The DuPont Company was founded in 1802—over two centuries ago—and the foundation of a strong tradition for safety was established that remains a corporate core value today. Thomas Jefferson, the third U.S. President, encouraged the company founder, E. I. du Pont (1772–1834), to manufacture gunpowder since the United States at that time did not have reliable producers of high quality powder [1, 2], and perhaps because du Pont's father had assured Jefferson that du Pont gunpowder would “send bullets a fifth farther than English or Dutch bullets travel .” E. I. du Pont was indeed uniquely qualified, since he had apprenticed with Antoine Lavoisier, the famous French chemist who had also been chief of the French royal powder works:
Lavoisier recommended Eleuthere for the vacant superintendent of the Government Works, and the new head threw himself with traditional energy into the study of the mystery and manufacture of explosives … there was nothing that escaped his observant and open mind. He studied and experimented increasingly. He learned every possible detail theoretically, as well as practically, from the use of the new raw material to the finally tested product. He furnished many new ideas and introduced numerous improvements. In a word, he raised the hitherto rough methods of manufacture to the higher level of a recognized science .
Of course, manufacture of gunpowder was an inherently dangerous business, which E. I. du Pont readily recognized. Reflecting on these dangers, he noted that “we must seek to understand the hazards we live with .”
While the process hazards of 1802 are very different than the hazards of today, the foundation of the strong current process safety program and performance at DuPont rests in this early corporate history. The continued dedication over 200 years to understanding the hazards present in our processes, and in successfully managing them to prevent serious injuries and incidents, has contributed significantly to current process safety priorities and practices. Learning from experience—what has worked and what hasn't—both in our company, and in the broader chemical industry, has been essential for continuous improvement. Therefore, reviewing the sometimes hard lessons of the past can help contribute to a safer future.
POWDER MILLS ON THE BRANDYWINE
Foundations of Process Safety
E. I. du Pont selected a location along the Brandywine River in Delaware for the first gunpowder mills. The river provided water power for the mills, local granite could be used for construction, and the local port in Wilmington could be used for shipping . In his original plans, du Pont noted that “At the side of the stream, there must be sufficient land to distribute the different buildings of the plant at prudent distances from each other .” Spacing considerations were key to limiting the effects of possible explosions related to manufacture of gunpowder. Specific instructions included:
The stamp mill should be at a considerable distance from … any other building. This machine may cause violent explosions and should be surrounded by high and thick walls … It [the graining mill] always contains a somewhat large quantity of finished powder and the necessary presence of the workers may cause most serious accidents, it is therefore important to isolate it as much as possible .
Construction at the Brandywine location was started in 1802, and gunpowder was first sold in 1804 with the name Brandywine Powder (later changed to DuPont Powder) [1, 8]. DuPont gunpowder quickly developed a reputation for high quality, and production of gunpowder on the Brandywine continued until 1921.
In addition to careful siting of buildings at minimum safe distances, much consideration was also given to the actual design of the mills. High, thick granite walls were constructed on three sides, as shown in Figure 1. The fourth side, which faced the river, and the light gauge roof were designed to direct any explosions towards the river and away from workers and other buildings . Additional design features were intended to prevent powder contamination and potential ignition sources, which could lead to explosions, and to allow workers to exit quickly if needed . Redundant safety valves were also used:
Two safety valves are used, which are absolutely necessary, as when one only is employed it may by accident get choked and the works explode .
In addition, worker boots were supplied at company expense with wooden pegs instead of nails , and later all aspects of worker clothing was controlled:
The garments of the workers are pocketless, so that they cannot carry knives or matches, or, indeed anything, and are made of non-inflammable material. Even the buttons must not be metal. No one is allowed to go about with trousers turned up at the bottom, because grit is collected in that way, and the merest hard speck of foreign material in a charge of gunpowder is fraught with danger .
Members of the du Pont family and supervisors were accountable for the safe operation of the mills, with corporate policy requiring that they be present to startup new equipment or manufacturing processes. The following was posted on the doorway to the mills:
No employee may enter a new or rebuilt mill until a member of top management has personally operated it .
Management also gave personal instructions on how to safely roll powder kegs and how to avoid dropping them. By 1811, E. I. du Pont issued official safety rules to help ensure safe manufacture:
As the greatest order is indispensable in the manufacturing as well as for the regularity and the security of works, than the safety of the workmen themselves, the following Rules shall be strictly observed by every one of the men employed in the factory .
Family commitment and accountability were so strong that E. I. du Pont lived at the site. The original plan for the site, in fact, included the requirement that the director's house be constructed “in such a position that the whole plant may be seen from its windows .” The du Ponts raised seven children in the house, and on at least one occasion, his wife was injured and the house was severely damaged in an explosion. Ultimately, several family members were injured or died of work-related causes [3, 4].
An Inherently Dangerous Business
Despite precautions, explosions in this dangerous business were always a primary concern:
The experience and keen watchfulness of Irenee du Pont had held accidents to a minimum in his mills. His workmen were sober, reliable, carefully trained. But no one could foretell when some small particle of saltpeter, sulphur, or charcoal would erupt in rebellion against the grinding, rolling, and pounding that processed it into black powder. Then with no warning, would come the rumble, crash, and flare of flame, the billowing black cloud, and flying debris, and later the utter desolation of chaos—demolished buildings and sometimes torn or mangled bodies that, but a moment before, had been moving, living creatures .
The first explosion occurred in 1807 causing only damage to several buildings. The first company casualties occurred in an explosion in 1815 which caused 9 deaths , remarkably over 10 years after production began on the Brandywine. A serious explosion that occurred in 1818 resulted in 34 deaths [3, 4, 13], which remains the worst process incident in DuPont company history. E. I du Pont was in Philadelphia, then a day's journey away , but his daughter later described the explosion:
… the magazine blew up with the most tremendous report I ever heard. Looking up, we beheld an immense cloud of white, thick smoke filling with dark objects, stones, beams, etc., the debris of the building and its contents .
When he returned, du Pont found “all that was left was a big hole in the hill ” and “two acres of desolation .” The company would have been bankrupt if a supplier had not agreed to accept payment later than originally agreed upon [3, 13], allowing the mills to be rebuilt over the following year. The award of an annuity to the widows of victims of this explosion was an early example of pension benefits [2, 3].
All accidents were carefully investigated: “the accident cannot be attributed to any stone or nail or other foreign body mixed by chance with the materials ” and “This is the only cause which our knowledge of the business enables us to find for the accident .” Two years following the major explosion in 1818, changes had been made and du Pont wrote that:
We have last Thursday another accident in one of our mills which has been attended to with some satisfaction, as nobody was injured and it has proved a fair experiment that upon the plan on which our mills are now built we have not to fear any general explosion like the one which happened here 2 years ago. From the particular construction of the mill the effects of the explosion have been directed in such a way so as not to communicate to any other part of the works. The whole of our mills are now constructed on that safe plan .
In another instance, it was recorded that “3,000 lbs. of powder have never before exploded together so innocently and with so little damage .” The conscientious efforts of the company to operate safely and to learn from accidents were recognized in 1855 by the Wilmington Morning News:
The number of persons killed in explosions has been reduced by the persistent efforts of the firm to discover and introduce safeguards to prevent catastrophes .
Overall, despite the many safety precautions, 288 explosions occurred from 1804 to 1921 , such as the one shown in Figure 2 which occurred in 1889. Although only about 20% of these explosions resulted in a fatality , working in a gunpowder mill certainly required brave workers:
Like a Damoclean sword, hanging over the head of every powder man, was the dread of explosions. It was a nameless terror, waking men at night to prowl at odd hours about the yards, observing things that would have drawn scarcely a glance from less anxious eyes—random sparks from a chimney, wind direction, faintest indication of heavy skies that might bring thunder and lightning .
As a result:
Men in powderhouses usually have an arranged plan of escape in their minds, and at the least unexpected noise, have not hesitated to plunge into the canal .
Since the mills were designed to direct explosions into the creek rather than the surrounding buildings, the euphemism for dying in an explosion was to “go across the creek [1–3].” Working at the gunpowder mills required workers to remain alert at all times:
The men were wont to say that daydreaming was dangerous; when a man got to musing, it was time to look for him “on the other side of the creek .”
Fortunately, the company was always able to find good workers, such as those shown in Figure 3, as they were paid and treated well:
This paternalism is hard to accept a century later, but to the workmen at that time, struggling in the dark ages of the Industrial Revolution when the work day was long, pay was low, pensions were rare, and workmen's compensation and unemployment insurance laws were a half century or more in the future, the du Pont policies were humanitarian and enlightened .
EXPANSION INTO CHEMICALS
In the early 1900s, DuPont was re-organized and aggressively expanded into new chemical businesses, such as dyes, paints, plastics, and cellulose products , as shown in Figure 4. A good source of nitrogen for explosives, fertilizers, and refrigerants was particularly desired, for example, so DuPont began investigating production of ammonia following World War I. In 1924, a contract was completed to acquire the rights to the Claude process developed in France for high pressure catalytic synthesis of ammonia [1, 18], and the first ammonia was made at the Belle, WV site in 1926. Some problems were encountered during startup, though, and a failure of a liquefaction column resulted in a 4-month shutdown and re-location of the columns near the river behind concrete barricades for safety. Other safety improvements were also made to the design, including the early application of rupture discs:
Spring loaded safety valves were installed at the start on all stages of the compressors, but the performance at pressure about 3000 psi was so erratic, even with the greatest care in assembling and servicing, that we learned in mid-1926 of a type of safety or rupture disc that failed by shearing a thin disc; we lost no time in arranging with the originator for their use. It is unquestionably the most dependable relieving device above 5,000 psi when correctly designed and mounted .
It's interesting to note that one of the first applications of computers at the Belle site thirty years later (an IBM 650, available in the mid-1950s for approximately $500,000) was for preventive maintenance, since “former efforts took too many people too long to keep necessary records .” This is not surprising when considering the need for reliable, well-maintained equipment when the process operated at very high pressures with hazardous materials present. Mechanical integrity programs continue to be of great importance today for ensuring safe operation of company processes.
Formal Safety Organization
In 1911, at a corporate management meeting, it was stressed that “In the manufacture of explosives, we have three important points to consider—safety of operation, quality of product, and the last of all the cost .” In addition:
… to the list of principles of scientific management … several more were added, with safety being put at the top of the list … “In any line of industry … the question of safety of the workers is of vast importance and in an industry such as ours, is of paramount importance .”
Later that year, Safety Commissions were formed to study and promote accident prevention measures, first in the High Explosives Operating Department and then in the other businesses [19, 21]:
These commissions promulgated formal rules governing, certain operating methods and practices, standard drawings for construction design and mechanical safeguards, injury report forms and methods of reporting and tabulating injuries, plant and equipment inspections, and other miscellaneous safety features. These were all assembled in an indexed code book which was distributed to all plant and operating department heads and other interested persons .
Safety Commission meetings of three operating departments in 1913, for example, required over two weeks and resulted in 300 recommendations .
A corporate Safety Division was established in the Engineering Department in 1915 [19, 21, 22] to serve as central clearinghouse for evaluation and purchase of all safety items. The Safety Division acted in an advisory capacity for all plants, which included technical training, safety inspections, and review of all construction projects during the design stage. Prevention of accidents was targeted “by protection, by education, and by eliminating the hazard [19, 20],” but the priority was for eliminating hazards:
When circumstances will permit, the elimination of dangerous conditions is naturally the best course and should receive the first consideration .
Starting in 1916, standardized “safety instruction sheets” for correct practices for working safely were issued by the Safety Division, and over 150 had been distributed throughout the company by mid-1919 .
Senior company leadership, including du Pont family members, continued to strongly support safety during this period and made changes as needed to improve the safety organization:
Despite the interest of top management, the company initially made the error of placing the responsibility for safety largely on the safety department rather than the operating personnel. Hence, early results were not deemed satisfactory. In 1917, the approach to safety was reorganized and, as one vice president later put it, “management took over the responsibility.” This responsibility was made clear to the operating personnel by the continued, detailed involvement of top executives in safety. What had changed was accountability: in 1919 … it was a company axiom that all injuries ultimately reflected a failure of the operating managers .
Requests from Irenee du Pont, then President of the company, in the 1920s for example, included “specific requests on reducing high injury rates, studies of accident savings, and savings from prevention work .” Communications by senior leadership in this time period firmly established a goal for no accidents: “Practically all accidents are avoidable in one way or another,” and “We will never be satisfied until all manufacturing operations are conducted without accident .”
The Safety Division continued to be very active making plant inspections, compiling and analyzing accident statistics, conducting special investigations of new processes, and participating in design reviews. In 1926, safety and fire protection were merged to form the Safety and Fire Protection Division, which in addition to its other responsibilities sponsored safety contests such as the one conducted in 1928, which is shown in Figure 5. A set of Safety and Fire Protection standards was subsequently issued around 1930, including for example, Safe Practices in Entering Tanks. Detailed, periodic inspections based on these standards were also conducted at plants. The success of these programs is evident from safety statistics collected during this period. Fatality rates were reduced from 5.66 per million hours of exposure in 1910 to 0.09 by 1931. Injury rates and days lost were similarly reduced by 90%–95% from 1913 to 1931 . Application of DuPont safety management principles was also found to greatly benefit the safety of acquired businesses:
While the newly acquired properties invariably had injury rates much higher than DuPont's, one safety man noted the dramatic effect on them of applying DuPont's methods: “The next year they reduced their accidents to a ridiculously low amount. There was no change in equipment, there was simply the reinforcement from the management down of an intensive drive to cut out accidents .”
Safety groups were eventually established at all plants, though, responsibility for safety continued to be the responsibility of operations management, based on:
The acceptance throughout the company of the fundamental principle that accident prevention is an integral part of the operating routine and therefore responsibility .
Training programs were offered to all workers, since employee commitment to working safely was recognized as essential for the success of safety programs:
Recognition of the fact that the safety morale or attitude of the actual workers will mostly govern the success of the safety effort and consequently any program to be successful must be designed to reach every worker through regular organization lines .
One problem, though, was the availability of trained safety engineers and professionals. Lewis DeBlois, the first head of the Safety Division and later the head of the National Safety Council, commented on “a very definite and lamentable scarcity of trained safety engineers technically fitted to carry forward the work .” Part of the problem, DeBlois also commented, was that training on safety was not commonly part of most engineering programs:
… safety engineering, with its interests in design, equipment, organization, supervision, and education … bears as well a very definite and important relation to all other branches of engineering. This relation is so close, and its need so urgent, that I am convinced that some instruction in the fundamentals of safety engineering should be given a place in the training of every young engineer. He should be taught to think in terms of safety as he now thinks in terms of efficiency. Conservation of life should surely not be rated below the conservation of energy. Yet, few of our technical schools and universities offer instruction in this subject, and the graduates go out to their profession with only vague surmises on “what all this talk on safety is about .”
To help alleviate the scarcity of capable safety engineers “men with the required amount of technical training had to be especially trained for the work, and this was done by and under the supervision of the main office Safety Division .” Company safety training remains a key activity today.
Perhaps the most severe challenge to the company's safety focus might be expected to have occurred during the hard economic times of The Depression in the 1930s. However, the company's efforts to understand and control the hazards of its processes continued:
Special studies are continually being made of the hazards arising out of the use of various materials or processes … Where sufficient information is not obtainable … experiments and tests are conducted … .
and the core value for safety was re-emphasized to maintain safety performance:
The operations of the DuPont Company and subsidiary companies have for many years enjoyed enviable success in safety work; and we believe no other group of plants can point with equal pride to such a high degree of control over a multiplicity of inherent industrial hazards … As accidents are reduced, their further reduction becomes increasingly difficult. Furthermore, several factors are present today, undoubtedly due to economic conditions, which make it imperative that our accident prevention work be materially increased particularly in certain directions .
Modern Process Safety Program
In many respects, the modern era of Process Safety Management (PSM) at DuPont began with a serious process incident in Louisville, Kentucky in 1965, which resulted in12 fatalities, 61 injuries, and a property loss of over $50 million. Following the incident, corporate management asked each site to review their production facilities and procedures to assess the potential for catastrophic events and to take appropriate preventive measures. An annual review was also instituted to ensure that process additions or changes did not create new hazards, and in following years, many sites conducted annual, in-depth process hazard reviews to evaluate the process safety of site processes. By 1973, new guidance was issued that detailed suggested hazard review methodologies and frequencies. A corporate guideline for Process Hazards Reviews was issued later in 1978 following several serious incidents, and a comprehensive, integrated corporate Process Hazards Management (PHM) guideline was issued in 1979 , over 10 years before the OSHA PSM Standard.
The PHM guideline, now known as Process Safety Management (PSM) , was intended to help prevent “serious, process-related incidents, which might affect plant personnel, off-site communities, the environment, or result in significant property loss or loss of business.” Its purpose was to:
Establish a framework to help focus management efforts on this important, serious, and complex subject.
Comprehensively describe the principles and essential features of Process Safety Management for use by sites in managing Process Safety.
Describe Corporate Business responsibilities and activities.
Business and site management responsibilities were clearly defined, and application of the guideline required that:
Each site and/or manufacturing facility manufacturing, handling, using, or storing hazardous substances will, within the framework of this Guideline, develop a detailed Process Safety Management Program suited to its specific organizational structure and needs.
The incident in Bhopal, India in 1984, involving the release of acutely toxic methyl isocyanate (MIC), resulted in about 2,000 deaths and thousands of injuries, significantly raising the awareness of both industry and regulators about the potential for off-site catastrophic incidents . The response in DuPont was immediate. At the time, a product in the agrichemicals business used MIC as a key ingredient in the manufacture of an insecticide. Following Bhopal, the R&D organization quickly developed a new process using inherently safer process principles to allow use of a less hazardous material as the starting raw material, eliminating the risk of shipping and storing MIC. Process upgrades allowed this new raw material to be converted to MIC in the reactor, which was then immediately reacted as part of the next step, limiting the amount of MIC in the process to very low levels .
A Highly Toxic Materials (HTM) Subcommittee was also formed to review DuPont operations worldwide. This review found that DuPont's traditional emphasis on management responsibility for managing safety and PSM was effective in minimizing risks both on- and off-site. Additional safeguards were also recommended, though, to provide an extra margin of safety, providing additional guidelines for facilities, storage, operations, transportation, detection, and community protection. In 1985, three new corporate guidelines were issued on Off-Site Risk Assessment, Community Preparedness, and Management of Highly Toxic Materials. The Off-Site Risk Assessment guideline provided “management with information to aid in identifying and assessing potential off-site public exposure,” and included risk reduction measures incorporating many principles of inherently safer processes. The Community Preparedness guideline endorsed strong support of the chemical industry Community Awareness Emergency Response (CAER) program and similar efforts in other countries, and it provided guidance on how sites could establish and renew appropriate community organizations to plan and respond to chemical emergencies.
The Management of Highly Toxic Materials guideline identified 15 hazardous materials, such as ammonia and chlorine, where special consideration was required to ensure safe storage, processing, and transportation. Highly Toxic Material (HTM) Safety Guardian Committees were established for managing each hazardous material globally, and specific principles and guidance were provided on facilities, storage, operations, transportation, detection, and community protection. For example, one principle for detection was:
Sites handling highly toxic materials will include use of automatic or continuous specific chemical detection systems, where appropriate, as an integral part of minimizing the potential for harmful exposure on- and off-site.
Each HTM Safety Guardian Committee used this guidance to develop specific standards and practices to help ensure safe use of each material. A HTM Safety Guardian Leadership Team was formed in 1988 to “provide continued global focus, leadership, coordination, and leveraged support for the safe management of Highly Toxic Materials.” Upgrades to HTM guidance over the last 20 years have included audit requirements, product stewardship reviews, and additional guidance on minimizing storage and preventing, detecting, controlling, and containing releases. HTM Safety Guardian Committees now exist for over 20 substances.
In addition to corporate PSM and HTM programs, individual businesses developed specialized process safety programs, often related to reactive chemicals, to help ensure the safety of site operations. In many cases, these programs resulted from serious process incidents, leading to formation of global teams from multiple manufacturing sites with similar processes to help prevent further incidents . These teams shared technical and process safety information, developed specific guidance and standards for promoting safe operations, developed hazard evaluation methodologies, provided training, and developed audit protocols. In some cases, these programs pre-dated the issuance of corporate PSM guidance (e.g., one program began in 1968 and another in 1975) and are still active today, continuing to contribute to the prevention of serious process incidents.
In late 1996, the corporate ZIP (Zero Incidents … Period!) Team was formed to increase focus on eliminating process-related injuries and incidents, while at the same time building business value for PSM. The ZIP Team reaffirmed the vision of “The Goal is Zero” for process incidents and communicated these key messages:
There is no silver bullet, no single answer, to improving process safety.
The goal has to be ZERO process-related injuries and incidents. The question is, not IF, but HOW, this goal can be achieved, just as it is for personal safety.
PSM is a business issue, not only a manufacturing issue, requiring the contributions of a broad cross section of the organization to ensure success.
Businesses therefore need to establish a sustainable continuous improvement process toward achieving the goal of zero PSM injuries and incidents that is embedded in business planning.
All businesses and regions were requested to have implementation plans by the end of 1997, which would be included in executive level discussions on performance and planning. The result was a renewed corporate effort to drive continuous improvement activities that led to upgraded standards and practices, training programs, evaluation tools, and business metrics that have greatly impacted PSM performance in DuPont. Subsequent improvement activities, including a PSM Discovery Team effort in 2006, have helped to improve PSM programs on a continuous basis.
Today, PSM requirements and guidance are documented in a series of corporate process safety standards with the principles and essential features of the PSM program continuing to be defined by 14 elements, grouped by Technology, Personnel, and Facilities, as shown in Figure 6. This figure is typically called the PSM Wheel, with each of the 14 elements, such as Process Hazards Analysis, Operating Procedures and Safe Work Practices, and Personnel Training and Performance, arranged around the spokes of the wheel. Management leadership and commitment, necessary for implementing and maintaining strong PSM programs, is shown at the center of the PSM Wheel. Operational discipline is shown as the rim of the PSM Wheel, connecting all of the elements and translating the required managing systems into real results for preventing injuries and incidents [32, 33].
PSM has traditionally applied to high hazard processes involving hazardous materials, such as defined in the OSHA PSM Standard, which presents requirements for “preventing or minimizing the consequences of catastrophic releases of toxic, reactive, flammable, or explosive chemicals.” While this has certainly been true at DuPont as well, PSM efforts have also been extended to include other higher- hazard processes (HHPs), lower-hazard operations (LHOs), and laboratory and pilot plant facilities that go beyond the minimum essential practices required by regulations. The impact is that there are relatively few, if any, manufacturing or research facilities at DuPont where some level of PSM or related programs are not applied to help ensure that process hazards are appropriately evaluated and managed.
In thinking about the future, the one certainty is that changes will occur. Businesses will grow, acquisitions will be made, and new technologies will be invented. Process safety will need to change as well. New acquisitions may present challenges due to different corporate or geographic safety cultures. New technologies may benefit from the application of PSM, but at the same time, may require that new approaches be developed. Standing still and celebrating our successes, though, will not work. Continuous improvement will always be necessary:
Systems and organizations continually experience change as adaptations are made in response to local pressures and short-term productivity and cost goals … A corollary of this propensity for systems and people to adapt over time is that safety defenses are likely to degenerate systematically through time, particularly when pressure toward cost-effectiveness and increased productivity is the dominant element in decision making. Thus, the redundancy and other precautions added to protect against human error often degenerate over time as other work practices adapt to increase efficiency within the local environment. The critical factor here is that such adaptation is not a random process—it is an optimization process … .
The challenge is to recognize this problem and continually work to maintain robust process safety programs. These words, written by a DuPont safety manager over 75 years ago, remain true today:
However, past successes will not prevent present or future accidents. If we are to maintain our position in this field of work, we must not only continue our efforts, but we must increase them .
The goal then, now, and in the future, is to prevent serious injuries and catastrophic incidents—the goal is zero. Learning from experience, based on the lessons of the past, is essential if zero is to be achieved. At DuPont, our core value for safety was established over 200 years ago by the founder, E. I. du Pont, and it continues today. Seeking to understand and manage the hazards of our processes to help ensure a safe future remains our challenge and our commitment.