The document summarizes several major industrial accidents and disasters: 1) The 1974 Flixborough disaster in England where a chemical plant explosion killed 28 people after a temporary pipe ruptured and ignited 40 tons of cyclohexane. 2) The 1979 Three Mile Island nuclear accident in Pennsylvania where a partial nuclear meltdown occurred due to failures in the cooling system. 3) The 1986 Space Shuttle Challenger disaster where the shuttle broke apart 73 seconds into launch due to an O-ring failure, killing all 7 crew members. 4) The 1986 Chernobyl nuclear accident in Ukraine where a reactor explosion released radiation due to operator errors during a safety test, contaminating a large area.

1. INCIDENTS AND
ACCIDENTS

2. Flixborough Disaster, 1974
• An explosion at a
chemical plant owned
by Nypro (UK) Ltd.
• Occurred in
Flixborough, England on
Saturday, 1st June 1974
at about 4.53pm.
• The plant has been in
operation since 1967.

3. Flixborough Disaster, 1974
• A temporary pipe containing
cyclohexane (Raw material for
manufacturing caprolactam
which is used for
manufacturing Nylon-66)
caught on fire and burst.
• The blast was equivalent to 5
tons of TNT.

5. The Disaster
• Cyclohexane was
discovered to be
leaking from Reactor
No.5
• Temporary bypass
assembly was
constructed to connect
Reactor No.4 and No.6

6. The Disaster
• At 4.53pm on 1st June
1974, the temporary
bypass pipe ruptured.
• About 40 tones of the
cyclohexane leaked
from the pipe and
ignited.
• 28 people were killed
• 36 peoples were
seriously injured.

7. Three Mile Island, 1979
• March 28, 1979 – 4 AM
Minor malfunction caused
the second reactor to shut
down almost immediately.
A relief valve was supposed
to close, but it did not,
contrary to what the
instrumentation showed.
Operators struggled to
determine the problem and
an appropriate solution
After almost 16 hours and
the collaboration of 60 or
more people, the situation
was under control.

8. Flowsheet

9. The Accident
• Partial core meltdown as the result of a LOCA ( Loss of Coolant
Accident)
• Main feed water pumps failed, triggered a controlled shutdown,
• But the decay heat (heat generated by the decay of radioactive
material in the fuel) continued, with nothing to remove it
• Auxiliary systems could not pump water, as their valves had
been closed for maintenance.
• Pressure built up, which was released by a PORV valve (Pilot-
operated relief valve) which opened automatically, but failed to
close. This allowed coolant water to escape.

10. Sequence of Accident

11. Space Shuttle Challenger, 1986
• Space Shuttle Challenger
was second reusable orbiter
of NASA's space shuttle
program
• Disaster occurred on
January 28, 1986
• Challenger Broke apart 73
seconds into its flight and
exploded in midair
• Which led the deaths of its
all seven crew members

12. Space Shuttle
The Space Shuttle orbiter was the
reusable spaceplane component of
the Space Shuttle
Orbiter is attached to the large
External Tank—the middle cylinder
with the sharp-pointed end shown
in the figure; the external Tank
contains 143,000 gallons of liquid
oxygen and 383,000 gallons of
liquid hydrogen for the Orbiter's
engines.
The two smaller cylinders on the
sides of the External Tank are the
Solid Rocket Boosters (SRBs).

13. What Happened?
• Disintegration of the vehicle
began after an O-ring seal in its
right SRB failed at liftoff.
• The O-ring failure caused a
breach in the SRB joint it sealed,
allowing pressurized burning gas
from within the solid rocket
motor to reach the outside
external fuel tank.
• This led to the separation of the
right-hand SRB's aft field joint
attachment and the structural
failure of the external tank.

14. • Tank exploded and
aerodynamic forces
broke up the orbiter.
• Loss of 7 astronauts
(entire crew)
• Loss of Challenger
• Over the Atlantic
Ocean, off the coast of
Cape Canaveral,
Florida
What Happened?

15. What Failed?
• O-rings were designated as "Criticality 1"—
meaning that their failure would result in the
destruction of the Orbiter
• Joint rotation phenomenon: O-ring joints were
supposed to close more tightly due to forces
generated at ignition, but due to the effects of
booster combustion, the metal parts bent
away from each other, opening a gap through
which gases leaked
• First and Second(safety backup) O-ring seals
both failed to prevent the leak
Simplified cross section of the
joints
between SRB segments.
Legend:
A - steel wall 0.5 inches
(12.7 mm) thick
B - base O-ring gasket,
C - backup O-ring gasket,
D - Strengthening-Cover band,
E - insulation,
F - insulation,
G - carpeting,
H - sealing paste,
I - fixed propellant

16. Why did it happen?
• SRB temperatures below their redline of 40 °F
(4 °C).
• The temperature on the day of the launch was far
lower than had been the case with previous
launches: below freezing at 28 to 29 °F (−2.2 to
−1.7 °C)
• O-rings were not tested at temperatures below
50 °F (10 °C).
• Causing the O-rings to harden
• Opening a gap through which hot gases—above
5,000 °F (2,760 °C)—leaked
• Right SRB producing a propulsive force that
rammed the hydrogen tank into the liquid oxygen
tank

17. • The astronauts: seven crew members, which included five NASA astronauts and
two Payload Specialists. One of the Payload Specialist Christa McAuliffe, who
would have been the first schoolteacher in space.

18. Chernobyl, 1986
The Chernobyl disaster was a nuclear reactor accident in
the Chernobyl Nuclear Power Plant in the Ukraine, which
used to be a part of the Soviet Union.
• April 26, 1986:
• Chernobyl nuclear power plant
• Operator errors cause a reactor explosion
• Explosion releases 190 tons of radioactive gasses into the
atmosphere
• Fire starts that lasts 10 days
• People:
• 7 million lived in contaminated areas; 3 million were
children
• Wind:
• Carries radiation far distances

19. Reactor Plant Scenario
• As the reaction occurs, the
uranium fuel becomes hot.
• The water pumped through
the core in pressure tubes
removes the heat from the
fuel.
• The water is then boiled into
steam.
• The steam turns the
turbines.
• The water is then cooled.
• Then the process repeats.

20. What Happened?
Saturday, April 26, 1986
• Reactor No.4 was undergoing a
test to test the backup power
supply in case of a power loss.
• The power fell too low, allowing
the concentration of xenon-135
to rise.
• The workers continued the test,
and in order to control the rising
levels of xenon-135, the control
rods were pulled out.

21. What Happened?
• The experiment involved shutting down the
coolant pumps,
• Which caused the coolant to rapidly heat
up and boil.
• Pockets of steam formed in the coolant
lines. When the coolant expanded in this
particular design, the power level went up.
• All control rods were ordered to be inserted.
As the rods were inserted, they became
deformed and stuck. The reaction could not
be stopped.
• The rods melted and the steam pressure
caused an explosion, which blew a hole in
the roof. A graphite fire also resulted from
the explosion.

22. Immediate Impact
• 203 people were hospitalized
immediately. 31 of them
eventually died. Most of these
people were workers in the
plant or local firefighters.
• NW winds from the Black Sea
carried the radiation for miles
in the following days.
Scandinavian detectors picked
up on the abundance of
radiation, but the Soviet
government denied
everything.

23. King’s Cross Underground Fire, 1987
• November 18, 1987
• Large flashover fire on an
escalator
• Killed 31 people
• Injured more than sixty
• Result of many safety hazards
• Aftermath of fire included
implementation of numerous
safety regulations

24. Existing Hazard
• Old wooden escalators
• Dirty running track (grease,
hair, paper, etc.)
• Toxic paint
• Smoking ban consistently
ignored
• 46 similar small fires in
about 30 years
• 32 result of careless
smoking
• No assigned safety personnel
• No safety procedures

25. Time Line
• 7:25 p.m. Fire started
• 7:30 p.m. Fire reported
• 7:39 p.m. Police began evacuating
passengers through escalators
• 7:40 p.m. Trains ordered not to stop at
King’s Cross
• 7:43 p.m. Fire engines arrived on site
• 7:45 p.m. Large flashover occurred
• 7:46 p.m. Full evacuation from station
ordered
• 1:46 a.m. Fire extinguished

26. Why Did It Happen?
• Buildup of grease and hair allowed
fire to ignite and spread
• Containment of escalator guided
flames like a trench, causing
overheating and flashover
• Smoke was clean until reaching
toxic ceiling paint
• Particular combination of
circumstances led to the trench
effect

27. Lessons Learned
• Wooden escalators replaced with all-steel ones
• Smoking banned again
• Sale of smoking materials in station banned
• Installation of sprinklers and heat detectors in
escalators
• Non-executive director of safety
• Mandatory safety training for staff
• Public telephones, radios, and televisions put in place
• Paint restrictions

28. THE HERALD OF FREE ENTERPRISE TRAGEDY,
1987
• The MS Herald of Free Enterprise was one of three
vessels built by Schichan Uterwaser AG.
• On March 6th, 1987 she left on a non-routine
voyage between Zeebrugge, Belgium and Dover,
England.
• The vessel was laden with 80 crewmembers,
approximately 459 passengers, 81 passenger cars
and 47 freight vehicles.
• When the ferry reached 18.9 knots (35.0 km/h;
21.7 mph) 90 seconds after leaving the harbour,
water began to enter the car deck in large
quantities. The resulting Surface free effect
destroyed her stability.

29. The Accident
• The vessel was under command of captain David Lewry.
• Started the voyage in fair conditions, leaving the mouth of the harbour at
6:24 pm
• As the vessel accelerated to cruising speed water flowed over the hull’s
bow and through the open loading gates subsequently causing a free surface
effect on the main vehicle deck.
• The rapid capsizing resulted in at least 193 passengers and 38
crewmembers to perish in the frigid water.
• However more lives would have been lost if the vessel did not happen to
come to rest on a sand bank which prevented a complete capsizing and left
it in a ninety degree heeled position.

30. Investigation
• loading gates were left open upon
departure from the port of Zeebrugge.
• Human error caused this mistake to
occur and when the open gates were
complimented with the other
circumstances created on March 6th, a
catastrophe was unavoidable that
evening.
• The assistant Bosun on duty was asleep
when the call went out to indicate that
the vessel had dropped her moorings
and was beginning its voyage.

31. • Complimenting this mistake was the fact that the first officer at
the time of the call, had returned to the wheelhouse in an
attempt to speed up departure.
• The status of the loading or unloading gates could not be
physically observed from the wheelhouse therefore no form of
mechanical redundancy existed that could compliment the human
communication
• It was determined that the Herald was also a victim of ship squat
during its acceleration period
Investigation

32. Investigation
• Squat:- When a vessel travels in shallow water, low pressure is
created between the surface of the hull and seabed due to the
higher velocity of water surrounding the ship. This low-pressure
field under the boat causes the draft to increase or in other words
squat
• In the case of the Herald, because it was travelling over a sand
bank, a low-pressure area was created and the freeboard of the
bow was even less than anticipated when the crew took into
account the partially full bow ballast tanks.

33. Causes of Accident
• Poor communication at all levels in the hierarchy
• Failure to empty the ballast tanks prior to departure
• Rejection at board level of the proposal to install a warning light
on the bridge
• Hydrodynamic factors
• Bow wave above 18 knots
• ‘Squat effect’ in shallow water

34. The Role of Human Failure In Accidents
• The actions of people account for 96% of all injuries” – (DuPont)
• “80-90% of accidents are due to human error” (Heinrich et al, 1980)
• “50-90% of accidents according to statistics are due to human
failings” – Kletz (1990)
• “We seem to have passed the era where the need was for further
engineering safety guards….What we have to do is to capture the
Human Factor”

35. Human Factors
“Human factors refer to
environmental,
organisational and job
factors, and human and
individual
characteristics, which
influence behaviour at
work in a way which can
affect health and safety”

36. The Job Factor
• Including areas such as the nature of the task, workload,
the working environment, the design of displays and
controls, and the role of procedures.
• Tasks should be designed in accordance with ergonomic
principles to take account of both human limitations and
strengths. This includes matching the job to the physical
and the mental strengths and limitations of people.

37. The Job Factor
1) Clarity of signs, signals, instructions and other information
2) System/equipment interface (labelling, alarms, error
avoidance/ tolerance)
3) Difficulty/complexity of task
4) Routine or unusual
5) Divided attention
6) Procedures inadequate or inappropriate
7) Preparation for task (e.g. permits, risk assessments,
checking)

38. The Individual Factors
• Including his/her competence, skills, personality,
attitude, and risk perception.
• Individual characteristics influence behaviour in complex
ways. Some characteristics such as personality are fixed;
others such as skills and attitudes may be changed or
enhanced.

39. The Individual Factors
1) Physical capability and condition
2) Fatigue
3) Stress/morale
4) Work overload/underload
5) Motivation vs. other priorities
6) Competence to deal with circumstances

40. The Organizational Factors
• Including work patterns, the culture of the
workplace, resources, communications,
leadership and so on. Such factors are often
overlooked during the design of jobs but have a
significant influence on individual and group
behaviour.

41. The Organizational Factors
1) Work pressures e.g. production vs. safety
2) Communication
3) Manning levels
4) Peer pressure
5) Consequences of failure to follow
6)rules/procedures
7) Clarity of roles and responsibilities
8) Staffing

42. Types Of Human Failure
Human
failure
Error
Action Error
Action
Based-Slips
Memory
Based-
Lapse
Thinking
Error
Rule Based
Mistake
Knowledge
Based
Mistake
Violation
Routine Situational Exceptional

43. Types Of Human Failure
Errors
•An action or decision
which was not
intended
Violations
•A deliberate
deviation from a rule
or procedure

44. Action Error- Skill Based
Slips (Commission) Lapse (Omission)
A simple, frequently-performed physical
action goes wrong
• Flash headlights instead of operating
windscreen wash/wipe function
• Move a switch up rather than down
(wrong action on right object)
• Take reading from wrong instrument
(right action on wrong object)
Short-term memory lapse; omit to perform
a required action
• Forget to indicate at a road junction
• Medical implement left in patient after
surgery
• Miss crucial step, or lose place, in a
safety-critical procedure
• Drive road tanker off before delivery
complete (hose still connected)

45. Thinking Error- Do the wrong thing believe it
to be right
Rule-Based Mistake Knowledge-Based Mistake
If behaviour is based on remembered
rules and procedures, mistake occurs
due to mis-application of a good rule
or application of a bad rule
• assume £20 fuel will last a week but
fail to account for rising prices.
• Ignore alarm in real emergency,
following history of spurious alarms.
Individual has no rules or routines
available to handle an unusual
situation: resorts to first principles
and experience to solve problem.
• Rely on out-of-date map to plan
unfamiliar route.
• Misdiagnose process upset and take
inappropriate corrective action (due
to lack of experience or insufficient
/ incorrect information etc.).

46. Violations- A deliberate deviation from a rule
or procedure
Routine Situational
Non-compliance becomes the ‘norm’;
general consensus that rules no longer
apply; characterised by a lack of
meaningful enforcement:
• High proportion of motorists drive at
80mph on the motorway
• PTWs routinely authorised without
physical, on-plant checks
Non-compliance dictated by situation-
specific factors (time pressure;
workload; unsuitable tools &
equipment; weather); non-compliance
may be the only solution to an
impossible task:
• Van driver has no option but to speed
to complete day’s deliveries.

47. Violations- A deliberate deviation from a rule
or procedure
Exceptional
Person attempts to solve
problem in highly unusual
circumstances (often if
something has gone wrong);
takes a calculated risk in
breaking rules:
• After a puncture, speed
excessively to ensure not late
for meeting

48. The consequences Of Human Failure
Active Failure Latent Failure
Active failures have an immediate
consequence and are usually made by
frontline people such as drivers,
control room staff or machine
operators.
• In a situation where there is no
room for error these active failures
have an immediate impact on health
and safety. t
Latent failures are made by people
whose tasks are removed in time and
space from operational activities.
• Poor design of plant and equipment
• Ineffective training
• Inadequate supervision
• Ineffective communications
• Uncertainties in roles and
responsibilities

49. BP-Texas City Refinery Accident, 2005
• Industry name :- British
Petroleum oil refinery
• When:- March 23rd , 2005
• Where :- Texas, USA
• Time :- Between 12:30 pm to 1
pm
• Deaths :- 15
• Injuries:- 170
• Reason:- A hydrocarbon vapor
cloud exploded at the ISOM
isomerization process unit

50. The Active Failure
• Required pre-start actions not completed
• Pre-Startup Safety Review not performed
• Key malfunctioning instrumentation not repaired
• Malfunctioning pressure control valve not repaired -- supervisor signed
off on startup procedure that control valves had tested satisfactorily
• Functionality checks of alarms and instruments not completed
• Night Lead Operator did not use startup procedure or record completed
steps when startup was partially completed on night shift
• Night Lead Operator left an hour before end of shift

51. The Active Failure
• ISOM-experienced Day Supervisor A arrived over an hour
late - did not conduct shift turnover with night shift
personnel
• Day Board Operator closed automatic tower level control
valve – although procedure required valve to be placed in
“automatic” and set at 50 percent
• Day Supervisor left the plant due to family emergency as
unit was being heated

52. The Latent Failure
• Work environment encouraged procedural noncompliance
• Ineffective communications for shift change and
hazardous operations (such as unit startup)
• Malfunctioning instrumentation and alarms
• Poorly designed computerized control system
• Ineffective supervisory oversight
• Insufficient staffing
• Lack of a human fatigue-prevention policy

53. The Latent Failure
• Inadequate operator training for abnormal and startup
conditions
• Failure to establish effective safe operating limits
Ineffective incident investigation management system
• Ineffective lessons learned program
• No coordinated line management self-assessment process
• No flare on blow down drum
• No automatic safety shutdown system
• Key operational indicators and alarms inoperative

54. Human Failures Involved
in Accidents
Flixborough Disaster, 1974
Three Mile Island, 1979
Space Shuttle Challenger, 1986
Chernobyl, 1986
King’s Cross Underground Fire, 1987

55. Flixborough Disaster, 1974
Staffing • The works engineer had left early in the year and had
not yet been replaced.
• At the time the bypass line was being planned and
installed, there was no engineer on site with the
qualifications to perform a proper mechanical design,
or to provide critical technical review on related
issues. There were chemical and electrical engineers
on staff, but no other mechanical engineers.

56. Flixborough Disaster, 1974
Lack of
Hazard
Identification
• In the opinion of the investigators, the urgency to resume
production distracted staff from the sort of critical consideration
of their plans that could have identified the hazards involved
(i.e., they did not intentionally establish an unsafe condition
but, rather, failed to fully assess the significance of what they
were doing).
Work Load • The fact that the works manager position was vacant also shifted
workload to remaining staff, contributing to the distractions
discussed above. The report implies that company management
was not aware of the effect of the short staffing on the
performance of the facility staff involved in the modification.

57. Flixborough Disaster, 1974
Lack of
Knowledge
• While calculations were made to confirm that the 20-inch pipe could
withstand the normal working pressure, no consideration was given to the
bending moments or hydraulic thrusts that would be imposed on the assembly
due to its dogleg configuration . There was no reference made to vendor
manuals for the expansion bellows, nor to relevant British Standards.
Lack of
Quality
Assurance
• There were no quality assurance checks made on the fabrication or
installation of the assembly other than a leak check at approximately 130 psi
(for comparison, the relief valves [RVs] on the reactor system were set to
open at approximately 155 psi). Applicable British Standards required that the
assembly be tested at a pressure of 1.3x 105 the system design pressure,
which would have been above the RV set pressure.

58. Three Mile Island, 1979
Lack of
Knowledge
• The event that occurred in 1979, caused by two workers who
made a mistake cleaning valves with air pressure hoses,
resulted in much change for nuclear safety in the world.
Lack of
Training
• Workers in the control room faced a situation that they had not
prepared for in any of their training, and were forced to make
decisions on the spot. Additionally, there were flaws in the
control panel that caused the workers to be unaware that a
valve had been left open.

59. Three Mile Island, 1979
Design
Deficiencies
• The loss of normal feed water which is an anticipated
operating occurrence leads to the opening of the pressurizer
relief valve which is an other anticipated operating
occurrence;
• A break in the steam phase of the pressurizer is not
considered. There is no procedure to identify and manage
this event and the operating staff is not trained for it;
• The actuation of the emergency core cooling system does not
actuate a complete containment building isolation.

60. Three Mile Island, 1979
Multiple latent
deficiencies
(organization, m
aintenance,
quality, ...
• The pressurizer relief valve had been known to be leaking for a
while but the repair work was postponed so increasing the
probability of a jammed open valve and depriving the
operators of a way to identify the valve situation: the
temperature of the pressurizer relief line;
• The closed connecting valves of the steam generators auxiliary
feed water system added a complete loss of feed water system
to the complete loss of emergency core cooling system and
focused the attention of the operating team;
• An effluent tank was leaking;
• The iodine filters in the auxiliary building had poor efficiency.

61. Space Shuttle Challenger,1986
Inadequate
Design
• The O-Ring was a rubber seal component in the solid rocket booster (SRB),
its purpose was to stop leaks. Due to extremely cold temperature on the
day of launch, the O-Ring lost its elastic property and became brittle
(inflexible), allowing a leak and resulting in explosion.
lack of
understanding
• During the conference call with the management team and the
engineering team, the management team did not seem to understand
that a failure in the O rings system would result into fatalities and the
engineers also did stand against the launch and refusing that the launch
would take place as the life of 7 astronauts have a very big chance of
being lost they issued a recommendation that the launch shouldn’t
happen, instead of recommending they should of used another world in
order to express the severity of the problem

62. Space Shuttle Challenger,1986
Faulty
Judgement
• managers decided to launch despite record low temperatures
and ice on launch pad
Management
Problems
• NASA managers had known since 1977 that the design of the
SRBs contained a potentially catastrophic flaw in the O-rings,
but they had failed to address this problem properly.
• NASA managers also disregarded warnings from engineers
about the dangers of launching posed by the low temperatures
of that morning, and failed to adequately report these
technical concerns to their superiors.

63. Chernobyl, 1986
Wrong
Procedure
• Correct procedure was down the reactor to 700-MW but it
was down to 200 MW. At this Power reactor became unstable.
Lack of
Knowledge
• Operator error was probably due to their lack of knowledge
of nuclear reactor physics and engineering, as well as the
lack of experience and training. Personnel had an
insufficiently detailed understanding of technical procedures
involved with the nuclear reactor, and knowingly ignored
regulations to speed test completion

64. Chernobyl, 1986
Inadequate
Design
• The reactor had a dangerously large positive void coefficient.
The void coefficient is a measurement of how a reactor
responds to increased steam formation in the water coolant.
Most other reactor designs have a negative coefficient, i.e.
the nuclear reaction rate slows when steam bubbles form in
the coolant, since as the vapor phase in the reactor
increases, fewer neutrons are slowed down. Faster neutrons
are less likely to split uranium atoms, so the reactor
produces less power (a negative feed-back)

65. King’s Cross Underground Fire, 1987
Lack of
Training
• The staff was not properly trained for emergency fire.
• Many times fire had been detected most of time due to
smokers, dropping cigarette butts and matches.
Unclean
Escalators
• Lack of cleaning of wooden escalators causes flammable
mixture of lubricating oil and dirt ( tickets, hair, Pouches)
• This flammable mixture got ignited due to smokers cigarette
butts.

66. King’s Cross Underground Fire, 1987
Design of
Escalators
• Wooden escalators ignited quickly.
• Inclination of Escalators help in Trench effect.
• No fire detection system was present.