What Went Wrong?: Case Histories of Process Plant Disasters and How They Could Have Been Avoided

What Went Wrong?

Case Histories of Process Plant Disasters and How They Could Have Been Avoided

Fifth Edition

Trevor Kletz

Table of Contents

Cover image

Title page

Copyright

Dedication

Acknowledgments

Preface

How to Use This Book

Units and Nomenclature

A Note About Nomenclature

Part A: What Went Wrong?

Chapter 1. Preparation for Maintenance

Publisher Summary

1.1 Isolation

1.2 Identification

1.3 Removal of Hazards

1.4 Procedures not Followed

1.5 Quality of Maintenance

1.6 A Personal Note

References

Chapter 2. Modifications

Publisher Summary

2.1 Startup Modifications

2.2 Minor Modifications

2.3 Modifications Made During Maintenance

2.4 Temporary Modifications

2.5 Sanctioned Modifications

2.6 Process Modifications

2.7 New Tools

2.8 Organizational Changes

2.9 Gradual Changes

2.10 Modification Chains

2.11 Modifications Made to Improve the Environment

2.12 Control of Modifications

References

Chapter 3. Accidents Said to Be Due to Human Error

Publisher Summary

3.1 Introduction

3.2 Accidents that Could be Prevented by Changing the Plant Design or Method of Working

3.3 Accidents that Could be Prevented by Better Training

References

Chapter 4. Labeling

Publisher Summary

4.1 Labeling of Equipment

4.2 Labeling of Instruments

4.3 Labeling of Chemicals

4.4 Labels not Understood

References

Chapter 5. Storage Tanks

Publisher Summary

5.1 Overfilling

5.2 Overpressuring

5.3 Sucking In

5.4 Explosions

5.5 Floating-Roof Tanks

5.6 Miscellaneous Incidents

5.7 Fiberglass-Reinforced (FRP) Tanks

References

Chapter 6. Stacks

Publisher Summary

6.1 Stack Explosions

6.2 Blocked Stacks

6.3 Heat Radiation

References

Chapter 7. Leaks

Publisher Summary

7.1 Some Common Sources of Leaks

7.2 Control of Leaks

7.3 Leaks onto Water, Wet Ground, or Insulation

7.4 Detection of Leaks

7.5 Fugitive Emissions

References

Chapter 8. Liquefied Flammable Gases

Publisher Summary

8.1 Major Leaks

8.2 Minor Leaks

8.3 Other Leaks

8.4 Safety in the Design of Plants Handling Liquefied Light Hydrocarbons

References

Chapter 9. Pipe and Vessel Failures

Publisher Summary

9.1 Pipe Failures

9.1.1 Dead-Ends

9.1.2 Poor Support

9.1.3 Water Injection

9.1.4 Bellows

9.2 Pressure Vessel Failures

References

Chapter 10. Other Equipment

Publisher Summary

10.1 Centrifuges

10.2 Pumps

10.3 Air Coolers

10.4 Relief Valves

10.5 Heat Exchangers

10.6 Cooling Towers

10.7 Furnaces

References

Chapter 11. Entry to Vessels

Publisher Summary

11.1 Vessels not Freed from Hazardous Material

11.2 Hazardous Materials Introduced

11.3 Vessels not Isolated from Sources of Danger

11.4 Unauthorized Entry

11.5 Entry into Vessels with Irrespirable Atmospheres

11.6 Rescue

11.7 Analysis Of Vessel Atmosphere

11.8 What is a Confined Space?

11.9 Every Possible Error

References

Chapter 12. Hazards of Common Materials

Publisher Summary

12.1 Compressed Air

12.2 Water

12.3 Nitrogen [4,29]

12.4 Heavy Oils (Including Heat Transfer Oils)

References

Chapter 13. Tank Trucks and Cars

Publisher Summary

13.1 Overfilling

13.2 Burst Hoses

13.3 Fires and Explosions

13.4 Liquefied Flammable Gases

13.5 Compressed Air

13.6 Tipping Up

13.7 Emptying into or Filling from the Wrong Place

13.8 Contact with Live Power Lines

References

Chapter 14. Testing of Trips and Other Protective Systems

Publisher Summary

14.1 Testing Should be Thorough

14.2 All Protective Equipment should be Tested

14.3 Testing Can be Overdone

14.4 Protective Systems Should not Reset Themselves

14.5 Trips Should not be Disarmed Without Authorization

14.6 Instruments should Measure Directly What we Need to Know

14.7 Trips are for Emergencies, not for Routine Use

14.8 Tests may Find Faults

14.9 Some Miscellaneous Incidents

14.10 Some Accidents at Sea

References

Chapter 15. Static Electricity

Publisher Summary

15.1 Static Electricity from Flowing Liquids

15.2 Static Electricity from Gas and Water Jets

15.3 Static Electricity from Powders and Plastics

15.4 Static Electricity from Clothing

References

Chapter 16. Materials of Construction

Publisher Summary

16.1 Wrong Material Used

16.2 Hydrogen Produced by Corrosion

16.3 Other Effects of Corrosion

16.4 Loss of Protective Coatings

16.5 Some other Incidents Caused by Corrosion

16.6 Fires

16.7 Choosing Materials

References

Chapter 17. Operating Methods

Publisher Summary

17.1 Trapped Pressure

17.2 Clearing Choked Lines

17.3 Faulty Valve Positioning

17.4 Responsibilities not Defined

17.5 Communication Failures

17.6 Work at Open Manholes

17.7 One Line, Two Duties

17.8 Inadvertent Isolation

17.9 Incompatible Storage

17.10 Maintenance: Is it Really Necessary?

17.11 An Interlock Failure

17.12 Emulsion Breaking

17.13 Chimney Effects

References

Chapter 18. Reverse Flow, Other Unforeseen Deviations, and Hazop

Publisher Summary

18.1 Reverse Flow from a Product Receiver or Blowdown Line Back into the Plant

18.2 Reverse Flow into Service Mains

18.3 Reverse Flow Through Pumps

18.4 Reverse Flow from Reactors

18.5 Reverse Flow from Drains

18.6 Other Deviations

18.7 A Method for Foreseeing Deviations

18.8 Some Pitfalls in Hazop

18.9 Hazop of Batch Plants

18.10 Hazop of Tank Trucks

18.11 Hazop: Conclusions

References

Chapter 19. I Didn't Know That ♦ ♦ ♦

Publisher Summary

19.1 Ammonia can Explode

19.2 Hydraulic Pressure Tests can be Hazardous

19.3 Diesel Engines can Ignite Leaks

19.4 Carbon Dioxide can Ignite a Flammable Mixture

19.5 Mists can Explode

19.6 The Source of the Problem Lay Elsewhere

References

Chapter 20. Problems with Computer Control

Publisher Summary

20.1 Hardware and Software Faults

20.2 Treating the Computer as a Black Box

20.3 Misjudging the way Operators will Respond

20.4 Other Problems

20.5 Unauthorized Interference

20.6 New Applications

20.7 Conclusions

References

Additional Reading

Chapter 21. Inherently Safer Design

Publisher Summary

21.1 Bhopal

21.2 Other Examples of Inherently Safer Design

21.3 User-Friendly Design

References

Additional Reading on Bhopal

Chapter 22. Reactions—Planned and Unplanned

Publisher Summary

22.1 Lack of Knowledge

22.2 Poor Mixing

22.3 Contamination

22.4 Reactions with Auxiliary Materials

22.5 Poor Training or Procedures

22.6 Use-by Dates

References

Additional Reading on Runaway Reactions

Part B: Still Going Wrong

Still Going Wrong

Introduction to Part B

Chapter 23. Maintenance

Publisher Summary

23.1 Inadequate Preparation on a Distant Plant

23.2 Precautions Relaxed too Soon

23.3 Failure to Isolate Results in a Fire

23.4 Unintentional Isolation

23.5 Bad Practice and Poor Detailed Design

23.6 Dismantling

23.7 Commissioning

23.8 Other Hidden Hazards

23.9 Changes in Procedure

23.10 Dead-Ends

References

Chapter 24. Entry into Confined Spaces

Publisher Summary

24.1 Incomplete Isolation

24.2 Hazardous Materials Introduced

24.3 Weaknesses in Protective Equipment

24.4 Poor Analysis of Atmosphere

24.5 When Does a Space Become Confined?

24.6 My First Entry and a Gasholder Explosion

24.7 Failure of a Complex Procedure

24.8 Epidemics of Unsafe Entries

References

Chapter 25. Changes to Processes and Plants

Publisher Summary

25.1 Changes to Processes

25.2 Changes to Plant Equipment

25.3 Gradual Changes

25.4 Changes made Because the Reasons for Equipment or Procedures has Been Forgotten

References

Chapter 26. Changes in Organization

Publisher Summary

26.1 An Incident at an Ethylene Plant

26.2 The Longford Explosion

26.3 The Texas City Explosion

26.4 Outsourcing

26.5 Multiskilling and Downsizing

26.6 How to Lose your Reputation

26.7 Administrative Convenience Versus Good Science

26.8 The Control of Managerial Modifications

26.9 Some Points a Guide Sheet Should Cover

26.10 Afterthoughts

References

Chapter 27. Changing Procedures Instead of Designs

Publisher Summary

27.1 Misleading Valve Layouts

27.2 Simple Redesign Overlooked

27.3 Unimaginative Thinking

27.4 Just Telling People to Follow the Rules

27.5 Don't Assemble it Incorrectly

27.6 Tighten Correctly or Remove the Need

27.7 Should Improvements to Procedures Ever be the First Choice?

References

Chapter 28. Materials of Construction (Including Insulation)

Publisher Summary

28.1 Rust

28.2 Insulation

28.3 Brittle Failure

28.4 Wrong Materials of Construction

28.5 Corrosion Sends a Column into Orbit

28.6 Unexpected Corrosion

28.7 Another Failure to Inspect Pipework

28.8 How not to Write an Accident Report

References

Chapter 29. Operating Methods

Publisher Summary

29.1 The Alarm Must be False

29.2 A Familiar Accident—But not as Simple as it Seemed

29.3 More Reluctance to Believe the Alarm

29.4 The Limitations of Instructions

29.5 The Limitations of Instructions Again

29.6 Empty Plant That is Out of Use

29.7 A Minor Job Forgotten—Until there was a Leak

29.8 Design Error + Construction Error + Operating Error = Spillage

References

Chapter 30. Explosions

Publisher Summary

30.1 An Explosion in a Gas-Oil Tank

30.2 Another Sort of Explosion

30.3 One + One = More than Two

30.4 Near Enough is Good Enough

30.5 Another Explosion Ignited by a Carbon Bed

30.6 An Explosion in an Alternative to a Carbon Bed

30.7 Only a Minor Change

30.8 An Explosion in a Pipe

30.9 A Dust Explosion in a Duct

30.10 Obvious Precautions Neglected

30.11 A Drum Explosion

30.12 Foam-Over—The Cinderella of the Oil and Chemical Industries

30.13 Explosions of Cold Gasoline in the Open Air

30.14 The Inevitability of Ignition

References

Chapter 31. Poor Communication

Publisher Summary

31.1 What is Meant By Similar?

31.3 Wrong Material Delivered

31.4 Packaged Deals

31.5 Draftsmen's Delusions

31.6 Same Plant and Product, but no Communication

31.7 A Failure at the Design/Construction Interface

31.8 Failure of Communication Between Marketing and Technology

31.9 Too Much Communication

31.10 No One Told the Designers

31.11 Conclusions

References

Chapter 32. I Did Not Know ♦♦♦

Publisher Summary

32.1 … That Metals Can Burn

32.2 … That Aluminum is Dangerous When Wet

32.3 … That Rubber and Plastics are Permeable

32.4 …That Some Plastics can Absorb Process Materials and Swell

32.5 … What Lay Underneath

32.6 … The Method of Construction

32.7 … Much about Static Electricity

32.8 … That a Little Contamination can have a Big Effect

32.9 … That we cannot get a Tight Seal between Thin Bolted Sheets

32.10 … That Unforeseen Sources of Ignition are Often Present

32.11 … That Keeping the Letter of the Law is not Enough

32.12 … The Power of Compressed Air

References

Chapter 33. Control

Publisher Summary

33.1 Instruments that cannot do what we want them to do

33.2 Too Little Instrumentation

33.3 Diagrams were not up to Date

33.4 An Automatic Restart Fails to Restart

33.5 Procedures: An Essential Feature of Control Systems

References

Chapter 34. Leaks

Publisher Summary

34.1 Leaks from Tanks

34.2 Leaks from Lined Pipes

34.3 A Leak through Closed Valves

34.4 A Leak caused by Surge Pressure

34.5 Leaks from Screwed Fittings

34.6 Other weak Spots in Pipework

References

Chapter 35. Reactions—Planned and Unplanned

Publisher Summary

35.1 Delayed Mixing

35.2 Waiting Until after the Fourth Accident

35.3 Lower Temperature may not mean less Risk

35.4 Forgetting to add a Reactant

35.5 Inadequate Tests

35.6 A Heating Medium was too Hot

35.7 An Unstable Substance Left Standing for too Long

References

Chapter 36. Both Design and Operations Could Have Been Better

Publisher Summary

36.1 Water in Relief Valve Tailpipes

36.2 A Journey in a Time Machine

36.3 Chokes in Flarestacks

36.4 Other Explosions in Flarestacks

36.5 Design Poor, Protection Neglected

36.6 Several Poor Systems do not make a Good System

36.7 Failures in Management, Equipment, and Control Systems

36.8 Changes to Design and Operations

36.9 The Irrelevance of Blame

References

Chapter 37. Accidents in Other Industries

Publisher Summary

37.1 An Explosion in a Coal Mine

37.2 Marine Accidents

37.3 Human Error

37.4 Tests should be like Real Life

37.5 Load and Strength too Close

37.6 The Nineteenth Century

References

Chapter 38. Accident Investigation—Missed Opportunities

Publisher Summary

38.1 Accident Investigations often find only a Single Cause

38.2 Accident Investigations are often Superficial

38.3 Accident Investigations List Human Error as a Cause

38.4 Accident Reports Look for People to Blame

38.5 Accident Reports List Causes that are Difficult or Impossible to Remove

38.6 We Change Procedures Rather than Designs

38.7 We May go too Far

38.8 We do not Let others Learn from our Experience

38.9 We Read or Receive only Overviews

38.10 We Forget the Lessons Learned and Allow the Accident to Happen Again

References

Chapter 39. An Accident That May Have Affected the Future of Process Safety

Publisher Summary

39.1 Why did ICI, more so than other Companies, make these Changes?

39.2 What Would Have Happened if ICI had not Existed?

39.3 Why did ICI come to an End?

39.4 What will we Miss in the Years to Come?

References

Appendix 1. Relative Frequencies of Incidents

Primary Causes

Responsibility

Appendix 2. Why Should We Publish Accident Reports?

It's Not Like That Today

Appendix 3. Some Tips for Accident Investigators

Appendix 4. Recommended Reading

Appendix 5. Afterthoughts

Index

Copyright

Gulf Professional Publishing is an imprint of Elsevier

30 Corporate Drive, Suite 400, Burlington, MA 01803, USA

Linacre House, Jordan Hill, Oxford OX2 82P

Copyright © 2009, Elsevier Inc. All rights reserved.

The author has asserted his moral right to be recognized as the author of this book.

No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording, or any information storage and retrieval system, without permission in writing from the publisher.

Permissions may be sought directly from Elsevier's Science & Technology Rights Department in Oxford, UK: phone: (+44) 1865 843830, fax: (+44) 1865 853333, E-mail: permissions@elsevier.co.uk. You may also complete your request on-line via the Elsevier homepage (http://elsevier.com), by selecting Customer Support and then ‘Obtaining Permissions."

Library of Congress Cataloging-in-Publication Data Kletz, Trevor A.

What went wrong?: case histories of process plant disasters and how they could have been avoided/Trevor Kletz. —5th ed.

p. cm.

Includes bibliographical references and index.

ISBN 978-1-85617-531-9 (hardcover: alk. paper) 1.

Chemical plants—Accidents. I. Title.

TP155.5.K54 2009

363.11′966—dc22

2009011194

British Library Cataloguing in Publication Data

A catalogue record for this book is available from the British Library

ISBN 13: 978-1-85617-531-9

For all information on all Elsevier Gulf Professional Publishing publications visit our Web site at www.elsevierdirect.com

Printed in the United States of America

Transferred to Digital Printing in 2013

Dedication

To Denise

Who waited while I scorned delights and lived laborious days but never saw the results.

Only that shall happen

Which has happened,

Only that occur

Which has occurred;

There is nothing new

Beneath the sun…

For as wisdom grows, vexation grows;

To increase learning is to increase heartache.

—Ecclesiastes 1: 9 and 18

Acknowledgments

Thanks are due to the staffs of the companies where the incidents occurred for allowing me to describe their mistakes; to many colleagues, past and present, especially to Professor F. P. Lees for his ideas and advice; and to the U.K. Science and Engineering Research Council and the Leverhulme Trust for their financial support of the first edition.

Preface

In 1968, after many years' experience in plant operations, I was appointed safety adviser to the heavy organic chemicals division (later the petrochemicals division) of Imperial Chemical Industries. My appointment followed a number of serious fires in the 1960s, and therefore I was mainly concerned with process hazards rather than those of a mechanical nature. Today I would be called a process safety adviser.

One of my tasks was to pass on to design and operating staff details of accidents that had occurred and the lessons that should be learned. This book contains a selection of the reports I collected from many different companies, as well as many later reports. Although most have been published before, they were scattered among many different publications, some with small circulations.

The purpose here is to show what has gone wrong in the past and to suggest how similar incidents might be prevented in the future. Unfortunately, the history of the process industries shows that many incidents are repeated after a lapse of a few years. People move on, and the lessons are forgotten. This book will help keep the memories alive.

The advice is given in good faith but without warranty. Readers should satisfy themselves that it applies to their circumstances. In fact, you may feel that some of my recommendations are not appropriate for your company. Fair enough, but if the incidents could occur in your company, and you do not wish to adopt my advice, then please do something else instead. But do not ignore the incidents.

To quote the advice of John Bunyan, written more than 300 years ago,

What of my dross thou findest there, be bold

To throw away, but yet preserve the gold.

What if my gold be wrapped up in ore?

None throws away the apple for the core:

But if thou shalt cast all away as vain …

You have been warned what will happen.

You may believe that the accidents could not happen at your plant because you have systems to prevent them. Are you are sure that they are always followed, everywhere, all the time? Perhaps they are followed most of the time but someone turns a blind eye when a job is urgent. Also remember that systems have limitations. All they can do is make the most of people's knowledge and experience by applying them in a systematic way. If people lack knowledge and experience, the systems are empty shells.

Many of the accidents I describe occurred in plants that had such systems, but the systems were not always followed. The accidents happened because of various management failures: failure to convince people that they should follow the systems, failure to detect previous violations (by audits, spot checks, or just keeping an open eye), or deliberately turning a blind eye to avoid conflict or to get a job done quickly. The first step down the road to many a serious accident occurred when someone turned a blind eye to a missing blind (see Chapter 1).

The incidents described could occur in many different types of plants and are therefore of widespread interest. Some of them illustrate the hazards involved in activities such as preparing equipment for maintenance and modifying plants. Others illustrate the hazards associated with widely used equipment, such as storage tanks and hoses, and with that universal component of all plants and processes: people. Other incidents illustrate the need for techniques, such as hazard and operability studies, and protective devices, such as emergency isolation valves.

You will notice that most of the incidents are very simple. No esoteric knowledge or detailed study was required to prevent them—only a knowledge of what had happened before, which this book provides.

Only a few incidents started with the sudden failure of a major component. Most started with a flaw in a minor component, an instrument that was out of order or not believed, a poor procedure, or a failure to follow procedures or good engineering practice. For want of a nail, a kingdom was lost.

Many of the incidents described could be discussed under more than one heading. Therefore, cross-references have been included.

If an incident that happened in your plant is described, you may notice that one or two details have been changed. Sometimes this has been done to make it harder for people to tell where the incident occurred. Sometimes this has been done to make a complicated story simpler but without affecting the essential message. Sometimes—and this is the most likely reason—the incident did not happen in your plant at all. Another plant had a similar incident.

Many of the incidents did not actually result in death, serious injury, or serious damage—they were so-called near misses, although they were really near accidents. But they could have had much more serious consequences. We should learn from these near misses, as well as from incidents that had serious results.

Most of the incidents described occurred at so-c