Impact: HUMAN (On Site Fatalities)

An explosion ripped through the New Cumberland A.L. Solutions titanium plant in West Virginia on December 9, 2010, fatally injuring three workers. The workers were processing titanium powder, which is highly flammable, at the time of the explosion.

KEY ISSUES:
• FEDERAL COMBUSTIBLE DUST OVERSIGHT
• HAZARD RECOGNITION & TRAINING
• LEARNING FROM PREVIOUS INCIDENTS

ROOT CAUSES:
1. AL Solutions did not mitigate the hazards of metal dust explosions through engineering controls, such as a dust collection system. Specifically, AL Solutions did not adhere to the practices recommended in NFPA 484 for controlling combustible metal dust hazards.

Image credit: CSB

An explosion occurred in the ammonium nitrate process area of this plant. As a result of the explosion, the seven-story main process building was completely destroyed and a 30-foot-diameter crater was created. Metal fragments from the explosion punctured one of the plant’s two 15,000-metric-ton refrigerated ammonia storage tanks. The punctured tank released an estimated 5,700 metric tons of ammonia, causing the evacuation of approximately 2,500 people from the surrounding area. Metal fragments also punctured a nitric acid tank, resulting in the release of approximately 100 metric tons of this acid. The explosion tore metal siding from adjacent buildings, damaged three third-party electric generating stations, broke windows of buildings 16 miles away in Sioux City, and was felt more than 30 miles away.

[ Property Damage $203 Million. Estimated Current Value $404 Million ]

Image credit: EPA
Ref: https://en.wikipedia.org/wiki/Port_Neal_fertilizer_plant_explosion

At 1:33 pm on December 19, 2007, a powerful explosion and subsequent chemical fire killed four employees and destroyed T2 Laboratories, Inc. (T2), a chemical manufacturer in Jacksonville, Florida. It injured 32, including four employees and 28 members of the public who were working in surrounding businesses. Debris from the reactor was found up to one mile away, and the explosion damaged buildings within one quarter mile of the facility.

On December 19, T2 was producing its 175th batch of methylcyclopentadienyl manganese tricarbonyl (MCMT). At 1:23 pm, the process operator had an outside operator call the owners to report a cooling problem and request they return to the site. Upon their return, one of the two owners went to the control room to assist. A few minutes later, at 1:33 pm, the reactor burst and its contents exploded, killing the owner and process operator who were in the control room and two outside operators who were exiting the reactor area.

KEY ISSUES:
• REACTIVE HAZARD RECOGNITION
• HAZARD EDUCATION
• EMERGENCY PREPAREDNESS
• PROCESS DESIGN & SCALE-UP

ROOT CAUSES:
• T2 did not recognize the runaway reaction hazard associated with the MCMT it was producing.

Image credit: CSB

An eight-inch-diameter pipeline operating at approximately 700-pounds-per-square-inch ruptured, releasing a mix of ethane and propane. The record low temperature of 10°F for the region is believed to have contributed to the rupture. After a few minutes, the resulting release was ignited, causing a vapor cloud explosion. The explosion shattered windows up to six miles away and could be felt as far as 15 miles away. Seventeen additional pipelines, in a pipe rack containing 70 lines, were ruptured by the explosion.

The resulting fire involved two large storage tanks holding 3.6 million gallons of diesel, 12 small tanks containing a total of 882,000 gallons of lube oil, and two separator units. The explosion resulted in the partial loss of electricity, steam, and fire water for the refinery, since two power lines, two steam lines and a 12-inch diameter fire water line were located in this pipe rack. Upon the initial explosion, the lines for the dock fire pumps were damaged. Therefore, the water for fire fighting had to be supplied with the remaining plant fire pumps and municipal fire trucks taking draught from alternate sources. Approximately 48,000 gallons of aqueous film-forming foam (AFFF) concentrate, 200 fire brigade members, and 13 pumper units were used during the fire fighting effort, which was successful in extinguishing the fire approximately 14 hours after the initial explosion. Because of this incident, the refinery was completely shut down for three days and operated at reduced capacity for an additional three weeks.

[ Property Damage $69 Million. Estimated Current Value $155 Million ]

Image credit: Sam Kittner

On 4th January 1966, an operation to drain off an aqueous layer from a propane storage sphere was attempted. Two valves were opened in series on the bottom of the sphere. When the operation was nearly complete, the upper valve was closed and then cracked open again. No flow came out of the cracked valve, so it was opened further. The blockage, assumed to be ice or hydrate, cleared and propane gushed out. The operator was unable to close the upper valve and by the time he attempted to close the lower valve this was also frozen open. The alarm was raised and traffic on the nearby motorway was stopped. The resulting vapour cloud is thought to have found its source of ignition from a car about 160 m away. The storage sphere was enveloped in a fierce fire and upon lifting of the relief valve a stream of escaping vapour was ignited.

The LPG tank farm where the sphere was located consisted of four 1200 m3 propane and four 2000 m3 butane spheres. The fire brigade arrived on site, but were not experienced in dealing in refinery fires, and it appears they did not attempt to cool the burning sphere. They concentrated their hoses on cooling the remaining spheres. About 90 minutes after the initial leakage, the sphere ruptured, killing the men nearby. A wave of liquid propane flowed over the compound wall and fragments of the ruptured sphere cut through the legs of the next sphere which toppled over. The relief valve on this tank began to emit liquid.

The fire killed 18 people and injured 81 others. Five of the storage spheres were destroyed.

KEY ISSUES:
• DESIGN CODES – PIPEWORK
• SECONDARY CONTAINMENT
• OPERATING PROCEDURES
• EMERGENCY RESPONSE / SPILL CONTROL
• DESIGN CODES – PLANT

Image Credit: Fonds Georges Vermard

One worker died after hazardous chemical vapors released from an over-pressurized reactor burned his respiratory system. The worker charged chemicals inside a reactor vessel and a reaction started before he could close it.

OSHA’s proposed penalties total $87,780

Proximate causes:
• Inadequate management/supervision

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Google Maps

On January 7, 1998, two explosions in rapid succession destroyed the Sierra Chemical Company Kean Canyon plant near Mustang, Nevada, killing four workers and injuring six others.

The Kean Canyon plant manufactured explosive boosters for the mining industry. When initiated by a blasting cap or detonation cord, boosters provide the added energy necessary to detonate less sensitive blasting agents or other high explosives. The boosters manufactured at the Kean Canyon plant consisted of a base mix and a second explosive mix, called Pentolite, both of which were poured into cardboard cylinders. The primary explosives used in the base mix were TNT (2,4,6-trinitrotoluene), PETN (pentaerythritol tetranitrate), and Comp-B, a mixture of TNT and RDX (hexahydro-1,3,5-trinitro-1,3,5-triazine). The Pentolite is a mix of TNT and PETN.

KEY ISSUES:
• PROCESS SAFETY MANAGEMENT
• WORKER TRAINING
• PROCESS HAZARD ANALYSIS
• LANGUAGE BARRIERS

ROOT CAUSES:
1. Process hazard analysis (PHA) conducted by the facility was inadequate.
2. Training programs for facility personnel were inadequate.
3. Written operating procedures were inadequate or not available to workers.
4. The facility was built with insufficient separation distances between different operations and the design and construction of buildings was inadequate.
5. There was no systematic safety inspection or auditing program.
6. The employee participation program was inadequate.

Image Credit: CSB

An 11-year-old, 121,000-deadweight-ton tanker had completed unloading its first parcel of Arabian heavy crude when a small fire was noticed on deck. About 10 minutes later, fire spread to both sides of the ship. Later, a massive explosion occurred. The initiating event of the disaster was likely the buckling of the ship’s structure at deck level. Explosions in the ballast tanks and the breaking of the ship’s back followed. These events were produced by the conjunction of two separate factors: a seriously weakened hull due to inadequate maintenance and an excessive stress due to incorrect ballasting at the time of the disaster. In addition to the total loss of the ship, 1,130 feet of the concrete and steel jetty were damaged or destroyed.

[ Property Damage $70 Million. Estimated Current Value $248 Million ]

Image credit: Irish Times

On Wednesday, January 11, 2006, three workers continued the roof removal. About 11:15 a.m., the lead mechanic and the third worker were cutting the metal roof directly above the methanol tank vent. Sparks, showering down from the cutting torch, ignited methanol vapors coming from the vent, creating a fireball on top of the tank. The fire flashed through a flame arrester on the vent, igniting methanol vapors and air inside the tank, causing a explosion inside the steel tank.

The explosion inside the methanol storage tank
• rounded the tank’s flat bottom, permanently deforming the tank and raising the side wall about onefoot;
• ripped the nuts from six bolts used to anchor the tank to a concrete foundation;
• blew the flame arrester off the tank vent pipe;
• blew a level sensor off a 4-inch flange on the tank top;
• separated two 1-inch pipes, valves, and an attached level switch from flanges on the side of the tank;
• separated a 4-inch tank outlet pipe from the tank outlet valve; and
• separated a 4-inch tank fill pipe near the top the tank.

Methanol discharged from the separated pipes ignited and burned, spreading the fire. Methanol also flowed into the containment around the tank and through a drain to the WWTP where it was diluted and harmlessly processed. The lead mechanic and the third worker were in the man-lift basket over the methanol tank when the ignition occurred. They were likely burned from the initial fireball and burning methanol vapors discharging from the tank vent under pressure from the explosion. The lead mechanic, fully engulfed in fire, likely jumped or fell from the man-lift. Emergency responders found his body within the concrete containment next to the tank.

The third worker stated that he had been partially out of the man-lift basket leaning over the roof when the fire ignited. On fire, he climbed onto the roof to escape. Co-workers, unable to reach him with a ladder, told him to jump to an adjacent lower roof and then to the ground. He sustained second and third degree burns over most of his body, and was hospitalized for 4 months before being released to a medical rehabilitation facility. Methanol sprayed from separated pipes onto the crane, burning the crane cab with the mechanic inside. On fire, he exited the cab and was assisted by co-workers. He died in the hospital the following day.

KEY ISSUES:
• HAZARD COMMUNICATION
• HOT WORK CONTROL
• PLASTIC PIPE IN FLAMMABLE SERVICE
• FLAME ARRESTER MAINTENANCE
• FLORIDA PUBLIC EMPLOYEE SAFETY PROGRAMS

ROOT CAUSES:
1. The City of Daytona Beach did not implement adequate controls for hot work at the Bethune Point WWTP.
2. The City of Daytona Beach had a hazard communication program that did not effectively communicate the hazards associated with methanol at the Bethune Point WWTP.

Image credit: CSB

On January 13, 2003, at approximately 4:30 pm, a vapor cloud deflagration and pool fire erupted at the BLSR Operating, Ltd. (BLSR), facility located 5 miles north of Rosharon, Texas. Two BLSR employees were killed, and three were seriously burned. Two T&L Environmental Services, Inc. (T&L), truck drivers, who had just delivered gas condensate storage tank basic sediment and water (BS&W) to BLSR, were seriously burned; one of these men died on March 2.

The fire was caused by the release of hydrocarbon vapor during the unloading of BS&W from two vacuum trucks into an open area collection pit. BS&W is an oil/gas exploration and production (E&P) waste liquid. The fire destroyed two 50-barrel (2,100-gallon) vacuum trucks and seriously damaged waste liquid offloading equipment and structures at BLSR. One of the vacuum truck diesel engines was the most likely source of ignition..

KEY ISSUES:
• RECOGNIZING FLAMMABILITY HAZARDS OF EXPLORATION & PRODUCTION WASTE LIQUIDS
• SAFE HANDLING OF FLAMMABLE LIQUIDS

ROOT CAUSES:
1. Noble Energy, Inc., the shipper, failed to identify the flammability hazard of BS&W generated at its gas well production facility, and also failed to communicate the hazard to employees and contractors who were required to handle the flammable liquid.
2. T&L management did not require Noble Energy to provide vacuum truck drivers with a material safety data sheet or other document listing the potential flammability hazard of BS&W, nor did it identify the flammability hazard of the mixture in the vacuum truck tank.
3. BLSR management did not have effective hazard communication practices in place to recognize the potential flammability hazard of each shipment of BS&W, nor did it implement safe handling practices when offloading flammable liquid onto the mud disposal and washout pad area.

Image Credit: CSB

On January 16, 2002, highly toxic hydrogen sulfide gas leaked from a sewer manway at the Georgia-Pacific Naheola mill in Pennington, Alabama. Several people working near the manway were exposed to the gas. Two contractors from Burkes Construction, Inc., were killed. Eight people were injured–seven employees of Burkes Construction and one employee of Davison Transport, Inc. Choctaw County paramedics who transported the victims to hospitals reported symptoms of hydrogen sulfide exposure.

KEY ISSUES:
• REACTIVE HAZARD IDENTIFICATION
• HYDROGEN SULFIDE SAFETY
• EMERGENCY RESPONSE

ROOT CAUSES:
1. Good engineering and process safety practices were not followed when joining the drain from the truck unloading station and the oil pit to the acid sewer.
2. There was no management system to incorporate hazard warnings about mixing sodium hydrosulfide (NaSH) with acid into process safety information.

Image Credit: CSB

An explosion at a liquefied natural gas (LNG) plant resulted in 27 people killed, 72 injured, and seven reported missing. The explosion destroyed three out of six liquefaction trains, damaged a nearby power plant, and led to the shutdown of a 335,000 bbl per day refinery. There was also some damage to the neighboring industrial facilities. A faulty boiler was initially blamed for the incident. Investigations, however, indicated that a large release of hydrocarbon from a cold-box exchanger was ignited upon ingestion into the boiler. Train six of the LNG complex re-started in May 2004 and trains five and 10 in September 2004. Trains 20, 30, and 40 were destroyed in the incident, representing 50% of the capacity of the LNG complex.

[ Property Damage $470 Million. Estimated Current Value $689 Million ]

Image credit: Sonatrach

The incident occurred when workers were weighing a barrel of 4-hydroxybenzohydrazide. There was a short circuiting in the weighing scale which led to an explosion.

Proximate causes:
• Defective equipment

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Survival Technologies

On January 21, 1997, an explosion and fire occurred at the Hydrocracker Unit of the Tosco Refinery at Martinez, California, resulting in one death, 46 worker injuries and precautionary sheltering-in-place for the surrounding community. The accident involved the release and autoignition of a mixture of flammable hydrocarbons and hydrogen under high temperature and pressure. EPA undertook an investigation into the causes and underlying circumstances associated with this accident because of its serious consequences (fatality, injuries and offsite concern), the potential for greater impacts, and the opportunity to learn from this accident how similar accidents could be prevented

Image Credit: EPA

On January 22, 2018, a blowout and rig fire occurred at Pryor Trust 0718 gas well number 1H-9, located in Pittsburg County, Oklahoma. The fire killed five workers, who were inside the driller’s cabin on the rig floor. They died from thermal burn injuries and smoke and soot inhalation. The blowout occurred about three-and-a-half hours after removing drill pipe (‘tripping’) out of the well.

The cause of the blowout and rig fire was the failure of both the primary barrier (hydrostatic pressure produced by drilling mud) and the secondary barrier (human detection of influx and activation of the blowout preventer) which were intended to be in place to prevent a blowout.

KEY ISSUES:
• POOR BARRIER MANAGEMENT
• UNDERBALANCED OPERATIONS PERFORMED WITHOUT PROPER PLANNING, PROCEDURES, OR NEEDED EQUIPMENT
• SIGNS OF INFLUX EITHER NOT IDENTIFIED OR INADEQUATELY RESPONDED TO
• ALARM SYSTEM OFF
• FLOW CHECKS NOT CONDUCTED
• GAPS IN SAFETY MANAGEMENT SYSTEM
• DRILLER’S CABIN DESIGN
• BOP COULD NOT CLOSE DUE TO BURNED HYDRAULIC HOSES
• LACK OF SAFETY REQUIREMENTS BY REGULATION

ROOT CAUSES:
1. Failure of primary barrier – hydrostatic pressure produced by drilling mud.
2. Failure of secondary barrier – human detection of influx and activation of the blowout preventer.

Image & AcciMap Credit: CSB

Image credit: CSB

On January 22 and 23, 2010, three separate incidents at the DuPont plant in Belle, WV, involving releases of methyl chloride, oleum, and phosgene, triggered notification of outside emergency response agencies. The incident involving the release of phosgene gas led to the fatal exposure of a worker performing routine duties in an area where phosgene cylinders were stored and used.

Operators discovered the first incident, the release of methyl chloride, the morning of January 22, 2010, when an alarm sounded on the plant’s distributed control system monitor. They confirmed that a release had occurred and that methyl chloride was venting to the atmosphere. Managers assessing the release estimated that more than 2,000 pounds of methyl chloride may have been released over the preceding 5 days.

The oleum release, the second incident, occurred the morning of January 23, 2010. Workers discovered a leak in an overhead oleum sample pipe that was allowing a fuming cloud of oleum to escape to the atmosphere. The plant fire brigade, after donning the appropriate personal protective equipment, closed a valve that stopped the leak about an hour after it was discovered. No injuries occurred, but the plant called the Belle Volunteer Fire Department to assist.

The third incident, a phosgene release, occurred later that same day when a hose used to transfer phosgene from a 1-ton cylinder to a process catastrophically failed and sprayed a worker in the face while he was checking the weight of the cylinder. The employee, who was alone when exposed, was assisted by co-workers who immediately responded to his call for help. Initial assessments by the plant’s occupational health nurse indicated that the worker showed no symptoms of exposure prior to transport to the hospital for observation and treatment. A delayed onset of symptoms, consistent with information in phosgene exposure literature, occurred after he arrived at the hospital. His condition deteriorated over the next day and he died from his exposure the next night.

KEY ISSUES:
• MECHANICAL INTEGRITY
• ALARM MANAGEMENT
• OPERATING PROCEDURES
• COMPANY EMERGENCY RESPONSE & NOTIFICATION

ROOT CAUSES:

Methyl Chloride Incident (January 22, 2010)
1. DuPont management, following their Management of Change process, approved a design for the rupture disc alarm system that lacked sufficient reliability to advise operators of a flammable methyl chloride release.

Oleum Release Incident (January 23, 2010)
1. Corrosion under the insulation caused a small leak in the oleum pipe.

Phosgene Incident (January 23, 2010)
1. DuPont’s phosgene hazard awareness program was deficient in ensuring that operating personnel were aware of the hazards associated with trapped liquid phosgene in transfer hoses.
2. DuPont relied on a maintenance software program that was subject to changes without authorization or review, did not automatically initiate a change-out of phosgene hoses at the prescribed interval, and did not provide a back-up process to ensure timely change-out of hoses.
3. DuPont Belle’s near-miss reporting process was not rigorous enough to ensure that the near failure of a similar phosgene transfer hose, just hours prior to the exposure incident, would be immediately brought to the attention of plant supervisors and managers.
4. DuPont lacked a dedicated radio/telephone system and emergency notification process to convey the nature of an emergency at the Belle plant, thereby restricting the ability of personnel to provide timely and quality information to emergency responders.

Image credit: CSB

The massive explosion fatally injured two workers and caused extensive damage to nearby structures.

Image credit: CSB

During the early morning hours of January 25, ASCO employees filled cylinders with purchased acetylene. At approximately 9:30 am, with the depletion of the supply of purchased acetylene, they began to produce acetylene from calcium carbide in the generator.

Because of heavy snowfall, workers were shoveling snow in the area south of the decant tanks near the loading dock. At 10:36 am, an explosion occurred, centered in the shed. Two of the workers immediately south of the shed were killed instantly. A third worker farther south, closer to the loading dock, was severely injured and was pronounced dead shortly after arriving at the Newark Medical Center. A fourth worker who was in the loading dock/lime pit area was very seriously injured by the blast. .

KEY ISSUES:
• OPERATING PROCEDURES
• STAFF TRAINING
• DRAIN & VENT TO SAFE LOCATION
• BUILDINGS TO BE DESIGNED FOR ACETYLENE CONTAINMENT
• MECHANICAL INTEGRITY
• POSITIVE ISOLATION

ROOT CAUSES:
1. At ASCO, a line that could potentially contain acetylene drained into an enclosed wooden shed.
2. The shed in this incident was not designed or constructed in accordance with NFPA 51A.
3. At ASCO the check valve was relied upon to prevent backflow. The check valve and block valve that failed at ASCO and allowed backflow were not on a testing or inspection schedule. The single block valve on the recycle water line, which was found closed after the explosion, leaked during post-incident testing.
4. Operators did not use either written operating procedures or check lists for start up of the acetylene generator or recycled water system at this facility.

Image Credit: CSB

The Space Shuttle Challenger disaster was a fatal incident in the United States space program that occurred on Tuesday, January 28, 1986, when the Space Shuttle Challenger (OV-099) broke apart 73 seconds into its flight, killing all seven crew members aboard. The crew consisted of five NASA astronauts, one payload specialist, and a civilian schoolteacher. The mission carried the designation STS-51-L and was the tenth flight for the Challenger orbiter.

The spacecraft disintegrated over the Atlantic Ocean, off the coast of Cape Canaveral, Florida, at 11:39 a.m. EST (16:39 UTC). The disintegration of the vehicle began after a joint in its right solid rocket booster (SRB) failed at liftoff. The failure was caused by the failure of O-ring seals used in the joint that were not designed to handle the unusually cold conditions that existed at this launch. The seals’ failure caused a breach in the SRB joint, allowing pressurized burning gas from within the solid rocket motor to reach the outside and impinge upon the adjacent SRB aft field joint attachment hardware and external fuel tank. This led to the separation of the right-hand SRB’s aft field joint attachment and the structural failure of the external tank. Aerodynamic forces broke up the orbiter.

Image Credit: NASA

On January 29, 2003, an explosion and fire destroyed the West Pharmaceutical Services plant in Kinston, North Carolina, causing six deaths, dozens of injuries, and hundreds of job losses. The facility produced rubber stoppers and other products for medical use. The fuel for the explosion was a fine plastic powder, which accumulated above a suspended ceiling over a manufacturing area at the plant and ignited.

KEY ISSUES:
• HAZARD RECOGNITION & COMMUNICATION
• GOOD ENGINEERING PRACTICE
• LOCAL AMENDMENTS TO FIRE CODES

ROOT CAUSES:
1. West did not perform adequate engineering assessment of the use of powdered zinc stearate and polyethylene as antitack agents in the rubber batchoff process.
2. West engineering management systems did not ensure that relevant industrial fire safety standards were consulted.
3. West management systems for reviewing material safety data sheets did not identify combustible dust hazards.
4. The Kinston plant’s hazard communication program did not identify combustible dust hazards or make the workforce aware of such.

Image Credit: CSB

On Wednesday, January 29, 2020, a gas well explosion fatally injured three contractors. The gas well was operated by Chesapeake Energy.

Image credit: CSB

This incident occurred at Synthron, LLC’s Morganton, North Carolina, facility. The company manufactured a variety of powder coating and paint additives by polymerizing acrylic monomers in a 1,500 gallon reactor.

The company had received an order for slightly more of an additive than the normal size recipe would produce. Plant managers scaled up the recipe to produce the required larger amount of polymer, and added all of the additional monomer needed into the initial charge to the reactor. This more than doubled the rate of energy release in the reactor, exceeding the cooling capacity of the reactor condenser and causing a runaway reaction.

The reactor pressure increased rapidly. Solvent vapors vented from the reactor’s manway, forming a flammable cloud inside the building. The vapors found an ignition source, and the resulting explosion killed one worker and injured 14. The blast destroyed the facility and damaged off-site structures.

KEY ISSUES:
• REACTIVE HAZARDS & SAFEGUARDS
• CORPORATE OVERSIGHT
• SAFE OPERATING LIMITS
• EVACUATION PLANNING & DRILLS

ROOT CAUSES:
1. A lack of hazard recognition.
2. Poorly documented process safety information & ineffective control of product recipe changes.
3. Lack of automatic safeguards to prevent or mitigate the effects of loss of control over the reaction.
4. Improper manway bolting practices and poor operator training.
5. Inadequate emergency plans drills.
6. Inadequate corporate oversight of process safety.

Image credit: CSB

Three combustible dust incidents over a six month period occurred at the Hoeganaes facility in Gallatin, TN, resulting in fatal injuries to five workers. The facility produces powdered iron and is located about twenty miles outside of Nashville.

KEY ISSUES:
• HAZARD RECOGNITION AND TRAINING
• ENGINEERING CONTROLS
• FIRE CODES/ENFORCEMENT
• REGULATORY OVERSIGHT

ROOT CAUSES:
1. Hoeganaes facility management were aware of the iron powder combustibility hazard two years prior to the fatal flash fire incidents but did not take necessary action to mitigate the hazard through engineering controls and housekeeping.
2. Hoeganaes did not institute procedures – such as combustible gas monitoring – or training for employees to avoid flammable gas fires and explosions

Image credit: CSB

Four people were killed in an explosion and fire at an oil gathering center, gas booster station, and power substation. The explosion occurred after a leak from a buried oil pipeline in the gathering station spread to a power substation, sparking the blaze. The flash explosion and resulting blaze hit the gathering center and the adjacent gas booster station. At least 19 people were injured in the incident, mainly suffering first- and second-degree burns. The fire was extinguished two days after the event.

[ Property Damage $150 Million. Estimated Current Value $246 Million ]

Image credit: BBC

A gas leak followed by explosion occurred during an inspection process due to the loose of valve bolt.

Proximate causes:
• Inadequate training/knowledge transfer (Lack of understanding the process);
• Lack of work rules/policies/ standards/procedures (wrong procedures for inspections);
• Inadequate work rules plan (lack of the pre-start safety review before inspection).

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Wikipedia

The Space Shuttle Columbia disaster was a fatal incident in the United States space program that occurred on February 1, 2003, when the Space Shuttle Columbia (OV-102) disintegrated as it re-entered the atmosphere, killing all seven crew members. The disaster was the second fatal accident in the Space Shuttle program, after the 1986 breakup of Challenger soon after liftoff.

During the launch of STS-107, Columbia’s 28th mission, a piece of foam insulation broke off from the Space Shuttle external tank and struck the left wing of the orbiter. Similar foam shedding had occurred during previous shuttle launches, causing damage that ranged from minor to nearly catastrophic, but some engineers suspected that the damage to Columbia was more serious. Before re-entry, NASA managers had limited the investigation, reasoning that the crew could not have fixed the problem if it had been confirmed. When Columbia re-entered the atmosphere of Earth, the damage allowed hot atmospheric gases to penetrate the heat shield and destroy the internal wing structure, which caused the spacecraft to become unstable and break apart.

Image Credit: NASA

On February 2, 2001, a fire occurred at Bethlehem Steel Corporation’s Burns Harbor mill in Chesterton, Indiana. One Bethlehem Steel millwright and one contractor supervisor died. Four Bethlehem Steel millwrights were injured, one seriously. Workers were attempting to remove a slip blind and a cracked valve from a coke oven gas line leading to a decommissioned furnace. During removal of the valve, flammable liquid was released and ignited.

KEY ISSUES:
• MAINTENANCE JOB PLANNING
• FACILITY WINTERIZATION & DEADLEGS
• LINE & EQUIPMENT OPENING
• DECOMMISSIONING & DEMOLITION

ROOT CAUSES:
1. Management systems for the supervision, planning, and execution of maintenance work were inadequate.
2. The Burns Harbor facility did not have a system for monitoring and controlling hazards that could be caused by changes in COG condensate flammability or accumulation rates.

Image Credit: CSB

On February 7, 2008, at about 7:15 p.m., a series of sugar dust explosions at the Imperial Sugar manufacturing facility in Port Wentworth, Georgia, resulted in 14 worker fatalities. Eight workers died at the scene and six others eventually succumbed to their injuries at the Joseph M. Still Burn Center in Augusta, Georgia. Thirty six workers were treated for serious burns and injuries – some caused permanent, life altering conditions. The explosions and subsequent fires destroyed the sugar packing buildings, palletizer room, and silos, and severely damaged the bulk train car loading area and parts of the sugar refining process areas.

KEY ISSUES:
• COMBUSTIBLE DUST HAZARD RECOGNITION
• MINIMIZING COMBUSTIBLE DUST ACCUMULATION IN THE WORKPLACE
• EQUIPMENT DESIGN & MAINTENANCE

ROOT CAUSES:
1. Sugar and cornstarch conveying equipment was not designed or maintained to minimize the release of sugar and sugar dust into the work area.
2. Inadequate housekeeping practices resulted in significant accumulations of combustible sugar and sugar dust on the floors and elevated surfaces throughout the packing buildings.
3. Imperial Sugar emergency evacuation plans were inadequate. Emergency evacuation drills were not conducted, and prompt worker notification to evacuate in the event of an emergency was inadequate.

Image credit: CSB

Six workers were fatally injured during a planned work activity to clean debris from natural gas pipes at Kleen Energy in Middletown, CT. To remove the debris, workers used natural gas at a high pressure of approximately 650 pounds per square inch. The high velocity of the natural gas flow was intended to remove any debris in the new piping. During this process, the natural gas found an ignition source and exploded.

KEY ISSUES:
• SIMILAR NATURAL GAS BLOW INCIDENTS
• INDUSTRY PRACTICES AND SAFER ALTERNATIVE METHODOLOGIES
• HAZARDS OF RELEASING NATURAL GAS NEAR WORK AREAS
• CODES AND STANDARDS

ROOT CAUSES:
1. Natural gas blows are common
2. Workers remained in building during gas blow

Image credit: CSB

On Wednesday, February 8, 2017, at approximately 11:05 am, a foul condensate tank, part of a non-condensable gas system, exploded at the Packaging Corporation of America (PCA) containerboard mill in DeRidder, Louisiana. The explosion killed three people and injured seven others. All 10 people were working at the mill as contractors. The explosion also heavily damaged the surrounding process. The foul condensate tank travelled approximately 375 feet and over a six-story building before landing on process equipment.

At the time of the incident, the mill was undergoing its annual planned maintenance outage, also referred to as a shutdown. The foul condensate tank likely contained water, a layer of flammable liquid turpentine on top of the water, and an explosive vapor space containing air and flammable turpentine vapor.

KEY ISSUES:
• PROCESS SAFETY MANAGEMENT SYSTEM
• INHERENTLY SAFER DESIGN
• PROCESS HAZARD ANALYSIS
• INEFFECTIVE SAFEGUARDS
• HOT WORK SAFETY MANAGEMENT

ROOT CAUSES:
1. PCA did not evaluate the majority of the non-condensable gas system, including the foul condensate tank, for certain hazards. The DeRidder mill never conducted a process hazard analysis to identify, evaluate, and control process hazards for the non-condensable gas system.
2. PCA did not expand the boundaries of its process safety management program beyond the units covered by safety regulations.
3. PCA did not effectively apply the hierarchy of controls to the selection and implementation of safeguards that the company used to prevent a potential non-condensable gas explosion.
4. PCA did not evaluate inherently safer design options that could have eliminated the possibility of air entering the non-condensable gas system, including the foul condensate tank.
5. PCA did not establish which mill operations group held ownership of, and responsibility for, the foul condensate tank.
6. PCA did not apply important aspects of industry safety guidance and standards.

Image credit: CSB

An explosion occurred when 8 personnel were working on the repair of a catalyst tower.

Proximate causes:
• Inadequate training/knowledge transfer (Lack of understanding the process)
• Lack of work rules/policies/ standards/procedures (wrong procedures for inspections);
• Inadequate work rules plan (lack of the pre-start safety review before inspection).

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)

Explosion in an oil and gas production ship rented by Petrobras. The explosion occurred aboard the FPSO unit. A leak of flammable substance in the pump room was the cause of the explosion.

Proximate causes:
• Failure in following procedures
• Lack of work rules/policies/ standards/procedures (breach of operational procedures for the pumping of fluids)
• Inadequate engineering/design
• Inadequate management/ supervision (installation of equipment in pipe without proper technical specification and registration of the change)
• Work exposure to hazardous chemicals (flammable substances) Inadequate assessment of needs and risks

Marsh (https://www.marsh.com/us/insights/research/100-largest-losses-in-the-hydrocarbon-industry.html):

An explosion on a FPSO off the coast of Brazil resulted in nine fatalities and multiple wounded. The accident happened as the vessel was anchored in the Atlantic Ocean 120 kilometres from the coast of Espirito Santos, Brazil. The FPSO is a converted very large crude oil tanker (VLCC), designed to produce up to 10 million cubic meters of natural gas. It is understood that a condensate leak during a fluid transfer operation released a cloud of flammable vapor into the engine room, resulting in an explosion in the machinery space. The majority of fatalities were believed to be part of the emergency response team. FPSO took on water, but the explosion did not result in a breach of the hull of the vessel.

[ Property Damage $250 Million. Estimated Current Value $264 Million ]

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: AFP / Getty Images

An explosion occurred due to an overflow of a slurry mixing tank, containing potassium sulfide, potassium dihydrogen phosphate, and MAP.

Proximate causes:
• Inadequate training/knowledge transfer (Lack of understanding the process);
• Lack of work rules/policies/ standards/procedures (wrong procedures for inspections);
• Inadequate work rules plan (lack of the pre-start safety review before inspection).

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)

A February 20, 2003, dust explosion at the CTA Acoustics, Inc. (CTA) facility in Corbin, Kentucky, killed seven and injured 37 workers. This incident caused extensive damage to the production area of the 302,000-square-foot plant. Nearby homes and an elementary school were evacuated, and a 12-mile section of Interstate 75 was closed. The largest CTA customer, Ford Motor Company, temporarily suspended operations at four automobile assembly plants because CTA had produced acoustic insulation products for those plants, as well as for other industrial and automotive clients.

KEY ISSUES:
• COMBUSTIBLE DUST HAZARD AWARENESS
• WORK PRACTICES
• BUILDING DESIGN
• PRODUCT STEWARDSHIP

ROOT CAUSES:
1. CTA management did not implement effective measures to prevent combustible dust explosions.
2. The CTA cleaning and maintenance procedures for production lines did not prevent the accumulation of unsafe levels of combustible dust on elevated flat surfaces.
3. The CTA incident investigation program did not ensure that all oven fires were investigated and that underlying causes were identified and resolved.
4. The Borden Chemical product stewardship program did not explicitly convey to CTA the explosive hazards of phenolic resins.
5. The original building design and subsequent building modifications did not effectively address the fire and explosion hazards associated with combustible dusts.

Image Credit: CSB

On February 23, 1999, a fire occurred in the crude unit at Tosco Corporation. Avon oil refinery in Martinez, California. Workers were attempting to replace piping attached to a 150-foot-tall fractionator tower while the process unit was in operation. During removal of the piping, naphtha was released onto the hot fractionator and ignited. The flames engulfed five workers located at different heights on the tower. Four men were killed, and one sustained serious injuries.

KEY ISSUES:
• CONTROL OF HAZARDOUS NONROUTINE MAINTENANCE
• MANAGEMENT OVERSIGHT & ACCOUNTABILITY
• MANAGEMENT OF CHANGE
• CORROSION CONTROL

ROOT CAUSES:
1. Tosco Avon refinery’s maintenance management system did not recognize or control serious hazards posed by performing nonroutine repair work while the crude processing unit remained in operation.
2. Tosco’s safety management oversight system did not detect or correct serious deficiencies in the execution of maintenance and review of process changes at its Avon refinery.

Image Credit: CSB

A high-pressure steam (3.7 MPa) discharge occurred during a maintenance process, resulting in three field workers burned to death.

Proximate causes:
• Lack of work rules/policies/ standards/procedures (wrong procedures for inspections);
• Inadequate work rules plan (lack of the pre-start safety review before inspection).

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)

At approximately 6:15 p.m. on March 4, 1998, a catastrophic vessel failure and fire occurred near Pitkin, Louisiana, at the Temple 22-1 Common Point Separation Facility owned by Sonat Exploration Co. Four workers who were near the vessel were killed, and the facility sustained significant damage.

The facility housed two petroleum separation trains and consisted of separation equipment, piping, storage vessels, and a gas distribution system. The separation trains were designed to produce crude oil and natural gas from well fluid, derived from two nearby wells. The vessel ruptured due to overpressurization, releasing flammable material which then ignited.

KEY ISSUES:
• DESIGN & HAZARD REVIEWS
• PRESSURE-RELIEF DEVICES
• OPERATING PROCEDURES

ROOT CAUSES:
1. Sonat management did not use a formal engineering design review process or require effective hazard analyses in the course of designing and building the facility.
2. Sonat engineering specifications did not ensure that equipment that could potentially be exposed to high-pressure hazards was adequately protected by pressure-relief devices.

Image Credit: CSB

Flooding and capsize of ro-ro passenger ferry Herald of Free Enterprise with loss of 193 lives

On the 6th March 1987 the Roll on/Roll off passenger and freight ferry HERALD OF FREE ENTERPRISE (‘HERALD’) under the command of Captain David Lewry sailed from Number 12 berth in the inner harbour at Zeebrugge at 18.05 G.M.T. The HERALD was manned by a crew of 80 hands all told and was laden with 81 cars, 47 freight vehicles and three other vehicles.

Approximately 459 passengers had embarked for the voyage to Dover, which they expected to be completed without incident in the prevailing good weather. There was a light easterly breeze and very little sea or swell. The HERALD passed the outer mole at 18.24. She capsized about four minutes later. During the final moments the HERALD turned rapidly to starboard and was prevented from sinking totally by reason only that her port side took the ground in shallow water. The HERALD came to rest on a heading of 136° with her starboard side above the surface. Water rapidly filled the ship below the surface level with the result that not less than 150 passengers and 38 members of the crew lost their lives. Many others were injured.

Image Credit: Independent

A hairline crack in a welded seam of piping to the level indicator system on an aldehyde column resulted in a minor ethylene oxide leak on this gas processing plant. As a result of this crack, which was caused by low cycle fatigue, ethylene oxide escaped near the level indicator and formed polyethylene glycols (PEG) in the mineral wool insulation. It is believed that both the leak and accumulation of PEG occurred over a period of time. During repairs to the level indicator, the metal sheathing of the insulation was removed and air contacted the insulation soaked with PEG. Auto-oxidation of the PEG resulted and the insulating material was ignited. The piping to the level indicator system was heated to such a degree that auto-decomposition of the ethylene oxide within the piping occurred. This autodecomposition propagated into the aldehyde column which subsequently exploded. The force of the explosion completely destroyed the distillation section of this plant. The large resulting fire and impact of flying debris to other process sections resulted in extensive damage throughout the plant.

[ Property Damage $79 Million. Estimated Current Value $178 Million ]

Image credit: No credit

On March 11, 2011, the Great East Japan Earthquake triggered an extremely severe nuclear accident at the Fukushima Daiichi Nuclear Power Plant, owned and operated by the Tokyo Electric Power Company (TEPCO). This devastating accident was ultimately declared a Level 7 (“Severe Accident”) by the International Nuclear Event Scale (INES).

When the earthquake occurred, Unit 1 of the Fukushima Daiichi plant was in normal operation at the rated electricity output according to its specifications; Units 2 and 3 were in operation within the rated heat parameters of their specifications; and Units 4 to 6 were undergoing periodical inspections. The emergency shut-down feature, or SCRAM, went into operation at Units 1, 2 and 3 immediately after the commencement of the seismic activity.

Although there were no immediate fatalities, a worker later died from radiation exposure (https://www.reuters.com/article/us-japan-fukushima-radiation/japan-acknowledges-first-radiation-death-among-fukushima-workers-idUSKCN1LL0OA)

Image Credit: NY Times