Contributory Factors: PLANT/EQUIPMENT

On December 7, 2009, at approximately 2:30 pm, State Special Vessel No. 2, under an operating pressure of 29,000 psig, suddenly and violently ruptured, 120 days into a 150-day operating cycle. A white cloud of steam and debris rapidly expanded outward from the facility, traveled onto the interstate, and dissipated within seconds.

The sudden release of superheated liquid caused an eight-foot tall by four-foot wide vessel fragment, weighing approximately 8,600 pounds, to travel through two concrete walls and finally land about 435 feet from the NDK building. The fragment skipped across a neighboring facility parking lot and slammed into the wall of an adjacent business office. The force of the impact pushed the wall inward causing furniture to shift and ceiling tiles to fall. One person working near the wall was injured.

The thrust from the escaping liquid caused the base of the vessel to violently shear away from its foundation and blew pieces of structural steel out of the building into the parking lot of a nearby rest stop gas station, known as the Illinois Tollway (I-90) Oasis. One piece of structural steel struck and killed a truck driver at the rest stop. After shearing from its base and throwing shrapnel out of the facility, the vessel swung from the building and landed on the ground outside.

KEY ISSUES:
• PRESSURE VESSEL DESIGN & MATERIAL SELECTION REQUIREMENTS
• LEARNING FROM PREVIOUS INCIDENTS
• INSPECTIONS

ROOT CAUSES:
1. Stress corrosion cracking.
2. Testing & inspection deficiencies.

Image credit: CSB

An explosion ripped through the New Cumberland A.L. Solutions titanium plant in West Virginia on December 9, 2010, fatally injuring three workers. The workers were processing titanium powder, which is highly flammable, at the time of the explosion.

KEY ISSUES:
• FEDERAL COMBUSTIBLE DUST OVERSIGHT
• HAZARD RECOGNITION & TRAINING
• LEARNING FROM PREVIOUS INCIDENTS

ROOT CAUSES:
1. AL Solutions did not mitigate the hazards of metal dust explosions through engineering controls, such as a dust collection system. Specifically, AL Solutions did not adhere to the practices recommended in NFPA 484 for controlling combustible metal dust hazards.

Image credit: CSB

In the early hours of Sunday 11th December 2005, a number of explosions occurred at Buncefield Oil Storage Depot, Hemel Hempstead, Hertfordshire. At least one of the initial explosions was of massive proportions and there was a large fire, which engulfed a high proportion of the site.

Over 40 people were injured; fortunately there were no fatalities. Significant damage occurred to both commercial and residential properties in the vicinity and a large area around the site was evacuated on emergency service advice. The fire burned for several days, destroying most of the site and emitting large clouds of black smoke into the atmosphere.

KEY ISSUES:
• SYSTEMATIC ASSESSMENT OF SAFETY INTEGRITY LEVEL REQUIREMENTS
• PROTECTING AGAINST LOSS OF PRIMARY CONTAINMENT
• ENGINEERING AGAINST ESCALATION OF LOSS OF PRIMARY CONTAINMENT
• ENGINEERING AGAINST THE LOSS OF SECONDARY AND TERTIARY CONTAINMENT
• OPERATING WITH HIGH RELIABILITY ORGANISATIONS
• DELIVERING HIGH PERFORMANCE THROUGH CULTURE AND LEADERSHIP

HSE Reports:
MIIB Final Report Vol 1: https://www.icheme.org/media/13707/buncefield-miib-final-report-volume-1.pdf
MIIB Final Report Vol 2a: https://www.icheme.org/media/13923/buncefield-miib-final-report-volume-2a.pdf
MIIB Final Report Vol 3a: https://www.icheme.org/media/13923/buncefield-miib-final-report-volume-2a.pdf
Land Use Planning – Recommendations: https://www.icheme.org/media/10694/recommendations-on-land-use-planning.pdf
Land Use Planning – Model: https://www.icheme.org/media/13709/illustrative-model-of-a-risk-based-lup-system_repaired.pdf
Explosion Mechanism: https://www.icheme.org/media/10696/buncefield-explosion-mechanism-advisory-group-report.pdf
BSTG Final Report: https://www.icheme.org/media/10697/safety-and-environmental-standards-for-fuel-storage-sites.pdf
Emergency Preparedness: https://www.icheme.org/media/10698/recommendations-on-emergency-preparedness.pdf
Design & Operation: https://www.icheme.org/media/10699/recommendations-on-the-design-and-operation-of-fuel-storage-sites.pdf
Initial Report: https://www.icheme.org/media/10700/buncefield-initial-report.pdf
Investigation – Progress Report: https://www.icheme.org/media/10705/buncefield-first-progress-report.pdf
Investigation – 2nd Progress Report: https://www.icheme.org/media/10703/buncefield-second-progress-report.pdf
Investigation – 3rd Progress Report: https://www.icheme.org/media/10702/buncefield-third-progress-report.pdf
Why did it happen?: https://www.icheme.org/media/10706/buncefield-report.pdf

Image Credit: Hertfordshire County Council

At 1:33 pm on December 19, 2007, a powerful explosion and subsequent chemical fire killed four employees and destroyed T2 Laboratories, Inc. (T2), a chemical manufacturer in Jacksonville, Florida. It injured 32, including four employees and 28 members of the public who were working in surrounding businesses. Debris from the reactor was found up to one mile away, and the explosion damaged buildings within one quarter mile of the facility.

On December 19, T2 was producing its 175th batch of methylcyclopentadienyl manganese tricarbonyl (MCMT). At 1:23 pm, the process operator had an outside operator call the owners to report a cooling problem and request they return to the site. Upon their return, one of the two owners went to the control room to assist. A few minutes later, at 1:33 pm, the reactor burst and its contents exploded, killing the owner and process operator who were in the control room and two outside operators who were exiting the reactor area.

KEY ISSUES:
• REACTIVE HAZARD RECOGNITION
• HAZARD EDUCATION
• EMERGENCY PREPAREDNESS
• PROCESS DESIGN & SCALE-UP

ROOT CAUSES:
• T2 did not recognize the runaway reaction hazard associated with the MCMT it was producing.

Image credit: CSB

On January 9, 2014, West Virginia Department of Environmental Protection (WVDEP) inspectors arrived at the Freedom Industries (Freedom) chemical storage and distribution facility in Charleston, West Virginia, in response to complaints from the public about a chemical odor. Upon arrival, WVDEP inspectors discovered a chemical leaking from tank 396, an aboveground storage tank (AST). The leaking tank contents were originally reported as crude methylcychohexanemethanol (MCHM), but 13 days later Freedom reported it was a mixture of Crude MCHM and polyglycol ethers (PPH, stripped) called Shurflot 944.5 The chemical mixture escaped tank 396 through two small holes on the tank floor and traveled down a descending bank into the adjacent Elk River. The holes were caused by pitting corrosion that initiated on the internal surface of the tank floor. The tank contents drained into the gravel and soil surrounding tank 396 and found multiple pathways into the river. The secondary containment or dike wall, originally designed to control leaks, had cracks and holes from disrepair that allowed the mixture, containing Crude MCHM and PPH, stripped, to escape the containment. The leak also found a pathway to the river through a subsurface culvert, located under adjacent ASTs.

After prompting by WVDEP, Freedom took action to stop the leak and prevent further contamination by deploying services to recover the spill and vacuum the remaining tank contents. However, nearly 11,000 gallons of a mixture containing Crude MCHM and PPH, stripped had already entered into the surrounding soil and Elk River. Once in the river, it flowed downstream to the intake of the West Virginia American Water (WVAW) water treatment facility, about 1.5 miles downriver from Freedom. WVAW’s water treatment and filtration methods were unable to treat and remove all of the chemical mixture in its water treatment process and as a result, it contaminated the drinking water within WVAW’s distribution system. That evening, WVAW issued a Do Not Use (DNU) order for 93,000 customer accounts (approximately 300,000 residents) across portions of nine counties.

KEY ISSUES:
• TANK INSPECTIONS & MAINTENANCE
• RISK COMMUNICATION
• PUBLIC WATER SYSTEMS SAFETY & RISK ASSESSMENT
• TOXICOLOGICAL INFORMATION

ROOT CAUSES:
1. Corrosion of primary containment
2. Deteriorated secondary containment

Image credit: CSB

On the evening of January 12, 2009, 2 refinery operators and 2 contractors suffered serious burns resulting from a flash fire at the Silver Eagle Refinery in Woods Cross, Utah. The accident occurred when a large flammable vapor cloud was released from an atmospheric storage tank, known as tank 105, which contained an estimated 440,000 gallons of light naphtha. The vapor cloud found an ignition source and the ensuing flash fire spread up to 230 feet west of the tank farm.

On November 4, 2009, a second accident occurred at the Silver Eagle Refinery in Woods Cross, Utah, when a powerful blast wave – caused by the failure of a 10 inch pipe – damaged nearby homes.

KEY ISSUES:
• MECHANICAL INTEGRITY

ROOT CAUSES:
1. Sulfidation corrosion

Image credit: CSB

An explosion occurred at one of Petrobras’ refineries. The blast occurred at a hydrogen conduit in an enclosed space, causing a flare and a displacement of air that threw the contract workers against the refinery’s metal structure.

Proximate causes:
• Inadequate maintenance
• Failure following procedures
• Lack of work rules/policies/ standards/procedures
• Physical condition (the accident may have been the result of maintenance work being carried out under tight deadlines and long shifts imposed on refinery workers)
• Mental stress
• Mental state

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Daily Motion

The incident occurred when workers were weighing a barrel of 4-hydroxybenzohydrazide. There was a short circuiting in the weighing scale which led to an explosion.

Proximate causes:
• Defective equipment

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Survival Technologies

On January 22, 2018, a blowout and rig fire occurred at Pryor Trust 0718 gas well number 1H-9, located in Pittsburg County, Oklahoma. The fire killed five workers, who were inside the driller’s cabin on the rig floor. They died from thermal burn injuries and smoke and soot inhalation. The blowout occurred about three-and-a-half hours after removing drill pipe (‘tripping’) out of the well.

The cause of the blowout and rig fire was the failure of both the primary barrier (hydrostatic pressure produced by drilling mud) and the secondary barrier (human detection of influx and activation of the blowout preventer) which were intended to be in place to prevent a blowout.

KEY ISSUES:
• POOR BARRIER MANAGEMENT
• UNDERBALANCED OPERATIONS PERFORMED WITHOUT PROPER PLANNING, PROCEDURES, OR NEEDED EQUIPMENT
• SIGNS OF INFLUX EITHER NOT IDENTIFIED OR INADEQUATELY RESPONDED TO
• ALARM SYSTEM OFF
• FLOW CHECKS NOT CONDUCTED
• GAPS IN SAFETY MANAGEMENT SYSTEM
• DRILLER’S CABIN DESIGN
• BOP COULD NOT CLOSE DUE TO BURNED HYDRAULIC HOSES
• LACK OF SAFETY REQUIREMENTS BY REGULATION

ROOT CAUSES:
1. Failure of primary barrier – hydrostatic pressure produced by drilling mud.
2. Failure of secondary barrier – human detection of influx and activation of the blowout preventer.

Image & AcciMap Credit: CSB

Image credit: CSB

On January 22 and 23, 2010, three separate incidents at the DuPont plant in Belle, WV, involving releases of methyl chloride, oleum, and phosgene, triggered notification of outside emergency response agencies. The incident involving the release of phosgene gas led to the fatal exposure of a worker performing routine duties in an area where phosgene cylinders were stored and used.

Operators discovered the first incident, the release of methyl chloride, the morning of January 22, 2010, when an alarm sounded on the plant’s distributed control system monitor. They confirmed that a release had occurred and that methyl chloride was venting to the atmosphere. Managers assessing the release estimated that more than 2,000 pounds of methyl chloride may have been released over the preceding 5 days.

The oleum release, the second incident, occurred the morning of January 23, 2010. Workers discovered a leak in an overhead oleum sample pipe that was allowing a fuming cloud of oleum to escape to the atmosphere. The plant fire brigade, after donning the appropriate personal protective equipment, closed a valve that stopped the leak about an hour after it was discovered. No injuries occurred, but the plant called the Belle Volunteer Fire Department to assist.

The third incident, a phosgene release, occurred later that same day when a hose used to transfer phosgene from a 1-ton cylinder to a process catastrophically failed and sprayed a worker in the face while he was checking the weight of the cylinder. The employee, who was alone when exposed, was assisted by co-workers who immediately responded to his call for help. Initial assessments by the plant’s occupational health nurse indicated that the worker showed no symptoms of exposure prior to transport to the hospital for observation and treatment. A delayed onset of symptoms, consistent with information in phosgene exposure literature, occurred after he arrived at the hospital. His condition deteriorated over the next day and he died from his exposure the next night.

KEY ISSUES:
• MECHANICAL INTEGRITY
• ALARM MANAGEMENT
• OPERATING PROCEDURES
• COMPANY EMERGENCY RESPONSE & NOTIFICATION

ROOT CAUSES:

Methyl Chloride Incident (January 22, 2010)
1. DuPont management, following their Management of Change process, approved a design for the rupture disc alarm system that lacked sufficient reliability to advise operators of a flammable methyl chloride release.

Oleum Release Incident (January 23, 2010)
1. Corrosion under the insulation caused a small leak in the oleum pipe.

Phosgene Incident (January 23, 2010)
1. DuPont’s phosgene hazard awareness program was deficient in ensuring that operating personnel were aware of the hazards associated with trapped liquid phosgene in transfer hoses.
2. DuPont relied on a maintenance software program that was subject to changes without authorization or review, did not automatically initiate a change-out of phosgene hoses at the prescribed interval, and did not provide a back-up process to ensure timely change-out of hoses.
3. DuPont Belle’s near-miss reporting process was not rigorous enough to ensure that the near failure of a similar phosgene transfer hose, just hours prior to the exposure incident, would be immediately brought to the attention of plant supervisors and managers.
4. DuPont lacked a dedicated radio/telephone system and emergency notification process to convey the nature of an emergency at the Belle plant, thereby restricting the ability of personnel to provide timely and quality information to emergency responders.

Image credit: CSB

During the early morning hours of January 25, ASCO employees filled cylinders with purchased acetylene. At approximately 9:30 am, with the depletion of the supply of purchased acetylene, they began to produce acetylene from calcium carbide in the generator.

Because of heavy snowfall, workers were shoveling snow in the area south of the decant tanks near the loading dock. At 10:36 am, an explosion occurred, centered in the shed. Two of the workers immediately south of the shed were killed instantly. A third worker farther south, closer to the loading dock, was severely injured and was pronounced dead shortly after arriving at the Newark Medical Center. A fourth worker who was in the loading dock/lime pit area was very seriously injured by the blast. .

KEY ISSUES:
• OPERATING PROCEDURES
• STAFF TRAINING
• DRAIN & VENT TO SAFE LOCATION
• BUILDINGS TO BE DESIGNED FOR ACETYLENE CONTAINMENT
• MECHANICAL INTEGRITY
• POSITIVE ISOLATION

ROOT CAUSES:
1. At ASCO, a line that could potentially contain acetylene drained into an enclosed wooden shed.
2. The shed in this incident was not designed or constructed in accordance with NFPA 51A.
3. At ASCO the check valve was relied upon to prevent backflow. The check valve and block valve that failed at ASCO and allowed backflow were not on a testing or inspection schedule. The single block valve on the recycle water line, which was found closed after the explosion, leaked during post-incident testing.
4. Operators did not use either written operating procedures or check lists for start up of the acetylene generator or recycled water system at this facility.

Image Credit: CSB

At 2:09 p.m. on Friday, February 16, 2007, liquid propane under high pressure was released in the Propane De-Asphalting (PDA) unit of Valero’s McKee Refinery, 50 miles north of Amarillo in the Texas panhandle, near the town of Sunray. The resulting propane vapor cloud found an ignition source, and the subsequent fire injured workers, damaged unit piping and equipment, and collapsed a major piperack. The fire grew rapidly and threatened surrounding units, including a Liquefied Petroleum Gas (LPG) storage area. Fire-fighting efforts were hampered by high and shifting winds and the rapid spread of the fire. A refinery-wide evacuation was ordered approximately 15 minutes after the fire ignited.

Three of the four workers injured were seriously burned, including a contractor. The refinery was completely shut down for just under two months and operated at reduced capacity for nearly a year.

KEY ISSUES:
• FREEZE PROTECTION OF DEAD-LEGS
• EMERGENCY ISOLATION OF EQUIPMENT
• FIREPROOFING OF SUPPORT STEEL
• FIRE PROTECTION FOR HIGH PRESSURE LPG SERVICE
• CHLORINE RELEASE

ROOT CAUSES:
1. The McKee Refinery had no formal written program in place to identify, review, and freeze-protect dead-legs or infrequently used piping and equipment, such as the propane mix control station.
2. The McKee Refinery did not apply Valero’s mandatory Emergency Isolation Valve procedure when evaluating risks in the PDA unit to ensure that the large quantities of flammable materials in the unit could be rapidly isolated in an emergency.
3. API guidance and Valero’s corporate Fire Proofing Specifications standard do not specify sufficiently protective distances for fireproofing pipe rack support steel for processes handling high-pressure flammables, such as the LPG in the PDA unit.

Image credit: CSB

On February 19, 1999, a process vessel containing several hundred pounds of hydroxylamine exploded at the Concept Sciences Inc. production facility near Allentown, Pennsylvania. Employees were distilling an aqueous solution of hydroxylamine and potassium sulfate, the first commercial batch to be processed at the facility. After the distillation process was shut down, the HA in the process tank and associated piping explosively decomposed, most likely due to high concentration and temperature. Four CSI employees and a manager of an adjacent business were killed. Two CSI employees survived the blast with moderate-to-serious injuries. Four people in nearby buildings were injured. The explosion also caused significant damage to other buildings in the Lehigh Valley Industrial Park and shattered windows in several nearby homes.

KEY ISSUES:
• HAZARDS OF PROCESSING HYDROXYLAMINE
• PROCESS HAZARDS EVALUATION
• CHEMICAL FACILITY SITING

ROOT CAUSES:
1. CSI’s process safety management systems were insufficient to properly address the hazards inherent in its HA manufacturing process and to determine whether these hazards presented substantial risks.
2. Inadequate collection and analysis of process safety information contributed to CSI’s failure to recognize specific explosion hazards.
3. Basic process safety and chemical engineering practices – such as process design reviews, hazard analyses, corrective actions, and reviews by appropriate technical experts – were not adequately implemented.
4. The existing system of siting approval by local authorities allowed a highly hazardous facility to be inappropriately located in a light industrial park.

Image Credit: CSB

At approximately 6:15 p.m. on March 4, 1998, a catastrophic vessel failure and fire occurred near Pitkin, Louisiana, at the Temple 22-1 Common Point Separation Facility owned by Sonat Exploration Co. Four workers who were near the vessel were killed, and the facility sustained significant damage.

The facility housed two petroleum separation trains and consisted of separation equipment, piping, storage vessels, and a gas distribution system. The separation trains were designed to produce crude oil and natural gas from well fluid, derived from two nearby wells. The vessel ruptured due to overpressurization, releasing flammable material which then ignited.

KEY ISSUES:
• DESIGN & HAZARD REVIEWS
• PRESSURE-RELIEF DEVICES
• OPERATING PROCEDURES

ROOT CAUSES:
1. Sonat management did not use a formal engineering design review process or require effective hazard analyses in the course of designing and building the facility.
2. Sonat engineering specifications did not ensure that equipment that could potentially be exposed to high-pressure hazards was adequately protected by pressure-relief devices.

Image Credit: CSB

Four reactors exploded after an initial fire in a warehouse in the plant. The toxic gas released due to the fire and explosion affected the local community. Electrical short circuit and improper shutdown was the reason that triggered the incident.

Proximate causes:
• Inadequate tools, equipment & vehicles (Electrical appliances shortcut)
• Failure in following procedure (improper shutdown)

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)

On Sunday, March 17, 2019, at approximately 10:00 am, a large fire erupted at the Intercontinental Terminals Company, LLC (ITC) bulk liquid storage terminal located in Deer Park, Texas (Figure 1). The fire originated in the vicinity of Tank 80-8, an 80,000-barrel aboveground atmospheric storage tank that held naphtha, a flammable liquid, typically used as a feedstock or blend stock for production of gasoline. ITC was unable to isolate or stop the release of naphtha product from the tank, and the fire continued to burn, intensify, and progressively involved additional tanks in the tank farm. The fire was extinguished on the morning of March 20, 2019.

The incident did not result in any injuries to either ITC personnel or emergency responders. However, the local community experienced disruptions, including several shelter-in-place notifications, which prompted local schools and businesses either to close or operate under modified conditions.

KEY ISSUES:
• RELEASE DETECTION
• RELEASE ISOLATION
• PROLONGED EMERGENCY RESPONSE

Image credit: CSB

On March 21, 2011, during calcium carbide production at the Carbide Industries plant in Louisville, KY, an electric arc furnace exploded, ejecting solid and powdered debris, flammable gases, and molten calcium carbide at temperatures near 3800°F (2100°C). Two workers died and two others were injured.

KEY ISSUES:
• FACILITY SITING
• NORMALIZATION OF DEVIANCE
• CONSENSUS STANDARDS

ROOT CAUSES:
1. Despite past incidents, neither the previous owners nor Carbide Industries identified that the control room should be relocated and cameras installed to better protect workers while they remotely monitored the furnace.
2. Carbide Industries issued 26 work orders for leak repair for water leaks on the furnace cover in the five months prior to the March 2011 incident, but continued operating the furnace despite the hazard from ongoing water leaks.
3. The company did not adequately address past explosive incidents, which normalized blows as routine events.
4. The company did not have a process safety management program in place that required the elimination of overpressure incidents in the furnace.

Image credit: CSB

On Tuesday, April 2, 2019, just before 10:46 am, a vapor cloud of isobutylene formed at the KMCO, LLC (‘KMCO’) facility in Crosby, Texas after a three-inch gray iron (a type of cast iron) y-strainer, a piping component, failed.

Shortly after 10:50 am, the vapor cloud found an ignition source and ignited, causing an explosion. The explosion killed one KMCO worker and seriously burned two others. On the day of the incident, more than 200 KMCO employees, contract workers, and visitors were onsite. The incident injured at least 30 workers (seven KMCO employees and 23 contract workers). A shelter-in-place was issued to community members within one mile of the KMCO facility.

KEY ISSUES:
• MECHANICAL INTEGRITY

Image credit: CSB

On April 2, 2010, the Tesoro Refining and Marketing Company LLC (‘Tesoro’) petroleum refinery in Anacortes, Washington (‘the Tesoro Anacortes Refinery’), experienced a catastrophic rupture of a heat exchanger in the Catalytic Reformer / Naphtha Hydrotreater unit (‘the NHT unit’). The heat exchanger, known as E-6600E (‘the E heat exchanger’), catastrophically ruptured because of High Temperature Hydrogen Attack (HTHA). Highly flammable hydrogen and naphtha at more than 500 degrees Fahrenheit (°F) were released from the ruptured heat exchanger and ignited, causing an explosion and an intense fire that burned for more than three hours. The rupture fatally injured seven Tesoro employees (one shift supervisor and six operators) who were working in the immediate vicinity of the heat exchanger at the time of the incident. To date this is the largest fatal incident at a US petroleum refinery since the BP Texas City accident in March 2005.

The NHT unit at the Tesoro Anacortes Refinery contained two parallel groups, or banks, of three heat exchangers (A/B/C and D/E/F) used to preheat process fluid before it entered a reactor, where impurities were treated for subsequent removal. The E heat exchanger was constructed of carbon steel.

At the time of the release, the Tesoro workers were in the final stages of a startup activity to put the A/B/C bank of heat exchangers back in service following cleaning. The D/E/F heat exchangers remained in service during this operation. Because of the refinery’s long history of frequent leaks and occasional fires during this startup activity, the CSB considers this work to be hazardous and nonroutine. While the operations staff was performing the startup operations, the E heat exchanger in the middle of the operating D/E/F bank catastrophically ruptured. .

KEY ISSUES:
• INHERENTLY SAFER DESIGN
• TESORO PROCESS SAFETY CULTURE
• CONTROL OF NONROUTINE WORK
• MECHANICAL INTEGRITY INDUSTRY STANDARD DEFICIENCIES
• REGULATORY OVERSIGHT OF PETROLEUM REFINERIES

ROOT CAUSES:
1. High Temperature Hydrogen Attack
2. NHT Heat Exchanger Flanges – A History of Leaking
3. Hazardous Nonroutine Work
4. Process Hazard Analyses Failed to Prevent or Reduce the Consequences

Image credit: CSB

At approximately 7:20 a.m. on April 3, 2017, the bottom of a steam condensate (hot water) storage tank catastrophically failed at the Loy-Lange Box Company (LLBC), located at 222 Russell Boulevard in St. Louis, Missouri. The 1952-pound, 30-inch diameter by 17-½-feet long steel tank, called a Semi-Closed Receiver (SCR)4 contained about 510 gallons condensed steam (water at about 330 °F and 100 psig.) Condensate from the vertically-mounted SCR was normally sent to two associated steam generators.

As the pressure in the tank suddenly dropped due to the failure of the tank bottom, a portion of the water in the SCR instantaneously exploded into steam, resulting in an increase in volume of about 75 times the volume of the SCR. A steam explosion of this type is extremely hazardous. The energy released was equivalent to about 350 pounds of TNT. Some of that energy dissipated when the escaping steam condensed to water, but the surveillance video from a nearby custom work truck shop clearly shows the power of the explosion and the effect on the building, as does the damage evident after the event.

The force of the steam explosion exiting the bottom of the SCR destroyed a large portion of the LLBC facility, and launched the storage tank like a rocket through the roof. One LLBC employee was fatally injured, and a second was left in critical condition.

Even after pulling loose from all of the piping and floor attachments, and crashing up through the structure of the building and out through the roof, the 1952-pound SCR was still traveling at about 120 mph. It rose to about 425 feet above street level and traveled laterally across about 520 feet. It remained airborne for over 10 seconds. As it fell, the SCR crashed through the roof of Faultless Healthcare Linen’s property at 2030 S. Broadway, fatally injuring three individuals.

KEY ISSUES:
• CORROSION
• MECHANICAL INTEGRITY & INSPECTION

ROOT CAUSES:
1. Steam generator repairs.

Image credit: CSB

On April 8, 1998, an explosion and fire occurred during the production of Automate Yellow 96 Dye at the Morton International Inc. plant in Paterson, New Jersey. The explosion and fire were the consequence of a runaway reaction, which overpressurized a 2000-gallon chemical vessel and released flammable material that ignited. Nine employees were injured.

KEY ISSUES:
• INTERNAL HAZARD COMMUNICATION & PROCESS SAFETY INFORMATION
• REACTIVE HAZARD MANAGEMENT
• PROCESS SAFETY MANAGEMENT

ROOT CAUSES:
1. Neither the preliminary hazard assessment conducted by Morton in Paterson during the design phase in 1990 nor the process hazard analysis conducted in 1995 addressed the reactive hazards of the Yellow 96 process.
2. Process safety information provided to plant operations personnel and the process hazard analysis team did not warn them of the potential for a dangerous runaway chemical reaction.

Image Credit: CSB

Two employees accidently fell in an aerobic tank sewage treatment station. Two more employees fell into the aerobic tank in the subsequent rescue.

Proximate causes:
• Inadequate tools, equipment & vehicles (Aerobic tank no special ventilation equipment)

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)

A crack occurred in a pipeline (diameter 200 mm) conveying oil and gas, and the following fire damaged three pumps and some instrumentation

Proximate causes:
• Inadequate tools, equipment & vehicles (Equipment failure: sealing failure and pipe leak)

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)

An April 11, 2003, vessel explosion at the D.D. Williamson & Co., Inc. (DDW), plant in Louisville, Kentucky, killed one operator. The explosion damaged the western end of the facility and released 26,000 pounds of aqua ammonia (29.4 percent ammonia solution in water), forcing the evacuation of as many as 26 residents and requiring 1,500 people to shelter-in-place.

DDW used the vessel in the manufacture of food-grade caramel coloring. It functioned as a feed tank for a spray dryer that produced powdered colorants. The feed tank, which was heated with steam and pressurized with air, was operated manually. To ensure that the filling, heating, and material transfer processes stayed within operating limits, operators relied on their experience and on readouts from local temperature and pressure indicators.

The feed tank most likely failed as a result of overheating the caramel color liquid, which generated excessive pressure. .

KEY ISSUES:
• OVERPRESSURE PROTECTION
• HAZARD EVALUATION SYSTEMS
• LAYERS OF PROTECTION
• OPERATING PROCEDURES & TRAINING

ROOT CAUSES:
1. D.D. Williamson did not have effective programs in place to determine if equipment and processes met basic process and plant engineering requirements.
2. D.D. Williamson did not have adequate hazard analysis systems to identify feed tank hazards, nor did it effectively use contractors and consultants to evaluate and respond to associated risks.
3. D.D. Williamson did not have adequate operating procedures or adequate training programs to ensure that operators were aware of the risks of allowing the spray dryer feed tanks to overheat and knew how to respond appropriately.

Image Credit: CSB

On the night of April 12, 2004, during an attempt to make the first production batch of triallyl cyanurate (TAC) at MFG Chemical, Inc. (MFG) in Dalton, Georgia, a runaway chemical reaction released highly toxic and flammable allyl alcohol and toxic allyl chloride into the nearby community. The fire department ordered an evacuation of residents and businesses within a halfmile of the facility. The release forced more than 200 families from their homes. One MFG employee sustained minor chemical burns and 154 people received decontamination and treatment at the local hospital for chemical exposure, including 15 police and ambulance personnel assisting with the evacuation. Five residents required overnight hospitalization for breathing difficulties. The reactor continued venting toxic vapor for nearly eight hours and the evacuation order lasted more than nine hours.

KEY ISSUES:
• REACTIVE CHEMICALS PROCESS DESIGN
• PROCESS SCALE-UP
• EMERGENCY PLANNING & RESPONSE

ROOT CAUSES:
1. MFG did not understand or anticipate the reactive chemistry hazards. They did not make use of readily available literature on the hazards of reactive chemistry, or conduct a comprehensive literature search of the reactive chemistry specifically involved in manufacturing the product, which would have alerted them to the hazards involved in manufacturing TAC.
2. MFG did not perform a comprehensive process design and hazard review of the laboratory scale-up to full production before attempting the first production run.
3. MFG did not prepare and implement an adequate emergency response plan. They did not train or equip employees to conduct emergency mitigation actions.
4. MFG did not implement the EPA Risk Management Program or the OSHA Process Safety Management program prior to receiving the allyl alcohol. The regulations require comprehensive engineering analyses of the process, emergency planning, a pre-startup safety review, and coordination with the local community before receiving the covered chemical at the site and introducing the covered chemical into the process.

Image Credit: CSB

On April 17, 2013, a fire and explosion occurred at the West Fertilizer Company (WFC), a fertilizer blending, retail, and distribution facility in West, Texas. The violent detonation fatally injured 12 emergency responders and three members of the public. Local hospitals treated more than 260 injured victims, many of whom required hospital admission. The blast completely destroyed the WFC facility and caused widespread damage to more than 150 offsite buildings. The WFC explosion is one of the most destructive incidents ever investigated by the U.S. Chemical Safety and Hazard Investigation Board (CSB) as measured by the loss of life among emergency responders and civilians; the many injuries sustained by people both inside and outside the facility fenceline; and the extensive damage to residences, schools, and other structures. Following the explosion, WFC filed for bankruptcy.

The explosion happened at about 7:51 pm central daylight time (CDT), approximately 20 minutes after the first signs of a fire were reported to the local 911 emergency response dispatch center. Several local volunteer fire departments responded to the facility, which had a stockpile of between 40 and 60 tons (80,000 to 120,000 pounds) fertilizer grade ammonium nitrate (FGAN), not counting additional FGAN not yet offloaded from a railcar.

More than half of the structures damaged during the explosion were demolished to make way for reconstruction. The demolished buildings include an intermediate school (552 feet southwest of the facility), a high school (1,263 feet southeast), a two-story apartment complex with 22 units (450 feet west) where two members of the public were fatally injured, and a 145-bed nursing home (500 feet west) where many of the seriously injured civilians resided. A middle school (2,000 feet southwest) also sustained serious but reparable damage. Section 3 describes the incident and its consequences in detail.

KEY ISSUES:
• REGULATORY OVERSIGHT
• HAZARD AWARENESS
• EMERGENCY PLANNING & RESPONSE
• FERTILIZER GRADE AMMONIUM NITRATE STORAGE PRACTICES
• LAND USE PLANNING & ZONING

ROOT CAUSES:
1. The presence of combustible materials used for construction of the facility and the fertilizer grade ammonium nitrate (FGAN) storage bins, in addition to the West Fertilizer Company (WFC) practice of storing combustibles near the FGAN pile, contributed to the progression and intensity of the fire and likely resulted in the detonation.
2. The WFC facility did not have a fire detection system to alert emergency responders or an automatic sprinkler system to extinguish the fire at an earlier stage of the incident.
3. Regulatory, Insurance, Emergency Response, Emergency & Land Use Planning deficiencies.

Image credit: CSB

On April 20, 2010, a multiple-fatality incident occurred at the Macondo oil well approximately 50 miles off the coast of Louisiana in the Gulf of Mexico during temporary well-abandonment activities on the Deepwater Horizon (DWH) drilling rig. Control of the well was lost, resulting in a blowout—the uncontrolled release of oil and gas (hydrocarbons) from the well. On the rig, the hydrocarbons found an ignition source and ignited. The resulting explosions and fire led to the deaths of 11 individuals, serious physical injuries to 17 others, the evacuation of 115 individuals from the rig, the sinking of the Deepwater Horizon, and massive marine and coastal damage from a reported 4 million barrels of released hydrocarbons.

BP was the main operator/lease holder responsible for the well design, and Transocean was the drilling contractor that owned and operated the DWH. On the day of the incident, the crew was completing temporary abandonment of the well so that it could be left in a safe condition until a production facility could return later to extract oil and gas from it.

Abandonment activities would essentially plug the well. Earlier, a critical cement barrier intended to keep the hydrocarbons below the seafloor had not been effectively installed at the bottom of the well. BP and Transocean personnel misinterpreted a test to assess cement barrier integrity, leading them to erroneously believe that the hydrocarbon bearing zone at the bottom of the well had been sealed. When the crew removed drilling mud from the well in preparation to install an additional cement barrier, the open blowout preventer (BOP) was the only physical barrier that could have potentially prevented hydrocarbons from reaching the rig and surrounding environment. The ability of the BOP to act as this barrier was contingent primarily upon human detection of the kick and timely activation and closure of the BOP.

Removing drilling mud after the test allowed hydrocarbons to flow past the failed cement barrier toward the DWH. The hydrocarbons continued to flow from the reservoir for almost an hour without human detection or the activation of the automated controls to close the BOP. Eventually, oil and gas passed above the BOP and forcefully released onto the rig. In response, the well operations crew manually closed the BOP. Oil and gas that had already flowed past the BOP continued to gush onto the rig, igniting and exploding. The explosion likely activated an automatic emergency response system designed to shear drillpipe passing through the BOP and seal the well, but it was unsuccessful.

KEY ISSUES:
• BOP TECHNICAL FAILURE ANALYSIS
• BARRIER MANAGEMENT AT MACONDO
• SAFETY CRITICAL ELEMENTS
• HUMAN FACTORS
• ORGANIZATIONAL LEARNING
• SAFETY PERFORMANCE INDICATORS
• RISK MANAGEMENT PRACTICES
• CORPORATE GOVERNANCE
• SAFETY CULTURE

ROOT CAUSES:
1. Technical Factors
2. Human and Organizational Factors
3. Regulatory Factors

Image Credit: CSB