Contributory Factors: Containment Failure

An explosion and fire that occurred in a polyethylene wax processing facility operated by Marcus Oil and Chemical on the southwest side of Houston, Texas. On Friday, December 3, 2004, at about 5:50 pm, employees heard a loud “pop” then saw light from a fire reflecting off a shiny tanker truck parked near the process equipment. About 45 seconds later, a violent explosion occurred and a fire fueled by molten wax erupted near the main warehouse. The warehouse and nearby equipment were quickly involved in the fire.

The Houston Fire Department arrived approximately five minutes after the explosion. Firefighters extinguished the three-alarm blaze by midnight, approximately seven hours after the explosion.

Three firefighters were slightly injured while fighting the fire, and local residents sustained minor injuries from flying glass. The explosion shattered windows in buildings and vehicles and caused structural damage as far as one-quarter mile away. Significant interior damage resulted when suspended ceilings and light fixtures were blown down in the onsite buildings, nearby businesses, and a church. Tank 7, a 12-foot diameter, 50-foot long, 50,000-pound pressure vessel was propelled 150 feet where it impacted a warehouse belonging to another business..

KEY ISSUES:
• PRESSURE VESSEL REPAIRS & ALTERATIONS
• NITROGEN INERTING SYSTEM DESIGN & OPERATION

ROOT CAUSES:
1. Poor welding severely weakened Tank 7 and led to its catastrophic failure.
2. The connection between the nitrogen and the compressed air systems increased the oxygen concentration in the inerting gas to an unsafe level.
3. Pressure vessels had operating pressures in excess of 100 psig, yet none was equipped with a pressure relief device.

Image Credit: CSB

On January 9, 2014, West Virginia Department of Environmental Protection (WVDEP) inspectors arrived at the Freedom Industries (Freedom) chemical storage and distribution facility in Charleston, West Virginia, in response to complaints from the public about a chemical odor. Upon arrival, WVDEP inspectors discovered a chemical leaking from tank 396, an aboveground storage tank (AST). The leaking tank contents were originally reported as crude methylcychohexanemethanol (MCHM), but 13 days later Freedom reported it was a mixture of Crude MCHM and polyglycol ethers (PPH, stripped) called Shurflot 944.5 The chemical mixture escaped tank 396 through two small holes on the tank floor and traveled down a descending bank into the adjacent Elk River. The holes were caused by pitting corrosion that initiated on the internal surface of the tank floor. The tank contents drained into the gravel and soil surrounding tank 396 and found multiple pathways into the river. The secondary containment or dike wall, originally designed to control leaks, had cracks and holes from disrepair that allowed the mixture, containing Crude MCHM and PPH, stripped, to escape the containment. The leak also found a pathway to the river through a subsurface culvert, located under adjacent ASTs.

After prompting by WVDEP, Freedom took action to stop the leak and prevent further contamination by deploying services to recover the spill and vacuum the remaining tank contents. However, nearly 11,000 gallons of a mixture containing Crude MCHM and PPH, stripped had already entered into the surrounding soil and Elk River. Once in the river, it flowed downstream to the intake of the West Virginia American Water (WVAW) water treatment facility, about 1.5 miles downriver from Freedom. WVAW’s water treatment and filtration methods were unable to treat and remove all of the chemical mixture in its water treatment process and as a result, it contaminated the drinking water within WVAW’s distribution system. That evening, WVAW issued a Do Not Use (DNU) order for 93,000 customer accounts (approximately 300,000 residents) across portions of nine counties.

KEY ISSUES:
• TANK INSPECTIONS & MAINTENANCE
• RISK COMMUNICATION
• PUBLIC WATER SYSTEMS SAFETY & RISK ASSESSMENT
• TOXICOLOGICAL INFORMATION

ROOT CAUSES:
1. Corrosion of primary containment
2. Deteriorated secondary containment

Image credit: CSB

On January 22, 2018, a blowout and rig fire occurred at Pryor Trust 0718 gas well number 1H-9, located in Pittsburg County, Oklahoma. The fire killed five workers, who were inside the driller’s cabin on the rig floor. They died from thermal burn injuries and smoke and soot inhalation. The blowout occurred about three-and-a-half hours after removing drill pipe (‘tripping’) out of the well.

The cause of the blowout and rig fire was the failure of both the primary barrier (hydrostatic pressure produced by drilling mud) and the secondary barrier (human detection of influx and activation of the blowout preventer) which were intended to be in place to prevent a blowout.

KEY ISSUES:
• POOR BARRIER MANAGEMENT
• UNDERBALANCED OPERATIONS PERFORMED WITHOUT PROPER PLANNING, PROCEDURES, OR NEEDED EQUIPMENT
• SIGNS OF INFLUX EITHER NOT IDENTIFIED OR INADEQUATELY RESPONDED TO
• ALARM SYSTEM OFF
• FLOW CHECKS NOT CONDUCTED
• GAPS IN SAFETY MANAGEMENT SYSTEM
• DRILLER’S CABIN DESIGN
• BOP COULD NOT CLOSE DUE TO BURNED HYDRAULIC HOSES
• LACK OF SAFETY REQUIREMENTS BY REGULATION

ROOT CAUSES:
1. Failure of primary barrier – hydrostatic pressure produced by drilling mud.
2. Failure of secondary barrier – human detection of influx and activation of the blowout preventer.

Image & AcciMap Credit: CSB

Image credit: CSB

On January 22 and 23, 2010, three separate incidents at the DuPont plant in Belle, WV, involving releases of methyl chloride, oleum, and phosgene, triggered notification of outside emergency response agencies. The incident involving the release of phosgene gas led to the fatal exposure of a worker performing routine duties in an area where phosgene cylinders were stored and used.

Operators discovered the first incident, the release of methyl chloride, the morning of January 22, 2010, when an alarm sounded on the plant’s distributed control system monitor. They confirmed that a release had occurred and that methyl chloride was venting to the atmosphere. Managers assessing the release estimated that more than 2,000 pounds of methyl chloride may have been released over the preceding 5 days.

The oleum release, the second incident, occurred the morning of January 23, 2010. Workers discovered a leak in an overhead oleum sample pipe that was allowing a fuming cloud of oleum to escape to the atmosphere. The plant fire brigade, after donning the appropriate personal protective equipment, closed a valve that stopped the leak about an hour after it was discovered. No injuries occurred, but the plant called the Belle Volunteer Fire Department to assist.

The third incident, a phosgene release, occurred later that same day when a hose used to transfer phosgene from a 1-ton cylinder to a process catastrophically failed and sprayed a worker in the face while he was checking the weight of the cylinder. The employee, who was alone when exposed, was assisted by co-workers who immediately responded to his call for help. Initial assessments by the plant’s occupational health nurse indicated that the worker showed no symptoms of exposure prior to transport to the hospital for observation and treatment. A delayed onset of symptoms, consistent with information in phosgene exposure literature, occurred after he arrived at the hospital. His condition deteriorated over the next day and he died from his exposure the next night.

KEY ISSUES:
• MECHANICAL INTEGRITY
• ALARM MANAGEMENT
• OPERATING PROCEDURES
• COMPANY EMERGENCY RESPONSE & NOTIFICATION

ROOT CAUSES:

Methyl Chloride Incident (January 22, 2010)
1. DuPont management, following their Management of Change process, approved a design for the rupture disc alarm system that lacked sufficient reliability to advise operators of a flammable methyl chloride release.

Oleum Release Incident (January 23, 2010)
1. Corrosion under the insulation caused a small leak in the oleum pipe.

Phosgene Incident (January 23, 2010)
1. DuPont’s phosgene hazard awareness program was deficient in ensuring that operating personnel were aware of the hazards associated with trapped liquid phosgene in transfer hoses.
2. DuPont relied on a maintenance software program that was subject to changes without authorization or review, did not automatically initiate a change-out of phosgene hoses at the prescribed interval, and did not provide a back-up process to ensure timely change-out of hoses.
3. DuPont Belle’s near-miss reporting process was not rigorous enough to ensure that the near failure of a similar phosgene transfer hose, just hours prior to the exposure incident, would be immediately brought to the attention of plant supervisors and managers.
4. DuPont lacked a dedicated radio/telephone system and emergency notification process to convey the nature of an emergency at the Belle plant, thereby restricting the ability of personnel to provide timely and quality information to emergency responders.

Image credit: CSB

At 2:09 p.m. on Friday, February 16, 2007, liquid propane under high pressure was released in the Propane De-Asphalting (PDA) unit of Valero’s McKee Refinery, 50 miles north of Amarillo in the Texas panhandle, near the town of Sunray. The resulting propane vapor cloud found an ignition source, and the subsequent fire injured workers, damaged unit piping and equipment, and collapsed a major piperack. The fire grew rapidly and threatened surrounding units, including a Liquefied Petroleum Gas (LPG) storage area. Fire-fighting efforts were hampered by high and shifting winds and the rapid spread of the fire. A refinery-wide evacuation was ordered approximately 15 minutes after the fire ignited.

Three of the four workers injured were seriously burned, including a contractor. The refinery was completely shut down for just under two months and operated at reduced capacity for nearly a year.

KEY ISSUES:
• FREEZE PROTECTION OF DEAD-LEGS
• EMERGENCY ISOLATION OF EQUIPMENT
• FIREPROOFING OF SUPPORT STEEL
• FIRE PROTECTION FOR HIGH PRESSURE LPG SERVICE
• CHLORINE RELEASE

ROOT CAUSES:
1. The McKee Refinery had no formal written program in place to identify, review, and freeze-protect dead-legs or infrequently used piping and equipment, such as the propane mix control station.
2. The McKee Refinery did not apply Valero’s mandatory Emergency Isolation Valve procedure when evaluating risks in the PDA unit to ensure that the large quantities of flammable materials in the unit could be rapidly isolated in an emergency.
3. API guidance and Valero’s corporate Fire Proofing Specifications standard do not specify sufficiently protective distances for fireproofing pipe rack support steel for processes handling high-pressure flammables, such as the LPG in the PDA unit.

Image credit: CSB

At approximately 6:15 p.m. on March 4, 1998, a catastrophic vessel failure and fire occurred near Pitkin, Louisiana, at the Temple 22-1 Common Point Separation Facility owned by Sonat Exploration Co. Four workers who were near the vessel were killed, and the facility sustained significant damage.

The facility housed two petroleum separation trains and consisted of separation equipment, piping, storage vessels, and a gas distribution system. The separation trains were designed to produce crude oil and natural gas from well fluid, derived from two nearby wells. The vessel ruptured due to overpressurization, releasing flammable material which then ignited.

KEY ISSUES:
• DESIGN & HAZARD REVIEWS
• PRESSURE-RELIEF DEVICES
• OPERATING PROCEDURES

ROOT CAUSES:
1. Sonat management did not use a formal engineering design review process or require effective hazard analyses in the course of designing and building the facility.
2. Sonat engineering specifications did not ensure that equipment that could potentially be exposed to high-pressure hazards was adequately protected by pressure-relief devices.

Image Credit: CSB

On Sunday, March 17, 2019, at approximately 10:00 am, a large fire erupted at the Intercontinental Terminals Company, LLC (ITC) bulk liquid storage terminal located in Deer Park, Texas (Figure 1). The fire originated in the vicinity of Tank 80-8, an 80,000-barrel aboveground atmospheric storage tank that held naphtha, a flammable liquid, typically used as a feedstock or blend stock for production of gasoline. ITC was unable to isolate or stop the release of naphtha product from the tank, and the fire continued to burn, intensify, and progressively involved additional tanks in the tank farm. The fire was extinguished on the morning of March 20, 2019.

The incident did not result in any injuries to either ITC personnel or emergency responders. However, the local community experienced disruptions, including several shelter-in-place notifications, which prompted local schools and businesses either to close or operate under modified conditions.

KEY ISSUES:
• RELEASE DETECTION
• RELEASE ISOLATION
• PROLONGED EMERGENCY RESPONSE

Image credit: CSB

On April 2, 2010, the Tesoro Refining and Marketing Company LLC (‘Tesoro’) petroleum refinery in Anacortes, Washington (‘the Tesoro Anacortes Refinery’), experienced a catastrophic rupture of a heat exchanger in the Catalytic Reformer / Naphtha Hydrotreater unit (‘the NHT unit’). The heat exchanger, known as E-6600E (‘the E heat exchanger’), catastrophically ruptured because of High Temperature Hydrogen Attack (HTHA). Highly flammable hydrogen and naphtha at more than 500 degrees Fahrenheit (°F) were released from the ruptured heat exchanger and ignited, causing an explosion and an intense fire that burned for more than three hours. The rupture fatally injured seven Tesoro employees (one shift supervisor and six operators) who were working in the immediate vicinity of the heat exchanger at the time of the incident. To date this is the largest fatal incident at a US petroleum refinery since the BP Texas City accident in March 2005.

The NHT unit at the Tesoro Anacortes Refinery contained two parallel groups, or banks, of three heat exchangers (A/B/C and D/E/F) used to preheat process fluid before it entered a reactor, where impurities were treated for subsequent removal. The E heat exchanger was constructed of carbon steel.

At the time of the release, the Tesoro workers were in the final stages of a startup activity to put the A/B/C bank of heat exchangers back in service following cleaning. The D/E/F heat exchangers remained in service during this operation. Because of the refinery’s long history of frequent leaks and occasional fires during this startup activity, the CSB considers this work to be hazardous and nonroutine. While the operations staff was performing the startup operations, the E heat exchanger in the middle of the operating D/E/F bank catastrophically ruptured. .

KEY ISSUES:
• INHERENTLY SAFER DESIGN
• TESORO PROCESS SAFETY CULTURE
• CONTROL OF NONROUTINE WORK
• MECHANICAL INTEGRITY INDUSTRY STANDARD DEFICIENCIES
• REGULATORY OVERSIGHT OF PETROLEUM REFINERIES

ROOT CAUSES:
1. High Temperature Hydrogen Attack
2. NHT Heat Exchanger Flanges – A History of Leaking
3. Hazardous Nonroutine Work
4. Process Hazard Analyses Failed to Prevent or Reduce the Consequences

Image credit: CSB

On April 20, 2010, a multiple-fatality incident occurred at the Macondo oil well approximately 50 miles off the coast of Louisiana in the Gulf of Mexico during temporary well-abandonment activities on the Deepwater Horizon (DWH) drilling rig. Control of the well was lost, resulting in a blowout—the uncontrolled release of oil and gas (hydrocarbons) from the well. On the rig, the hydrocarbons found an ignition source and ignited. The resulting explosions and fire led to the deaths of 11 individuals, serious physical injuries to 17 others, the evacuation of 115 individuals from the rig, the sinking of the Deepwater Horizon, and massive marine and coastal damage from a reported 4 million barrels of released hydrocarbons.

BP was the main operator/lease holder responsible for the well design, and Transocean was the drilling contractor that owned and operated the DWH. On the day of the incident, the crew was completing temporary abandonment of the well so that it could be left in a safe condition until a production facility could return later to extract oil and gas from it.

Abandonment activities would essentially plug the well. Earlier, a critical cement barrier intended to keep the hydrocarbons below the seafloor had not been effectively installed at the bottom of the well. BP and Transocean personnel misinterpreted a test to assess cement barrier integrity, leading them to erroneously believe that the hydrocarbon bearing zone at the bottom of the well had been sealed. When the crew removed drilling mud from the well in preparation to install an additional cement barrier, the open blowout preventer (BOP) was the only physical barrier that could have potentially prevented hydrocarbons from reaching the rig and surrounding environment. The ability of the BOP to act as this barrier was contingent primarily upon human detection of the kick and timely activation and closure of the BOP.

Removing drilling mud after the test allowed hydrocarbons to flow past the failed cement barrier toward the DWH. The hydrocarbons continued to flow from the reservoir for almost an hour without human detection or the activation of the automated controls to close the BOP. Eventually, oil and gas passed above the BOP and forcefully released onto the rig. In response, the well operations crew manually closed the BOP. Oil and gas that had already flowed past the BOP continued to gush onto the rig, igniting and exploding. The explosion likely activated an automatic emergency response system designed to shear drillpipe passing through the BOP and seal the well, but it was unsuccessful.

KEY ISSUES:
• BOP TECHNICAL FAILURE ANALYSIS
• BARRIER MANAGEMENT AT MACONDO
• SAFETY CRITICAL ELEMENTS
• HUMAN FACTORS
• ORGANIZATIONAL LEARNING
• SAFETY PERFORMANCE INDICATORS
• RISK MANAGEMENT PRACTICES
• CORPORATE GOVERNANCE
• SAFETY CULTURE

ROOT CAUSES:
1. Technical Factors
2. Human and Organizational Factors
3. Regulatory Factors

Image Credit: CSB