Analysis of underlying causes of investigated loss of containment incidents in Dutch Seveso plants using the Storybuilder method

• 118 Dutch major accident investigations at Seveso sites are analysed within a bow-tie model.
• The pattern of failures of barriers, barrier tasks and management delivery systems for each of 6 lines of defence is given.
• Dominant barrier failures were safeguarding failure, flow failure, recovery failure, containment bypass and shut-off failures.
• Management failed to deliver adequate equipment, procedures and competences for the provision and use of barriers.
• Results show the link between management, safety barrier tasks and the technical system of safety barriers for major hazards.

In the Netherlands there are around 400 “Seveso” sites that fall under the Dutch Major Hazards Decree (BRZO) 1999. Between 2006 and 2010 the Dutch Labour Inspectorate's Directorate for Major Hazard Control completed investigations of 118 loss of containment incidents involving hazardous substances from this group. On the basis of investigation reports the incidents were entered in a tailor-made tool called Storybuilder developed for the Dutch Ministry of Social Affairs and Employment for identifying the dominant patterns of technical safety barrier failures, barrier task failures and underlying management causes associated with the resulting loss of control events. The model is a bow-tie structure with six lines of defence, three on either side of the central loss of containment event. In the first line of defence, failures in the safety barriers leading to loss of control events were primarily equipment condition failures, pre start-up and safeguarding failures and process deviations such as pressure and flow failures. These deviations, which should have been recovered while still within the safe envelope of operation, were missed primarily because of inadequate indication signals that the deviations have occurred. Through failures of subsequent lines of defence they are developing into serious incidents. Overall, task failures are principally failures to provide adequate technical safety barriers and failures to operate provided barriers appropriately. Underlying management delivery failures were mainly found in equipment specifications and provisions, procedures and competence. The competence delivery system is especially important for identifying equipment condition, equipment isolation for maintenance, pre-start-up status and process deviations. Human errors associated with operating barriers were identified in fifty per cent of cases, were mostly mistakes and feature primarily in failure to prevent deviations and subsequently recover them. Loss of control associated with loss of containment was primarily due to the containment being bypassed (72% of incidents) and less to material strength failures (28%). Transfer pipework, connections in process plant and relief valves are the most frequent release points and the dominant release material is extremely flammable. It is concluded that the analysis of a large number of incidents in Storybuilder can support the quantification of underlying causes and provide evidence of where the weak points exist in major hazard control in the prevention of major accidents.