Root Cause Analysis of Dust Explosions in Grain Handling Facilities: A Proposed Investigation Framework

1. Introduction

Dust from wheat, maize, soya and other grains is combustible, and when it is suspended in air inside an enclosure in sufficient concentration it can explode. The hazard has been recognised since the early days of mechanised milling. A series of grain elevator explosions in the United States in late 1977 led to a national study of their causes (National Materials Advisory Board, 1982) and, a decade later, to a dedicated occupational safety standard for grain handling facilities (OSHA, 1987). The physical mechanism is described in standard texts (Eckhoff, 2003), and consensus standards set out the precautions (NFPA, 2020).

Explosions nevertheless recur, and reviews of case histories find the same causes appearing again: accumulated dust, an ignition source inside a bucket elevator or introduced by hot work, and no means of stopping the flame from travelling (Abbasi and Abbasi, 2007). A study of combustible dust incidents by the United States Chemical Safety and Hazard Investigation Board reached a similar conclusion for industry in general: the hazards were known, and the knowledge had not been turned into practice at the sites concerned (CSB, 2006).

If the technical causes are known, an investigation that only confirms them adds little. The question worth answering after an explosion is why known precautions were absent or ineffective at that facility. This article proposes an investigation framework designed to answer it. The framework is assembled from published guidance and established accident models. It is offered as a method for others to apply and assess, and it has not been validated on an incident in this article.

2. Background

Two bodies of knowledge underlie the framework: the physics of dust explosions as it applies to grain handling plant, and the theory of accident causation that distinguishes immediate causes from the conditions that produce them.

2.1. The explosion pentagon in a grain facility

A dust explosion requires five things at once: a combustible dust, an oxidant, an ignition source, dispersion of the dust into a cloud within its explosible concentration range, and some degree of confinement. This explosion pentagon is the usual starting point for both prevention and analysis (Amyotte and Eckhoff, 2010). In a grain facility the fuel and the air are always present. Bucket elevator legs, enclosed conveyors, bins, dust collectors and the galleries and tunnels that connect them provide confinement, and the handling of grain itself disperses dust inside the equipment.

The most destructive events involve more than one explosion. An initial explosion inside a piece of equipment sends a pressure wave into the building, the wave lifts dust that has settled on floors, ledges and beams, and the flame that follows ignites the new cloud. Such secondary explosions can travel the length of a gallery and into connected structures (Eckhoff, 2003). The quantity of settled dust therefore governs the scale of the loss, which is why the grain handling standard sets an action level for dust accumulation in priority housekeeping areas and requires a written housekeeping programme (OSHA, 1987).

Whether a given dust can explode, and how violently, is established by test. The maximum explosion pressure and the deflagration index are measured in a closed vessel (ASTM, 2019a), and the minimum ignition energy of a cloud is measured by spark discharge (ASTM, 2019b). Both depend strongly on particle size and moisture content, so a sample that does not represent the dust involved will mislead (Cashdollar, 2000).

2.2. Models of accident causation

Accident research has moved from a search for the single failed component or negligent person towards an account of how organisations allow hazards to pass their defences. Reason (1997) distinguishes active failures at the point of work from latent conditions created earlier by decisions about design, maintenance, staffing and supervision. Rasmussen (1997) describes how economic and workload pressures cause practice to drift towards the boundary of safe operation. Leveson (2004) treats accidents as failures of control within a hierarchy that runs from the regulator to the operator. Guidance for the process industries applies these ideas to incident investigation (CCPS, 2003), and Kletz (2001) shows through case histories how much is lost when an inquiry stops at the first cause it finds.

3. The Proposed Framework

The framework has eight stages, taken in order although evidence found late may reopen an earlier stage. Stages 1 to 5 establish what happened physically. Stages 6 to 8 establish why the facility was vulnerable and what should change.

3.1. Stage 1: Secure the scene and preserve evidence

After rescue and fire control are complete, the first duty is to prevent further harm and to keep the evidence intact. Damaged bins and elevators may be unstable, smouldering grain can reignite or generate carbon monoxide, and residual dust can explode again if disturbed near a hot spot. Access is controlled and recorded. Before anything is moved, the scene is photographed systematically, and perishable evidence is collected: dust layers in undamaged areas, the contents of control system memories, maintenance logs, hot work permits and shift records. The guide for fire and explosion investigations sets out the principles for documentation and for custody of evidence (NFPA, 2021).

3.2. Stage 2: Map the damage and reconstruct the flame path

The damage is surveyed and plotted on drawings of the plant. Direction of displacement of casings, panels and walls, the distribution of scorching and of charred dust, and the positions of thrown debris indicate the direction in which pressure and flame travelled. Explosion vents that opened, and those that did not, are recorded. The object is to separate the primary explosion from the secondary ones and to identify the equipment in which the event began. Damage is often greatest far from the origin, where the flame had accelerated, and the area of heaviest destruction should not be taken as the starting point without supporting evidence.

3.3. Stage 3: Sample and characterise the dust

Samples are taken from the equipment of origin where residue survives, from comparable undamaged equipment and from settled layers in the building, with the location and layer depth of each recorded. Particle size distribution and moisture content are measured as received. Explosion severity and ignition sensitivity are then determined by the standard closed-vessel and spark tests (ASTM, 2019a; ASTM, 2019b). Where a hot surface or a smouldering deposit is suspected, the ignition temperatures of the cloud and of the layer are relevant as well. The results tell the investigator which ignition sources were capable of igniting the dust and which can be set aside.

3.4. Stage 4: Test each element of the pentagon

Each of the five elements is examined in turn, and for each the investigator states what evidence shows it was present at the origin at the time. Table 1 sets out the questions and the evidence that typically bears on them. The discipline of the table is that no element is assumed. It is common, for instance, to take dispersion for granted inside a running elevator leg, yet the concentration in a leg depends on the commodity, the throughput and the state of the aspiration system, all of which can be established from records.

3.5. Stage 5: Evaluate ignition hypotheses

Candidate ignition sources are listed and each is tested against the evidence, following the scientific method described in the investigation guide: a hypothesis is retained only if it is consistent with all the reliable facts, and it is not adopted merely because the alternatives have been eliminated and nothing contradicts it (NFPA, 2021). In grain facilities the candidates usually include overheated bearings, a belt slipping on a pulley or rubbing on a casing, foreign metal striking moving parts, welding and cutting, faulty electrical equipment, and smouldering material carried in from a dryer or a bin. For each, the investigator asks whether it was present, whether it could reach the ignition temperature or energy found in Stage 3, and whether its position agrees with the origin found in Stage 2. Where the evidence does not discriminate between two sources, the report should say so.

3.6. Stage 6: Chart the events and the barriers that failed

The physical findings are assembled into a sequence of events, and against each event the investigator lists the barriers that were meant to prevent it or limit its consequences. Barriers in a grain facility include housekeeping, dust collection, bearing temperature and belt alignment monitoring, motion sensors that stop a leg when the belt slips, magnets and screens for tramp metal, hot work permits, explosion venting and isolation between connected equipment (NFPA, 2020). For each barrier three questions are asked: whether it existed, whether it was working, and whether it was adequate. A dust hazard analysis of the kind required by the combustible dust standard, if one was carried out, shows which barriers the operator believed to be in place (NFPA, 2019).

3.7. Stage 7: Analyse organisational causes

For every barrier that was missing, defeated or inadequate, the inquiry continues upward, as Figure 1 illustrates. A disabled motion sensor leads to questions about maintenance resources, spare parts and the response to earlier alarms. Heavy dust accumulation leads to questions about staffing during harvest, the condition of the dust collection system and the attention given to housekeeping inspections. The concepts of latent conditions and of drift under production pressure give structure to these questions (Reason, 1997; Rasmussen, 1997), and the control-structure view directs attention to contractors, corporate management, insurers and the regulator as well as the site (Leveson, 2004).

Interviews at this stage need care. People who were present will know the outcome, and so will the investigator, and both are liable to judge earlier decisions by what happened afterwards. Dekker (2006) argues that the useful question is why an action made sense to the person at the time, given what they knew and the pressures they faced. An answer in those terms points to conditions that can be changed. A finding of operator error does not.

3.8. Stage 8: Derive and rank recommendations

Each causal finding should lead to a recommendation, and each recommendation should name the cause it addresses. Measures are ranked by the hierarchy of controls. Those that remove the hazard or reduce its scale come first: relocating legs outside the structure, reducing dust generation at transfer points, removing unnecessary connections between buildings. Engineering controls such as venting, isolation and hazard monitoring follow. Procedural measures and training come last, since they depend on the continued attention that the analysis has usually just shown to be unreliable (Amyotte and Eckhoff, 2010). The report should also state how the completion of each action will be verified.

4. Applying the Framework

The framework is intended to be usable by the parties who normally investigate such events: the operator, the insurer, the safety regulator and independent specialists. A team needs at least one member with knowledge of dust explosion phenomena, one with operating knowledge of grain handling plant, and one with experience of interviewing and of organisational analysis. The first five stages depend on prompt access, because demolition and salvage begin early at a damaged elevator. The later stages depend on access to records and to people, and on the willingness of the organisation to have its decisions examined. Where an inquiry is conducted for litigation or enforcement, that willingness may be limited, and the report should make clear which stages could not be completed.

5. Limitations and What Remains to Be Shown

The framework has been set out here on paper only. Its usefulness would have to be judged by application, and three questions seem most important. The first is whether investigators using it reach organisational findings that a conventional origin-and-cause inquiry into the same event would have missed. The second is whether different teams applying it to the same evidence reach similar conclusions, since causal analysis above the physical level involves judgement. The third is whether the additional effort is proportionate for smaller incidents. Retrospective application to published investigation reports would be a reasonable first test of each.

Some limits are inherent. Explosions destroy evidence, and the origin or the ignition source may remain undetermined however careful the work. Laboratory tests characterise a sample, not the cloud that exploded. And the organisational stage can describe conditions that made the event more likely without proving that any one of them was necessary for it.

6. Conclusion

Grain dust explosions are well understood physically, and the precautions against them are written into standards and regulations. An investigation that identifies only the dust and the spark therefore repeats what is already known. The eight-stage framework proposed in this article keeps the rigour of a conventional explosion investigation, testing each element of the pentagon and each ignition hypothesis against evidence, and then requires the inquiry to continue through the failed barriers to the organisational conditions behind them. Its value remains to be demonstrated by use, and reports of its application, including cases where it proved impractical, would be a useful contribution.

Conflict of interest

To be declared by the author(s) before publication.

Funding

To be declared by the author(s) before publication.