You are on page 1of 21

Safety

Use Case

Energize Your HAZOP

Histories to

Revie wing incide nt reports at a

Glenn E. Mahnken,

FM Global

Photos: 2000 Factory Mutual Insurance


Company. Reprinted

T
o f

H he process safety management proA grams of many companies include formal process hazards Z analyses, O using methods such as hazard and P operability (HAZOP) studies and m what-if reviews, as key elements e et in g is m or e th a n

just lessons learned

activity. It can spur sharper thinking and lead

with permission.

to a more telling analysi s of your proces ses.

likely to discover the unforeseen effects that might result in a preventable major accident. As noted, the team is working with a basically sound design, so the sought after effects are often quite subtle. To find as many of these as possible, the team must energetically probe and challenge the process design and be able to sustain its efforts over many hours of questioning and answering.

Safety

Table 2. Selected case histories from the AIChE Loss Prevention Symposia (1971 2000). Author(s) R. C. Dartnell, Jr. and T. A. Ventrone Title Year Incident type 197 1
Consequences

Explosion of a ParaNitroMeta-Cresol Unit

A. H. Searson T. J. R. Stephenson and C. B. Livingston

Fire in a Catalytic Reforming Unit Explosion of a Chlorine Distillate Receiver

197 1 197 2

Fire, explosion damage to building, injuries, one fatality. Unexpected thermal degradation of Vapor cloud explosion and major fire, injuries. PNMC caused the rupture of a 3,000 gal stainless Chlorine receiver blew apart into five pieces, also steel causing tank extensive damage to nearby equipment. storage into five pieces inside a building. Corrosion as a result of a process change When led to the welder cut into the steam main, an explosion occurred. rupture of piping and release of hydrocarbons. Hydrogen formed in gpm a corrosive Despite 4,0005,000 water deluge, the fire spread environment to neighboring units causing considerable material
where Cl

damage.

over into thesystems process where Cl Sprinkler contained the fire toTrain 2.

T. A. Kletz

Case Histories on Loss Prevention Emergency Isolation Valves for Chemical Plants

197 3

was high. The vapors ignited due to unknown ignition source. Maintenance was underway to add a branch 14 fatalities, 106 injuries. line to a steam main, which had not been adequately isolated from a process vent prior to welding.
Fire, property damage, business interruption.

T. A. Kletz

197 5

Gasket on a level connection for a reactor burst suddenly, allowing the release of polypropylene vapor, which ignited after about 20 min, probably due to buildup of static electricity in the cloud. During shutdown due to power failure, a 24 in. bellows expansion joint failed, allowing 15,000 gal of polypropylene to to escape. Vapor cloud traveled 250300 ft to furnaces and ignited within about 2 min. Upsets during startup caused high level/low temperature in a feed drum, resulting in cold brittle fracture of a weld. Loss of containment of polypropylene. Vapor cloud ignited. Power failure caused control valves to shut. Thrust forces on pipe caused control loop supports to puncture the pipe, resulting in loss of containment of flammable liquid.

S. A. Saia

Vapor Clouds and Fires in a Light Hydrocarbon Plant

197 6

A. L. M. vanEinjnatten

Explosion in a Naphtha Cracking Unit

1977

V. G. Geishler

Major Effects from Minor Features in Ethylene Plants

197 8

Operat

T. A. Kletz

R. E. Sanders Organisations Have No Memory Explosive Evolution of T. O. Gibson Gas in Manufacture of Ethyl Polysilicate Dust Explosions in D. J. Lewis Storage Silos: Polyvinyl Alcohol

or

Plant Modifications d the Troubles and Treatment


a

opene door to pressu

S. J. Skinner

Learning Value from that a Recent Loss


still

re filter was under

D. R. Pesuit

A Review of Some re. Transportation Accidents, Identification of Causes Reactan

pressu

ts had diffe rent den sitie s and did not mix initi ally. Gas bub bles evol

v e d b y r e a c t i o n a

t interface caused mixing and runaway acceleration of the reaction.

Electrostatic discharge during unloading of polymer from a tanker truck into a silo. Operation had operated without incident for many years.

High pressure caused a cryogenic ethylene tanker truck to explode. It was parked near an alcohol unloading rack. The cause was considered to be freezing of the safety relief valve.

Operad in hydrogen chloride fumes. tor was killed. Explosion: silo


Cov er was blow n off the reac tor and the plant was enve lope

damage.
Oil fire spread to electrical cables and into the control room. Caused emergency evacuation of the control room. A $17.6 million loss. The tanker rocket March 2001

swung over in flames onto the top of the truck and the transfer line.

No flow of oil when a process heater was fired up and the safeguards had been fieldadjusted out of range.

Electrical fault in an indoor transformer containing 235 gal of mineral oil.

6 in. dia. tube ruptured and allowed 1,800 gal of oil to escape. Fire ensued and caused substantial property
ep/

e d . A l c o h o l f i r e .

Vapor cloud explosi on.

74

www.aiche.org/c

CEP

Author(s)

Title

Year

Incident type 19 87

Consequences

P. G. Snyder

Brittle Fracture of a High Pressure Heat Exchanger Explosion and Fire at a Phenol Plant

R. F. Schwab

19 88

Combination of deviations lead to brittle fracture at 3,400 psig during hydrostatic pressure testing of a steam generator following an outage. High temperature as a result of a leaking steam valve, in conjunction with abnormal conditions that arose during process restart, caused explosion of a 25,000 gal tank containing cumene hydroperoxid e. Blown fuse in instrumentation power supply caused series of abnormal conditions, including high condensate level in a steam drum, which overflowed into the steam header. Condensate was introduced into a hot 20 in. dia. line when a steam valve was opened.

T. O. Gibson

Learning Value from a Blown Fuse

19 89

B. W. Bailey

Iron Fire in Heat Recovery Unit

19 90

S. E. Anderson and R. W. Skioss

More Bang for the Buck: Getting the Most from Accident Investigations Management of a Reactive Chemicals Incident: Case Study Case Histories of Some Power and Control-based Process Safety Incidents Catastrophic Failure of a Liquid Carbon Dioxide Storage Vessel Carbon-initiated Effluent Tank Overpressure Incident

19 91

g a lo ad of m et ha cr yli c aci d th at wa s ins uff ici en tly in hi bit ed . W r o n g m a t e r i a l w a s l o a d e d i n t o a c h e m i c a l b a r g e

D. J. Leggett M. L. Griffin and F. H. Garry W. E. Clayton and M. L. Griffin R. E. Sherman, K. C. Crawford, T. M. Cusick, and C. S. Czengery S. Mannan

19 92 19 93

19 94

19 95

Boiler Incident Directly Attributable to PSM Issues Carbon Disulfide Incidents DuringViscose Rayon Processing Air Compressor Delivery Pipeline Failure Plastics in Construction The Hidden Hazard

19 96

D. S. Hall and L. A. Losee F. P. Nichols

19 97 19 98

High temperatures occurred as a result of an electrical short in control wiring while gas turbine was on turning gear. The short caused fuel valves to open and ignition transformer to energize. High temperat ure and runaway reaction occurred in a rail tank car containin

H. L. Febo

19 99

Y. Riezel

Fixed Roof Gas-Oil Tank Explosion

20 00

. High gas flow to a reactor resulted when an air-toopen valve suddenly went to the full open position (as a result of a plugged orifice in the valve positioner).
High temperature occurred in a tank containing 30 m.t. CO 2, when an internal heater failed "on." The high temperature resulted in high pressure. The relief valve on the tank failed to open.

No injuries. Refinery production was curtailed to 6070% for 4 mo. Phenol Unit 1 was almost completely destroyed by fire. Severe damage to adjacent Unit 3. Fuel tank fire.

the area of the reactor.

The tank exploded.


Three fatalities, $20 million property damage, 3 mo. lost production.
The vent stream was in the flammable range, ignited and propagated back to the storage tank. The tank roof was blown off (~200 ft). The boiler was dry fired. Serious internal damage to boiler and steam drum. No injuries (near miss). Explosion blew out a wall. Extensive fire in the ductwork. Minor injuries. The air stream ignited and an explosion p/

propagate da "galloping detonation " in the compresse d air pipeline. All plastic duct work destroyed, scrubber collapsed onto cable tray. Mill was shut down for extended period. Property damage over $5 million. The tank exploded as a result of electrostatic discharge during a sampling operation. One fatality. Massive fire in storage dike.

High temperature (hot spot) developed in a carbon bed absorber connected to the vent line of a 1,000 bbl intermediate effluent storage tank.
Low water level occurred in a high-temperature boiler in a process plant due to failure to follow proper procedures and failure of the low-level interlock. High level of carbon disulfide liquid during a cleaning operation resulted in overflow into the heating zone and sudden volatilization of the liquid. Low flow of air from one of the cylinders of a double-acting reciprocating air compressor resulted in high temperature and concentration of lubricating oil mist in the air stream.

The line ruptured.


Three people were sprayed with steam and condensate. Two fatalities.

Fuel gas burned inside the combustor exhaust duct. The 600 psig heat recovery unit caught fire and was destroyed.
Car exploded. Parts were found 300 yards away. Overhead electrical lines were severed, shutting down production. Incompatible reactive chemicals mixed. 48 72 h state of alert. Near miss.

High temperature occurred in the plastic duct and scrubber due to loss of quenching for the hot flue gases when a pulp mill recovery boiler tripped offline and interlocks failed. More hydrogen was present than was expected in the gas-oil stream sent from a hydrogen desulfurizing unit to a

15,000 m storage tank.

Gas vented into


CEP March 2001

www.aiche.org/ce

75

Safety

Table 1. Case history synopsis hypothetical HAZOP worksheet (in hindsight). Company: ABC Facility: XYZ Plant Process: Waste Gas Incinerator Design Intent: Burn AOG and SVG offgases HAZ OP Item No. Deviat ion Study-Section: 2.1 SVG piping: fan to incinerator HAZOP Date: Leader/Scrib e: Team Members: Engineering / Administrati ve Controls No flow F * C * R *

Cause

Consequences

Questions/ Recommendations

2.1.1

Valves L and K closed improperly

(1) Increase concentration of combustible gases in SVG piping. (2) Potential explosion if gas goes into explosive range and gas reaches incinerator.

Operators follow procedures for shutdowns. High concentratio n alarm.

2.1.1.1 Check procedures for Valves L and K Are procedures clearly documented? Do procedures cover abnormal situations?

2.1.1.2 Check gas alarm response time is it fast enough?

Bypass SVG to flare on high: high gas concentration alarm. Flame arrestor.

2.1.1.3 Check bypass response time vs. travel time to incinerator.

2.1.1.4 Review flame arrestor design vs. expected blast pressures.

Damagelimiting construction.

2.1.1.5 Review flame arrestor design vs. expected reaction forces.

* F = frequency; C = consequence severity; R = risk ranking.

based upon reported CPI plant losses. This benefit is How case histories can help not quantifiable either; it Clearly, a variety of psychological factors come into playrelates to the value of that can encourage or hold back the HAZOP team during learning any kind of history deliberations (2). The intent is to help encourage criticalthat we desire to avoid thinking by making short presentations of previous chemical repeating. In this re-spect, process industries (CPI) plant accidents to the team (3). Ofthe HAZOP session affords course, as a general prerequisite for the suc-cess of any a unique opportunity to HAZOP, the participants must already own the process (4), present these history lessons i.e., the team members must have a strong sense of urgency to busy engineers and plant and be highly motivated by virtue of their roles and personnel who generally are responsibilities as process designers, plant engi-neers,not easy to assemble for supervisors, operators, and technicians. In this con-text, case such purposes. history presentations can be made at the start of a meeting, or during a break to help engage and galvanize the team by Use a synopsis telling a short war story and, at the same time, presentation format demonstrating the connection between HAZOP guidewords HAZOP meeting time is and real world accidents. almost inevitably in short

The immediate benefit of the case history presentation is not sup-ply. And, since the main quantifiable in terms of the HAZOP output; one sim-plyintent of presenting the case surmises that a properly designed 10-minute presenta-tion can be histo-ry is not to study the worthwhile, because a group with an accident example fresh in details of the accident, but their minds will be more critical and more creative in their rather to help energize the deliberations through the course of the study. A long-term critical thinking process, a benefit, assuming case history presenta-tions become an integral synopsis pre-sentation format part of the plants HAZOP ses-sions, is that participants will is most appropriate. In the gradually accumulate a body of loss experience and invaluable context of the study, loss-prevention wisdom providing the basic sequence of events of the acci-dent,

along with a flow schematic, selected loss lessons and key conclusions will suffice as long as these are offered in a manner that engages the interest of the team. The presentation can also include a hypothetical HAZOP worksheet page that illustrates how the accident might have been foreseen in a HAZOP study. This worksheet serves as a minitraining example for new participants and a refresher for those with previous such experience. Of course, the reasons for making the case history presentation also need to be explained to the group at the start of the presentation. The person presenting the case history need not be the group leader or the same individual. Team members can take

76

www.aiche.org/cep/

March 2001

CEP

Figure. 1. Source slide.

wrong valve

Case History Synopsis


Based on the paper: Flashback from Waste Gas Incinerator into Air Supply Piping S. E. Anderson, A. M. Dowell, III, P.E.,

A waste gas incinerator experienced a flashback with a pressure wave in the supply piping
Damage to flame arrestor, piping, fan, and the incinerator

and J. B. Mynaugh
Rohm and Haas Texas, Inc.

P.O. Box 672 Deer Park, TX 77536 Paper 73c prepared for presentation at the 25th Annual AIChE Loss Prevention Symposium, August 18-22, 1991

Figure 2. Summary slide.

Accident Summary

Miscommunication between outside operators and control room resulted in closing the

Figure 5. Cause slide.


Waste Gas Incinerator AOG Waste Gases from Process

Valve L Vent Gases (SVG) from Process Valve K SVG Fan

To SVG Flare

Figure 3. Schematic slide.

Figure 4. Process slide.

Process Description

1 2

Waste gas incinerator burns off-gases from two separate sources: AOG and SVG
SVG stream is normally routed to the waste gas inciner-ator at less than 10% of the lower explosive limit (LEL)

3 1
flare

At 25% LEL, an alarm sounds At 50% LEL, the SVG stream bypasses to the

Initial Cause

3 4

SVG was blocked in: VOCs increased

Field operators misunderstood radio instructions

from the control room to close the AOG valve to the incinerator

Valve L was then reopened, sending the SVG to the incinerator, which flashed back

Valve L was closed by mistake and Valve K was being opened

Figure 6. Consequences slide.

Consequences (Partial list)

1 2

SVG flame arrestor was broken from its mounting bolts and sheared into 2 pieces Stainless steel piping connecting the SVG flame arrestor to SVG fan was broken free from its supports and came to rest on top of the fan Explosion was not stopped by the flame arrestor Incinerator had numerous cracks in the refractory brick radial

p/

77

3 4 5 6 7 8 9

SVG piping going up to reactor rack fell from the third level to the ground Plastic (FRP) piping connected to the SVG fan suction was sheared and broken Missile damage to incinerator bustle

The manual wheel for Valve K was broken off at the gear box casing No injuries But, at the time of the explosion, an operator was holding onto the wheel for Valve K

Figure 7. Conclusions slide.

Some Conclusions

Unusual circumstances of human factors, unsteady-state events, and a rapid challenge combined to overcome the well-designed safety systems.

Much of the serious damage was the result of poor construction. Consult the original paper for additional findings and many recommendations that have general application for this type of equipment.
CEP March 2001 www.aiche.org/ce

Safety

A fire could cost you ...


turns being assigned a case history as prework to study before the meeting, and, using already pre-pared overhead slides or handouts, make the presentation to the rest of the team at a convenient break in the meeting. The original case history ar-ticle should preferably be familiar to the presenter beforehand, but discussion of the accident details should be minimal. The original article can be made available to interested participants for fol-lowup reading outside of the meeting. which supplied one of the two waste gas streams feeding into an incinerator, shut down safely and tripped offline. The incinerator remained in operation, burning waste gas from a second process, called SVG. In preparing the AOG line for a restart, op-erators accidentally closed the wrong valves, resulting in the SVG gas flow being blocked in. The control room operator received a low SVG flow alarm and radioed to the field operators to reopen the SVG valve to the incinerator. The SVG flow to the incinerator was quickly restored and an explosion occurred, resulting in overpressure damage to the incinerator refractory, as well as the dislocation of pip-ing, valves, a flame arrestor, and the main SVG blower. Fortunately, there were no injuries to the operators who were working in the vicinity of the explosion.

e C i t e d

1. Kletz,

T., Hazop and Hazan: Identifying and Assessing Process In-dustry Hazards, 4th ed., Taylor & Francis, London, p. 34 (1999). B., and D. Nicholls, Improving the Effectiveness of HAZOP: A Psychological Approach,Loss Prevention Bulletin, Issue No. 139, p. 8 (1998). G., et al., Using Case Histories in PHA Meetings, Paper 6c, presented at AIChE 34th Annual Loss Prevention Symposium, Atlanta (Mar. 69, 2000). T., Hazop and Hazan: Identifying and Assessing Process In-dustry Hazards, 4th ed., Taylor & Francis, London, p. 33 (1999). al., Flashback from Waste Gas Incinerator into Air Supply Piping, Paper 73c, AIChE 25th Annual Loss Prevention Symposium, Pittsburgh (Aug. 1821, 1991).

2. Leathley,

3. Mahnken,

4. Kletz,

Example presentation
A wellknown case history paper describing a waste-gasincinerator explosion at a chemical plant was presented at the 25th annual AIChE Loss Prevention Symposium (5). As described in the original paper, the accident evolved as follows: The AOG process,

5. Anderson, S. E., et

L i t e r a t u r

6. Loss

Prevention on CD ROM, AIChE, New York (1998). The set contains presentations from all 31 Loss Prevention

a selected list of these reports from 19712000 that can be used in the manner described above. Other sources are available as well, such as case historybased loss 7. Kletz, T., What Went prevention books (7, Wrong: Case Histories of more Process Plant Dis-asters, 8),than loss prevention you journals, know. e.g., the 4th ed., Gulf Publishing, Houston (1998). Loss Prevention 8. Sanders, R. E., Bulletin, and Chemical Process Safety: published investigaLearning from Case Histive reports. A good tories, Butterworth source of these Heineman, Boston (1999). reports is the U.S. A synopsis of Chemical Safety and this accident, prepared in a slide Hazard Investigation format intended for Board, Washing-ton, presentation to DC. The CSB allows HAZOP groups, is downloading of its given in Figures 1 investigation

Symposia spon-sored by AIChEs Safety and Health Division from 1967 to 1997, plus early CCPS conference and workshop proceedings from 1987 through 1994. (See www.aiche.org/pubcat.)

through 7. Table 1 represents a hypothetical HAZOP worksheet that predicts the accident (in perfect hindsight, of course). The worksheet attempts to demon-strate to the team how, by using critical thinking and following HAZOP methodology, they might have been able to identify some of the possible causes and consequences, as well as develop the corresponding action items to help pre-vent or mitigate an actual accident.

reports at www.csb.gov.

C E P

<Di
scu ss Thi s Arti cle!

>
T o j o i n a n o n l i n e d i s c u s s i o n a b o u t

Sources of accident case history reports


The annual AIChE Loss Symposium Papers (6) include many accident case history studies that are detailed and, often, written first hand by the accident investigators or participants. Table 2 is

t h i s a r t i c l e w i t h t h e a u t h o r a n d o t h e r r e a d e r s , g o

t o t h e P r o c e s s C i t y D i s c u s s i o n R o o m f o r C E P a r t i c l e s

a t w w w . p r o c e s s c i t y . c o m / c e p .

7.

E. MAHNKEN is a loss prevention specialist with FM Global (formerly known as Factory Mutual), Norwood, MA ((781) 440-8000 ext. 8644; Fax: (781) 440-8718; Email: glenn.mahnken@fmglo bal.com). He has been with the company for 15 years, and holds a BA in biology from Antioch College and a BS in chemical engineering from the National Technical University of Athens, Greece. He is a member of AIChE.

78
www.aiche.org/cep/

March 2001

CEP