THE IMPORTANCE OF OPERATIONAL READINESS REVIEWS - ARE YOU WALKING THE LINE?

 Leak of boron trifluoride (ARIA 51230) Five employees were hospitalised following the release of 15 kg of BF3 during the restart of a petrochemical site. A valve had remained open during a leak test performed the previous day. The operating procedure did not specify the position of the valve (not identified in the DCS) upon completion of the test.

Ammonia leak incident:

When a service provider was filling a tank, 2.1 m³ of NH3 was released via a drain. The day before, the technician preparing the operation was interrupted to take an urgent sample. The service provider's procedures did not provide for an inspection of the installation.

Source: Aria database

ARE YOUR HAZOP STUDIES LOOKING AT HUMAN ERROR AND ITS EFFECT ON AUTOMATED SYSTEMS?

 An exothermic runaway chemical reaction abruptly occurred within a production facility when an operator initiated an automated sequence to add water inside a multi-purpose batch reactor. The reactor suddenly experienced a pressure build-up due to its foaming content, but the automated control system was not able to regulate it. The glass reflux condenser burst while the rupture disc remained unbroken, given that its bursting pressure had not been reached. The irritating HCl vapours released in the facility was evacuated outside through the ventilation system. These vapours affected 7 people in the neighbourhood, 2 of whom would be kept in hospital overnight for observation. 

The investigation conducted revealed that the sudden exothermic reaction followed a 30-litre spill of water into the reactor instead of the 3-litre quantity indicated in the procedure. The 32-litre water tank was connected to the reactor via a pipe fitted with 2 valves. The first valve, activated by the automated control system, normally delivers 3 litres of water, while the second manual valve is supposed to stay in the closed position at the beginning of this water addition sequence. During the accident however, the manual valve was left open, and this oversight led to quickly draining the 30 litres water content of the tank into the reactor. The exothermic reaction was triggered, and the sole control system designed to prevent chemical runaway was unable to function properly, since the system was designed to provide a control of the water added to the reactor through the closure of the second valve.

Moreover, the manual valve, which was not equipped with an open/closed position indicator, could not be easily reached by the operator, making it difficult to control. This risk of exothermic reaction had been identified during the process safety study (i.e. the Hazard and Operability Study, or HAZOP), but at the time of the accident only a call for procedural improvements had been issued. The company limits the maximum volume of water which can be added at one time in the reactor and improves the automated control system. The safety studies (HAZOP) are updated for all exothermic reactions carried out on in this apparatus. A particular attention is paid to consequences of operating failures and a balance is found between risk control measures and the potential severity of the consequences.

Source:Aria database

COMPETENCY AND COMMUNICATION - THE ESSENCE OF PROCESS SAFETY

 At 9:20 a.m., a rupture disc of a reactor used to produce an organomagnesium compound burst when the reactor’s internal pressure rose too high. The incident was caused by a nonconforming mixture that had formed in the reactor. First, the ambiguous instructions led a technician to add an insufficient amount of initiator. Then, seeing that the reaction had not yet started, a second technician added more reagents. The process sheet indicated that the reagent could be added after, but only after receiving the supervisor’s approval. 

The operation took place on a Saturday and the chemical engineer belatedly informed the on-duty engineer. This lack of communication between the workers of both shifts and the technicians’ lack of experience are what set the stage for the incident. 

The operator subsequently implemented a number of changes : tracking of technicians who are accredited to carry out synthesis operations has been reinstated ; the process sheet now indicates the amounts of reagent to be added and includes hold points for the start of the reaction ; the reaction may no longer be carried out over the weekend and it must be scheduled at the beginning of a shift so that workers may monitor it from start to finish. In addition, the operator conducted an in-depth review of organomagnesium compound synthesis in order to establish production standards and problem-management guidelines applicable at all its similar production sites.

Source:Aria database

PRECAUTIONS FOR TANKS WITH INBUILT HEATING COILS

 PRECAUTIONS FOR TANKS WITH INBUILT HEATING COILS:

Design of facilities: 

Three interacting elements need to be taken into account when designing installations, particularly in terms of their compatibility with the operating conditions: - the nature of the products stored: flammable or non-flammable, likely to generate decomposition products that are themselves flammable or even explosive, requiring or not requiring temperature control; - the materials used for the storage tanks: flammable or non-flammable, and must be resistant to the products stored; - the heating elements: essential or non-essential, electric or using a thermal fluid (steam, hot water, heat transfer fluid, etc.), sized for a specific heating power. 

Reliable control equipment: - products are present in the tanks to prevent heating if tanks are empty (level and weighing sensors, etc.) - temperature of the thermal fluids used, the products contained in the tank, the atmosphere in the tank, etc. (appropriately positioned probes and sensors); - heating is controlled by the presence of product and by temperature control; - no contact between the heating elements and the tank’s walls; - monitoring of all of the installation’s operating and safety parameters. 

Regulated operating conditions: - preventive maintenance of facilities and equipment to prevent failures; - operating and intervention instructions (concerning the start-up of facilities in manual or automatic mode, shut-down of heating systems before intervention requiring tank emptying, after all interventions, etc.) - training of personnel in procedures and operating instructions; - monitoring and supervision of the installations during operations (the night prior, at night, early in the morning); - verification that all instrumentation and control channels are operating correctly, that the servocontrol and command logic is functioning correctly, and verification of automatic operation programmers.

Source:Aria database

ARE YOUR INTERLOCKS TESTED?

A fire broke out in a chemical warehouse that was inactive at the time. The flames had spread through the area used to store acids, bases and peroxides and included 28 storage tanks. This area is separate from the flammable products area. The site's Internal emergency Plan (IOP) was initiated. 

Six tanks containing hydrochloric acid, potash, flocculant, alkaline solutions and soda were destroyed, and the flames damaged five others. Overheating of a heating element in an empty soda tank over several hours caused the incident, as the product low-level detector had not switched off its power supply. The energy produced melted and then ignited the tank filled with HDPE (high-density polyethene). The material of which tank is made of then also fuelled the fire. The operator implemented the following preventive measures: - no heating device on product storage tanks not requiring it; - preference is given to steel or stainless steel tanks with electric or hot water heating; - the new plastic tanks are heated by hot water only; - the heating power must not allow a tank to ignite, - the reliability of the controller used to regulate the tank heating systems must be improved.

Source:Aria database

ARE YOUR TEMPERATURE SENSORS MEASURING PROPERLY?

 An explosion occurred in a metal bitumen tank (15 m high) in a company that manufactures, stores and distributes bitumen emulsion. The top of the tank was blown off and landed more than 45 m away on the grounds of the neighbouring facility. Upon arriving at the site, the operator switched off the electricity to the entire facility. The site was shut down. The tank in question was destroyed, and two other tanks were damaged in the explosion. The amount of bitumen in the tank was less than indicated by the sensor (10 tonnes) and insufficient to cover the resistors completely. The system began heating the fluid and caused the temperature in the tank to rise because the temperature sensor was not immersed in the bitumen. The heating system thus operated at its maximum level. The temperature rise caused a fire to break out, which ignited the combustion gases. The course of the accident implies that the level sensor had failed.

Source:Aria database

FAULTY ELECTRICAL COMPONENT TRIGGERS FIRE IN PLASTIC TANK

 A fire broke out on a tank containing 0.3 t of a mixed acid solution feeding a phosphating production line. The security guard raised the alarm. The tank eventually ruptured, spilling product into a retention basin. The fire resulted in an economic loss of €40,000. The fire is believed to have been caused by a faulty electrical component on the level sensor and the combustible nature of the tank (PE plastic). The line involved had been out of operation for maintenance since 20/12/2018. On 28/12/2018, the preventive maintenance was completed after 4 hours of testing. The line had been in preheating mode just 6 minutes before the fire broke out. Following the fire, a variety of actions were implemented: . modification of the tank’s materials (stainless steel); . replacement of the control relays (as a preventive measure); . modification of technology used to measure bath level; . installation of a preventive maintenance system with a thermal camera.

Source: Aria database

EMPTY SULPHURIC ACID TANK EXPLODES DURING HOT WORK AT TOP OF TANK

An empty 100-m³ tank sulphuric acid (H2SO4) exploded at 9:15 am at a chemical site. The tank was projected and fell nearby, toppling the scaffolding set up for reservoir maintenance and causing 3 workers (2 subcontracted personnel) to fall. Two of the three were seriously hurt: the plant employee sustained cranial trauma after falling some ten metres; and a subcontractor was pinned between the tank and the scaffolding, injured to the face by the grinder he had been using. The internal emergency plan was activated, bringing both internal and external responders to the site. The injured were taken to hospital. 

The tank had been temporarily plugged on 18th July using a sealant box after discovering a leak on 17th July. Scheduled for repair at the beginning of August following its drainage, the tank was rinsed with water throughout the weekend of 2nd August, then a subcontractor installed the scaffolding for the specific intervention: reservoir access, process insulation plating, etc. A plant employee, accompanied by 2 subcontractors, then climbed up the tank in order to open the top manway when the explosion occurred.

The accident appears to have followed a hydrogen (H2) accumulation at the top of the tank due to ignition of the inflammable mixture formed with air when cutting corroded bolts from the manway with a grinder. The tank was torn over half the circumference of the shell/bottom junction, and its anchorages were stripped. 
Insufficient rinsing of the tank (just a single rinsing cycle was performed) combined with the presence of a low concentration of sulphuric acid caused an acid attack of the metal, leading to the formation and accumulation of hydrogen at the top of the tank (dome-shaped tank roof). The explosion occurred by means of igniting the flammable mix created with air at the time of splitting the corroded bolts on the dome manhole with a grinder. The metallurgical assessment performed on this tank indicated the presence of extensive internal corrosion over the lower part of the structure. This observation confirmed the sudden onset of corrosion at the tank sidewall due to diluted acid, thus generating a source of hydrogen production.

Source:Aria database

ARE YOU OPERATING WITHIN SAFE OPERATING WINDOW?

When observing yellow smoke emanating from the chimney of a drying unit located downstream of the fertiliser plant granulator, an employee notified a control room technician; the workshop extraction fan was turned off at 10:30 am in order to limit discharges of both nitrous and chlorine gases, which were beginning to fill the workshop. The internal emergency plan was activated at 10:58 am, and fire-fighters arrived on the scene at 11:10. The dryer was started and then flooded; the incident was brought under control at 12:34 pm. The device was drained, with all fire extinction water collected in a retention basin; recovered sludge was recycled over the following week. 

Thermal decomposition had occurred inside a dryer, of the rotating tube variety, fed with hot air by a 7 MW/hr natural gas generator containing 20 tonnes of aggregates, over which an ammonium phosphate slurry had been sprayed. This ammonium phosphate supply was obtained by means of a chemical reaction between phosphoric acid (H3PO4) and ammonia (NH3). The site operator considered the possibility of accidental overheating, since the NPK 11-11-32 fertiliser had not been prone to self-sustaining decomposition. The unit had been shut down for the maintenance of a chain conveyor. The pertinent operating instructions would have been followed for this mission, given that the granulation loop contained dry matter, with the burner operating at the minimum setting (35%) and the drying drum no longer rotating.Subsequent to an excessive production temperature (> 300°C), the “dryer input” temperature, which was also abnormally high, surpassed the temperature at the onset of dry fertiliser decomposition (i.e. > 170°C). This thermal disequilibrium was caused by use of an H3PO4 at 38% concentration, which was more diluted than the normal level (53%). With a slurry containing a large quantity of water to be evaporated, gas temperature at the reactor output (set at 110°C) decreased, while the drying air temperature was automatically increased as a compensation to 300°C, by exceeding the typical threshold of 240°C. No alarm was triggered, with the 300°C value remaining below the 370°C threshold recorded on the “hot air intake” temperature probes. Afterwards, the dryer required more time to cool.The acidic dilution stemmed from an incident that had occurred 10 days prior, involving the unit’s three H3PO4 tanks, two containing a 53% acid and the other a diluted corroded acid (< 30%). With its shell leaking at a height of 1.5 m above the bottom, tank contents had been transferred into the other two tanks, thus diluting the acid used for manufacturing purposes.

The operator modified production standards, by introducing a "hot air intake temperature" alarm threshold adapted to each production run (260°C for ammonium nitrate fertilisers), along with the relevant maintenance shutdown procedure by indicating temperature controls and thresholds correlated with the steps required for installation shutdown, plus an internal emergency plan reminder to avoid stopping the fan in the event of toxic gas emissions.

Source: Aria database

ARE YOU INSPECTING ALL VULNERABLE COMPONENTS OF PIPING AS PER STANDARDS?

At 11:15 pm, high-pressure steam pipe elbow at 120 bar and 520°C connected to catalytic reforming equipment burst. The elbow and pipe , a 40-kg block of steel, was projected longitudinally. Inside the shop area, a walkway was ripped off its supports damaging an access ladder. It then flew over an ammonium nitrate conveyor belt only to land 230 m away in a parking zone for tanker cars full of ammonia awaiting shipment, which on that day happened to be empty. The steam tore apart the asbestos cement cladding on the wall located 20 m from the original rupture and escaped into the atmosphere with a load noise. 

The two employees present in the unit at the time shut down production operations and cooled the steam reformer with nitrogen. 

A metallurgical assessment of the elbow indicated that slow creep had initiated on the outer skin, which combined with flow into the material layer was the cause of pipe rupture. This hypothesis relied on the detection of oxidised, yet non-deformed, pipe openings in the presence of intergranular microcracks on both the pipe and its elbow. The origin of this creep was explained by the metallurgical composition of the elbow, i.e. ordinary carbon steel containing no alloys and not adapted to temperatures above 425°C. The pipeline was made of a slightly-alloyed P22 type steel, which was more resistant to creep and compliant with the original specifications defined 32 years prior for both material elements. 

Inspections carried out at the time on the elbow did not detect any noncompliance of the steel, given that non-destructive technology had not yet come of age. This creep might have been accelerated as a result of heat treatment performed at 700°C during equipment installation, once the assembly had been welded. Periodic inspections dedicated to pressurised equipment on the damaged pipe were only recorded into the log 25 years after service start-up, at the time of applying for facility recertification. The initial recertification was rendered official without any underlying structural documentation (misplaced), and subsequent inspections never focused on the section of pipe that would burst.

Source: Aria database

CONFUSION DURING A MAJOR LOPC CAUSES WRONG ACTION TO BE TAKEN

In a petrochemical complex, an ethylene (a highly flammable gas) compressor was in stable operation when a sudden drop in pressure occurred at 5:33 p.m., accompanied by a loud noise. The gas detectors in the zone became saturated, and a 2nd level alarm was triggered in the unit’s control room, as well as in the control room controlling the nearby compressor and at the safety station. The compressor began to vibrate. Its motor stopped but not its ethylene supply.

Confusion over which compressor was leaking
Not knowing which compressor was causing the leak, the shift crew of compressor No. 1 contacted the crew in charge of compressor No. 2. The latter crew persuaded them it was compressor No. 2 that was to blame. Crew No. 1 left their control room to help them. The alarms and parameters indicating the malfunction of compressor No. 1 (pressure drop) were not taken into account since the control room had been deserted.

The two shift crews, joined by the internal fire brigades, approached the area of the accident but were unable to enter due to the deafening noise. They encountered a flammable cloud of ethylene measuring 4 m high x 100 m, with visible droplets. The firefighters protected the nearby units with water curtains. Around 5:45 p.m., the shift leader 1 consulted with the shift leader in charge of the neighbouring unit. A leak on the ethylene supply network was suspected. Two operators, equipped with hearing protection, moved through the cloud, protected by a water curtain, to reach the network’s manual shut-off valves. They were able to close the valves manually, ending the leak. The cloud rapidly dispersed. The operators returned to the control room and closed the local supply valve of compressor 1. 8 t of ethylene (354 kg of flammable mass) was released in 21 minutes.

ROOT CAUSE: Valve ejection due to incorrect tightening and a non-compliant seal
The hatch and the valve porthole of the second stage of compressor 1 were found 6 m away. One stud from the hatch was severed (sudden brittle-type rupture), while the other five studs remained in place, three of which were missing their nuts and exhibited torn threads. These studs are compliant but had never been replaced since the compressor was commissioned 16 years ago. An expert assessment showed that the valve’s copper seal was not annealed at the time of its installation, contrary to procedure and the other seals on the equipment. It was therefore not as flexible and less able to absorb stresses. This defect, combined with a bolt tightening error on the verge of plastic deformation, led to fluttering in the stack and its rupture.

If the emergency stop had been activated, the leak could have been stopped more quickly as it shuts down both the motor and the ethylene supply. The operators believed that the motor shut-down because of vibration was sufficient. After the accident, the compressor was equipped with an emergency stop triggered by gas detection. However, the manual emergency stop remains in operation should this detection system fail.

Source: Aria database

INADVERTENT CHEMICAL ADDITION DURING CLEANING CAUSES EXPLOSION

 An explosion and fire occurred at night in a workshop set up to synthesise toluene diamine (TDA), by means of hydrogenating dinitrotoluene (DNT) in the presence of Raney nickel, during a scheduled maintenance downtime. In-house fire-fighters brought the fire under control within 35 min; in the meantime, four employees required hospitalisation. One of them, who was handling the valves to wash the hydrogenation reactors with isopropanol, sustained burns over 40%-50% of his body and died 15 days later. The workshop was completely destroyed. The reactor burst; the bunker housing the workshop was deformed due to the combined action of the blast wave and sprayed fragments; the reinforced concrete wall was ripped open, with rebar twisted; and the control room was heavily damaged. Glass panes were broken over a 50- to 100-m radius, while the distillation unit juxtaposing the bunker was damaged and allowed isopropanol and TDA to escape, adding fuel to the fire. Buildings belonging to the neighbouring industrial facility located 150 m away suffered deformations to their lightweight structures. 

According to the investigation conducted, this explosion resulted from injecting pure DNT into one of the reactors washed by the circuit used at the time of production startup. Two valves connected in series equipping this DNT feed line were found partially opened (at 10°) after the accident, most likely allowing 500 to 700 kg/h of product to flow into the reactor. The heat release upon hydrogenation of a small quantity of DNT probably triggered the sudden decomposition of the remaining DNT, while abruptly reheating the reaction medium. Corrective measures were adopted to prevent routing pure dinitrotoluene into the reactor. These were elimination of the DNT intake line on the injection tank, addition of two automatic on-off valves on the mixing tank’s DNT feed line, closure of the link (by an automatic on-off valve) between the mixing tank and the injection tank during the reactor washing

ARE YOU PREPARED FOR AN OFF SITE EMERGENCY?

A power failure occurred in a refinery, as a result of the failure of the main power line during maintenance. This led to an emergency shut down of the whole plant. The automatically operated safety systems started working : large quantities of products were dumped in the flare and were burnt off. Safety valves opened and released gasses to the atmosphere. Personnel and people working at the refinery were evacuated and only emergency staff remained at the plant.

Information at the central operating desk about what was going on in all the components of the plant was sparse. In the first hour after the incident it was not known which safety valves were opened and which products were vented. That information became available bit by bit.

One of the safety valves that opened released an amount of 70 kg H2S into the atmosphere. The release point is situated at about 40 m above ground level.

After 5 min, the cloud of H2S formed reaches a downwind distance of about 3 km with a concentration valued at nearly 10 ppm 3 m above ground level.

Driven by a wind from the south-south-west at 45 km/hr, the cloud proceeds over the western part of the province of Brabant and after about 70 min has reached the city of Dordrecht, 50 km from the refinery. Concentrations of H2S in the cloud are about 0.06 ppm, still well above the smell detection level .

No warning of the H2S spill was issued, partly due to a lack of information at the plant, partly due to a lack of communication between Belgium emergency services and the Dutch authorities.

A population of about 100.000 people was in the path of the cloud and potentially affected by it. An estimated several hundred people were affected by the H2S and experienced nauseous ness, and respiratory problems. 57 people needed medical care.

However the Dutch emergency services were not prepared to deal with the situation, due to lack of information about the event and its possible consequences. This in turn led to insecurity and a loss of confidence in the capacity of the government to deal with incidents like these.

Source:Aria database

DO YOU CONSIDER ACCIDENTAL REVERSAL OF PNEUMATIC HOSE CONNECTIONS TO CONTROL SYSTEMS DURING HAZOP?

 A reactor exploded in a fine chemicals plant during the chlorination of an alcohol by thionyl chloride (SOCl2 ). The relatively non-exothermic reaction took place in a solvent medium (1,2 dichloroethane or DCE), under a slightly lower pressure and a temperature of 70°C maintained by means of steam injection. The reactor initially contained the SOCl2 in solution in the DCE, with the alcohol being added under close monitoring for 30 hours. 

At the time of the accident, the reactor was being fed for three hours by successive 200- litre loads of alcohol, with the first injection still incomplete. Monitoring performed by two technicians, one of whom was a trainee, included an hourly reading of both the temperature and pressure drop; no anomaly had been observed until that point. Upon hearing a noise accompanied by a break to the protective disc on the glass column connected to the reactor and noticing smoke around the disc joints, the technician turned the feeder control box selector switch to the “off” position. As he closed the alcohol feed valve and was making his way to the valve used to shut down steam injection, he spotted that leaking on the column was becoming more persistent. He immediately left the unit, requesting that a co-worker follow him out — at which point the explosion happened. A rupture disc calibrated at 0.3 bar and the glass fixtures on top of the device burst. The explosion or toxic gases emitted once the equipment had broken killed the trainee technician, who did not exit the premises quickly enough. 

The feeder was equipped with two valves. The upper one (loading side) was found in the closed position while the lower valve (reactor side) was open with a reversal of the pneumatic control hoses. These recordings supported the hypothesis of an accidental addition of water into the reaction medium via the feeder. The laboratory simulation of such an addition found that the SOCl2 hydrolysis with the formation of SO2 and HCl led to a sudden pressure rise. 

Source:Aria database

ARE YOU MONITORING SUPPORTS FOR THEIR INTEGRITY? ARE YOU PROPERLY CONGURING ALARMS?

In a refinery, an alarm in the control room informed the operators of a fire in the distilling unit. The unit’s emergency shutdown procedure was initiated from the control room. The internal fire-fighting resources were initiated at to extinguish the fire and cool down certain installations in addition to the fixed installations at the site. No injuries were reported on or off the site. The distillation unit was partially destroyed over an area measuring 50 m x 50 m, and flaring episodes were required.

A petrol leak was discovered on a 3” diameter pressure testing pipe of a flowmeter on a hollow tubular support. The operator had visually noted corrosion on the support already 3 years earlier. Replacement of the support was planned to take place during the regulatory shut-down period but was not performed. The ignition source was not precisely identified. Before the fire started, an alarm corresponding to the 20% lower explosive limit had been triggered 6 times, without the operators noticing. As some of the units had still been shut down, the alarms dedicated to the unit in operation were filtered. This filtering arrangement masked the display of the fire and gas alarms and only displayed those pertaining to the unit’s processes that had been restarted. The flashing light visible in the control room was considered a “process” alarm, knowing that such signals are not explicitly dedicated to fire and gas alarms.

Source: Aria database

SMALL CHANGES BRING MAJOR HEADACHES

At a plant producing intermediate organic synthesis compounds, a runaway reaction coupled with an explosion (approx. 1 kg of TNT equivalent) took place in the 3.5-m high glass column overlooking a 3,000- litre reactor. The explosion triggered a fire outbreak inside the unit. A 110-kg cloud of hydrochloric acid (HCl) hovered over the site before dispersing after a few minutes due to a favourable wind. The noise alerted the technical staff, who promptly placed the installation in safe operating mode and launched the internal emergency plan. The staff began to fight the fire using the resources at hand, and were then joined by fire-fighters who brought the blaze under control within twenty minutes. One employee sustained loss of hearing due to the explosion and property damage amounted to €700,000. 

On the day of the accident, a batch production had been underway involving the addition of 1,000 kg of a cold liquid ethylene compound along with 750 kg of a highly flammable and volatile silyl (hydrosilane). The homogeneous mix was then supposed to be poured into a 2nd reactor at 100°C in the presence of a catalyst to form the final product. The hydrosilylation reaction was maintained under control by gradually introducing the mix. However, in this incident, a sudden rise in mix temperature caused a pressure surge and a pneumatic burst of the column. The hydrosilane was hydrolyzed into HCl upon coming into contact with humid air and then decomposed into the hydrogen that triggered this fire. 

The investigation revealed that in order to compensate for the loss of catalyst activity (this was the seventh consecutive batch), which would have necessitated an extended batch time, a technician took the initiative to insert around 10g of new catalyst into the reactor at the same time as the raw materials. Data studies and laboratory tests actually indicated that the reaction could not have started in the low temperature reactor (5-20°C), since deviation from the temperature required for synthesis (at 90°C) appears to safeguard the reaction safety of this modification, i.e. now deemed to be minor. Nonetheless, the tests conducted by the operator following the accident revealed that at these temperatures, an exothermic hydrosilylation reaction could arise following an induction period lasting several hours in the presence of trace alcohol amounts. Since the catalyst had been placed in solution with a ketone, an infinitesimal quantity of ketone (in the order of 0.01%) was found in the mix inside the reactor and subsequently reduced to alcohol by the hydrosilane. Despite an extensive process of analysing reaction risks plus the synthesis of 36 batches without an accident in six years, the accident occurred on the only batch for which the process had been slightly modified. 

The operator reminded plant technicians that: 1. this modification should have been rated as significant and undergone an in-depth, collective analysis prior to implementation; and 2. any modification to a process must be justified and accompanied by compensatory safety measures.

Source:Aria database

DO YOU HAVE BACK UP POWER TO SAFETY CRITICAL EQUIPMENT?

A transformer caught on fire at 7:45 pm on a production building’s basement floor at a pharmaceutical plant. The building’s electrical power was cut, causing shutdown of the reactors’ stirring and cooling mechanisms. An exothermic reaction that was taking place at the time became uncontrollable. The reactor’s rupture disc, calibrated at 4 bar, broke, and the explosion vent opened to protect the structural integrity of the reactor. A quantity of the reaction mix at 70°C, composed of several hazardous products, projected onto one employee and six fire-fighters in the vicinity and formed a 60-m² puddle on the floor. 

The plant operator activated the internal emergency plan and the facility was evacuated. The safety report conducted on-site had not identified any comparable scenario. No backup source had been allocated to ensure the continued operations of critical equipment. Activities assigned to the damaged building and associated solvent storage zone were suspended until the safety systems (fire detection control, both post and automatic extinction) were once again operational. A diagnostic assessment of all site electrical installations was performed, along with a study, on the backup power supply for critical equipment, dedicated to exothermic reactions, i.e.: cooling, stirring, temperature and pressure probes.

Source:Aria database

LIGHTNING STRIKE DAMAGES CARD

A thunderstorm struck in the vicinity of a flammable liquid storage facility protected by an early streamer emission lightning rod. The indirect effects of the lightning damaged one of the 4 computer interface cards. This particular card had interfaced with the bus network responsible for relaying high-level safety alarms from the storage tanks. The facility operator detected the malfunction via the depot supervisor, who had indicated the communication breakdown. The operator did not possess a backup card and was unable to perform a quick replacement. He decided to inform the entire operating staff and requested extra vigilance when monitoring the performance sheets. Operations continued in this manner for 5 days before the interface card could actually be replaced. The damaged card had not been protected against indirect lightning effects. Following this accident, the operator kept on hand an additional card as a backup and implemented the recommendations issued in the study on indirect lightning effects conducted in April 2006. These recommendations focused on the protection, mainly by lightning rod, of the supervisor’s computer, alarm relay units, sensors, utility rooms, fire pumps serving 3 depots, and the electric generating sets for 2 sites.

 Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION

AMMONIA RELEASE DUE TO LACK OF DIAGNOSING THE PROBLEM

 On a tubular exchanger, a disc broke over ¼ of its cross-section at 4:50 am during a pressure surge in the liquid ammonia (NH3 ) circuit connecting NH3 storage cells to a urea workshop operating under stable conditions. NH3 was partially led to a 100-m high degassing stack. Given stable weather conditions, a foul-smelling cloud drifted towards the city. The release occurred unbeknownst to control room operators, who had incorrectly interpreted several alarms that had tripped. Once the diagnosis rendered, the device was isolated at 6:25 am. The plant operator only became aware of the severity of the event at 8 am; two and a half hours were then needed to fully determine the origin and likely causes. The 10 tonnes of NH3 release was due to a succession of physical, organisational and human malfunctions: - Lack of anomaly detection and automatic safety systems: information made available to control room operators was inadequate; - Poor diagnosis / decision-making process lacking adequate verifications despite several precursors; - Incomplete safety recommendations, insufficient monitoring procedures and inspection plans. This poor diagnosis would explain the delay required to isolate the deficient circuit and the potential impact of this release. Long periods elapsed between the onset of the accident, the alarm and activation of the internal emergency plan, source identification, causes and circumstances of the discharge, and then a definitive quantification.

Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION

DOMINO EFFECTS DUE TO POWER NON AVAILABILITY NOT CONSIDERED DURING DESIGN

 In a Seveso chemical plant, a fire broke out at 12:59 pm in a substation supplying a hydrazine hydrate unit. An electrical fault on a cooling water pump caused a generalised short circuit on an electrical tower. The fire alarm was triggered at 1.00 pm. The fire spread to the other towers of the panel through the subfloor. The 400 V circuit breaker located upstream was blocked and did not function. The fault current passed through the 13,000 / 400 V transformer, there was overpressure and an oil leak followed by a primary side homopolar fault causing the 13 kV circuit breaker to trip. The absence of voltage caused the diesel generator set to stop but the switchover to the emergency system failed as the automatism was damaged by the fire. The smoke spread to the UPS room whose door remained opened. The UPS stopped when a high temperature (> 40 °C) was reached causing the loss of control and command on the process. The component switched over to safety mode. Due to the lack of power supply, the cooling system, agitation and the internal and external emergency plan siren were no longer functional. Since the ongoing reaction was exothermic, the reactor temperature and pressure increased. Several measures are taken such as designing an emergency cooling circuit, improving circuit breaker maintenance, sectoring UPS system, electric boards, generator sets, etc.

Source: Aria ACCIDENT ANALYSIS OF INDUSTRIAL AUTOMATION