The Loch Ness Monster and Plant Safety

Martin Pitt recalls his time spotting monsters, and warns that just because they are hard to spot, it doesn’t mean death and destruction aren’t around the corner

IN THE late sixties I spent two weeks each summer with the Loch Ness Investigation Bureau, a body set up to investigate the possibility of a large unknown animal or animals existing in the Scottish loch  (we were volunteers who paid a subscription and our own costs).  

Manning stations along the loch with cine cameras and powerful lenses, during photographic daylight, we were trying to get film of these reputed creatures (I filmed a floating oil drum and was congratulated for shooting first and asking questions 20 seconds later).

It is my view that the amount of watching over several years meant that these animals would have been seen and filmed. The occasional reports from the public are generally misidentification of other things, most of which I have seen and recognised. Major sonar studies did not provide any proof, leaving me to conclude that at the time there were no animals larger or more unusual in there than otters. For more on my assessment, see Should We believe in the Loch Ness Monster?

Now imagine you are in a safe plant and industry, where incidents are rare. Yet you are supposed to be on the lookout for hazards all the time. Hazards which may not even be there. Not for two weeks, but for years. People who have never seen an incident, or even known someone who has, will have difficulty believing in them. Fire drills and safety procedures may seem a waste of time. Do we really need to spend all that money on safety?

It is the natural reaction to assume that what you notice has some innocent explanation. “It’s probably just something to do with the contractors/burnt toast in the canteen/rainwater etc.” It is also the natural reaction not to want to make a fuss or cry wolf when you do see something. And with good reason, because people can get annoyed if you do, and it can affect your career. If a hazardous situation arises, will you recognise it at all? How quickly will you react? Have the designers and management understood the magnitude of the danger?

The monster that escaped from its pen

On 22 March 1974, a bill now known as The Health and Safety at Work Act 1974 (HSaWA) was introduced into Parliament. It had been in planning for two years, with little public discussion.

Then on 1 June, a major leak of hot pressurised cyclohexane vapour ignited at the Nypro works in the village of Flixborough, North Lincolnshire, resulting in an explosion which killed 28 workers onsite, severely injuring 36 others. In addition, 53 people were injured offsite, and buildings badly damaged. It had been generally accepted that many workplaces were dangerous, and employers had accepted some responsibility for the safety of their employees, but now this monster had reached far beyond the plant walls – a horrifying idea, considering the number of industrial establishments with large amounts of flammable material. I remember the shock of the chemical and chemical engineering community.

On 31 July, the bill received Royal Assent, becoming law on 1 October 1974. On the same day, the body appointed to oversee it, the Health and Safety Commission (HSC), had its first meeting. This set up an operating body, the Health and Safety Executive (HSE), on 1 January 1975. IChemE presidents John Cullen and Judith Hackitt both served as chairs of the HSC. In 2008, the HSC merged with the HSE to become one statutory body, with Hackitt as its first chair.

For the first time, employers had a duty to protect people other than employees and a much stronger requirement to safeguard those at work. By the time the HSC and HSE merged, injuries and deaths at work in the UK had both dropped by three-quarters. I believe that public shock at the Flixborough tragedy meant that the powers given and government support for these bodies and their activities were much greater than they would otherwise have been.

As a complementary factor, hazard and operability studies (HAZOP) had been developed by ICI and published for the first time in 1974. This was particularly relevant to situations such as occurred at Flixborough for studying the dangers of plant modifications. It was included in an IChemE course led by Trevor Kletz at Hull which received a flurry of applications, and HAZOP soon became part of the syllabus in UK chemical engineering degrees. I have no doubt that there was a major improvement in chemical engineering safety in UK companies. By contrast, Flixborough had little impact in the US, and HAZOP remained relatively unknown for many years.

The monster that came to stay

On 10 July 1976, a reactor making a common disinfectant, trichlorophenol (TCP), overheated. The secondary safety equipment performed as designed and it did not explode. No one died. No one was injured. This was at Seveso, in Italy. In preventing the explosion, the reaction mixture was vented and deposited over the town. As a result, people developed delayed skin damage called chloracne, to be expected from the corrosive components. It was later discovered that the higher temperature had resulted in the formation of a more complex compound tetrachloro-dibenzo-p-dioxin (TCDD). This is a highly persistent toxin, giving long-term effects on humans and animals. As well as compensating the people affected, the company had to remove large amounts of soil and other material. The monster of environmental contamination can be a very expensive one.

In 1982, the European Union passed the Seveso Directive requiring environmental risk to be taken into account when authorities give permission to develop a plant. It was implemented in the UK by the Control of Major Accident Hazards (COMAH) regulations, which still apply.

The biggest monster yet

On 3 December 1984 in a plant near Bhopal, India, failure to isolate during routine pipe washing resulted in water getting into a tank of methyl isocyanate (MIC). The two materials reacted, and pressure built up, causing a relief valve to open. Fortunately, the designers had anticipated this possibility, and the vent directed the vapours to a caustic scrubber tower and flare stack. A refrigeration system was fitted to keep the MIC cool, with sufficient capacity to overcome the exotherm, and thus limit the rate of release, allowing time to stop the cause. A duplicate cooling system was there in case of failure.

Sadly, management had decided to save money by not operating the refrigeration, so the refrigerant had been removed from both units the previous June and sent to other plants. The scrubber tower and flare were also out of use, so the vapours went out into the open. Thousands died and many more suffered long-term health problems.

The plant had been built in 1969, before HAZOP and inherent safety were known, but the design engineers believed in the monster and included measures to prevent and mitigate a release. The operating management did not, and as a result, the plant was run with critical safety systems off, making the incident very much worse than it should have been. The tank was also 80% full instead of the designed 50%, and there was no offsite alarm or emergency plan to notify local authorities how to protect people.

The monster that was not allowed to exist

On 26 April 1986, number 4 nuclear reactor at Chernobyl, in the Ukrainian Soviet Socialist Republic, exploded, resulting in the worst nuclear accident in history, with many deaths and widespread dissemination of radioactive particles across Europe.

The design of reactor, by far the biggest in the world, was a Soviet triumph in 1968. The problem was this: to suggest that Soviet design, fabrication, or operations had any weaknesses was considered an attack on the USSR and was strongly resisted. The ultimate weakness was the lack of a full containment vessel, as used by other countries. This made it easier, cheaper, and quicker to build, with less skilled factories. The fundamental justification was that the accident requiring containment just could not happen. The monster might roam the West, but not the USSR.

For the same reason, there was a very poor safety culture and lack of communication. In addition, the authorities initially refused to accept the seriousness of the situation. It was only after this incident that some flaws in the design and operating procedures were corrected in Soviet nuclear power stations.

The Fukushima nuclear accident on 11 March 2011 shows the same denial, but for a different reason. The regulators and companies supposed to protect the population had made themselves very rich, but totally failed to provide an adequate safety response in what has been called “a network of corruption, collusion, and nepotism” by Richard Tanter, a senior research associate at the Nautilus Institute.

The monster they thought they could deal with

On the late evening of 6 July 1988, a fire started on the Piper Alpha oil and gas production platform in the North Sea. The following morning a meeting of the IChemE Safety and Loss Prevention Subject Group was abandoned to follow the tragic events. A total of 167 people lost their lives. Piper Alpha was actually the largest unit of its kind in the world, handling 10% of North Sea oil. A court case ruled that two of the workers who died were responsible.

The main cause of loss of life was actually having 228 people in accommodation on top of this potential bomb. It is difficult to understand today how the company and the regulators allowed it. However, I worked with the oil industry during my PhD and noted a somewhat gung-ho attitude by some. They were proud of the danger, and the heroic tactics they took when things went wrong in any way.

The accommodation was fire-proofed, and there were other features designed to deal with fires, but insufficient for explosions. Firewater pumps could have saved the structure from collapse but did not come on automatically in case there was a diver below so never operated. It is clear the people in charge believed they could deal with a monster which was vastly bigger than they could imagine.

The monster that couldn't happen

Flixborough occurred when hot hydrocarbon vapour produced a detonation (explosion with shock wave) rather than deflagration (fireball). However, it was agreed by experts that this could not happen with cold petrol. Nevertheless at 03:00 on a cold December morning in 2005, Hertfordshire was shaken by a blast measuring 2.4 on the Richter scale, damaging buildings 8 km away. The Buncefield oil storage depot had allowed 185 tonnes of petrol to overflow. Fortunately, few people were at work, and none died, though 40 were injured and the damage cost £1bn (US$1.28bn). Theoretically it couldn’t happen with the academic models of a leak in infinite space, but this happened in an area surrounded by tanks, which Trevor Kletz suggested in 1986 (TCE) made it possible. Though it was reported as “unprecedented”, this was only in the UK. In 1983, overfilling of petrol tanks in New Jersey, US, had led to an explosion heard 100 miles away, and there had been comparable incidents in France and Italy.

Moreover, even without detonation, the site design, instruments, bunds, and management were insufficient to guard against a really large petrol fire. So many people did not believe the scale of the danger.

The monster that nearly had me

On Friday 21 September 2001, I was getting ready to go to Toulouse for a committee meeting of the Working Party on Education (WPE) of the European Federation of Chemical Engineering (EFCE) the next day. However, I got a phone call that the meeting would have to be cancelled because the department of chemical engineering and most of the university had been destroyed in an explosion. If it had happened a week later it would have been full of students, so the death toll would have been much higher. The cause was some 300 tonnes of off-specification ammonium nitrate fertiliser in store on the adjacent AZF industrial site. The explosion was equivalent to 30 tonnes of TNT and a shock of 3.4 on the Richter scale, the largest in Europe since the second world war. Thirty people were killed, nine offsite, and thousands injured across the city. Around 27,000 houses were damaged, along with schools, three of which had to be rebuilt. Rebuilding the university cost €58 billion, while €3 billion in compensation was paid to victims.

It was not the first accidental ammonium nitrate explosion. Precisely 80 years earlier on 21 September 1921 in Oppau, Germany, one killed 507 people, injured nearly 2,000, and destroyed 700 houses. On 17 April 1947, a ship, the SS Grandcamp, containing the fertiliser exploded on the docks in Texas City, US, and set off another ship, killing 500 people and injuring 3,500. Then in 2001 there was Toulouse but being ten days after the 9/11 attack it received little media attention outside France.

And it was not the last. On 17 April 2013 the state of Texas had another ammonium nitrate explosion killing 15 people, injuring 260, and damaging 150 buildings at the West Fertilizer Company in the city of West. On 12 August 2015 in Tianjin, China, an explosion of nitrocellulose set off 800 tonnes of ammonium nitrate, resulting in 173 deaths and 798 injuries. On 4 August 2020, the city of Beirut, Lebanon suffered one of the most powerful non-nuclear explosions in history, as 2,750 tonnes of badly stored and deteriorated ammonium nitrate gave a blast equivalent to 1,000 tonnes of TNT, killing 218, injuring 7,000 and making 300,000 homeless.

There have been other ammonium nitrate explosions, but these are the really monster ones. Despite warnings from history, they happen again and again.

Going back to Toulouse, the AZF Seveso assessment did not include a scenario of ammonium nitrate explosions. The amounts stored together were far greater than considered good practice. The factory had actually been built well away from the city in 1930 (probably in light of Oppau), but the city had grown. The university had doubtless taken advantage of cheaper land near an industrial site. It is clear neither the university nor their neighbour properly realised the monster they had ready to be released.

The monster that cost me my job

I was a project chemical engineer, told to assess a proposal for an additional plant on an existing site. My conclusion was: “This plant can be operated safely or profitably, but not both.”

My boss tore me off a strip, saying “I’m not having you telling me what decision I should make”. Subsequent events included me being made redundant (two weeks before I would have been entitled to compensation), the plant being built without my safety proposals, and a serious fire not long after. It involved ether, a highly flammable liquid, being brought on to a site unused to such things. They built the plant to their budget which excluded what I thought was necessary modifications to the surrounding area. In addition, the workforce was lacking experience of flammable vapour so did not properly appreciate the hazard. A leak occurred, was ignited and there was considerable financial loss, though fortunately no deaths. Flammable vapour can become a huge and destructive monster.

By contrast, with another company, I was hired to oversee the final construction, commissioning, and initial running of a plant. In later life, I occasionally returned. One day it was gone, having been replaced by a different development. It had had its life and had not needed various design features and equipment there in case of emergency. The money that could have been saved…

This is the tragedy of safety engineering. When it is successful, nothing happens. People see the expense and the inconvenience but not the monster which never surfaced. In a safe workplace or industry, they may have difficulty even believing in the hazard, and may not recognise it until it is too late. The safer life is made, the less people understand dangers, and the less well they are prepared to react to it.

The Covid pandemic illustrated the problem. Because of vaccination and some luck, most people in the UK and many other countries had not experienced a lethal or crippling disease epidemic. However, the medical professionals knew it could happen (the 1918 influenza pandemic killed 50 -100 million people worldwide). A careful study was made and in 2016 a UK exercise was carried out which determined what would probably happen and the provisions and precautions which needed to be made for the next major pandemic. This included stocks of Personal Protective Equipment (PPE) and sufficient empty beds and intensive care facilities. In addition, it would be expected that a significant number of staff would be affected. Despite this warning the UK government made the decision not to spend money on the recommended stocks of PPE and continued its reduction in staff and beds. Furthermore, they (and others) refused to fully recognise the hazard when the pandemic began. As a result, preventable deaths occurred on a larger scale than any industrial incident.

This illustrates a common pattern for rare dangers. Top management, whether politicians, generals or CEOs often got there by taking risks and being lucky. They do not credit the luck, just their superior skills and judgment. When advised by experts of a rare but serious danger, they are reluctant to commit resources. If the danger appears, the first reaction is to deny or downplay it. Hence it gets worse, and action is delayed. Inadequate planning and resources are compounded with a refusal to recognise how big it can be, until even drastic measures are just mitigating (and usually far more expensive).

The longer we go without a disaster, the harder it is to persuade people to take action to prevent another, and to have arrangements to deal with it. The problem is that even if they have not been seen for a long time, these monsters, unlike Nessie, do exist and are far worse than people imagine.