Journal of Loss Prevention in the Process Industries 18 (2005) 254260

www.elsevier.com/locate/jlp

Export inherent safety NOT risk

David W. Edwards*
Department of Chemical Engineering, Loughborough University, Loughborough LE11 3TU, UK

Abstract
The author presents a personal view that production of bulk chemicals and the attendant risks are being transferred from developed to
developing nations. Some evidence is presented on the transfer of production. The transferred risk is increased because of the larger scale
plants that are now built in locales that are less able to cope with the increased hazards. Bhopal was an example of an inherently unsafe plant,
with major hazards that could have been avoided or drastically reduced by design. It behoves the industry to adopt the inherently safer
philosophy and practice in the new plants that it builds, in order to minimise the opportunity for another accident like Bhopal and the threat to
our industry that such an accident would pose.
q 2005 Elsevier Ltd. All rights reserved.
Keywords: Bhopal; Chemicals production; Risk transfer; Inherent safety; Plant location

1. Introduction

1.1. Bhopal and inherent safety, hazard and risk

This paper presents a personal view about the current

development of the chemical industry, with increased-scale
bulk chemicals production appearing to be transferred from
developed to developing countries and with it the attendant
risks to people and the environment. I believe that this
export of risk is neither ethical nor good business.
Furthermore, it will not happen if we build inherently
safer plants that avoid or minimise the hazards.
The release of toxic gas/vapour at Bhopal in 1984
remains the worlds worst industrial accident, which
immediately killed about 8000 people and 12,000 thereafter.
The toxic material was emitted from a chemical plant that
was built and operated in a developing country by a
chemical company from the developed world.
The Bhopal accident should be an awful warning of what
can happen when dangerous chemicals are produced with
less care than ought to be exercised in a populous
developing country location. However, as Gupta (2003)
has noted, we seem to be doing our best to forget that it ever
happened.

The precise agent(s) that caused the deaths and injuries at

Bhopal is (are) still not widely known. What is certain is that
an unintended reaction in a large storage tank between about
40 tonnes of methyl isocyanate (MIC) and water caused
MIC and other chemicals to be released. However, the MIC
was neither a raw material nor a finished product, which
might have justified such storage, but it was an intermediate
in a sequence of reaction and process steps. As such it
should not have been stored and certainly not stored in such
large quantities. Furthermore, there is an alternative
reaction route to make the final product, carbaryl, which
uses the same raw materials as the Bhopal plant; this route
has been described by Kletz (1998). The same feedstocks
are reacted in a different order and MIC is not produced, see
Fig. 1. If this route had been used at Bhopal, there would
have been no MIC intermediate to escape and kill and maim
so many people. Thus, on a number of counts the Bhopal
plant was inherently unsafechoice of reaction route and
storage of large quantity of hazardous material being just
two. When the systems, or so-called layers of protection, in
place on the plant to control or mitigate the MIC hazard
were called upon to act they were either ineffective, disabled
or failed. Referring to Reasons, 1997 defence-in-depth
model and his Swiss cheese metaphor, some slices were
missing and the holes were lined-up in those that remained.
The conventional approach to ensure acceptable plant safety
by reducing risk did not work.

* Tel.: C44 1509 222515; fax: C44 1509 223923.

E-mail address: d.w.edwards@lboro.ac.uk.

0950-4230/$ - see front matter q 2005 Elsevier Ltd. All rights reserved.
doi:10.1016/j.jlp.2005.06.014

D.W. Edwards / Journal of Loss Prevention in the Process Industries 18 (2005) 254260

(a)
CH3OCN
+ 2HCl
Methyl Isocyanate
(MIC) +

CH3NH2
+ COCl2
Methylamine +
phosgene
R1

R2

STEP 1

40 tons
OCONHCH3

OH
CH3OCN

MIC

-naphthol

carbaryl

R3

I
Raw material

STEP 2

Intermediate

Product

(b)
OCOCl

OH
COCl2

+
-naphthol +

phosgene

R3

chloroformate
I

R2

OCOCl
+
chloroformate +
I

CH3NH2
methylamine
R1

HCl

HCl
STEP 1

OCONHCH3
+ HCl
carbaryl
P

HCl

STEP 2

Fig. 1. The Bhopal plant chemistry and an alternative route to the product,
carbaryl, that does not make methyl isocyanate (MIC). (a) The reaction
route used at the Bhopal plant. (b) Alternative route, using the same raw
materials (R1, R2, R3), that des not make the MIC intermediate (I).

I use the following definitions of hazard and risk that are

widely used in the process industries and described in Jones
(1992).
Hazarda physical situation with potential for human
injury, damage to property, damage to the environment
or some combination of these.
Riskthe likelihood of a specified undesired event
occurring within a specified period or in specified
circumstances. It may be either a frequency (the number
of specified events occurring in unit time) or a
probability (the probability of a specified event following
a prior event), depending on the circumstances.
In an inherently safeR (nothing can ever be absolutely
safe) plant the hazards have been identified early and
avoided or minimised by design. Therefore, an inherently
safer plant design usually minimises risk as well.
Conventional plant design accepts some hazards. Added
protective systems reduce the risk of realisation of these
hazards to an acceptable level. Mitigating systems reduce
the severity of the consequences of realisations.
It is important to distinguish between inherent safety and
safety (the Bhopal plant was safe when built and operated
correctly), because inherent safety is the more desirable
quality. It is better to achieve safety inherently rather than

255

by protection, because then unexpected events, whether

foreseen or not, cannot cause a problem.
Many commentators have noted that bulk chemicals
production is being transferred from the major, developed
nations, such as countries in Europe, Japan and the USA, to
lower cost locations for new plant. The major advantage is
due to lower feedstock costs, although labour and capital
cost reductions might be significant as well. Such low-cost
locations are often developing countries, such as China,
India, Iran, Vietnam, Malaysia, etc. where the labour costs
are certainly lower. This transfers the hazards from the
developed countries, (where, historically, the plants would
have been built and are now being decommissioned) to the
developing countries.
These new plants are built and operated to the same high
standards that the companies insist upon worldwide.
However, the hazards are larger, because most of the
designs have not changed and the plants tend to be larger
than those that have been built before. The risks are greater
initially because not only does the hazard increase with
scale but also with the likelihood of realisation. The risk
might increase over the years that the plant is operating for
reasons described in the paper.
There have been many advances in process safety since
Bhopal, not least those in inherent safetyBhopal was the
worst example of an inherently unsafe plant where the
hazards have been realised to devastating effect. However,
inherent safety remains a philosophy that is much admired
but seldom practised to reduce major hazards. I contend that
the key future course of action should be that the industry
practise what it has endorsed for so long and make the new
generation of plants being built in the developing world
inherently safer. This is the only credible way to reduce the
risks to acceptable levels. Otherwise, the industry might not
survive future disasters on the scale of Bhopal.

2. The changing geographical distribution of chemicals

production and scale of operations
I compiled a list of new plant announcements as reported
on the Contracts page of the British Institution of
Chemical Engineers house magazine, The Chemical
Engineer, and in the pages of the UK magazine, Process
Engineering.
In the one-year period covered by magazine issues dated
September 2003 to August 2004, a total of 19.6 million
tonnes of new or expanded capacity was announced. In the
following breakdown of this figure, the numbers are
millions of tonnes. Of this 19.6 total, 15.9 and 3.7 was for
organic and inorganic chemicals, respectively. The majority
of the organics were petrochemicals. The country with by
far the largest announced new capacity was Saudi Arabia
with 10.6. There was one capacity expansion announced for
the UK (0.4 chlor-alkali) and the rest (8.6) was all in
developing countries. Iran had the most with 3.93, followed

256

D.W. Edwards / Journal of Loss Prevention in the Process Industries 18 (2005) 254260

by Egypt (2.08) and China (1.87). The other countries

appearing in my list were: Thailand (0.64), Malaysia (0.06),
Brazil (0.01) and Vietnam (0.01). The new plants were all
set to produce bulk chemicals with the possible exception of
one in Vietnam with a capacity of 6500 tonnes per year of
isomerates.
News stories that accompany the announcements of new
plants and capacity expansions often claim that they are
world-scale or that the location now has the largest
production of the chemical in the world, etc. The size of
the plants and complexes seems to be increasing.
A recent paper by Windhorst and Koen (2001) presented
at the 2001 Asia Pacific Safety Symposium, claims that the
capacities of all process plants have trended upwards over
the preceding decades but that the designs have not changed.
They provide some evidence of this for ethylene crackers
and go on to argue that this large localised supply exerts
upwards pressure on the capacity of local olefins consuming
plants, for example ethylene oxide and polyethylene.
Thus, a cursory survey of contracts data and literature
survey suggests that production of bulk chemicals is being
transferred away from the developed countries to less
developed ones and that plant capacities are increasing.
Clearly, we need detailed research to confirm and define the
extent and destinations of the transfer and the rate of
capacity increase.
Let us now examine the risk implications of these effects.

3. Risk transfer
Given that the capacities of the new plants are increasing
and that they mostly use existing designs, the size of the
hazards is increased either in proportion to the necessary
inventory increases or over and above this. For example,
piping inventories increase more than linearly with
capacity. If equipment, for example columns, heat
exchangers and flare systems, has to be duplicated or
tripled, etc the inventory and therefore, the hazard will rise
more than in proportion to the capacity increase. However,
the risks are increased even more.
Windhorst and Koen (2001) make the case that, while the
designs of new plants are simple linear extrapolations of
existing designs of much smaller plant, the risks increase
exponentially. To justify this assertion they made quantified
risk assessments of ethylene plants. They concluded that the
individual risk of the most exposed person increases to
the power 1.33 of capacity and that risk is proportional to
the square of capital.
They state a number of reasons for this effect. Some of
these are:
larger equipment and nozzle sizes result in larger release
rates and amount released and also increased probability
of ignition;
bigger maximum rate of energy release;

increased adiabaticity (larger equipment has lower heat

loss per unit of inventory) causing higher temperatures
during an upset and hence different runaway reaction
behaviour or unexpected combustion reactions;
management of change is more complex because of the
greater number of support systems;
larger reactor volumes, whereas reactor control enhancements may not be commensurate and special safety
systems may be required;
duplicated, triplicated, etc equipment requires much
more complicated piping, many more valves, flanges,
welds, etc all of these increase the probability of a
release.
In addition to the increased risk posed by the larger
capacity plant. Other factors compound the increased risk
for plant built in developing countries. Many of these are to
do with people, their culture and history.
In most of the developed countries the chemical industry
has developed over many years, for example chemicals
production in the UK and Germany started centuries ago.
This has resulted in a comprehensive body of appropriate
legislation and regulations that have proved their worth over
the years. Just as importantly, a culture has grown up of
respect for the inherent hazards of chemicals manufacture
and a determination to do it safely, not just within the
industry but also in society. These factors have resulted in
the industry having an enviable safety record. For example,
the worker fatal accident rate of the UK chemical industry is
better than most other sectors and I cannot discover when
the last person was killed offsite by a chemical accident in
the UK. There have been none this or last century. This
excludes explosives, such as nitro-glycerine and dynamite,
which have killed significant numbers of people during the
two world wars by massive explosions in stores and plants.
However, this might not be the case for plants built in
developing countries where the regulations might not exist
or be inappropriate or there are insufficient resources for
enforcement. For example, it is inconceivable that people
would have been allowed to live as close to a major hazard
site in the UK as they were at Bhopal. There might not be
any emergency response planning for people living near the
plant and these people might not be told about the hazards
(both as at Bhopal).
These deficiencies might not be a problem when the plant
is new, is making money and is run by well-trained local
people and expatriateschemical companies insist upon the
same good standards worldwide. However, it is when the
plant is ageing and is losing money (as the Bhopal plant
was) that problems are likely to occur due to reduced
staffing and skipped maintenance, for example. The chances
of safety suffering on a very large plant (as Bhopal was) are
greater when demand for the product drops, because the loss
due to closure would be higher and the breakeven
production is large.

D.W. Edwards / Journal of Loss Prevention in the Process Industries 18 (2005) 254260

Companies might underestimate the difficulties of

operating in countries with different cultures and traditions.
For example, in some new locations for chemical plant loss
of face is a hugely important issue. I have heard of serious
safety incidents caused by local personnel saying there was
no problemwhen there was.
Problems might be more likely if ownership is
subsequently transferred to local companies or to the state.
Then the local operators might lose the experience of the
expatriate experts and they will not have the cultural
knowledge of chemicals production that exists in the
developed countries.
Finally, major hazard chemical installations are clearly
soft targets for terrorists, wherever they are located. Less
developed countries may not have effective security to
counter this threat. It is self-evident that if there are no or
only small hazardous inventories in a plant then it would not
be a terrorist target. Avoiding or minimising hazardous
inventories is the most important strategy of inherently safer
design. Therefore, building inherently safer plant is a nobrainer for countering terrorism targeted at chemical plant.
Leaving aside terrorism, inherently safer plant should be
the norm for lesser developed countries. Because adequate
risk reduction is not dependent upon regulation, or welltrained operators or protective systems, etc. The risk is low
because the hazards are small. However, inherently safer
plants are not the norm. I now examine why this is so and
make some suggestions for overcoming identified barriers to
inherently safer production.

4. The barriers to inherently safer plant and how

to overcome them
Firstly, how do we know that the new plants are not built
to inherently safer designs? Because none of the project
announcements mention inherent safety and people in the
industry tell me that existing technology is usedany
innovation there is building bigger plants to achieve
greater economies of scale. If the new plants were inherently
safer, the press releases would surely mention it.
Perversely, it seems that the inherent aversion to
commercial risk and the conservatism of the chemical
industry has prevented the widespread adoption of the best
available technique for reducing risk to people and the
environmentthe inherently safety philosophy and its
practical application in inherently safer design! This aversion
and conservatism finds expression most often in the approach
to process development, cost estimation, evaluation of
projects and business risk. A recent paper, Edwards (2004),
provides a comprehensive view of the barriers to inherently
safer plant, which may be summarised:
overriding focus on time-to-market,
inadequate project evaluation, because of lack of
appropriate and tested inherent safety assessment tools

257

and limited resources that do not allow space for

inherent safety;
inflexible capital and operating cost estimation and
economic feasibility assessment methods that do not credit
inherently safer designs with their due cost advantages;
no enforced legislative requirements for inherently safer
plant;
no incentives for implementing inherently safer designs.
Competitive pressures and emphasis on speed to market
make inherently safer designs too (commercially) risky!
Why should companies risk new technology, which might
delay start-up and allow competitors to capture marketshare, when the existing technology is safe enough? The
flaw in this logic is that the existing technology is believed
to be safe enough in a developed country (because there are
very few major loss of life incidents) but my contention is
that it will not even be safe enough used in a larger plant in a
developing country. Therefore, we must strive to ensure that
the new plants are designed and built according to the
principles of inherent safety.
4.1. Encouraging inherently safer production
Let us examine each of these barriers in turn.
4.1.1. Project evaluation
One of the reasons for not implementing inherently safer
designs most mentioned by respondents to a recent survey
by Gupta and Edwards (2002) is the lack of tools for making
the required analyses. In fact, there are a number of
published tools for inherently safer design, some of which,
for example INSET the INSIDE Project (1997), have had
considerable resources expended on development with a
consortium of companies. However, most of the new plants
are for producing established bulk chemicals. Alternative
designs are well known and conventional tools such as the
Dow Indices and quantified risk assessment (QRA) will
already have been used to assess the relative hazards and
risks. The inherently unsafe areas of existing designs are
also well known. So, the problem is not producing new
inherently safer designs but having the will to spend a little
more time developing existing inherently safer designs and
then to take the commercial risk of implementing them.
Shinnar (2004) comments that whereas the first fluid
catalytic cracker went from initial design to full production
in only 18 months in 1938, it might take 18 months today to
pass a management decision to build a pilot plant. The need
for more decision-making time by management, within
project timescales compressed by competition, can have
negative implications for engineering, particularly for
inherently safer engineering.
Malpas (1978) suggests a strategy for promoting
innovation in his paper, The Plant After Next. He writes:
The technical options available for the next plant are
usually limited by time, so if major advances are to be made

258

D.W. Edwards / Journal of Loss Prevention in the Process Industries 18 (2005) 254260

there has to be thought about the plant after next.

Fundamental and significant technical advance takes years
to develop, so the time to start thinking about it is precisely
when the next plant is being designed, for it is then that the
many compromises between what would have been
desirable and what is practically acceptable are fresh in
the mind. Despite the fact that it is just then that the pressure
on everyone to define and execute the next plant is greatest,
it is the best time to identify appropriate research targets.
Intuitively inherently safer designs offer cost savings and
profit enhancement:
inventory reduction will generally reduce costs because
smaller vessels cost less;
simpler plant costs less because there is less equipment
and ancillaries;
avoiding hazards also avoids the costly hazard control
measures.
These arguments apply equally to capital and operating
cost, because reducing count, size and complexity of
equipment, reduces utilities, labour, testing and maintenance costs. As Henry Ford succinctly put it: what you do
not fit costs you nothing and needs no maintenance.
Industry insiders claim that equipment related to safety,
health and environmental protection represents 1050% of
the capital cost of conventional plant and that the potential
savings are not appreciated because this equipment is seen
as standard items that will inevitably be required. On
operating cost, achievable cost reductions for inherently
safer plant are 10% for maintenance and 20% for downtime.
Payback times are typically less than 2 years for projects
involving inherent safety.
Such economic benefits are not apparent at the point that
the major project decisions are made. This is because early
economic estimates do not allow for the decreased capital
and operating costs of inherently safer plants. Therefore, in
the absence of a compelling argument for doing otherwise,
the conventional design will normally be chosen.
4.1.2. Inherent safety legislation
Inherent safety is not yet compulsory in most safety
legislation but it is mentioned or described in existing
regulations and guidance, for example in the UK, where an
inherently safer approach is recommended. There is a trend
towards regulation that focuses on reducing the size of
hazards and the possible consequences, particularly to
offsite populations, rather than reducing the statistical risk
of harm. This trend favours the adoption of inherent safety
and it is likely that it will appear in future legislation.
Therefore, companies ought to adopt an inherently safer
approach to ease current and future regulatory compliance.
4.1.2.1. Experience of inherent safety legislation. In the
USA legislation enacted locally in Contra Costa County,
California (CCC) insists upon inherently safer systems (ISS)

unless evidence is presented that the financial impacts

would be sufficiently severe to render the inherently safer
system as impractical.
This legislation was prompted by a series of major
incidents in CCC, which is near San Francisco, mostly
involving refineries. This legislation has caused considerable problems for the major hazard sites in CCC
and the County has issued a guidance document. It
remains to be seen how this legislation will impact
actual process design in this locale. Early reports
indicate that hazardous inventories have been reduced,
chlorine is now being generated in situ for water
treatment or else alternatives, such as ozone or ultra
violet light, are used instead and aqueous ammonia is
used instead of anhydrous. Major hazard sites are
introducing procedures for implementing the ISS
requirements of the ordinance.
4.1.2.2. Forthcoming legislation?. The Federal USA
(therefore with much wider applicability) Chemical
Security Act of 2003 was first introduced in 2001 in
response to 911. It was withdrawn but has recently
reappeared. It is sponsored by Senator Jon Corzine and cosponsored by Hillary Clinton, amongst others. Some of this
bill reads like excerpts from a Trevor Kletz book on
inherently safer design and is very prescriptive. In response
to this Democrat bill, Republican Senator Inhofe has
introduced the Chemical Facilities Security Act. This bill
deals with plant security only but it is rumoured that some
Republicans want amendments to include inherent safety.
Inherent safety is on the regulatory agenda in the USA. It
is perhaps ironic that, at this time, companies that might
have to comply with the proposed legislation at home are
building plants that would not so comply in overseas
jurisdictions.
It behoves Governments in developing countries to enact
legislation insisting where possible on inherently safer
plant. After all, if the developed nations are moving in this
direction and their companies insist on the same standards
worldwide, then they ought to build inherently safer plant
worldwide.
4.2. Incentives for inherent safety
The incentive for inherently safer plant is as simple as the
concept:
Inherently safer plants are safer. However, this has not
resulted in installations so far. Cynics might say that
rather than build inherently safer plant the risk has been
exported to be borne by people who do not matter so
much. I am sure that this is not the case, but in order that
more cynical people or those with other agendas do not
come to this conclusion and promulgate it against the
plant owners, would it not be in everyones interests to
build inherently safer plant? Adoption of inherent safety
can help to improve the reputation of companies. It seems

D.W. Edwards / Journal of Loss Prevention in the Process Industries 18 (2005) 254260

obvious that it is better to operate inherently safer plants

than to control large hazards. The public, even in
developing countries, understand that low probability
events can happenpeople do win lotteries. The absence
of hazards is far easier to communicate than acceptability
of risk.

5. Summary and the way forward

The Bhopal plant was a large, inherently unsafe
chemical production facility in a developing country that
was majority owned and operated by a company from a
developed country. An accident on the plant caused the
worlds worst industrial disaster, wherein 8000 people
died.
This accident ought to be remembered for all time as a
terrible warning of what can happen when hazard control
and mitigation fail. Instead, we seem to be forgetting the
lessons learned and a new generation of potential Bhopals
are now being built in the developing world, largely by
companies from the developed nations.
This paper presents a personal view that the current
transfer of production of bulk chemicals from developed to
developing nations poses unacceptable risks to the people
and the environment in these new locations. This is
because the risks increase more than linearly with the ongoing capacity increases of the plants and the developing
country locales are less able to cope with the increased
hazards.
Of course this is just my opinion, based upon limited data
and research. Therefore, I appeal for research into the
changing geographic distribution and scale of chemical
production and for analysis of the new risk profile due to any
identified changes.
The Bhopal plant was inherently unsafe. It could have
been inherently safer, which would have spared all those
lives that were lost. This simple fact ought to spur
Governments and regulators with jurisdiction over the
locations of new facilities to insist upon inherently safer
designs. The paper makes the case for building inherently
safer plant to reduce the hazards and risks borne in the
plant locations. Even if these safety benefits were not
enough, the economic, security and PR advantages of
inherently safer production should convince those people
taking investment and fundamental design decisions to
sanction inherently safer designs for new facilities.
However, instead, bigger and bigger plant is built to
conventional, tried and trusted designs but which have
larger hazards and pose even larger risks because of the
increased scale and unusual location.
This trend also poses an unacceptable risk to our
industry. The chemical industry survived the appalling
loss of life at Bhopal but the Union Carbide Corporation did
not. The industry urgently needs to make inherently safer
plants a reality, rather than a much-lauded ideal. This

259

strategy might seem commercially risky but in the long term

it is the only way to ensure the sustainability of the industry,
wherever it is located. Would the industry survive another
Bhopal?
I have recently been privileged to attend meetings of two
bodies that were both set up in response to disasters where
the scale was due to inherently unsafe plant. The
International Process Safety Group was set up after the
Flixborough disaster, where the realised hazard was of the
other primary category: fire and explosion that, prompted
Kletz (1976) to establish the principles of inherent safety.
The other group is the Centre for Chemical Process Safety,
which was set up by the AIChE in response to the Bhopal
disaster.
At both of these meetings I was very impressed by the
open and honest discussion of incidents and future policy
amongst representatives of companies, for the benefit of the
industry. However, both these meetings were attended only
by safety professionals.
My dream is for a similar forum for process industry
chief executives and decision makers, where they could be
informed of and discuss risk issues and formulate an
industry response. For example, would Warren Anderson,
Chief Executive of Union Carbide, have allowed the Bhopal
plant to continue operating as inherently unsafely, had he
known about the size of the hazard and that all the risk to his
company was concentrated in that one loss-making plant in
India? I believe that such a forum of chief executives would
decide to:
Export inherent safety NOT risk. I encourage everyone to
try to make it happen.

Acknowledgements
The author gratefully acknowledges the helpful comments made by Trevor Kletz and Jan Windhorst during the
writing of this paper.

References
Edwards, D. W. (2004). Are we too risk-averse for inherent safety? An
examination of current status and barriers to adoption, hazards XVIII
process safety- sharing best practice IChemE Symposium Series No
150. Manchester: IChemE (p. 250).
Gupta, J. P. (2003). Bhopal: .Eighteen, going on nineteen and fading?
Transactions of the Institution of Chemical Engineers: Process Safety
and Environmental Protection, 81B, 81B(4), 227228.
Gupta, J. P., & Edwards, D. W. (2002). Inherently safer designpresent
and future. Transactions of the Institution of Chemical Engineers:
Process Safety and Environmental Protection, 80B(3), 115125.
INSIDE Project (1997). Inherent SHE: The cost effective route to improved
safety, health and environmental performance. London: IBC UK
Conferences Limited.
Jones, D. A. (Ed.). (1992). Nomenclature for hazard and risk assessment in
the process industries2nd ed.. Rugby: IChemE.

260

D.W. Edwards / Journal of Loss Prevention in the Process Industries 18 (2005) 254260

Kletz, T. A. (1976). Preventing catastrophic accidents. Chemical

Engineering, 83(8), 124128.
Kletz, T. A. (1998). Process plants: A handbook for inherently safer design.
Bristol, PA: Taylor & Francis.
Malpas, R. (1978). The Plant After Next. Engineering, 246, 563565.
Reason, J. (1997). Managing the risks of organisational accidents.
Aldershot: Ashgate.

Shinnar, R. (2004). Systematic methodology for the design development

and scale-up of complex chemical processes. The role of control and
concurrent design. Industrial and Engineering Chemistry Research,
43(2), 246269.
Windhorst, J. C. A., & Koen, J. A. (2001). Economies of scale of worldscale plants and process safety Proceedings of asia pacific safety.
Kyoto.