Received: 22 June 2020 Revised: 14 August 2020 Accepted: 19 August 2020

DOI: 10.1002/cjce.23987

SPECIAL SERIES

The role of inherently safer design in process safety

Paul R. Amyotte1 | Faisal I. Khan2

1
Department of Process Engineering &
Applied Science, Dalhousie University, Abstract
Halifax, Nova Scotia, Canada The role of inherently safer design (ISD) in process safety assurance has chan-
2
Centre for Risk, Integrity and Safety ged significantly over the past 40 years. When first introduced by Professor
Engineering, Faculty of Engineering &
Trevor Kletz following the 1974 Flixborough explosion, the ISD concept chal-
Applied Science, Memorial University, St.
John’s, Newfoundland & Labrador, lenged the manner in which process risk was addressed in the chemical indus-
Canada try. The prevailing view of adding on safety devices and implementing
Correspondence
procedures aimed at controlling hazards was now complemented by a way of
Paul R. Amyotte, Department of Process thinking that sought to remove or reduce hazards at their source. The past
Engineering and Applied Science, 20 years have seen ISD mature into an established risk reduction strategy that
Dalhousie University, 5273 DaCosta Row,
PO Box 15000, Halifax, NS, Canada.
is widely known in principle and increasingly adopted in practice. The current
Email: [email protected] paper reviews the authors’ collaborative research efforts aimed at integrating
ISD into various process safety systems, activities, and applications. The pri-
[Correction added on 22 March 2021, after
first online publication: Peer review mary inherent safety principles (minimization, substitution, moderation, and
history statement has been added.] simplification) are explained with example-based guidance provided for their
use. ISD features and performance indices are examined throughout the early
design and operational stages of a typical process life cycle. Preventing and
mitigating undesirable occurrences such as domino effects and dust explosions
are shown to be feasible by adopting an inherent safety approach. The impor-
tance of reviewing ISD case studies developed from incident investigations is
also discussed. Finally, we present our personal opinions on the current status
of inherently safer design and future possibilities for its continued growth.

KEYWORDS
inherent safety, inherently safer design, process plant design, process safety

1 | INTRODUCTION update to our earlier responses, which could best be

described as “perhaps,” “not really,” and “no,” respec-
Common sense, common knowledge, common applica- tively. Much has changed in the intervening years.
tion: Do any of these terms apply to the concept of inher- The current paper is a feature article written at the
ently safer design? Almost two decades ago we addressed invitation of the editor. Our intent is to provide the
this question in our review paper, “How to Make Inher- above-mentioned update by highlighting some of our
ent Safety Practice a Reality,” published in the Canadian contributions to the field of process safety, specifically
Journal of Chemical Engineering.[1] Here, we present an those related to inherently safer design (ISD). Many

This is an open access article under the terms of the Creative Commons Attribution-NonCommercial-NoDerivs License, which permits use and distribution in any
medium, provided the original work is properly cited, the use is non-commercial and no modifications or adaptations are made.
© 2020 The Authors. The Canadian Journal of Chemical Engineering published by Wiley Periodicals LLC on behalf of Canadian Society for Chemical Engineering.

Can J Chem Eng. 2021;99:853–871. wileyonlinelibrary.com/journal/cjce 853

 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
854 AMYOTTE AND KHAN

others are active in the process safety/ISD research and publication venues for process safety research. (In the
practice global communities; throughout the paper we interest of full disclosure, the authors note they are the
cite several references from their work. We have not, current editors of JLPPI (Amyotte) and PSEP (Khan).)
however, attempted to conduct a critical review of The decision by the Canadian Journal of Chemical Engi-
inherently safer design in the chemical process indus- neering (ie, a mainstream chemical engineering journal)
tries. Comprehensive resources are available for this to consider Khan and Amyotte[1] for peer review was
purpose,[2,3] including a recent book from the AIChE quite unusual for the early 2000s. This decision has
Center for Chemical Process Safety.[4] Also, for prag- proven to be highly beneficial to both our own research
matic reasons (in particular, our primary research focus and apparently that of others; Khan and Amyotte[1]
on process safety) we have generally not broadened the remains one of our most cited joint publications and has
discussion to matters of process security (with one been termed a high-impact paper in the inherent safety
exception in the later section on the ISD principle of field by Li et al.[12]
moderation). However, it should be noted that physical Our approach to dissemination of ISD research results
and cyber security benefits can be brought about by ISD is intentionally broad-based. In addition to a primary
implementation.[5] focus on peer-reviewed research journal publications, we
The remainder of this introductory section gives an have engaged in several other communication avenues as
overview of our collaborative work, the origin of the illustrated by the following list (with representative
inherent safety way of thinking, and the fundamentals examples):
and basic principles of inherently safer design. We then
describe contributions made by our research teams • expert work with technical organizations and
with respect to explicit incorporation and application institutions,[13–15]
of ISD in the following areas: (a) process safety man- • articles for the trade literature,[16]
agement systems and their various elements, • presentations to industry, government, and investiga-
(b) chemical industry process safety issues by specific tive and regulatory bodies,[17–20]
principle, (c) development of overall performance indi- • presentations at international specialist and generalist
ces, (d) process design, (e) process operation, (f ) pre- conferences,[21–23]
vention and mitigation of domino (knock-on) effects, • presentations at Canadian combustion and chemical
(g) dust explosion risk reduction, (h) lessons learned engineering conferences,[24,25]
from case studies, and (i) incident investigations con- • presentations at international process safety confer-
ducted by the US Chemical Safety Board. The final ences, several of which have led to refereed journal
section of the paper offers concluding thoughts on the papers,[26–28] and
current status and future of inherently safer design. • educational publications.[29,30]

Process safety is a highly practical field that encom-

1.1 | Collaborative work in research, passes a wide variety of teaching and learning
practice, and education opportunities.

Fittingly enough, the first collaborative effort of the pre-

sent authors was a review of inherent safety applications 1.2 | Origins of modern inherent safety
in offshore oil and gas activities published in 2002 in the thinking and practice
Journal of Loss Prevention in the Process Industries
(JLPPI).[6] Other early work, around the time of publica- We have previously remarked that the principles of
tion of Khan and Amyotte,[1] included examination of inherent safety are analogous to the laws of conservation
the inherent safety features of available process safety of mass and energy. They have been around for a long
indexing techniques[7,8] and application of ISD principles time and they have not changed since they first came into
to the industrial dust explosion problem,[9,10] both of existence.[2] Formal conceptualization of inherently safer
which are covered in detail in subsequent sections. The design, however, did not occur until about 40 years ago
full extent of our collaboration to date can be viewed in when the late Trevor Kletz provided the process indus-
the bibliometric analysis conducted by Amin et al.[11] tries with the vocabulary and road map needed for ISD
Khan et al[8] and Amyotte et al[10] were published in implementation.
Process Safety Progress (PSP) and Process Safety and Envi- Responding to the 1974 cyclohexane explosion at
ronmental Protection (PSEP), respectively, which along Flixborough, UK, Professor Kletz wondered aloud why
with JLPPI represent the main archival journal the investigation recommendations dealt mostly with the
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
AMYOTTE AND KHAN 855

addition of improved safety devices, the adoption of safer keywords “Trevor Kletz.” Any resource identified will be
working procedures, and the need for enhanced regula- worth reading. Highly recommended are the:
tory oversight. Why, he asked, was there no mention of
the fundamental risk associated with storage of massive • aforementioned paper by Poliakoff,[31] which helps to
inventories of highly hazardous materials? The proverbial explain why Trevor is widely regarded as the “father of
light bulb had been turned on; the result was his seminal inherent safety,”
paper, “What You Don’t Have, Can’t Leak,” presented in • JLPPI special issue introduction by Amyotte et al,[32]
1978 and reproduced in Poliakoff.[31] The paper title which contains personal tributes celebrating Trevor’s
expresses the essence of inherent safety; while what you 90th birthday and which speaks of the high esteem in
do not have cannot leak, it also cannot burn, explode, be which he is held in the global process safety
released from containment, cause harm to people, dam- community,
age equipment and other assets, cause business interrup- • PSEP special issue editorial by Edwards and Gupta,[33]
tion, or adversely impact the environment. Chemical which also celebrates Trevor’s 90th birthday and intro-
engineers will recognize elements of pollution preven- duces his groundbreaking work on ISD, qualitative
tion, green chemistry, and green engineering in this treat- and quantitative hazard analysis, human error analy-
ment of hazards at their source. sis, and communication of lessons learned,
Trevor’s original phrase “intrinsically safe design” • article appearing in The Chemical Engineer,[34] which
soon became inherently safer design in recognition that was published one year before Trevor’s passing in 2013
intrinsic safety was already used for hazardous area clas- and gives a retrospective look at his career, and
sification in terms of allowable electrical equipment, and • obituary written by Edwards,[35] which emphasizes
that inherent safety is relative.[31] Hence, we now speak Trevor’s immense contributions to the field of inherent
of a design being inherently safer rather than inherently safety as well as process safety in general.
safe. His initial set of ISD principles have remained
largely intact with respect to their definitions as described
in the next section, although some have evolved with 1.3 | Inherent safety and the hierarchy
new names (eg, intensification is now commonly known of controls
as minimization, and attenuation is now more often
called moderation). There are four basic ways of dealing with hazards in the
Trevor Kletz was a consummate storyteller. He had chemical process industries. Arranged from most to least
the unique ability to take a complex technical concept, effective in a framework known as the hierarchy of con-
break it down into its more understandable components, trols, they are inherent safety (or inherently safer design,
and relate the entire matter to an everyday life example ISD), passive engineered safety, active engineered safety,
that has a familiar ring to it. As an example, consider the and procedural (or administrative) safety. Passive and
hazard of stairs in a two-story house and the risk of fall- active safety measures involve the use of add-on devices
ing down the stairs. We can provide add-on measures designed to effect either preventive or mitigative action
(eg, handrails and landings) and we can remind house- when called upon. Active devices (eg, fire suppression
hold members to observe proper stair-walking procedures systems) require event detection leading to actuation of
(eg, holding onto the handrail). Or we can eliminate the moving parts whereas passive devices (eg, containment
hazard entirely by living in a one-story house. This seem- dikes for above-ground hydrocarbon storage tanks) do
ingly simple example has numerous undertones that not employ sensors or mechanical actuators. Actuation of
illustrate some of the challenges of ISD. How feasible is it a passive device such as an explosion relief vent
to eliminate stairs if one already lives in a two-story (or rupture disk) is brought about solely by the undesired
house? (This concern is related to the life cycle nature of event itself (in this case, the explosion overpressure). Pro-
ISD in which consideration at the conceptual design cedural safety brings the human operator fully into the
stage typically yields the greatest benefits.) What if one picture through use of measures such as standard operat-
lives in an area prone to flooding? (This concern is ing procedures or administrative protocols such as pro-
related to the fact that ISD is hazard specific; removal of cess hazard analysis.
a flammability hazard by introduction of nitrogen pad- Inherent safety, on the other hand, does not seek to
ding can also introduce an asphyxiation hazard.) similarly control hazards but rather to eliminate them or
For readers not familiar with the body of scientific reduce their potential to cause harm without resorting to
and engineering work that underpins inherently safer use of add-on or procedural safety barriers. Because this
design, we recommend a literature search with the is ideally accomplished by making use of the underlying
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
856 AMYOTTE AND KHAN

T A B L E 1 Primary inherent safety principles; adapted from 2. Process safety, which is the prevention and mitigation
Amyotte et al[36] of process-related injuries and damage arising from
Principle Description
process incidents involving fire, explosion, and toxic
release.[43]
Minimization Use smaller quantities of hazardous materials
3. Process safety management (PSM), which is the appli-
when the use of such materials cannot be
avoided. Perform a hazardous procedure as cation of management principles and systems to the
few times as possible when the procedure is identification, understanding, and control of process
unavoidable. Elimination can be thought of hazards to prevent process-related injuries and
as 100% minimization. incidents.[44,45]
Substitution Replace a substance with a less hazardous
material (ie, a completely new substance) or
a processing route with one that does not 2.1 | Process safety management
involve hazardous material. Replace a systems
hazardous procedure with one that is less
hazardous.
Safety management systems are recognized and accepted
Moderation Use hazardous materials in their least worldwide as best-practice methods for managing risk
hazardous forms (ie, the same substance but
through the continuous improvement scheme known as
in a safer formulation) or identify
processing options that involve less severe
Plan/Do/Check/Act.[41] They typically consist of 10-20
processing conditions (such as a lower program elements that must be carried out to manage
temperature or pressure). the risks in an acceptable way. Control of process hazards
Simplification Design processes, processing equipment, and (as per the above definition: flammable, explosible, and
procedures to eliminate opportunities for toxic materials) and the ensuing risks is accomplished by
errors by eliminating excessive use of add- using a PSM system such as the example given in
on safety features and protective devices. Table 2. The CSA PSM standard shown consists of 16 ele-
ments arranged in groupings of four, each under one of
four headings: (a) process safety leadership,
material properties and process chemistry and physics, (b) understanding hazards and risks, (c) risk manage-
ISD can be a highly effective risk management strategy. ment, and (d) review and improvement.[46] Many other
The four main ISD principles are summarized in PSM systems exist worldwide.[41]
Table 1. Various sub-principles have also been identified Amyotte and Lupien[41] commented that a number
over the years; these include limitation of effects (under of overarching process safety concepts, including ISD,
moderation), making equipment robust (under simplifi- achieve maximum benefit when interwoven throughout
cation), and making incorrect assembly impossible (also the fabric of a PSM system. Thus, inherently safer
under simplification). Further details can be found in the design should not be viewed as a stand-alone concept.
previously referenced texts,[2–4] or by consulting the prac- It is a way of thinking that is most effective in
tical summary of basic ISD principles given by preventing and mitigating process incidents when
Hendershot.[37] A series of papers appearing consecu- adopted as an integral and explicit component of the
tively in Chemical Engineering Progress offers a concise PSM system in use.
package of information on ISD fundamentals and appli- Rayner Brown et al[47] have demonstrated how this
cation at the design and operational stages.[38–40] can be accomplished by extensively illustrating ISD
incorporation in the 16-element CSA PSM standard[46]
(Table 2). Their work builds on a similar exposition con-
2 | P R O C E S S SA F E T Y ducted by Amyotte et al[48] for the 12-element CSChE
MANAGEMENT PSM system[44,45] on which the CSA PSM standard[46] is
based. They describe, for example, how ISD regulations,
We begin with three definitions that are foundational to codes, and standards (Table 2) have been implemented in
the discussion in this paper[41]: specific jurisdictions in the United States: Contra Costa
County and the City of Richmond in California, and also
1. Process, which is any activity involving a highly haz- the state of New Jersey.[47] Amyotte and Lupien[41] fur-
ardous chemical including using, storing, manufactur- ther explain the embedding of ISD in the European
ing, handling, or moving such chemicals at the site, or Union’s Seveso Directive III by, for example, the require-
combination of these activities.[42] ment for consideration of inter-site domino effects (which
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
AMYOTTE AND KHAN 857

TABLE 2 CSA process safety management (PSM) standard[46]

Process safety management elements

Understanding hazards and

Process safety leadership risks Risk management Review and improvement
Accountability Process knowledge and Training and competency Investigation
documentation
Regulations, codes, and standards Project review and design Management of change Audits process
procedures
Process safety culture Process risk assessment and risk Process and equipment Enhancement of process safety
reduction integrity knowledge
Conduct of operations—senior Human factors Emergency management Key performance indicators
management responsibility planning

techniques are available, the approach taken should, as

with the overall PSM system itself, unambiguously incor-
porate ISD considerations.
A PHA method that is increasingly being employed in
industry is bow tie analysis (BTA), which is a combina-
tion of the fault tree and event tree techniques.[49]
Figure 1 illustrates one approach to ensuring the princi-
ples of inherently safer design are addressed in BTA.
Within this framework, the PHA team is directed to
explicitly consider ISD barriers (safety measures) before
moving on to passive, active, and procedural barriers.
This seemingly simple step is required to counter any
existing bias or tendency to favour established, although
less effective, measures such as process alarms and safety
devices. The complexity of invoking the ISD philosophy
is partially eased by equipping the PHA team with
example-based guidance (specific, practical applications
of ISD from industrial practice and the technical litera-
ture, which can be used to guide and inform other ISD
F I G U R E 1 Overview of a protocol for incorporating inherently opportunities).
safer design (ISD) into bow tie diagrams for process hazard
analyses (PHAs) at the design and operational life cycle stages[47]

2.3 | Incident investigation

are described later in the current paper). Examples for
two other specific PSM elements follow. The investigation element in Table 2 refers to examina-
tion of near-misses and loss producing events to establish
root causes and provide recommendations to prevent
2.2 | Process hazard analysis recurrence.[46] As with process hazard analysis, explicit
incorporation of ISD throughout the various stages of
A key activity under process risk assessment and risk incident investigation is required to enhance overall
reduction (Table 2) is process hazard analysis (PHA), in effectiveness of the search for lessons learned. Figure 2
which a process, procedure, or piece of equipment is illustrates the approach for this purpose developed by
reviewed to identify hazards within the analysis scope. Goraya et al.[50]
This is commensurate with the basic definitions of haz- This methodology employs both inherent safety
ard and risk, whereby risk (consisting of likelihood of guidewords and checklists to ensure ISD remains front-
occurrence and severity of consequences) arises from and-centre during the investigation process. The
hazards, meaning that hazard identification is a neces- guidewords are simply the principles of ISD as described
sary precursor to risk assessment. While a variety of PHA in the next section of the current paper. Checklists are
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
858 AMYOTTE AND KHAN

F I G U R E 2 An inherent safety-based
incident investigation methodology
(numbers refer to the investigation stage:
1, preparation and initial response;
2, data gathering; 3, data analysis;
4, recommendation reporting,
implementation, and follow-up)[50]

commonly used in the field of process safety to serve as examples given for each main principle and several
mind triggers so that important items are rigorously sub-principles.
addressed; ISD checklist questions can be built around Since the beginning of the present authors’ collabo-
the individual principles to assess their relevance to the ration in 2001, we have attempted to identify the rela-
incident in question. tionship to ISD for each of our various research projects.
This was not always the case in prior years as we had
yet to fully embrace the notion that fundamental
3 | I N H E R EN T L Y S A F E R DE S I G N research on other topics could in fact have a direct bear-
PRINCIPLES ing on the inherent safety of a given process. A case in
point is the work of Mintz et al[52] on rendering fine
Here we provide a few examples from our research, metallic powders chemically inert by admixture with
which have been classified according to each of the four non-reactive materials. The research dealt with
main ISD principles: minimization, substitution, mod- inerting/suppression of dust explosions and so had an
eration, and simplification (Table 1). Many others are obvious process safety relevance; it was not until several
given in subsequent sections, especially when dis- years later that the first author (Amyotte) realized the
cussing domino effects and dust explosions. A recent direct connection to the ISD principles of substitution
review by Gao et al[51] illustrates the wide applicability and moderation. One might reasonably wonder how
of ISD to the process industries with numerous many other researchers and practitioners would find
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
AMYOTTE AND KHAN 859

TABLE 3 Inherently safer approaches for handling fertilizer grade ammonium nitrate (FGAN)[53]

Inherently safer
strategy Description Example
Minimization Reducing the quantity of a hazardous Store FGAN in purpose-built buildings holding smaller
material used in a chemical process quantities of material, well separated from one another and
from potential sources of contamination
Substitution Replacing a hazardous material with a Use a fertilizer with less explosive potential than FGAN
safer option
Moderation Using a hazardous material under the Store FGAN in bins constructed of materials impervious to the
least hazardous conditions effects of AN (ammonium nitrate) and in areas where electric
service is not required
Limitation of effects Changing designs or reaction Construct FGAN storage bins to minimize the consequence of a
(a form of moderation) conditions rather than adding possible explosion
protective equipment
Simplification Eliminating process complexity to Limit the types of FGAN blends sold to minimize the need for
provide fewer opportunities for error staff to handle FGAN
and equipment failure

inherent safety applications in their own work upon handling protocols (especially in the case of batch
review and reflection.[2] processing), such as avoiding loose packaging and sup-
Occasionally, there is no need to search for how ISD plying materials in required quantities only.[54] In a simi-
might apply to the prevention and mitigation of a partic- lar vein, excessive use of clamps to contain hydrocarbons
ular incident. A striking case in point is the US Chemical in leaking process pipes should be discouraged; such
Safety Board (CSB) investigation report on the 2013 fire overuse may be indicative of a weak mechanical integrity
and explosion involving fertilizer grade ammonium management system.[55]
nitrate (FGAN) at the West Fertilizer Company in West,
TX.[53] Fifteen people were killed and 260 more were
injured, including emergency responders and members 3.2 | Substitution
of the public. Table 3 (which appears as table 6 on page
98 in CSB[53]) identifies, by principle, some possible ISD In the early 2000s, Nova Scotia Power Incorporated
approaches specifically for handling FGAN. (NSPI) was interested in the use of petroleum coke as an
additive fuel in their pulverized fuel boilers; petroleum
coke was cheaper, lower in volatile matter, and higher in
3.1 | Minimization fixed carbon than the bituminous coal already being bur-
ned. Fuel blending was attractive to the utility industry at
There is widespread and ongoing industrial interest in that time in its pursuit of less expensive and more envi-
fugitive emissions (small continuous leaks from process ronmentally benign fuels. While fuel substitution has
plant equipment and connection fittings), which produce economic benefits in the form of fuel cost savings, it also
small but ever-present concentrations of chemicals in the changes the explosion hazard of the plant in both the fuel
workplace environment and atmosphere.[3] In their study and ash handling systems.[56]
of fugitive emission sources in a petrochemical process, Using a 20-L laboratory-scale explosion chamber, the
Hassim et al[54] determined the main contributors to be present authors undertook a test program on behalf of
valves (50% of total emissions), pumps without mechani- NSPI to determine the extent to which substituting petro-
cal seals (30%), and flanges (8%). leum coke for a portion of the bituminous coal feed
They also suggested that generation of fugitive emis- resulted in an inherently safer fuel.[10] The main parame-
sions can be reduced by several means: (a) minimizing ters of interest were explosion overpressure, Pm, and rate
the number of individual equipment items through pro- of pressure rise, (dP/dt)m, which are indicative of explo-
cess optimization, which will help to minimize the num- sion violence from thermodynamic and kinetic perspec-
ber of flanges on connecting pipes; (b) minimizing tives, respectively. Figure 3 illustrates that while a fuel
material inventories wherever possible, which will result blend of 60% petroleum coke/40% Colombian coal, which
in smaller equipment size; and (c) effective material was achievable in a circulating fluidized bed boiler,
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
860 AMYOTTE AND KHAN

scale (eg, with respect to emergency response), exchange

of material streams, and optimization of energy
streams.[57] Given that these clusters are largely already
built, design-based protection of assets from external
threats can be challenging.
Comparable with the strategy of compartmentaliza-
tion in the case of fire safety, Reniers et al[57] illustrated
the use of attenuation by limitation of effects in
design-based security for chemical clusters to decrease
the possible extent of an undesired outcome. (Recall that
attenuation is the original name for the ISD principle of
moderation, and that limitation of effects is generally
viewed as a sub-principle of moderation.) In essence, they
recommend judicious protection of highly hazardous
installations such that the network of plants within the
cluster disintegrates into smaller networks with no esca-
lation danger between these separate islands.[57]
We return to the subject of limitation of effects (mod-
eration/attenuation) in the later section on domino
effects.

3.4 | Simplification
F I G U R E 3 Influence of petroleum coke percentage on the
explosion overpressure, Pm (top graph), and rate of pressure rise, The boundaries between categories in the hierarchy of
(dP/dt)m (bottom graph), of petroleum coke/Colombian coal fuel controls are not always crisp. While the concept of mak-
blends[10] ing equipment robust was previously identified as a com-
ponent of the ISD principle of simplification, some
process safety practitioners view the strengthening of pro-
showed only a 5% reduction in explosion overpressure cess plant to withstand upsets to be a passive safety
compared to the pure coal, the reduction in rate of pres- approach (in that, for example, extra wall thickness is
sure rise was significant at approximately 40%. Explo- added on to the original design). Similarly, the principles
sions of such mixtures would therefore eventually reach of ISD can often be applied with good effect to other hier-
about the same maximum overpressure as the coal dust archy levels; simplification of standard operating proce-
alone if left unchecked. They would, however, require a dures to ensure clarity of intent is a classic example of
smaller vent area to relieve the overpressure and tolerate ISD thinking applied to procedural safety. Recognition of
a longer reaction time for automatic suppression of an the human factors (eg, unclear instructions) underlying
incipient explosion. This observation reinforces the fact the potential for human error (eg, skipping a procedural
that ISD is not a standalone concept but rather one that step) is key to effective risk management.
works in concert with other levels in the hierarchy of There is thus a strong relationship between avoidance
controls, in this case ISD (partial substitution of petro- of human error and simplification of designs, process
leum coke for coal), passive engineered devices (explo- plant equipment and piping, and procedures. As detailed
sion vents), and active engineered devices (explosion by Kletz and Amyotte,[3] offshore oil and gas production
suppression systems). platforms represent a good example in this regard. The
first action in the escape, evacuation, and rescue (EER)
sequence during emergencies on offshore rigs is detection
3.3 | Moderation of the muster alarm; failure to detect this alarm is a rela-
tively high-probability event dependent on the initiating
A chemical industrial cluster can be defined as a geo- cause for the muster.[58] Alarm simplification can help to
graphically limited concentration of manufacturing com- facilitate ease of maintenance and lower the risk of alarm
panies and service providers operating in the chemical malfunction.[59,60] Deacon et al[61] extended this offshore
business.[57] There is a strong tradition of such linkages EER analysis beyond the escape stage to include evacua-
in the chemical industry for reasons such as benefits of tion, while Noroozi et al[62] examined human error
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
AMYOTTE AND KHAN 861

probabilities and the need for simplification of pump which has some relevant measure of improvement associ-
maintenance procedures. ated with it. Index values can then be compared for a
given process design before and after inherent safety con-
siderations have been applied, or between different pro-
4 | I N H E R EN T L Y S A F E R DE S I G N cess designs aimed at achieving the same objective in
INDICES terms of conversion of raw materials to value-added
products.
We remarked in the introduction that ISD is relative; no As mentioned earlier, our own research on inherent
single process can be considered safe from an inherent or safety measurement began with an analysis of process
any other perspective. Thus, while design and operational safety indices already available in the early 2000s:
changes can be made to enhance inherent safety features, (a) Dow Fire and Explosion Index (Dow FEI),[7,8]
we are left with the question as to how much safer the (b) Dow Chemical Exposure Index (Dow CEI),[7,8]
result is. So how does one measure inherent safety? One (c) Mond Fire, Explosion, and Toxicity Index (Mond
answer to this question is with a number (an index) Index),[8] (d) Safety Weighted Hazard Index (SWeHI),[8]

F I G U R E 4 Conceptual framework of
the Integrated Inherent Safety Index
(I2SI)[64]
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
862 AMYOTTE AND KHAN

and (e) Inherent Safety Index (ISI).[8] The ISD lens 5 | PROCESS DESIGN
through which we examined these indexing procedures
revealed that although none comprehensively captured It is widely known and accepted that inherently safer
the entire suite of inherent safety principles (Table 1), design achieves its greatest benefits when considered
several were robust on many accounts.[8] We then set out early in the sequence of process life cycle stages, as well
to develop a new index for ISD evaluation that would as early within a given stage. Thus, many researchers
address the identified shortcomings; the result was the including ourselves, have focused on the desirability of
Integrated Inherent Safety Index (I2SI)[63,64] shown con- explicit ISD consideration in process design. Such work
ceptually in Figure 4. consists of both provision of general guidance and devel-
As described by Khan and Amyotte,[64] I2SI is termed opment of specific tools (the latter, often in the form of
an integrated index because the procedure considers the indexing approaches as described in the previous
life cycle of the process under consideration, along with section).
economic evaluation and hazard potential identification For example, Tugnoli et al[68,69] emphasized the early
for each processing option (recall the relative nature of adoption of inherent and passive safety measures during
ISD). I2SI is comprised of sub-indices that account for plant layout design. They used I2SI[63,64] as the starting
hazard potential, inherent safety potential, add-on con- point for development of a Domino Hazard Index (DHI),
trol requirements (thus encompassing the full hierarchy which is related to the potential for event escalation in
of controls), and economic factors. The efficacy of I2SI congested plant. Moderation (or attenuation, along with
was demonstrated by application to 3 one-step acrylic limitation of effects) and simplification were determined
acid production options.[64] to be highly relevant to facility siting and overall plot
The technical literature is replete with other examples planning, both of which are key considerations under the
of indices designed to measure ISD performance in project review and design procedures element of the CSA
achieving cost-effective hazard and risk reduction. Kletz PSM standard[46] (Table 2). Extensive use of passive bar-
and Amyotte[2] identified 25 references published during riers such as blast walls and containment dikes was ana-
the period 2002-2009, which describe examples of inher- lyzed in light of potential negation of the simplification
ent safety assessment methodology development and elu- principle.[68]
cidation of assessment considerations. They observed Rathnayaka et al[70] considered the process design life
that[2]: cycle to be composed of the five stages shown in Figure 5.
Again using I2SI[63,64] as the basis, they developed a Risk-
• Many of the methods dealt specifically with the early based Inherent Safety Index (RISI) to serve as a design
concept and reaction route selection stages of the decision-making support tool that incorporates both con-
design process (as also reviewed in the next section of sequence severity and probability of occurrence. All pri-
the current paper). mary process incident scenarios were examined: fire,
• Some of the approaches used sophisticated mathemati-
cal and problem-solving techniques such as fuzzy logic
and statistical analysis.
• There was an increasing tendency to link inherent
safety with environmental and health issues in an
effort to achieve a hybrid SHE (Safety/Environment/
Health) approach.

Subsequent years have seen continued interest in ISD

performance measurement. For example, Eini et al[65]
developed an optimization scheme for choosing among
ISD options with consideration of both processing costs
and potential accident costs. Ahmad et al[66] recently
presented a graphical inherent safety assessment tech-
nique for the preliminary design stage. Interestingly, Gao
et al[67] adopted I2SI[63,64] as the basis for their own
Inherent Safety Applicability Index (IASI). The quest
continues to develop scientifically rigorous ISD indexing
techniques that are straightforward to implement and FIGURE 5 Classification of stages of the process design life
hence will be adopted by industry. cycle[70]
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
AMYOTTE AND KHAN 863

explosion, and toxic release, with explosions being fur- trade-off between increased storage pressure (working
ther subdivided by fuel type (gas, vapour, and dust). Yuan against moderation), and reduced inventory and increased
et al[71] focused entirely on prevention and mitigation of separation distance (working in favour of minimization
dust explosions in their analysis of risk-based design of and limitation of effects, respectively), created an
safety measures throughout all levels in the hierarchy improved overall risk profile.
of controls. The work of Khakzad et al[72] examined the Operational consideration of inherently safer design
use of Bayesian networks in risk-based process design to is therefore both possible and desirable. Rathnayaka
address issues such as data uncertainty, probability et al[77] developed a System Hazard Identification, Predic-
updating, and conditional dependency between primary tion and Prevention (SHIPP) methodology to aid in iden-
events and safety barriers. tifying and prioritizing inherently safer design and
Research on the role of ISD in process design, espe- operational strategies. In a second paper,[78] they applied
cially in the early stages of the design life cycle, has con- the SHIPP methodology and its embedded process acci-
tinued to the present day. A sampling of the recent dent model (Figure 6) to an LNG processing facility. This
literature reveals a description of hazard prevention strat- case study illustrates the usefulness of the approach in
egies for inherent safety assessment during preliminary implementing accident prevention strategies for opera-
design,[73] as well as development of a design technique tional plants based on the principles of ISD.
focused on the process equipment itself at the same pre- A unique feature of the SHIPP technique is a Bayes-
liminary stage.[74] Park et al[75] have given a recent and ian updating mechanism used to revise failure probabili-
comprehensive review on incorporating inherent safety ties of safety barriers by means of prior plant data (eg, the
strategies during the conceptual process design stage. occurrence of near-misses).[77,78] As noted by Amyotte et
al,[79] incidents such as the aforementioned Flixborough
explosion (1974) and the Bhopal gas tragedy (1984)[80]
6 | P R O C E S S OP E R A T I O N have demonstrated the need for such operational risk
updating. Known as dynamic safety analysis[81] or
An unfortunate by-product of emphasizing early consider- dynamic risk assessment (DRA),[82] this strategy, in con-
ation of ISD is the impression that inherent safety has lim- junction with the static risk assessments performed in
ited applicability to existing process plants. The reality is early design, is a key component of an overall manage-
that there are many possible ways to make a built facility ment plan for risk minimization. Just as equipment ages
inherently safer, especially when process and unit modifi- and measuring devices can be rendered inoperable by
cations are being conducted.[40] For example, Hendershot inadequate maintenance, the reasons for inclusion of
et al[76] illustrate the principle of minimization (hazardous inherent safety features in a process can be forgotten as
inventory reduction) applied to an existing bromine raw plant personnel relocate or retire. Risk must not be
material handling plant. Kletz and Amyotte[3] describe the viewed as a static concept.
case of a refinery that used to store ammonia refrigerated A current driver for dynamic management of opera-
and at atmospheric pressure in large spheres (over 30 m in tional risk is the advent of the fourth industrial revolu-
diameter) located close to the surrounding community. tion utilizing smart technology. Industry 4.0 is primarily
The spheres were replaced with horizontal pressure tanks based on the industrial Internet of things (IIoT), Internet
having a storage capacity about 10% of that of the spheres of Services (IoS), Internet of manufacturing services
and located over a kilometre from the community. The (IoMS), and artificial intelligence and cyber-physical

F I G U R E 6 Process accident
model utilized in the System
Hazard Identification, Prediction,
and Prevention (SHIPP)
methodology[77]
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
864 AMYOTTE AND KHAN

systems (CPS).[30] Industry is becoming increasingly reli- the blast blanket (a steel-rope mesh ballistic shield)
ant on process digitalization, which is defined as the inte- protecting the aboveground methyl isocyanate (MIC) day
gration of digital technologies in process operations for storage tank at a pesticide production facility in the
the purposes of greater efficiency and increased product United States. Although fragments from a vessel that had
quality.[30] With the accompanying use of sensors, other exploded in an adjacent unit struck the blast blanket, and
electronic devices, and information technology, a systems the shield was subjected to intense radiant heat from the
thinking and systems engineering approach has been fire caused by the explosion, the day tank itself was not
advocated to effect process safety improvements.[83] We damaged during the incident.[87] Had the shield failed or
would argue that inherently safer design will have a had missile fragments from the original explosion struck
prominent, although as yet largely undefined, role in this an unprotected part of the day tank, the consequences
endeavour. could have been disastrous. The company eventually
eliminated MIC production at the facility, although this
was done largely for business and community relation
7 | DOMINO EFFECTS reasons. MIC is the chemical that was released in the
1984 Bhopal gas tragedy.
Avoidance of domino or knock-on effects is a critical pro- Our published work on domino effects consists of
cess safety concern. Domino incidents involve a sequence both fundamental treatments and applied design-
of events in which a primary incident (usually a fire or oriented papers. In the former category we would include
explosion) triggers further incidents with an overall esca- research on vessel overpressure hazards and missile frag-
lation of event consequences.[84] Cozzani et al[85] give a ment generation, trajectory, and impact.[88–90] Design
comprehensive overview of domino chains in terms of guidance efforts have focused on safety barrier analysis
primary scenarios, escalation vectors, and potential sec- and plant layout considerations,[91] Bayesian network
ondary scenarios. For example, a hydrocarbon pool fire
would be expected to escalate by means of heat radiation
or direct fire impingement on an adjacent process vessel;
depending on the hazards of the target vessel inventory,
the result could be a pool fire, jet fire, BLEVE (boiling liq-
uid expanding vapour explosion), or toxic release.[85]
There are a number of ways in which the principles
of ISD help to prevent and mitigate domino effects. Mini-
mization of hazardous inventories can reduce the severity
of consequences (eg, thermal flux) arising from an initiat-
ing event such as ignition of a fuel spill. Substitution of
dust-tight equipment for process plant prone to material
leaks will reduce the formation of dust layers acting as
targets for secondary explosions. Moderation by lowering
the operating pressure inside a process vessel similarly
lowers the kinetic energy and therefore the travel dis- F I G U R E 7 Post-incident view of the methyl isocyanate (MIC)
tance of missile fragments generated by vessel rupture. day tank blast shield at a Bayer CropScience plant[87]
Thoughtful plant layout considerations can help to
achieve limitation of effects (moderation) through the
use of safe separation distances, especially between units
processing hazardous materials and buildings (temporary
or permanent) housing people. Simplification by making
equipment robust and avoiding complex vessel intercon-
nections is also beneficial in addressing the problem of
domino effects.
Amyotte[86] recounts an example of successful dom-
ino avoidance brought about by a passive engineered
device. (Recall that ISD works in concert with other
levels in the hierarchy of controls and that passive safety
measures sit just below ISD in the hierarchy with respect
to effectiveness.) Figure 7 gives a post-incident view of FIGURE 8 The explosion pentagon[96]
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
AMYOTTE AND KHAN 865

analysis to address a variety of issues including structural (a) admixture of solid inertants, (b) increase of the dust
uncertainty,[92–94] and Bayesian network analysis focused particle size, and (c) avoidance of the formation of
specifically on the domino sequence of primary and sec- hybrid mixtures.
ondary dust explosions.[95]

8.1 | Solid inertants

8 | DUST EXPLOSIONS
The term inerting applies when attempting to prevent
The occurrence of dust explosions in the manner just the occurrence of a dust explosion. Use of an inert dust
described (primary ! secondary) is best understood with (eg, limestone, dolomite, sodium bicarbonate, or mono-
reference to the dust explosion pentagon illustrated in ammonium phosphate) premixed in sufficient amount
Figure 8. Here we see the familiar fire triangle (fuel, oxi- with a combustible dust can lead to removal of the heat
dant, and ignition source) augmented by two additional necessary for combustion. Depending on its composi-
components (mixing and confinement). Because tion, the inertant may act purely as a thermal sink or
explosible dust clouds are optically thick and have air- may also interfere with the actual combustion reactions;
borne dust concentrations orders of magnitude higher inertants are therefore classified as either physical or
than those permissible by occupational hygiene regula- chemical inhibitors. There are obvious limitations on
tions, primary dust explosions typically occur inside pro- the use of solid inerting. The technique is likely feasible
cess units. Following loss of containment in the primary when the combustible dust is a waste by-product (such
vessel (eg, a spray drier), secondary explosions or flash as float coal dust in the case of coal mines or pulverized
fires occur due to entrainment of dust layers (ie, mixing fuel facilities). On the other hand, the technique is more
of fuel and oxidant) by the blast waves arising from the difficult to employ (although not impossible) when the
primary explosion.[97] combustible dust is the actual value-added
Dust explosions are an ever-present threat not only in product.[107,108]
the chemical process industries, but in any industrial/ The term suppression arises when focusing on mit-
manufacturing application where bulk powders are han- igating the consequences of a dust explosion. As with
dled. Nevertheless, effective dust explosion risk reduction inerting, the intent is to remove the heat necessary
can be achieved only by adopting an approach based on for sustained combustion and thus to limit the genera-
the principles of process safety.[43,98] This requires the tion of destructive overpressures in an enclosed vol-
use of ISD measures in addition to passive and active ume. In the case of suppression, however, the inert
devices and procedural safety.[99–101] dust is injected into the just-ignited explosible dust/air
Amyotte[43] gives a hierarchical view of the various mixture rather than being intimately premixed with
means of preventing and mitigating dust explosions; the combustible dust prior to ignition (as in the case
examples include the following: (a) explosion-pressure of inerting). As previously indicated, explosion sup-
resistant construction (ISD - simplification), (b) explosion pression is an active engineered safety measure. It
venting (passive), (c) automatic explosion suppression requires the use of pressure sensors, fast-acting valves,
(active), and (d) control of ignition sources by hot-work and high-rate discharge canisters, all of which must
permitting (procedural). Numerous other examples of be regularly inspected and maintained to increase
inherent safety measures to address the dust explosion their likelihood of proper functioning when called
problem are provided by Amyotte et al.[36] Guidance on upon to act.[107,108]
risk-based decision making for safety measure selection In addition to previously referenced papers,[10,52,56]
is also available.[9,71,95,102–106] our body of work on admixture of solid inertants to mod-
Of the four main ISD principles, moderation argu- erate dust explosion hazards includes studies on:
ably presents the greatest challenge to visualize the
intent of the principle; the names of minimization, sub- • the use of various rock dusts (limestone, dolomite, and
stitution, and simplification alone seem to convey their magnesite) in coal dust explosion applications,[109,110]
meaning quite well. Combustible dusts, however, afford • prevention and mitigation of dust layer fires,[111–115]
several concrete opportunities for moderating the haz- • development of a new explosibility parameter known
ard they pose by utilizing the underlying chemistry and as the minimum inerting concentration (MIC),[116–118]
physics of dust explosion phenomena. Three aspects of • the presence of fly ash in pulverized fuel carry-over
moderation, all focused primarily on the fuel compo- streams,[119,120] and
nent of the explosion pentagon, have been the subject • mixtures of micro- and nano-size metals with micro-
of much of our dust explosion research over the years: and nano-size metallic oxides.[121–123]
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
866 AMYOTTE AND KHAN

8.2 | Particle size which hydrocarbon gas (either free or dissolved in the
resin) is removed in a nitrogen environment. The resin
Of all possible material characteristics, particle size then enters a series of storage bins; the first of these units
(or more properly, particle size distribution) has the poses a particular challenge for explosion prevention and
greatest impact on dust explosion likelihood and conse- mitigation because of the potential for residual hydrocar-
quence severity parameters. It is well-established that bon gas to be present. Gases of concern include ethylene,
finer sized combustible dust is easier to ignite by electric hexane, hexene, and isopentane.[133]
sparks, hot surfaces, and other ignition sources, requires Amyotte et al[133] conducted an experimental study of
smaller amounts of dust to sustain an explosion, and the above scenario via explosion testing of a combustible
leads to higher overpressures and rates of pressure rise in dust both in air and in an atmosphere with flammable
enclosed volumes. The explanation is straightforward; a gas admixed at a concentration just below its LFL. Ethyl-
decrease in particle size leads to an increase in particle ene, hexane, and propane (the latter because of its similar
surface area and therefore an enhancement of dust burning velocity to hexane) were used along with poly-
reactivity.[43] ethylene resin; tests were conducted with a 20-L
Thus, shifting the particle size distribution of a com- laboratory-scale explosion chamber. Figure 9 shows the
bustible dust to larger sizes whenever feasible can be parameter KSt as a function of the volume median diame-
expected to have a moderating effect on explosibility, as ter of three polyethylene samples; KSt is the maximum
the hazardous material is being used in a less hazardous rate of pressure rise normalized by multiplying by the
form (Table 1). Efforts in this area by our research teams cube-root of the vessel volume (20 L). Clearly, the explo-
have involved the following: (a) empirical examination of sion risk increases in terms of heightened consequence
the influence of both combustible dust and inertant parti- severity with either particle size reduction or flammable
cle size distributions[124,125]; (b) thermo-kinetic and phe- gas admixture. Application of the moderation principle
nomenological modelling[126,127]; and (c) testing of would indicate the need to monitor and alter processing
flocculent (fibrous) wood, polyethylene, polyamide, and methods and parameters whenever possible to avoid
polyester,[128,129] and nano-size titanium[130] (which we these conditions.
have termed nontraditional dusts[131] to distinguish them This line of research was later extended to pharma-
from more typical spherical or near-spherical micro-size ceutical dusts by examining the formation of hybrid mix-
powders). A recent study by Cloney et al[132] investigated tures with admixture of solvent in both liquid and vapour
the influence of particle diameter on the explosion limits states.[134] Predictive modelling work on hybrid mixture
of coal dust/methane hybrid mixtures. explosions has also been recently undertaken.[135–137]

8.3 | Hybrid mixtures 9 | CASE STUDIES

Hybrid mixtures consist of a flammable gas and a com- As evidenced by the current paper, much of our work has
bustible dust, each of which may be present in an involved development of ISD methodologies and proto-
amount less than the lower flammable limit (LFL) of the cols for specific purposes such as process hazard analysis,
gas and the minimum explosible concentration (MEC) of incident investigation, comparative evaluation of designs,
the dust, and still give rise to an explosible mixture.
Avoiding the generation of hybrid mixtures is an impor-
tant consideration in dust explosion moderation. This is
especially critical in the case of inadvertent admixture of
a flammable gas in concentrations below its LFL to an
already explosible concentration of dusts. Synergistic
effects can create a situation where the resulting fuel
mixture is more hazardous than either of its individual
components.[43]
A relevant industrial example is the production of
high-density polyethylene (HDPE) in a catalytic
fluidized-bed reactor. Oxygen is treated as a contaminant
and is therefore excluded from the reactor inventory,
which contains hydrocarbon gas, polyethylene resin, and F I G U R E 9 Dust and hybrid mixture size-normalized maximum
catalyst. Product from the reactor enters a purge unit in rate of pressure rise as a function of particle diameter[133]
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
AMYOTTE AND KHAN 867

and the like. In these cases, we typically employ a case safer alternatives, such as air, are just as effective as natu-
study to test and validate the research product. Recall, for ral gas for cleaning fuel gas piping.[140]
example, the aforementioned SHIPP methodology[77] and Major accidents happen in the chemical process
its application to an LNG processing facility.[78] industries (CPI) with relatively low frequencies but
Looking into the past to learn lessons for the preven- extremely severe consequences.[79] Yet they do occur,
tion of future incidents is also a fundamental tenet of pro- sometimes with repeat appearances in venues and
cess safety education, research, and practice.[2,3,138] In this applications seemingly unrelated to the CPI. As
regard, we have conducted critical reviews of the 1984 expressed recently by Dr. Katherine Lemos, Chairper-
Union Carbide Bhopal gas tragedy[79,80] and the 2005 BP son and CEO of the CSB: “The video accounts are stun-
Texas City refinery explosion[139] for ISD and other process ning. Smoke emerges over the city as yellow flames
safety lessons. We were also privileged to respond to a reach towards the sky. A few seconds later an explosion
request to expand a conference presentation[28] into a and its resulting pressure wave leave death and destruc-
paper for the Loss Prevention Bulletin,[55] which is publi- tion in its wake. This was West, Texas in 2013. This is
shed by the UK Institution of Chemical Engineers Beirut, Lebanon in 2020. As details of Tuesday’s acci-
(IChemE). This work presents an analysis of six process dent continue to emerge, one thing is clear: we have
incidents investigated by the US Chemical Safety Board seen this before.”[141]
(described in the next section of the current paper). Pre- The explosion of 2750 t of ammonium nitrate in a
ventive lessons were sought for three key process safety Port of Beirut warehouse on 4 August 2020 and the
concepts: inherently safer design, recognition of warning accompanying catastrophic loss of human life were nei-
signs (precursor events), and safety culture. ther unpredictable nor unpreventable. The warning signs
Figure 10 shows a gas blow used to remove pipeline from previous incidents (eg, Table 3) are quite clear in
debris at the Kleen Energy power plant in Middletown, this regard. If inherently safer design can teach us only
CT one week before repeated application of this proce- one thing, let it be the lesson that storage, transportation,
dure led to an explosion in 2010 that killed six and processing of huge quantities of hazardous materials
workers.[55] The fuel for the explosion was natural gas are all fraught with peril. When something goes wrong,
being forced through a pipe at a pressure of 4.5 MPa safety devices, control systems, and human beings will
and eventually exiting into a congested outdoor work need to act and perform with near-perfection. Often, this
area where a number of potential ignition sources is asking too much of people and inanimate objects.
existed.[140]
As explained by Amyotte and Khan,[28] one of the rec-
ommendations from the subsequent CSB report invokes 10 | UNITED STATES CHEMICAL
the inherent safety principle of substitution in the case of S A F ET Y A N D HA Z A R D
replacing natural gas with a less hazardous gas, such as INVESTIGATION BOARD
air, in the cleaning of fuel gas piping.[140] The principle of
simplification is also relevant here in helping to ease the As noted on its web site (www.csb.gov), the United States
complex requirements for discharge design when using Chemical Safety and Hazard Investigation Board
natural gas for pipeline cleaning. Additionally, the CSB (US Chemical Safety Board or CSB) is an independent,
report addresses the issue of whether alternative cleaning nonregulatory federal agency that investigates the root
methods are technically feasible by commenting that causes of major chemical incidents. The CSB is a valuable
source of process safety information and case studies in
both written and video formats. The following adaptation
from Kletz and Amyotte[3] illustrates some of the lessons
that can be learned from the CSB’s investigative work.
Amyotte et al[142,143] reviewed 85 CSB reports publi-
shed over the period 1998-2016 for specific examples of
application, or lack thereof, of the hierarchy of controls.
A total of 680 hierarchy examples were found, with the
breakdown by category being 26% ISD, 10% passive, 16%
active, and 48% procedural. Analysis of the 25 reports
published during 2009-2016 showed the following[143]:

F I G U R E 1 0 Cleaning of fuel gas piping by a gas blow at the • With respect to incident prevention, the highest per-
Kleen Energy site one week before the incident[140] centage of examples was procedural in nature. This
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
868 AMYOTTE AND KHAN

was attributed to a general reliance on safe work pro- Is ISD common knowledge? Yes, it is, if for no other
cedures and other administrative controls in the pro- reason than a generation of senior engineers and man-
cess industries (at least in the companies experiencing agers who missed out on acquiring ISD information dur-
significant loss). ing their careers has retired. And a generation of process
• With respect to consequence mitigation, the highest safety educators has taught ISD principles and applica-
percentage of examples was related to active tions to two decades’ worth of engineers now in
engineered safety measures. This was attributed to the mid-career and established in technical and managerial
widespread use in the process industries (and hence, positions. We have textbooks, conference sessions,
more extensive mention in CSB reports) of emergency journal special issues, trade publication articles, CPD
alarms and automatic fire/explosion suppression sys- (continuing professional development) courses, regula-
tems. Such active measures are often required by exter- tions (in some jurisdictions), codified standards, and so
nal codes, standards, and regulations. on, all devoted to ISD. There is now a critical mass of
• With respect to inherently safer design, numerous educators, researchers, and practitioners who, if they
examples were found for each of the four main ISD believe the answer to this question is still “not really,”
principles with the highest percentage being related to will work tirelessly to change the answer to “yes.”
moderation. This was attributed, in part, to a high Is ISD common application? Increasingly, it would
number of facility siting and safe separation distance seem. As researchers resident in academia, and in spite
issues (which, as previously identified in the current of our strong ties to industrial colleagues and research
paper, fall under the moderation sub-principle of limi- sponsors, we do not have personal in-depth knowledge of
tation of effects). the state of ISD application throughout the entire chemi-
cal process industries. The answer to this question comes
Ongoing and explicit use of ISD terminology by the largely from our attendance and presentation at process
US Chemical Safety Board plays a significant role in com- safety conferences such as the Process Safety Manage-
munication of ISD benefits to industry. ment Symposium (Canadian Society for Chemical Engi-
neering, CSChE), Global Congress on Process Safety
(Center for Chemical Process Safety, CCPS), Hazards
11 | CONCLUDING REMARKS (Institution of Chemical Engineers, IChemE), and the
International Symposium on Loss Prevention and Safety
As mentioned in the introduction, the current paper is a Promotion in the Process Industries (European Federa-
feature article in which our approach was to highlight tion of Chemical Engineering, EFCE). The majority of
our fundamental and applied work in the field of inher- presenters at these conferences come from industry or
ently safer design. Hence, most of the references cited are have an industrial background. Highly informative
from our own research teams. Readers will of course be papers on process safety applications and issues in their
aware that many other researchers and practitioners have companies are the norm; ISD is often a popular theme.
made significant advances in our collective understand- Our guarded optimism in expressing this opinion of
ing of the ISD way of thinking. increasingly common application is tempered by the root
We also remarked in the introduction that we would cause analysis work of the US Chemical Safety Board, in
update our answers to the questions: Is inherently safer which ISD deficiencies are often cited as contributing fac-
design common sense, common knowledge, and com- tors to an incident.
mon application? At the time of publication of Khan and The future of inherently safer design is wide open. ISD
Amyotte,[1] the responses were essentially “perhaps,” is an expansive topic that can fit into any discussion of
“not really,” and “no,” respectively. Almost 20 years later, process safety research and practice needs:
our opinions have changed. (a) incorporation in PSM system elements, (b) elucidation
Is ISD common sense? This is not really a reasonable of example-based guidance by principle, (c) development
question to ask because one person’s common sense is of simple but rigorous tools for industrial use,
another person’s lack of comprehension. Answer “yes” (d) application to process safety topics other than dust
and ISD implementation must therefore be easy and explosions (eg, process fires and gas explosions), and
straightforward. Answer “no” and risk ridicule for not (e) use in dynamic risk assessment during the current digi-
understanding the seemingly simplest of concepts. As the talization era. Other topics not emphasized in the current
old saying goes, common sense is not so common. Per- paper also hold promise for ISD implementation in terms
haps we can just agree that ISD makes good sense. It is of its relationship to process safety culture, process secu-
definitely something worth considering early in a design rity, process control, and process intensification.
life cycle. We close with two final thoughts:
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
AMYOTTE AND KHAN 869

1. Inherently safer design will not cure all process safety Safety Research Agenda for the 21st Century. A Policy Docu-
ills and should never be viewed as the only approach ment Developed by a Representation of the Global Process
to risk reduction. ISD is hazard specific and is but one Safety Academia (October 21-22, 2011, College Station, TX),
Mary Kay O’Connor Process Safety Center, Texas A&M Uni-
level in the hierarchy of controls. It happens to be the
versity System, College Station, TX 2012.
most effective level in the hierarchy, so it’s a good [15] Mary Kay O’Connor Process Safety Center (M. S. Mannan)
place to start when faced with a hazard. and IChemE Safety Centre (T. Kerin) Process Safety for the
2. Professor Trevor Kletz said it first and he said it best: 21st Century and Beyond Project, Process Safety for the 21st
What you don’t have, can’t leak. Century and Beyond, Mary Kay O’Connor Process Safety Cen-
ter, Texas A&M University System, College Station, TX &
ACK NO WLE DGE MEN TS IChemE Safety Centre, Institution of Chemical Engineers,
Rugby, UK 2017.
The authors gratefully acknowledge the significant contribu-
[16] P. R. Amyotte, Chem. World 2011, 8(1), 84.
tions of all research team members and other colleagues
[17] P. Amyotte, F. Khan, presented at Total Process Engineering
who have contributed over the years to the work described Meeting (PEM), Brussels, Belgium, October 2015.
in this paper. Gratitude is also expressed to the academic [18] P. R. Amyotte, presented at Short Course on Hierarchy of
institutions, industrial companies, and government agencies Hazard Control Analysis, Santa Ana, CA, June 2018.
that have provided research funding and other forms of sup- [19] P. R. Amyotte, presented at Public Hearing on Chevron Rich-
port. We especially wish to acknowledge Dalhousie Univer- mond Refinery Fire, Richmond, CA, April 2013.
sity, Memorial University, and the Natural Sciences and [20] F. I. Khan, P. R. Amyotte, presented at Workshop on Inher-
ently Safer Design, St. John’s, NL, January 2009.
Engineering Research Council of Canada.
[21] P. R. Amyotte, F. I. Khan, T. A. Kletz, Hazards XXI, IChemE
Symp. Series No. 155, Institution of Chemical Engineers,
P EE R R EV IE W Manchester, UK 2009, pp. 736–743.
The peer review history for this article is available at [22] P. R. Amyotte, presented at Int. Conf. on Safe Production and
https://publons.com/publon/10.1002/cjce.23987. Use of Nanomaterials (Nanosafe2010), Grenoble, France,
November 2010.
R EF E RE N C E S [23] P. R. Amyotte, presented at 2011 World Engineers’ Conven-
tion, Geneva, Switzerland, September 2011.
[1] F. I. Khan, P. R. Amyotte, Can. J. Chem. Eng. 2003, 81, 2.
[24] P. R. Amyotte, M. J. Pegg, F. I. Khan, M. Nifuku, T. Yingxin,
[2] T. Kletz, P. Amyotte, Process Plants. A Handbook for Inher-
presented at Spring Technical Meeting of Combustion Insti-
ently Safer Design, 2nd ed., CRC Press/Taylor & Francis
tute (Canadian Section), Waterloo, ON, May 2006.
Group, Boca Raton, FL 2010.
[25] K. Rayner Brown, P. Amyotte, F. Khan, M. Hastie, presented
[3] T. Kletz, P. Amyotte, What Went Wrong? Case Histories of
at 69th Canadian Chemical Engineering Conf., Halifax, NS,
Process Plant Disasters and How They Could Have Been
October 2019.
Avoided, 6th ed., Elsevier, Oxford, UK 2019.
[26] F. I. Khan, P. R. Amyotte, presented at 37th Annual Loss Pre-
[4] CCPS (Center for Chemical Process Safety), Inherently Safer
vention Symp., AIChE 2003 Spring National Meeting, New
Chemical Processes: A Life Cycle Approach, 3rd ed., John
Orleans, LA, March 2003.
Wiley and Sons, Inc., Hoboken, NJ 2019.
[27] F. I. Khan, P. R. Amyotte, presented at Bhopal Gas Tragedy and
[5] G. Reniers, P. Amyotte, J. Loss Prev. Process Ind. 2012, 25, 227.
its Effects on Process Safety: Int. Conf. on the 20th Anniversary
[6] F. I. Khan, P. R. Amyotte, J. Loss Prev. Process Ind. 2002, 15, 279.
of the Bhopal Gas Tragedy, Kanpur, India, December 2004.
[7] C. B. Etowa, P. R. Amyotte, M. J. Pegg, F. I. Khan, J. Loss
[28] P. Amyotte, F. Khan, presented at 15th Int. Symp. on Loss
Prev. Process Ind. 2002, 15, 477.
Prevention and Safety Promotion in the Process Industries,
[8] F. I. Khan, R. Sadiq, P. R. Amyotte, Process Saf. Prog. 2003,
Freiburg, Germany, June 2016.
22, 83.
[29] P. R. Amyotte, Process Saf. Prog. 2013, 32, 126.
[9] P. R. Amyotte, F. I. Khan, J. Phys. IV 2002, 12, Pr7-189.
[30] F. Khan, P. Amyotte, S. Adedigba, Educ. Chem. Eng. 2021, 34, 33.
[10] P. R. Amyotte, A. Basu, F. I. Khan, Process Saf. Environ. Prot.
[31] M. Poliakoff, Chem. Eng. 2013, 866, 42.
2003, 81, 457.
[32] P. Amyotte, A. Miyake, G. Reniers, J. Loss Prev. Process Ind.
[11] M. T. Amin, F. Khan, P. Amyotte, Process Saf. Environ. Prot.
2012, 25, 761.
2019, 126, 366.
[33] D. W. Edwards, J. P. Gupta, Process Saf. Environ. Prot. 2012,
[12] J. Li, F. Goerlandt, G. Reniers, J. Loss Prev. Process Ind. 2020,
90, 341.
65, 104141.
[34] TCE (The Chemical Engineer), Chem. Eng. 2012, 856, 53.
[13] National Research Council of the National Academies, Board
[35] D. Edwards, Chem. Eng. 2013/2014, 870/871, 60.
on Chemical Sciences and Technology, Committee on Inher-
[36] P. R. Amyotte, M. J. Pegg, F. I. Khan, Process Saf. Environ.
ently Safer Chemical Processes: The Use of Methyl Isocya-
Prot. 2009, 87, 35.
nate (MIC) at Bayer CropScience, The Use and Storage of
[37] D. C. Hendershot, Process Saf. Prog. 2010, 29, 389.
Methyl Isocyanate (MIC) at Bayer CropScience, The National
[38] D. C. Hendershot, Chem. Eng. Prog. 2012, 108(1), 40.
Academies Press, Washington, DC 2012.
[39] S. T. Maher, K. D. Norton, S. Surmeli, Chem. Eng. Prog. 2012,
[14] Mary Kay O’Connor Process Safety Center, Texas A&M Uni-
108(1), 43.
versity System, A Frontiers of Research Workshop, Process
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
870 AMYOTTE AND KHAN

[40] V. H. Edwards, J. Chosnek, Chem. Eng. Prog. 2012, 108(1), 48. [67] X. Gao, A. A. A. Raman, H. F. Hizaddin, A. Buthiyappan,
[41] P. R. Amyotte, C. S. Lupien, in Methods in Chemical Process M. H. Bello, J. Loss Prev. Process Ind. 2020, 65, 104133.
Safety, Vol. 1 (Ed: F. Khan), Elsevier/Academic Press, Cam- [68] A. Tugnoli, F. Khan, P. Amyotte, V. Cozzani, J. Hazard.
bridge, MA 2017, p. 87. Mater. 2008, 160, 100.
[42] OSHA (Occupational Safety and Health Administration), [69] A. Tugnoli, F. Khan, P. Amyotte, V. Cozzani, J. Hazard.
Process Safety Management, OSHA 3132, US Department of Mater. 2008, 160, 110.
Labor, Occupational Safety and Health Administration, [70] S. Rathnayaka, F. Khan, P. Amyotte, Saf. Sci. 2014, 70, 438.
Washington, DC 2000. [71] Z. Yuan, N. Khakzad, F. Khan, P. Amyotte, G. Reniers, Ind.
[43] P. Amyotte, An Introduction to Dust Explosions. Understanding Eng. Chem. Res. 2013, 52, 18095.
the Myths and Realities of Dust Explosions for a Safer Workplace, [72] N. Khakzad, F. Khan, P. Amyotte, Reliab. Eng. Syst. Saf. 2013,
Elsevier/Butterworth-Heinemann, Waltham, MA 2013. 109, 5.
[44] CSChE (Canadian Society for Chemical Engineering), Process [73] S. I. Ahmad, H. Hashim, M. H. Hassim, R. Rashid, Process
Safety Management Guide, 4th ed., Canadian Society for Saf. Environ. Prot. 2019, 121, 271.
Chemical Engineering, Ottawa, ON 2012. [74] M. Athar, A. M. Shariff, A. Buang, S. Nazir, H. Hermansyah,
[45] CSChE (Canadian Society for Chemical Engineering), Process T. L. See, Process Saf. Environ. Prot. 2019, 128, 14.
Safety Management Standard, 1st ed., Canadian Society for [75] S. Park, S. Xu, W. Rogers, H. Pasman, M. M. El-Halwagi,
Chemical Engineering, Ottawa, ON 2012. J. Loss Prev. Process Ind. 2020, 63, 104040.
[46] CSA Group, Process Safety Management, CAN/CSA-Z767-17, [76] D. C. Hendershot, J. A. Sussman, G. E. Winkler, G. L. Dill,
CSA Group, Toronto, ON 2017. Process Saf. Prog. 2006, 25, 52.
[47] K. Rayner Brown, A. Addo, F. I. Khan, P. R. Amyotte, in [77] S. Rathnayaka, F. Khan, P. Amyotte, Process Saf. Environ.
Methods in Chemical Process Safety, Vol. 4 (Eds: F. Khan, P. Prot. 2011, 89, 151.
Amyotte), Elsevier/Academic Press, Cambridge, MA 2020, [78] S. Rathnayaka, F. Khan, P. Amyotte, Process Saf. Environ.
p. 379. Prot. 2011, 89, 75.
[48] P. R. Amyotte, A. U. Goraya, D. C. Hendershot, F. I. Khan, [79] P. R. Amyotte, S. Berger, D. W. Edwards, J. P. Gupta, D. C.
Process Saf. Prog. 2007, 26, 333. Hendershot, F. I. Khan, M. S. Mannan, R. J. Willey, Curr.
[49] B. K. Vaughen, K. Bloch, Chem. Eng. Prog. 2016, 112(12), 30. Opin. Chem. Eng. 2016, 14, 1.
[50] A. Goraya, P. R. Amyotte, F. I. Khan, Process Saf. Prog. 2004, [80] M. Yang, F. Khan, P. Amyotte, Process Saf. Environ. Prot.
23, 197. 2015, 97, 70.
[51] X. Gao, A. A. A. Raman, H. F. Hizaddin, M. H. Bello, J. Loss [81] N. Khakzad, F. Khan, P. Amyotte, Process Saf. Environ. Prot.
Prev. Process Ind. 2020, 65, 104092. 2013, 91, 46.
[52] K. J. Mintz, M. J. Bray, D. J. Zuliani, P. R. Amyotte, M. J. [82] F. Khan, S. J. Hashemi, N. Paltrinieri, P. Amyotte, V.
Pegg, J. Loss Prev. Process Ind. 1996, 9, 77. Cozzani, G. Reniers, Curr. Opin. Chem. Eng. 2016, 14, 9.
[53] CSB (Chemical Safety Board), Investigation Report – West Fer- [83] J. Lee, I. Cameron, M. Hassall, Process Saf. Environ. Prot.
tilizer Company Fire and Explosion, Report No. 2013-02-I-TX, 2019, 132, 325.
US Chemical Safety and Hazard Investigation Board, [84] J. Li, G. Reniers, V. Cozzani, F. Khan, J. Loss Prev. Process
Washington, DC 2016. Ind. 2017, 49, 103.
[54] M. H. Hassim, M. Hurme, P. R. Amyotte, F. I. Khan, J. Loss [85] V. Cozzani, G. Gubinelli, E. Salzano, J. Hazard. Mater. 2006,
Prev. Process Ind. 2012, 25, 820. 129, 1.
[55] P. Amyotte, C. Lupien, F. Khan, Loss Prev. Bull. 2017, 253, 14. [86] P. R. Amyotte, Process Saf. Environ. Prot. 2020, 135, 179.
[56] P. R. Amyotte, F. I. Khan, A. Basu, A. G. Dastidar, R. K. [87] CSB (Chemical Safety Board), Investigation Report – Pesticide
Dumeah, W. L. Erving, J. Loss Prev. Process Ind. 2006, 19, 142. Chemical Runaway Reaction, Pressure Vessel Explosion –
[57] G. L. L. Reniers, K. Sorensen, F. Khan, P. Amyotte, Reliab. Bayer CropScience LP, Report No. 2008-08-I-WV, US Chemi-
Eng. Syst. Saf. 2014, 131, 94. cal Safety and Hazard Investigation Board, Washington, DC
[58] D. G. DiMattia, F. I. Khan, P. R. Amyotte, J. Loss Prev. Process 2011.
Ind. 2005, 18, 488. [88] E. Salzano, P. Hoorelbeke, F. Khan, P. Amyotte, in Domino
[59] F. I. Khan, P. R. Amyotte, D. G. DiMattia, Saf. Sci. 2006, 44, 313. Effects in the Process Industries. Modeling, Prevention and
[60] T. Deacon, P. R. Amyotte, F. I. Khan, Saf. Sci. 2010, 48, 803. Management (Eds: G. Reniers, V. Cozzani), Elsevier, Wal-
[61] T. Deacon, P. R. Amyotte, F. I. Khan, S. MacKinnon, Saf. Sci. tham, MA 2013, p. 43.
2013, 51, 319. [89] R. C. Pula, F. I. Khan, B. Veitch, P. R. Amyotte, Process Saf.
[62] A. Noroozi, F. Khan, S. MacKinnon, P. Amyotte, T. Deacon, Prog. 2007, 26, 129.
Process Saf. Environ. Prot. 2014, 92, 131. [90] A. Tugnoli, V. Cozzani, F. Khan, P. Amyotte, in Domino
[63] F. I. Khan, P. R. Amyotte, Process Saf. Prog. 2004, 23, 136. Effects in the Process Industries. Modeling, Prevention and
[64] F. I. Khan, P. R. Amyotte, J. Loss Prev. Process Ind. 2005, Management (Eds: G. Reniers, V. Cozzani), Elsevier, Wal-
18, 310. tham, MA 2013, p. 116.
[65] S. Eini, B. Abdolhamidzadeh, G. Reniers, D. Rashtchian, Pro- [91] A. Tugnoli, V. Cozzani, F. Khan, P. Amyotte, in Domino
cess Saf. Environ. Prot. 2015, 93, 89. Effects in the Process Industries. Modeling, Prevention and
[66] S. I. Ahmad, H. Hashim, M. H. Hassim, R. Rashid, Process Management (Eds: G. Reniers, V. Cozzani), Elsevier, Wal-
Saf. Environ. Prot. 2019, 130, 275. tham, MA 2013, p. 242.
 1939019x, 2021, 4, Downloaded from https://onlinelibrary.wiley.com/doi/10.1002/cjce.23987 by Egyptian National Sti. Network (Enstinet), Wiley Online Library on [29/09/2023]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
AMYOTTE AND KHAN 871

[92] N. Khakzad, F. Khan, P. Amyotte, V. Cozzani, Risk Anal. [122] C. Yuan, P. R. Amyotte, M. N. Hossain, C. Li, J. Hazard.
2013, 33, 293. Mater. 2014, 275, 1.
[93] N. Khakzad, F. Khan, P. Amyotte, V. Cozzani, Risk Anal. [123] Y. Bu, C. Li, P. Amyotte, W. Yuan, C. Yuan, G. Li, J. Hazard.
2014, 34, 1128. Mater. 2020, 381, 120968.
[94] N. Khakzad, P. Amyotte, V. Cozzani, G. Reniers, H. Pasman, [124] P. R. Amyotte, K. J. Mintz, M. J. Pegg, Process Saf. Environ.
J. Loss Prev. Process Ind. 2018, 54, 49. Prot. 1995, 73, 89.
[95] Z. Yuan, N. Khakzad, F. Khan, P. Amyotte, Process Saf. Envi- [125] A. G. Dastidar, P. R. Amyotte, M. J. Pegg, Fuel 1997, 76, 663.
ron. Prot. 2016, 100, 108. [126] A. di Benedetto, P. Russo, P. Amyotte, N. Marchand, Chem.
[96] P. R. Amyotte, M. P. Clouthier, F. I. Khan, in Methods in Eng. Sci. 2010, 65, 772.
Chemical Process Safety, Vol. 3 (Eds: P. Amyotte, F. [127] P. Russo, P. R. Amyotte, F. I. Khan, A. di Benedetto, J. Loss
Khan), Elsevier/Academic Press, Cambridge, MA Prev. Process Ind. 2013, 26, 1634.
2019, p. 1. [128] P. R. Amyotte, C. T. Cloney, F. I. Khan, R. C. Ripley, J. Loss
[97] P. Amyotte, M. Clouthier, in Perry’s Chemical Engineers’ Prev. Process Ind. 2012, 25, 862.
Handbook, 9th ed. (Eds: D. W. Green, M. Z. Southard), [129] I. Iarossi, P. R. Amyotte, F. I. Khan, L. Marmo, A. G. Dastidar,
McGraw-Hill, New York 2019, p. 23. R. K. Eckhoff, J. Loss Prev. Process Ind. 2013, 26, 1627.
[98] Dust Explosions, Vol. 3 (Eds: P. Amyotte, F. Khan), [130] S. P. Boilard, P. R. Amyotte, F. I. Khan, A. G. Dastidar, R. K.
Elsevier/Academic Press, Cambridge, MA 2019. Eckhoff, J. Loss Prev. Process Ind. 2013, 26, 1646.
[99] P. R. Amyotte, F. I. Khan, A. G. Dastidar, Chem. Eng. Prog. [131] S. M. Worsfold, P. R. Amyotte, F. I. Khan, A. G. Dastidar,
2003, 99(10), 36. R. K. Eckhoff, Ind. Eng. Chem. Res. 2012, 51, 7651.
[100] P. R. Amyotte, R. K. Eckhoff, J. Chem. Health Saf. 2010, 17 [132] C. T. Cloney, R. C. Ripley, M. J. Pegg, F. I. Khan, P. R.
(1), 15. Amyotte, J. Loss Prev. Process Ind. 2019, 61, 206.
[101] P. R. Amyotte, Process Saf. Environ. Prot. 2014, 92, 292. [133] P. Amyotte, M. Lindsay, R. Domaratzki, N. Marchand, A. di
[102] M. Abuswer, P. Amyotte, F. Khan, J. Loss Prev. Process Ind. Benedetto, P. Russo, Process Saf. Prog. 2010, 29, 17.
2013, 26, 289. [134] M. N. Hossain, P. Amyotte, M. Abuswer, A. Dastidar, F. Khan,
[103] M. A. Abuswer, P. R. Amyotte, F. I. Khan, L. S. Morrison, R. Eckhoff, Y. Chunmiao, Process Saf. Prog. 2014, 33, 374.
J. Loss Prev. Process Ind. 2013, 26, 1530. [135] C. T. Cloney, R. C. Ripley, M. J. Pegg, P. R. Amyotte, J. Loss
[104] J. Hassan, F. Khan, P. Amyotte, R. Ferdous, J. Chem. Health Prev. Process Ind. 2017, 49, 912.
Saf. 2014, 21, 13. [136] C. T. Cloney, R. C. Ripley, M. J. Pegg, P. R. Amyotte, Com-
[105] Z. Yuan, N. Khakzad, F. Khan, P. Amyotte, Saf. Sci. 2015, bust. Flame 2018, 198, 14.
74, 79. [137] C. Cloney, R. Ripley, M. Pegg, F. Khan, P. Amyotte, Process
[106] M. Abuswer, P. Amyotte, F. Khan, S. Imtiaz, Process Saf. Saf. Environ. Prot. 2018, 120, 215.
Environ. Prot. 2016, 100, 49. [138] R. E. Sanders, Chemical Process Safety. Learning from Case
[107] P. R. Amyotte, J. Loss Prev. Process Ind. 2006, 19, 161. Histories, 4th ed., Elsevier/Butterworth-Heinemann, Oxford,
[108] P. R. Amyotte, M. J. Pegg, F. I. Khan, M. Nifuku, T. Yingxin, UK 2015.
J. Loss Prev. Process Ind. 2007, 20, 675. [139] F. I. Khan, P. R. Amyotte, J. Loss Prev. Process Ind. 2007, 20, 387.
[109] P. R. Amyotte, K. J. Mintz, M. J. Pegg, J. Loss Prev. Process [140] CSB (Chemical Safety Board), Urgent Recommendations from
Ind. 1992, 5, 196. Kleen Energy Investigation, US Chemical Safety and Hazard
[110] P. R. Amyotte, M. J. Pegg, Plant/Oper. Prog. 1992, 11, 166. Investigation Board, Washington, DC 2010.
[111] P. D. Reddy, P. R. Amyotte, M. J. Pegg, Combust. Flame 1998, [141] Statement from CSB Chairman Katherine Lemos on Massive
114, 41. Explosion and Fire in Beirut, https://www.csb.gov/
[112] C. Yuan, K. Liu, P. Amyotte, C. Li, J. Cai, F. Wang, G. Li, statement-from-csb-chairman-katherine-lemos-on-massive-
J. Loss Prev. Process Ind. 2017, 46, 84. explosion-and-fire-in-beirut/ (accessed: August 2020).
[113] C. Yuan, J. Cai, P. Amyotte, C. Li, Y. Bu, K. Liu, G. Li, [142] P. R. Amyotte, D. K. MacDonald, F. I. Khan, Process Saf.
J. Hazard. Mater. 2018, 346, 26. Prog. 2011, 30, 261.
[114] J. Cai, C. Yuan, C. Li, P. Amyotte, Y. Bu, G. Li, J. Loss Prev. [143] P. Amyotte, Y. Irvine, F. Khan, Process Saf. Prog. 2018, 37, 459.
Process Ind. 2019, 57, 41.
[115] J. Cai, C. Li, P. Amyotte, W. Yuan, C. Yuan, G. Li, Process
Saf. Environ. Prot. 2019, 129, 321. SU PP O R TI N G I N F O RMA TI O N
[116] A. G. Dastidar, P. R. Amyotte, J. Going, K. Chatrathi, Process Additional supporting information may be found online
Saf. Prog. 1999, 18, 56. in the Supporting Information section at the end of this
[117] A. G. Dastidar, P. R. Amyotte, J. Going, K. Chatrathi, Fuel
article.
2001, 80, 1593.
[118] A. Dastidar, P. Amyotte, Process Saf. Environ. Prot. 2002, 80, 287.
[119] A. G. Dastidar, P. R. Amyotte, J. Hazard. Mater. 2002, How to cite this article: Amyotte PR, Khan FI.
92, 115.
The role of inherently safer design in process
[120] P. R. Amyotte, A. Basu, F. I. Khan, J. Hazard. Mater. 2005,
122, 23.
safety. Can J Chem Eng. 2021;99:853–871. https://
[121] C. Yuan, P. R. Amyotte, M. N. Hossain, C. Li, J. Hazard. doi.org/10.1002/cjce.23987
Mater. 2014, 274, 322.