If your reporting system only captures events that have already hurt someone, it isn't a near-miss reporting system. It's an injury recording system.
On 28 August 1998, something went wrong at Esso's Longford gas plant in Victoria, Australia.
Warm lean oil stopped circulating to a piece of process equipment. Without that warm flow, the metal inside began to drop toward dangerously low temperatures, well outside what the equipment was designed to tolerate.
Nobody was hurt. Nothing was damaged beyond repair. The plant kept running.
And the incident was not reported the way it should have been.
A month later, almost exactly the same condition happened again.
The same warning, twice
On 25 September 1998, Gas Plant 1 at Longford was taken off-line after a process upset. Over the following hours, with warm lean oil no longer flowing through it, a heat exchanger dropped to around minus 40°C — a fraction of its normal operating temperature of around 100°C or more.
The metal, never designed to operate anywhere near that cold, became brittle.
When operators restarted the plant, hot lean oil at well over 200°C was reintroduced into the embrittled exchanger. The sudden thermal shock was more than the metal could take. It fractured catastrophically.
More than ten tonnes of hydrocarbon vapour escaped. It drifted toward nearby fired heaters and ignited. The resulting fire burned for more than two days. Two workers were killed. Eight more were injured. Victoria's gas supply was cut off for over two weeks.
The events of 28 August weren't identical to what happened on 25 September — the Royal Commission that investigated the disaster was careful to describe them as closely related, not the same incident. And the Commission did not find that the August event directly caused the September explosion.
What it did find was this: if the August incident had been properly reported, the danger of the equipment reaching dangerously low temperatures would, in all probability, have become known in time to prevent what followed.
The warning existed. It just never reached anyone who could act on it.
A system built to hear a different kind of problem
This wasn't a story about a cover-up, or a culture where people were afraid to speak up.
Esso had an incident reporting system. People used it. The company had, by its own measure, an excellent safety record — its lost-time injury rate had been driven down to close to zero, something it was genuinely proud of.
The problem was what the system had been built to listen for.
As process safety researcher Andrew Hopkins documented in his analysis of the disaster, Esso's incident reporting system was geared toward events that caused, or had the potential to cause, a lost-time injury. It was not geared toward process upsets with the potential to endanger the entire plant.
A loss of warm oil flow, on its own, ticks neither box convincingly. Nobody was hurt. Nothing broke. By the standards the reporting system had been built around, there was nothing here that counted as an incident worth escalating.
So it wasn't escalated. Not out of carelessness, and not because anyone decided to let it slide. It simply wasn't the kind of thing the system had been designed to recognise as a warning.
The gap between having a system and having the right system
Plenty of organisations would look at Longford and conclude the fix is obvious: report everything, encourage people to flag near-misses, set a target for the number of reports coming in.
But a target for volume doesn't fix a system that's listening for the wrong signal. An organisation can hit an ambitious near-miss reporting target every month and still miss the one report that would have prevented a fatality — if the categories, thresholds and culture around that reporting system are still built around personal injury rather than process risk.
The question worth asking isn't simply “are people reporting near-misses?” It's “would our system actually recognise a process-safety precursor as something worth reporting, even when nobody was hurt and nothing was damaged?”
At Longford, the honest answer, in hindsight, was no.
Five things to check tomorrow
- Read your incident reporting form or system as if you'd never seen it. Would a loss of flow, a temperature excursion or an unusual reading with no injury and no damage actually fit into a category someone would report?
- Ask your operators directly. If something unusual happened on their shift and nobody was hurt, would they know this was still worth formally reporting, not just mentioning in passing?
- Check what happens to a report after it's filed. Does a process-upset report reach someone with the engineering knowledge to recognise its significance, or does it sit in the same queue as a near-slip in the car park?
- Look for your own 28 August. Has something happened recently — an abnormal reading, a brief process deviation — that was noticed, mentioned, and then quietly forgotten because nothing bad happened at the time?
- Separate your personal safety statistics from your process safety statistics. A falling injury rate tells you about slips, trips and minor incidents. It tells you nothing about whether your major hazard barriers are being tested, maintained and reported on properly.
The warning was there
Longford is not a story about negligence in the way that word usually gets used. It's a story about a well-intentioned system that was simply pointed at the wrong target.
Esso had reduced its lost-time injury rate to close to zero. It had a reporting system. People used it. None of that was fiction.
But none of it was built to hear a loss of warm oil flow as the warning it actually was.
If your reporting system only captures events that have already hurt someone, it isn't a near-miss reporting system. It's an injury recording system.
The difference between the two can be the difference between catching the warning in August, and burying two colleagues in October.
Sources
- Royal Commission into the Esso Longford Gas Plant Accident (the Dawson Report), Victoria, Australia (1999).
- Andrew Hopkins, published analysis of the Longford disaster and the Royal Commission's findings on incident reporting and lost-time injury measurement.
- Institution of Chemical Engineers (IChemE), incident summary: Esso Longford Gas Plant, 25 September 1998.