No good deed goes unpunished: Case studies of incidents and potential incidents caused by protective systems

In the course of chemical process and plant design, engineers identify potential hazardous incidents. These potential incidents may be identified through special hazard analysis reviews and procedures, or by the design team in the course of design activities. To manage and control those hazards, the team will modify the initial design, often by adding on additional protective devices and systems—alarms, interlocks or active protective systems. However, any change in a system, even a change intended to prevent or mitigate a potential hazardous incident, also has the potential to introduce new hazards, or new mechanisms by which existing hazards can result in an incident. A number of case studies illustrating this point are reviewed. The examples illustrate the importance of a management of change program, which must consider all changes including the addition of safety devices and systems, and which must throughly consider all potential effects on the system.