In September 1998 Esso Australia’s gas plant at Longford in Victoria suffered a major fire. Two men were killed and the state’s gas supply was severed for two weeks, causing chaos in Victorian industry and considerable hardship in homes which were dependent on gas. What happened was that a warm liquid system (known as the “lean oil” system) failed, allowing a metal heat exchanger to become intensely cold and therefore brittle. When operators tried to reintroduce warm lean oil, the vessel fractured and released a large quantity of gas which found an ignition source and exploded. In what follows I shall trace the reasons for this event, relying on evidence provided to the Royal Commission which investigated the disaster. (For further details see Hopkins, 2000). Operator error? There is often an attempt to blame major accidents on operator error. This was the position taken by Esso at the Royal Commission. The company argued that operators and their supervisors on duty at the time should have known that the attempt to reintroduce a warm liquid could result in brittle fracture. The company claimed that operators had been trained to be aware of the problem and Esso even produced the training records of one operator in an attempt to show that he should have known better. However, the Commission took the view that the fact that none of those on duty at the time understood just how dangerous the situation was, which indicated a systematic training failure. Not even the plant manager, who was away from the plant at the time of the incident, understood the dangers of cold metal embrittlement. (Dawson, 1999:197). The Commission concluded that inadequate training of operators and supervisors was the “real cause” of the accident (Dawson, 1999:234). It is clear therefore that operator error does not adequately account for the Longford incident. This is a general finding of all inquiries into major accidents (Reason, 1997). Although the Commission spoke of inadequate training as the “real cause”, we are entitled to ask: “Why was the training so inadequate?” or more generally “Why were the operators and their managers so ignorant of the dangers?” And as soon as we ask these questions, a host of other contributory factors come into view. We need to uncover these more fundamental causes in order to identify the real lessons of Longford. The failure to identify hazards A major contributing factor was the fact that Esso had not carried out a critical hazard identification process, standard in the industry, know as a HAZOP (short for hazard and operability study, see Bahr, 1997). This procedure involves systematically imagining everything that might go wrong in a processing plant and developing procedures or
engineering solutions to avoid these potential problem. HAZOPs had been carried out on two of the three gas plants at the Longford refinery but not at gas plant one, the oldest of the three. A proposed HAZOP of this plant had been deferred indefinitely because of resourcing constraints. By all accounts a HAZOP would have identified the possibility of cold temperature embrittlement caused by a failure of the lean oil system. Even Esso’s parent company, Exxon, acknowledged that the failure to carry out this HAZOP was a contributing factor to the accident. The failure to identify this hazard meant that operating instructions made no mention of what to do in the event of lean oil failure and the result was that operators neither appreciated the seriousness of the problem when it arose nor knew how to handle it. In short, inadequate training was a consequence of inadequate attention by the company to hazard identification. The failure of the Safety Management System Audits The Royal Commission severely criticized Esso’s safety management system (OIMS) and the auditing of that system. “OIMS, together with all the supporting manuals,...