Kletz's warning, revisited: risk normalization when margins are tight
Chemical Processing has been running a thread this year on a cluster of refinery and fuel-facility fires, and its most recent editorial, Trevor Kletz Warned Us, reaches for the right frame for a process-safety audience. Setting aside the incidents that are the product of external attack rather than plant operation, the underlying argument is one worth putting in front of anyone who chairs or scribes a HAZOP: the conditions that quietly erode safeguards are economic and organizational, and they show up in the study room before they show up in the field.
The mechanism, not the headline
The editorial, drawing on the Process Safety with Trish & Traci podcast with Trish Kerin, describes a familiar chain: high demand and tight margins meet aging assets, and deferred maintenance and delayed upgrades become more common. Kerin adds a detail that matters to hazard teams — refineries are finely tuned to specific feedstocks, and changing the crude mix can bring lower throughput, product-quality problems, and, over a longer horizon, accelerated corrosion that introduces genuinely new failure modes. None of that is visible as a single decision. As the piece puts it, deferred maintenance “isn’t one decision; it’s a thousand small ones that each felt survivable.”
That is Trevor Kletz’s thesis restated. Kletz — the ICI engineer who coined inherently safer design and helped establish HAZOP methodology — spent decades arguing that accidents trace to management decisions, not just operator error, and that risk assessments are performed by humans carrying biases.
Where it lands in the study room
The sharpest line for facilitators is Kletz’s caution about walking into a risk assessment “where everyone already knows what the answer is going to be, because they know what the answer needs to be.” Revalidations run under cost pressure are exactly where that failure mode lives. A safeguard can be credited on paper — a relief path, an interlock, an inspection interval — while its real-world integrity is quietly drifting because the maintenance or testing behind it has been stretched. The node looks unchanged; the protection isn’t.
A few practical implications follow for teams working revalidations in a tight-margin environment:
- Treat “same as last cycle” safeguards as claims to be tested, not facts to be carried forward. Ask what has actually been done to keep each one at the integrity the study assumes — inspection history, bypass logs, overdue work orders.
- Put feedstock and operating-envelope changes on the deviation list explicitly. A different crude slate, a higher run rate, or a longer run between turnarounds can move corrosion, fouling and throughput hazards that a prior study closed out under different assumptions.
- Watch transient and degraded states — startup, shutdown, reduced-staffing periods, and operation with a known safeguard impaired — which is where incremental risk acceptance tends to accumulate.
Kerin’s own suggestion is the least technical and possibly the most useful: talk to the operators and maintainers, and ask which controls they think are degrading right now. That knowledge rarely makes it into a revalidation unless someone deliberately pulls it into the room.
The full editorial is at Chemical Processing; the companion podcast, 11 Fires, 60 Days, was recorded May 7, 2026.