Contributory Factors Containment Failure
Audits & Reviews
Commitment & Culture
Compliance with Standards
Control of Work
Management of Change
MONITORING & IMPROVEMENT
PROCESS SAFETY MANAGEMENT
Food & Drink
Onshore Oil & Gas
Plastics & Polymers
Pulp & Paper
Papua New Guinea
Fluid release to ground
Fluid release to water
Gas/vapour/mist/etc release to air
Rapid phase-transition explosion
Runaway reaction explosion
Solid release to air
Solid release to ground
Solid release to water
Design of Plant
Loss of Process Control
Physical Security Breach
COST (On Site)
ENVIRONMENTAL (On Site)
HUMAN (Offsite At Risk)
HUMAN (Offsite Fatalities)
HUMAN (Offsite Injuries)
HUMAN (On Site At Risk)
HUMAN (On Site Fatalities)
HUMAN (On Site Injuries)
> 100 Fatalities
< 100 Injuries
11 - 100 Fatalities
11 – 100 Fatalities
≥ 100 Injuries
PSV – Pilot Operated
Safety & Control
Shell & Tube
Valves - Safety
Methyl Ethyl Ketone
Oil based solvent
Urea Ammonium Nitrate
Vinyl Chloride Monomer
Live Event Type
Quantitative Risk Assessment
Dust Safety Science
Dutch Safety Board
New Zealand Government
Process Safety Integrity
Step Change in Safety
Corrosion Under Insulation
High Pressure Water
Loss of Utilities
Low Temperature Embrittlement
Normalization of Deviance
Safe Operating Limits
Stress Corrosion Cracking
Permit To Work
Learning from Incidents
Floating Roof Tanks
Minute To Learn
Safety Critical Decisions
202303DecAll DayMarcus Oil & Chemical Explosion 2004Marcus Oil and Chemical Houston (US-TX) Lessons:Asset integrity,Operating ProceduresIndustry:ChemicalsCountry:United StatesLanguage:ENLoC:Deficiency Origin: CSB Incident:VCEHazards:FlammableContributory Factors:Containment FailureImpact:HUMAN (Offsite Injuries)Effects:< 100 InjuriesMaterial:Polyethylene
An explosion and fire that occurred in a polyethylene wax processing facility operated by Marcus Oil and Chemical on the southwest side of Houston, Texas. On Friday, December 3, 2004,
An explosion and fire that occurred in a polyethylene wax processing facility operated by Marcus Oil and Chemical on the southwest side of Houston, Texas. On Friday, December 3, 2004, at about 5:50 pm, employees heard a loud “pop” then saw light from a fire reflecting off a shiny tanker truck parked near the process equipment. About 45 seconds later, a violent explosion occurred and a fire fueled by molten wax erupted near the main warehouse. The warehouse and nearby equipment were quickly involved in the fire.
The Houston Fire Department arrived approximately five minutes after the explosion. Firefighters extinguished the three-alarm blaze by midnight, approximately seven hours after the explosion.
Three firefighters were slightly injured while fighting the fire, and local residents sustained minor injuries from flying glass. The explosion shattered windows in buildings and vehicles and caused structural damage as far as one-quarter mile away. Significant interior damage resulted when suspended ceilings and light fixtures were blown down in the onsite buildings, nearby businesses, and a church. Tank 7, a 12-foot diameter, 50-foot long, 50,000-pound pressure vessel was propelled 150 feet where it impacted a warehouse belonging to another business..
• PRESSURE VESSEL REPAIRS & ALTERATIONS
• NITROGEN INERTING SYSTEM DESIGN & OPERATION
1. Poor welding severely weakened Tank 7 and led to its catastrophic failure.
2. The connection between the nitrogen and the compressed air systems increased the oxygen concentration in the inerting gas to an unsafe level.
3. Pressure vessels had operating pressures in excess of 100 psig, yet none was equipped with a pressure relief device.
Image Credit: CSB
202409JanAll DayFreedom Industries Toxic Release 2014Freedom Industries Charleston (US-WV)Lessons:Asset integrity,Compliance with Standards,Emergency PreparednessIndustry:StorageCountry:United StatesLanguage:ENLoC:Deterioration Origin: CSB Incident:Fluid release to waterHazards:Harmful/IrritantContributory Factors:Containment FailureImpact:HUMAN (Offsite Injuries)Effects:≥ 100 InjuriesMaterial:MCHM
On January 9, 2014, West Virginia Department of Environmental Protection (WVDEP) inspectors arrived at the Freedom Industries (Freedom) chemical storage and distribution facility in Charleston, West Virginia, in response to
On January 9, 2014, West Virginia Department of Environmental Protection (WVDEP) inspectors arrived at the Freedom Industries (Freedom) chemical storage and distribution facility in Charleston, West Virginia, in response to complaints from the public about a chemical odor. Upon arrival, WVDEP inspectors discovered a chemical leaking from tank 396, an aboveground storage tank (AST). The leaking tank contents were originally reported as crude methylcychohexanemethanol (MCHM), but 13 days later Freedom reported it was a mixture of Crude MCHM and polyglycol ethers (PPH, stripped) called Shurflot 944.5 The chemical mixture escaped tank 396 through two small holes on the tank floor and traveled down a descending bank into the adjacent Elk River. The holes were caused by pitting corrosion that initiated on the internal surface of the tank floor. The tank contents drained into the gravel and soil surrounding tank 396 and found multiple pathways into the river. The secondary containment or dike wall, originally designed to control leaks, had cracks and holes from disrepair that allowed the mixture, containing Crude MCHM and PPH, stripped, to escape the containment. The leak also found a pathway to the river through a subsurface culvert, located under adjacent ASTs.
After prompting by WVDEP, Freedom took action to stop the leak and prevent further contamination by deploying services to recover the spill and vacuum the remaining tank contents. However, nearly 11,000 gallons of a mixture containing Crude MCHM and PPH, stripped had already entered into the surrounding soil and Elk River. Once in the river, it flowed downstream to the intake of the West Virginia American Water (WVAW) water treatment facility, about 1.5 miles downriver from Freedom. WVAW’s water treatment and filtration methods were unable to treat and remove all of the chemical mixture in its water treatment process and as a result, it contaminated the drinking water within WVAW’s distribution system. That evening, WVAW issued a Do Not Use (DNU) order for 93,000 customer accounts (approximately 300,000 residents) across portions of nine counties.
• TANK INSPECTIONS & MAINTENANCE
• RISK COMMUNICATION
• PUBLIC WATER SYSTEMS SAFETY & RISK ASSESSMENT
• TOXICOLOGICAL INFORMATION
1. Corrosion of primary containment
2. Deteriorated secondary containment
Image credit: CSB
202422JanAll DayPryor Trust Blowout & Fire 2018Pryor Trust Pittsburg County (US-OK)Lessons:Asset integrity,Commitment & Culture,Compliance with Standards,Operating Procedures,Operational Integrity,Operational ReadinessIndustry:Onshore Oil & GasCountry:United StatesLanguage:ENLoC:Overpressure Origin: CSB Incident:EXPLOSIONHazards:FlammableContributory Factors:Containment FailureImpact:HUMAN (On Site Fatalities)Effects:1-10 FatalitiesMaterial:Methane
On January 22, 2018, a blowout and rig fire occurred at Pryor Trust 0718 gas well number 1H-9, located in Pittsburg County, Oklahoma. The fire killed five workers, who were
On January 22, 2018, a blowout and rig fire occurred at Pryor Trust 0718 gas well number 1H-9, located in Pittsburg County, Oklahoma. The fire killed five workers, who were inside the driller’s cabin on the rig floor. They died from thermal burn injuries and smoke and soot inhalation. The blowout occurred about three-and-a-half hours after removing drill pipe (‘tripping’) out of the well.
The cause of the blowout and rig fire was the failure of both the primary barrier (hydrostatic pressure produced by drilling mud) and the secondary barrier (human detection of influx and activation of the blowout preventer) which were intended to be in place to prevent a blowout.
• POOR BARRIER MANAGEMENT
• UNDERBALANCED OPERATIONS PERFORMED WITHOUT PROPER PLANNING, PROCEDURES, OR NEEDED EQUIPMENT
• SIGNS OF INFLUX EITHER NOT IDENTIFIED OR INADEQUATELY RESPONDED TO
• ALARM SYSTEM OFF
• FLOW CHECKS NOT CONDUCTED
• GAPS IN SAFETY MANAGEMENT SYSTEM
• DRILLER’S CABIN DESIGN
• BOP COULD NOT CLOSE DUE TO BURNED HYDRAULIC HOSES
• LACK OF SAFETY REQUIREMENTS BY REGULATION
1. Failure of primary barrier – hydrostatic pressure produced by drilling mud.
2. Failure of secondary barrier – human detection of influx and activation of the blowout preventer.
Image & AcciMap Credit: CSB
Image credit: CSB
202423JanAll DayDupont (Belle) Toxic Release 2010DuPont Belle (US-WV)Lessons:Asset integrity,Audits & Reviews,Competency,Compliance with Standards,Emergency Preparedness,Incident Investigation,Operating Procedures,Risk AssessmentIndustry:ChemicalsCountry:United StatesLanguage:ENLoC:Deterioration Origin: CSB Incident:Gas/vapour/mist/etc release to airHazards:Corrosive,Flammable,ToxicContributory Factors:Containment FailureImpact:HUMAN (On Site Fatalities)Effects:1-10 FatalitiesMaterial:Methyl Chloride,Oleum,Phosgene
On January 22 and 23, 2010, three separate incidents at the DuPont plant in Belle, WV, involving releases of methyl chloride, oleum, and phosgene, triggered notification of outside emergency response
On January 22 and 23, 2010, three separate incidents at the DuPont plant in Belle, WV, involving releases of methyl chloride, oleum, and phosgene, triggered notification of outside emergency response agencies. The incident involving the release of phosgene gas led to the fatal exposure of a worker performing routine duties in an area where phosgene cylinders were stored and used.
Operators discovered the first incident, the release of methyl chloride, the morning of January 22, 2010, when an alarm sounded on the plant’s distributed control system monitor. They confirmed that a release had occurred and that methyl chloride was venting to the atmosphere. Managers assessing the release estimated that more than 2,000 pounds of methyl chloride may have been released over the preceding 5 days.
The oleum release, the second incident, occurred the morning of January 23, 2010. Workers discovered a leak in an overhead oleum sample pipe that was allowing a fuming cloud of oleum to escape to the atmosphere. The plant fire brigade, after donning the appropriate personal protective equipment, closed a valve that stopped the leak about an hour after it was discovered. No injuries occurred, but the plant called the Belle Volunteer Fire Department to assist.
The third incident, a phosgene release, occurred later that same day when a hose used to transfer phosgene from a 1-ton cylinder to a process catastrophically failed and sprayed a worker in the face while he was checking the weight of the cylinder. The employee, who was alone when exposed, was assisted by co-workers who immediately responded to his call for help. Initial assessments by the plant’s occupational health nurse indicated that the worker showed no symptoms of exposure prior to transport to the hospital for observation and treatment. A delayed onset of symptoms, consistent with information in phosgene exposure literature, occurred after he arrived at the hospital. His condition deteriorated over the next day and he died from his exposure the next night.
• MECHANICAL INTEGRITY
• ALARM MANAGEMENT
• OPERATING PROCEDURES
• COMPANY EMERGENCY RESPONSE & NOTIFICATION
Methyl Chloride Incident (January 22, 2010)
1. DuPont management, following their Management of Change process, approved a design for the rupture disc alarm system that lacked sufficient reliability to advise operators of a flammable methyl chloride release.
Oleum Release Incident (January 23, 2010)
1. Corrosion under the insulation caused a small leak in the oleum pipe.
Phosgene Incident (January 23, 2010)
1. DuPont’s phosgene hazard awareness program was deficient in ensuring that operating personnel were aware of the hazards associated with trapped liquid phosgene in transfer hoses.
2. DuPont relied on a maintenance software program that was subject to changes without authorization or review, did not automatically initiate a change-out of phosgene hoses at the prescribed interval, and did not provide a back-up process to ensure timely change-out of hoses.
3. DuPont Belle’s near-miss reporting process was not rigorous enough to ensure that the near failure of a similar phosgene transfer hose, just hours prior to the exposure incident, would be immediately brought to the attention of plant supervisors and managers.
4. DuPont lacked a dedicated radio/telephone system and emergency notification process to convey the nature of an emergency at the Belle plant, thereby restricting the ability of personnel to provide timely and quality information to emergency responders.
Image credit: CSB
202416FebAll DayValero (Sunray) Refinery Fire 2007Valero Sunray (US-TX)Lessons:Compliance with Standards,Management of Change,Risk AssessmentIndustry:RefiningCountry:United StatesLanguage:ENLoC:Undertemperature Origin: CSB Incident:FIREHazards:FlammableContributory Factors:Containment FailureImpact:HUMAN (On Site At Risk)Effects:< 100 InjuriesMaterial:PropaneTopics:Natural Hazards
At 2:09 p.m. on Friday, February 16, 2007, liquid propane under high pressure was released in the Propane De-Asphalting (PDA) unit of Valero’s McKee Refinery, 50 miles north of Amarillo
At 2:09 p.m. on Friday, February 16, 2007, liquid propane under high pressure was released in the Propane De-Asphalting (PDA) unit of Valero’s McKee Refinery, 50 miles north of Amarillo in the Texas panhandle, near the town of Sunray. The resulting propane vapor cloud found an ignition source, and the subsequent fire injured workers, damaged unit piping and equipment, and collapsed a major piperack. The fire grew rapidly and threatened surrounding units, including a Liquefied Petroleum Gas (LPG) storage area. Fire-fighting efforts were hampered by high and shifting winds and the rapid spread of the fire. A refinery-wide evacuation was ordered approximately 15 minutes after the fire ignited.
Three of the four workers injured were seriously burned, including a contractor. The refinery was completely shut down for just under two months and operated at reduced capacity for nearly a year.
• FREEZE PROTECTION OF DEAD-LEGS
• EMERGENCY ISOLATION OF EQUIPMENT
• FIREPROOFING OF SUPPORT STEEL
• FIRE PROTECTION FOR HIGH PRESSURE LPG SERVICE
• CHLORINE RELEASE
1. The McKee Refinery had no formal written program in place to identify, review, and freeze-protect dead-legs or infrequently used piping and equipment, such as the propane mix control station.
2. The McKee Refinery did not apply Valero’s mandatory Emergency Isolation Valve procedure when evaluating risks in the PDA unit to ensure that the large quantities of flammable materials in the unit could be rapidly isolated in an emergency.
3. API guidance and Valero’s corporate Fire Proofing Specifications standard do not specify sufficiently protective distances for fireproofing pipe rack support steel for processes handling high-pressure flammables, such as the LPG in the PDA unit.
Image credit: CSB
202404MarAll DaySonat Exploration Vessel Overpressurization 1998Sonat Exploration Co. Pitkin (US-LA)Lessons:Asset integrity,Operating Procedures,Risk AssessmentIndustry:Onshore Oil & GasCountry:United StatesLanguage:ENLoC:Overpressure Origin: CSB Incident:FIREHazards:FlammableContributory Factors:Containment FailureImpact:HUMAN (On Site Fatalities)Effects:1-10 FatalitiesMaterial:HydrocarbonsTopics:Pressure Systems
At approximately 6:15 p.m. on March 4, 1998, a catastrophic vessel failure and fire occurred near Pitkin, Louisiana, at the Temple 22-1 Common Point Separation Facility owned by Sonat Exploration
At approximately 6:15 p.m. on March 4, 1998, a catastrophic vessel failure and fire occurred near Pitkin, Louisiana, at the Temple 22-1 Common Point Separation Facility owned by Sonat Exploration Co. Four workers who were near the vessel were killed, and the facility sustained significant damage.
The facility housed two petroleum separation trains and consisted of separation equipment, piping, storage vessels, and a gas distribution system. The separation trains were designed to produce crude oil and natural gas from well fluid, derived from two nearby wells. The vessel ruptured due to overpressurization, releasing flammable material which then ignited.
• DESIGN & HAZARD REVIEWS
• PRESSURE-RELIEF DEVICES
• OPERATING PROCEDURES
1. Sonat management did not use a formal engineering design review process or require effective hazard analyses in the course of designing and building the facility.
2. Sonat engineering specifications did not ensure that equipment that could potentially be exposed to high-pressure hazards was adequately protected by pressure-relief devices.
Image Credit: CSB
202417MarAll DayITC Tank Fire 2019ITC Deer Park (US-TX)Lessons:Emergency Preparedness,Operational Integrity,Stakeholder EngagementIndustry:StorageCountry:United StatesLanguage:ENLoC:Deterioration Origin: CSB Incident:FIREHazards:FlammableContributory Factors:Containment FailureImpact:HUMAN (Offsite At Risk)Effects:EnvironmentalMaterial:Naptha
On Sunday, March 17, 2019, at approximately 10:00 am, a large fire erupted at the Intercontinental Terminals Company, LLC (ITC) bulk liquid storage terminal located in Deer Park, Texas (Figure
On Sunday, March 17, 2019, at approximately 10:00 am, a large fire erupted at the Intercontinental Terminals Company, LLC (ITC) bulk liquid storage terminal located in Deer Park, Texas (Figure 1). The fire originated in the vicinity of Tank 80-8, an 80,000-barrel aboveground atmospheric storage tank that held naphtha, a flammable liquid, typically used as a feedstock or blend stock for production of gasoline. ITC was unable to isolate or stop the release of naphtha product from the tank, and the fire continued to burn, intensify, and progressively involved additional tanks in the tank farm. The fire was extinguished on the morning of March 20, 2019.
The incident did not result in any injuries to either ITC personnel or emergency responders. However, the local community experienced disruptions, including several shelter-in-place notifications, which prompted local schools and businesses either to close or operate under modified conditions.
• RELEASE DETECTION
• RELEASE ISOLATION
• PROLONGED EMERGENCY RESPONSE
Image credit: CSB
202402AprAll DayTesoro (Anacortes) Refinery Explosion 2010Tesoro Anacortes (US-WA)Lessons:Asset integrity,Commitment & Culture,Compliance with Standards,Control of WorkIndustry:RefiningCountry:United StatesLanguage:ENLoC:Deterioration Origin: CSB Incident:VCEHazards:FlammableContributory Factors:Containment FailureImpact:HUMAN (On Site Fatalities)Effects:1-10 FatalitiesMaterial:Naptha
On April 2, 2010, the Tesoro Refining and Marketing Company LLC (‘Tesoro’) petroleum refinery in Anacortes, Washington (‘the Tesoro Anacortes Refinery’), experienced a catastrophic rupture of a heat exchanger in
On April 2, 2010, the Tesoro Refining and Marketing Company LLC (‘Tesoro’) petroleum refinery in Anacortes, Washington (‘the Tesoro Anacortes Refinery’), experienced a catastrophic rupture of a heat exchanger in the Catalytic Reformer / Naphtha Hydrotreater unit (‘the NHT unit’). The heat exchanger, known as E-6600E (‘the E heat exchanger’), catastrophically ruptured because of High Temperature Hydrogen Attack (HTHA). Highly flammable hydrogen and naphtha at more than 500 degrees Fahrenheit (°F) were released from the ruptured heat exchanger and ignited, causing an explosion and an intense fire that burned for more than three hours. The rupture fatally injured seven Tesoro employees (one shift supervisor and six operators) who were working in the immediate vicinity of the heat exchanger at the time of the incident. To date this is the largest fatal incident at a US petroleum refinery since the BP Texas City accident in March 2005.
The NHT unit at the Tesoro Anacortes Refinery contained two parallel groups, or banks, of three heat exchangers (A/B/C and D/E/F) used to preheat process fluid before it entered a reactor, where impurities were treated for subsequent removal. The E heat exchanger was constructed of carbon steel.
At the time of the release, the Tesoro workers were in the final stages of a startup activity to put the A/B/C bank of heat exchangers back in service following cleaning. The D/E/F heat exchangers remained in service during this operation. Because of the refinery’s long history of frequent leaks and occasional fires during this startup activity, the CSB considers this work to be hazardous and nonroutine. While the operations staff was performing the startup operations, the E heat exchanger in the middle of the operating D/E/F bank catastrophically ruptured. .
• INHERENTLY SAFER DESIGN
• TESORO PROCESS SAFETY CULTURE
• CONTROL OF NONROUTINE WORK
• MECHANICAL INTEGRITY INDUSTRY STANDARD DEFICIENCIES
• REGULATORY OVERSIGHT OF PETROLEUM REFINERIES
1. High Temperature Hydrogen Attack
2. NHT Heat Exchanger Flanges – A History of Leaking
3. Hazardous Nonroutine Work
4. Process Hazard Analyses Failed to Prevent or Reduce the Consequences
Image credit: CSB
202420AprAll DayDeepwater Horizon Blowout & Explosion 2010BP Macondo (US-GM)Lessons:Asset integrity,Commitment & Culture,Compliance with Standards,Contractor Management,Incident Investigation,Management of Change,Operating Procedures,Operational IntegrityIndustry:OffshoreCountry:United StatesLanguage:ENLoC:Overpressure Origin: CSB Incident:VCEHazards:FlammableContributory Factors:Containment FailureImpact:HUMAN (On Site Fatalities)Effects:11 – 100 FatalitiesMaterial:Crude Oil
On April 20, 2010, a multiple-fatality incident occurred at the Macondo oil well approximately 50 miles off the coast of Louisiana in the Gulf of Mexico during temporary well-abandonment activities
On April 20, 2010, a multiple-fatality incident occurred at the Macondo oil well approximately 50 miles off the coast of Louisiana in the Gulf of Mexico during temporary well-abandonment activities on the Deepwater Horizon (DWH) drilling rig. Control of the well was lost, resulting in a blowout—the uncontrolled release of oil and gas (hydrocarbons) from the well. On the rig, the hydrocarbons found an ignition source and ignited. The resulting explosions and fire led to the deaths of 11 individuals, serious physical injuries to 17 others, the evacuation of 115 individuals from the rig, the sinking of the Deepwater Horizon, and massive marine and coastal damage from a reported 4 million barrels of released hydrocarbons.
BP was the main operator/lease holder responsible for the well design, and Transocean was the drilling contractor that owned and operated the DWH. On the day of the incident, the crew was completing temporary abandonment of the well so that it could be left in a safe condition until a production facility could return later to extract oil and gas from it.
Abandonment activities would essentially plug the well. Earlier, a critical cement barrier intended to keep the hydrocarbons below the seafloor had not been effectively installed at the bottom of the well. BP and Transocean personnel misinterpreted a test to assess cement barrier integrity, leading them to erroneously believe that the hydrocarbon bearing zone at the bottom of the well had been sealed. When the crew removed drilling mud from the well in preparation to install an additional cement barrier, the open blowout preventer (BOP) was the only physical barrier that could have potentially prevented hydrocarbons from reaching the rig and surrounding environment. The ability of the BOP to act as this barrier was contingent primarily upon human detection of the kick and timely activation and closure of the BOP.
Removing drilling mud after the test allowed hydrocarbons to flow past the failed cement barrier toward the DWH. The hydrocarbons continued to flow from the reservoir for almost an hour without human detection or the activation of the automated controls to close the BOP. Eventually, oil and gas passed above the BOP and forcefully released onto the rig. In response, the well operations crew manually closed the BOP. Oil and gas that had already flowed past the BOP continued to gush onto the rig, igniting and exploding. The explosion likely activated an automatic emergency response system designed to shear drillpipe passing through the BOP and seal the well, but it was unsuccessful.
• BOP TECHNICAL FAILURE ANALYSIS
• BARRIER MANAGEMENT AT MACONDO
• SAFETY CRITICAL ELEMENTS
• HUMAN FACTORS
• ORGANIZATIONAL LEARNING
• SAFETY PERFORMANCE INDICATORS
• RISK MANAGEMENT PRACTICES
• CORPORATE GOVERNANCE
• SAFETY CULTURE
1. Technical Factors
2. Human and Organizational Factors
3. Regulatory Factors
Image Credit: CSB