Contributory Factors: Maintenance

On Wednesday, January 11, 2006, three workers continued the roof removal. About 11:15 a.m., the lead mechanic and the third worker were cutting the metal roof directly above the methanol tank vent. Sparks, showering down from the cutting torch, ignited methanol vapors coming from the vent, creating a fireball on top of the tank. The fire flashed through a flame arrester on the vent, igniting methanol vapors and air inside the tank, causing a explosion inside the steel tank.

The explosion inside the methanol storage tank
• rounded the tank’s flat bottom, permanently deforming the tank and raising the side wall about onefoot;
• ripped the nuts from six bolts used to anchor the tank to a concrete foundation;
• blew the flame arrester off the tank vent pipe;
• blew a level sensor off a 4-inch flange on the tank top;
• separated two 1-inch pipes, valves, and an attached level switch from flanges on the side of the tank;
• separated a 4-inch tank outlet pipe from the tank outlet valve; and
• separated a 4-inch tank fill pipe near the top the tank.

Methanol discharged from the separated pipes ignited and burned, spreading the fire. Methanol also flowed into the containment around the tank and through a drain to the WWTP where it was diluted and harmlessly processed. The lead mechanic and the third worker were in the man-lift basket over the methanol tank when the ignition occurred. They were likely burned from the initial fireball and burning methanol vapors discharging from the tank vent under pressure from the explosion. The lead mechanic, fully engulfed in fire, likely jumped or fell from the man-lift. Emergency responders found his body within the concrete containment next to the tank.

The third worker stated that he had been partially out of the man-lift basket leaning over the roof when the fire ignited. On fire, he climbed onto the roof to escape. Co-workers, unable to reach him with a ladder, told him to jump to an adjacent lower roof and then to the ground. He sustained second and third degree burns over most of his body, and was hospitalized for 4 months before being released to a medical rehabilitation facility. Methanol sprayed from separated pipes onto the crane, burning the crane cab with the mechanic inside. On fire, he exited the cab and was assisted by co-workers. He died in the hospital the following day.

KEY ISSUES:
• HAZARD COMMUNICATION
• HOT WORK CONTROL
• PLASTIC PIPE IN FLAMMABLE SERVICE
• FLAME ARRESTER MAINTENANCE
• FLORIDA PUBLIC EMPLOYEE SAFETY PROGRAMS

ROOT CAUSES:
1. The City of Daytona Beach did not implement adequate controls for hot work at the Bethune Point WWTP.
2. The City of Daytona Beach had a hazard communication program that did not effectively communicate the hazards associated with methanol at the Bethune Point WWTP.

Image credit: CSB

An explosion occurred at one of Petrobras’ refineries. The blast occurred at a hydrogen conduit in an enclosed space, causing a flare and a displacement of air that threw the contract workers against the refinery’s metal structure.

Proximate causes:
• Inadequate maintenance
• Failure following procedures
• Lack of work rules/policies/ standards/procedures
• Physical condition (the accident may have been the result of maintenance work being carried out under tight deadlines and long shifts imposed on refinery workers)
• Mental stress
• Mental state

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Daily Motion

Three combustible dust incidents over a six month period occurred at the Hoeganaes facility in Gallatin, TN, resulting in fatal injuries to five workers. The facility produces powdered iron and is located about twenty miles outside of Nashville.

KEY ISSUES:
• HAZARD RECOGNITION AND TRAINING
• ENGINEERING CONTROLS
• FIRE CODES/ENFORCEMENT
• REGULATORY OVERSIGHT

ROOT CAUSES:
1. Hoeganaes facility management were aware of the iron powder combustibility hazard two years prior to the fatal flash fire incidents but did not take necessary action to mitigate the hazard through engineering controls and housekeeping.
2. Hoeganaes did not institute procedures – such as combustible gas monitoring – or training for employees to avoid flammable gas fires and explosions

Image credit: CSB

On February 2, 2001, a fire occurred at Bethlehem Steel Corporation’s Burns Harbor mill in Chesterton, Indiana. One Bethlehem Steel millwright and one contractor supervisor died. Four Bethlehem Steel millwrights were injured, one seriously. Workers were attempting to remove a slip blind and a cracked valve from a coke oven gas line leading to a decommissioned furnace. During removal of the valve, flammable liquid was released and ignited.

KEY ISSUES:
• MAINTENANCE JOB PLANNING
• FACILITY WINTERIZATION & DEADLEGS
• LINE & EQUIPMENT OPENING
• DECOMMISSIONING & DEMOLITION

ROOT CAUSES:
1. Management systems for the supervision, planning, and execution of maintenance work were inadequate.
2. The Burns Harbor facility did not have a system for monitoring and controlling hazards that could be caused by changes in COG condensate flammability or accumulation rates.

Image Credit: CSB

Six workers were fatally injured during a planned work activity to clean debris from natural gas pipes at Kleen Energy in Middletown, CT. To remove the debris, workers used natural gas at a high pressure of approximately 650 pounds per square inch. The high velocity of the natural gas flow was intended to remove any debris in the new piping. During this process, the natural gas found an ignition source and exploded.

KEY ISSUES:
• SIMILAR NATURAL GAS BLOW INCIDENTS
• INDUSTRY PRACTICES AND SAFER ALTERNATIVE METHODOLOGIES
• HAZARDS OF RELEASING NATURAL GAS NEAR WORK AREAS
• CODES AND STANDARDS

ROOT CAUSES:
1. Natural gas blows are common
2. Workers remained in building during gas blow

Image credit: CSB

On Wednesday, February 8, 2017, at approximately 11:05 am, a foul condensate tank, part of a non-condensable gas system, exploded at the Packaging Corporation of America (PCA) containerboard mill in DeRidder, Louisiana. The explosion killed three people and injured seven others. All 10 people were working at the mill as contractors. The explosion also heavily damaged the surrounding process. The foul condensate tank travelled approximately 375 feet and over a six-story building before landing on process equipment.

At the time of the incident, the mill was undergoing its annual planned maintenance outage, also referred to as a shutdown. The foul condensate tank likely contained water, a layer of flammable liquid turpentine on top of the water, and an explosive vapor space containing air and flammable turpentine vapor.

KEY ISSUES:
• PROCESS SAFETY MANAGEMENT SYSTEM
• INHERENTLY SAFER DESIGN
• PROCESS HAZARD ANALYSIS
• INEFFECTIVE SAFEGUARDS
• HOT WORK SAFETY MANAGEMENT

ROOT CAUSES:
1. PCA did not evaluate the majority of the non-condensable gas system, including the foul condensate tank, for certain hazards. The DeRidder mill never conducted a process hazard analysis to identify, evaluate, and control process hazards for the non-condensable gas system.
2. PCA did not expand the boundaries of its process safety management program beyond the units covered by safety regulations.
3. PCA did not effectively apply the hierarchy of controls to the selection and implementation of safeguards that the company used to prevent a potential non-condensable gas explosion.
4. PCA did not evaluate inherently safer design options that could have eliminated the possibility of air entering the non-condensable gas system, including the foul condensate tank.
5. PCA did not establish which mill operations group held ownership of, and responsibility for, the foul condensate tank.
6. PCA did not apply important aspects of industry safety guidance and standards.

Image credit: CSB

On February 12, 2014, a mechanical integrity failure released sulfuric acid in the alkylation unit, which burned two Tesoro Martinez refinery employees. Approximately 84,000 pounds of sulfuric acid were released during the incident.

On March 10, 2014, sulfuric acid sprayed and burned two contract workers while they removed piping in the same alkylation unit. The CSB found that this second incident shared similar causation with a 1999 incident at the same refinery, then called the Avon refinery, owned by the Tosco Corporation, that resulted in four fatalities. Similarities between the two incidents suggest that the Tesoro Martinez refinery did not effectively continue to implement or communicate important safety lessons from the 1999 Tosco incident.

KEY ISSUES:
• PROCESS SAFETY CULTURE
• PROCESS SAFETY INDICATORS

ROOT CAUSES:
1. The safety culture at the Tesoro Martinez refinery created conditions conducive to the occurrence and recurrence of process safety incidents that caused worker injuries at the refinery over several years.
2. Prior sulfuric acid exposure incidents at the Tesoro Martinez refinery could have properly been considered leading indicators of an impending serious chemical accident and then triggered preventive inspections and review of the refinery’s safety systems and equipment.

Image & AcciMap Credit: CSB

Image credit: CSB

On Wednesday, February 18, 2015, an explosion occurred in the ExxonMobil Torrance, California refinery’s Electrostatic Precipitator (ESP), a pollution control device in the fluid catalytic cracking (FCC) unit that removes catalyst particles using charged plates that produce sparks (potential ignition sources) during normal operation. The incident occurred when ExxonMobil was attempting to isolate equipment for maintenance while the unit was in an idled mode of operation; preparations for the maintenance activity caused a pressure deviation that allowed hydrocarbons to backflow through the process and ignite in the ESP.

The CSB found that this incident occurred due to weaknesses in the ExxonMobil Torrance refinery’s process safety management system. These weaknesses led to operation of the FCC unit without pre-established safe operating limits and criteria for unit shutdown, reliance on safeguards that could not be verified, the degradation of a safety-critical safeguard, and the re-use of a previous procedure deviation without a sufficient hazard analysis that confirmed that the assumed process conditions were still valid. .

KEY ISSUES:
• LACK OF SAFE OPERATING LIMITS & OPERATING PROCEDURE
• SAFEGUARD EFFECTIVENESS
• OPERATING EQUIPMENT BEYOND SAFE OPERATING LIFE
• RE-USE OF PREVIOUS PROCEDURE VARIANCE WITHOUT SUFFICIENT HAZARD ANALYSIS

ROOT CAUSES:
1. ExxonMobil did not establish the safe operating limits for operating the FCC unit in Safe Park (a standby mode of operation) or determine process conditions that required unit shutdown.
2. ExxonMobil did not perform a sufficient hazard analysis to determine if the unit conditions specified in the 2012 procedure were valid for the 2015 operation.
3. ExxonMobil operated FCC unit equipment beyond its predicted safe operating life.
4. ExxonMobil lacked safety instrumentation to detect flammable hydrocarbons flowing through the equipment and into the ESP.
5. ExxonMobil refinery management permitted opening process equipment without conforming to refinery standards.

Image credit: CSB

On February 23, 1999, a fire occurred in the crude unit at Tosco Corporation. Avon oil refinery in Martinez, California. Workers were attempting to replace piping attached to a 150-foot-tall fractionator tower while the process unit was in operation. During removal of the piping, naphtha was released onto the hot fractionator and ignited. The flames engulfed five workers located at different heights on the tower. Four men were killed, and one sustained serious injuries.

KEY ISSUES:
• CONTROL OF HAZARDOUS NONROUTINE MAINTENANCE
• MANAGEMENT OVERSIGHT & ACCOUNTABILITY
• MANAGEMENT OF CHANGE
• CORROSION CONTROL

ROOT CAUSES:
1. Tosco Avon refinery’s maintenance management system did not recognize or control serious hazards posed by performing nonroutine repair work while the crude processing unit remained in operation.
2. Tosco’s safety management oversight system did not detect or correct serious deficiencies in the execution of maintenance and review of process changes at its Avon refinery.

Image Credit: CSB

On March 13, 2001, three people were killed as they opened a process vessel containing hot plastic at the BP Amoco Polymers plant in Augusta, Georgia. They were unaware that the vessel was pressurized. The workers were killed when the partially unbolted cover blew off the vessel, expelling hot plastic. The force of the release caused some nearby tubing to break. Hot fluid from the tubing ignited, resulting in a fire.

KEY ISSUES:
• RECOGNITION OF REACTIVE HAZARDS
• LEARNING FROM NEAR-MISS INCIDENTS
• OPENING OF PROCESS EQUIPMENT

ROOT CAUSES:
1. Amoco, the developer of the Amodel process, did not adequately review the conceptual process design to identify chemical reaction hazards.
2. The Augusta facility did not have an adequate review process for correcting design deficiencies.
3. The Augusta site system for investigating incidents and nearmiss incidents did not adequately identify causes or related hazards. This information was needed to correct the design and operating deficiencies that led to the recurrence of incidents.

Image Credit: CSB

A fire started inside a depot with 3 million liters of diesel and the flames spread to four neighboring storage tanks. The fire lasted for 9 days.

Fine of around USD $6.4 million (R$ 22.5 million). Environmental impact causing death of thousands of fish

Proximate causes:
• Inadequate management/ supervision
• Inadequate work planning

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Paulo Whitaker / Reuters

On April 8, 2004, four workers were seriously injured when highly flammable gasoline components were released and ignited at the Giant Industries Ciniza refinery, east of Gallup, New Mexico. The release occurred as maintenance workers were removing a malfunctioning pump from the refinery’s hydrofluoric acid (HF) alkylation unit. Unknown to personnel, a shut-off valve connecting the pump to a distillation column was apparently in the open position, leading to the release and subsequent explosions.

KEY ISSUES:
• MECHANICAL INTEGRITY
• CORROSION & SCALE FORMATION
• VALVE DESIGN
• HUMAN FACTORS CONSIDERATION
• MANAGEMENT OF CHANGE
• LOCKOUT/TAGOUT & ISOLATION

ROOT CAUSES:
1. An MOC hazard analysis was not conducted.
2. the facility lacked procedures to verify that the pump had been isolated, depressurized and drained.
3. Instead of determining the cause of frequent pump malfunctions and then implementing a program that would prevent problems before they occurred, Giant used breakdown maintenance by making repeated repairs to the pump seals after failure.

Image Credit: CSB

On April 26, 2018, an explosion and subsequent fire occurred at the Superior Refinery Company LLC refinery in Superior, Wisconsin (‘Husky Superior Refinery’). The incident occurred in the refinery’s Fluid Catalytic Cracking Unit (FCCU). In preparation for the shutdown, the refinery brought in hundreds of contractors and increased operations staffing. The contractors were performing many tasks such as electrical work, preparing for chemical cleaning, building scaffolding, and welding. As a result of the explosion, thirty-six people sought medical attention, including eleven refinery and contract workers who suffered OSHA recordable injuries. In addition, a large portion of Superior, Wisconsin was evacuated. The refinery was shutting down in preparation for a five-week turnaround when an explosion occurred, sending several people to area hospitals with injuries.

KEY ISSUES:
• PYROPHORIC IRON SULFIDE

Image credit: CSB