Lessons: Emergency Preparedness

On October 2, 2007, a chemical fire inside a permit-required confined space1 at Xcel Energy’s hydroelectric plant in a remote mountain location 45 miles (72 kilometers) west of Denver, Colorado, killed five and injured three workers. Industrial painting contractors were in the initial stages of recoating the 1,530-foot (466-meter) steel portion of a 4,300-foot (1,311-meter) enclosed penstock2 tunnel with an epoxy coating product when a flash fire occurred. Flammable solvent being used to clean the epoxy application equipment in the open penstock atmosphere ignited, likely from a static spark. The initial fire quickly grew as it ignited additional buckets of solvent and substantial amounts of combustible epoxy material, trapping and preventing five of the 11 workers from exiting the single point of egress within the penstock. Fourteen community emergency response teams responded to the incident. The five trapped workers communicated using handheld radios with co-workers and emergency responders for approximately 45 minutes before succumbing to smoke inhalation.

KEY ISSUES:
• SAFE LIMITS FOR WORKING IN CONFINED SPACE FLAMMABLE ATMOSPHERES
• PRE-JOB SAFETY PLANNING OF HAZARDOUS MAINTENANCE WORK
• CONTRACTOR SELECTION & OVERSIGHT
• EMERGENCY RESPONSE AND RESCUE

ROOT CAUSES:
1. Xcel and RPI management did not ensure effective planning and coordination of the Cabin Creek penstock recoating project to control or eliminate the serious confined space hazards that were present.
2. Xcel’s and RPI’s corporate safety policies and permits did not effectively establish safe limits for flammable atmospheres in permit-required confined spaces that would prohibit entry or occupancy when those limits were exceeded.
3. Early in the planning process, Xcel identified the Cabin Creek penstock’s single point of egress in the event of an emergency as a major concern; RPI personnel also raised safety issues about a single exit. However, neither Xcel nor RPI management took remedial action.
4. Xcel management did not provide effective oversight of RPI to ensure the penstock recoating work was safely conducted.

Image credit: CSB

At 9:38 pm on October 5, 2006, a citizen driving past the EQ facility called 911 to report a haze with a ‘strong chlorine smell’ The Apex 911 center dispatched emergency personnel to investigate.

Responding Apex Fire Department personnel discovered a chemical cloud coming from one of several businesses on Investment Boulevard. The Apex Fire Chief, acting as the Incident Commander (IC), sent two firefighter reconnaissance teams in personal protective equipment to investigate the source of the cloud.

Firefighters located a small ‘sofa-size’ fire in one of the hazardous waste bays at the EQ facility. Within minutes, the fire spread to the flammable liquid storage area, causing 55-gallon drums of flammable hazardous waste to explode and sending fireballs hundreds of feet into the air. The hazardous waste building ultimately collapsed (cover photograph).

During the incident, about 30 people (including 13 first responders) sought medical attention at local hospitals for respiratory distress and nausea. Some were treated; none was admitted. .

KEY ISSUES:
• FACILITY FIRE DETECTION
• FACILITY FIRE PROTECTION
• EMERGENCY PLANNING

ROOT CAUSES:
1. The EQNC hazardous waste building was not equipped with fire or smoke detection sensors, automated fire suppression equipment, or fire barriers.
2. EQNC had not provided the fire department or county emergency agency with written information on the types, quantities, and locations of the hazardous materials in the facility prior to the incident.

Image credit: CSB

At approximately 0400 hrs on the 9th October 1995 the fire alarm sounded in ICI’s Wilton Site Emergency Services Control Centre, alerting of a fire in the BASF warehouse which was used for storing polypropylene finished products. Almost an hour later a major emergency on the site was declared and the full on-site emergency plan initiated. The fire generated a large black plume of smoke, although this was declared non-toxic. Police alerted the public situated down wind of the fire to stay indoors and to close windows. The ‘Redcar’ trunk road was closed and employees of adjacent companies, including those on-site, were advised not to report to work.

The warehouse facility met the building regulations and was equipped with a range of fire safety features. This included fire doors, operated both by fusible links and smoke detection, which failed to close during the fire. No cause was established for this. However, it may have been attributed to the fact that the warehouse did not become completely smoke logged, as smoke was vented through the roof. Hence, the smoke failed to activate the detectors, which would have closed the doors.

No direct root causes for the fire was determined. However, the results of the investigation by BASF and the Cleveland County Fire Brigade suggests the probable cause was a fluorescent light fitting overheating, causing the ignition of its Perspex refectory which dropped flaming molten plastic onto stored product below. The warehouse lighting was in continuous use.

No injuries or ill health were reported.

The perceived risk was low and therefore no formal risk assessment for dealing with a major fire for the warehouse was undertaken. Following the incident it took several days to re-establish the inventory and its layout, as all local records were destroyed in the fire.

Because the warehouse was sited in the middle of the ICI complex there was potential for escalation into a much more serious event. The incident clearly highlighted the value of having a well-defined emergency plan and procedures in place as well as trained personal to execute it.

KEY ISSUES:
• EMERGENCY RESPONSE / SPILL CONTROL
• PLANT LAYOUT
• ACTIVE / PASSIVE FIRE PROTECTION

Image Credit: Cleveland Fire Brigade

The rupture of a 145-foot-tall distillation column (C-501) used to refine mononitrotoluene (MNT) caused the October 13, 2002, explosion and fire at the First Chemical Corporation (FCC) facility in Pascagoula, Mississippi. The column was thought to be isolated and in standby mode at the time of the explosion (approximately 5:25 am) though it contained a significant amount of MNT.

Debris from the explosion, including metal fragments and packing from the column, was scattered throughout the facility and propelled offsite. One large fragment of the distillation column punctured a nearby para-MNT storage tank and ignited its contents, which burned for almost 3 hours. A 6-ton column segment was hurled 1,100 feet and landed near a crude oil storage tank at a refinery across the highway. Flying glass injured three FCC employees, who were in the unit control room at the time of the explosion. All three employees received first-aid, and one required additional medical treatment.

The FCC fire brigade fought the onsite fires, including the large para-MNT storage tank fire and numerous fires initiated by burning material on ejected column packing. Local community emergency responders provided backup and firefighting support for numerous small fires outside the facility. The sheriff’s department provided traffic control. FCC personnel, the U.S. Environmental Protection Agency (EPA), and the U.S. Coast Guard monitored the air around the facility.

KEY ISSUES:
• EVALUATION OF REACTIVE HAZARDS
• APPLYING LESSONS LEARNED
• LAYERS OF PROTECTION
• WORK PRACTICES
• FACILITY SITING
• COMMUNITY NOTIFICATION

ROOT CAUSES:
1. The FCC Pascagoula facility did not have an adequate system for evaluating the hazards of processing mononitrotoluene (MNT) in its continuous process and did not apply lessons learned from hazard analyses conducted on similar processes in the plant.
2. FCC did not have a system to ensure that the #1 MNT column (C-501) was equipped with sufficient layers of protection to prevent a catastrophic release.
3. The Pascagoula facility had no effective system for ensuring consistent work practices when isolating equipment.
4. FCC did not have an adequate program to prevent leakage from isolation valves in the steam line connected to the #1 MNT column (C-501).

Image Credit: CSB

On October 17, 2017 a rapid release of ammonia occurred within the mechanical room at the Fernie Memorial Arena and resulted in estimated concentrations of ammonia exceeding 20,000 ppm. Three people were in the room at the time of the release and were found deceased. The incident resulted in a local state of emergency for the community and an evacuation of the area around the arena.

Following the incident, Technical Safety BC conducted an investigation to determine factors that contributed to the ammonia release. The objective of the investigation was to identify causes and contributing factors to inform an understanding and management of safety risks associated with refrigeration systems.

The investigation identified three areas where evidence indicates causal and contributing factors leading to the incident and the subsequent impact to the arena and surrounding community:

• Failure of refrigeration system equipment
• Operational decisions that contributed to the incident
• Impact of inadequate ventilation and discharge systems following the incident

Image Credit: TSBC

A boiler explosion occurred in Kaka Chemical factory which manufactures chemicals required for making soaps

Proximate causes:
• Inadequate personal protective equipment
• Inadequate isolation of process or equipment

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Shutterstock (example boiler explosion)

On October 21, 2016, a chemical release occurred at the MGPI Processing plant in Atchison, Kansas. MGPI Processing produces distilled spirits and specialty wheat proteins and starches. The release occurred when a chemical delivery truck, owned and operated by Harcros Chemicals, was inadvertently connected to a tank containing incompatible material. The plume generated by the chemical reaction led to a shelter-in-place order for thousands of residents. At least 120 employees and members of the public sought medical attention.

KEY ISSUES:
• DESIGN OF CHEMICAL TRANSFER EQUIPMENT
• AUTOMATED & REMOTE EMERGENCY SHUT-OFFS
• PIPE MARKINGS
• CHEMICAL UNLOADING PROCEDURES
• HUMAN FACTORS
• EMERGENCY PLANNING

ROOT CAUSES:
1. Design of connections & markings.
2. Inadequate procedures & training

Image credit: CSB

A chemical spill shut down portions of Interstate 75 in northern Madison County. A tanker truck was leaking ferric chloride solution from one of its valves

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: WKYT

At approximately 1:00 p.m. on the 23rd October 1989 Phillips’ 66 chemical complex at Pasadena, near Houston (USA) experienced a chemical release on the polyethylene plant. A flammable vapour cloud formed which subsequently ignited resulting in a massive vapour cloud explosion. Following this initial explosion there was a series of further explosions and fires.

The consequences of the explosions resulted in 23 fatalities and between 130 – 300 people were injured. Extensive damage to the plant facilities occurred.

The day before the incident scheduled maintenance work had begun to clear three of the six settling legs on a reactor. A specialist maintenance contractor was employed to carry out the work. A procedure was in place to isolate the leg to be worked on. During the clearing of No.2 settling leg part of the plug remained lodged in the pipework. A member of the team went to the control room to seek assistance. Shortly afterwards the release occurred. Approximately 2 minutes later the vapour cloud ignited.

KEY ISSUES:
• MAINTENANCE PROCEDURES
• LEAK / GAS DETECTION
• PLANT LAYOUT
• PERMIT TO WORK SYSTEMS
• ACTIVE / PASSIVE FIRE PROTECTION
• WARNING SISGNS
• EMERGENCY RESPONSE / SPILL CONTROL

Image Credit: Houston Chronicle

On the night of October 23, 2009, a large explosion occurred at the Caribbean Petroleum Corporation (CAPECO) facility in Bayamon, Puerto Rico, during offloading of gasoline from a tanker ship, the Cape Bruny, to the CAPECO tank farm onshore. A 5-million gallon aboveground storage tank (AST) overflowed into a secondary containment dike. The gasoline spray aerosolized, forming a large vapor cloud, which ignited after reaching an ignition source in the wastewater treatment (WWT) area of the facility. The blast and fire from multiple secondary explosions resulted in significant damage to 17 of the 48 petroleum storage tanks and other equipment onsite and in neighborhoods and businesses offsite. The fires burned for almost 60 hours. Petroleum products leaked into the soil, nearby wetlands and navigable waterways in the surrounding area.

KEY ISSUES:
• TANK OVERFILL PREVENTION
• COMMUNITY IMPACT
• HAZARD ASSESSMENT
• SAFETY MANAGEMENT SYSTEM
• REGULATION GAPS: NO RISK ASSESSMENT CONSIDERING PROXIMITY TO COMMUNITIES
• REGULATION GAPS: NO ADHERENCE TO RAGAGEP
• REGULATION GAPS: NO REDUNDANT OR INDEPENDENT SAFEGUARDS TO PREVENT OVERFILLING A TANK

ROOT CAUSES:
1. Deficient Management System.
2. Production Pressure.
3. Lack of reliable instruments:Level control failure due to inaccurate available volume calculation.
4. No high-level alarm to notify ship to stop transfer or divert flow.
5. No AOPS with ability to shut down or divert flow into tank.

Image credit: CSB

Gas leaked out of a pipeline, which had been damaged by excavation work. Local news reported that the pipe exploded when it was hit by a digger. It caught fire followed by an explosion. An entire neighborhood was devastated

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: dpa

An explosion in a chemical facility. A gas cloud was seen above the area immediately after the explosion. Damaged about 20 buildings and left a crater in the facility’s backyard

Proximate causes:
• Inadequate tools, equipment & vehicles
• Inadequate engineering/design

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Unidentified

Early on 7 November 1975, start-up of the Naphtha cracker commenced on the ethylene plant at the Dutch State Mines (DSM) works at Beek. At 06:00 hours compressed gas was sent to the low temperature system. At 09:48 hours an escape of vapour occurred from the depropaniser which ignited, resulting in a massive vapour cloud explosion. The explosion caused significant damage and started numerous fires around the plant. 14 people were killed and a total of 107 people injured, three of whom were outside of the site.

The investigation was hampered by the destruction of instrument records in the incident but evidence suggested that the release was due to low temperature embrittlement at the depropaniser feed drum. It was thought that the initial fracture had occurred on a 40 mm pipe connecting the feed drum to its relief valve. The normal operating temperature of the drum was 65°C, however, due to a process upset in the de-ethaniser column, the stream feeding into the depropaniser drum was a liquid at about 0°C(or lower) with a high C2 content. This would flash within the drum resulting in a temperature which could be as low as -10°C. The feed drum material could normally be used at temperatures as low as -20°C, however the fracture occurred at a weld, which with ageing may fail at up to 0°C.

The raising of the alarm was also flawed. The first operator to enter the control room to report the gas release was distressed and shocked. A second operator left the room to investigate, leaving orders for the fire alarm to be sounded. This did not occur. Some witnesses stated that the alarm system failed, but the investigation found that the system was in good working order before the explosion, and that none of the button switches had been operated.

KEY ISSUES:
• DESIGN CODES – PLANT
• EMERGENCY RESPONSE / SPILL CONTROL

Image Credit: Nationaal Archief

On November 15, 2014, approximately 24,000 pounds of highly toxic methyl mercaptan was released from an insecticide production unit (Lannate® Unit) at the E. I. du Pont de Nemours and Company (DuPont) chemical manufacturing facility in La Porte, Texas. The release killed three operators and a shift supervisor inside a manufacturing building. They died from a combination of asphyxia and acute exposure (by inhalation) to methyl mercaptan.

KEY ISSUES:
• EMERGENCY PLANNING & RESPONSE (PREPAREDNESS)
• IMPLEMENTATION OF PROCESS SAFETY MANAGEMENT SYSTEMS
• ASSESSMENT OF PROCESS SAFETY CULTURE

ROOT CAUSES:
1. DuPont’s corporate process safety management system did not ensure that DuPont La Porte implemented and maintained an effective process safety management system; and
2. DuPont La Porte did not assess its culture for process safety in the site’s Safety Perception Surveys or any other formal assessment program, allowing serious process safety deficiencies to exist at the site.

Image credit: CSB

At about 11:30 a.m. on November 17, 2003, an uncontrolled decomposition reaction in a batch scrubber released chlorine gas into the air at the DPC Enterprises, L.P. (DPC) chlorine repackaging facility in Glendale, Arizona. Hazardous emissions continued for about six hours. Residents and workers in a 1.5 square mile zone were told to evacuate, and 11 police officers and five members of the community sought medical treatment for exposure to chlorine.

KEY ISSUES:
• MATCHING SAFEGUARDS TO RISK
• OPERATING PROCEDURES
• REACTIVE HAZARDS
• EMERGENCY RESPONSE

ROOT CAUSES:
1. Corporate standards relied solely on procedural safeguards against scrubber over-chlorination.
2. Corporate hazard assessment process did not identify or address the consequences of failure to follow the bleach manufacturing SOP, including potential off-site consequences.
3. Internal PSM/RMP audit program did not detect deficiencies in operating procedures, training, operating practice, process safety information, and hazard assessment.

Image Credit: CSB

On Friday 19 November 2010 at 3:45pm there was an underground explosion at the Pike River coal mine. Twenty-nine men lost their lives, and their bodies have not been recovered.

Two men survived the explosion. They were in the stone access tunnel (drift), a distance from the pit bottom area where the main workplaces were located. Although initially overcome, Daniel Rockhouse rescued himself and his colleague Russell Smith.

The New Zealand Police led the emergency response that involved emergency services, and mines rescue crews from New Zealand, New South Wales and Queensland. Despite strenuous efforts by everyone involved, a lack of information concerning the conditions underground prevented a rescue attempt.

A second explosion on Wednesday 24 November extinguished any hope of the mens survival. The emergency focus changed to recovery of the bodies.

Image Credit: AFP

At approximately 05:35 hours on 19 November 1984 a major fire and a series of catastrophic explosions occurred at the government owned and operated PEMEX LPG Terminal at San Juan Ixhuatepec, Mexico City. As a consequence of these events some 500 individuals were killed and the terminal destroyed.

Three refineries supplied the facility with LPG on a daily basis. The plant was being filled from a refinery 400 km away, as on the previous day it had become almost empty. Two large spheres and 48 cylindrical vessels were filled to 90% and 4 smaller spheres to 50% full.

A drop in pressure was noticed in the control room and also at a pipeline pumping station. An 8-inch pipe between a sphere and a series of cylinders had ruptured. Unfortunately the operators could not identify the cause of the pressure drop. The release of LPG continued for about 5-10 minutes when the gas cloud, estimated at 200 m x 150 m x 2 m high, drifted to a flare stack. It ignited, causing violent ground shock. A number of ground fires occurred. Workers on the plant now tried to deal with the escape taking various action. At a late stage somebody pressed the emergency shut down button.

About fifteen minutes after the initial release the first BLEVE occurred. For the next hour and a half there followed a series of BLEVEs as the LPG vessels violently exploded. LPG was said to rain down and surfaces covered in the liquid were set alight. The explosions were recorded on a seismograph at the University of Mexico.

KEY ISSUES:
• PLANT LAYOUT
• ISOLATION
• ACTIVE / PASSIVE FIRE PROTECTION
• LEAK / GAS DETECTION
• EMERGENCY RESPONSE / SPILL CONTROL

Image Credit: Mexico News Daily

In the early hours of 3 December 1984 a relief valve on a storage tank containing highly toxic methyl isocyanate (MIC) lifted. A cloud of MIC gas was released which drifted onto nearby housing.

Prior to this, at 23.00 hrs on 2 December, an operator noticed the pressure inside the storage tank to be higher than normal but not outside the working pressure of the tank. At the same time a MIC leak was reported near the vent gas scrubber (VGS). At 00.15hrs a MIC release in the process area was reported. The pressure inside the storage tank was rising rapidly so the operator went outside to the tank. Rumbling sounds were heard from the tank and a screeching noise from the safety valve. Radiated heat could also be felt from the tank.
Attempts were made to switch on the VGS but this was not in operational mode.

Approximately 2,000 people died within a short period and tens of thousands were injured, overwhelming the emergency services. This was further compounded by the fact that the hospitals were unaware as to which gas was involved or what its effects were. The exact numbers of dead and injured are uncertain, as people have continued to die of the effects over a period of years.

The severity of this accident makes it the worst recorded within the chemical industry.

KEY ISSUES:
• PLANT MODIFICATION / CHANGE PROCEDURES
• REACTION / PRODUCT TESTING
• DESIGN CODES – PLANT
• MAINTENANCE PROCEDURES
• EMERGENCY RESPONSE / SPILL CONTROL

Image Credit: No credit

At 1:33 pm on December 19, 2007, a powerful explosion and subsequent chemical fire killed four employees and destroyed T2 Laboratories, Inc. (T2), a chemical manufacturer in Jacksonville, Florida. It injured 32, including four employees and 28 members of the public who were working in surrounding businesses. Debris from the reactor was found up to one mile away, and the explosion damaged buildings within one quarter mile of the facility.

On December 19, T2 was producing its 175th batch of methylcyclopentadienyl manganese tricarbonyl (MCMT). At 1:23 pm, the process operator had an outside operator call the owners to report a cooling problem and request they return to the site. Upon their return, one of the two owners went to the control room to assist. A few minutes later, at 1:33 pm, the reactor burst and its contents exploded, killing the owner and process operator who were in the control room and two outside operators who were exiting the reactor area.

KEY ISSUES:
• REACTIVE HAZARD RECOGNITION
• HAZARD EDUCATION
• EMERGENCY PREPAREDNESS
• PROCESS DESIGN & SCALE-UP

ROOT CAUSES:
• T2 did not recognize the runaway reaction hazard associated with the MCMT it was producing.

Image credit: CSB

On 4th January 1966, an operation to drain off an aqueous layer from a propane storage sphere was attempted. Two valves were opened in series on the bottom of the sphere. When the operation was nearly complete, the upper valve was closed and then cracked open again. No flow came out of the cracked valve, so it was opened further. The blockage, assumed to be ice or hydrate, cleared and propane gushed out. The operator was unable to close the upper valve and by the time he attempted to close the lower valve this was also frozen open. The alarm was raised and traffic on the nearby motorway was stopped. The resulting vapour cloud is thought to have found its source of ignition from a car about 160 m away. The storage sphere was enveloped in a fierce fire and upon lifting of the relief valve a stream of escaping vapour was ignited.

The LPG tank farm where the sphere was located consisted of four 1200 m3 propane and four 2000 m3 butane spheres. The fire brigade arrived on site, but were not experienced in dealing in refinery fires, and it appears they did not attempt to cool the burning sphere. They concentrated their hoses on cooling the remaining spheres. About 90 minutes after the initial leakage, the sphere ruptured, killing the men nearby. A wave of liquid propane flowed over the compound wall and fragments of the ruptured sphere cut through the legs of the next sphere which toppled over. The relief valve on this tank began to emit liquid.

The fire killed 18 people and injured 81 others. Five of the storage spheres were destroyed.

KEY ISSUES:
• DESIGN CODES – PIPEWORK
• SECONDARY CONTAINMENT
• OPERATING PROCEDURES
• EMERGENCY RESPONSE / SPILL CONTROL
• DESIGN CODES – PLANT

Image Credit: Fonds Georges Vermard

One worker died after hazardous chemical vapors released from an over-pressurized reactor burned his respiratory system. The worker charged chemicals inside a reactor vessel and a reaction started before he could close it.

OSHA’s proposed penalties total $87,780

Proximate causes:
• Inadequate management/supervision

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Google Maps

On January 9, 2014, West Virginia Department of Environmental Protection (WVDEP) inspectors arrived at the Freedom Industries (Freedom) chemical storage and distribution facility in Charleston, West Virginia, in response to complaints from the public about a chemical odor. Upon arrival, WVDEP inspectors discovered a chemical leaking from tank 396, an aboveground storage tank (AST). The leaking tank contents were originally reported as crude methylcychohexanemethanol (MCHM), but 13 days later Freedom reported it was a mixture of Crude MCHM and polyglycol ethers (PPH, stripped) called Shurflot 944.5 The chemical mixture escaped tank 396 through two small holes on the tank floor and traveled down a descending bank into the adjacent Elk River. The holes were caused by pitting corrosion that initiated on the internal surface of the tank floor. The tank contents drained into the gravel and soil surrounding tank 396 and found multiple pathways into the river. The secondary containment or dike wall, originally designed to control leaks, had cracks and holes from disrepair that allowed the mixture, containing Crude MCHM and PPH, stripped, to escape the containment. The leak also found a pathway to the river through a subsurface culvert, located under adjacent ASTs.

After prompting by WVDEP, Freedom took action to stop the leak and prevent further contamination by deploying services to recover the spill and vacuum the remaining tank contents. However, nearly 11,000 gallons of a mixture containing Crude MCHM and PPH, stripped had already entered into the surrounding soil and Elk River. Once in the river, it flowed downstream to the intake of the West Virginia American Water (WVAW) water treatment facility, about 1.5 miles downriver from Freedom. WVAW’s water treatment and filtration methods were unable to treat and remove all of the chemical mixture in its water treatment process and as a result, it contaminated the drinking water within WVAW’s distribution system. That evening, WVAW issued a Do Not Use (DNU) order for 93,000 customer accounts (approximately 300,000 residents) across portions of nine counties.

KEY ISSUES:
• TANK INSPECTIONS & MAINTENANCE
• RISK COMMUNICATION
• PUBLIC WATER SYSTEMS SAFETY & RISK ASSESSMENT
• TOXICOLOGICAL INFORMATION

ROOT CAUSES:
1. Corrosion of primary containment
2. Deteriorated secondary containment

Image credit: CSB

On January 16, 2002, highly toxic hydrogen sulfide gas leaked from a sewer manway at the Georgia-Pacific Naheola mill in Pennington, Alabama. Several people working near the manway were exposed to the gas. Two contractors from Burkes Construction, Inc., were killed. Eight people were injured–seven employees of Burkes Construction and one employee of Davison Transport, Inc. Choctaw County paramedics who transported the victims to hospitals reported symptoms of hydrogen sulfide exposure.

KEY ISSUES:
• REACTIVE HAZARD IDENTIFICATION
• HYDROGEN SULFIDE SAFETY
• EMERGENCY RESPONSE

ROOT CAUSES:
1. Good engineering and process safety practices were not followed when joining the drain from the truck unloading station and the oil pit to the acid sewer.
2. There was no management system to incorporate hazard warnings about mixing sodium hydrosulfide (NaSH) with acid into process safety information.

Image Credit: CSB

On 17 January 1981 at approximately 00:07 hours operators on the plant observed an explosion followed by a fire. They immediately evacuated the area. On-site security initiated the on-site emergency procedures and called both the works fire brigade and the local authority fire brigade. Staff in a nearby control room initiated shut down procedures.

On arrival at the site the fire service set up two cooling sprays onto LPG pipelines within the plant. The deployment of additional water sprays was advised to protect unaffected pipelines (carrying kerosene, white spirit, petrol, fuel gas, high pressure steam, low pressure steam and lubricating oil) from the heat of the burning propane.

Residual propane in the plant was permitted to burn off and the severity of the fire gradually diminished. By 07:58 hours the fire was under control. Isolated pockets of oil residues continued to burn for some hours later.

Propane gas, contained in two 20 tonne storage vessels, was consumed by fire, and the area around the vessels was severely damaged.

The incident investigation believed that the release of gas occurred as the result of a damaged seal on a propane recirculating pump. Fire damage of control cables made process isolation difficult.

Fire severely damaged the de-asphalting plant and pipe work, the supporting structures and the feedstock storage tanks

KEY ISSUES:
• INSPECTION / NON-DESTRUCTIVE TESTING (NDT)
• ACTIVE / PASSIVE FIRE PROTECTION

Image Credit: Ben Brooksbank

An explosion occurred at one of Petrobras’ refineries. The blast occurred at a hydrogen conduit in an enclosed space, causing a flare and a displacement of air that threw the contract workers against the refinery’s metal structure.

Proximate causes:
• Inadequate maintenance
• Failure following procedures
• Lack of work rules/policies/ standards/procedures
• Physical condition (the accident may have been the result of maintenance work being carried out under tight deadlines and long shifts imposed on refinery workers)
• Mental stress
• Mental state

Source: A web-based collection and analysis of process safety incidents (https://www.sciencedirect.com/science/article/abs/pii/S0950423016302285)
Image Credit: Daily Motion

On January 22 and 23, 2010, three separate incidents at the DuPont plant in Belle, WV, involving releases of methyl chloride, oleum, and phosgene, triggered notification of outside emergency response agencies. The incident involving the release of phosgene gas led to the fatal exposure of a worker performing routine duties in an area where phosgene cylinders were stored and used.

Operators discovered the first incident, the release of methyl chloride, the morning of January 22, 2010, when an alarm sounded on the plant’s distributed control system monitor. They confirmed that a release had occurred and that methyl chloride was venting to the atmosphere. Managers assessing the release estimated that more than 2,000 pounds of methyl chloride may have been released over the preceding 5 days.

The oleum release, the second incident, occurred the morning of January 23, 2010. Workers discovered a leak in an overhead oleum sample pipe that was allowing a fuming cloud of oleum to escape to the atmosphere. The plant fire brigade, after donning the appropriate personal protective equipment, closed a valve that stopped the leak about an hour after it was discovered. No injuries occurred, but the plant called the Belle Volunteer Fire Department to assist.

The third incident, a phosgene release, occurred later that same day when a hose used to transfer phosgene from a 1-ton cylinder to a process catastrophically failed and sprayed a worker in the face while he was checking the weight of the cylinder. The employee, who was alone when exposed, was assisted by co-workers who immediately responded to his call for help. Initial assessments by the plant’s occupational health nurse indicated that the worker showed no symptoms of exposure prior to transport to the hospital for observation and treatment. A delayed onset of symptoms, consistent with information in phosgene exposure literature, occurred after he arrived at the hospital. His condition deteriorated over the next day and he died from his exposure the next night.

KEY ISSUES:
• MECHANICAL INTEGRITY
• ALARM MANAGEMENT
• OPERATING PROCEDURES
• COMPANY EMERGENCY RESPONSE & NOTIFICATION

ROOT CAUSES:

Methyl Chloride Incident (January 22, 2010)
1. DuPont management, following their Management of Change process, approved a design for the rupture disc alarm system that lacked sufficient reliability to advise operators of a flammable methyl chloride release.

Oleum Release Incident (January 23, 2010)
1. Corrosion under the insulation caused a small leak in the oleum pipe.

Phosgene Incident (January 23, 2010)
1. DuPont’s phosgene hazard awareness program was deficient in ensuring that operating personnel were aware of the hazards associated with trapped liquid phosgene in transfer hoses.
2. DuPont relied on a maintenance software program that was subject to changes without authorization or review, did not automatically initiate a change-out of phosgene hoses at the prescribed interval, and did not provide a back-up process to ensure timely change-out of hoses.
3. DuPont Belle’s near-miss reporting process was not rigorous enough to ensure that the near failure of a similar phosgene transfer hose, just hours prior to the exposure incident, would be immediately brought to the attention of plant supervisors and managers.
4. DuPont lacked a dedicated radio/telephone system and emergency notification process to convey the nature of an emergency at the Belle plant, thereby restricting the ability of personnel to provide timely and quality information to emergency responders.

Image credit: CSB

The Bermuda registered LPG tanker Havkong, berthed at the Braefoot Bay Marine Terminal in the River Forth in fine weather on 23 January 1993. The ship moored alongside, in compliance with the terminal’s Jetty Regulations, including those related to moorings. However the winch and fairlead positions aboard Havkong were such that, despite deploying lines in excess of those required, the final mooring pattern geometry resulted in only two lines contributing restraint against westerly winds.

At 18:50 hours, when Havkong had loaded approximately 6000 tonnes of a nominated 15 000 tonne cargo of butane, the Braefoot Bay area was subjected to an unusually violent squall. This squall produced a veering westerly wind with gusts in the order of 80 knots (92 mph) superimposed on a mean wind speed that reached 62 knots. The resulting additional loading on the mooring system was resisted only by the forward backsprings. The winch brakes for these were overcome and the ship began to move ahead along the berth driven by the wind. As she gathered momentum the loading arms reached their envelope limits and successfully disconnected with no spillage of cargo. The remainder of the mooring lines failed one by one as the load came upon them sequentially.

Havkong began to swing under the influence of both the wind and the last of the moorings and drifted eastwards, broadside to the wind. She cleared a ship on the other berth, which was loading ethylene, by approximately 20 metres. About eight minutes after breaking away her engine was ready for use and this was used to keep the ship in the deep-water channel as she drifted downwind while the anchors were prepared. She was eventually brought to anchor approximately one mile east of the berth. A pilot boarded her to assist and tugs arrived. With tug assistance the ship was manoeuvred out into the main channel and then to a designated anchorage. The incident was declared over at 22:55 hours when Havkong anchored in Kirkcaldy Bay.

The available evidence leads to a conclusion that Havkong grounded lightly, probably on two occasions, during the incident. However, no damage was done to the hull and her cargo containment remained intact. There were no injuries on board and no spillage of cargo. Damage to the ship was limited to some deformed rails near the manifold and minor damage to one manifold line. As a result of the ship’s movement there was minor damage to the access gantry, loading arms and navigation light on the jetty.

The inadequacies in Shell Expro’s system for dealing with high wind speeds did not in themselves contribute to the incident. However, they led to the highly unsatisfactory situation that when the Havkong broke free from its moorings, terminal staff were caught by surprise with the ship still loading normally, despite wind speeds above the limits specified for stopping loading and disconnecting.

KEY ISSUES:
• EMERGENCY RESPONSE / SPILL CONTROL
• CONTROL ROOM DESIGN
• OPERATING PROCEDURES
• DESIGN CODES – JETTIES

Image Credit: ShipSpotting.com

On January 30, 2007, a propane explosion at the Little General Store in Ghent, West Virginia, killed two emergency responders and two propane service technicians, and injured six others. The explosion leveled the store, destroyed a responding ambulance, and damaged other nearby vehicles.

On the day of the incident, a junior propane service technician employed by Appalachian Heating was preparing to transfer liquid propane from an existing tank, owned by Ferrellgas, to a newly installed replacement tank. The existing tank was installed in 1994 directly next to the store’s exterior back wall in violation of West Virginia and U.S. Occupational Safety and Health Administration regulations.

When the technician removed a plug from the existing tank’s liquid withdrawal valve, liquid propane unexpectedly released. For guidance, he called his supervisor, a lead technician, who was offsite delivering propane. During this time propane continued releasing, forming a vapor cloud behind the store. The tank’s placement next to the exterior wall and beneath the open roof overhang provided a direct path for the propane to enter the store.

About 15 minutes after the release began, the junior technician called 911. A captain from the Ghent Volunteer Fire Department subsequently arrived and ordered the business to close. Little General employees closed the store but remained inside. Additional emergency responders and the lead technician also arrived at the scene. Witnesses reported seeing two responders and the two technicians in the area of the tank, likely inside the propane vapor cloud, minutes before the explosion.

Minutes after the emergency responders and lead technician arrived, the propane inside the building ignited. The resulting explosion killed the propane service technicians and two emergency responders who were near the tank. The blast also injured four store employees inside the building as well as two other emergency responders outside the store.

KEY ISSUES:
• EMERGENCY EVACUATION
• HAZARDOUS MATERIALS INCIDENT TRAINING FOR FIREFIGHTERS
• 911 CALL CENTER RESOURCES
• PROPANE COMPANY PROCEDURES
• PROPANE SERVICE TECHNICIAN TRAINING

ROOT CAUSES:
1. The Ferrellgas inspection and audit program did not identify the tank location as a hazard. Consequently, the tank remained against the building for more than 10 years.
2. Appalachian Heating did not formally train the junior technician, and on the day of incident he was working alone.
3. Emergency responders were not trained to recognize the need for immediate evacuation during liquid propane releases.

Image credit: CSB

This incident occurred at Synthron, LLC’s Morganton, North Carolina, facility. The company manufactured a variety of powder coating and paint additives by polymerizing acrylic monomers in a 1,500 gallon reactor.

The company had received an order for slightly more of an additive than the normal size recipe would produce. Plant managers scaled up the recipe to produce the required larger amount of polymer, and added all of the additional monomer needed into the initial charge to the reactor. This more than doubled the rate of energy release in the reactor, exceeding the cooling capacity of the reactor condenser and causing a runaway reaction.

The reactor pressure increased rapidly. Solvent vapors vented from the reactor’s manway, forming a flammable cloud inside the building. The vapors found an ignition source, and the resulting explosion killed one worker and injured 14. The blast destroyed the facility and damaged off-site structures.

KEY ISSUES:
• REACTIVE HAZARDS & SAFEGUARDS
• CORPORATE OVERSIGHT
• SAFE OPERATING LIMITS
• EVACUATION PLANNING & DRILLS

ROOT CAUSES:
1. A lack of hazard recognition.
2. Poorly documented process safety information & ineffective control of product recipe changes.
3. Lack of automatic safeguards to prevent or mitigate the effects of loss of control over the reaction.
4. Improper manway bolting practices and poor operator training.
5. Inadequate emergency plans drills.
6. Inadequate corporate oversight of process safety.

Image credit: CSB