Hazards: Flammable

A tank ruptured in Warsaw Chemical company, it contained hazardous chemical that caused a fire followed by an explosion. After the fire some chemicals spilled into Winona lake.

50 homes were evacuated

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: 1480 News Now

On February 7, 2008, at about 7:15 p.m., a series of sugar dust explosions at the Imperial Sugar manufacturing facility in Port Wentworth, Georgia, resulted in 14 worker fatalities. Eight workers died at the scene and six others eventually succumbed to their injuries at the Joseph M. Still Burn Center in Augusta, Georgia. Thirty six workers were treated for serious burns and injuries – some caused permanent, life altering conditions. The explosions and subsequent fires destroyed the sugar packing buildings, palletizer room, and silos, and severely damaged the bulk train car loading area and parts of the sugar refining process areas.

KEY ISSUES:
• COMBUSTIBLE DUST HAZARD RECOGNITION
• MINIMIZING COMBUSTIBLE DUST ACCUMULATION IN THE WORKPLACE
• EQUIPMENT DESIGN & MAINTENANCE

ROOT CAUSES:
1. Sugar and cornstarch conveying equipment was not designed or maintained to minimize the release of sugar and sugar dust into the work area.
2. Inadequate housekeeping practices resulted in significant accumulations of combustible sugar and sugar dust on the floors and elevated surfaces throughout the packing buildings.
3. Imperial Sugar emergency evacuation plans were inadequate. Emergency evacuation drills were not conducted, and prompt worker notification to evacuate in the event of an emergency was inadequate.

Image credit: CSB

A February 7, 2003, explosion and fire inside a vent collection system (VCS) at Technic Inc., in Cranston, Rhode Island, critically injured one employee, who suffered permanent eye damage and chemical burns to his face and upper body. Eighteen other employees were sent to the hospital for medical evaluations, and the fire department evacuated the surrounding community. Facility operations were interrupted for several weeks.

The explosion and fire were caused by a violent chemical reaction inside the vent collection system, which was likely initiated when the employee tapped on a duct with a small hammer. The building where the incident occurred housed several chemical processes that were connected to the ventilation system.

KEY ISSUES:
• INCOMPATIBLE CHEMICAL MIXING
• PROCESS SAFETY REVIEW
• MANAGEMENT OF CHANGE
• PREVENTIVE MAINTENANCE
• EMERGENCY PLANNING & RESPONSE

ROOT CAUSES:
1. Technic did not conduct a process safety review as a part of the engineering process to identify and evaluate the hazards associated with installing a vent collection system to handle the exhausts from multiple processes.
2. Technic did not identify and evaluate the hazards created by changes to facility processes and equipment (i.e., management of change).

Image Credit: CSB

Six workers were fatally injured during a planned work activity to clean debris from natural gas pipes at Kleen Energy in Middletown, CT. To remove the debris, workers used natural gas at a high pressure of approximately 650 pounds per square inch. The high velocity of the natural gas flow was intended to remove any debris in the new piping. During this process, the natural gas found an ignition source and exploded.

KEY ISSUES:
• SIMILAR NATURAL GAS BLOW INCIDENTS
• INDUSTRY PRACTICES AND SAFER ALTERNATIVE METHODOLOGIES
• HAZARDS OF RELEASING NATURAL GAS NEAR WORK AREAS
• CODES AND STANDARDS

ROOT CAUSES:
1. Natural gas blows are common
2. Workers remained in building during gas blow

Image credit: CSB

On Wednesday, February 8, 2017, at approximately 11:05 am, a foul condensate tank, part of a non-condensable gas system, exploded at the Packaging Corporation of America (PCA) containerboard mill in DeRidder, Louisiana. The explosion killed three people and injured seven others. All 10 people were working at the mill as contractors. The explosion also heavily damaged the surrounding process. The foul condensate tank travelled approximately 375 feet and over a six-story building before landing on process equipment.

At the time of the incident, the mill was undergoing its annual planned maintenance outage, also referred to as a shutdown. The foul condensate tank likely contained water, a layer of flammable liquid turpentine on top of the water, and an explosive vapor space containing air and flammable turpentine vapor.

KEY ISSUES:
• PROCESS SAFETY MANAGEMENT SYSTEM
• INHERENTLY SAFER DESIGN
• PROCESS HAZARD ANALYSIS
• INEFFECTIVE SAFEGUARDS
• HOT WORK SAFETY MANAGEMENT

ROOT CAUSES:
1. PCA did not evaluate the majority of the non-condensable gas system, including the foul condensate tank, for certain hazards. The DeRidder mill never conducted a process hazard analysis to identify, evaluate, and control process hazards for the non-condensable gas system.
2. PCA did not expand the boundaries of its process safety management program beyond the units covered by safety regulations.
3. PCA did not effectively apply the hierarchy of controls to the selection and implementation of safeguards that the company used to prevent a potential non-condensable gas explosion.
4. PCA did not evaluate inherently safer design options that could have eliminated the possibility of air entering the non-condensable gas system, including the foul condensate tank.
5. PCA did not establish which mill operations group held ownership of, and responsibility for, the foul condensate tank.
6. PCA did not apply important aspects of industry safety guidance and standards.

Image credit: CSB

An explosion occurred when 8 personnel were working on the repair of a catalyst tower.

Proximate causes:
• Inadequate training/knowledge transfer (Lack of understanding the process)
• Lack of work rules/policies/ standards/procedures (wrong procedures for inspections);
• Inadequate work rules plan (lack of the pre-start safety review before inspection).

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)

On the 11 February 1980 a fire and a series of explosions occurred at a warehouse in a factory at Trubshaw Cross, Longport, Stoke-on-Trent. On the morning of the fire the warehouse contained some 49 tonnes of liquefied petroleum gas (LPG) in cartridges and aerosol containers as well as about 1 tonne of petroleum mixtures in small containers, raw materials, and packaging materials. It is almost certain that the source of ignition was the electrical system of a battery operated fork lift truck.

LPG is a well known fire and explosion hazard; the circumstances of the fire emphasise the need for occupiers of premises containing LPG to be adequately informed, by obtaining information and advice from authoritative sources, on the hazards of LPG and the precautions to be observed in its storage.

Report: https://www.icheme.org/media/13695/the-fire-and-explosions-at-permaflex-trubshaw-cross-stoke.pdf

Image Credit: Stoke Sentinel

The main turret bearing on a FPSO vessel seized and subsequently failed, resulting in the vessel being unable to weathervane. Production was resumed with a revised operating regime employing tugs to maintain a constant heading. Subsequently, the vessel was converted to employ a permanent spread moored configuration, fixing the heading of the vessel and installing an associated deepwater offloading buoy.

[ Property Damage $450 Million. Estimated Current Value $466 Million ]

Image credit: Tullow Oil

Explosion in an oil and gas production ship rented by Petrobras. The explosion occurred aboard the FPSO unit. A leak of flammable substance in the pump room was the cause of the explosion.

Proximate causes:
• Failure in following procedures
• Lack of work rules/policies/ standards/procedures (breach of operational procedures for the pumping of fluids)
• Inadequate engineering/design
• Inadequate management/ supervision (installation of equipment in pipe without proper technical specification and registration of the change)
• Work exposure to hazardous chemicals (flammable substances) Inadequate assessment of needs and risks

Marsh (https://www.marsh.com/us/insights/research/100-largest-losses-in-the-hydrocarbon-industry.html):

An explosion on a FPSO off the coast of Brazil resulted in nine fatalities and multiple wounded. The accident happened as the vessel was anchored in the Atlantic Ocean 120 kilometres from the coast of Espirito Santos, Brazil. The FPSO is a converted very large crude oil tanker (VLCC), designed to produce up to 10 million cubic meters of natural gas. It is understood that a condensate leak during a fluid transfer operation released a cloud of flammable vapor into the engine room, resulting in an explosion in the machinery space. The majority of fatalities were believed to be part of the emergency response team. FPSO took on water, but the explosion did not result in a breach of the hull of the vessel.

[ Property Damage $250 Million. Estimated Current Value $264 Million ]

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: AFP / Getty Images

At approximately 10:00 hours workers on site noticed the electrical lights flickering and saw smoke coming from the warehouse. On opening the warehouse door to investigate, a wall of thick smoke confronted an employee. Shutting the door he raised the alarm and called the fire brigade. The warehouse was used for storing large quantities of ICI herbicides in plastic bottles and drums with plastic liners and octyl phenol in paper sacks.

The fire brigade responded promptly and was automatically issued with TREM cards (Transport Emergency Cards) relating to the herbicides and Octyl Phenol. However, by this time the fire had become established and had broken through the roof of the warehouse. The intensity and speed at which the fire developed surprised the fire fighters, as they believed the warehouse contents to be largely incombustible.

Some of the drums/bottles had burst in the fire and their contents were washed down the road and into Hey Beck, a small stream that drains from the site. This resulted in a major pollution incident. Because of the large volumes involved the decision was taken to allow the material to continue to flow into the drains, washed down by the fire brigade. This washing down activity continued for over two days after the incident. The diluted herbicides turned the stream into a brown foaming torrent for several miles. The River Calder was affected by this pollution. The fire fighters were faced with additional problems because of the physical properties of octyl phenol. This substance floats on water producing a flowing pool of burning liquid.

The seriousness of the pollution prompted action to be taken to contact police, the water authority, local radio stations and the press to warn the general public of the dangers of coming into contact with the contaminated water. Farmers were warned to keep livestock away from riverbanks.

The exact cause of this accident is unknown. A worker had been shrink-wrapping paper sacks of octyl phenol onto wooden pallets using a plastic film and a hand held cylinder heat gun, shortly before the incident occurred. It is feasible that the flame from the gun passing too close overheated one of the pallets, causing one or more bags, or the pallet to smoulder, eventually bursting in flames.

KEY ISSUES:
• EMERGENCY RESPONSE / SPILL CONTROL
• REACTION / PRODUCT TESTING

Image Credit: West Yorkshire Fire & Rescue Service

A rail car with more than 100 tanks of crude bakken oil derailed in West Virginia, generating a huge fireball, the evacuation of hundreds of people and, a spill into the Kanawha River.

Hundreds evacuated – FRE issued CSX and Sperry Rail Service $25.000 fines each

Proximate causes:
• Inadequate tools, equipment & vehicles (rail defect)

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: US Coast Guard

At 2:09 p.m. on Friday, February 16, 2007, liquid propane under high pressure was released in the Propane De-Asphalting (PDA) unit of Valero’s McKee Refinery, 50 miles north of Amarillo in the Texas panhandle, near the town of Sunray. The resulting propane vapor cloud found an ignition source, and the subsequent fire injured workers, damaged unit piping and equipment, and collapsed a major piperack. The fire grew rapidly and threatened surrounding units, including a Liquefied Petroleum Gas (LPG) storage area. Fire-fighting efforts were hampered by high and shifting winds and the rapid spread of the fire. A refinery-wide evacuation was ordered approximately 15 minutes after the fire ignited.

Three of the four workers injured were seriously burned, including a contractor. The refinery was completely shut down for just under two months and operated at reduced capacity for nearly a year.

KEY ISSUES:
• FREEZE PROTECTION OF DEAD-LEGS
• EMERGENCY ISOLATION OF EQUIPMENT
• FIREPROOFING OF SUPPORT STEEL
• FIRE PROTECTION FOR HIGH PRESSURE LPG SERVICE
• CHLORINE RELEASE

ROOT CAUSES:
1. The McKee Refinery had no formal written program in place to identify, review, and freeze-protect dead-legs or infrequently used piping and equipment, such as the propane mix control station.
2. The McKee Refinery did not apply Valero’s mandatory Emergency Isolation Valve procedure when evaluating risks in the PDA unit to ensure that the large quantities of flammable materials in the unit could be rapidly isolated in an emergency.
3. API guidance and Valero’s corporate Fire Proofing Specifications standard do not specify sufficiently protective distances for fireproofing pipe rack support steel for processes handling high-pressure flammables, such as the LPG in the PDA unit.

Image credit: CSB

An explosion at this 70,000 bbl-per-day oil refinery caused damage to the FCC, utilities, storage tanks, and asphalt unit. One employee was hospitalized for burns. Another person was injured when her car was struck by debris from the explosion on the nearby highway. There was a total of four injuries. A skeleton crew of just 40 people were on site because the blast occurred on a public holiday. There would typically have been about four times as many people on duty at the time of the explosion. The fire was brought under control the same day by the site’s fire brigade, supported by local fire departments. The release is believed to have occurred during a start-up on the propylene splitter unit, as a result of the catastrophic failure of a pump. Some processing resumed about two months later, and the FCC was re-commissioned eight months after the incident.

[ Property Damage $380 Million. Estimated Current Value $454 Million ]

Image credit: Delek

On Wednesday, February 18, 2015, an explosion occurred in the ExxonMobil Torrance, California refinery’s Electrostatic Precipitator (ESP), a pollution control device in the fluid catalytic cracking (FCC) unit that removes catalyst particles using charged plates that produce sparks (potential ignition sources) during normal operation. The incident occurred when ExxonMobil was attempting to isolate equipment for maintenance while the unit was in an idled mode of operation; preparations for the maintenance activity caused a pressure deviation that allowed hydrocarbons to backflow through the process and ignite in the ESP.

The CSB found that this incident occurred due to weaknesses in the ExxonMobil Torrance refinery’s process safety management system. These weaknesses led to operation of the FCC unit without pre-established safe operating limits and criteria for unit shutdown, reliance on safeguards that could not be verified, the degradation of a safety-critical safeguard, and the re-use of a previous procedure deviation without a sufficient hazard analysis that confirmed that the assumed process conditions were still valid. .

KEY ISSUES:
• LACK OF SAFE OPERATING LIMITS & OPERATING PROCEDURE
• SAFEGUARD EFFECTIVENESS
• OPERATING EQUIPMENT BEYOND SAFE OPERATING LIFE
• RE-USE OF PREVIOUS PROCEDURE VARIANCE WITHOUT SUFFICIENT HAZARD ANALYSIS

ROOT CAUSES:
1. ExxonMobil did not establish the safe operating limits for operating the FCC unit in Safe Park (a standby mode of operation) or determine process conditions that required unit shutdown.
2. ExxonMobil did not perform a sufficient hazard analysis to determine if the unit conditions specified in the 2012 procedure were valid for the 2015 operation.
3. ExxonMobil operated FCC unit equipment beyond its predicted safe operating life.
4. ExxonMobil lacked safety instrumentation to detect flammable hydrocarbons flowing through the equipment and into the ESP.
5. ExxonMobil refinery management permitted opening process equipment without conforming to refinery standards.

Image credit: CSB

A February 20, 2003, dust explosion at the CTA Acoustics, Inc. (CTA) facility in Corbin, Kentucky, killed seven and injured 37 workers. This incident caused extensive damage to the production area of the 302,000-square-foot plant. Nearby homes and an elementary school were evacuated, and a 12-mile section of Interstate 75 was closed. The largest CTA customer, Ford Motor Company, temporarily suspended operations at four automobile assembly plants because CTA had produced acoustic insulation products for those plants, as well as for other industrial and automotive clients.

KEY ISSUES:
• COMBUSTIBLE DUST HAZARD AWARENESS
• WORK PRACTICES
• BUILDING DESIGN
• PRODUCT STEWARDSHIP

ROOT CAUSES:
1. CTA management did not implement effective measures to prevent combustible dust explosions.
2. The CTA cleaning and maintenance procedures for production lines did not prevent the accumulation of unsafe levels of combustible dust on elevated flat surfaces.
3. The CTA incident investigation program did not ensure that all oven fires were investigated and that underlying causes were identified and resolved.
4. The Borden Chemical product stewardship program did not explicitly convey to CTA the explosive hazards of phenolic resins.
5. The original building design and subsequent building modifications did not effectively address the fire and explosion hazards associated with combustible dusts.

Image Credit: CSB

On February 23, 1999, a fire occurred in the crude unit at Tosco Corporation. Avon oil refinery in Martinez, California. Workers were attempting to replace piping attached to a 150-foot-tall fractionator tower while the process unit was in operation. During removal of the piping, naphtha was released onto the hot fractionator and ignited. The flames engulfed five workers located at different heights on the tower. Four men were killed, and one sustained serious injuries.

KEY ISSUES:
• CONTROL OF HAZARDOUS NONROUTINE MAINTENANCE
• MANAGEMENT OVERSIGHT & ACCOUNTABILITY
• MANAGEMENT OF CHANGE
• CORROSION CONTROL

ROOT CAUSES:
1. Tosco Avon refinery’s maintenance management system did not recognize or control serious hazards posed by performing nonroutine repair work while the crude processing unit remained in operation.
2. Tosco’s safety management oversight system did not detect or correct serious deficiencies in the execution of maintenance and review of process changes at its Avon refinery.

Image Credit: CSB

The earthquake struck with an intensity of M7.5 (MM IX), with aftershocks over the following weeks. The event caused building and infrastructure damage, and sinkholes and landslides. Over 160 people were killed from the local communities and many injured.

The damage affected the local airport at Komo, which was significantly damaged, the gas conditioning plant — which was safely shut down with some damage but no loss of containment — and the pipeline system, where there was no loss of containment but a need to remediate the pipeline “right of way” along most of its onshore length.

The Rimbey pipeline system in Alberta, Canada transports liquid propane, butane and condensate products in an 8-inch pipeline. On the day of the incident the operating pumps were pumping against a closed valve. The line failed at a pressure of approximately 8000 kPa, which is below the 8372 kPa maximum operating pressure for the pipeline.

Liquid propane erupted violently and formed a pond of boiling propane. The propane quickly formed a ground level flammable gas cloud, which rolled across topsoil until it reached a road where it was ignited by a passing truck. Liquid propane entered a nearby storm sewer catchment basin. The propane spread into adjacent sewer lines. Explosive mixtures were detected over a wide area within the sewer system.

No injuries were recorded, however the incident instigated a large-scale evacuation of 19,000 people while efforts were made to eliminate the explosive danger.

A combination of water flushing, ventilation and nitrogen gas blanketing successfully eliminated the danger about 23 hours after the original fracture. Maintenance crews plugged the pipeline either side of the fracture to stop the flow of leaking gas

KEY ISSUES:
• EMERGENCY RESPONSE / SPILL CONTROL

Image Credit: Provincial Archives Of Alberta

A high-pressure steam (3.7 MPa) discharge occurred during a maintenance process, resulting in three field workers burned to death.

Proximate causes:
• Lack of work rules/policies/ standards/procedures (wrong procedures for inspections);
• Inadequate work rules plan (lack of the pre-start safety review before inspection).

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)

At approximately 6:15 p.m. on March 4, 1998, a catastrophic vessel failure and fire occurred near Pitkin, Louisiana, at the Temple 22-1 Common Point Separation Facility owned by Sonat Exploration Co. Four workers who were near the vessel were killed, and the facility sustained significant damage.

The facility housed two petroleum separation trains and consisted of separation equipment, piping, storage vessels, and a gas distribution system. The separation trains were designed to produce crude oil and natural gas from well fluid, derived from two nearby wells. The vessel ruptured due to overpressurization, releasing flammable material which then ignited.

KEY ISSUES:
• DESIGN & HAZARD REVIEWS
• PRESSURE-RELIEF DEVICES
• OPERATING PROCEDURES

ROOT CAUSES:
1. Sonat management did not use a formal engineering design review process or require effective hazard analyses in the course of designing and building the facility.
2. Sonat engineering specifications did not ensure that equipment that could potentially be exposed to high-pressure hazards was adequately protected by pressure-relief devices.

Image Credit: CSB

Some 25 miles of Trans-Andean pipeline disappeared in this event, which also damaged natural gas and gasoline pipelines. All 285 producing wells were shut down and oil exports were suspended and swap arrangement made with Venezuelan suppliers. The first earthquake registered 6.0 on the Richter scale, the second 6.8, and there was a total of 10 earthquakes in total. Repairs took several months.

[ Property Damage $120 Million. Estimated Current Value $288 Million ]

Image credit: NAPU

A hairline crack in a welded seam of piping to the level indicator system on an aldehyde column resulted in a minor ethylene oxide leak on this gas processing plant. As a result of this crack, which was caused by low cycle fatigue, ethylene oxide escaped near the level indicator and formed polyethylene glycols (PEG) in the mineral wool insulation. It is believed that both the leak and accumulation of PEG occurred over a period of time. During repairs to the level indicator, the metal sheathing of the insulation was removed and air contacted the insulation soaked with PEG. Auto-oxidation of the PEG resulted and the insulating material was ignited. The piping to the level indicator system was heated to such a degree that auto-decomposition of the ethylene oxide within the piping occurred. This autodecomposition propagated into the aldehyde column which subsequently exploded. The force of the explosion completely destroyed the distillation section of this plant. The large resulting fire and impact of flying debris to other process sections resulted in extensive damage throughout the plant.

[ Property Damage $79 Million. Estimated Current Value $178 Million ]

Image credit: No credit

A gas leak involving the pipe rack that runs to the terminal of this petrochemical complex led to an explosion, which occurred near the complex chemical plant, causing additional damage to the pipe rack and resulting in a major gas leak. A powerful second explosion occurred that could be felt more than 15 miles from the complex. These explosions and a subsequent fire completely destroyed the chemical plant, caused significant damage to the pipe rack, and resulted in moderate damage to other complex buildings and adjacent third-party facilities. The fire was extinguished after approximately three hours. Because of this incident, the chemical plant at this complex was completely shut down for seven months to allow for the rebuild of the plant and the pipe rack.

[ Property Damage $97 Million. Estimated Current Value $208 Million ]

Image credit: Reuters

A fire broke out in a wet gas scrubber while heavy maintenance on a unit was being carried out. Personnel were evacuated from the site and there were no injuries. The site was conducting a planned shutdown and maintenance of the plant equipment including the polypropylene plant.

[ Property Damage $150 Million. Estimated Current Value $162 Million ]

Image credit: ORPIC

A major explosion occurred at a 145,000-barrels-per-day refinery in the north-eastern city of Sendai, hours after the largest earthquake in the country’s history was followed by a tsunami. The fire at the Sendai refinery originated from a land oil product shipping facility. Workers at the refinery were evacuated, and there was no capacity available to extinguish the fire. Fire in the storage and shipping facilities had also damaged a 35,500 barrels-per-day FCC at the refinery.

[ Property Damage $590 Million. Estimated Current Value $651 Million ]

Image credit: JXTG Nippon Oil & Energy

An explosion occurred in the ethylene oxide process unit at this plant. As a result, the ethylene oxide refining column was completely destroyed, the ethylene glycol unit was substantially damaged, and the co-generation unit was partially damaged. A pipe rack near the storage area for liquid ethylene oxide was damaged when a large piece of shrapnel from the explosion hit the rack, rupturing lines which contained methane and other hydrocarbon products.

The subsequent fire that resulted from the released products was the only significant fire to occur during this incident. As a result of the explosion, all utilities at the plant were lost for approximately one week. Additionally, several fixed fire protection systems were damaged by the explosion or inadvertently actuated due to a loss of plant air. These systems were shut off, isolated, or placed back in service, as appropriate. A manual fire fighting effort was used to extinguish the fire in the pipe rack once the lines in the rack were isolated. The polyethylene production was restarted in early April 1991 using imported ethylene. The olefins production unit was restarted in late April 1991.

[ Property Damage $90 Million. Estimated Current Value $194 Million ]

Image credit: Vitaly Shmatikov

Fifteen months before the incident occurred it had been noticed that the flare line isolation valve V17 was passing. It was decided however to wait for a scheduled shutdown of the catalytic cracker unit and No 1 flare before commencing work on the valve. Gases from the remaining operating units were re-routed to No 2 and No 3 flares. This flare arrangement would allow the pipelines at V17 to be isolated.

When senior refinery staff prepared a plan for the isolation of the flare system, they concentrated on the operational and safety requirements of the flare system, making sure that no operational areas of the plant were inadvertently isolated. The details of the removal of V17 were not considered and left to those who would be responsible for the work.

Four workers were involved with the removal of the valve. When the majority of the bolts were undone the joint opened slightly and liquid dripped from a small gap between the flanges. The workers sought advice. The valve was checked and it was concluded that it was safe to carry on. Non ferrous hammers were provided before continuing with the removal. All the bolts were removed and the crane took the weight of a spacer and started to remove it, at which point gallons of liquid poured from the valve. A flammable vapour cloud formed from the rapidly spreading pool. The cloud reached the nearby air compressor, ignited and flashed back around the working area.

Two workers managed to escape the fire but a fitter and a rigger were engulfed by the flames and killed. The fire was allowed to burn in a controlled manner for almost two days while the rest of the refinery was shut down and the flare system purged with nitrogen

KEY ISSUES:
• DESIGN CODES – PIPEWORK
• MAINTENANCE PROCEDURES
• ISOLATION

Report: https://www.icheme.org/media/13700/the-fires-and-explosion-at-bp-oil-grangemouth-refinery-ltd.pdf

Image Credit: HSE

A fire occurred on one of the two hydrotreaters on an oil sands upgrader facility. The fire was reported to be as a result of the failure of a pipe, resulting in a releaser of naphtha. One worker was seriously injured as a result of the fire, which was extinguished after two days.

[ Property Damage $220 Million. Estimated Current Value $220 Million ]

Image credit: CBC

The world’s largest offshore production facility was rocked by a series of explosions caused by a gas release. The explosions knocked out a support pillar of the semi-submersible platform allowing seawater to enter the vessel. Workers pumped in nitrogen and compressed air and tried to pump out almost 3,000 metric tons of seawater to keep the rig afloat, but were unsuccessful. On March 20, 2001, the rig sank to the sea floor. The incident killed 11 workers.

[ Property Damage $500 Million. Estimated Current Value $851 Million ]

Ref: http://www.anp.gov.br/noticias/2342-anp-marinha-comissao-conjunta

Image credit: Petrobras

On Sunday, March 17, 2019, at approximately 10:00 am, a large fire erupted at the Intercontinental Terminals Company, LLC (ITC) bulk liquid storage terminal located in Deer Park, Texas (Figure 1). The fire originated in the vicinity of Tank 80-8, an 80,000-barrel aboveground atmospheric storage tank that held naphtha, a flammable liquid, typically used as a feedstock or blend stock for production of gasoline. ITC was unable to isolate or stop the release of naphtha product from the tank, and the fire continued to burn, intensify, and progressively involved additional tanks in the tank farm. The fire was extinguished on the morning of March 20, 2019.

The incident did not result in any injuries to either ITC personnel or emergency responders. However, the local community experienced disruptions, including several shelter-in-place notifications, which prompted local schools and businesses either to close or operate under modified conditions.

KEY ISSUES:
• RELEASE DETECTION
• RELEASE ISOLATION
• PROLONGED EMERGENCY RESPONSE

Image credit: CSB

Contract personnel were installing a pig trap on an 18-inch-diameter export gas pipeline on the platform. As a cold cut was made into the pipeline, hydrocarbons sprayed from the cut and ignited. The explosion and fire burned the main structure and caused subsequent explosions when six other pipelines ruptured due to the intense heat. The accident resulted in the total destruction of the platform and seven fatalities. It took two years to replace the platform.

[ Property Damage $400 Million. Estimated Current Value $899 Million ]

Image credit: ARCO

On 20 March 1990 the halogen exchange reactor on the Fluoroaromatics plant was ruptured by the pressure generated by a runaway reaction. The plant was partially destroyed and missiles were projected over 500m. Six employees were injured and one subsequently died from post-operative complications.

A batch had been charged into the vessel and was being heated up as normal. When it reached 165oC, the temperature continued to rise and the operators adjusted the jacket temperature. The display screen in use did not display pressure and they were unaware of a corresponding rise in pressure. By the time they were alerted to the rise in pressure the pressure relief valves had lifted. Before any other corrective action could be taken, the reactor exploded. The pressure in the vessel reached a value of about 60-80 barg compared with the relief valve set pressure of 5 barg.

The resulting blast was enhanced by the formation of a fireball, which occurred when the contents of the reactor ignited within the plant structure. This started local fires and initiated what became a major conflagration in an adjacent unit where vessels containing xylene were damaged by the blast/missile effects. The ensuing fires were brought under control in four hours by the Shell fire team and Cheshire fire service.

The initial cause of the incident was the ingress of excessive water into the process leading to the formation of acetic acid which, upon recycle to the reactor, reacted vigorously with the reactor contents initiating the explosion. Water was present as a part of the process, however a massive incursion led to the formation of a separate layer in the process vessel which was not removed but recycled back into reactor.

KEY ISSUES:
• CONTROL ROOM DESIGN
• RAW MATERIALS CONTROL / SAMPLING
• REACTION / PRODUCT TESTING
• RELIEF SYSTEMS / VENT SYSTEMS

Image Credit: The Leader

An accident occurred at a methylcellulose manufacturing facility. An explosion occurred and was followed by a fire, which was extinguished about seven hours later. A total of 17 people working at the site were injured in this accident; three critically, five seriously, and nine with minor injuries. There was one minor injury off site. Ignition of the methylcellulose powder is though to have been due to static electricity, resulting in a powder dust explosion. All methylcellulose operations were suspended for two months before sequentially restarting.

[ Property Damage $240 Million. Estimated Current Value $306 Million ]

Image credit: Shin-Etsu

On Saturday 21 March 1987 the hydrocracker unit was being recommissioned following a routine shut down. During the recommissioning a plant trip occurred. This was thought to be a spurious trip and the plant operators started to bring up the unit to normal operating conditions. From then on until the time of the incident the plant was held in stand by condition with no fresh feed.

At 07:00 hours the following morning there was a violent explosion and subsequent fire. The explosion could be heard and felt up to 30km away. The explosion centred on a low pressure (LP) separator vessel, V306, which was fabricated from 18mm steel plate and weighed 20 tonnes.

The investigation of the accident suggested that an air operated control valve on the high pressure (HP) separator had been opened and closed on manual control at least three times. Liquid level in the LP separator fell and the valve was opened. This action allowed the remaining liquid in the HP separator to drain away and for high pressure gas to break through into the LP separator. As the pressure relief on the LP separator had been designed for a fire relief case, not gas breakthrough the vessel subsequently exploded.

The control valve did not close automatically because the low low level trip on the HP separator had been disconnected several years earlier. The operators did not trust the main level control reading and referred to a chart recorder for a back up level reading. There was an offset on this chart recorder which led them to assume that the level in the HP separator was normal.

KEY ISSUES:
• MAINTENANCE PROCEDURES
• CONTROL SYSTEMS
• OPERATING PROCEDURES
• PLANT MODIFICATION / CHANGE PROCEDURES
• ALARM / TRIPS / INTERLOCKS
• RELIEF SYSTEMS / VENT SYSTEMS
• ISOLATION

Report: https://www.icheme.org/media/13700/the-fires-and-explosion-at-bp-oil-grangemouth-refinery-ltd.pdf

Image Credit: HSE

At approximately 1:20 p.m. on March 23, 2005, a series of explosions occurred at the BP Texas City refinery during the restarting of a hydrocarbon isomerization unit. Fifteen workers were killed and 180 others were injured. Many of the victims were in or around work trailers located near an atmospheric vent stack. The explosions occurred when a distillation tower flooded with hydrocarbons and was overpressurized, causing a geyser-like release from the vent stack.

KEY ISSUES:
• SAFETY CULTURE
• REGULATORY OVERSIGHT
• PROCESS SAFETY METRICS
• HUMAN FACTORS

ROOT CAUSES:
1. BP Group Board did not provide effective oversight of the company’s safety culture and major accident prevention programs.

2. Senior executives:
• inadequately addressed controlling major hazard risk. Personal safety was measured, rewarded, and the primary focus, but the same emphasis was not put on improving process safety performance;
• did not provide effective safety culture leadership and oversight to prevent catastrophic accidents;
• ineffectively ensured that the safety implications of major organizational, personnel, and policy changes were evaluated;
• did not provide adequate resources to prevent major accidents; budget cuts impaired process safety performance at the Texas City refinery.

3. BP Texas City Managers did not:
• create an effective reporting and learning culture; reporting bad news was not encouraged. Incidents were often ineffectively investigated and appropriate corrective actions not taken.
• ensure that supervisors and management modeled and enforced use of up-to-date plant policies and procedures.
• incorporate good practice design in the operation of the ISOM unit.
• ensure that operators were supervised and supported by experienced, technically trained personnel during unit startup, an especially hazardous phase of operation; or that
• effectively incorporated human factor considerations in its training, staffing, and work schedule for operations personnel.

Image Credit: CSB

On March 24, 1989, shortly after midnight, the oil tanker Exxon Valdez struck Bligh Reef in Prince William Sound, Alaska, spilling more than 11 million gallons of crude oil. The spill was the largest in U.S. history and tested the abilities of local, national, and industrial organizations to prepare for, and respond to, a disaster of such magnitude. Many factors complicated the cleanup efforts following the spill. The size of the spill and its remote location, accessible only by helicopter and boat, made government and industry efforts difficult and tested existing plans for dealing with such an event.

The spill posed threats to the delicate food chain that supports Prince William Sound’s commercial fishing industry. Also in danger were ten million migratory shore birds and waterfowl, hundreds of sea otters, dozens of other species, such as harbor porpoises and sea lions, and several varieties of whales.

Image Credit: EPA

An apparent failure of a propane intercooler liquid level control during unsupervised maintenance led to an explosion and fire. The control room on the main platform was destroyed and adjacent platforms were affected by the blast wave. There were 11 fatalities.

[ Property Damage $100 Million. Estimated Current Value $194 Million ]

Image credit: PDVSA

This explosion was caused by the failure of a valve bonnet in a high-pressure section of a 60,000 bbl-per-day hydrocracker. A vapor cloud formed from the release, ignited, and was followed by a large fire fed by escaping hydrocarbons at high pressure. The explosion resulted in the collapse of a large section of pipe rack and destruction of a large fin-fan cooler mounted above the rack. Many pumps were destroyed and a separator was badly damaged. Approximately 300 fire fighters and 33 fire trucks participated in the two and a half-hour effort to control the fire. Foam concentrate consumed totalled 3,200 US gallons. The hydrocracker was out of service for 12 months.

[ Property Damage $113 Million. Estimated Current Value $205 Million ]

Image credit: SF Gate

Blaze in a warehouse next to oil factory. Fire created massive plumes of smoke in the area. Fire spread to adjacent paint factory. Damaged buildings

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Twitter / News24

A complex of six platforms located in 30 meters of water in the Gulf of Mexico was subject to a major fire. The fire originated on the lower decks of the production platform and resulted in major damage to that platform, radiation and fire damage to an adjacent compression platform, the loss of bridge links and pipelines, and radiation damage to other bridge links. The root-cause investigation required by the government identified corrosion of a small bore pipeline as the cause of the initial failure.

[ Property Damage $500 Million. Estimated Current Value $650 Million ]

Image credit: PEMEX

A fire started inside a depot with 3 million liters of diesel and the flames spread to four neighboring storage tanks. The fire lasted for 9 days.

Fine of around USD $6.4 million (R$ 22.5 million). Environmental impact causing death of thousands of fish

Proximate causes:
• Inadequate management/ supervision
• Inadequate work planning

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Paulo Whitaker / Reuters

A fire broke out in the 188,000 barrels-per-day refinery, caused by flash-floods during heavy rain. The rain overwhelmed the storm drainage system on the refinery, resulting in hydrocarbons being washed out of the drains and around the site. An explosion was reported in the crude distillation unit. There were two fires in the crude distillation unit (CDU), one in the coking plant and two in the topping distillation plant. The government agency said the incident had been caused by hydrocarbons exploding in one of the coke manufacturing furnaces. The furnaces had been shut down, but were still hot enough to ignite the hydrocarbon. It took eight hours to extinguish the fire and 10 hours before the incident was under control. There were no fatalities or injuries.

[ Property Damage $225 Million. Estimated Current Value $243 Million ]

Image credit: YPF

On April 2, 2010, the Tesoro Refining and Marketing Company LLC (‘Tesoro’) petroleum refinery in Anacortes, Washington (‘the Tesoro Anacortes Refinery’), experienced a catastrophic rupture of a heat exchanger in the Catalytic Reformer / Naphtha Hydrotreater unit (‘the NHT unit’). The heat exchanger, known as E-6600E (‘the E heat exchanger’), catastrophically ruptured because of High Temperature Hydrogen Attack (HTHA). Highly flammable hydrogen and naphtha at more than 500 degrees Fahrenheit (°F) were released from the ruptured heat exchanger and ignited, causing an explosion and an intense fire that burned for more than three hours. The rupture fatally injured seven Tesoro employees (one shift supervisor and six operators) who were working in the immediate vicinity of the heat exchanger at the time of the incident. To date this is the largest fatal incident at a US petroleum refinery since the BP Texas City accident in March 2005.

The NHT unit at the Tesoro Anacortes Refinery contained two parallel groups, or banks, of three heat exchangers (A/B/C and D/E/F) used to preheat process fluid before it entered a reactor, where impurities were treated for subsequent removal. The E heat exchanger was constructed of carbon steel.

At the time of the release, the Tesoro workers were in the final stages of a startup activity to put the A/B/C bank of heat exchangers back in service following cleaning. The D/E/F heat exchangers remained in service during this operation. Because of the refinery’s long history of frequent leaks and occasional fires during this startup activity, the CSB considers this work to be hazardous and nonroutine. While the operations staff was performing the startup operations, the E heat exchanger in the middle of the operating D/E/F bank catastrophically ruptured. .

KEY ISSUES:
• INHERENTLY SAFER DESIGN
• TESORO PROCESS SAFETY CULTURE
• CONTROL OF NONROUTINE WORK
• MECHANICAL INTEGRITY INDUSTRY STANDARD DEFICIENCIES
• REGULATORY OVERSIGHT OF PETROLEUM REFINERIES

ROOT CAUSES:
1. High Temperature Hydrogen Attack
2. NHT Heat Exchanger Flanges – A History of Leaking
3. Hazardous Nonroutine Work
4. Process Hazard Analyses Failed to Prevent or Reduce the Consequences

Image credit: CSB

On Tuesday, April 2, 2019, just before 10:46 am, a vapor cloud of isobutylene formed at the KMCO, LLC (‘KMCO’) facility in Crosby, Texas after a three-inch gray iron (a type of cast iron) y-strainer, a piping component, failed.

Shortly after 10:50 am, the vapor cloud found an ignition source and ignited, causing an explosion. The explosion killed one KMCO worker and seriously burned two others. On the day of the incident, more than 200 KMCO employees, contract workers, and visitors were onsite. The incident injured at least 30 workers (seven KMCO employees and 23 contract workers). A shelter-in-place was issued to community members within one mile of the KMCO facility.

KEY ISSUES:
• MECHANICAL INTEGRITY

Image credit: CSB

A blast occurred in a pumping station, after leaking oil caught fire. 177 fire engines and more than 800 firefighters were rushed to the blaze, and more than 14,000 residents in the surrounding area were evacuated.

Proximate causes:
• Improper use of protective methods (Improper welding of conveying pipe)

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Getty

On April 7, 2003, at about 8:55 p.m., central daylight time, an 80,000-barrel storage tank at ConocoPhillips Company’s Glenpool South tank farm in Glenpool, Oklahoma, exploded and burned as it was being filled with diesel. The tank, designated tank 11, had previously contained gasoline, which had been removed from the tank earlier in the day. The tank contained between 7,397 and 7,600 barrels of diesel at the time of the explosion.

The resulting fire burned for about 21 hours and damaged two other storage tanks in the area. The cost of the accident, including emergency response, environmental remediation, evacuation, lost product, property damage, and claims, was $2,357,483. There were no injuries or fatalities. Nearby residents were evacuated, and schools were closed for 2 days.

Image Credit: NTSB

On April 8, 2004, four workers were seriously injured when highly flammable gasoline components were released and ignited at the Giant Industries Ciniza refinery, east of Gallup, New Mexico. The release occurred as maintenance workers were removing a malfunctioning pump from the refinery’s hydrofluoric acid (HF) alkylation unit. Unknown to personnel, a shut-off valve connecting the pump to a distillation column was apparently in the open position, leading to the release and subsequent explosions.

KEY ISSUES:
• MECHANICAL INTEGRITY
• CORROSION & SCALE FORMATION
• VALVE DESIGN
• HUMAN FACTORS CONSIDERATION
• MANAGEMENT OF CHANGE
• LOCKOUT/TAGOUT & ISOLATION

ROOT CAUSES:
1. An MOC hazard analysis was not conducted.
2. the facility lacked procedures to verify that the pump had been isolated, depressurized and drained.
3. Instead of determining the cause of frequent pump malfunctions and then implementing a program that would prevent problems before they occurred, Giant used breakdown maintenance by making repeated repairs to the pump seals after failure.

Image Credit: CSB

Two employees accidently fell in an aerobic tank sewage treatment station. Two more employees fell into the aerobic tank in the subsequent rescue.

Proximate causes:
• Inadequate tools, equipment & vehicles (Aerobic tank no special ventilation equipment)

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)

An oil spill occurred due to a failure of a block valve to seat properly during maintenance on a pump strainer in the visbreaker unit. The oil auto-ignited and the ensuing fire spread and destroyed the visbreaker and damaged adjacent equipment. Subsequent explosions, heat restricted fire fighting access, inadequately trained fire brigade personnel, and damage to the firewater distribution system further hindered extinguishing the fire in a timely manner. The fire was spread by the firewater application, and was finally extinguished with the help of the local fire department.

[ Property Damage $159 Million. Estimated Current Value $271 Million ]

Image credit: Citgo