During a maintenance operation in a refinery, two operators opened the wrong purge. Four hundred litres of naphtha spilled out and caught fire. The operators were not qualified to perform this task and, like 10% of their colleagues, did not follow the operating procedure. The authorities noted persistent shortcomings in the facility operator's safety culture.
Source:Aria database
Leak of boron trifluoride (ARIA 51230) Five employees were hospitalised following the release of 15 kg of BF3 during the restart of a petrochemical site. A valve had remained open during a leak test performed the previous day. The operating procedure did not specify the position of the valve (not identified in the DCS) upon completion of the test.
Ammonia leak incident:
When a service provider was filling a tank, 2.1 m³ of NH3 was released via a drain. The day before, the technician preparing the operation was interrupted to take an urgent sample. The service provider's procedures did not provide for an inspection of the installation.
Source: Aria database
An exothermic runaway chemical reaction abruptly occurred within a production facility when an operator initiated an automated sequence to add water inside a multi-purpose batch reactor. The reactor suddenly experienced a pressure build-up due to its foaming content, but the automated control system was not able to regulate it. The glass reflux condenser burst while the rupture disc remained unbroken, given that its bursting pressure had not been reached. The irritating HCl vapours released in the facility was evacuated outside through the ventilation system. These vapours affected 7 people in the neighbourhood, 2 of whom would be kept in hospital overnight for observation.
The investigation conducted revealed that the sudden exothermic reaction followed a 30-litre spill of water into the reactor instead of the 3-litre quantity indicated in the procedure. The 32-litre water tank was connected to the reactor via a pipe fitted with 2 valves. The first valve, activated by the automated control system, normally delivers 3 litres of water, while the second manual valve is supposed to stay in the closed position at the beginning of this water addition sequence. During the accident however, the manual valve was left open, and this oversight led to quickly draining the 30 litres water content of the tank into the reactor. The exothermic reaction was triggered, and the sole control system designed to prevent chemical runaway was unable to function properly, since the system was designed to provide a control of the water added to the reactor through the closure of the second valve.
Moreover, the manual valve, which was not equipped with an open/closed position indicator, could not be easily reached by the operator, making it difficult to control. This risk of exothermic reaction had been identified during the process safety study (i.e. the Hazard and Operability Study, or HAZOP), but at the time of the accident only a call for procedural improvements had been issued. The company limits the maximum volume of water which can be added at one time in the reactor and improves the automated control system. The safety studies (HAZOP) are updated for all exothermic reactions carried out on in this apparatus. A particular attention is paid to consequences of operating failures and a balance is found between risk control measures and the potential severity of the consequences.
Source:Aria database
At 9:20 a.m., a rupture disc of a reactor used to produce an organomagnesium compound burst when the reactor’s internal pressure rose too high. The incident was caused by a nonconforming mixture that had formed in the reactor. First, the ambiguous instructions led a technician to add an insufficient amount of initiator. Then, seeing that the reaction had not yet started, a second technician added more reagents. The process sheet indicated that the reagent could be added after, but only after receiving the supervisor’s approval.
The operation took place on a Saturday and the chemical engineer belatedly informed the on-duty engineer. This lack of communication between the workers of both shifts and the technicians’ lack of experience are what set the stage for the incident.
The operator subsequently implemented a number of changes : tracking of technicians who are accredited to carry out synthesis operations has been reinstated ; the process sheet now indicates the amounts of reagent to be added and includes hold points for the start of the reaction ; the reaction may no longer be carried out over the weekend and it must be scheduled at the beginning of a shift so that workers may monitor it from start to finish. In addition, the operator conducted an in-depth review of organomagnesium compound synthesis in order to establish production standards and problem-management guidelines applicable at all its similar production sites.
Source:Aria database
PRECAUTIONS FOR TANKS WITH INBUILT HEATING COILS:
Design of facilities:
Three interacting elements need to be taken into account when designing installations, particularly in terms of their compatibility with the operating conditions: - the nature of the products stored: flammable or non-flammable, likely to generate decomposition products that are themselves flammable or even explosive, requiring or not requiring temperature control; - the materials used for the storage tanks: flammable or non-flammable, and must be resistant to the products stored; - the heating elements: essential or non-essential, electric or using a thermal fluid (steam, hot water, heat transfer fluid, etc.), sized for a specific heating power.
Reliable control equipment: - products are present in the tanks to prevent heating if tanks are empty (level and weighing sensors, etc.) - temperature of the thermal fluids used, the products contained in the tank, the atmosphere in the tank, etc. (appropriately positioned probes and sensors); - heating is controlled by the presence of product and by temperature control; - no contact between the heating elements and the tank’s walls; - monitoring of all of the installation’s operating and safety parameters.
Regulated operating conditions: - preventive maintenance of facilities and equipment to prevent failures; - operating and intervention instructions (concerning the start-up of facilities in manual or automatic mode, shut-down of heating systems before intervention requiring tank emptying, after all interventions, etc.) - training of personnel in procedures and operating instructions; - monitoring and supervision of the installations during operations (the night prior, at night, early in the morning); - verification that all instrumentation and control channels are operating correctly, that the servocontrol and command logic is functioning correctly, and verification of automatic operation programmers.
Source:Aria database
An explosion occurred in a metal bitumen tank (15 m high) in a company that manufactures, stores and distributes bitumen emulsion. The top of the tank was blown off and landed more than 45 m away on the grounds of the neighbouring facility. Upon arriving at the site, the operator switched off the electricity to the entire facility. The site was shut down. The tank in question was destroyed, and two other tanks were damaged in the explosion. The amount of bitumen in the tank was less than indicated by the sensor (10 tonnes) and insufficient to cover the resistors completely. The system began heating the fluid and caused the temperature in the tank to rise because the temperature sensor was not immersed in the bitumen. The heating system thus operated at its maximum level. The temperature rise caused a fire to break out, which ignited the combustion gases. The course of the accident implies that the level sensor had failed.
Source:Aria database
A fire broke out on a tank containing 0.3 t of a mixed acid solution feeding a phosphating production line. The security guard raised the alarm. The tank eventually ruptured, spilling product into a retention basin. The fire resulted in an economic loss of €40,000. The fire is believed to have been caused by a faulty electrical component on the level sensor and the combustible nature of the tank (PE plastic). The line involved had been out of operation for maintenance since 20/12/2018. On 28/12/2018, the preventive maintenance was completed after 4 hours of testing. The line had been in preheating mode just 6 minutes before the fire broke out. Following the fire, a variety of actions were implemented: . modification of the tank’s materials (stainless steel); . replacement of the control relays (as a preventive measure); . modification of technology used to measure bath level; . installation of a preventive maintenance system with a thermal camera.
Source: Aria database
An explosion and fire occurred at night in a workshop set up to synthesise toluene diamine (TDA), by means of hydrogenating dinitrotoluene (DNT) in the presence of Raney nickel, during a scheduled maintenance downtime. In-house fire-fighters brought the fire under control within 35 min; in the meantime, four employees required hospitalisation. One of them, who was handling the valves to wash the hydrogenation reactors with isopropanol, sustained burns over 40%-50% of his body and died 15 days later. The workshop was completely destroyed. The reactor burst; the bunker housing the workshop was deformed due to the combined action of the blast wave and sprayed fragments; the reinforced concrete wall was ripped open, with rebar twisted; and the control room was heavily damaged. Glass panes were broken over a 50- to 100-m radius, while the distillation unit juxtaposing the bunker was damaged and allowed isopropanol and TDA to escape, adding fuel to the fire. Buildings belonging to the neighbouring industrial facility located 150 m away suffered deformations to their lightweight structures.
According to the investigation conducted, this explosion resulted from injecting pure DNT into one of the reactors washed by the circuit used at the time of production startup. Two valves connected in series equipping this DNT feed line were found partially opened (at 10°) after the accident, most likely allowing 500 to 700 kg/h of product to flow into the reactor. The heat release upon hydrogenation of a small quantity of DNT probably triggered the sudden decomposition of the remaining DNT, while abruptly reheating the reaction medium. Corrective measures were adopted to prevent routing pure dinitrotoluene into the reactor. These were elimination of the DNT intake line on the injection tank, addition of two automatic on-off valves on the mixing tank’s DNT feed line, closure of the link (by an automatic on-off valve) between the mixing tank and the injection tank during the reactor washing
A reactor exploded in a fine chemicals plant during the chlorination of an alcohol by thionyl chloride (SOCl2 ). The relatively non-exothermic reaction took place in a solvent medium (1,2 dichloroethane or DCE), under a slightly lower pressure and a temperature of 70°C maintained by means of steam injection. The reactor initially contained the SOCl2 in solution in the DCE, with the alcohol being added under close monitoring for 30 hours.
At the time of the accident, the reactor was being fed for three hours by successive 200- litre loads of alcohol, with the first injection still incomplete. Monitoring performed by two technicians, one of whom was a trainee, included an hourly reading of both the temperature and pressure drop; no anomaly had been observed until that point. Upon hearing a noise accompanied by a break to the protective disc on the glass column connected to the reactor and noticing smoke around the disc joints, the technician turned the feeder control box selector switch to the “off” position. As he closed the alcohol feed valve and was making his way to the valve used to shut down steam injection, he spotted that leaking on the column was becoming more persistent. He immediately left the unit, requesting that a co-worker follow him out — at which point the explosion happened. A rupture disc calibrated at 0.3 bar and the glass fixtures on top of the device burst. The explosion or toxic gases emitted once the equipment had broken killed the trainee technician, who did not exit the premises quickly enough.
The feeder was equipped with two valves. The upper one (loading side) was found in the closed position while the lower valve (reactor side) was open with a reversal of the pneumatic control hoses. These recordings supported the hypothesis of an accidental addition of water into the reaction medium via the feeder. The laboratory simulation of such an addition found that the SOCl2 hydrolysis with the formation of SO2 and HCl led to a sudden pressure rise.
Source:Aria database
At a plant producing intermediate organic synthesis compounds, a runaway reaction coupled with an explosion (approx. 1 kg of TNT equivalent) took place in the 3.5-m high glass column overlooking a 3,000- litre reactor. The explosion triggered a fire outbreak inside the unit. A 110-kg cloud of hydrochloric acid (HCl) hovered over the site before dispersing after a few minutes due to a favourable wind. The noise alerted the technical staff, who promptly placed the installation in safe operating mode and launched the internal emergency plan. The staff began to fight the fire using the resources at hand, and were then joined by fire-fighters who brought the blaze under control within twenty minutes. One employee sustained loss of hearing due to the explosion and property damage amounted to €700,000.
On the day of the accident, a batch production had been underway involving the addition of 1,000 kg of a cold liquid ethylene compound along with 750 kg of a highly flammable and volatile silyl (hydrosilane). The homogeneous mix was then supposed to be poured into a 2nd reactor at 100°C in the presence of a catalyst to form the final product. The hydrosilylation reaction was maintained under control by gradually introducing the mix. However, in this incident, a sudden rise in mix temperature caused a pressure surge and a pneumatic burst of the column. The hydrosilane was hydrolyzed into HCl upon coming into contact with humid air and then decomposed into the hydrogen that triggered this fire.
The investigation revealed that in order to compensate for the loss of catalyst activity (this was the seventh consecutive batch), which would have necessitated an extended batch time, a technician took the initiative to insert around 10g of new catalyst into the reactor at the same time as the raw materials. Data studies and laboratory tests actually indicated that the reaction could not have started in the low temperature reactor (5-20°C), since deviation from the temperature required for synthesis (at 90°C) appears to safeguard the reaction safety of this modification, i.e. now deemed to be minor. Nonetheless, the tests conducted by the operator following the accident revealed that at these temperatures, an exothermic hydrosilylation reaction could arise following an induction period lasting several hours in the presence of trace alcohol amounts. Since the catalyst had been placed in solution with a ketone, an infinitesimal quantity of ketone (in the order of 0.01%) was found in the mix inside the reactor and subsequently reduced to alcohol by the hydrosilane. Despite an extensive process of analysing reaction risks plus the synthesis of 36 batches without an accident in six years, the accident occurred on the only batch for which the process had been slightly modified.
The operator reminded plant technicians that: 1. this modification should have been rated as significant and undergone an in-depth, collective analysis prior to implementation; and 2. any modification to a process must be justified and accompanied by compensatory safety measures.
Source:Aria database
A transformer caught on fire at 7:45 pm on a production building’s basement floor at a pharmaceutical plant. The building’s electrical power was cut, causing shutdown of the reactors’ stirring and cooling mechanisms. An exothermic reaction that was taking place at the time became uncontrollable. The reactor’s rupture disc, calibrated at 4 bar, broke, and the explosion vent opened to protect the structural integrity of the reactor. A quantity of the reaction mix at 70°C, composed of several hazardous products, projected onto one employee and six fire-fighters in the vicinity and formed a 60-m² puddle on the floor.
The plant operator activated the internal emergency plan and the facility was evacuated. The safety report conducted on-site had not identified any comparable scenario. No backup source had been allocated to ensure the continued operations of critical equipment. Activities assigned to the damaged building and associated solvent storage zone were suspended until the safety systems (fire detection control, both post and automatic extinction) were once again operational. A diagnostic assessment of all site electrical installations was performed, along with a study, on the backup power supply for critical equipment, dedicated to exothermic reactions, i.e.: cooling, stirring, temperature and pressure probes.
Source:Aria database
A thunderstorm struck in the vicinity of a flammable liquid storage facility protected by an early streamer emission lightning rod. The indirect effects of the lightning damaged one of the 4 computer interface cards. This particular card had interfaced with the bus network responsible for relaying high-level safety alarms from the storage tanks. The facility operator detected the malfunction via the depot supervisor, who had indicated the communication breakdown. The operator did not possess a backup card and was unable to perform a quick replacement. He decided to inform the entire operating staff and requested extra vigilance when monitoring the performance sheets. Operations continued in this manner for 5 days before the interface card could actually be replaced. The damaged card had not been protected against indirect lightning effects. Following this accident, the operator kept on hand an additional card as a backup and implemented the recommendations issued in the study on indirect lightning effects conducted in April 2006. These recommendations focused on the protection, mainly by lightning rod, of the supervisor’s computer, alarm relay units, sensors, utility rooms, fire pumps serving 3 depots, and the electric generating sets for 2 sites.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
On a tubular exchanger, a disc broke over ¼ of its cross-section at 4:50 am during a pressure surge in the liquid ammonia (NH3 ) circuit connecting NH3 storage cells to a urea workshop operating under stable conditions. NH3 was partially led to a 100-m high degassing stack. Given stable weather conditions, a foul-smelling cloud drifted towards the city. The release occurred unbeknownst to control room operators, who had incorrectly interpreted several alarms that had tripped. Once the diagnosis rendered, the device was isolated at 6:25 am. The plant operator only became aware of the severity of the event at 8 am; two and a half hours were then needed to fully determine the origin and likely causes. The 10 tonnes of NH3 release was due to a succession of physical, organisational and human malfunctions: - Lack of anomaly detection and automatic safety systems: information made available to control room operators was inadequate; - Poor diagnosis / decision-making process lacking adequate verifications despite several precursors; - Incomplete safety recommendations, insufficient monitoring procedures and inspection plans. This poor diagnosis would explain the delay required to isolate the deficient circuit and the potential impact of this release. Long periods elapsed between the onset of the accident, the alarm and activation of the internal emergency plan, source identification, causes and circumstances of the discharge, and then a definitive quantification.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
In a Seveso chemical plant, a fire broke out at 12:59 pm in a substation supplying a hydrazine hydrate unit. An electrical fault on a cooling water pump caused a generalised short circuit on an electrical tower. The fire alarm was triggered at 1.00 pm. The fire spread to the other towers of the panel through the subfloor. The 400 V circuit breaker located upstream was blocked and did not function. The fault current passed through the 13,000 / 400 V transformer, there was overpressure and an oil leak followed by a primary side homopolar fault causing the 13 kV circuit breaker to trip. The absence of voltage caused the diesel generator set to stop but the switchover to the emergency system failed as the automatism was damaged by the fire. The smoke spread to the UPS room whose door remained opened. The UPS stopped when a high temperature (> 40 °C) was reached causing the loss of control and command on the process. The component switched over to safety mode. Due to the lack of power supply, the cooling system, agitation and the internal and external emergency plan siren were no longer functional. Since the ongoing reaction was exothermic, the reactor temperature and pressure increased. Several measures are taken such as designing an emergency cooling circuit, improving circuit breaker maintenance, sectoring UPS system, electric boards, generator sets, etc.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
A leak of over-pressurised and overheated glycol water occurred at a chemical plant after the rupture of a pipe joint. At 2 am, a control room operator recorded a drop in coolant temperature (150°C), preventing vacuum drying operations from continuing. On-call staff diagnosed a loss of communication link between the plant’s utilities automated system and the plant’s process automated system. A specialist in such systems confirmed the defect of a card on the utilities automated system, whose replacement had been postponed until the next morning. Once the specialist left the premises and confident of his diagnosis, the on-call maintenance operator decided to restart the unit. He short-circuited all of the safety mechanisms for hot fluid monitored by the process system, and replicated the corresponding settings in manual mode. Called by another workshop an hour later, the operator abandoned the post for 30 min. Upon his return, the hot fluid had exceeded 180°C, and a noise resembling a detonation shook the plant. After joint rupture, the glycol water vaporised on the premises, which were closed immediately thereafter.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
At a facility producing carbonate and sodium bicarbonate, fire broke out at 7 am in an electrical cabinet containing transmission cables for the liquid part of the process. The blaze caused a complete loss of control for 2 hours and a shutdown of the process responsible for releasing 2 to 8 kg of gaseous ammonia (NH3) into the atmosphere, subsequent to the sudden stoppage of the gas scrubber. In addition, ammonium hydroxide was released into the plant’s accidental pollution retention basin following discharge of a brine tank; this water made its way into the nearby river given that retention basin controls and monitoring installations had become unresponsive. This discharge wound up causing the death of some 400_kg of fish. According to the facility operator, the heating of electrical cables, traced to worn insulation, had triggered the incident. The control system, composed of control stations, a connecting bus and an automated system programmed to monitor the process, had been designed with a critical point in the form of a «node» at the time of creating the site’s 1st control system (26 years prior), through which all automated system cables were routed. Whereas all electrical component supply lines had been backed up, the automated system cables ran through a single cable tray in the electrical cabinet.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
Inside a chemical plant, a sulphur dichloride (SCl2) leak on a pipeline supplying the boiler tube of a distillation column hydrolysed, thereby generating a strong emission of hydrogen chloride (HCl). 50 ppm of HCl were recorded inside the building. Operating losses were valued at Euros 270,000 (the downstream unit stayed idle for 18 days). A pressure sensor was undergoing maintenance; it had been diagnosed as defective after indicating a reading of 108 mbar of pressure at the boiler tube output, thus triggering closure of the valves controlling SCl2 supply and regulating the vapour heating the boiler tube. Since the sensor was not «fail safe», its electrical disconnection caused the vapour regulation valve to open, thus heating the boiler tube, whose temperature rose from 24° to 120°C in 30 min, and causing the emission of SCl2. Several measures were adopted as part of the feedback provided: monitoring and intervention procedures in a degraded operating mode, modification of the sectional valve / pressure sensor assembly, introduction of a positive safety loop independent of the regulation, thereby prohibiting any automatic restart once the high pressure threshold had been reached. This accident demonstrates that a process control system can in no way be equated with a safety system. More specifically, industrial automation satisfy a rationale and criteria that are not all known by response teams and that do not necessarily incorporate degraded modes and lockouts situations.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
Dimethyl sulphate (DMS) began leaking around 11 am at a chemical plant as the product was being loaded. The connection between the DMS container and the loading station consisted of disassembling the solid flanges, replacing the joint by a new part and reconnecting the container flanges to the unit’s pipe flanges. After initiating DMS loading in the control room, the field operator climbed down to inspect the container and, at that point, identified a leak on the flange connecting the container to the loading pipeline. He sounded the siren and the emergency light before pressing the emergency stop button. The next day, the plant operator concluded that the leak had been caused by poor clamping of the loading flange while the container was connected to the loading station. Moreover, the safety automated system was not activated because the pushbutton had not been held down long enough for its cycle length (1/10th of a second). All emergency stop pushbuttons were replaced by locking buttons throughout the site.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
At 6:55 am, a propane ship unloaded its cargo into 2 mounded spherical storage tanks at a Seveso plant. At 8:50 that evening, the liquid phase had been completely unloaded and the vessel’s pumps were turned off. Unloading of the gaseous phase via the ship’s compressors began a few minutes later. At 9:35 pm, the 2 relief valves on one of the tanks opened at their calibration level (10.9 bar) for 30 seconds. The on-duty pump operator stopped the transfer and connected the 2 spheres in order to lower the pressure, steadying it at 9.8 bar. The plant manager and ship captain jointly decided to halt the unloading operation and monitor pressure of both tanks every 30 minutes. According to the site operator, the sphere’s pressure rise from 9.2 to 10.9 bar in 35 min was due to the simultaneous use of both propane ship compressors to accelerate unloading. The installation inspection revealed that pressure alarm thresholds on the sphere had been set at a higher value than the valve calibration pressure. Subsequent to the incident, the pre-alarm levels (visual and sound) and sphere alarm were calibrated at 10.4 and 10.7 bar, respectively, i.e. below the valve tripping values. The effective closure of the sphere filling valve and opening of the spraying valve were both prominently displayed on the control room displays
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
Inside a petrochemical unit, a steam supply problem encountered at the site’s steam production plant caused activation of the cracked gas compressor. The steam cracker was immediately shut down and the gases routed to the flare, resulting in the flaring of 800 tonnes of a hydrocarbon mix between Saturday evening and Sunday end of the afternoon. The unit’s supply was being provided by 2 boilers, one serving as a backup to the other. During the incident, one of the boilers was taken off-line for maintenance, leaving just a single boiler running. The idle boiler had undergone numerous safety tests, one of which called for closing the intake valve. The test operator mistakenly closed the fuel intake valve on the operating boiler from the control panel, causing a significant and sudden drop in steam supply to the units. With the steam cracker shutting down immediately, the installations were degassed and the flare network used as a backup for hydrocarbon ignition. To mitigate this type of error, the site operator improved boiler differentiation appearing on the control room’s graphic interfaces.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
A fire broke out on the vacuum distillation unit in a refinery during its shutdown. The unit had been restarted the day before following the acceptance of the work, while other job sites were still underway at the site. The reheating operation had begun during the night, and the unit was still in the power build-up phase. At around 9.15 am, thick black smoke was observed coming from the stack (fire in the furnace), with flames shooting from the open explosion vents. This situation was preceded by hammering in the pipes and rising pressure in the tower increase and the opening of valves: hydrocarbons began spilling outside. Following the inquiry, it appears that erroneous level indicators caused the tower to be overfilled then the backflow of liquid into the furnace via the vacuum system (backflow of incondensable materials). A brief summary of the findings: the local levels were not visible, the chain associated with the control levels in the bottom of the tower had not been completely checked (card), and the configuration of the system and notably the extraction levels were not correct.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
Subsequent to a tube break inside a refinery, fire ignited on a furnace. The emergency shutoff system was tripped and the unit became depressurised via the tube that broke inside the furnace. During this incident, the unit was on a return path to its nominal flow rate. Roughly 24 hours prior to the break, following another incident, the reforming unit was operating at an extremely low flow rate over a 3-hour period. The low flow rate safety system had been bypassed without implementing any compensatory measures. The next day, this information was not even relayed to the daytime shift, with the abnormal situation leading to the quick coking of the tubes and accelerating their creep. The fire had originated from overheated tubes tied to an internal coking operation, caused by operating at an insufficient flow rate (in a breach of safety rules). In underestimating the incident occurring the previous day, the subsequent shift had not been properly informed. The environmental agency requested strengthening the refinery’s safety management rules and verifying their strict implementation, in addition to installing an alarm management system. The agency also requested: formalising both the resources to be notified in the event of a process-related incident outside of plant operating hours and the rules for overseeing unplanned shutdowns and corresponding start-ups; revising the periodic safety test acceptance protocol; and expanding training and recycling programmes thanks to the Company’s new tools, in emphasising furnaces and incident management.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
At 9:03 pm, the control room operator responsible for the catalyst section of a refinery’s fluid catalytic cracking (FCC) unit entered an erroneous opening value for the atmospheric relief valve at the discharge of a compressor blowing the air needed to suspend a catalyst inside the regenerator. This valve deviated some air flow to the compressor discharge in order to protect the compressor from pumping phenomena. The operator on duty had input, then validated, an erroneous valve opening control value (less than 10%), when he actually wanted to lower the value from 20% to 19.5%. This instruction wound up increasing air flow to the regenerator and subsequently tripping the safety mechanism for the compressor and then for the entire unit. The 15-minute unit decompression caused flare emissions, followed by a gradual shutdown. The facility management brought the unit back online incrementally between 11 pm and 5 am, resulting in new flare emissions. The updated guideline requested the panel operator to no longer enter a value, but instead solely use the «up» or «down» arrow commands to increment the initial value by 0.5% or max 1%.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
At 10:46 pm during a thunderstorm, an electrical outage interrupted polystyrene (PS) production at a Seveso-classified site. A safety disc broke and styrene was released. To minimise the effects of micro-outages (due to thunderstorms) on PS output quality, the site operator typically switched shop power supply onto the 4 electric generating sets of the facility’s Peak Day Withdrawal (PDW) unit. This manoeuvre was performed at 10:20 pm, with 3 sets still available. At 10:43, the thunderstorm knocked out the 1st set. Since the 2 remaining sets were no longer sufficient, the unit entered into safety mode at 10:46, closing all utilities. An employee tried to restart the PDW unit; the on-call electrical maintenance operator was called at 10:53 pm. By 11:05 pm, pressure on the 1st synthesis reactor had begun to rise. As per emergency procedures, gyro monitors started up at 11:15 to remove eventual vapours at the reactor line vent. The site was connected to the grid at 11:18 but the units were only allowed to resume operations a short time later. At 11:20, the disc on the 1st reactor burst at 5.8 bar, spraying a liquid mix containing 10 tonnes of PS and 3 tonnes of styrene.The runaway reactor was caused by the loss of utility service. The control room operator opened the vent too late, given all the actions required to put the 3 polystyrene lines into safe mode, in accordance with procedures.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
"The factory of the future will have only two employees, a man and a dog. The man will be there to feed the dog. The dog will be there to keep the man from touching the equipment.» Warren G. Bennis, North American consultant,1996"
HCL LEAKS FROM FURNACE FOR 10 MINUTES In a chemical plant, 0.6 tons of hydrogen chloride (HCl) escaped during a 10-minute period from all furnaces and vents within the potassium sulphate workshop while cleaning the HCl circuits. An employee living adjacent to the site notified the guard house of the presence of a cloud originating from the plant. The emergency sprinkling system connected to the washer was turned on to stop these emissions. Poor calibration of one of the two devices used to measure gas pressure at the furnace outlet (not directly related to the ongoing works), causing the control valve on the gas evacuation circuit to close, was responsible for this incident: since gases were no longer being drawn, they escaped from the furnaces. The lack of an alarm on this control parameter slowed personnel response, and the absence of any means for comparing the 2 pressure measurements prevented the detection of sensor drift. To reduce the probability of repeat occurrence, an alarm was installed to detect deviations between the 2 pressure readings; also, a procedure laying out the most sensitive steps, in particular those requiring a supervisor's presence, was issued.
Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION
Any combustible material can burn rapidly when in a finely divided form. If such a dust is suspended in air in the right concentration, under certain conditions, it can become explosible. Even materials that do not burn in larger pieces (such as aluminum or iron), given the proper conditions, can be explosible in dust form.
The force from such an explosion can cause employee deaths, injuries, and destruction of entire buildings. For example, 3 workers were killed in a 2010 titanium dust explosion in West Virginia, and 14 workers were killed in a 2008 sugar dust explosion in Georgia. The U.S. Chemical Safety and Hazard Investigation Board (CSB) identified 281 combustible dust incidents between 1980 and 2005 that led to the deaths of 119 workers, injured 718, and extensively damaged numerous industrial facilities.
A wide variety of materials that can be explosible in dust form exist in many industries. Examples of these materials include: food (e.g., candy, sugar, spice, starch, flour, feed), grain, tobacco, plastics, wood, paper, pulp, rubber, pesticides, pharmaceuticals, dyes, coal, metals (e.g., aluminum, chromium, iron, magnesium, and zinc). These materials are used in a wide range of industries and processes, such as agriculture, chemical manufacturing, pharmaceutical production, furniture, textiles, fossil fuel power generation, recycling operations, and metal working and processing which includes additive manufacturing and 3D printing.
Source: https://www.osha.gov/combustible-dust
On May 20, 2025, at approximately 8:15 a.m., approximately 8,000 pounds of toxic chlorine were released, seriously injuring one employee at a facility in Texas . The community was ordered to shelter in place, and estimated that the incident resulted in approximately $23 million in property damage.
On the day of the incident, it was planned to replace a rupture disc (RD-217N) in the chlorine liquefication unit. This safety device protected the E-209A heat exchanger
The company gave two contract maintenance workers the work package and a permit to replace the RD-217N rupture disc. At approximately 8:10 a.m., one of the maintenance workers began disassembling the RD-217N rupture disc holder using a battery-powered impact wrench. In addition to the standard protective equipment, the maintenance worker wore an air-supplying respirator with a 30-minute air bottle. At 8:15 a.m., liquid chlorine at a pressure of 100 pounds per square inch began releasing from the partially disassembled RD-217N rupture disc holder. The maintenance workers evacuated from the area. Alarm horns in the unit were activated after chlorine gas detectors identified the release. Local officials issued a shelter-in-place order for the cities. At 9:03 a.m., emergency responders closed Valve 1 to stop the release.
During the response to the incident, one emergency responder’s 30-minute air supply depleted. He switched to a cartridge-style escape respirator to exit the area, but the respirator likely became saturated with chlorine, causing him to inhale the toxic vapor. Other emergency responders then transported him to a hospital, where he was admitted for treatment.
The company's investigation found that although the work planning documents showed that RD-217N was to be replaced, its operations team had mistakenly isolated, cleared, and tagged a different but nearly identical piping system—heat exchanger E-209B—to replace a different rupture disc, RD-217S. As a result, the operations team did not isolate, clear, or tag the E-209A heat exchanger and the piping associated with RD-217N. This equipment was operating when it issued the contract workers a permit to replace the RD-217N rupture disc. The unit operator who issued the permit and the maintenance workers did not perform a field walk-through of the job. In addition, the contract workers did not review or sign the equipment isolation plan or the tag that identified the rupture disc holder to be opened. Seeking to do so should have revealed that RD-217N was in operation and had not been prepared for replacement.
Probable Cause
Based on the company's investigation, the CSB determined that the probable cause of the chlorine release was the mistaken disassembly of a rupture disc holder in an operating chlorine system. A breakdown in the equipment opening and control of work programs contributed to the incident, including the absence of a pre-job site walkthrough that should have allowed plant operators and the maintenance crew to verify the rupture disc had been prepared for replacement.
Source:CSB.gov
On February 1, 2025, around 1:36 p.m., an explosion and fire occurred at a refinery in California. It was estimated that the incident caused approximately $924 million in property damage.
On February 1, 2025, the refinery tasked contract workers with installing an isolation blind at Flange A to prepare a catalytic feed hydrotreater unit (“unit”) for turnaround maintenance. A yellow tag was placed between Valve 2 and Valve 3 to indicate the location of the blind installation. After completing a field walkthrough to verify that the piping segment between Valve 1 and Valve 2 was empty, an operator issued a permit to the supervisor of the contractor work crew at 11:30 a.m.
When the work started, two contract workers were on a scaffold that provided access to the elevated equipment. In addition to their standard protective equipment, the two workers wore supplied-air respirators. Two standby workers from a different contract company were at ground level to monitor the breathing air equipment and observe the flange opening work. At approximately 1:25 p.m., the two contract workers began unbolting Flange B. At this time, neither the workers’ supervisor nor the operator who issued the permit for the contractors to install the blind was present.
As Flange B was being unbolted, the contract workers’ supervisor returned to the work area. From his vantage point, the supervisor could not see which flange the crew was working on. Shortly thereafter, the supervisor observed and heard a pressurized release and recognized that something was wrong. One of the standby workers activated an air horn to stop the work. The two contract workers disconnected from their supplied-air hoses, jumped from the scaffold, and evacuated the area. At about 1:30 p.m., the flammable material ignited and exploded with flames erupting from the area. Hot (above 600 degrees Fahrenheit) hydrocarbon material continued to be released from Flange B, fueling the fire. The extent of the fire escalated over three days and involved other equipment until emergency responders extinguished the fire on February 4, 2025. The company reported that approximately 50,000 gallons of flammable hydrocarbon material were released over three days.
The company’s investigation found that the contract workers, hired specifically for the extra tasks during the turnaround, had not received training on the refinery’s equipment opening policies and procedures. Consequently, these workers were not aware of the company's tagging system for identifying which flange should be opened. The company’s investigation also revealed that installing this blind should have been treated as a “first break” (as written on the permit) under the refinery’s policies, because this was the initial equipment opening for this system. First breaks required a qualified operator to be present during the work to ensure that maintenance workers open the proper equipment. However, because of a miscommunication between the workers, the operator was not present when the contract workers disassembled Flange B.
The company required maintenance crews to attach their personal locks or tags to all valves used for equipment isolation. The contractor crew did not apply locks or tags to Valve 1 or Valve 2. If the crew had done so, they could have had the opportunity to better understand the existing hazards by participating in the lockout/tagout process for these valves. The permit issued to the contractor supervisor stated that the equipment was out of service. The supervisor believed that all the equipment was empty and was unaware of the active (operating) process adjacent to Valve 2.
Because the work was on a scaffold, laser pointers were used to highlight Flange A during the field walk-throughs involving the operator, contract workers, and the contractor’s supervisor. Although post-incident interviews with the operator and the contractor’s supervisor revealed that two of the four walkdown participants understood that the blind should be installed in Flange A, it is evident that the contract workers believed that Flange B was the correct location.
Following the incident, the company revised its permitting procedure. For permits that require an operator to be present, operators must now issue one permit per isolation blind only after the workers are at the job site and prepared to start the task. This change was made to help ensure an operator is present to confirm that work is performed on the correct equipment.
Probable Cause
Based on the company's investigation, the CSB determined that the probable cause of the incident was the opening of a flange that was connected to an active process containing pressurized flammable liquid hydrocarbon. When the flange was loosened, the flammable material was released and ignited (autoignition or static discharge), resulting in a large fire. The company could have prevented the incident by having a knowledgeable person present to ensure that workers unfamiliar with the equipment disassembled the correct flange and were aware of the existing hazards. Additionally, the company would benefit from improving its tagging practice to make it obvious which equipment workers should disassemble.
Source:CSB.gov
On October 8, 2024, at 8:15 p.m., a cylinder containing approximately 150 pounds of liquid anhydrous ammonia exploded, seriously injuring four employees at a facility in Louisiana.
On the day of the incident, it was planned to introduce anhydrous ammonia into equipment as part of a chemical treatment in preparation for turnaround maintenance work. To supply the ammonia, the company used a cylinder (DOT 4AA480) that contained approximately 150 pounds of liquid anhydrous ammonia (“cylinder”). The operations team wrapped the lower half of the cylinder with a rubber hose. This was done to allow steam to flow through the hose, enhancing heat transfer and preventing ice from forming on the cylinder’s external surface as the liquid ammonia inside vaporized. The steam supply was approximately 300 degrees Fahrenheit and had a pressure of about 70 pounds per square inch (psi). While the valve on the cylinder remained closed, one of the operators opened the steam supply valve to initiate steam flow through the hose while continuing preparations for the chemical treatment. As the workers continued the equipment setup, the cylinder exploded, seriously injuring three operators and an operations supervisor . Emergency responders transported the four injured employees to a hospital, where they were admitted for treatment.
The company's investigation determined that the procedure used for the chemical treatment did not cover critical safety details, such as not heating the cylinder when its outlet valve was closed. In addition, it was found that the cylinder was not protected by a pressure relief device. When the cylinder was heated, the pressure exerted by the liquid ammonia inside the cylinder significantly increased far above the cylinder’s service pressure of 480 psi, resulting in a boiling liquid expanding vapor explosion (BLEVE).
Probable Cause
Based on the company's investigation, the CSB determined that the probable cause of the incident was the uncontrolled external heating of a liquefied compressed gas cylinder without essential safeguards, including an emergency pressure-relief device. The uncontrolled heating generated tremendous internal pressure, causing the cylinder to explode. The company's process safety management systems contributed to the incident by not effectively evaluating and controlling the hazards presented by its anhydrous ammonia chemical treatment system.
Source:CSB.gov
On February 22, 2024, at 4:20 a.m., a valve leaked hot liquid hydrocarbon, which ignited, resulting in a fire in refinery in Louisiana . It was estimated that the fire caused $1.2 million in property damage.
On the morning of the incident, unit operators saw a decrease in the crude unit’s vacuum tower bottoms (VTB) flow. Field operators then found a fire near the flow control valve. Emergency responders extinguished the fire within minutes. It was reported that approximately 12,000 pounds of VTB material were released.
The comapny's investigation found that a recently installed 4-inch stainless steel globe valve in the VTB flow control station bypass piping had leaked at its pressure-retaining cover (bonnet). The valve had a Teflon (PTFE) bonnet gasket and Teflon packing, which were limited to 450 degrees Fahrenheit (℉), and were incompatible with the 650℉ VTB material. The valve was ordered in August 2023 and installed during a unit outage on February 16, 2024, six days before the incident.
The valve was equipped with two tags that provided conflicting information. When the company ordered the valve from its preferred vendor, the order included the refinery’s valve number, which specified a valve that met the process requirements by using graphite for the bonnet gasket and packing material. Teflon was not an acceptable material for this application.
The company's preferred vendor did not have this valve in its inventory, so it procured the valve from a third-party supplier. The manufacturer’s tag attached to the valve correctly indicated that it was equipped with Teflon components and stated that the valve’s maximum operating temperature was 450°F. However, the third-party supplier wired an additional tag stamped with the refinery’s valve number to the valve, incorrectly identifying the valve as having graphite components. Refinery personnel accepted and installed the valve based on the order and receipt documentation, along with the valve’s size, flange rating, and the refinery valve number.
Probable Cause
Based on the company's investigation, the CSB determined that the probable cause of the incident was the installation of a valve with Teflon components that could not withstand the process temperature. The company could have prevented the incident by confirming that the manufacturer’s tag indicated that the valve was assembled with the proper components and that the valve’s design temperature was compatible with the vacuum tower bottoms temperature. Contributing to the incident was the third-party supplier’s tag, which incorrectly identified the valve as having graphite components
Source:CSB.gov
On December 10, 2023, at 3:38 p.m., two explosions and a fire occurred in a polymer reactor at a facility in Mt. Vernon, Indiana. Property damage was estimated at $3.5 million.
Three months prior to the incident, on September 18, the company had shut down its polybutylene terephthalate resin unit for scheduled maintenance. On the day of the incident, the maintenance work was nearing completion, and operators were preparing the unit’s reactor system for startup. At 3:38 p.m., a heat exchanger exploded, ejecting several equipment fragments, including one that landed approximately 505 feet away near the facility’s boundary along the Ohio River. A second explosion and flash fire soon followed, rupturing a reactor.
The company's investigation concluded that the initial explosion in the heat exchanger was caused by the rapid, energetic decomposition of unstable organic peroxide that had formed and accumulated inside the equipment. The second explosion and flash fire, which destroyed the reactor, was caused by heat from the first explosion igniting flammable tetrahydrofuran vapor inside the reactor.
The exchanger and reactor were interconnected, with no isolation between the two pressure vessels. The design of the reactor’s outlet piping retained liquid in the piping. Because the piping could not fully drain, it contained polybutylene terephthalate polymer, butanediol, and tetrahydrofuran when the unit was shut down on September 18, 2023.
On December 10, operators began pre-startup activities. At 3:16 a.m., hot oil was sent through the tracing used to heat the reactor’s outlet piping. As the piping heated, the residual hydrocarbon material also heated, evolving tetrahydrofuran vapor that flowed into the reactor and the heat exchanger. A 3-inch nozzle on the heat exchanger remained open to ambient air, allowing oxygen into the reactor system. The tetrahydrofuran vapor reacted with available oxygen to form an organic peroxide compound. The organic peroxide continued to form for another 12 hours, until it exploded in a rapid decomposition reaction at 3:38 p.m. The heat from the explosion ignited additional flammable tetrahydrofuran inside the reactor, triggering the second explosion and a flash fire.
The company's investigation found that the company’s historical practice of leaving residual hydrocarbon material in the reactor’s outlet piping during shutdown created hazards that were neither recognized nor controlled. The reaction of tetrahydrofuran with oxygen produced the explosive organic peroxide. Before the incident, personnel had assumed that the cooled, solidified material could remain in the reactor’s outlet piping because it was not hazardous, creating a false sense of safety.
The investigation also found that a change to the reactor’s leak-testing procedure contributed to the incident. Previously, the reactor was leak-tested online under vacuum. The company switched to using pressurized nitrogen and moved the test into the maintenance outage. A management of change review had been approved to allow a leak test of the reactor during pre-startup activities. However, the review did not assess how the leak test might adversely affect those activities.
When the hot oil heated the reactor’s outlet piping, the procedure required adding nitrogen to the reactor system. However, the nitrogen flow was omitted due to the modified leak test. The company’s investigation concluded that the risk of performing simultaneous tasks during startup had not been evaluated.
Probable Cause
Based on the company's investigation, the CSB determined that the probable cause of the incident was heating the reactor’s outlet piping containing solidified polybutylene terephthalate polymer, butanediol, and tetrahydrofuran while a nozzle on an interconnected heat exchanger was open, allowing oxygen (air) to enter the equipment. These conditions generated tetrahydrofuran vapor, which reacted with oxygen to form an explosive organic peroxide, and also created a flammable atmosphere in the equipment, which then ignited and exploded after the organic peroxide energetically decomposed. The management of change review conducted for the reactor’s leak testing did not assess how the leak testing might affect the simultaneous pre-startup tasks, contributing to the incident. As a result, there was no nitrogen flow through the reactor system, allowing unstable peroxide to form and developing flammable conditions within the equipment.
Source: CSB.gov
On February 6, 2023, at 8:15 a.m., a release of a hot sodium hydroxide and water solution (“caustic slurry”) seriously injured two employees at an aluminum refinery in Louisiana
On the morning of the incident, a team of operators was assigned to drain hot caustic slurry, at a temperature of approximately 195 degrees Fahrenheit (℉), from a tank with an open-top design. The operators closed the tank’s steam injection control valve before beginning the draining operation. During their initial attempt to drain the tank, the operators determined that the drain piping was blocked. They used compressed air to blow through the drain piping to clear the blockage. However, when they directed the air into the piping, caustic slurry erupted from the tank’s open top. The hot, corrosive liquid splashed onto two of the operators. After they washed off in a safety shower, the two operators were transported to a hospital, where they were admitted for treatment of their burn injuries. It was reported that approximately 80 gallons of caustic slurry had been released during the incident.
The company’s investigation revealed that bauxite ore had accumulated in the tank and blocked the drain piping. Additionally, although the steam control valve was closed, it was leaking, which resulted in the tank’s contents being heated beyond the target temperature of 180℉. The investigation also found that no isolation device was installed to prevent the air injected into the drain piping from entering the tank. Furthermore, it was noted that some operators were not wearing the required chemical suits while clearing the pipes. Among the injured operators, one wore the required chemical suit, goggles, and rubber gloves, while the other wore goggles and rubber gloves but not the chemical suit.
Probable Cause
Based on the comapny's investigation, the CSB determined that the probable cause of the incident was flowing compressed air into the bottom of an open-top caustic slurry tank. The air created a geyser-like eruption of hot (195℉) caustic slurry that sprayed onto two operators, resulting in serious burn injuries. The lack of an isolation device between the tank and the air injection location, as well as the lack of an effective procedure to clear the drain piping, contributed to the incident
On January 30, 2023, at approximately 5:30 p.m., argon gas was released at the Propulsion Systems facility in Utah. Exposure to the argon gas fatally injured two employees, who asphyxiated.
The company treated carbon fiber blocks at the facility. As part of the treatment, a specialized vessel (autoclave) containing carbon fiber blocks was pressurized with argon gas. On the day of the incident, two employees were working to locate argon leaks and troubleshoot the vessel’s pressure control system. During this work, the autoclave did not contain carbon fiber blocks. Throughout the workday, the vessel was pressurized with argon gas several times, but the task was not completed by the end of the employees’ shift. The employees changed out of their work clothes and removed their personal oxygen monitors. However, before meeting with the oncoming shift workers, the two employees returned to the basement. The crew arriving for the next shift found their two coworkers unconscious in the basement’s stairway. Emergency responders transported the two employees to the hospital, where they were declared deceased.
The company’s investigation found that argon had leaked through the seals of the pressurized vessel while the basement’s ventilation system was off, which allowed the basement (about 4,500 cubic feet) to begin to fill with argon and create an oxygen-deficient atmosphere. The company’s investigation did not determine why the two employees returned to the basement at the end of their shift, however. After the incident, the company classified the basement as a confined space and installed an oxygen monitoring system. The company also implemented safeguards to prevent entry into the basement when the oxygen concentration is unsafe, the exhaust ventilation fan is off, or the vessel is pressurized.
Probable Cause
Based on the company's investigation, the CSB determined that the probable cause of the incident was the release of argon gas from the autoclave into a confined area. The two workers were fatally injured when they entered this oxygen-deficient environment. The lack of effective engineering controls, such as forced air ventilation and continual oxygen monitoring, contributed to the severity of the incident.
Source;CSB.gov
On February 21, 2022, at 9:22 a.m., a large jet fire occurred at a refinery in Louisiana, after a vacuum ejector ruptured within a hydrocracker unit at the refinery. It was estimated that the fire caused approximately $54 million in property damage.
On the day of the incident, the refinery restarted the hydrocracker unit following a maintenance turnaround. The pre-startup work included flowing nitrogen through the equipment to remove air (oxygen) that entered when the equipment was opened for maintenance. The equipment for removing air included a vacuum ejector (Figure). A vacuum ejector is a stationary device that utilizes a high-velocity fluid, such as steam, to create a low-pressure area at a specified location. Even though the vacuum ejector was not operating, nitrogen still was flowed through it to remove air from the equipment.
After the operators completed the air removal step, the hydrogen and hydrocarbon flows were initiated, which increased the pressure inside the unit’s equipment. At 9:22 a.m., the vacuum ejector ruptured, releasing a flammable gas mixture mainly composed of methane and hydrogen that ignited, resulting in a large fire. Emergency responders closed Valve A (Figure 2) to stop the release of flammable gas and successfully extinguished the fire at 12:27 p.m., roughly three hours after it began. It was estimated that approximately 7,000 pounds of flammable gas were released.
The refinery's investigation determined that after the air removal step was completed, an operator closed Valve C, but Valve A remained open. During the startup, this valve alignment allowed process gas to enter and pressurize the vacuum ejector to approximately 1,465 pounds per square inch (psi). The pressure ruptured the vacuum ejector, which had a design pressure of 360 psi. Marathon concluded that the flammable gas was ignited by a spark created when the vacuum ejector ruptured or from static electricity.
The refinery's investigation identified that the startup procedure did not include the necessary actions to protect the vacuum ejector from high-pressure conditions after operators completed the air removal step. In addition, it was found that the process hazard analysis had not identified the potential for overpressurizing the vacuum ejector.
Probable Cause
Based on the company's investigation, the CSB determined that the probable cause of the incident was not isolating the vacuum ejector from the high-pressure process gas before startup. As a result, the flammable process gas overpressurized and ruptured the vacuum ejector, resulting in a large fire. Marathon could have prevented the incident by eliminating the vacuum ejector from the process since it was no longer in use, thereby avoiding the rupture, the flammable gas release, and ultimately the fire. Alternatively, the company could have installed a blind or a blind flange at the high-pressure isolation valve (Valve A) after the air removal step and before startup, which would have protected the vacuum ejector and prevented the incident.
Source: CSB.gov
On the day of the incident, a contract worker used steam to heat the contents of a railcar to facilitate its unloading into process equipment. After the railcar was unloaded, the worker needed to remove the steam and condensate hoses from the railcar . The contractor verified that the steam and condensate isolation valves were closed and that steam was no longer draining from the condensate drain valve. While removing the steam hose from under the railcar, the contractor was sprayed with steam and hot condensate. The contractor was transported and admitted to a hospital for treatment.
The company's investigation identified that the typical practice used at the facility to isolate and depressurize the steam hose was to close Valve A while having Valve B and Drain Valve 1 open to allow residual steam to flow out of the hose. However, Valve A was broken in the open position and could not be closed. Instead, the contract worker closed Valve B, left Drain Valve 1 closed, and opened Drain Valve 2 (visually obstructed in by the steam supply hose) to drain both the condensate hose and the steam hose. Because of how the heating coil was configured within the railcar, this configuration trapped condensate in the steam hose.
The company's investigation found that when workers first identified the broken valve (Valve A), they should have used stop work authority to prevent the unloading equipment from being used until the valve was repaired. The company’s investigation also concluded that its written operating procedure did not effectively describe the process of draining steam or hot condensate from the railcar. In addition, the procedure did not explain how to verify that there was no pressure on the steam or hot condensate hoses. No instruments (such as a pressure gauge) or other safeguards were available to warn workers that the steam hose contained a dangerous amount of condensate.
Probable Cause
Based on the company's investigation file, the CSB determined that the probable cause of the incident was disconnecting a hose from a railcar that contained steam and hot condensate. A broken isolation valve on the steam supply piping changed how the steam and condensate hoses were isolated and drained, contributing to the incident. The lack of instrumentation or other safeguards to warn employees that the loading hose held a dangerous amount of condensate contributed to the incident.
Source:CSB.gov
On December 20, 2021, at approximately 9:30 a.m., a release of molten polymer caught fire, seriously injuring an employee in a company in Virginia. In December 2021, the company planned to perform maintenance work on a rupture disc used to protect one of its molten polymer positive displacement pumps from potential high-pressure conditions. On December 18, an operator prepared the equipment for maintenance. The preparation involved turning the pump off, locking and tagging its electrical switch, and closing, tagging, and locking the pump’s inlet and outlet isolation valves. The keys for the three locks were put into a lock box.
On December 20, 2021, the day of the incident, a different company operator issued safe and hot work permits to two maintenance workers to perform the rupture disc maintenance. Each of the two maintenance workers applied their personal lock to the lock box. The work involved using a propane torch to heat the external surface of the equipment and melt the polymer inside so that the rupture disc could be removed. One of the maintenance employees removed the bolts from the rupture disc holder, while the second worker acted as a “standby” and observed the work. Both workers wore the standard personal protective equipment (PPE) used at the plant, plus a face shield and an aluminized jacket. When the maintenance worker used the propane torch before removing the last bolt, the rupture disc and the bolt were forcefully ejected, spraying the employee with hot (500 degrees Fahrenheit) molten polymer. The propane torch ignited the molten polymer, starting a fire.
The standby worker pulled the emergency alarm and used the plant radio system to call for help. Emergency responders extinguished the fire and transported the injured maintenance worker to a nearby hospital with a burn center. The worker was admitted for treatment of his injuries, which included third-degree burns. The most severe injuries were to the workers’ legs. The worker’s denim jeans did not offer the same level of protection as his aluminized jacket.The company reported that approximately 50 pounds of molten polymer were released. The polymer primarily consisted of nylon 6 and some caprolactam.
The company's investigation found that the pump’s outlet valve had been incorrectly locked in the open position when it should have been closed (Figure below). On the day of the incident, the employees saw that the inlet and outlet valves had been tagged and locked. However, they did not verify that the valves were closed.
Simplified equipment drawing, highlighting the open outlet valve (left image)
In response to the incident, the company upgraded the PPE requirements to include aluminized clothing for line opening work on its molten polymer equipment.
Probable Cause
Based on the company's investigation, the CSB determined that the probable cause of the incident was not effectively isolating and draining the piping before having workers disassemble the rupture disc. As a result, after most of the rupture disc’s flange bolts were removed, the pressurized piping caused molten polymer to spray out of the rupture disc’s holder. The molten polymer ignited, leading to a fire that seriously injured one employee. Not verifying that the equipment was effectively isolated contributed to the incident. If any employee or supervisor had verified that the locked valves were closed, the incident could have been prevented. Not wearing aluminized pants with the aluminized jacket contributed to the severity of the incident.
Source:CSB.gov
On March 22, 2021, at approximately 12:30 p.m., an explosion and fire occurred at a Refinery in California. The explosion and fire seriously injured one contract worker.Leading up to the incident, the refinery was shut down for turnaround maintenance. The planned maintenance work included removing a section of carbon steel piping in the Fluidized Catalytic Cracking (FCC) unit that typically contained gasoline. Two days before the incident, on March 20, 2021, 50 gallons of chemical cleaning water containing hydrocarbons were released when workers opened a flange to install a blind (metal plate) to isolate a section of 18-inch piping.
On March 22, 2021, the day of the incident, the 18-inch piping was isolated with the blind at one end and the other end transitioning to a section of 10-inch piping open to the atmosphere with drain piping between the blind and the open 10-inch end. To remove the piping, Phillips 66 tasked a crew of contract workers to cut the 18-inch piping at the location shown in Figure.
Before the cutting began, an operator performed flammable gas testing at the work area, showing no flammable gas was present. Operators also walked the job with the contractor’s supervisor. After this, the operators issued a work permit authorizing the contractors to use an electric angle grinder with a cutting wheel to cut the piping. The permit stated that the piping was isolated, vented, depressured, and chemically cleaned. Because the work area was elevated about 10 feet above ground, fire blankets were installed, creating an enclosure to contain sparks created during the pipe-cutting work.
As the lower portion (from the four to six o’clock position) of the piping was being cut, liquid flowed out, and the worker stopped cutting. The drain piping was unplugged using a wire, allowing the fluid to drain. The contractors contacted operations personnel to evaluate the piping. The operators rechecked the piping and confirmed that no flammable gas was present. One of the contract workers invoked his stop-work authority and refused to continue cutting on this piping because the liquid smelled like gasoline. One of the operators described the odor as pine and attributed it to the substance used during chemical cleaning. Ultimately, two operators and a contractor supervisor agreed that the liquid was primarily water. At approximately 12:30 p.m., two hours after the work was stopped, another contract worker was sent to finish cutting the pipe. When the worker started the angle grinder, an explosion and fire occurred. The contractor suffered serious burn injuries from the combustion event and was transported and admitted to a hospital for treatment.
The company's investigation determined that the piping contained flammable hydrocarbons because the plugged drain prevented the piping from being flushed and cleared as intended. The flammable gas testing performed at the work area did not identify the flammable vapor inside the piping. In addition, the company’s investigation concluded that when the contract worker used his stop-work authority and refused to cut the piping, his safety concerns should have been elevated to operations and maintenance supervisors for help ensuring the job was safe before resuming work – but they were not. The company estimated that less than half a gallon of gasoline was released.
Probable Cause
Based on the company's investigation, the CSB determined that the probable cause of the incident was that the piping segment was not effectively flushed and drained before the contract workers were authorized to cut the piping. Not recognizing the presence of flammable gas contributed to the incident.
Source: CSB.gov
On November 29, 2020, at approximately 6:42 p.m., a major fire occurred at a Chemical Company in USA, after sections of piping supplying water to a coal gasification unit failed, releasing flammable chemicals that ignited (autoignition).The company estimated the property damage to be $1.1 million.
At the time of the incident, the company was feeding oxygen and a slurry of coal and water to one of its coal gasifiers to generate product gases, primarily hydrogen and carbon monoxide. The gasifier operated at a pressure of approximately 1,000 pounds per square inch. Pressurized water was injected into the gasifier to cool the hot product gases
Figure 1. Simplified diagram of the water supply system involved in the incident. (Credit: CSB)
At approximately 6:41 p.m., a pipe support failed near the water supply control valve at location #1, shown in Figure 1. This pipe support was welded to the water supply piping, and its failure opened a large hole in the piping, releasing most of the available water supply. Roughly one minute later, two of the four water supply pipes to the gasifier ruptured at location #2, shown in Figure 1, releasing hot, flammable product gases that autoignited, resulting in a fire around the gasifier. The company operators shut down the gasifier, which stopped the release of product gases, extinguishing the fire.
The company's investigation found that fatigue cracking at the pipe support weld caused the initial water supply piping failure. The piping support had severely corroded over time and was no longer supporting the pipe, as it had lost contact with the structure. The company’s last visual inspection of this piping system, which occurred in 2018, did not identify any problems with the pipe support.
With Water Supply 2 being released through the breached piping, Water Supply 1 should have been able to provide sufficient water flow to the gasifier. However, the check valve in the water supply piping had been stuck in the open position for an extended period prior to the incident and had not been inspected or otherwise tested. As a result, Water Supply 1 preferentially flowed through the open hole in the piping at location #1 (Figure 1).
Without a steady water supply to the gasifier, hot product gases exited into the water piping, creating localized high-pressure and high-temperature conditions that ruptured two of the four water supply piping connections to the gasifier. Hot, flammable product gases were released from these two ruptured pipe locations, resulting in the fire.
Before the incident, the company's process hazard analysis (PHA) had not accurately assessed the potential for loss of water flow to the gasifier. The company’s technical staff had mistakenly concluded that a loss of water flow would trigger a shutdown of the gasifier due to a low liquid level.
Probable Cause
Based on the company's investigation, the CSB determined that the probable cause of the incident was the rupture of piping connected to the gasifier. The failure of the piping released hot, flammable material from the gasifier that ignited, resulting in the fire. The gasifier piping failure was caused by the loss of water flow through the piping, which occurred when a large hole developed in a different section of piping in the water system after a welded pipe support broke, and a check valve in the piping system did not close because it was stuck in the open position. The company's process safety management systems contributed to the incident. The company did not maintain the integrity of the piping support, which was severely corroded. Additionally, it was not testing the integrity of the check valve, which had been inoperable for an extended period before the incident. Furthermore, not accurately assessing the loss of water flow in its PHA contributed to a lack of effective safeguards to protect the gasifier’s piping.
Source:CSB.gov
On July 16, 2020, at approximately 6:30 a.m., an explosion and fire occurred in a blast furnace in a steel mill USA. In iron manufacturing, a blast furnace operates at high temperatures to convert iron ore into molten iron. Hot, pressurized air enhances the blast furnace’s efficiency and capacity. This hot air is heated in a pressure vessel known as a stove, and the top hemispherical part of the stove is referred to as the dome.
On July 16, 2020, a blast furnace was operating normally when the dome on one of its stoves suddenly and catastrophically separated at approximately 6:30 a.m., resulting in a large explosion. Plant operators shut the unit down within minutes. The incident severely damaged portions of the mill.
The company's investigation revealed that the rupture originated at a large repair patch on the stove’s dome. The failure initiated where the dome’s shell was thinnest due to internal corrosion, measuring approximately one-tenth of an inch. This thickness was only ten percent of the dome’s original wall thickness of one inch. The investigation also found that the repair patch in this area was improperly welded and that the repair plate was only 0.25 inches thick, significantly less than the calculated minimum required thickness of 0.56 inches for the dome. The stove’s normal operating pressure of 36 pounds per square inch caused the fracture to spread along the welds of the shell.
High-temperature oxidation corrosion had significantly reduced the thickness of the dome’s shell over the years it was in operation. Several repair patches were applied throughout the dome’s service life to address thinning and weld cracking. The company's investigation concluded that some of these repairs did not conform to the American Society of Mechanical Engineers (ASME) Pressure Vessel Code requirements. In fact, several repair patches were improperly welded, used dissimilar steel grades that did not match the original structural steel, and failed to meet the minimum thickness requirements for this type of pressure vessel. These deficiencies likely compromised the strength of the repaired areas, allowing the crack to propagate along the welds after the initial failure.
Probable Cause
Based on the company's investigation, the CSB determined that the probable cause of the explosion was the catastrophic failure of the stove’s dome. The dome failed at a repair patch that had been improperly welded and did not provide the minimum thickness needed to contain the dome’s operating pressure. The steel mill’s mechanical integrity program lacked effective inspection and weld repair practices, contributing to the incident.
Source: CSB.gov
