Comment is mandatory

Lessons Learned Bulletin No. 12

pdf version (en) ER3 Leerpunten van incidentbestrijding – Mislukte en geslaagde incidentbestrijding (nl)
Return to Lessons Learned Home Page

Chemical Accident Prevention & Preparedness

Learning from emergency response failures and successes

The aim of the bulletin is to provide insights on lessons learned from accident reported in the European Major Accident Reporting System (eMARS) and other accident sources for both industry operators and government regulators. In future the CAPP Lessons Learned Bulletin will be produced on a semi-annual basis. Each issue of the Bulletin will focus on a particular theme.

Emergency response

The current issue is the third and final part of a series of lessons learned from research on emergency response. In particular, it discusses lessons learned from both emergency responses failures and successes and analyses why. The first part in the series addressed lessons from evacuation, sheltering, and event containment. Meanwhile the second part focused on firefighter preparedness and response.

Please note:

The accident descriptions and lessons learned are reconstructed from accident reports submitted to the EU’s Major Accident Reporting System

as well as other open sources. EMARS consists of over 1000 reports of chemical accidents contributed by EU Member States and OECD Countries.

The cases selected for this bulletin also generated a number of lessons learned, not all of which are detailed in this bulletin. The bulletin highlights those lessons learned that the authors consider of most interest for this topic, with the limitation that full details of the accident are often not available and the lessons learned are based on what can be deduced from the description provided. The authors thank the country representatives who provided advice to improve the descriptions of the cases selected.

Accident 1

Fire and toxic release at a chemical production plant Source of leak unknown

Sequences of the event
At a plant producing substances used in medical imaging, a temperature control defect on a biconical dryer caused product decomposition during the drying cycle. The subsequent pressure surge led, around 10 pm, to the explosion of part of the glass piping (a pipe elbow connecting the dryer to its vacuum pump). At the time, the dryer was holding 1,800 kg of a mix containing ethanol and a product releasing iodine (I2), hydrochloric acid (HCl) and nitrogen 
Figure 1: Intervention of responders at the site  (SDIS 56, 2011)

oxides (NOx) when decomposing. I2 was discharged into the atmosphere via both a door left open and the building’s roof air extractors. One plant safety officer was slightly intoxicated by the release.

The external emergency plan was activated at 11 pm and a 500-m safety perimeter set up. Notified by neighbours around 10:15 pm and expecting to battle a residential blaze, fire-fighters arrived at the scene without proper equipment for a chemical accident. A pungent smell was perceptible as far as a cinema 1 km away. Fire-fighters’ atmospheric readings downwind of the site further east/south-east did not reveal any danger.
The emergency plan was lifted at 5:30 am. Their complaints focused on the late warning given and lack of information on the part of both the plant and local authorities, resulting in some neighbours failing to comply with the confinement order.

Important findings
This accident had not been identified in the plant’s safety report and emergency plans as a high-risk scenario.
When the accident occurred, the decision-making process was unable to keep up with the fast pace of events. The automatic responses programmed into the internal emergency plan were thus implemented late and not necessarily in the right order.  For example, personnel evacuated prior to installation shutdown, alarm sirens ordering neighbours to remain indoors sounded 50 minutes after the explosion (according to the press), and the decision to place all dryers in a cooling position was announced 2 hours after the explosion, with another hour required to fully execute the measure.

ARIA # 41305


An important challenge for emergency response – unforeseen events can hinder mitigation and response

MAHB studied 753 accidents reported to the EU eMARS database that occurred between 1990 and 2015 and that contained descriptions of the emergency response.  Of these, 87 were judged as a failure to manage the response because they were unable to manage unforeseen complications. Each one appeared to have been notably undermined by at least one of the following unforeseen events:

– A member of the emergency team/fire brigade injured or died during the intervention.
– There was a clear lack of communication or delayed communication to the public.
– There was a clear failure to liaison with external emergency response teams (police, ambulance, etc.) during the event.
– There was a clear failure of the evacuation procedure in place, endangering workers and emergency responders.
– Environmental impacts were generated due to overflow of contaminated fire extinguishing water.
– There was no emergency response plan (often due to insufficient awareness of the risks or how to manage them).
– Due to the severity of the accident, it was impossible to activate most aspects of the emergency plan.
– Failure to foresee clear deficiencies of the emergency plan, e.g., escape routes foreseen in the emergency response plan were not available, offices were close to the chemical installation in relation to the risk.
– The accident scenario was not considered in the emergency plan. In some cases, the accident scenario was not considered at all. In another case, the scenario was considered a low risk and was not included in the internal emergency plan.
– Lack of clear and consistent emergency response procedures or inadequate training and instruction to on-site staff.

These unexpected circumstances were probably not foreseen in the planning stages. In particular, the unexpected loss of a resource, e.g., the injury of a response team member or inadequate water supply, often hindered the response effort. In these cases, the response was severely disabled when part of the planned response did not turn out as intended, sometimes because the accident scenario had not been predicted and/or practiced.


Factors that can help make a successful emergency response

Many of the cases in this bulletin exhibited failures in the emergency response, even though they could be judged largely as successful response efforts.  Effective emergency response goes beyond good preparedness and planning and very often is achieved despite setbacks and shortcomings. Unexpected situations will arise that were not foreseen in the planning, especially since, as severity increases, its complexity and the challenges of response also increase. Moreover, the surrounding area is not immobile but is constantly changing. Whom and where the impacts will hit hardest cannot be predicted with certainty. 

Case 3 in this bulletin is particularly interesting because, even though there were some unforeseen events (a site evacuation exit was closed, the siren stopped when the power went out, and there was not enough water).  In every case, it seems that a backup strategy was quickly decided and executed. Although this accident involved a severe fire involving dangerous substances, no one was seriously injured. This outcome happens when trained responders are on the scene, there is a clear chain of command, and rapid communication between teams is possible.

A good response ultimately relies a number of factors being in place, including a well-developed and rehearsed internal and external emergency plans, coordination of preparedness and training on realistic scenarios with offsite responders, trust and a culture of communication among all relevant responder organisations, a command structure that facilitates rapid and informed decision-making, sufficient infrastructure for communicating between responders and to the public, and  rapid access to sufficient response equipment and materials. 


Figure 2: Typical communication needs and mechanisms supporting chemical accident emergency response. There
should always be a back-up means of communication if for any reason the planned communication mode fails.


Accident 2

Fire and toxic release at an electronics production plant

Sequence of events
At 20:22 on 26 April 1998 an operator of the plant saw white fumes in correspondence with the CDI unit, adjacent to the hydrogen compression room and to the refrigeration units. The operator alerted the foreman, then the shutdown operation of the plant, controlled by a microprocessor with display on the control-panel, was activated. At the same time nearby voluntary fire brigades arrived, having been alerted by a person passing by who had seen the smoke. When the personnel identified the source of the smoke as a release of hydrochloric acid (HCl) from the combination of silicon tetrachloride (SiCl4) with water (H2O) (due to the presence of humidity in the air and in the soil), they proceeded in establishing a vertical water curtain, in compliance with the emergency plan, in order to avoid the displacement of the fumes due to the wind, attempting at the same time to avoid direct contact of the water with the SiCl4. The external firefighting teams attempted to abate the fumes without similar care, causing the intensification of the chemical reaction described above.

An HCl cloud formed and was transported by wind to a residential area in the vicinity of the establishment at a few kilometres distance, principally to the south and also affecting a major road. The fire fighting water also abetted infiltration of chlorine and silicone in approximately 400m2 of soil around the plant. No one was injured. 

Important findings
The plant was a relatively small site and an accident of such potential severity apparently had not been considered for risk management. It may be that such a large release of HCl due to water interacting with SiCl4 had not been imagined.

Although the involvement of external fire fighters was foreseen in the emergency plan, it appears that many local fire fighting forces, particularly volunteer operations, had not been consulted.


Accident 3

Fire at a chemical production plant

Sequence of events
At 14:20 on 21 July 1992 a series of explosions leading to an intense fire broke out in a storeroom in the raw materials warehouse. Due to overheating, azodi-isobutyronitrile (AZDN) was released into a store reserved for oxidising materials. Due to its incompatibility with the AZDN dust released, Ammonium Persulphate (APS), which was also in the store, they ignited. The fire spread rapidly to the remainder of the warehouse and external chemical drum storage. The fire service was called at 14:22 and the first appliance arrived from the local station only a short distance away by 14:28. Thick black smoke and flames were escaping from the roof in the vicinity of the storeroom and the quantity of smoke rapidly developed as the fire gained a swift hold, spreading to the external drum storage. A 25 km/hr wind was blowing at ground level from slightly north of west (280°) causing the black cloud of smoke to drift eastwards, affecting the traffic flows on two main roads over two miles away. Eventually the smoke could be seen from the nearby city centre, some 16 km away. The site emergency plan was activated and employees were effectively evacuated.

Considerable difficulties were experienced in obtaining an adequate water supply as the water mains in the area were incapable of supplying the fire-fighting needs of a large fire. Foam was also used at the fire, including all of the stocks held by the company. It was applied to parts of the fire to prevent or slow its spread from the warehouse to drums stored externally. However, foam was unsuitable for cooling the finished goods warehouse and drums of flammable liquids held in the fire block storage area. These operations consumed substantial quantities of water.

At 14: 55 the siren sounded to warn the public and employees to warn of a major accident and the possibility of toxic fumes. The siren continued to operate until 15:40 when power to the whole site was cut off by the electricity board because the fire was threatening the main sub-station. The loss of power also caused a shutdown of the company's effluent pumps and the escape of contaminated fire water from the site boundaries.

None of the company employees were injured. 33 people, including three residents and 30 fire and police officers were taken to hospital where they were primarily treated for smoke inhalation. Six people were detained. Approximately 2000 local residents were confined to their houses and residents in eight properties immediately adjacent to the raw materials warehouse were evacuated. Firewater run-off caused significant river pollution. The total cost of company property damage was estimated at £4.25 million and substantial indirect costs were incurred.

The fire was finally contained at about 1740 h. Power was restored to the site at 20:45.

Figure 3: Plastic drums on the fire block flammable liquid storage area showing heat radiation damage and effects of pressurisation. (HSE, 1992)

Important findings
The crucial error leading to the fire was the incorrect categorisation of AZDN and its consequent storage with oxidising agents with which it was chemically incompatible.
The company had been aware that water mains were not adequate for certain scenarios.  There had been discussions with the fire service but a suitable alternative had not been provided.

The serious potential for escalation of the incident was evidenced by numerous plastic drums on the fire block which were damaged by radiant heat. The fire service made a considerable effort to cool these containers of flammable liquids during the course of the fire and successfully prevented their ignition.

The police helped to enforce the shelter-in-place and a limited evacuation.

Fire officers had made early contact with the company's incident controller and had strongly advised the sounding of the emergency siren provided by the company to warn the public and employees in the event of a major accident. This advice was initially not acted upon.

eMARS – Accident 21/07/1992


Accident 4

Toxic release at a chemical production plant

Sequence of events
In a sulphur dichloride (SCl2) distillation facility in a chemical plant, a spillage of SCl2 occurred in the retention area for a distillation column in the final stages of distillation, after a leak from a recirculating pump. The SCl2 hydrolysed upon contact with ambient humidity, causing an intensive emission of hydrogen chloride (HCl), which was not detected by the HCl gas detector of the column. But a safety detector installed in the unit gives the alarm at 13:12. The controller placed the unit in safety shut down and then triggered locally the audible and visual alarm while alarm messages appear on the control screens in the control room. The internal emergency plan was activated and the 35 employees were evacuated. The internal fire team, supported by 40 external firefighters, equipped themselves with breathing apparatus and plugged the leak. The cloud of HCl was overcome using 4 lateral fire hose lines. The 120 m³ of water used is collected in a retention pond for reuse in production. The internal emergency plan is terminated at 16:15 pm. The next day a specialized company pumped 800 liters (1,200 kg) of sulfur dichloride from the retention basin into a storage tank. The HCl release remained confined inside the building. A similar accident occurred on the site in 2006 (ARIA 31691).

Important findings
It was discovered that a similar accident had already taken place at the site in 2006, resulting from the failure of a pressure sensor. [ARIA 31691] In this case, the release was also contained by a rapid emergency response.

(eMARS 15/04/2013 and ARIA No. 43681)


Accident 5

Lightning strike causes explosion at a distillery 

Case 2

In a distillery, a 5,000-m³ tank containing 1,000 m³ of ethanol at 96% concentration exploded when lightning struck and then ignited. The raised roof fell into the reservoir, which remained intact. However, the tank foot valve cracked upon impact.

An emulsifier delivered 2 hours later enabled preventing the fire from spreading to the 1,000-m² retention basin. The blaze was extinguished in 3 hours and the fire-fighters for over 5 hours cooled 3 adjacent 2,500 m³-tanks exposed to the intense heat.

During the emergency response, 23,000 litres of emulsifiers stored onsite and a total of 7,000 m³ of water (including cooling water) were used. The loss was valued at 30 million francs (including 2.5 million of alcohol destroyed and 3 million of emulsifier). The extinction water (1,500 m³) collected in the retention basins would be diluted in a lagoon. An outside organization was called to verify the electrical installations of the storage zone.

Important findings
An internal response plan drill conducted 2 months earlier, based on a comparable scenario involving one of the tanks involved in the accident, served to facilitate the actual intervention. It had been recommended to install flame arrestors on the vents and the breathing valves on the tanks following a lightning risk evaluation study conducted 18 months prior to the event.

(eMARS#394 and ARIA No. 18325)


Lessons learned

The case studies described here are illustrative of the importance of several aspects of emergency planning and response. In particular, following points should be taken into account in planning and preparedness:
- Identifying and planning on realistic scenarios is the starting point.

- Reviewing past accidents is important for identifying possible scenarios but also as input to response needs.

- Small sites that meet Seveso (high hazard) criteria are capable of serious accidents. They need to know their high risk scenarios and have an emergency response plan.

- Training and co-ordination with other responders can have an enormous impact on the effectiveness of response. Responders can put themselves and others at risk if they don’t know what they’re doing. Failure to involve relevant external responders in training can have serious consequences.  Don’t overlook this aspect.

In Case 2, the responders created a significantly greater toxic release because they were not sufficiently trained.

- Emergency equipment and materials form the backbone of response operations.  Critical needs should be identified with back-up options immediately available.

- The response effort relies heavily on good communication between all parties and with the public. Technology needs to be tested regularly and back-up systems should be in place in case key elements (sirens, wireless networks, etc.) become disabled.

- Emergencies often require decisions to be made quickly and timing is everything. Decisions that may be needed should already be anticipated in the planning and assigned a clear decision-making process (who makes decisions, what information is needed) with well-defined criteria that recognises criticality of timing and how to deal with uncertainty.


Motto of the semester

“By failing to prepare,
you are preparing to fail.”



Number 12, December 2017
JRC 109722



For more information on related to this bulletin on lessons learned from major industrial accidents, please contact

Technology Innovation in Security Unit
European Commission
Joint Research Centre
Directorate E - Space, Security
and Migration
Via E. Fermi, 2749
21027 Ispra (VA) Italy

If your organisation is not already receiving the MAHBulletin, please contact . Please include your name and email address of your organisation’s focal point for the bulletin.

All MAHB publications can be found at Minerva Portal.


   Checklist on emergency response

• Are emergency response procedures clear, efficient and sufficiently brief and do they define clear roles and responsibilities?
• Are internal emergency response procedures and the emergency plan updated to reflect input from near misses, accidents, audit feedback, and outcomes of management of change analyses? Are authorities notified of updates that may also be necessary for the offsite emergency plan?
• Have past accidents at the site and in external accident databases been consulted in establishing scenarios and identifying emergency response needs?
• Does the emergency response plan reflect actual circumstances on site?  For example, are the necessary equipment available and are distances to equipment and exit routes reasonable for the accident scenarios foreseen, etc.?
• Was the internal emergency plan developed by the site or if developed by an external contractor, has it been carefully reviewed by staff in charge of process operations and response management?
• Have communication channels and protocol been established and tested between onsite and offsite responders? Is there a backup plan if the primary communication system between responders fails?
• Have all communication means been tested, on and offsite, and are their back-up plans in case loss of power or accessibility make this equipment unavailable?
• Have offsite responders been involved adequately in training exercises? Have all potential responder teams in the area, including voluntary forces, been involved?
• Have onsite staff been informed and trained on evacuation procedures?  Are there signs and simple instructions readily available for consultation in the event of an emergency?
• Are locations and exit routes selected for assembly and evacuation in areas sufficiently spacious and expected to remain safe and available for selected scenarios, or if not, are there different options for different scenarios?
• Is the location of the command post appropriate, in particular, is it sufficiently distant from potential impacts?  Are criteria to select location based on the accident scenarios and experience from past accidents?
• Have the fire detection and water extinguishing systems been tested with recommended frequency?  Are they maintained regularly and upgraded to ensure fitness and availability?
• Is access to fire extinguishing water assured for all scenarios?  Has the availability of equipment, water, the size of the water curtain and other measures, the amount of foam available, etc., been checked and compared with the accident scenarios?
• Have fire fighting logistics, e.g., distances, intervention routes, been planned and tested, taking into account possible scenarios and the layout of the site?
• Are there clear rules for when assistance from external responders is requested with objective criteria and taking into account potential rapid acceleration of the sequence of events?
• Are there clear rules for when the public should be alerted that an accident has occurred with potential offsite effects?
• Is the public warning system checked at recommended intervals?  Will its functionality be affected by an accident?  If so, is there a contingency plan to ensure that the public is adequately informed and knows what to do?
• Does the response plan address management of environmental effects from the presence of high volumes of fire water and foam?  Have drainage options been identified and has disposal been co-ordinated with relevant water or sewage authorities?