Ccps Process Safety Beacons Aio 2001 To 2018 15079

This issue sponsored by
http://www.aiche.org/CCPS/Publications/Beacon/index.aspx
www.aiche.org/ccps www.iomosaic.com
Messages for Manufacturing Personnel
Maintain a Sense of Vulnerability April 2018
Maintaining a sense of vulnerability is an essential characteristic of a good process safety culture. What does
“maintain a sense of vulnerability” mean? It means that everybody in your plant:
 Has a high level of awareness of the hazards of your processes and materials.
 Is constantly vigilant for symptoms of weaknesses that might foreshadow more serious events. This includes
reporting near miss events (March 2018 Beacon).
 Avoids complacency that might result from good past performance and a good safety record.
On April 15, 1912 (106 years ago this month) the ocean liner Titanic sank in less than 3 hours after hitting an iceberg
in the north Atlantic Ocean, with the loss of over 1,500 lives. There are many examples of a failure to maintain a sense
of vulnerability in the design and operation of the Titanic. For example:
 The ship was perceived to be “unsinkable” resulting in poor critical safety decisions. For example, water tight
bulkheads stopped two decks below the main deck. Lifeboats were considered “unnecessary” and the number of
lifeboats was reduced from 64 to 16, so there were not enough for all passengers and crew.
 The captain was considered to be overconfident in his seamanship and the invincibility of his ship.
 The ship was traveling at high speed, although its course was through floating pack ice. Despite warnings about
icebergs from other ships, at no time was any order to slow down given.
By Willy Stöwer,Magazine Die Gartenlaube, en:Die Gartenlaube NOAA/Institute for Exploration/University of Rhode Island
F.G.O. Stuart (1843-1923) Public domain.. and de:Die Gartenlaube, Public domain. (NOAA/IFE/URI) Public domain.
Do you know? What can you do?

Failure to maintain a sense of vulnerability  Understand the hazards of your process and materials. Know
has been a factor in process industry tragedies. what the worst-case incident is, and what safety systems and
For example, in December 1984 a toxic gas procedures are in place to prevent it. Understand how you can
(methyl isocyanate – MIC) release in Bhopal, be sure that those systems and procedures are working
India caused thousands of fatalities. Following properly, and inform management if you see weaknesses.
the tragedy, it was found that several critical  Never think “it can’t happen here” or “it can’t happen to me.” It
safety systems had not been functioning for can!
some time.  Encourage everyone at your plant to have a calm awareness that
 A vent gas scrubber and flare tower were the worst-case scenario can happen, and it could happen right
out of service. now! Know what you can do to prevent it, what to do if it
 A refrigeration system for the MIC storage happens, and always be ready to follow emergency response
tank had been left idle. procedures.
 Pipe blinds that would have prevented the  Understand the potential impact of the full range of events
water contamination that initiated the which could occur in your plant, not only the “worst case”
incident had not been installed. event.
“It does not do to leave a live dragon out of your calculations, if you live near him.”
– J. R. R. Tolkien, The Hobbit, Chapter XII
©AIChE2018. All rights reserved. Reproduction for non-commercial, educational purposes is encouraged. However, reproduction for any
commercial purpose without express written consent of AIChE is strictly prohibited. Contact us at ccps_beacon@aiche.org or 646-495-1371.
The Beacon is usually available in Afrikaans, Arabic, Catalan, Chinese, Czech, Danish, Dutch, English, Filipino, French, German, Greek, Gujarati, Hebrew, Hindi, Hungarian, Indonesian,
Italian, Japanese, Korean, Malay, Marathi, Mongolian, Persian (Farsi), Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, Urdu, and Vietnamese.
Reporting and Investigating Near Misses March 2018
On January 28, 1986 the US Space Shuttle Challenger exploded 1 2
73 seconds after launch from Cape Canaveral, Florida (1, 2). The
Challenger was destroyed and all seven crew members were lost.
The immediate cause was a leak of hot gas from a joint in the solid
fuel rocket boosters. The hot gas impinged on the hydrogen fuel Solid fuel rockets
tank causing it to rupture and explode. Adjoining segments of the

solid fuel rocket boosters were sealed with primary and secondary
"O-rings" in the joints. Both seals on a joint failed because of low
temperature on the launch day. There had been several prior Leaking solid fuel
launches in which the primary seal had failed, but the secondary rocket joint
Shuttle Challenger
seal successfully preserved the solid fuel rocket integrity. These
prior failures were near misses that were not deemed serious
enough for investigation. 3 4
Failure to report and investigate near misses has been a factor in
process industry incidents as well. For example, on April 8, 1998 a
runaway reaction overpressurized a 2000 gallon batch reactor (3)
at a plant in New Jersey. The explosion and fire (4) injured 9
workers, 2 seriously. Operators were unable to control the batch
temperature using existing procedures and available cooling. In at
least 6 previous batches, operators had been unable to control the
temperature below the specified maximum, but the temperature did
not get high enough for a runaway reaction. These prior near-miss
incidents were not investigated.
 Following a major process safety incident, investigators  Understand your plant’s incident and near miss
often find that there were previous warnings and near reporting and investigation system. If your plant
misses. If these had been reported, investigated, and doesn’t have such a system, suggest to your
investigation findings implemented, the major incident management that they implement a system.
could have been prevented.  Report all near misses, including failure to
 We would all prefer to learn from near misses, where there control your process within safe operating limits
were no injuries and damage was not significant, rather and operation of safety or backup systems.
than from serious incidents.  Don’t assume that supervisors, managers, and
 Near misses cannot be investigated if nobody reports them! technical staff will observe near miss events by
Near misses will not be reported if people fail to recognize reading shift logs, instrument records, or other
the incidents as near misses, or if they do not understand process data. A plant generates a lot of data, and
their significance. these events might be missed. If you recognize a
 Safe process operation requires control of your process. If near miss, it is your responsibility to make sure
you are unable to control your process within specified management is aware of it.
safe operating limits for any critical process safety  If you are not sure if something is a near miss,
parameter you must recognize this as a near miss. report it anyway. Also, think about “how bad
 Successful activation of any safety device or backup could it have been” to help identify a near miss.
device should be considered a near miss. What if the safety  Volunteer to participate in investigations of near
or backup device had failed? misses and incidents in your plant.
Your plant is talking to you through near misses – is anybody listening?

Runaway reactions caused by contamination February 2018
Incident 1: A pipe containing an organic residue
from distillation processes and liquid drained from
process vent systems was isolated by closed valves.
The pipe was steam-traced to keep the residue from
solidifying. During a weekend shutdown, the pipe
exploded (Figures 1a and 1b). Nobody was injured
because the building was not occupied, and damage 1a 2a
was minimal.
Incident 2: A railroad tank car containing crude
methacrylic acid (MAA) was observed to be hot
and venting material from its relief valve. The area
was evacuated, and after some time the rail car
exploded, destroying the car and causing significant
damage in the area (Figures 2a and 2b) Because
people had evacuated, there were no injuries. 1b 2b
What Happened?
Most incidents have multiple causes. For each of these incidents, contamination was a contributing cause.
Incident 1: The temperature control system on the steam tracing for the pipe had failed, resulting in high temperature.
This should not have resulted in decomposition and explosion, but the residue had been contaminated with about 1%
water. Water vapor from process vessels condensed in the vent system and drained into the residue tank. Laboratory tests
confirmed that this amount of water reduced the decomposition temperature of the residue by about 100°C. The
temperature resulting from the steam temperature control failure was high enough to initiate decomposition.
Incident 2: Crude MAA contains strong mineral acids from the manufacturing process which corrode stainless steel.
The dissolved metal from corrosion increases the tendency of MAA to polymerize. Crude MAA is supposed to be stored
in lined tank cars, but, in this incident, an unlined stainless steel tank car was used. Also, the plant did not add the
specified amount of polymerization inhibitor to the crude MAA. The inhibitor stabilizes MAA by stopping slow
polymerization that occurs, even in pure material. The metal contamination from corrosion of the tank car may have
induced the polymerization, and the reduced inhibitor concentration diminished the stability of MAA, ultimately leading
to the runaway polymerization and explosion.
References: Incident 1 – Hendershot, et al., Process Safety Progress 22 (1), pp. 48-56 (2003). Incident 2 – Anderson and Skloss, Process Safety Progress 11 (3), pp. 151-156 (1992).
What can you do?

 When you check safety information (Safety Data Sheets, operating procedures, etc.) for materials in your plant, pay attention to
possible hazardous reactions such as decomposition and polymerization as a result of contamination. Be aware of any specific
contaminants of concern which are present in your plant.
 Some contaminants are common – rust, water, heat transfer fluids, lubricants, metals and other products from corrosion of pipes
and equipment. Know if any of these common contaminants are of concern for your process.
 Recognize that even a small amount of contaminant can be enough to cause a dangerous reaction.
 Follow all procedures for avoiding contamination in your plant and equipment. Take special care to verify the identity of materials
before unloading into storage tanks or other plant equipment.
 Always use the correct material of construction for all components when doing maintenance in your plant.
 Confirm that containers you fill (pails, drums, tank trucks, rail cars, etc.) are the correct material of construction.
 Make sure that pipes, vessels, and portable containers that you use are clean. “Clean” means free from deposits, residue, rust, or
other contamination as appropriate and defined by your plant procedures for the specific service.
A small amount of contamination can cause a big problem!

Could your plant be impacted by a natural disaster? January 2018
In recent years, many natural disasters have been

in the news all over the world. The pictures show
Fort
McMurray
some examples:
1. May 2016 satellite photo of wildfires in near Fort
Oil Sands
Facilities
Fires
McMurray, Alberta, Canada, showing the location
Fires
of nearby oil processing facilities.
2. The Fort McMurray fires.
1 Fires 2 3. Hurricane Harvey at near maximum strength in
August 2017 as it approaches the Texas coast.
4. Flooding in Houston, Texas caused by rain from
Hurricane Harvey.
5. Trailers containing organic peroxides in a process
plant exploded because refrigeration systems were
out of commission due to loss of electric power
following Hurricane Harvey.
6. The Fukushima Daiichi nuclear power plant in
3 4 Japan lost power in March 2011 as a result of a
By Digital Globe [CC BY-SA 3.0 (https://creativecommons.org/licenses/by-sa/3.0)], via Wikimedia Commons
major earthquake and subsequent tsunami.

Insufficient cooling caused three nuclear reactor
meltdowns, hydrogen-air explosions, and the
release of radioactive material.
These events and others like them had, or could

5 6 have had, significant impacts on process plants.
What can you do?

 Know your plant emergency procedures for natural disasters and understand your role in preparing for, responding to,
and recovering from the event. The type of disaster which can impact your plant will depend on where your plant is
located and what kind of natural events might happen in that place.
 Check that your emergency procedures take into consideration that some natural events such as earthquakes and
tornadoes may occur with little or no advance warning.
 Confirm that plans consider workers who remain on site during and immediately after a natural event. The workers
require support (food, shelter, communications, etc.), and roads and other public infrastructure may be out of service.
 Understand how your area of responsibility could be impacted by a natural event, especially where there are specific
process hazards – for example, the organic peroxide decomposition described in item 5 above. Review the disaster
response plans and check that they are thorough and complete for your work area.
 If you identify something which you think is important, and which is not covered by the existing plans, bring your
concerns to the attention of your supervisors so the plans can be improved.
 Recognize that employees may not be able to report to work after a natural disaster, and that workers on site may not be
able to go home. Be sure your plans consider these possibilities, as well as the potential of limited staffing.
 Develop a personal emergency plan for yourself and your family for the kinds of disasters which can occur where you
live and work. You won’t be able to work effectively if you are worried about your family!
 Read the November 2005 and June 2011 Beacons for more advice on natural disaster preparation.
Be prepared for natural disasters!

Liquefied Gases December 2017
In July 1948 a tank car filled with dimethyl ether (DME)
1
arrived at a factory in Ludwigshafen, Germany. It stood in
sunlight for about 10 hours when it is believed that a weld
seam failed. About 200 people were killed, nearly all by the
explosion of the flammable DME vapor cloud created by the
leak. Nearly 4000 people were injured, the majority by
exposure to toxic substances escaping from installations
damaged by the blast (Picture 1).
In July 1978, a tank truck carrying propylene ruptured,
and the released gas ignited. This occurred in a vacation area
2
near Tarragona, Spain. The explosion killed 217 people,
including the driver. 200 other people were severely burned
(Picture 2).
A common cause of these accidents was a tank overfilled
with liquefied gas. In the first incident, the tank identification
plate incorrectly showed a higher capacity than the tank car
could actually hold. In the second incident the cause may
have been human error when filling the tank.
Did you know? What can you do?
 Gases such as nitrogen, oxygen, and argon are shipped or stored as  Energy in a pressurized container depends
liquids at extremely low temperature, or as compressed gas at on its size, temperature, pressure, and the
ambient temperature and thousands of psig (hundreds of bars) state of the contents – condensed liquid or
pressure. compressed gas. Avoid adding to this
 Other gases such as ammonia, chlorine, sulfur dioxide, vinyl energy by exposing containers to heat from
chloride, propane, LPG, and dimethyl ether (DME) condense to a their surroundings.
liquid at room temperature under moderate pressure, and are  Read the safety information about gas
usually shipped or stored as liquefied gas. containers you handle, and follow
 A vessel filled with condensed liquid contains more material than recommended procedures.
the same size vessel filled with compressed gas – liquid has a  If you fill containers with a liquefied gas,
higher density. For example, a cylinder of argon gas at 2900 psig ensure that you do not overfill them.
(200 bar) holds about the same amount of material as a cylinder of
 Read the October and December 2006
the same size containing liquefied propane at only 116 psig (8 bar).
Beacons which discuss gas cylinder safety.
 Liquefied gases, like most other liquids, expand when heated. As
 You may have liquefied gases at home – for
the liquid expands, the vapor space in a closed container shrinks. If
example, as fuel for a grill, a home heater,
the container becomes completely liquid filled and continues to be
or a stove. Liquefied flammable gas may
heated, it can rupture from the pressure of liquid expansion.
also be present in lighters or aerosol cans.
Thermal expansion of a liquid can generate very large pressures
Handle these with the same care as you
with a relatively small temperature increase. The result of the
would at work, and make sure that your
container rupture is a boiling liquid expanding vapor explosion –
family understands the hazards.
BLEVE (November 2009 and August 2013 Beacons).
Do not underestimate the hazards of liquefied gases!

Purged Enclosures in Hazardous Areas November 2017
Does your plant have enclosures in hazardous areas
which must be purged with air or other gas and
maintained at a pressure above atmospheric pressure?
Some examples include electrical equipment
enclosures, enclosures for analyzers such as shown in
Picture 1, and even control rooms or other occupied
rooms. The enclosures are maintained at a pressure
above atmospheric so that any flow through openings
or leaks in the enclosure will be from inside the
enclosure to the outside atmosphere. This prevents
flammable vapors or gases getting into the enclosure, 1
where the electrical equipment might be an ignition
source for a fire or explosion.
Usually these enclosures are purged with clean air,
but alternatively, or from a backup system, they may
have a nitrogen purge and atmosphere (Picture 2). If 2 3
your enclosures have a nitrogen purge, or a nitrogen 1. A pressurized and purged analyzer building (air purged with nitrogen backup)
backup for an air purge, be aware of the potential of an 2. Warning signs for potential nitrogen atmosphere inside enclosure
asphyxiating atmosphere (4/2004 and 6/2012 Beacons) 3. Examples of enclosure pressure gauges
(Photos 1 and 2 courtesy of Roy E. Sanders)
inside, or outside near enclosure openings.

 Electrical codes and standards, which may  Be aware of any purged enclosures in your
vary in different countries and local areas, will plant, and check for proper operation as you
tell your engineers and managers how purged do your routine plant rounds.
enclosures are to be designed and operated.  Check the pressure in enclosures, and report
 Generally, the pressure inside a purged to management if it is not in the proper
enclosure must be maintained within a range. Follow up to make sure the problem is
specified range, and monitored (Pictures 3 and fixed. Picture 4 shows a pressure gauge 4
4) to ensure that any leakage of vapor is which clearly indicates the proper range.
actually from inside the enclosure to the  Check that all doors or other openings in purged enclosures are
outside atmosphere. closed, and that the enclosure is properly sealed.
 A pressure above the specified range can also  If you are doing maintenance inside a purged enclosure, be sure to
be hazardous. In May 2017, an engineer was get the proper permits for the work. Be aware of the potential
removing a 14 in (0.36 m) diameter cover hazard of high pressure when opening enclosures, and check the
weighing 12 lb (5.4 kg) from an enclosure. The pressure before opening. Make sure the enclosure is properly
enclosure had excess pressure inside, from closed, sealed, and that the purge is operating properly when the
leaking purge gas components. As the cover work is finished.
was being removed, it flew off and hit the  If your enclosures have a nitrogen backup for an air purge, or if the
engineer in the head, resulting in a fatal injury. normal purge uses nitrogen gas, be aware of the potential for an
(Reference: http://safetyzone.iogp.org/SafetyAlerts/alerts/Detail.asp?alert_id=288)
 To maintain the correct pressure inside the inert atmosphere inside or near the enclosure. Check the
enclosure, it is important to keep any doors or atmosphere for oxygen before going inside, even if there is a
other openings properly closed and sealed. nitrogen alarm and it is not warning of high nitrogen concentration.
Make purged enclosure checks a part of your plant routine!

Are your alarms alarming? October 2017
Vent line
to roof
Rupture
disc
Drain
line
1 2 3 Weep
hole
Do you know Aesop’s Fable “The Boy Who Cried Wolf”? A shepherd boy repeatedly tricked villagers by calling for
help because a wolf was attacking the sheep, when there was no wolf. After a while, the villagers ignored the boy. One
day there really was a wolf (1). When the boy cried for help, everybody assumed it was another false alarm. Nobody
came, and the wolf had a sheep dinner. In some English versions of the fable from the 15th century, the wolf also ate the
boy – perhaps an appropriate analogy for the potential consequences of ignoring alarms in the process industries!
Do you have alarms in your plant which are unreliable, frequently giving a “false alarm” because of faulty sensors or
because they are set too close to normal operating conditions? Would you notice if one of these unreliable alarms warned
of a real, important deviation which requires action? Or, do you have “nuisance alarms” which indicate minor process
deviations which do not require any response? If you get a lot of these, you might fail to notice a “real” alarm!
The US Chemical Safety Board (CSB) investigated a 2010 incident at a plant in West Virginia in which an alarm was
ignored resulting in a chemical release into a process building (2 and 3). A rupture disc on a reactor containing methyl
chloride, a toxic and flammable gas, burst releasing methyl chloride to a vent line. The rupture disc was designed to
provide an alarm when it burst, and this alarm worked. However, there was a history of false alarms, signaling a burst disc
when it was actually intact. Operators were not aware that the device had been upgraded, and assumed it was another false
alarm. There was a drain line with a weep hole on the vent, inside the process building. Methyl chloride was released
through the hole into an area of the process building where people were not frequently present. The release went on for 5
days before a gas detector designed for another chemical was triggered. It is estimated that about 2000 pounds (900 kg) of
methyl chloride was released.
What can you do?
 Never ignore safety alarms. Safety alarms should have specific response procedures, and you should always follow
these procedures. Make sure you understand the response procedures and have been trained on them.
 If you have nuisance alarms, especially safety alarms, which “chatter” or remain in the alarm condition, report the
problem to your instrument and automation engineers and management and work with them to fix the problem.
 If you have alarms that do not require a response, work with your engineers and management to eliminate them. Do
not change alarm set points unless authorized.
 Make sure that any changes to alarm design and equipment, alarm set points, or alarm response procedures, are
thoroughly reviewed using your plant management of change procedure. This includes informing all affected people
about the change, and training on any modified procedures resulting from the change.
Don’t ignore safety alarms – there might really be a “wolf”!

Italian, Japanese, Korean, Malay, Marathi, Mongolian, Persian (Farsi), Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
www.aiche.org/ccps www.chilworth.com
Haste Makes Waste! September 2017
Have you ever needed to put a piece of paper 1994 Port Neal, Iowa ammonium nitrate fertilizer plant explosion
in the trash can, but instead of taking those last 4

steps, you tossed it and missed the can? Then
you walk over, pick it up, and throw it out as
planned. What was gained? Actually, it took
extra effort to go back, pick the trash up, and put
it in the trash can. What if you didn’t go back?
Someone else would have had to do it for you.
The same idea applies to process safety. If you don’t do it
right the first time, you will have to do it over! Or, somebody else
will have to do it over for you. However, some process safety
tasks are not as obvious as trash on the floor. Not doing process
safety tasks (for example, checking an instrument, following a
procedure) correctly the first time can result in grave
consequences for you, your co-workers, the community and the
environment. When? Where? How? Who knows?
Why is it important? What can you do?

Taking “short cuts” in the plant has been a contributing cause to a number of  Always follow procedures
process safety incidents. For example: completely. If procedures are
• Failure to follow procedures inaccurate or incorrect, explain
• Silencing alarms without taking corrective action the problem to your supervisors.
• Failing to make rounds to check the plant status They want the activity to be
• Doing a plant procedure without bothering to take the check sheet with you. done correctly and safely!
You may have done this activity hundreds of times, but people are only 99%  When making plant inspection
accurate at best. You are about 10 times more likely to leave out a step in a rounds, take the time to do it
moderately complicated procedure if you are not using a checklist. well and thoroughly.
 If there are inspection points that
While these may seem to be minor, they can have severe consequences.
are difficult to access,
Improper, inaccurate or poorly used procedures have led to major incidents with
instruments that are out of
many fatalities and injuries. For example, in December, 1994 there was an
calibration or not working,
explosion in a fertilizer plant in Port Neal, Iowa. There were 4 fatalities, 18
unknown liquids dripping from
injuries, much of the plant was destroyed, and chemical releases had significant
pipes, agitators that are shaking,
environmental impacts. The US EPA investigation team concluded that “the
pumps that are making strange
explosion resulted from a lack of written, safe operation procedures” which
noises, or anything else that
“resulted in conditions in the plant that were necessary for the explosion to occur.”
doesn’t look or sound right as
What about a task that is not easy to do? There may be an instrument reading you go through the plant, note
that requires climbing many flights of stairs, unlocking an enclosure to verify a this on the rounds sheet and
level, or going to the far end of the plant to check a valve position. It is easy to bring it to your supervisor’s
rationalize skipping this when you are busy. Someone else will get it next time – attention. Nobody can fix a
just like the trash on the floor! But, if everybody behaves the same way, the task problem that they don’t know
will never be done. about!
If you can’t find time to do it right the first time, how will you find time to do it over?
Vulnerable Piping August 2017
1 Aerial 2 3 4
View
Valve In October 2005 there was an explosion and fire in an olefins plant in Texas. A fork
truck was towing a trailer of compressed air cylinders through a process unit (1). The
trailer struck a protruding drain valve on a strainer in a liquid propylene pipe (2). The
drain line, operating at 216 psig (15 bar-g), was severed (3) causing a 1.9 inch (4.8 cm)
opening. Propylene, which boils at -54°F (-48°C), was released (4) and rapidly created a
5
flammable vapor cloud (5). The fork truck driver and other workers in the area saw the
release and immediately fled. The control room was informed and operators immediately
began to shut down the unit and activate emergency response procedures. However they
were not able to isolate the leaking pipe and stop the release. The vapor cloud ignited
about 2 minutes after the release started (6). Several workers were knocked down by the
explosion, and two were burned, one seriously. 14 other workers received minor injuries.
The explosion ignited a pool fire which exposed structural supports for piping,
6
vessels, heat exchangers, and other process equipment to flames. About 30 minutes after
the fire began, support columns, which had not been fireproofed, failed. Their collapse
resulted in additional damage and loss of containment of flammable materials. The plant
was evacuated, neighbors were told to shelter in place, and a school was evacuated. The
fire burned for 5 days. The manufacturing unit was shut down for 5 months.
Reference: US Chemical Safety Board (CSB) Case History, http://www.csb.gov/formosa-plastics-propylene-explosion/, July 2006.
Pictures are taken from the CSB video describing the incident.
What can you do?

 Seek out piping, valves, and other equipment which might be vulnerable to damage – for example, by accidental
collision or by somebody standing on the equipment. Report potential problems to management for action – such as
piping modifications or providing protective barriers. Follow your plant’s management of change (MOC) procedure
when making changes.
 A quarter turn valve does not have to be broken off to leak. It can be opened accidentally by a person or a vehicle.
Consider plugging or capping open ended vents, drains, sample lines, or other pipes to prevent leaks.
 If your job requires driving fork trucks, cars, trucks, golf carts, or any other type of vehicle, stay on approved routes
when traveling through the plant. Always drive carefully and follow your plant driving rules!
 If you are involved in maintenance, construction, or another special activity which requires vehicles to travel in areas
of the plant where they are not normally present, make sure that the job safety analysis considers vehicle hazards such
as collision, damage to piping, equipment, and structures, and the vehicle as a potential ignition source.
 Watch the US Chemical Safety Board video (see reference above) to learn more about the incident.
 Read other Beacons related to this incident – May 2010 (fireproofing of structural steel) and January 2003 (inadequate
clearance for high equipment).
Protect your plant from collision!

©AIChE
2017. All rights reserved. Reproduction for non-commercial, educational purposes is encouraged. However, reproduction for any
Management of Change July 2017
A seemingly small change, without an adequate Management of Change (MOC)

review, can lead to a serious event. Here are two examples.
Incident 1: The vent system on a low pressure storage tank 20 ft (~ 6 m) diameter and 30
ft (~ 9 m) high was modified to reduce environmental emissions. The tank had operated for
20 years with a nitrogen blanket and a simple hinged breather vent to provide overpressure
and vacuum protection. The new system was much more complex, including a compressor
and more complex piping. The tank was returned to service and filled. The first time it was
emptied, the tank collapsed (Fig. 1) because it was not properly vented. Fortunately there
were no leaks or injuries, but the tank had to be replaced.
Incident 2: A tank truck owned by a trucking company had been modified with tubing so
that a nitrogen hose could be connected to the tank without somebody climbing a ladder on
the truck. There was a valve in the nitrogen line on the top of the truck, and it was
mistakenly left closed. The tank truck was pumped out using a plant pump and, with no
nitrogen flowing to the tank, a vacuum was created and the tank catastrophically collapsed
(Fig. 2). The tanker did have a pressure/vacuum relief device, but it failed. Figure 1: Collapsed Tank
Did you know?

In Incident 1, the MOC review was done,
but all operator training was not completed.
The training focused on the new vent
compressor and condenser. The training did
not stress the critical importance of a ½ inch
(13 mm) valve on instrument tubing which
controlled pressure/vacuum protection. After
the collapse, that tubing valve was found
closed, and it was key to protection of a Figure 2: Collapsed Truck
complex system. The valve should have

been locked or otherwise sealed open. The What can you do?
design and training could have been  Make sure you are trained on any changes to your plant, and that
simplified to reduce the likelihood of human you understand how to operate modified equipment. Get help if
error. Small details can provide you are required to operate modified equipment without training.
opportunities for human error which have  Never make changes to the piping or equipment in your plant
big consequences. without following your plant’s MOC process.
 If any equipment, existing or as modified by a change, is complex
In Incident 2, there was no MOC review
and likely to result in human error, tell management and
for what seemed to be a minor change,
engineering and ask them if the equipment can be simplified.
which was made by the truck owner. The
 Completely understand any changes made to equipment owned by
truck driver misunderstood the operation of
others, such as a trucking company, when it is used in your plant.
a new type valve and he inadvertently left
 When transferring material, make sure that all valves are in the
the nitrogen valve on top of the truck in a
correct position (see the August 2015 Process Safety Beacon).
closed position when preparing to unload the
References: Sanders, R. E.., Process Safety Progress 15 (3), pp. 150-155 (1996) and Sanders, R. E.,
truck. Chemical Process Safety: Learning from Case Histories, 4th Edition, Elsevier (2015) pp. 23-27 and 31-37.
A minor change can have a big impact!

Incident Investigation of a Steam Pipe Failure June 2017
Figure 1: Damage
In November 1998 a 12 in. (30.5 cm), 600 psig (~ 41 bar[g])
steam pipe in a large chemical plant failed catastrophically. A 36 in.
(~ 1 m) long section of pipe just upstream of a decommissioned
venturi flow meter suddenly ruptured causing major damage in the
area (Fig. 1). Steam supply throughout the plant was lost, the steam
generation equipment shut down, and there was no production in
most of the plant for more than 5 days. Fortunately there were no
injuries or fatalities.
An investigation team was immediately formed to understand the
cause of the failure of the 30 year old pipe (Fig. 2). There was
concern about other steam piping which might be in danger of a
similar failure. The team consisted of utility operating and Figure 2: Failed pipe Figure 3: Lines on pipe
management personnel, materials and mechanical engineers (piping,
reliability, and failure analysis experts), and chemical engineers.
The initial suspected cause was erosion of the pipe wall immediately
upstream of the venturi caused by poor quality (wet) steam,
resulting in thinning of the pipe wall. Observed lines on the pipe
(Fig. 3) were believed to be created by erosion.
In the course of the investigation it was determined that the pipe
which failed had been designed to have a slight taper (about 10º) to Lines
smooth flow to the venturi. This taper was produced by boring a
thicker piece of pipe to the designed profile. The investigation team asked an experienced machinist to inspect the failed
pipe. The machinist immediately recognized that the lines were not signs of erosion, but actually tool marks from a boring
tool. When the pipe was bored, the tool had not been inserted properly, but off-center. This resulted in the pipe being only
about 25% of the intended thickness at the top, and consequently weakened.

There is a reason for including a team of people  If you are asked to participate in an incident investigation,
with different expertise in an incident investigation, be a full participant and share your knowledge and
or any other process safety management activity expertise with the rest of the team. Your experience in
(process hazard analysis, management of change, operating or maintaining the plant is important for
pre-startup safety review, etc.). Everybody involved understanding the incident. Share that knowledge and ask
has a unique expertise to bring to the discussion, questions. If something in the discussion doesn’t sound
based on their education, training, and most consistent with your experience, make sure that it is
importantly, their work experience. In this incident, resolved to your satisfaction.
the engineers and other experts did not recognize the  You may be involved in other process safety management
machine tool marks on the failed pipe, and yet it was activities as an operations or maintenance representative –
immediately obvious to the expert, experienced for example, management of change, process hazard
machinist. His knowledge completely changed the analysis, writing procedures, developing training material,
conclusions of the investigation, and was essential pre-startup safety reviews, and others. Be an active
for understanding the cause of the incident. participant in these activities, and share your knowledge
Reference: Lodal, P. N., Process Safety Progress 19 (3), pp. 154-159 (2000).
with other participants.
Everybody has something to contribute when investigating an incident!

www.aiche.org/ccps www.chilworthglobal.com
Corroded Tanks! May 2017
In 2001 there was an explosion in a tank containing spent sulfuric Fig. 1: Spent sulfuric acid tank after explosion
acid (which contained some hydrocarbon) from a refinery alkylation

process (Fig. 1). Eight workers were injured and there was one fatality.
Spilled sulfuric acid reached a river causing environmental damage.
Contractors were repairing a platform in the tank farm when a spark
from hot work ignited flammable vapors in the tank. The tank had
significant corrosion, and leaks had been found annually for several
years. All reported leaks were repaired, except for one discovered a
few months before the incident. At the time of the incident, several
additional holes in the roof and shell of the tank had not been reported. Fig. 2 : Hot oil tanks
An operator did file an “unsafe condition report” a few weeks before
the explosion. A hot work permit had been rejected because of high
flammable vapor concentration, but corrective actions had not been
taken by management.
In January 2016, there was a fatal incident in a different refinery,
also caused by tank corrosion. During the evening shift, an operator
went to a tank farm to manually measure the temperature and level in
several tanks containing hot oil (Fig. 2). This required climbing to the
top of the tanks. The operator did not return for some time and did not Fig. 3 : Hole in top of hot oil tank
respond to radio contacts. His colleagues went to the tank farm to
investigate, found his vehicle parked there, and also found a large hole
in the top of one of the tanks (Fig. 3). The tank was emptied and the
body of the operator was discovered in the tank – he had fallen through
the hole into the tank. The tank roof was found to have severe internal
corrosion. The roof failed when the operator stepped onto the top of the
tank.

Corrosion of tanks and other equipment can be  Report holes in tanks or severe corrosion to
dangerous in many different ways, for example: management. If there is no action to correct the
 Holes in tanks can allow toxic or flammable vapors problem, don’t give up, and escalate the concern if
to escape into the surrounding environment. needed.
 Corrosion can weaken tanks, pipes, or other  Don’t ever walk or climb on equipment which is
equipment so they can fail under normal operating not intended for that purpose. Do not walk or climb
conditions. on anything that looks badly corroded – it might not
 Equipment which is severely corroded may be support your weight.
structurally weakened. A tank top may not be able to  Report corrosion of piping, pipe supports, vessels,
support weight on it, corroded pipes might weaken equipment supports, ladders, stairs, work platforms,
and break, and corroded equipment supports or building structural steel, or any other critical
building structural steel can collapse. equipment.
Report corroded equipment and holes in tanks!

Are you sure that vessel is empty? April 2017
In 1991, an explosion and fire occurred in a 50,000 barrel-per-day Fluid

Catalytic Cracker (FCC) unit in a refinery that was being brought online after
a seven-week shutdown for maintenance. Tragically, six workers lost their
lives and eight others were injured in the event. Property damage was reported
to be about $23 million and business interruption loss was estimated to be $44
million. What caused this terrible explosion? It was not caused by a runaway
reaction, or a flammable leak, or static ignition. It was caused by – water!
The vertical pressure vessel (F7) that exploded was used to separate heavy
oil from solid catalyst dust in the process. During the shutdown, oil was
drained from all process equipment and the equipment was cleaned, inspected,
and refurbished to be fit for service. As part of the startup procedure, steam
was purged to displace any air in the system before oil was fed to the process.
It was recognized by operations that the temperature in the process equipment
was low enough to condense some of this purge steam into water. So, any
water that condensed was collected and pumped to the F7 vessel. The normal
startup procedure required the operating crew to drain the water from F-7
before any hot oil was introduced. However, there was a block valve in the
wrong (closed) position that prevented the water from draining from F7. The
rapid expansion of the steam overpressurized F7, and it ruptured violently. The oil released by the explosion then
ignited, and the fire engulfed the FCC. The fire burned for about 2-1/2 hours before finally being extinguished.
 There are many reports of steam explosions involving hot  When returning equipment to service
material unintentionally coming in contact with water (see the following maintenance, make sure that it is
October 2015 Beacon for another example). completely clean and does not contain
 Water expands by about 1600 times when it vaporizes to steam. anything that could be incompatible with
This means that one US pint (~ ½ l) of water can generate process materials or operating conditions.
enough vapor to fill almost four 55 US gallon (~ 200 l) drums!  Do not deviate from your plant’s startup
procedures.
 Use checklists and written procedures for
startup. Some process plants operate for
many years between maintenance and other
shutdowns. You should not rely on your
memory for this critical operation which
you may not do very often.
 If you find valves in the wrong position or
 To prepare for maintenance, water is often used to clean or other equipment in the incorrect status
flush equipment. The water can collect in low points in during startup, get help to understand all
equipment and piping and could contact hot or incompatible potential consequences before changing
materials if it is not completely removed before re-start. valve position or other equipment status.
Liquid water + hot material = steam explosion danger!

The Beacon is usually available in Afrikaans, Arabic, Catalan, Chinese, Czech, Danish, Dutch, English, Filipino, French, German, Greek, Gujarati, Hebrew, Hindi, Indonesian,
Italian, Japanese, Korean, Malay, Marathi, Persian (Farsi), Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
www.aiche.org/ccps www.dekra-insight.com
…but the temperature was below the flash point! March 2017
In 1986, there was an explosion in a 10 gallon (~38 l) agitated Fig. 1: Damage to the facility
vessel in a pilot plant. An oxidation reaction was being done in a

pure oxygen atmosphere at 250 psig (1825 kPa). It was thought that
the vessel atmosphere was safe from ignition since the vessel was
operating 50°C below the flash point of the contents in the oxygen
atmosphere, and the fuel vapor concentration was below the Lower
Explosive Limit (LEL). Processing conditions were stable for 41
minutes when suddenly the explosion occurred. It ruptured the 750
psig (~5200 kPa) reactor, did significant damage to the facility
(Fig. 1), and started several small fires. Fortunately, nobody was
injured.
Because the vessel was operating below the flash point of the
MIST
contents, the concentration of fuel vapor in the vessel atmosphere was too low for ignition.
There should not have been an explosion hazard. But the fuel may not only be present as a
vapor (remember dust explosions). The investigation determined that the vessel agitator
created a fine mist of liquid droplets (Fig. 2). The tiny droplets were estimated to have an
average size of about 1 micron. In comparison, the diameter of a human hair is 40-50 times
larger than the mist droplets. Flammability testing demonstrated that the mist could be
ignited at room temperature in air – and the mist would be ignited even more easily in a
pure oxygen atmosphere. The vessel contained both fuel and oxygen – but what was the
ignition source? Although it is often difficult to identify an ignition source for an explosion,
the investigation determined that the most likely ignition source was a contaminant, left
Fig. 2.: What happened? The
over from a previous experiment in the vessel, which decomposed and generated enough agitator created a mist of very small
heat to ignite the mist. [Reference: Kohlbrand, H. T., Plant/Operations Progress 10 (1), pp. 52-54 (1991).]
combustible liquid droplets

 A mist of combustible liquid drops at temperatures below  Be aware of the potential for fire or explosion of
the flash point of the liquid can be as explosive as a fuel a mist of flammable or combustible liquid when
vapor-air mixture. The explosion mechanism is similar to responding to a leak or spill. If there is a mist
a dust explosion, except that the fuel is present as small present, don't assume that there is no hazard
drops of liquid rather than small, solid particles. because the temperature is below the flash point.
 A mist can be formed in many ways. In this incident, Take the same precautions that you would to
vigorous stirring by an agitator blade near the liquid prevent ignition and protect people if the leak
surface generated the mist. A mist can also be created by had resulted in a flammable vapor cloud.
a liquid leak from a pressurized pipe, vessel, or other  If you observe a mist or fog inside any process
equipment – for example, a flange leak, a hole in a equipment inform your management so they can
pressurized pipe or vessel, or a leak from a pump seal. ensure that proper protective measures are in
 Don’t forget that a leak from a utility or maintenance place.
system can create an ignitable mist. For example, there  Promptly report any leaks of flammable or
have been incidents of ignition of mist from a leak of combustible materials, including utility fluids, if
lubricating, heat transfer, or fuel oil. you see them in your plant.
Remember that combustible liquid mists can burn or explode!

The Beacon is usually available in Afrikaans, Arabic, Catalan, Chinese, Czech, Danish, Dutch, English, Filipino, French, German, Greek, Gujarati, Hebrew, Hindi, Indonesian,
Italian, Japanese, Korean, Malay, Marathi, Persian (Farsi), Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
Mixing Incompatible Materials in Storage Tanks February 2017
On October 21, 2016 two incompatible chemicals, sulfuric acid and sodium
hypochlorite (bleach) were inadvertently mixed during a routine delivery to a plant
in Atchison, Kansas, USA by a raw material supplier. These chemicals reacted and
released a cloud of chlorine gas into the surrounding community. Approximately 100
people received medical treatment, several schools were evacuated, and about
11,000 residents were advised to shelter indoors for 2 hours.
Similar incidents have happened in the past, all releasing chlorine gas clouds:
• May 2013, Portland, Oregon, USA – A supplier truck driver pumped a mixture of
nitric and phosphoric acids into a tank containing sodium hypochlorite at a dairy.
• October 2007, Frankfurt, Germany – Hydrochloric acid was accidently
transferred into a sodium hypochlorite tank. Approximately 200 kg of chlorine
were released, and more than 60 people were injured. The operator who finally
stopped the transfer was fatally injured from exposure to chlorine.
• August 2001, Coatbridge, UK – A tanker driver transferred sodium hypochlorite
solution and hydrochloric acid into the same tank at a swimming pool. 30 people
required medical treatment.
• August, 1993, Stockholm, Sweden – A truck driver pumped phosphoric acid into
a storage tank containing sodium hypochlorite at a swimming pool.
• March 1985, Westmalle, Belgium – Hydrochloric acid was pumped into a tank
containing residual sodium hypochlorite.
• November 1984, Slaithwaite, UK – A plant expected a delivery of sodium
hypochlorite, but received ferric chloride solution (an acidic solution) instead.
The ferric chloride was unloaded into the sodium hypochlorite tank.
• September 1984, Hinckley, UK – Hydrochloric acid was unloaded into a tank
containing sodium hypochlorite.
What can you do?

 Understand potential hazardous interactions among different materials that you unload into your plant’s storage tanks.
The July 2016 Beacon describes the “Chemical Reactivity Worksheet,” a tool which your engineers and chemists can
use to help understand chemical interactions.
 Always check (and then double check!) all of the documentation and labeling on incoming shipments of raw
materials to confirm that you are receiving the material you expect.
 Follow your plant procedures for identification of incoming raw materials and for unloading those materials.
 Make sure that all of the piping and equipment in your raw material unloading areas are clearly labeled. Also, there
should be no connections between pipes serving different tanks containing incompatible materials.
 If your raw material unloading area has confusing piping, or incompatible materials are unloaded in locations near to
each other, inform your management and engineers about the issue so that improvements can be made.
 If supplier or transportation company truck drivers unload materials into storage tanks at your plant, make sure they
are familiar with your unloading facilities and can ensure that they unload materials into the correct tank.
 See the March 2009 and April 2012 Beacons (available at www.sache.org) for other incidents in which an
incompatible material was unloaded into a tank.
Always put the right stuff in the right place!

©AIChE 2017. All rights reserved. Reproduction for non-commercial, educational purposes is encouraged. However, reproduction for any
The Beacon is usually available in Afrikaans, Arabic, Catalan, Chinese, Czech, Danish, Dutch, English, French, German, Greek, Gujarati, Hebrew, Hindi, Indonesian, Italian,
Japanese, Korean, Malay, Marathi, Persian (Farsi), Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
Hazards of High Oxygen Concentration January 2017
Apollo Command Module
Fifty years ago, on January 27, 1967, a fire killed all Section of CM interior after fire
three crew members (Virgil "Gus" Grissom, Edward

White, and Roger Chaffee) in the command module (CM)
of the Apollo 1 space capsule during a test while on the
launch pad. The CM atmosphere was 100% oxygen at
16.7 psia (1.15 bar). The most likely ignition source was
from electrical wiring. Materials that are hard to ignite in
air burn rapidly in a high or pure oxygen environment Memorial plaque at launch complex
High oxygen concentration has been a contributing

factor in industrial incidents. Here are some examples:
• A steelworker attempted to repair a car which had a
blockage in the fuel line. He used oxygen to clear the
blockage and the fuel tank exploded killing one
person.
• After maintenance work, a pipeline in oxygen service was degreased and blown dry. However, instead of
dry nitrogen, compressed air containing residual lube oil from the air compressor was used. Some oil was
deposited as a thin film inside the pipe. After the pipe was put back into service, the oil-oxygen mixture
ignited and the pipe ruptured. Ignition was believed to be caused by compression at a closed valve.
• In oxygen gas cylinders (used in welding, hospitals, diving), regulator fires have been reported when oxygen
contacted contaminants. Passage of oxygen through the regulator valve creates heat. Any combustible
material such as an incorrect gasket material, dirt, oil, grease (even an insect!) can ignite.
 The presence of oxygen above  Never use oxygen for blowing equipment clean or dry.
the 21% found in air will widen  Use only equipment, materials, gaskets and fittings, lubricants,
the fuel concentration range in sealing liquids, and other components that are specifically approved
which an explosion is possible. for oxygen service.
 Autoignition temperature (AIT)  Keep equipment for oxygen service clean. Follow all your plant
and minimum ignition energy procedures to ensure that there is no contamination of piping, valves,
(MIE) are lowered markedly by fittings, or other equipment in pure or concentrated oxygen service.
higher oxygen content.  Take extra care to avoid all sources of ignition near equipment
Substances ignite more readily, containing oxygen.
burn faster, generate higher  In a confined space, either a higher or lower oxygen concentration
temperatures, and are difficult to than normal should be investigated.
extinguish.  If people have been exposed to oxygen or oxygen enriched air, get
 Textiles, even hair, can trap them away from ignition sources and keep them in fresh air.
gases. If such material has  Suppliers and industry groups issue guidelines on safe oxygen use.
absorbed oxygen, it may burn in a Study these guidelines and discuss them with your co-workers if
flash (literally!). oxygen is used in your plant.
Oxygen – necessary for life but hazardous if not controlled!

The Beacon is usually available in Afrikaans, Arabic, Catalan, Chinese, Czech, Danish, Dutch, English, French, German, Greek, Gujarati, Hebrew, Hindi, Indonesian, Italian,
Japanese, Korean, Malay, Marathi, Persian (Farsi), Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
www.aiche.org/ccps Messages for Manufacturing Personnel www.iomosaic.com
Ignition Sources – Once More December 2016
Some ignition sources are fairly obvious. A glowing cigarette, an active

#1
oxyacetylene torch, or a cascade of sparks and burning metal from a grinder
is hard to miss. Hot work may also leave behind glowing particles, hot slag,
or a smoldering fire in hidden places. A raging fire may follow many hours
after the work is finished.
Ignition sources from unintended chemical reactions may be “invisible”
too. Here are some examples:
Unstable chemicals: For example, a peroxide stored above its #2 #3
decomposition temperature (#1), or chemicals with a specified shelf life
stored too long (January 2006 Beacon).
Incompatible chemicals stored together and accidently mixed (#2, July 2006
Beacon).
Enhanced oxidation by increased surface area: For example, activated
carbon plus organic vapors (April 2003/February 2014 Beacons), oily rags #4
(May 2005 Beacon), or combustible liquids leaked into insulation.
Pyrophoric materials: Self-igniting materials (#3) are regularly reported as
fire starters. For example, sodium hydrosulfite, a strong reducing agent,
becomes pyrophoric when moist (August 2014 Beacon). A fire on board a
container ship in Barcelona harbor in 1996 (#4) also was initiated in a
container of sodium hydrosulfite. Pyrophoric materials such as iron sulfide
can also be formed in petrochemical installations from reaction of oxidized
iron (rust) and hydrogen sulfide present in crude oil and derivatives.
What can you do?

• Understand your plant’s work permit procedures for hot work and ensure that sparks do not hide and create
a smoldering fire. Use up-to-date hazardous area classification drawings and ensure that you use tools and
procedures appropriate for hazardous areas.
• Do not ignore combustible liquids because of the high flash point. When they have been absorbed on porous
material, they might ignite spontaneously. Collect combustible material spills in closed metal containers.
• Cleanliness may not be all you need to prevent fires in your plant, but it is a good start!
• Look for signs of leaking (for example, discoloration) of organic liquids or heat transfer fluids into
insulation as you go about your job. Report problems and make sure they are fixed.
• Know your chemicals! What do the Safety Data Sheets state about stability, storage conditions, hazardous
reactions, and incompatible substances (see July 2016 Beacon)?
• Follow your plant procedures for storage and mixed material storage.
• If new materials are introduced into your plant, check if the procedures are adapted to include them and that
a management of change review (MOC) has been done. If not, ask your supervisor to update procedures and
consider an MOC.
There’s more than one way to start a fire – control them all!
The Beacon is usually available in Arabic, Afrikaans, Chinese, Czech, Danish, Dutch, English, French, German, Greek, Gujarati, Hebrew, Hindi, Italian, Japanese, Korean,
Malay, Marathi, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
15 Years of the Process Safety Beacon! November 2016
1 In November 2001, CCPS published the first issue of the Process Safety
Beacon (1) and distributed it to a few hundred people. Since then, 180
messages for front line process industry workers have been published
(read-only copies available at www.sache.org). Distribution has expanded
to over 38,000 people on the direct mailing list, and those recipients are
free to share the Beacon with co-workers. Total readership is probably
several hundred thousand each month. The Beacon is currently translated
into more than 25 languages by a dedicated group of volunteer translators,
who contribute their time to promote process safety worldwide.
In 2016, there were two Beacons focusing on repeat incidents –
February, on fires resulting from overflowing tanks containing flammable
materials (2), and May on
2 3
ammonium nitrate explosions (3).
These incidents are examples of
events that we hope the Beacon can
help prevent. Learn from incidents
that have happened somewhere else,
so that you don’t have to learn the
hard way by having a similar
incident in your own plant!
 The Beacon is written for operators,  When you read a Beacon, think about what you can learn from it,
maintenance workers, and other front line even if it discusses an incident which happened in a very different
process industry workers. It focuses on kind of plant. For example, the September 2016 Beacon was about
things that they can observe and actions they a fire on a ship. Most Beacon readers do not work on ships, but
can take within their job responsibility. the real message was about the importance of management of
 We realize that many engineers, chemists, change (MOC), which applies to every kind of plant or equipment.
other technical staff, and managers read the  There is limited space in a Beacon and it cannot include all of the
Beacon, and hopefully they learn something important lessons from an incident. Think about other things that
from it. However, the Beacon is not written you can learn from the incident, and search for more information
for them. You will not find suggestions such on the specific incident or similar incidents.
as “change the process,” “replace the  If you work in a plant with a good process safety management
equipment,” or “follow Standard XYZ” in program, you probably don’t have many incidents. It is easy to
the “What can you do?” section. become complacent. Use the Beacon to remind everybody of what
 You are free to share the Beacon with your can happen if you fail to rigorously carry out all of the activities in
co-workers and colleagues, either as printed your plant’s process safety management system.
copies or as computer files.  Read the February 2008 Beacon on “How to use the Beacon”,
which you can view at www.sache.org.
The Beacon – sharing process safety lessons for 15 years!

Process safety in the laboratory October 2016
Photos from Honolulu
On March 16, 2016 there was an explosion in a laboratory at the Fire Department
University of Hawaii in Honolulu. A research assistant was seriously
injured, losing her arm. The total financial loss was nearly $1 million.
The laboratory was conducting research using a flammable mixture of
hydrogen, oxygen, and carbon dioxide. The mixture was stored in a 50 liter
(13 gal) tank at about 6 barg (90 psig) pressure, and fed to a bioreactor
containing bacteria. The tank was rated for 11.6 barg (168 psig) and was
intended for use for dry compressed air only. The tank, and other equipment
such as instrumentation, was not bonded and grounded. Static sparks had
been observed in the laboratory with ungrounded metal equipment prior to
the explosion. The explosion occurred on the 11th run using the tank. It was
estimated by investigators to be equivalent to the detonation of about 70 gm
(2½ oz.) of TNT – nearly half the amount of explosive in a US Army M67
hand grenade.
The investigation determined that the likely immediate cause of the
explosion was a static discharge (see August 2016 Beacon) which ignited
the flammable mixture. However, more fundamentally, there was a failure
to recognize the hazard of the flammable atmosphere in the tank, and how
easily the mixture could be ignited. A mixture of gas containing hydrogen
and oxygen is explosive over a wide range of concentrations, and the
ignition energy is extremely low. The equipment, facilities, procedures, and
training were not adequate for such a highly hazardous mixture of gases.

 Hydrogen-air mixtures are explosive in concentrations from  Wherever you work – in a process plant, a
4% to 75% hydrogen, and the range is wider as oxygen research laboratory, a pilot plant, a quality
concentration increases – 4% to 94% hydrogen in pure control laboratory, a maintenance shop, or
oxygen. anywhere else – make sure you fully understand
 The energy required to ignite a flammable mixture of the hazards associated with all of your materials,
hydrogen and air (21% oxygen) is very small. A spark you equipment, and operations. You can’t manage
can barely feel has about 50 times as much energy as needed the risk from a hazard that you don’t know
to ignite the mixture, and a typical spark that you experience about! Hazard recognition is the first critical step
has over 1000 times the energy required for ignition. At to ensure safety in any activity. Apply the same
higher oxygen concentrations, the mixture is even more easily discipline to process safety management in a
ignited. laboratory or other work environment as you
 Process safety incidents can occur in laboratories or pilot would in a manufacturing plant.
plants as well as in manufacturing plants. A small quantity of  Use appropriate hazard identification and
material does not mean that the hazard is small. analysis tools to understand laboratory or other
 This incident occurred in a research laboratory, but a plant workplace hazards – for example, checklists,
laboratory may also contain enough hazardous material or what-if analysis, job safety analysis, and more
energy to potentially cause a serious incident – for example, a rigorous process hazard analysis tools for
cylinder of compressed gas in a quality control laboratory. complex operations.
You can’t control a hazard that you haven’t identified!

Can you recognize a change? September 2016
In 2014 there was a fire on a passenger vessel

operating about a mile offshore from the United States in
the Atlantic Ocean. A crew member making rounds in a
machinery space noticed a small fuel spray fire above one
of the four propulsion engines. He left the area and
informed the bridge. Proper emergency procedures were
followed, and the fire was quickly extinguished using the
1 vessel’s fixed fire protection system (CO2). None of the
174 persons on board were injured.
The vessel was equipped with four diesel propulsion
engines (1). Fuel was delivered to each cylinder through a
threaded variable length coupling (2). There were four
couplings per engine. These couplings are designed to
2 facilitate installation by their capability to lengthen when
the ends are threaded into the cylinder connections. On the
passenger vessel that experienced the engine fire,
couplings on three of the four engines had been replaced
with threaded hose fittings and rubber hoses (3). One of
those hoses failed and sprayed fuel directly onto the hot
engine exhaust, which likely provided the ignition source.
3 Reference: United States Coast Guard Marine Safety Alert 12-14, Washington, DC, November 3, 2014.
What can you do?

While this incident occurred on a passenger ship, a similar incident can occur in a process plant if a
robust management of change (MOC) procedure is not followed. Perhaps the most important step in
MOC is recognizing a change. If the change is not recognized, the MOC process will never be initiated!
• Always use the correct replacement parts when repairing any equipment.
• Understand your plant’s MOC procedures, and your role in implementing those procedures.
• Know how to recognize changes in procedures, equipment, instrumentation, controls, process control
computer software, materials, and safety systems.
• If you are involved in approving change proposals as part of your plant MOC process, make sure that
you understand the basis for the original design when you evaluate the proposed change.
• If you are not sure if something is a change, ask for help, or be safe and initiate the MOC procedure.
• If you see something different in your plant, ask if the MOC procedure has been followed for the
modification.
You can’t manage a change that nobody has recognized!

A little static can cause a big fire! August 2016
1 2
There have been many incidents where a static electric discharge was the likely ignition source for a fire or
explosion. In 2007, two incidents were investigated by the US Chemical Safety Board (CSB)1. One was
caused by poor grounding of an intermediate bulk container (portable tank) while filling with a flammable
solvent (1), and the other by a poorly grounded level float in a storage tank which was being filled from a tank
truck (2). Other incidents have been caused by poor grounding/bonding of tanks, portable containers, tank
trucks, railroad tank cars, and static discharge from people.
1 CSB Report numbers 2008-02-I-IA and 2007-06-I-KS, www.csb.gov.

• Static charge is generated by contact and separation • Always follow your plant grounding and bonding
of two different materials. Once generated, charge procedures before any material transfer operation.
may remain on the materials until it finds a lower • Make sure that grounding/bonding equipment in
electrical potential, then it discharges. The spark can your plant is regularly inspected and tested.
have enough energy to ignite flammable vapors, • Inspect grounding/bonding equipment before each
gases, or a combustible dust cloud. use to ensure it is in proper working order and that
• Static can be generated by fluids flowing through it attaches firmly (metal to metal) to the container.
pipes, solids through ducts, and even by air flowing If it is frayed, or has a poor connection to ground,
through ductwork or pneumatic conveyors. notify your supervisor.
• Mechanical conveying systems can generate static • Inspect hoses prior to use. A damaged hose may
by rollers and belts contacting each other, especially have a broken grounding wire inside. Hoses should
if they slide over each other. be regularly checked for electrical continuity.
• Static sparks may be felt (a sharp “zap”), seen (small • Non-metallic containers (for example, plastic or
bluish arcs), or heard (a snapping sound). glass) are difficult to ground and bond. When
• Non-conductive liquids such as benzene, toluene, using these containers, exercise additional caution
and naphtha, generate static much more easily and and follow procedures. If there is no grounding
dissipate charge more slowly compared to con- specified, ask why not.
ductive fluids, such as water, alcohols, and acetone. • If handling solids in plastic bags or with plastic
• Poorly grounded and bonded hoses are a frequent liners in paper bags, ask an engineer for advice on
contributor to creating static. proper procedures to prevent static sparks.
Managing static – a key part of reducing ignition sources!

www.aiche.org/ccps
Messages for Manufacturing Personnel www.acutech-consulting.com
Understanding chemical compatibility July 2016
Last month’s Beacon was about the danger of

mixing two common household cleaning products –
solutions containing ammonia and household bleach
(sodium hypochlorite). The reaction produces
dangerous toxic gases.
Have you ever seen a compatibility chart like the
one at the left? This one describes potential hazards
from mixing some household chemicals – ammonia
solution (cleaning products), hydrogen peroxide
(cleaning products), sodium hydroxide (drain cleaner),
and sodium hypochlorite (bleach). This chart was
generated using a computer program called the
Chemical Reactivity Worksheet (CRW), available free
from CCPS. It shows potential hazardous interactions
between combinations of chemicals on the chart. The
red boxes containing the letter “N” indicate potential
hazardous interactions, and the yellow box containing the letter “C” indicates a less hazardous potential
interaction requiring caution. The complete output of the CRW provides additional information about the
potential hazardous interaction. The red arrows highlight the bleach-ammonia interaction.
You may have similar chemical compatibility charts for the materials used in your plant. This is
important information to understand so you can take proper precautions to make sure that incompatible
materials are not inadvertently mixed. That can happen when making material transfers such as unloading
shipments into storage tanks or other containers, when containers are stored adjacent to each other in
warehouses or production areas, and when products are transferred to tank farms for storage before being
shipped.
You can download the CRW from: http://www.aiche.org/ccps/resources/chemical-reactivity-worksheet-40
What can you do?

• Understand chemical reactivity hazards from mixing incompatible materials in your plant, and what
safeguards are in place to prevent hazardous mixing of incompatible materials.
• Always follow your plant procedures to prevent hazardous interactions among chemicals.
• Does your plant use a compatibility chart like the one shown above? If so, ask chemists or engineers to
explain the chart to you, and to describe any hazardous chemical interactions.
• Verify the intended destination when hazardous materials are transferred. Many mixing incidents could have
been prevented by proper labeling and verification of correct transfer.
• Read other Beacons describing incidents caused by mixing incompatible chemicals: August 2003, August
2005, July 2006, March 2009, March 2011, April 2012, December 2013, and June 2016 (read-only copies
available at www.sache.org).
Know what happens when you mix chemicals!

Dangerous chemical reactions at home! June 2016
HOUSEHOLD
AMMONIA
Did you know that mixing some household cleaners could be fatal? Many cleaning products
contain aqueous ammonia. Another chemical often used in our homes is bleach – a water solution
of sodium hypochlorite. We add bleach to our laundry, and also use it for general cleaning and
disinfection in the house. If you mix these two chemicals, a chemical reaction produces toxic gases
called chloramines. Breathing these gases can be fatal. You can find many reports of serious
injuries and fatalities resulting from mixing these chemicals, as well as other common household
chemicals, on the Internet.
In next month’s Beacon we will discuss a tool called a chemical interaction matrix which many
organizations use to communicate potential hazards from mixing incompatible chemicals.
What can you do?
• Share this Beacon with your family and friends.
• Take your process safety knowledge home! Because you work with hazardous materials and
processes, you have special experience and training which is valuable away from work. Remind
your friends and family to follow safety measures as you would at work when handling hazardous
materials. You may save a life! For example:
• Always read warning labels on household products, and follow precautions recommended for
use and storage.
• Always use the recommended protective equipment as specified on the product label.
• When working with hazardous materials in the home, always ensure that you have good
ventilation in the work area to disperse hazardous vapors.
• Do not mix household products unless you completely understand the potential interactions
and consequences.
• Set a good example for your friends and family. When you use hazardous materials at home, treat
them with the same respect that you do at work. If you see other people handling hazardous
materials without proper safety precautions, help them understand how to use the materials safely.
Take your safety knowledge home and share it!

www.aiche.org/ccps Messages for Manufacturing Personnel www.acutech-consulting.com
More repeat incidents! May 2016
From the US CSB final report, pictures captured from video of the West, Texas explosion.
On January 29, 2016 the US Chemical Safety Board (CSB) issued a report and video animation of the April
17, 2013 explosion in an agricultural chemical storage facility in West, Texas. The explosion caused 15
fatalities, more than 260 injuries, total destruction of the plant, and widespread destruction in the surrounding
community.
A few days later, on February 5, 2016, the government of China released a report on the August 12, 2015
explosion in a chemical warehouse in Tianjin, China. That explosion resulted in more than 170 fatalities, over
700 injuries, and over a billion dollars in financial loss.
Both of these incidents occurred in warehouses which stored ammonium nitrate (AN), a common fertilizer,
along with a variety of other chemicals. In both incidents, there was a fire which exposed AN to high
temperature. The CSB report states that “AN exhibits three main hazards in fire situations”: uncontrollable fire,
decomposition with formation of toxic gases, and explosion.

 The CSB report on the West, Texas  You may not handle AN in your plant, and you may not
explosion identified 32 other explosions handle other materials with such high damage potential.
involving AN going back to 1916 However, if you use any hazardous materials, or if your
(including the 2015 Tianjin, China process operates at hazardous conditions, you should
explosion). These explosions caused understand what incidents have happened in the past with
nearly 1,500 fatalities and thousands of the materials and process conditions in your plant.
injuries.  Ask engineers, managers, and veteran employees to share
 The CSB list of AN explosions includes information about past incidents in your plant, and in other
an April 16, 1947 explosion of the ship plants like yours. Understand what is being done to prevent
Grandcamp in Texas City, Texas which similar incidents.
caused approximately 500 fatalities and  For other examples of repeated incidents, see the February
3,000 injuries. This incident is 2014 and February 2016 Beacons.
considered to be the deadliest industrial  Search the Internet for past incidents which have occurred
disaster in US history. with the materials and processes in your plant.
Learn from history so it doesn’t repeat!

Plugged flame arrester causes explosion! April 2016
Hot Work Maintenance workers were doing

hot work on an offshore platform,
Flame arrester approximately 12 feet (3.7 m) above
several oil storage tanks. There was an
explosion which ruptured two oil tanks
causing about $500,000 (US) damage
and spilling approximately 1,200 US
gallons (4.5 cu m) of oil into the sea.
The incident investigation found the

following:
Oil Tanks
• The flame arrester on an oil tank was

corroded and plugged with deposits.
This resulted in the tank “breathing”
through a sample hatch at the tank rather than through the flame arrester as intended. When it was
hot, during the day, vapors would exit the tank through the hatch. Air would enter the tank through
the hatch at night when it was cool.
• A sign on the flame arrester indicated that it should be “periodically serviced for safe operation.”
• The flame arrrester was installed at the end of a flare boom and could not be easily accessed for
inspection or maintenance.
• The oil tanks were not blanketed with inert gas, or protected from fire, sparks, or other potential
ignition sources during the hot work. This was required by US regulations for offshore platforms
because the hot work was near the oil tanks [30 CFR 250.113(a)].
REFERENCE: U.S. Department of the Interior, Bureau of Ocean Energy Management, Safety Alert No. 290, 14 October 2010.
What can you do?

• On land or water, flame arresters are important safety devices. Make sure that flame arresters in your
plant are inspected and maintained as recommended by your plant engineers and the manufacturer.
• If a flame arrester or other important safety device is in a location where required inspection and
maintenance is difficult or impossible, report the problem to your management so it can be corrected.
• Many regulations, industry guidelines, or company policies require a minimum distance between
welding or hot work, or from a point where slag, sparks, or other burning materials could fall, and
equipment containing flammable or combustible material. If moving equipment is impractical, the
equipment must be protected with flame-proofed covers, inerted, or shielded with metal or fire
resistant guards or curtains.
Flame arresters need inspection and maintenance!

Safety device or control device? March 2016
In a television news story, a volunteer at a tourist railroad described

how he prepared the vintage steam locomotive for its weekend
operation. He described how he built up the fire to warm the firebox
and increase the boiler pressure. He knew that the locomotive was
ready for operation with proper steam boiler pressure when the safety
relief valve on the boiler opened!
This sounds a lot like a process industry incident that process
safety pioneer Trevor Kletz often described in his talks. Material
was pumped to a tank in a manual operation for many years
without incident. Then, one day there was a small overflow which
the operator quickly stopped. A recommendation of the incident
investigation was to add a high level alarm which would shut off
the feed to the tank if the operator failed to stop flow, and this was
done.
About two years later there was another overflow! What
happened? Supervisors decided that the operator could be given
other work to do while the tank was filling since there was a high
level shutdown. No management of change review was done. A
device that was intended to be a second layer of protection became
the primary control. When the high level instrument failed, there
was nobody in the area and the spill was actually larger.

 The intended operation of the steam  Never use safety devices for control of your
locomotive was for the operator to observe process!
the steam pressure and control it when it  Know what devices in your plant are intended for
reached the desired operating pressure. The process control, and which are safety devices which are
safety relief valve was intended to be a intended to be additional layers of protection (see
second layer of protection if the operator March 2002 Beacon) to prevent incidents.
failed to properly control the steam pressure.  Make sure your operating procedures and training
 The intended operation of the modified tank identify which devices are intended for routine control
filling operation was for the operator to and which are safety devices.
manually shut off the feed when the tank  Check that all of your plant safety devices are properly
filled, as had been done for many years. The calibrated, tested at the frequency specified by the
high level alarm and feed shutoff was designers, and that the test results are reviewed to
intended to be a second layer of protection if identify and correct any reliability issues.
the operator failed to stop flow into the tank.
Safety devices – for emergency use only!

www.aiche.org/ccps
Messages for Manufacturing Personnel www.iomosaic.com
Still Overflowing Tanks! February 2016
The United States Chemical Safety Board (CSB)

recently released the results of their investigation of a
tank farm fire in a petroleum products storage facility in
Puerto Rico on October 23, 20091. We have published a
number of Process Safety Beacons on tank overflow
incidents – for example, Sept. 2004, Sept. 2006, and
Sept. and Oct. 2009. Notice that the last of these is the
same month that the incident occurred in Puerto Rico!
The CSB report includes (Appendix B) a list of 22
major tank farm fires since 1962, and the list does not
Multiple tanks burning in the fire
include all such events – the incident described in the
2009 Beacons was not included. It is interesting that 19
of the 22 incidents listed in the CSB report involved a
tank overflow. With all of the complex operations going
on in many process facilities, it is surprising that putting
more material into a tank than will fit is a frequent
contributor to major incidents.
Unreliable instruments, inadequate procedures, and
the lack of independent overflow protection systems on
storage tanks were some of the significant operational
and technical causes of the Puerto Rico incident, and
Damage to the facility after the fire likely for many of the other similar incidents.
1 http://www.csb.gov/caribbean-petroleum-refining-tank-explosion-and-fire/

 Although the operations in your storage  Never underestimate the consequences of overflow of
tank farm may not seem to be very flammable, combustible, or toxic material from a tank!
complex, they may actually be more  Read the “What can you do?” sections of the 9/2004, 9/2006,
complicated than you think. There may be 9/2009, and 10/2009 Beacons. These are posted on line (scroll
many interconnections between tanks, you through the file to find your language, if available):
may have to put material in tanks that are
 9/2004 - http://www.aiche.org/ccps/resources/process-safety-
already part full, or divide incoming beacon/200509/english
material among several tanks.  9/2006 - http://www.aiche.org/ccps/resources/process-safety-
 Your tank farm probably contains the beacon/200609/english
 9/2009 - http://www.aiche.org/ccps/resources/process-safety-
largest inventory of hazardous material in beacon/200909/english
your plant. If an incident occurs it is likely  10/2009 - http://www.aiche.org/ccps/resources/process-safety-
to be large. beacon/200910/english
Stop tank overflows!

www.aiche.org/ccps
Messages for Manufacturing Personnel www.iomosaic.com
Hydrate Hazards January 2016
The October 2015 Beacon discussed several hazards of water in process plants. Another potential hazard from a
mixture of water and some materials is the formation of a hydrate (more specifically, gas hydrate or “clathrate” hydrate).
Hydrates were first described by Sir Humphrey Davy in 1810 in a lecture to the Royal Society in England. A hydrate is a
crystaline, ice-like solid made up of water and another material. Usually the other material is a gas, but it can also be a
liquid. Some examples of materials that can form hydrates include hydrogen sulfide, acetylene, methyl mercaptan,
chlorine, vinyl fluoride, carbon dioxide, ethylene, methane, ethane, natural gas, and other hydrocarbon gases. When a
hydrate forms it can plug piping, instrument connections, valves, and other equipment causing process upsets which may
be hazardous. In addition to presence of a material that can form a hydrate, generally three conditions are required:
 Free, condensed water
 Sufficient pressure (how much pressure depends on the material, and some materials – for example, methyl
mercaptan – can form a hydrate at atmospheric pressure)
 Low temperature (the temperature depends on the material and the pressure, and a hydrate can form at a temperature
well above the freezing point of water)
Once formed, hydrates can be very stable, and difficult to remove. Clearing a blockage from hydrate formation could
be a routine or non-routine work activity that is hazardous if not done properly. Potential hazards include the release of
flammable, combustible, corrosive, or toxic material, or unexpected pockets of pressure in pipes and equipment blocked
with solid. It may be necessary to open pipes or equipment to clear a hydrate blockage, with all of the hazards associated
with opening process equipment. If you try to remove a hydrate plug in a line by applying pressure to one side of the
blockage, the plug may break free and the solid material may rapidly move through the pipe. This can cause a rupture if
the solid plug impacts the pipe at a tee, an elbow, or other bend.
The United States Chemical Safety Board recently described an incident resulting in 4 fatalities that occurred when
methyl mercaptan was released during attempts to clear a line blocked with a methyl mercaptan-water hydrate
(http://www.csb.gov/dupont-laporte-facility-toxic-chemical-release-/).
What can you do?

Make sure you know if you have any materials in your plant that can form hydrates. If you do handle materials which
can form hydrates, you should understand:
 What temperature and pressure conditions can result in hydrate formation
 What design features and operating procedures your plant includes to prevent hydrate formation
 How to recognize hydrate formation if it occurs
 What procedures you must follow to safely remove hydrates if they form
Be sure to do a hazard evaluation before doing any non-routine task such as clearing blocked equipment.
Does your plant handle any material that can form a hydrate?
Stop! Look! Listen! December 2015
We have all seen some version of the signs on the right at a railroad crossing
which is not protected by gates or warning lights. The signs remind you to STOP
before crossing the tracks, LOOK in both directions for an approaching train, and
LISTEN for a train whistle. Only after doing this can you be confident that it is safe
to cross.
When you are working in a process plant, you should also take time to STOP for © Image Copyright 2012 David P
Howard and licensed for reuse
under Creative Commons License.
a few minutes, LOOK around at your plant, and LISTEN to it. Your plant is always
sending you information about its status, but are you looking and listening? Here are
some examples:
 An operator looked at an uninsulated steel tank and thought that the side of
the tank wall appeared to be moving or vibrating. It just didn’t look right. He
reported it to his supervisor and the tank was emptied. It was found to be
severely corroded, and the side wall of the tank was very thin.
 An electrician on the way to a job stopped and looked at some electrical
equipment cabinets in another area. He saw one which was not properly closed, and made sure it was corrected.
 An operator walking past a reboiler recirculation pump on a distillation column thought that the pump was making
unusual noises. The pump was inspected and contained fragments of metal. These were found to be parts of tray
supports from the column, a number of which had corroded and failed.
 An engineer noticed a dust cloud and accumulated dust outside equipment containing combustible solids. There
were potential ignition sources (electrical equipment and potential for electrostatic sparks) in the area. The
equipment was stopped, the room was cleaned, and corrective actions to contain the dust were implemented.
What can you do?

 As you do your job, look at and listen to your plant. Does anything look or sound different? Are there
things that you see or hear that ought to be investigated, but people have just stopped paying attention to
them? This is called “normalization of deviation” – accepting things which should be corrected as “normal”
and not taking action to correct them. Report anything that doesn’t look or sound right and follow up to
remind management to investigate.
 Change your route as you walk through your plant doing routine inspections to get a different view of the
things that you pass.
 Here are some examples of potential safety issues you might observe:
That tank looks rusty and What is that puddle on Is that a crack in this Is something dripping
corroded! the floor? pipe? from this insulated pipe?
Note: Pictures are screen captures from United States Chemical Safety Board videos (www.csb.gov).
You can see a lot just by looking.

- Yogi Berra (Baseball Hall of Fame catcher, 1925-2015)
Malay, Marathi, Norwegian, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
Wrong hose causes ammonia leak! November 2015
Inches
Early on a July 2009 morning, a truck of anhydrous ammonia was being unloaded into a storage tank at a
plant in South Carolina using a hose stored on the truck trailer. Soon after the transfer began, the unloading
hose ruptured releasing a cloud of ammonia, a toxic gas. The cloud traveled across a highway and into a
wooded area where it dissipated. A motorist on the highway drove into the cloud of ammonia and apparently
drove off of the road. She got out of her car and subsequently died from exposure to ammonia. Fourteen
people reported medical problems, and seven were treated for respiratory symptoms and released the same
day. Residents in the area were told to shelter in place, and the highway was closed for several hours.
Approximately 7,000 pounds of ammonia were released.
The investigation found that one probable cause of the rupture was the use of an unloading hose which was
not chemically compatible with anhydrous ammonia. Other contributing causes included inadequate unloading
procedures and inadequate inspection of the unloading hose. The hose that was used to unload the ammonia
was clearly labeled “LPG TRANSFER ONLY” (LPG – Liquefied Petroleum Gas). The trucking company
found that one of their LPG trailers had an unloading hose intended for ammonia use on board, and it is likely
that the hoses had been switched some time before the incident. The incorrect hose which failed may have
been used to unload ammonia somewhere between 2 and 12 times.
What can you do?

• Always check that the correct hose is being used for unloading or loading operations. Be particularly
careful if you are using a hose that comes with the truck.
• Read labels or warnings on hoses and ask for help if you are not sure the hose is appropriate for use.
• Always inspect hoses for damage, including hoses that come with the truck. Do not use hoses which are
not in good condition. Also inspect any gaskets and fittings used with the hoses.
• Properly store hoses to avoid them being kinked, run over, or damaged.
• Follow your plant’s requirements for inspection and replacement of all hoses.
• If you routinely unload a material using a hose that comes with the delivery truck and you see that the hose
for a delivery looks different, ask somebody to check that it is suitable for use.
• Read the August 2004, July 2007, and October 2011 issues of the Beacon on other hose failure incidents.
Are you using the right hose?

Water, water everywhere… October 2015
Water is often found in many places in a plant. It is used for cleaning process Fig. 1
equipment and pipe, for general building and plant washing, and as a lubricant or
seal flush. Water is also a common heat transfer fluid – as cooling water, mixed
with salts or glycol for refrigerated cooling, and as steam for heating. Water is a
common solvent used in many processes. But water can also be dangerous if it
gets into the wrong place. Here are some examples.
• Water as a reactive chemical: Water reacts with many materials, and the
reaction can cause heat, pressure, or toxic reaction products. The initiating
event for the December 1984 Bhopal, India tragedy (Fig. 1), the worst
industrial disaster in history, was contamination of a tank of methyl
isocyanate with water. The reaction generated heat and pressure, releasing
toxic material into the community causing thousands of fatalities and injuries.
• Water as a reaction catalyst: Water can catalyze other chemical reactions Fig. 2
such as decomposition. For example, contamination of a distillation residue
with 1% water reduced its decomposition temperature by 100 ºC. The
temperature of steam heating on a pipe containing the contaminated residue
was above the reduced decomposition temperature. The residue decomposed
and ruptured the pipe (Fig. 2). Fortunately nobody was in the area.
• Water as a physical explosion hazard: Water boils at 100 ºC, below the
operating temperature of many processes. If water contacts hot material or
equipment, it will rapidly boil and generate pressure in a closed or
inadequately vented vessel. Water can explosively increase in volume by Fig. 3
1600-1700 times when it vaporizes to steam at atmospheric conditions. In

1947, a blast furnace in a steel mill Pennsylvania (Fig. 3) was being prepared
for replacement of the brick lining. Workers were improperly told to add
water to the furnace while it still contained molten iron and other hot
materials, in violation of standard operating procedures. The water boiled, and
pressure from the steam blew a hole in the bottom of the furnace. Molten
metal was released and engulfed nearby workers. There were 11 fatalities.
What can you do?

• Be aware of chemical reaction hazards of water in your plant – as a reactive chemical, and as a catalyst for other
reactions. Understand the design features of your plant which protect against hazardous interactions with water.
• Remember the hazard of boiling water from contact with hot (above 100 ºC) equipment or material.
• Always follow standard operating procedures designed to keep water from getting into places in your plant
where there may be a dangerous chemical or physical interaction.
• If there are parts of your plant where water is not supposed to be used, never set up a temporary water supply to
get water into that area. If there is a real need to use water in an area where it is not normally allowed, there
should be a standard operating procedure (SOP) for this special activity. Special precautions may be included in
the SOP, and a permit may be required. If this is not the case, make sure that the activity is given a thorough job
safety analysis or management of change review, and follow all procedures identified by that review.
Water – common but it can be dangerous!

The Beacon is usually available in Arabic, Afrikaans, Chinese, Czech, Danish, Dutch, English, Filipiono, French, German, Greek, Gujarati, Hebrew, Hindi, Italian, Japanese,
Korean, Malay, Marathi, Norwegian, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
Unloading and Loading Hazardous Materials September 2015

Fig. 1 Fig. 2 Fig. 3
A railroad tank car of methyl mercaptan, a poisonous flammable gas (boiling point = 6 ºC), was being unloaded in an
area where other railroad tank cars containing methyl mercaptan and chlorine gas were stored or unloaded. During
unloading, a failure occurred in a threaded section of pipe where it entered a 2-inch to 1-inch reducer attached to the tank
car's unloading valve. A cloud of methyl mercaptan was released and ignited shortly after emergency response personnel
arrived, sending a fireball 200 feet into the air and damaging unloading hoses on a chlorine rail car. Two workers were
fatally exposed to toxic gases, a third fatality resulted from the effects of toxic gas exposure and burns, and approximately
2000 people in the area were evacuated. The entire contents of the methyl mercaptan railcar were released (nearly 150,000
pounds), and approximately 26,000 pounds of chlorine were also released (Fig. 1). Although both railcars had excess flow
valves on their unloading connections, the valves did not close and stop the flow. The flow rate through the failed pipes
was believed to be too low to close the excess flow valves.
The fitting that failed (Fig. 2 and 3) was found to be significantly corroded on the inside. The fitting was the only
support for other piping (Fig. 2), which weighed more than 50 pounds. This fitting was a threaded connection and is likely
to not be as strong as other types of connection, such as a welded or flange connection.

• While the things you do in your tank farm, loading and • Inspect all hoses and piping when setting up to load/unload
unloading operations, may seem simple – usually just trucks or railcars. If anything does not appear to be in good
transferring material – these facilities may be some of condition, ask for a more thorough inspection by a piping
the most important contributors to process safety risk in expert.
your plant. The tank farm probably contains the largest • Make sure that your plant’s procedures for inspection and
inventory of hazardous material in your plant. replacement of components (fittings, valves, hoses, etc.) for
Operations, though simple, involve large quantities. The unloading operations are followed.
consequence of a loss of containment may be severe. • Inspect piping support in loading/unloading equipment,
• You cannot rely on an excess flow valve in a railroad make sure that piping does not have to support a large
tank car or a tank truck to stop flow in some unloading weight, and that it does not easily move or vibrate when
operations. These valves are designed to stop flow in used. If you believe there is a problem, ask a piping engineer
case of a catastrophic failure of the tank discharge to evaluate the system and recommend improvements.
connection and will not close unless the flow rate • Suggest installation of remotely operated emergency shutoff
exceeds a set value. The flow rate from a hose or pipe valves in addition to excess flow valves in trucks/railcars.
leak, or even a pipe failure if your unloading piping and • Consider using self-contained breathing apparatus or
hoses are smaller than the tank connection, may be too emergency escape respirators when loading/unloading gases
low to close the excess flow valve. or volatile liquids that are toxic or asphyxiating.
Reference: Hazardous Materials Accident Report: Hazardous Materials Release From Railroad Tank Car With Subsequent Fire at Riverview, Michigan July 14, 2001,
NTSB/HZM-02/01, US National Transportation Safety Board, Washington DC, June 26, 2002.
Remember process safety in your tank farms!

©AIChE
Operational Readiness August 2015
How do you know that a piece of equipment that you intend to put into service is actually ready for use? For example:
• A routine startup of a process pump, such as switching from the on-line pump to the spare
• Transferring material into a different tank or other process vessel
• Introducing material into a piping system which has been out of service for maintenance
• Starting up new equipment following a plant modification (which should be covered by your plant management of
change and pre-startup safety review procedures)
You can think of many other examples in your plant. Any time that you introduce material or energy into equipment that
is not currently being used, it is essential that you confirm that the equipment is ready. Are all of the parts of the
equipment actually there and properly installed, or is something missing? Are all the valves that are supposed to be open
actually open, and all the valves that are supposed to be closed actually closed? Is everything else ready to use?
Did you know?

It is believed that one of the many contributing causes of the Piper
Alpha North Sea oil platform disaster (165 fatalities) in July 1988 (top
photo, see July 2005 and 2013 Beacons) was a release of light
hydrocarbon condensate when a pump was restarted. Unknown to workers
starting the pump, a relief valve in the pump discharge had been removed
for service and a blank had been loosely installed in its place. This section
of piping was not readily visible from near the pump.
One company recently reported (Forest, J.J., Process Safety Progress

34 (2), June 2015, 126-129) that nearly half of the loss of primary
containment (LOPC) incidents in the plants studied were related to
Conduct of Operation causes (see June 2015 Beacon). Most of those were
due to problems with properly setting up process equipment before
introducing material or energy. Some common factors:
• Expectation not set by management
• Setup not formally included in operator training
• Lack of discipline and consistent format for operating procedures and
shift communications
• Failure to follow standard operating procedures for complex
equipment setup
What can you do?

• When you change the status (start, stop, open, close, increase, decrease, etc.) of a piece of equipment in your plant,
know where material and energy comes from, where it can go, and how that will change when you change the
equipment status.
• Complete a field assessment of a system before changing its status. Make sure that all components of the system are
properly installed, and that everything is in the correct position (open, closed, on, off, etc.).
• Be particularly careful when putting equipment back into service following maintenance or any other activity where
the equipment was taken apart. Make sure that it has been properly re-installed, that all temporary isolation devices
such as blinds have been removed, and that all valves are in the right position.
• Set a personal goal of zero equipment setup errors and “walk the line” incidents in your job, and encourage your
colleagues to do so as well!
Walk the Line!
- Johnny Cash
©AIChE
Know when to leave! July 2015
In April 1995, a manufacturing plant in New Jersey was preparing a

product blend which included sodium hydrosulfite, aluminum powder,
potassium carbonate (all solid materials), and a small amount
benzaldehyde (a liquid). The mixing was done in a 6 cubic meter
blender. An exothermic reaction occurred, likely due to water
contamination. Employees were evacuated from the building, but later
several workers returned to attempt to empty the blender. While they
were doing this, the blender exploded causing five fatalities (all were in
the blender room) and injuring four others.
In April 2004 an operator in a batch polyvinylchloride plant in Illinois
inadvertently opened a valve on the wrong reactor. The reactor was in the
reaction phase of the process and contained vinyl chloride monomer under
pressure. A large cloud of flammable, toxic vinyl chloride was released into
the building. Operators and a shift supervisor tried in vain to stop the
release, and did not evacuate. The flammable cloud ignited and exploded,
destroying the plant. There were five fatalities (including the operators who
were trying to stop the release) and three injuries. For more information on
this incident, see the June 2013 Beacon.
In June 2005 there was a fire in a gas cylinder filling and distribution
facility in St. Louis, Missouri. The facility contained thousands of
cylinders of flammable gas. A relief valve on a propylene cylinder
opened on the extremely hot day, and the released gas ignited starting the
fire. The fire spread rapidly, engulfing most of the facility within 4
minutes, and causing other cylinders to explode. All people in the facility
evacuated immediately and the fire department did not attempt to enter.
Although the death of one neighbor was attributed to an asthma attack
triggered by smoke, there were no fatalities among the site workers and
visitors who promptly evacuated.
What can you do?
In the first two incidents described, workers were fatally injured when attempting to respond to a serious
abnormal event – an unexpected exothermic reaction in a vessel, and a large release of flammable vapor into a
building. It is likely that they thought they could “save the day,” but either had insufficient information or didn't
consider the risk. In the third incident, workers and visitors promptly evacuated the facility, fire fighters maintained
a safe distance from the fire, and there were no fatalities among the workers, visitors, and fire fighters.
If there is an unexpected reaction in a vessel, you do not know when the reaction might develop enough pressure
to cause the vessel to rupture. When there is a large release of a flammable vapor, all it needs is an ignition source
to burn or explode. Never put yourself in danger by remaining in the area if this happens in your plant. Know your
facility emergency plans, participate in drills, and know when to evacuate or shelter in a safe place.
Know what can go wrong in your plant, when you should evacuate, and when to shelter in place!
Conduct of Operations June 2015
In January 1997 there was an explosion and fire in a In April 1998 an explosion followed the release of
hydrocracking unit in a refinery in California. A pipe in flammable chemicals from a 2000 US gallon batch reactor
the unit ruptured releasing a flammable mixture of into a building in a specialty chemical plant in New Jersey.
hydrocarbons and hydrogen, which ignited resulting in a Operators were unable to control the temperature of the
fire and explosion. There was one fatality and 46 people batch, and the runaway reaction partially vented through the
were injured. One of the causes was excess temperature in reactor manway into the production building. 9 people were
one of the hydrocracking reactors. The specified maximum injured, 2 seriously, and chemicals were released into the
temperature in the reactors was 800ºF (425ºC), and the surrounding community. It is believed that the initial
system was supposed to be shut down if the temperature temperature of the batch was higher than normal, making it
exceeded this value. The reactor and the pipe which more difficult for operators to control the batch temperature
ruptured were believed to have reached a temperature with the available cooling.
greater than 1400ºF (760ºC).
In 8 of the previous 32 batches produced, operators had
Previous temperature excursions in excess of the difficulty in controlling the batch temperature. The
specified 800ºF (425ºC) maximum had occurred, but the temperature and the rate of temperature rise for individual
system had not been shut down. This led operators to steps of the process were beyond the limits specified by the
believe that these excursions were acceptable. Also, some procedure. In some cases, the temperature exceeded the
of these temperature excursions were not investigated, and maximum range of the reactor temperature recorder (150ºC
recommendations from those that were investigated were or 300ºF). In those batches, operators were able to regain
not all implemented. control of the batch temperature without a runaway
reaction. These temperature excursions were not
investigated, and no action was taken in response to them.
What can you do?

Although these two incidents occurred in completely different types of manufacturing plant, they have one important
thing in common. In both incidents, the process had exceeded specified safe operating limits during operations before the
incident. The abnormal conditions became accepted – this is called “normalization of deviation.” These warning signs
were either not investigated, or actions recommended by the investigation were not implemented. “Conduct of
Operations” can be summarized in two simple concepts: (1) Say what you intend to do (procedures), and (2) Always do
what you say. This means, for example, that if your operating procedures say to shut down if a critical safety parameter
exceeds a specified value, you must always take this action!
• Know what the critical safety process parameters are for your plant, know the consequences of exceeding them, and
know what to do if they are exceeded.
• Always take the required actions if critical safety parameters are violated.
• If critical safety parameters are exceeded, report it to management so an appropriate investigation can be done.
What are your plant’s critical safety control limits?

Mechanical Integrity May 2015
In August 2012, a pipe in a Crude Distillation Unit (CDU) in a refinery 1

in California ruptured, releasing hot, flammable hydrocarbon process fluid
(Photo 1). The released material partially vaporized forming a large vapor
cloud which ignited. The pipe failed due to thinning caused by sulfidation
corrosion, a common damage mechanism in refineries. Sulfidation
corrosion failures are of great concern because of a comparatively high
likelihood of catastrophic failure. This can happen because corrosion
occurs at a relatively uniform rate over a broad area, so a pipe can get
progressively thinner until it bursts, rather than a failure starting as a small 2
leak at a pit, crack, or local thin area.
In November 2013, a fire erupted after a leak from a pipe containing
vacuum residue at a CDU in a refinery in Brazil (Photo 2). The leakage
occurred due to the rupture of a straight section pipe in a pipe rack, near
the pre-flash tower of the CDU. The investigation determined that the
pipe section was very thin (less than 1 mm). The specified material for
this pipe section was an alloy steel, but the actual material was found to
be carbon steel. This pipe section had been replaced during a maintenance
shutdown in 1998, and the wrong material of construction was used.
In both of these incidents, the Mechanical Integrity Management System was not successful in detecting or
replacing deteriorated piping components before failure. In the 2013 incident, the maintenance system did not
ensure that the correct material of construction was used when the pipe was replaced. More effective
mechanical integrity and maintenance programs could have prevented both incidents.
What can you do?

 Immediately report any leak that you discover, no matter how small, and follow up to make sure action is taken.
 If you are responding to what appears to be a small leak in a large pipe or vessel, consider the possibility that the
“small” leak is actually caused by a large area of thin or weak metal which could suddenly become a large leak. Plan
your response to ensure that people are protected if this happens.
 If you are replacing piping or other equipment, make sure that you use the correct material for all replacement parts.
Follow the Positive Material Identification (PMI) procedures at your facility and verify implementation in the field.
Perform a 100 percent component inspection of what has been replaced during a turnaround before re-starting.
 Frequent use of leak repair clamps to externally stop process fluid leaks raises questions about effectiveness of a
mechanical integrity program. These devices are intended to provide a temporary repair while a process continues
operating until a permanent repair can be made, perhaps during a plant shutdown. When such temporary repairs are
implemented, follow you plant’s management of change procedures. Be sure that temporary repairs are managed so they
can be included for permanent repair when planning the next shutdown.
 Understand and make sure that recommendations from your inspection group are implemented in a timely manner.
 An effective management of change (MOC) process is vital to the success of any piping integrity management
program. Your plant inspection group can anticipate changes in corrosion or other deterioration and change inspection
schedules and procedures appropriately. Make sure your inspection group is involved in the approval process for changes
that may affect piping or other equipment integrity.
“You get what you inspect, not what you expect!”

Safe Work Practices April 2015

1 A maintenance crew was re-installing piping at the top of a reactor in a
refinery. The reactor was being purged with nitrogen to keep oxygen in the air
from contacting the catalyst inside, and the top of the reactor was open (1). A
sign indicated that the reactor was a confined space and a permit was required
for entry, but no sign warned about the presence of nitrogen. On the job permit,
the box indicating “Nitrogen Purge or Inerted” was checked “N/A” – Not
Applicable (2).
2
When the maintenance workers began the job, they observed a roll of duct
tape inside the reactor (3), which would have to be removed. They attempted to
remove the tape from outside using a long wire to hook the tape, without
success. What happened next is not clear. A worker may have intentionally
entered the reactor to remove the tape, intending to exit quickly. Another
possibility is that the worker tried to get closer to the tape by sitting on the edge
of the reactor opening, and either slipped and fell in, or lost consciousness from
the reduced oxygen atmosphere near the reactor opening and fell into the reactor.
3
A co-worker observed the unconscious man inside the reactor and entered
himself for an attempted rescue. He also lost consciousness and collapsed. A
properly equipped rescue team arrived and removed the unconscious men, but it
was too late. Both were pronounced dead at the hospital.
US CSB report and video on this incident: http://www.csb.gov/valero-refinery-asphyxiation-incident/

 “Safe Work Practices” refers to the processes  Understand all of the Safe Work Practices in your plant and
we use to authorize non-routine work activities, your work area, including authorization and permit systems.
and to control the hazards and manage the risks Know what activities require a permit, and what the process
associated with these activities. is for obtaining a permit.
 Safe Work Practices often authorize work  If you are authorizing non-routine work activities covered
through permits, which often include checklists by your plant’s work permit systems, make sure you are
of potential hazards associated with the work. properly trained, understand the permit systems, and
 A “non-routine activity” has nothing to do with understand the hazards associated with the work.
how often the activity is done. Instead it refers  If you issue a permit, make sure the people doing the job
to activities that are NOT part of the normal understand all of the hazards.
process for converting raw materials to finished  Don’t rely on others to verify that a system is properly
product, and NOT COVERED by the plant’s prepared for the work. If you are going to sign the permit,
standard operating procedures for normal check everything yourself!
operations.  If you are doing the non-routine work activity, make sure
 Some examples of where Safe Work Practices that you have the required permit, follow all of the required
are applied: line breaking, vessel entry, other procedures to control hazards, and use the proper personal
confined space entry, control of energy sources, protective equipment. If the job changes while in progress,
lock out/tag out, hot work permits, elevated contact the person authorizing the work for permission and
work permits, excavation in process areas. to determine if any additional safety precautions are needed.
Understand your plant’s work permit systems!

©AIChE
Details Matter in Process Safety! March 2015
There was an exothermic reaction in a drum of radioactive waste

material in a nuclear waste repository. The drum ruptured, releasing
small amounts of radiation, exposing other waste drums to elevated
temperature, and contaminating 20 workers with low levels of
radiation. Other drums containing similar waste material may also be
in danger of rupture. The facility had to be shut down and the
recovery cost is expected to be several hundred million dollars.
A chemical reaction occurred in the drum, which contained acidic

waste material and oxidizing chemicals including nitrate salts, as
well as an organic absorbent. This mixture can react to generate heat
and pressure.
While a final determination of causes has not been made,

newspaper reports indicate that a typographical error in a revision to
a facility policy may have resulted in the use of the wrong
absorbent! The revised policy specifically stated that an organic
absorbent should be used, when it should have specified the use of
an inorganic absorbent (a clay based absorbent). The error was not
recognized and the absorbent was changed, resulting in the incident.
Details matter! Those two letters, “i” and “n,” make a huge
difference in the characteristics of the absorbent!
Some Other Examples What can you do?

 Small diameter tubing connecting a pressure gauge to process piping  Whatever your job –
ruptured releasing flammable material which ignited. The resulting fire operations, maintenance,
destroyed a plant (October 2012 Beacon). The detail – a few inches of supervision, engineering,
small tubing in thousands of feet of pipe! management – pay attention to
 An ungrounded instrument probe in a duct built up a static electric charge. the details in your work. There
The duct was air conveying a combustible solid powder. A spark ignited a are no unimportant details in
dust explosion. The detail – a single ungrounded conductive piece of process safety. You never
equipment out of thousands of components that were properly grounded! know which apparently minor
 There was a significant fire on an offshore oil platform when a small hose detail can initiate a major
failed releasing methanol, which ignited. The hose was leaking and had event, so you have to pay
been repaired with duct tape (July 2007 Beacon)! The detail – a single attention to all of them!
small hose leak on a platform containing large piping and equipment!  If you are asked to review a
 Many explosions have resulted from running a centrifugal pump with procedure or other process
both the suction and discharge valves closed, allowing temperature and safety information, really
pressure to build up in the pump (October 2002 and August 2013 review it. Don’t regard the
Beacons). The detail – one or two valves out of hundreds in the plant review as a formality, go over
were in the wrong position! it carefully.
Pay attention to details in your job – they are important!

Who are all these people? February 2015

In a number of serious events, there may have been more people in the area 1
than were needed to do or monitor the job. Some examples:
• Nineteen people managed to escape, although some were engulfed in flames,
when investigating a leaking oil pipe in a refinery. The leak suddenly
increased in size releasing a flammable vapor cloud which ignited (1).
• There were 17 fatalities from an explosion when a compressor removing
vapors from a wastewater storage tank was restarted. The tank unexpectedly
contained a flammable atmosphere (2).
• Three of five workers investigating a pipe leak in a metal processing plant
were fatally injured when a hydrogen fire broke out (3).
2
The risk of a serious event is higher when equipment is starting up, shutting
down, or in abnormal operation. Why? In some cases, safeguards may not be
fully functional during a transition. During startup, it is possible that somebody
made a mistake in preparing the equipment for startup and something is not
correct. Perhaps a valve that should be closed has been left open, a blind has
been left in a line, or some other error. People doing the startup are focused on
the task at hand and may not be thinking about what could go wrong or what 3
happens if it does. Upset conditions may create a large number of alarms which
hide a potential problem.
Too many people in the area, whether the control room or the plant, can be a
distraction, causing bad decisions which could lead to serious process safety
events. They may also be injured by the event, and there was no good reason for
them to be in the area.
What can you do?
Review operating procedures for non-standard operating modes – for example, startup, shutdown, process upset,
investigating a process or equipment problem. The procedures should consider who is allowed in the area and who isn’t.
If this information is not clear, bring it to the attention of plant management. Here are some questions that the operating
procedure should have answers for:
1. Who is essential to this task? Who MUST be there? Who are just concerned people who do not need to be in the
area and who should be directed to go to a safer location? For planned activities such as startup and shutdown, this
should be determined when the startup or shutdown plan is developed.
2. If something goes wrong, what could happen to people in the area?
3. Review emergency procedures for leaks – do they consider what people who are not essential for response should
do while the leak is being investigated?
4. Do all people in the area know what they should do if a loss of containment occurs? Are they using the proper
personal protective equipment?
5. Consider postponing tasks to prevent non-essential people from being in an area during non-standard operating
modes.
6. If you don’t have a specific, defined job to do in the operation, maybe you should go somewhere else! If you are not
sure, ask for permission from the area supervisor or operator to be present while this operation is taking place.
Think about who is not required to be present when starting up equipment or investigating a problem!
Malay, Marathi, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Tamil, Telugu, Thai, Turkish, and Vietnamese.
What is the process risk? January 2015
The November and December 2014 issues of the Process Safety Beacon marked the 30th
anniversary of two of the worst industrial disasters in history – the November 1984 explosions and
fires at an LPG terminal in San Juan Ixhuatepec, Mexico City, Mexico (1) and the December 1984
toxic gas release in Bhopal, India (2). These incidents were catastrophes impacting tens of
thousands of people. The “What can you do?” sections of these Beacons encouraged you to
understand the worst thing that might possibly happen in your plant, and your role in making sure
that event does not happen.
However, you should also be aware that the worst process incident that can happen in your plant
may not be the same as the highest process risk. Risk is a combination of how likely an incident is,
and how bad the consequences could be (3). The process incident in your plant with the worst
consequences may be very unlikely to occur. Other less severe incidents may be more likely,
making the risk of these events higher than the incident with the worst consequences.. You should
be aware of all process risks in your plant, and your role in managing all of those process risks.
1 2 3
Likelihood
Consequence
(Probability/
(Impact)
Frequency)
RISK
What can you do?

Ask similar questions to those suggested in the December 2014 Beacon for all of the process risks
in your plant:
What are all of the process risks in the area where I work and in my job?
What are the systems in place to manage these risks – both to prevent process incidents happening
and for reducing the consequences if they do happen?
How do I know that these process risk management systems are adequate and working properly?
What is my role in making sure that the systems for managing all of the process risks in my plant
are functioning properly?
Understand all process risks in your plant and your role in managing them!
Bhopal – The Worst Industrial Disaster in History December 2014
1 4
Just after midnight on December 3, 1984 (30
years ago), a pesticide plant in Bhopal, India
released approximately 40 tons of highly toxic
methyl isocyanate (MIC) into the atmosphere.
There were thousands of fatalities, hundreds of
thousands of injuries, as well as long term health,
environmental, and economic impacts. This
2 incident is widely considered to be the worst
industrial disaster in history.
It is believed that water entered MIC storage
tank E610 (1). An exothermic reaction resulted,
generating heat and pressure which opened the
tank relief valve. Some critical instruments in the
3 5 field and control room (2) were not working
properly. A refrigeration system (3) was out of
service and the refrigerant had been removed.
Gas from the relief valve flowed to a caustic
scrubber (4) which was shut down for
maintenance. From there, the gas flowed to a
flare (5) which was also shut down awaiting
replacement of corroded piping. The toxic gas
Note: All pictures taken in December was released to the atmosphere without treatment
2004 at the plant in Bhopal exposing hundreds of thousands of people.
There were many failures in design, management, safety culture, and operation
of the facility which contributed to the tragedy. You can find many good resources
on the Internet which describe the incident in great detail. Take some time this
Above: A sign in the plant control room month to learn about the incident, and what it means to you in your job.
What can you do?

Everybody in your organization, including executives, plant management, engineers and technical
personnel, unit management, supervisors and foremen, operators, maintenance workers, and even office and
service workers, should be able to answer the questions below. Obviously the answers will vary considerably
depending on the person’s job responsibility, but everybody must understand his or her role in preventing a
major tragedy like the Bhopal disaster.
What is the worst thing that can happen where I work and in my job?
What are the systems in place to keep that from happening (preventive systems)?
How do I know that these preventive systems are adequate and working properly?
What are the systems in place to respond to that event if it does happen (mitigative systems)?
How do I know that these mitigative systems are adequate and working properly?
Are any of the preventive and mitigative systems bypassed or shut down as they were at Bhopal?
What is my role in making sure that these preventive and mitigative systems are functioning properly?
Do your part to prevent disaster!

©AIChE
Thirty Years Ago – An LPG Tragedy November 2014

At about 5:30 AM on November 19, 1984 there was a
major fire and a series of explosions at a liquefied petroleum
gas (LPG) storage and distribution terminal at San Juan
Ixhuatepec, Mexico City, Mexico. There were approximately
600 fatalities, approximately 7,000 injuries, 200,000 people
were evacuated, and the terminal was destroyed. The blasts
were recorded on a seismometer 20 km (12.4 miles) away,
and the largest blast registered 0.5 on the Richter scale. Most
of the injuries and fatalities were in the surrounding
community – people were living as close as 130 m (425 ft.)
from the terminal.
The cause of the accident could not be definitively
established because of the destruction of the facilities and
absence of witness reports. It is believed that LPG leaked
from a tank or pipeline into a walled enclosure. LPG vapors
formed a flammable vapor cloud about 2 m (6.6 ft.) high.
The cloud was ignited, possibly by a ground flare.
There is evidence that some storage tanks in the facility
may have been overfilled, leading to diversion of LPG flow
to ground flares. The initiating release may have come from
overfilling a tank or overpressure of one of the storage tanks.
Many causes contributed to the disaster, including the
design of the terminal ( for example, inadequate spacing of
tanks, ineffective gas detection, lack of passive fire
protection systems), destruction of the fire fighting system by
the explosions, improper maintenance of safety equipment,
and a large number of people living close to the terminal.
Although there were many facility design  Understand the magnitude of a potential incident in your plant,
factors which contributed to the disaster, it is and what safety systems are in place to prevent and mitigate the
also reported that the local plant safety event.
committee found a number of operational  Report all failures of safety systems and equipment and ask your
safety problems before the incident. management to have them repaired.
 Housekeeping was poor  Check that all pressure relief devices are inspected and
 30-40 % of safety devices, including fire maintained as required by your plant’s policy.
water spray systems, were inoperative or  Confer with your safety and production engineers to determine
bypassed how to manage risk, including the possibility of shutting down, if
 A relief valve on an LPG receiving critical safety equipment is not working properly.
manifold was missing  Remember that poor housekeeping in a plant is often a symptom
 Pressure gages were inaccurate and in of a poor safety culture. Take care of your plant and all of its
poor condition equipment, especially safety equipment.
Take care of your plant’s safety systems so they can take care of you!
Dust Explosions - Clean up this Hazard! October 2014
1 2 3
In August 2014 the United States Chemical Safety Board (CSB) reported the
results of an investigation of a December 2010 explosion in a titanium and zirconium
4
scrap metal processing facility in West Virginia. The explosion resulted in three
fatalities and one injury. Here is a brief summary of what is believed to have
happened:
1. A blender was being used to process zirconium powder. Employees had observed
mechanical problems before the explosion. Blender paddles were striking the
sidewall of the blender causing damage. Adjustments and repairs were made but
problems continued.
Note: All pictures are screen captures
2. It is believed that sparks or heat from metal-to-metal contact between the blender from the US Chemical Safety Board video
blades and the blender side ignited the zirconium powder. describing the incident
(http://www.csb.gov/al-solutions-fatal-dust-
3. The burning zirconium dust resulted in a deflagration - hot gases expanded,
explosion/)
producing a “wind” observed by two witnesses. The burning zirconium dust
ignited open drums of titanium and zirconium stored nearby, propagating the fire.
4. The initial explosion lofted other dust in the plant into the air causing a secondary dust explosion and fire.

The CSB has investigated 9 serious combustible The CSB report identified many contributing causes for
dust incidents in the USA since 2003. These this incident. Most were related to facility design, failure to
explosions and fires caused a total of 36 fatalities comply with dust explosion protection standards, and
and 128 injuries. Five of these explosions involved management systems. But there are things that you can do as
metal dusts, and three occurred in the same plant. a plant worker to prevent dust explosions.
On August 2, 2014 an explosion in a plant in Know whether or not you have any dust explosion hazards
Kunshan, China that manufactures aluminum in your plant, and what you must do to ensure proper
automobile wheels caused at least 75 fatalities and operation of your plant’s protective systems. US OSHA
180 injuries. Initial reports indicate that the incident has a useful poster with guidance on what kinds of
was an aluminum dust explosion. materials might be dust explosion hazards:
Most solid organic materials, as well as plastic https://www.osha.gov/Publications/combustibledustposter.pdf
powders and many metals, can create an explosive Recognize that good housekeeping is critically important
cloud if the particles are small enough and for dust explosion safety. Accumulated dust on equipment,
dispersed in the air at a sufficiently high floors, and elevated surfaces such as lighting fixtures and
concentration. ceiling support beams can contribute to secondary dust
More information about dust explosions can be explosions.
found in the following Beacons: 9/2003, 5/2006, Report any maintenance issues which could result in
and 5/2008. You can view these at www.sache.org. sparking or overheating in any dust handling equipment,
and do not operate the equipment until it is repaired.
Do you have dust explosion hazards in your plant?

Malay, Marathi, Farsi (Persian), Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Tamil, Telugu, Thai, Turkish, and Vietnamese.
What is your role in Hazard Identification and Risk Analysis? September 2014
Hazard Identification and Risk Analysis (HIRA) includes all

activities involved in identifying hazards in your process,
understanding potential incident scenarios, identifying
safeguards, and evaluating risk to people, the environment,
property, and business. Your plant may call this review a
Process Hazard Analysis (PHA), a name used in regulations in
some countries, including the USA. CCPS now uses the term
“HIRA” because it specifically includes risk analysis, which has
become a part of this activity in many companies in recent
years. Regulations in the USA and many other countries, as well
as many company process safety standards and policies, require
In September of 1998, there was a fire in a natural gas
participation of front line workers in HIRA/PHA studies – plant processing facility in Longford, Australia. The fire resulted in
operators, maintenance workers, and other people directly 2 fatalities, 8 injuries, and disruption of the gas supply to the
involved with operating and maintaining the plant equipment. state of Victoria for several weeks. A Royal Commission
investigation concluded that a HIRA study could have
identified the potential failures that caused the incident.
There are a number of techniques which are used for Unfortunately, the HIRA study was planned but never
conducted. Planning to do something is important. Actually
HIRA/PHA. The most common HIRA techniques in the process doing it is required for success.
industries include “what if?” analysis, checklists, a combined
what if/checklist, hazard and operability (HAZOP) studies, and there are also other techniques. Your plant may use
some combination of these methods, and you may have a different name for your HIRA/PHA procedure. Regardless
of the technique used, the role of the plant worker is critical. You operate and maintain the equipment every day,
understand how it actually works, and, perhaps more importantly, how it can fail. It has been said that there are
actually three plants – the plant that the engineers and managers think is there, the plant that the operators initially
think is there, and the real plant. One of your key roles is to help make those three plants the same!
What can you do to contribute to a better HIRA (PHA)?
If you are asked to participate in an HIRA/PHA study, here are some things you can do to help make it better:
Î Share your knowledge of how the steps in a procedure are actually executed, especially if this is different from
what is written. Explain the reasons to the HIRA/PHA team so they can resolve them and make the actual and
written procedures the same.
Î Before the HIRA/PHA, talk to your colleagues about what you will be doing. Ask them to tell you about any
issues that they want to be sure the team discusses.
Î Share your years of operating experience, and that of your co-workers, about the reliability of equipment,
instrumentation, and alarms or safety systems. Make sure the team knows what works, what doesn’t work well, and
what has gone wrong in the past.
Î Verify that any operator action – for example, action in response to an alarm – which the team considers a
safeguard, is understood by operators, and can be done reliably in the time required to keep the process safe.
Î Don't be shy! Proactively share your knowledge and experience, and don't wait for somebody to ask.
Î Remember that your role is both to learn and to teach. You can learn from the other experts in the HIRA/PHA,
and they will learn from you, particularly about how things really work in the plant. Share what you learn with your
co-workers after the HIRA/PHA is completed.
Use your experience to help do a good HIRA/PHA and make your plant safer!
Ignition Sources August 2014
The best way to prevent fires and flammable vapor explosions, either inside or outside
process piping and equipment, is to avoid creating a flammable mixture. Inside process
equipment, this means controlling the “fuel” and “oxygen” sides of the fire triangle (left).
We must also prevent the release of flammable or combustible gases, liquids, or dusts (fuel)
from process equipment into the surrounding environment, where oxygen will always be
present in the air. 1 2 3 4
However, we must also recognize

that our equipment and operating
procedures can fail and a flammable
atmosphere can result from a failure.
So, we must always work to
eliminate ignition sources (“heat” in 5 6 7 8
the fire triangle) in any place where
there is the potential for a flammable
atmosphere. The pictures to the right
show some examples of ignition
sources that we need to control. Do
you have any of these in your plant?
Can you think of any other possible Some examples of ignition sources: (1) static electricity, (2) vehicle, (3) welding, (4) open flame,
(5) grinding, (6) faulty electrical wiring, (7) a furnace, (8) pyrophoric or decomposing material
ignition sources in your plant?
What can you do?
• Understand and strictly follow your plant’s work permit procedures for hot work, electrical work, and any
other activity that could create ignition sources in hazardous areas.
• Follow your emergency procedures in case of a flammable release. For example, make sure that hot work is
stopped and vehicles are shut off.
• Look for potential ignition sources such as faulty electrical wiring, improper equipment in hazardous areas,
or other issues as you go about your job. Report problems and make sure they are fixed.
• Understand hazardous area (electrical) classification
Several Process Safety Beacons have discussed specific
for your plant (see the October 2013 Beacon). examples of the likely ignition sources for major fires and
• Remember that many common portable electronic explosions. You can access “read only” copies of these
devices such as cell phones, digital cameras, tablet Beacons on line at http://sache.org/beacon/products.asp:
computers, and laptops are not rated for use in Process Safety Ignition Source
Beacon Date
hazardous areas. Follow your plant’s policies and
April 2003 Hot activated carbon absorber
permit systems for use of these devices.
July 2003 Static electricity
• Be aware that a hot surface, such as a hot pipe or a September 2004 Truck motor
hot motor, can be an ignition source, particularly if December 2008 Static electricity
you are handling a material with a low autoignition October 2009 Truck motor
temperature. October 2013 Sparks from electrical equipment
Control ignition sources in your plant!

Persistence – Good or Bad? July 2014

In some process safety incidents, operating personnel have failed to [1]
recognize that a process was not responding as expected. They attempted to
keep a process in operation by deviating from standard procedures, or put
themselves in danger by attempting to correct an out of control process
condition rather than evacuating. Some examples:
• April 1995 Lodi, New Jersey blender explosion, 5 fatalities: The plant
was blending water reactive chemicals. The operation continued 24 times
longer than expected, with unexpected heat and gas generation. Workers
were trying to empty the blender when it exploded.
• April 2004 Illiopolis, Illinois polyvinylchloride plant explosion, 5 [2]
fatalities [Picture 1]: A valve on a pressurized reactor was inadvertently
opened generating a flammable vapor cloud in a building. Operators
remained in the building trying to stop the release, and the vapor ignited.
• March 2005 Texas City, Texas refinery explosion, 15 fatalities [Picture
2], and December 2005 Buncefield, England oil storage terminal
explosion, 43 injuries and major damage [Picture 3]: Operators continued
to fill vessels even though level instruments showed no increase,
eventually resulting in a flammable material release which ignited. [3]
• January 2010 Charleston, West Virginia phosgene release, 1 fatality: A
process problem reduced the flow of phosgene from a cylinder. The feed
was switched between cylinders to keep the process running. Standard
procedures to clear phosgene from feed hoses were not followed. A liquid
filled hose failed and released phosgene because of pressure from thermal
expansion of the liquid and a faulty hose, exposing a worker to phosgene.
What went wrong? What can you do?

Many things contributed to the incidents above. Persistence is admirable, but know when to stop and get help, and
However, there are lessons from them which can what limits cannot be exceeded.
help you prevent injuries and fatalities in your plant: • When you have difficulties during operation or maintenance,
• A process did not respond as expected from a don’t try to force your way through the problems. Stop and get
known change. Nobody recognized the problem help, ask if you should continue, and be willing to shut down if
or asked for help about what was happening. For you don’t understand what is happening.
example, when filling a vessel, you expect the • Review startup and re-commissioning plans for potential failures,
level to increase and should investigate what is and plan what you can do to prevent or mitigate problems.
happening if you do not get the correct response. • Make sure instruments are accurate, and use the information they
• Operators used non-standard procedures to provide to make decisions. If an instrument reading does not
attempt to keep a process in operation without seem right, don’t assume it is a faulty instrument! Think about
recognizing the hazards involved. what it could mean if the instrument is correct, and ask if the
• People tried to take heroic measures to remove activity should continue.
reactive materials from a process vessel which • Know when to evacuate the area when your process is out of
exceeded safe operating limits, or to stop a leak control, or if there is a leak of hazardous material.
from a process. Workers put themselves in • If you do not have criteria for when to switch from normal to
danger while trying to correct a problem. emergency operating procedures or evacuation, ask leadership in
your area for guidance.
Know when to stop – and when to get help!

A Safety Device Gone Wrong! June 2014
Picture 1 shows a fire hydrant in a town in the northern 1

USA that gets a lot of snow in the winter. The vertical steel
rod fastened to the left side of the hydrant is intended to
mark the location of the hydrant, as shown in Picture 2. A
flag is installed at the top of the rod so firefighters can find
the hydrant if it is covered with snow. The flag also marks
the location of the hydrant so it is less likely to be damaged
by snow removal equipment, and so people do not park
vehicles where they will block access to the hydrant. The
flag is a safety device to help people know where the
hydrant is located if it is buried in snow.
Clearly this safety device has created a problem. The
metal rod was installed so that it passes through the valve
handle. You cannot open the valve without first removing
the rod! The rod may also impede the use of a hydrant
wrench to open the hydrant. While the rod and flag can be
removed, this will take valuable time, possibly in an
emergency situation.
2 3
Picture 1 resembles Picture 3, from the October 2004
Beacon. In Picture 3, nature, in the form of a growing tree
branch, makes it difficult to operate the fire water valve. In
Picture 1, somebody has installed a rod and flag through a
fire hydrant valve, with the same effect.

Î The flag on the fire hydrant can be considered to be Î Any change to a system, including the addition
a safety device – to protect the hydrant from damage by of a new safety device, is a change that must be
snow removal equipment, to remind people not to block reviewed using your plant’s Management of
access to the hydrant, and to help firefighters find the Change (MOC) procedure.
hydrant if it is buried by snow. But, because it was Î When doing an MOC review of a new safety
improperly installed, it is difficult to quickly open the device, be sure to consider the possibility that the
hydrant valve. So, a safety device has created a new, change introduces new hazards.
and perhaps more serious, safety problem! Î After the change is reviewed, make sure it is
Î Any safety device can create a new hazard. Any implemented correctly and is ready for operation
change to equipment, even one intended to improve using your plant’s pre-startup safety review (PSSR)
safety, can create new hazards or make other existing process.
hazards more severe. This is particularly true if the Î Get emergency response personnel involved in
safety device is not properly installed. MOC and PSSR if the change impacts them.
Review all changes – even those intended for safety!

Major Spills and Environmental Incidents May 2014
Some Incidents 1 2
November 1986 - A fire in an agricultural chemical warehouse
in Basel, Switzerland, released tons of pollutants into the Rhine
River. The pollution traveled the length of the Rhine through
four countries and caused serious environmental damage.
November 2005 - A plant explosion in Jilin, China, resulted in
the release of 100 tons of benzene into the Songhua River
creating a slick extending 80 kilometers downstream. The city
of Harbin had to shut off the water supply for almost 4 million
people for 5 days. 3 4
December 2008 - 1.1 billion gallons of coal fly ash slurry (a
mixture of ash and water) spilled when a containment area dike
ruptured at a power plant in Kingston, Tennessee, USA. The
slurry spilled across the Emory River onto the opposite shore.
It covered 300 acres of land, damaged homes, and
contaminated water in other nearby rivers. This is the largest
fly ash release in United States history.
January 2014 - Thousands of pounds of 4-methyl-
cyclohexanemethanol (MCHM) were released through a 1-inch (1) A damaged storage tank and
a spill into a containment dike;
hole in a storage tank in Charleston, West Virginia, USA into (2) Spill containment and
the Elk River. The spill was upstream of the intake for the cleanup efforts; (3) Aerial view
drinking water supply for up to 300,000 people. Hundreds of of the Kingston spill; (4) The
plant where the Charleston WV
people sought medical treatment after the spill. spill occurred

Î We may think of process safety incidents as fires, Î Know what you are expected to do if you observe any
explosions, and immediate injuries from exposure to material leaking from pipes or vessels in your plant.
toxic, corrosive, or otherwise hazardous materials. Understand what immediate action you should take, who to
However, major spills of hazardous materials, report the leak to, and how to activate spill and leak response
especially into rivers or other bodies of water, are procedures for your plant.
also process safety incidents. They have the potential Î Check your plant emergency response procedures and
to impact large numbers of people, including people make sure they include required actions to prevent the release
far away from your plant. of hazardous material into rivers or other waterways in case of
Î Some of the incidents listed above occurred a fire, explosion, or other incident.
because of a leak from a pipe, vessel, or containment Î Inspect containment dikes and spill containment pads
pond, while others were a consequence of another around pumps, loading and unloading areas, and other places
process safety incident (a fire or explosion). where spills might be more likely. Make sure they are properly
Î For spills or leaks, properly designed and maintained and in good condition.
maintained dikes around storage tanks and other Î Pump rain water out of containment dikes around storage
process vessels, and containment pads in areas where tanks promptly. If the dike is already full of water, it won’t be
spills might be more likely (for example, loading and able to contain a spill!
unloading areas), are important protection systems to Î Participate in emergency response drills and know what
contain hazardous material spills. actions you need to take to prevent spilled hazardous material
from escaping from your plant.
Process safety is also about protecting the environment!

How do you measure process safety performance? April 2014
The Problem
The March 2014 Beacon discussed the relationship between
process safety and occupational safety, as well as the importance of
both in ensuring a safe workplace. For many years, industry has used
established measures of occupational safety performance, such as
Occupational Injury and Illness (OII) rate, to monitor the
effectiveness of safety management systems. However, these
statistics are not good measures of process safety performance.
Following the March 2005 explosion at a BP refinery in Texas
City, Texas, an independent investigation panel (the “Baker Panel”)
found that “BP primarily used injury rates to measure process safety
performance at its U.S. refineries before the Texas City accident.
Although BP was not alone in this practice, BP’s reliance on injury
rates significantly hindered its perception of process risk.”
The panel concluded that the BP process safety management
system did not effectively measure process safety performance.
Other companies recognized that they had a similar problem. CCPS
and other government, industry, and professional organizations have
developed new measures for process safety performance. While the
details are beyond the scope of the Beacon, these measures focus on
loss of containment of material and energy, and on the effectiveness
of specific process safety management activities. For example, the
American Petroleum Institute (API) developed RP 754 “Process
Safety Performance Indicators for the Refining and Petrochemical Cover of the CCPS report on measuring
Industries.” Industry organizations and individual companies all over process safety, available for download from:
http://www.aiche.org/ccps/resources/tools/process-safety-metrics
the world are developing and using similar measures.
Î Traditional injury rate statistics do not effectively measure Î Understand what measures your plant uses to
how well your process safety management system is performing. monitor process safety performance.
Think about it – what if there is a large release of a flammable Î Understand your role in recognizing and
material, perhaps several tons, and it catches fire? If nobody is in reporting process safety incidents so you can do
the area, there will be no injuries. It may be reportable as an your part to make your plant’s process safety
environmental release or a financial loss, but the incident will have measures useful and meaningful.
no impact on your plant’s injury rate statistics! Yet, we can all Î Read your plant’s process safety reports and
agree that this is a significant process safety incident and we need statistics, and participate in efforts to improve
to monitor the occurrence of events such as this. performance.
Î Because common elements such as safety culture and Î Read the August 2008 CCPS Process Safety
operational discipline affect both process safety and occupational Beacon for more information on measuring
safety performance, you should be concerned about how well your process safety performance (available at
process safety program is performing if your injury rate starts to http://sache.org/beacon/products.asp).
increase. But do not make the mistake of believing that a low Î For engineers and managers, the CCPS report
injury rate proves that your process safety program is effective! above (44 pages) is available in Chinese, English,
Japanese, Portuguese, and Spanish.
You don’t improve what you don’t measure!

Don’t forget about occupational safety! March 2014
The Incident
A Beacon reader recently sent an incident description and thought
it might make a good Beacon topic. In a facility, there was a safety
rule prohibiting wearing jewelry. One worker continued to wear a
ring on his finger. As he got out of a truck, the ring caught on
something and his little finger was amputated.
While the injury was serious and will impact the worker for the
rest of his life, the incident is not a typical Beacon topic because it
was not process related. However, this incident reminds us that we
must pay attention to all aspects of safety, including process safety
and occupational safety. People fall from heights, fall down steps,
cut themselves with sharp objects, are hit by falling objects, and
many other types of incidents that have nothing to do with the
process technology in the facility. These people are hurt and affected
just as much as those injured in process related incidents.
While the Beacon focuses on process related incidents, never

forget that occupational safety is also important. For a safe
workplace, we need to have effective programs for both process and
occupational safety.
The picture is particularly appropriate to the incident described

above. Harold Lloyd performed most of the stunts in this classic film Harold Lloyd hangs above the streets of Los
himself, despite losing a thumb and part of a finger in an accident Angeles in a famous scene from the 1923
while filming a movie four years earlier! silent film comedy classic “Safety Last”

Î Occupational safety focuses on accident prevention through Î Never forget that a safe workplace requires
work systems aimed at minimizing risk of personal injury. that everyone in the facility pay attention to
Î Process safety focuses on prevention and mitigation of fires, both process and occupational safety.
explosions, hazardous material releases, and other potentially Î Recognize that safety culture and attitude,
large incidents associated with the chemistry and physics of the operating discipline, safe work practices, and
manufacturing process. other elements of a good safety program are
Î Process safety incidents have the potential to be very large and essential to success in both process and
affect many people, as well as the environment and property. A occupational safety.
large process safety incident can impact the community outside Î Understand your plant’s process safety and
your plant. occupational safety programs, and your role in
Î Some incidents have both occupational and process safety making them successful.
characteristics. For example, opening a pipe containing a hot Î Actively participate in all of your plant’s
flammable material can injure the pipefitter doing the work, from safety activities and encourage your co-
exposure to the material. It can also result in a fire or explosion. workers to participate as well.
Occupational safety and process safety – you need both!

AIChE © 2014. All rights reserved. Reproduction for non-commercial, educational purposes is encouraged. However, reproduction
for the purpose of resale by anyone other than CCPS is strictly prohibited. Contact us at ccps_beacon@aiche.org or 646-495-1371.
Are we reliving past incidents? February 2014
The short answer to this questions is YES!! In 1993, Dr. Trevor 2007 - Sløvåg, Norway
Kletz, who passed away on October 31, 2013 at the age of 91, wrote a
book titled “Lessons from Disaster: How Organizations Have No
Memory and Accidents Recur.” Twenty years later, this still happens.
A recent article described an incident at a gasoline processing plant
in Norway. A carbon adsorber used for emission control ignited a
flammable atmosphere in the attached tank. Sadly, a very similar
incident occurred at a bulk chemical storage terminal in Savannah,
Georgia, USA in 1995. A thorough literature search would undoubtedly
find more similar incidents. Tank farm after fire
What happened? In both incidents, a carbon adsorber was used to
reduce emission of pollutants from the storage tank. Both facilities Carbon bed adsorber
failed to recognize that adsorbing hydrocarbon vapors generated heat in after fire
the carbon bed. This heat provided the ignition source for the flammable
vapor in the tank vapor space.
Why did it occur? Two design problems were present in both
systems, even though they happened 12 years apart and in different
parts of the world! The systems did not account for the heat generation
from adsorption and did not provide a flame arrester between the tank
and carbon adsorber.
What can you do? 1995 – Georgia, USA

Î Be aware that equipment installed to protect the environment can
create new hazards that must be evaluated by process hazard
analysis and management of change.
Î Keep the stories of past incidents in your plant alive by
discussing them at safety meetings.
Î When incidents occur outside your area or company, review
them and ask “Could something like this happen here?” Don’t
discount incident reports because you don’t handle that specific
material or because the incident happened in a different technology. Tank farm fire
Î Younger and less experienced employees should ask about past
incidents to understand them. If it has happened before, it could
happen again!
Î Share incidents from your plant with others so they do not have
to relive them.
Î For more technical information on the incidents mentioned
above:
• US EPA Report on 1995 incident: www.epa.gov/oem/docs/chem/pdtirept.pdf
• Article on 2007 incident: T. Skjold and K. van Wingerden, Process Safety
Progress 32 (3), pp. 268-276, September 2013. Tank farm after fire
“Those who don't know history are destined to repeat it.”

Edmund Burke, Irish Statesman (1729-1797)
Corrosion Under Insulation (CUI) January 2014
What can happen? 1 2

• A 4-inch (10 cm) pipe containing liquid ammonia leaked
because of extensive corrosion. The quality of the pipe insulation
was poor allowing water to soak into the insulation. The piping
system had been partially inspected during the previous
turnaround, but this particular section of pipe was not examined.
• A 1-inch (2.5 cm) flammable gas feed line ruptured because of
wall thinning of the pipe due to corrosion under the insulation,
causing a gas fire. The pipe which failed was a bypass which was
3
not actually in operation at the time. Because there was no flow
through the line, it was cooler, about 80 degrees C (175 F), than
the main process pipe. The temperature was low enough that
steam or moisture in the air could condense, and liquid water
which contacted the insulated pipe did not evaporate quickly.
This, in combination with damaged insulation, created
conditions which make corrosion more likely.
Do you know?
Î Corrosion Under Insulation (CUI) is corrosion of piping, tanks,
or other equipment which occurs due to water under insulation or
fireproofing. Faulty or damaged insulation is frequently a source of (1) and (2) – Examples of damaged insulation
the water that causes corrosion, and the insulation may also hide the (3) – Corrosion resulting from damaged insulation
damage so you are not aware of it.
Î Literature suggests that CUI may be a concern for equipment service temperatures between minus 4 and 175 deg. C (25 to 350 F).
Î Some common contributors to CUI include:
¾ Water in the insulation, either because of improper storage before installation, improper installation, or damage after installation.
This may be compounded if there is corrosive chemical contamination of water soaked into the insulation – for example, acids
and other process chemicals, or chlorides such as salt from the air near salt water or from de-icing chemicals.
¾ Water or other fluids can flow through certain types of insulation and move away from the source of the leak. CUI may occur in
areas farther from the leak than expected –especially in low spots.
¾ Pinholes or small process leaks from gaskets and fittings underneath insulation, which may remain undetected until the damage
causes a larger leak.
What can you do?

ÎFor process plant construction or maintenance workers:
¾ Make sure that insulation is always installed according to the specified procedures. This includes proper covers and seals on
the insulation, and proper coating or painting of the equipment which is insulated.
¾ If you must remove insulation, be sure to protect the removed insulation until the job is finished and the insulation is properly
re-installed.
¾ When you remove insulation to do a maintenance job, take advantage of the opportunity to look at the equipment under the
insulation. If you see evidence of corrosion, report it to management so experts can inspect the equipment.
Î For process operators:
¾ Look for damage to insulation or other signs of CUI as you work in the plant, and report your observations to management so
damaged insulation can be repaired and the insulated equipment can be inspected if necessary.
¾ When a maintenance job is complete, check the insulation to make sure it has been properly replaced.
Î If you damage any insulation in the course of your work, report it and make sure it is repaired.
Î See the February 2005 Beacon at www.sache.org for another example of CUI. You can also read more about the incidents above
in this journal article: F. De Vogelaere, Process Safety Progress 28 (1), pp. 30-35, March 2009.
Take care of the insulation in your plant to prevent corrosion!

The Beacon is usually available in Arabic, Afrikaans, Chinese, Czech, Danish, Dutch, English, French, German, Greek, Gujarati, Hebrew, Hindi, Hungarian, Italian, Japanese,
Hazards of strong oxidizers December 2013
What happened?
A worker was asked to move two open top 5-gallon pails containing aqueous
sodium permanganate solution from one location to another. When he picked up
the pails, the contents of one of them erupted, spraying the worker with the
solution. Sodium permanganate is a strong oxidizer, and the splashed material set
the worker’s clothing on fire. His injuries required hospital treatment.
The facility where the incident occurred handled both oxidizing agents (such as
sodium permanganate) and reducing materials (for example, sodium thiosulfate
and sodium metabisulfite) in small quantities, sometimes in pails or other small
containers. At times, materials were transported in pails which were not labeled. It
is believed that the pail which erupted contained one of the reducing agents
handled at the facility, and sodium permanganate solution was added to the pail.
The reaction apparently was delayed because the materials were not mixed and the
solid reducing material already in the pail may have formed a protective layer of
relatively non-reactive material on its surface. When the worker lifted the pail, the
material was disturbed and reacted rapidly, ejecting material from the pail. Reconstruction of the incident ↑
Do you know?
Î Oxidizing materials such as sodium permanganate are highly reactive with
many materials. Some oxidizing materials are reactive enough that they can ignite
organic materials (for example, clothing, paper, cardboard, wood, and many
chemicals) on contact and cause a fire.
Î Oxidizing materials are particularly reactive with another type of chemical
called a “reducing agent”, such as sodium thiosulfate or sodium metabisulfite. The
reaction generates a lot of heat and can cause the reaction mixture to boil.
Î The material safety data sheet (MSDS) for a chemical will tell you if it is a The symbol for an oxidizer in the United
Nations “Globally Harmonized System of
strong oxidizing or reducing agent, and warn you about hazardous reactions with Classification and Labeling of Chemicals”
other materials (adopted by US OSHA in May 2012)
What can you do?

Î Read material safety data sheets (MSDS) for the materials in your plant, and be aware of chemical reaction hazards for
your materials. But do not rely only on the MSDS - ask chemists and engineers in your plant about reactivity hazards and
consult your plant’s process safety information files for more reactivity data.
Î Properly store all materials, and keep reactive materials separated from incompatible materials.
Î Avoid handling materials in “temporary” containers used for multiple materials. If this must be done, make sure that
you do a thorough safety review of the operation, always follow the procedures specified by the review, and always use all
of the required personal protective equipment.
Î Clearly label all containers, even those used “temporarily” to store or transport materials.
Î Carefully inspect any container to make sure it is clean before putting anything in it.
Î Review other Beacons on similar incidents (August 2003, July 2006, March 2011, available at www.sache.org).
Î Read a technical analysis of this incident: R. A. Ogle and D. Morrison, Process Safety Progress 30 (2), pp. 148-153,
June 2011.
Do not take “small” operations for granted – even a small amount of material can be
dangerous to somebody close by!
Holiday Operations November 2013
What happens in a process plant over a holiday? Many plants shut down or reduce operations during a holiday period.
Equipment may be in a non-standard condition while processes are on hold or shut down. Even though the plant is shut
down, it is likely that hazardous materials are still present in storage tanks and process vessels. Equipment that is shut
down may be opened for inspection or maintenance. Maintenance and contractor employees may outnumber operating
personnel. After the holiday, processes are re-started, sometimes after having been modified during the shutdown.
Some plants continue to operate during a holiday but with reduced staff, delaying less critical activities to allow
people to spend the holiday with their families. Fewer managers and technical staff may be present to provide oversight
or answer questions.
What can you do?

Î Recognize that process hazards do not take a holiday, Î Remember that storage tanks and process vessels may
and always pay attention to process safety. contain hazardous material, even if the plant is shut down
Î When celebrating holidays, remember your work for the holiday. Routinely check these tanks and vessels.
schedule, make sure you get enough sleep, and be ready Î Don’t hesitate to call managers or engineers as soon as
to work when you arrive at the plant. you suspect a problem. Don’t wait for the problem to
Î Be available when you are required to work a holiday become worse. Even on a holiday, it is their job to help you!
or weekend. Don’t make somebody else work overtime to Î If you have maintenance or inspection contractors
cover for you. This could put a fatigued co-worker more working in your plant during a holiday shutdown, make sure
at risk for an accident or injury. they follow your plant’s contractor safety procedures.
Î Do not forget the processes that are still operating Î Follow proper procedures when starting equipment up
even if they are on hold, such as a distillation column on after a holiday. Make sure that equipment is ready and that
total reflux. Record the required data and keep an eye on pre-startup safety reviews are complete if there was
those operations in case a process deviation occurs. maintenance or modification during the shutdown.
A holiday is a great time to celebrate, but, at work, celebrate safe operation!
Electrical Equipment in Hazardous Areas October 2013
On October 14, 1913, one hundred years ago, the

Senghenydd Colliery in Glamorgan, South Wales
exploded resulting in 439 fatalities. This was the
worst coal mine disaster in the history of the United
Kingdom. The incident is believed to have been
started by methane gas (“firedamp”) ignited by
electric sparks from equipment, possibly an electric
bell signal. The gas explosion disturbed coal dust in
the mine, creating a coal dust cloud that ignited. The
dust explosion raised still more coal dust and the
explosions continued to propagate.
The Senghenydd explosion was one of the events that led to a recognition of the
potential hazard of sparks from electrical equipment igniting a flammable vapor, dust, or
mist cloud. One protective approach is the use of “intrinsically safe equipment.” This is
defined as “equipment and wiring which is incapable of releasing sufficient electrical or
thermal energy under normal or abnormal conditions to cause ignition of a specific
hazardous atmospheric mixture in its most easily ignited concentration.” This is
accomplished by specific design of the electrical equipment - for example by limiting the
amount of power available to electrical equipment in a hazardous area to a level below
that which will ignite the fuel mixture.
While a thorough discussion of electrical safety in a hazardous area is beyond the

scope of the Beacon, there are some important things (see below) that you, as a plant
operator or maintenance worker, can do to maintain the integrity of electrical equipment Monument to the victims of the
in areas which are classified as hazardous. Senghenydd disaster
What can you do?

Î Understand the hazardous areas and electrical Î Be careful when bringing any electric equipment into
classification in your plant. If you have not seen a hazardous area, either yourself or when authorizing
electrical classification drawings for your area, ask for permits to work. Some examples: anything with an
these, and make sure that they are up-to-date. electric motor such as a portable pump, portable
Î Invite your plant electrical classification experts to instruments, flashlights, communications devices, motor
give a safety meeting describing the hazardous areas in vehicles (including fork trucks, lift trucks, etc.). Ask
your plant. Ask them how to recognize electrical safety about anything that must be plugged in or which needs a
issues and problems that you might observe as you work. battery! Be certain that all equipment is acceptable for
Î Focus one of your routine plant safety inspections on use in the specific hazardous area where you intend to
electrical safety. For example, look for damaged wiring use it. If you are not sure, get help from an expert who
or electrical connections, damaged electrical boxes, knows!
problems with gaskets, seals, inadequate air purge for an Î Make sure that electrical safety in hazardous areas is
enclosure, or missing bolts on electrical enclosures. addressed in Management of Change (MOC) reviews.
Understand electrical safety in your plant!
Air Power! September 2013
Air is always all around us, and the oxygen it 1

contains is necessary for life. But, compressed air
(or any other compressed gas) contains a lot of
energy and can cause major damage in case of a
vessel or pipe failure. The pictures show the
consequences of three explosions resulting from
failure during pneumatic pressure testing of pipes
and vessels.
1. A flange failed while pressure testing a 36
inch (~1 meter) diameter pipe at about 1,800
psig (12.41 MPa, or ~125 bar) compressed air
pressure. One person was killed, 15 injured,
and there was significant damage to the
equipment.
2. Pipes connected to a tank were pressure tested 2 3
using compressed air. The tank was isolated
from the pipes by closing valves, and there
was no blind or other positive isolation. A
valve leaked allowing air to pressurize the
tank. It took off like a rocket and landed on
top of the process rack! (See the October 2007
Beacon)
3. In this incident, the compressed gas was
nitrogen (not air), but the consequences of the
explosion are similar. A pipeline failed during
the compressed nitrogen pressure test, killing
one worker and seriously injuring three others.
What can you do?
Î Whenever possible, pressure test equipment using Î Do not rely on valves only to isolate equipment being
water (hydrostatic test) or another non-hazardous liquid. tested from other equipment that is not strong enough to
Water is a non-compressible fluid, and water at a given withstand the test pressure. Provide positive isolation with
pressure contains a lot less energy than a compressed gas blinds or physical disconnection of piping.
such as air. Think about the difference in the sound of Î Use an approved written pressure testing procedure,
bursting a balloon filled with water compared to one filled and follow it rigorously.
with air. The air filled balloon “pops”, but the water filled Î Post warning signs and restrict access to places where
balloon does not make much noise. pressure testing is being done.
Î Before you start a pressure test, think about the Î Make sure that people who are not directly involved in
consequences if a failure occurs. Take precautions so that the test are not allowed in the area for any reason.
people are not at risk during the test. Remember that it is a Î If you must use pressurized gas for a test, do a
test – what happens if the equipment fails the test? thorough safety review before conducting the test.
Think about what could happen if your equipment fails to pass the pressure test!
Can a water pump explode? August 2013
The answer must be “yes” or we wouldn’t have a subject for this Beacon! The centrifugal pumps in the pictures are
all water pumps which exploded. The explosions did not occur because of any contamination or chemical reaction with
something that was not supposed to be in the pump. In fact, explosions like this have happened with very pure water –
boiler feed water pumps, condensate pumps, and deionized water pumps.
How did these explosions happen? The pumps were operated for some period of time with both the pump suction and
discharge valves closed. Because water could not flow through the pump, all of the energy which normally goes into
pumping is instead converted to heat. When water is heated, it expands generating hydrostatic pressure inside the pump.
This may be enough pressure to cause the pump to fail – perhaps the seal would fail, or the pump casing might rupture.
These explosions may cause significant damage or injuries because of the built-up energy. However, if the water
exceeds its boiling point before the pump fails, a more energetic explosion may occur because the released superheated
water will rapidly boil and expand (a boiling liquid expanding vapor explosion - BLEVE). The severity and damage will
be similar to a steam boiler explosion.
This type of explosion can happen with any fluid if a pump is operated with suction and discharge valves closed. If a
non-hazardous fluid like water can result in the damage shown in the pictures, think how much more severe the damage
might be if the fluid is flammable - the released material could catch fire. If the fluid is toxic or corrosive, people near
the pump could be severely injured by the released material.
What can you do?

Î Before starting any pump, check that all valves are in Î Some pumps are started automatically – for example
the correct position. Be sure that the valves in the by a process control computer or a level instrument to
intended flow path are open, and other valves, such as automatically empty a tank when it is filled. Make sure
drains and vents, are closed. that all of the valves are in the correct positions when
Î If you are starting a pump from a remote location such putting these pumps into automatic operation, for
as a control room, be sure that the pump is ready for example, after maintenance.
operation. If you are not sure, go to the pump and check Î Some pumps have instrumentation installed to prevent
it, or have somebody else check it. running while blocked in – for example, low flow, high
Î Make sure that key steps important for safe operation temperature, or high pressure interlocks. Be sure that these
of pumps, including all valve positions, are included in safety systems are properly maintained and tested.
your plant operating procedures and checklists.
See the October 2002 Process Safety Beacon for a similar incident.
Don’t let your pumps run while blocked in!

Remembering Piper Alpha July 2013

This month marks the 25th anniversary of the Piper Alpha
offshore oil platform disaster in the North Sea approximately 110
miles (180 km) from Aberdeen Scotland. On July 6, 1988, a series
of catastrophic explosions and fires destroyed the platform. Of the
226 people on the platform at the time of the event, 165 died along
with two emergency response personnel during a rescue attempt.
The platform was totally destroyed.
Investigation was hindered by a lack of physical evidence.

Based upon eyewitness accounts it was concluded that a release of
light hydrocarbon occurred when a pump was restarted after having
been prepared for maintenance. Unknown to the workers starting
the pump, a relief valve in the pump discharge had been removed
for maintenance. A blank had been loosely installed in place of the
relief valve at a location which was not readily visible from the
pump vicinity. When the pump was started this blank leaked,
producing a flammable cloud, which subsequently found an
ignition source. The pump was started at about 10 PM, and by
1 AM, three hours later, the platform had been entirely destroyed
and most of its occupants had been killed.
As would be expected in a disaster of this magnitude, the

investigation identified many root causes related to design,
operation, safety culture, emergency response, and training. We
highlight two issues below which are particularly relevant to you as
a plant worker.
What can you do?

Î Shift turnover and communications. During shift turnover, the status of the pump work was addressed, but no mention
was made of the relief valve work. The relief valve work was also not mentioned in the control room or maintenance logs.
Continuing problems with the adequacy of turnovers and log entries were a problem known to some workers.
Be complete in documenting the status of all equipment in your plant logs. At the end of your shift, clearly
communicate the information to the incoming workers. Take the time to make sure they fully understand the
status of all operating equipment, and the status of all maintenance jobs.
Î Work Permit System. The work permit system was not consistently implemented according to procedure. For
example, omission of important information such as signatures and gas test results was common. Operations
representatives often did not inspect the job site before suspending the permit at the end of the shift or when closing the
permit indicating the work had been completed. Craft supervisors often left permits on the control room desk at the end of
a shift rather than personally returning them to the responsible operations representative as required by the procedure.
Always follow work permit procedures exactly as required, including all documentation, communication, and
record keeping. Do not take short cuts, and be sure to personally check everything on the permit. Never assume
that things have been done correctly – if you are going to sign the permit, check it yourself.
See the July 2005 Beacon for more on Piper Alpha, and the September 2007 Beacon for another incident related to work permits.
Remember Piper Alpha by taking your turnover and work permit procedures seriously!
Why can’t I open that valve? June 2013

In April 2004, an explosion and fire at a polyvinyl chloride (PVC) plant
killed five people and severely injured three others. The explosion and fire
destroyed most of the reactor building and an adjacent warehouse. Because
smoke from the fire drifted over the community, authorities ordered an
evacuation. The plant was never rebuilt. The United States Chemical Safety
Board (CSB) issued a report and video on the incident:
http://www.csb.gov/formosa-plastics-vinyl-chloride-explosion/
The CSB investigation identified a number of root causes for this

incident, including inadequate consideration of potential human error in the
design and operation of the plant, failure to follow up on recommendations
from a previous incident, reliance on procedures to prevent a major
incident, and inadequate emergency response procedures for a large release
of flammable materials.
This Beacon focuses on the specific event which initiated the incident,
which is something that you, as a plant operator or maintenance worker,
can impact directly. The plant had 24 essentially identical batch polyvinyl
chloride reactors. At the end of a batch, the reactor was purged of
flammable and toxic vapors and cleaned with water. The water was then emptied to open sewer drains on the floor below
the reactor. It is believed that the incident was initiated when an operator intended to drain water from a reactor which
had been cleaned. However the operator went to the wrong reactor – a reactor which was in the reaction stage. The
reaction mixture, at an estimated pressure of 70 psig, contained flammable vinyl chloride. The operator was not able to
open the pneumatic valve on the bottom of the reactor – there was a safety interlock which prevented opening the valve
while the reactor was under pressure. It is believed that the operator connected a nearby air supply to the valve and forced
it to open, releasing reaction mixture into the building. Flammable vapors from the released material ignited.
What can you do?

Î If you try to operate a pneumatic or electric valve (open or close it), and it will not operate, stop and think. Perhaps
there is a good reason why the valve will not operate. For example:
• Maybe you are trying to operate the wrong valve!
• The valve may be prevented from operating because of a safety interlock.
• The valve may be locked out or de-energized because of some kind of maintenance work or other activity
that requires equipment isolation or lockout.
ÎNever force a valve to operate directly by connecting the actuator to air or another type of power supply if the valve
will not operate by its normal control system.
Î If a valve will not open, and it has a bypass around it, do not use the bypass to establish flow until you understand why
the valve won’t open.
Î Contact your management and engineers and get help in investigating the reason that you are not able to operate the
valve. Do not take any action until everybody understands why the valve will not operate.
Î Do the same for any piece of equipment which you cannot operate – a pump or agitator that you can’t start or stop, or
any other piece of equipment which you cannot operate. Understand why, and never force equipment to operate.
Î Watch the CSB video on this incident to understand all of the root causes and lessons.
If you can’t open a valve, don’t force it – find out why!
Pressure relief valve bonnets - to plug or not to plug? May 2013
The left photograph and diagram BONNET

VENT PLUGGED
show a conventional spring loaded DESPITE
WARNING SIGN
pressure relief valve. There may be a
vent in the bonnet of the relief valve as
shown in the diagram at bottom left. If
the vent is present, it is normally
supposed to be plugged when the valve is
in service.
The photograph and diagram on the

right show a different kind of pressure
relief valve – a balanced bellows
pressure relief valve. This valve has a SET PRESSURE
bellows between the process and the ADJUSTING SCREW
valve bonnet. The bellows (when the BONNET BONNET

bonnet is vented to atmosphere) prevents SPRING VENT – VENT - NOT
PLUGGED IF
back pressure from assisting the spring in PRESENT
PLUGGED
BONNET
keeping the relief valve closed, and also
protects the spring from corrosion. Note
that it may be difficult to tell what kind BODY
of relief valve is installed from the
BELLOWS
external appearance of the relief valve. SEAT DISC
A balanced bellows relief valve may

be used when the relief valve discharges
to a collection header instead of directly
to the atmosphere. In a conventional NOZZLE
relief valve, the bonnet pressure is equal
to the downstream pressure, while in a CONVENTIONAL BALANCED BELLOWS
properly vented balanced bellows relief
valve the bonnet pressure is atmospheric What can you do?
pressure. For the valve to function as  Understand what kind of pressure relief valves you have in your
designed, the bonnet of a balanced plant, and know what you must do to ensure that they work properly.
bellows relief valve must be vented to  Ask if you have balanced bellows pressure relief valves in your
atmospheric pressure - the vent must not plant. If so, make sure they are clearly identified, and post signs near the
be plugged. It must also vent to a safe valves to remind people that the vent on the valve bonnet must not be
place. Note that, in spite of a warning plugged. Signs may be the only clear indication of the type of valve to
sign, there is a plug in the vent of the plant operators and maintenance workers, so the signs must be kept in
balanced bellows relief valve in the place and visible.
picture at top right (red arrow).  If you see a balanced bellows relief valve with the vent plugged,
report it so that it can be corrected.
Understand your plant relief valves!

Have you heard a pressure relief valve chatter? April 2013
In the November 2012 Beacon many readers

correctly identified one safety issue with the relief
valve in the picture at left – potentially closing a
block valve, isolating the relief valve so it cannot
provide protection against excess pressure. A
second possible problem, a piping system which
may cause the relief valve to chatter, was not
identified by nearly as many people. a b
What is “chattering”?
Chattering is the rapid opening and closing of a
pressure relief valve. The resulting vibration may
cause misalignment, valve seat damage and, if
prolonged, can cause mechanical failure of valve
internals and associated piping.
Why does a relief valve chatter? c d

Some causes of chattering include excessive
inlet pressure drop, excessive back pressure, an oversized relief valve, and a relief valve which must handle widely varying
flow rates. We will explain the first of these in more detail.
Look at the picture above on the right. Under normal process conditions the vessel pressure is below the set pressure of
the relief valve, and the pressure at the relief valve is the same as the vessel pressure (a). If a process upset increases the
vessel pressure, the pressure at the relief valve increases by the same amount, and if the pressure exceeds the relief valve
set pressure the valve opens (b). As soon as the valve opens, flow begins through the pipe to the relief valve, and the flow
results in a pressure drop between the vessel and the valve. If this pressure drop is large enough, the pressure at the relief
valve can be low enough that the relief valve closes (c). The flow stops, the pressure at the relief valve increases back to
the vessel pressure because there is no flow to cause pressure drop, and the relief valve opens again (d)! This happens over
and over, and can be very rapid, causing vibration and damage to the relief valve, pipes, and equipment.
What can you do?

Î If you observe a relief valve chattering, inform somebody
qualified to identify and correct the problem.
Î Look for potential problems in relief valve piping design, and ask
an engineer to determine if they could cause relief valve chattering.
Some things to look for:
• Inlet pipe to a relief valve which is smaller than the valve inlet (see
picture at right)
• Many valves, fittings, and other obstructions between a process
vessel and a relief valve, as in the picture above
• A very long pipe between a vessel and relief valve, or piping with
a lot of bends Pipe smaller than
• Evidence of line plugging from corrosion or process materials relief valve inlet
observed when removing a relief valve for maintenance
Don’t let your relief valves chatter!

The Beacon is usually available in Arabic, Afrikaans, Chinese, Czech, Danish, Dutch, English, French, German, Greek, Gujarati, Hebrew, Hungarian, Italian, Japanese,
Are your signs and labels confusing? March 2013

The picture at the right, from the November 2012 “Find the
Problem” Beacon contest, shows a group of pumps which look
exactly the same. In the picture they do not appear to be labeled
in any visible way. If you were told that one of the pumps had
been prepared for mechanical work, how would you be sure you
were working on the right pump?
Lack of labeling can be a safety problem, and poor or
confusing labels or information signs can be even worse. The
pictures below are examples of confusing labels or signs taken
from process plants and everyday life . Do you have confusing
signs or labels in your plant?
Similar labels on these
pipes contributed to
unloading the wrong
material into a storage
tank. A chemical reaction
START STOP resulted, releasing a
toxic gas which injured 6
people. See the April
2012 Beacon.
What can you do?

Î Look for unlabeled equipment, missing labels, or
damaged labels which you can not read. Repair the labels
if you are able to do so, or report it to somebody who can
fix the problem.
Î Look for confusing labels or signs, like some of those
in the pictures, and have them fixed.
Î Make sure that the labeling and identification of
equipment in the plant is the same as the identification
used in operating procedures, maintenance procedures,
emergency procedures, and other plant documents.
Î Don’t create confusion by modifying labels using hand
written notes or other temporary labels. If a label needs to
be corrected, use a proper label, and consider doing a
management of change review.
Î Be consistent in using names or acronyms for
chemicals in your plant. For example, “MMA” can mean
“Methyl Methacrylate” in one plant, “Monomethylamine”
in a different plant, and perhaps something completely
different in another plant. Always use the correct
chemical name for a material. Be sure that everybody in
your plant knows what the labels mean!
Use clear labels and signs for safety!

The Beacon is usually available in Arabic, Afrikaans, Chinese, Danish, Dutch, English, French, German, Greek, Gujarati, Hebrew, Hungarian, Italian, Japanese, Korean,
What is supporting your equipment? February 2013

You will recognize Picture 1 from the November 2012 and
January 2013 issues of the Beacon. It is an obvious example of badly 1 2
supported piping. But sometimes problems with inadequate support
of piping and other equipment are not so easy to see.
Picture 2– The steel supporting the pipes has bent, possibly
because the weight of the pipes is more than the steel can support.
Perhaps this was a result of a change – was a second pipe added
without considering the design of the supporting steel?
Picture 3 – The pipe has moved horizontally and the pipe support
stand has moved out of the support shoe.
Picture 4 – Look closely – the steel supports are not touching the 3
ground. They are hanging from the pipes rather than supporting them!
Picture 5 – Somebody has cut out a section of the structural steel to
make room for a valve!
Pipes and equipment which are not properly supported will be
subject to stress, vibration, or other problems. This can cause leaks,
or even a complete collapse of piping or equipment.
As you work in your plant, look for problems with poorly
supported equipment, excessive vibration, or other issues. A good
general rule - if it doesn't look like it did on the day it was installed,
there might be a problem! Report problems to your management, and
follow up to make sure the problems are corrected.
4 5
Support your pipes and equipment!

The Beacon is usually available in Arabic, Afrikaans, Chinese, Danish, Dutch, English, French, German, Greek, Gujarati, Hebrew, Italian, Japanese, Korean, Malay, Marathi,
Norwegian, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
Some Answers to the November 2012 Beacon “Find the Problem” Contest January 2013
First of all, thank you to everybody who participated in the Relief
November 2012 “Find the Problem” contest. We thank you for 1 2 valve
your interest, and, for those of you who also participated in the
survey, for your valuable feedback on the Beacon. This Beacon
needed to be prepared for publication and translation before all of
the contest entries were submitted, so we were not able to include
additional problems and hazards that have been undoubtedly Pressure!
identified by our tens of thousands of readers. Be assured that we
were quite liberal in determining “correct” answers and accepted
many other real problems beyond the ones listed here. Here are
some of the issues we identified:
Rupture disk
1. This is an easy one! Piping support is extremely poor!
2. The pressure between the rupture disk and the relief valve
compromises the integrity of the emergency pressure relief 4 5
system. Rupture disks burst when the difference between the
upstream pressure and the downstream pressure exceeds the
rupture pressure. If there is pressure downstream of the disk,
it will not burst at the intended process pressure.
3. Despite the warning sign, the plug in the bonnet of this 3 6
bellows sealed safety valve (which protects the valve during
shipping) has not been removed. This will affect the pressure Shipping plug
left in vent
at which the valve opens.
4. Flexible hoses are being used to connect piping which does
not fit together properly. Also, the flange on the right appears Warning sign
to be missing at least one bolt and the faces of the flange do

not align properly.
5. All of these pumps are identical in appearance and there is no
evidence of any labeling.
6. The valves and other pipe fittings on the inlet of the relief
valve (RV) result in greater inlet pressure drop, which could
cause relief valve chattering. The block valve on the RV inlet
does not appear to have anything to prevent closing it and
isolating the RV from the process.
7. There are many hazards in this photograph. Here are some of 7 1
them, (you may find others!): (1) no visible label on the
storage tank; (2) no eye wash or safety shower in the area;
(3) the person in the picture is not wearing any personal 36% HCl 11
3
protective equipment; (4) no chocks at tank truck wheels; (5) 10
2
no visible spill containment; (6) many tripping hazards (and 12
slipping hazards from the snow); (7) little or nothing to

prevent backing the truck into the shed and unloading piping;
9
(8) inadequate platform to access the unloading connection;
(9) no way to drain the hose when unloading is complete; 8
6
(10) no pressure gages anywhere on the unloading piping; 4 5
(11) the valve handle downstream of the pump is too high; 7
(12) the unloading piping is poorly supported.
Constant vigilance is the key to safety!

Norwegian, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, and Vietnamese.
Good Housekeeping for Safety! December 2012
A fire started in a fiber trash drum in a Fire damage in

the process area
process building. The drum contained solder
flux and paste, welding debris, general trash,
and oil soaked rags. It had not been emptied for
a long time. The ignition source may have been
hot welding debris or spontaneous combustion
of the oil soaked trash.
The trash drum fire got much worse. Some
of the process equipment, pipes, structural steel, and floors were coated with dried polymer from Remains of
trash drum
previous spills. The fire spread from the trash drum to the accumulated spilled polymer. A much
larger fire resulted, which did significant damage to the building, process equipment, instruments,
and control equipment. Although no one was injured, the plant was shut down for an extended
period of time, and the damage was several hundred thousand dollars.
Why did it happen?
Dried emulsion polymer on
Î Poor housekeeping contributed to this incident for plant structure and pipes
two reasons:
- The initial fire started in a fiber drum being
improperly used for trash and debris from
construction and maintenance. The drum was not
emptied regularly.
- The fire grew much larger because of
accumulated polymer on piping, equipment, and the
building structure. This accumulated combustible
solid material was the fuel which made the fire much
worse.
Î The accumulated polymer came from leaks of an
aqueous polymer emulsion due to process equipment
problems. What can you do?
Î The operating personnel in the plant gave up on
trying to keep the plant clean because the repeated Î Remove all maintenance debris from the work area immediately and
leaks made this a hopeless task. disposed of it properly. The job is not finished until you clean up!
Î The leakage of polymer was an equipment design Î Dispose of oil or chemical soaked rags and paper properly (metal
issue beyond the control of operating personnel. This containers, separated from potential ignition sources, not in process
was an engineering design problem which needed areas).
management and engineering attention. Î Put general trash in proper containers and empty the containers
Î Perhaps the culture in which a dirty plant had become regularly.
“normal” was a factor in making it acceptable to put Î Keep process areas clean. Any combustible material, including
trash and maintenance debris in a fiber drum and to combustible dust, that accumulates on equipment, floors, cable trays,
not empty the trash drum regularly. or structural steel is fuel which could make a fire much larger!
Î This kind of situation is called “normalization of Î Do not accept a situation where equipment problems result in leaks
deviation” when discussing process safety culture. which make it difficult or impossible to keep process areas clean.
This is just a fancy term for giving up on changing an Remind your management of a potentially dangerous situation, and
unacceptable situation and accepting it as normal. work with them to resolve the problem.
A clean plant is a safer plant!

The Beacon is usually available in Arabic, Afrikaans, Chinese, Danish, Dutch, English, French, German, Greek, Gujarati, Hebrew, Hindi, Italian, Japanese, Korean, Malay,
Marathi, Norwegian, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, and Vietnamese.
www.aiche.org/ccps Messages for Manufacturing Personnel http://www.chilworthglobal.com/en/
Can you find the safety problem? November 2012

We are finishing our celebration of 10 years of the
2 Relief
Process Safety Beacon with a “Find the Problem” contest. 1 valve
Look at the pictures in this Beacon and identify as many
hazardous situations (problems) as you can. There is at least
one unique safety problem in Pictures 1 through 6, and
Picture 7 has more than 10 (identify at least 6 to qualify as a
contest winner). Not all are “process hazards” – you will
find things like tripping hazards. We will select three
winners at random from correct responses, and winners will
receive a free CCPS book of their choice, subject to
availability. Responses must be received by Midnight US
Eastern Time on Nov. 30, 2012 to be eligible for the prizes.
Complete rules, and a form to submit answers, can be
found at http://www.aiche.org/ccps/beaconcontest. Our
answers will appear in the January 2013 Beacon. You will
also be asked to participate in a short survey to help us
understand how the Beacon is being used, so we can better
serve our readers. We realize that some of the pictures are Rupture disk
small in this Beacon, so you will also find bigger pictures
on line at the contest web address.
5
Bellows sealed
3 pressure relief
4
valve
6 Relief 36%
valve hydrochloric
acid
Protected
process
equipment
Always be alert and look for hazardous situations!

Manage Temporary Changes! October 2012
A filter on the suction of a pump frequently plugged. Because of

this, the pressure needed to be monitored, both in the field and at the
control panel. To minimize installation time for a pressure transmitter,
it was decided to install a tap on the existing connection for the local
pressure gauge and connect a pressure transmitter to this tap. Because
of the rush and the temporary nature of the change, it was decided to
use tubing for the change. The installation, though accepted as a
temporary installation, did not follow appropriate design codes or
engineering standards, and no management of change review was done.
Approximately three years later, the tubing ruptured and
combustible material at a temperature of 360° C leaked to the
atmosphere. The leaking material ignited and started a major fire which
destroyed the plant.
Why did it happen? What can you do?

Î The temporary installation did not follow appropriate Î Follow your plant’s Management of Change procedure
engineering design standards. for all modifications of piping, equipment, and procedures.
Î The piping and the temporary installation were subject Î Remember that temporary modifications require the
to vibration caused by the pump. same thorough analysis as permanent changes.
Î The pressure gauge installed at the end of the tubing Î Never make changes to piping or equipment without
acted as a pendulum. Tubing does not have adequate review by qualified experts to assure that the change
mechanical strength to withstand vibration and to support follows engineering standards and good practice.
instrumentation, such as the pressure transmitter. Î Follow recommendations from the manufacturer of
Î After the cause of the plugging filters on the suction your equipment.
pipe of the pump was eliminated, the temporary Î If “temporary” modifications are made to a plant, they
installation and the pressure transmitter were not needed, should have an “expiration date”, and be removed before
but were never removed. that date. You should do another management of change
Î As a “temporary” installation, the pressure gauge may review for removal of the temporary installation. Don’t let
not have received attention, inspection, and maintenance, a temporary change become permanent without review!
particularly after it was no longer needed. It may just have Î If you see equipment in your plant which is no longer
been forgotten! used or needed, suggest that it be removed!
This incident has several things in common with the June 1974 The 1974 Flixborough explosion
explosion in Flixborough, England (June 2004 Process Safety
Beacon). The Flixborough explosion killed 28 workers, injured 36,
and had a major impact on process safety management systems
and regulations throughout the world. The pipe which failed at
Flixborough was much larger, but some common characteristics
of this incident and the Flixborough explosion include:
• A management of change review was not done for a
temporary piping modification.
• The temporary piping did not follow appropriate engineering
standards, and the piping was not properly supported.
• Stress on temporary piping was one factor in the failure.
Use your Management of Change process for “temporary” changes!

What can I do? I’m just the operator! September 2012

A frequent comment from workers is, “What can I do to improve safety
of our processes? I am just the operator (or technician, mechanic, etc.). I
just turn valves, operate the equipment, take samples, turn wrenches, adjust
the equipment.” It is true that operators and maintenance people can’t
change the chemistry, redesign equipment, or change materials of
construction. However, they have the best view of the process. They know
how it behaves, how equipment fails, and under what conditions the process
runs best.
Yogi Berra was a baseball player who said, “You can observe a lot just
by watching.” That is true of process safety! You can learn a lot by looking
and listening. Unusual sounds may indicate an impending equipment
problem. A dirty or wet spot on the floor or piping may warn of a small leak.
We all know equipment problems and leaks do not fix themselves. Report
what you see, write a repair order, or tell your supervisor.
The pictures show examples of problems you might observe in your Could you open or
close this rusty valve?
plant.
The dust on this motor A rusty, leaking pipe! What can you do?
provides fuel for a fire and may
be a dust explosion hazard!
Î Understand your process and
equipment. Know how it is supposed to
work, and how to recognize when it is
not working properly.
Î Be alert to things that are different –
noises, smells, drips, leaks, vibration. If
something doesn’t seem right, tell
somebody!
Is something leaking from this flange? Bolts missing from a flange. Î Fill out inspection sheets accurately.
Even if a problem has been on the sheet
for months, make sure it is noted again
and point out to your supervisor how
long it has been a problem.
Î Promptly report safety concerns – for
example, missing guards, bolts, or pipe
hangers can cause serious injury or lead
to an injury, spill, fire, or even a major
catastrophe.
Î Use crew meetings and safety
Å Look meetings to raise safety concerns, and
for
electrical listen when others voice their concerns.
and Î Do your part. For example, when
wiring
problems.
asked to review operating procedures or
proposed changes, do it like your life
depends on it. IT MAY!
Process safety depends on everybody!

Hot Work Hazards! August 2012

A contract welder and a foreman were repairing an agitator support on
Tank top and agitator top of an atmospheric pressure storage tank containing a polyvinyl fluoride
slurry, with a flammable concentration of vinyl fluoride in the vapor space.
An explosion killed the welder, injured the foreman, and blew most of the
top off of the tank, leaving the agitator hanging over the tank side. The US
Chemical Safety Board (CSB) investigated the incident and determined that
vinyl fluoride vapor from connected process tanks leaked undetected into
the storage tank and ignited while the welder was working.
The CSB report noted that, in February 2010, it had issued a “Hot Work
Safety Bulletin” reviewing 11 similar fatal incidents. All of these incidents
are examples of improperly monitored hot work activities involving
flammable conditions inside a container. In April 2012, the CSB released
its report on this incident, along with a safety video (available from
www.csb.gov) describing what happened. A few weeks later, in May 2012,
the CSB sent a team to El Dorado, Arkansas to investigate another fatal hot
work incident!
 Hot work is any work that can be a source of  Understand procedures and permit requirements for safe
ignition when flammable material is present, or which hot work in your facility.
can be a direct fire hazard even if flammable material is  Understand the hazards of your process. Know what has to
not present. be done to prepare the work area for safe hot work and be sure
 Here are some examples of hot work: welding, it is done before you start.
soldering, cutting metals, brazing, grinding, drilling.  Anticipate how far sparks or heat can travel or be
 Most countries have regulations requiring safety conducted. Be prepared if work area conditions change.
permits for hot work.  Make sure that any activities required during the hot work
 There are industry standards from groups such as (for example, monitoring for flammable vapors, maintaining
the National Fire Protection Association (NFPA), the purges) are actually done.
American Welding Society, the American Petroleum  If you do hot work, make sure you understand everything
Institute (API), and others, which describe safe required for you to do each specific job safely, and follow
procedures for hot work. these safety requirements.
 If your job requires that you issue hot work permits,
you must be properly trained on your plant requirements
and procedures before you can issue any hot work Another hot
permits. work incident
 Many hot work incidents occur because the presence in 2006 blew
of flammable material was not anticipated. Flammable the top off of
vapors flowed into the area or equipment where the an oil tank,
work was being done by a route which had not been and the CSB
expected. issued an
 Insufficient flammable vapor monitoring of the investigation
atmosphere in vessels or other equipment, or in the report in 2007.
general work area, is also a frequent contributing cause 
to hot work incidents.
Why do we keep having the same accidents again?

Emergency Preparation – The Titanic Disaster July 2012
April 15, 2012 marked the 100th anniversary of the loss of the
ocean liner Titanic in the North Atlantic Ocean, approximately 2½
hours after hitting an iceberg. Over 1,500 people died in the most
famous maritime disaster in history. Thousands of pages have been
written about the loss of the Titanic, as well as many documentary and
fictional movies produced. Many focus on the construction of the ship
and the actions of its captain and crew. Whatever the construction and
operating issues, attention to one particular issue could have saved
many lives – Emergency Preparation!
Some specific failures in emergency preparedness before the
sinking of the Titanic included:
• Not enough lifeboats for all passengers and crew, perhaps because
the builders considered the ship “unsinkable”!
• No lifeboat drills had been conducted, and many people did not
know where to go or what to do.
• Many of the first lifeboats to leave the Titanic were not full and
some occupants were reluctant to pull other people from the icy
water for fear of capsizing their lifeboat.
• The decision to abandon ship was delayed while the captain and
crew assessed damage. Had the captain started evacuation earlier,
before people began to panic, more lifeboats may have been filled
in a more orderly evacuation.
What can you do?
Î Process plants may conduct many types of emergency drills. Fire, leak or spill
response, shelter-in-place, evacuation, and severe weather are some common
types. Be aware of your responsibility in each situation – it may be different.
Î In a drill or actual emergency, watch for others who may not remember what
they should do, especially new employees, visitors and contractors. Help them to
respond safely.
Î Promptly report any problem you observe during a drill or emergency to your
supervisor. Some examples – actions which cannot be done in the available time,
things you can’t do safely because of the emergency condition, exit signs that can’t
be seen or are confusing, emergency alarms or speakers that can’t be heard,
required safety equipment which is not available or not working properly. Report
your observations - it may save a life some day.
Î Take drills seriously and remind others that they should as well. Don’t think of
drills as a time to see people from other units and let the drill become a social
event.
Î When you read about incidents in other industries, ask yourself if there is
anything you can learn from what happened to make your plant safer!
Î Don’t let your plant “sink” due to a poor emergency plan or lack of knowledge
of how to respond.
Not all Process Safety lessons come from our industry!

www.aiche.org/ccps Messages for Manufacturing Personnel www.fauske.com
Nitrogen – Hazard and Safeguard! June 2012
This Beacon is not focused on a single incident, but on incidents that continue
to occur across industry – nitrogen asphyxiation. A June 2003 United States
Chemical Safety Board (CSB) bulletin reported nitrogen asphyxiation incidents
in US industry resulting in 80 deaths from 1992 to 2002. These incidents
occurred in many different workplaces – industrial plants, laboratories, and
medical facilities. Many of the incidents involved contractors. The pictures are
some examples of the kind of places where a dangerous concentration of
nitrogen could accumulate, taken from CSB reports.
While nitrogen itself is not toxic, a high nitrogen concentration in the air you
breathe will starve your body of the oxygen needed to sustain life. 78% of the air
we normally breathe is nitrogen, and oxygen makes up most of the rest. People
cannot function well when the nitrogen concentration is more than 84% (16%
oxygen). Your judgment may be impaired and you may not recognize that you
are in danger! At 94% nitrogen concentration, death is likely in a few breaths.
On the positive side, nitrogen is an inert gas which reduces fire potential by
eliminating the oxygen required for a fire. For this reason nitrogen is commonly
used to purge piping and equipment used in flammable material service.
Effects of Oxygen Deficiency on the Human Body *

% Oxygen Effect
20.9 Normal
19.5 Legal minimum concentration for humans (US OSHA)
15–19.5 Decreased ability to work; early symptoms in persons with
heart, lung, or circulatory problems
12–15 Increased pulse rate and respiration, impaired judgment
10–12 Further increase in pulse and respiration, giddiness, poor
judgment, blue lips
8–10 Mental failure, nausea, fainting, vomiting, unconsciousness
6–8 8 minutes - 100% fatalities; 6 minutes - 50% fatalities
* P. Yanisko and D.Kroll, “Use Nitrogen Less Coma in 40 seconds, convulsions, breathing stops, death
Safely”, Chemical Engineering Progress, than 6
March 2012, p. 44-48..
What can you do?

Î Know where nitrogen gas is vented. It should be outdoors or to a system designed to safely receive nitrogen.
Î Where nitrogen is used, consider monitoring the oxygen concentration in the area to ensure it does not drop below safe levels.
Î Know where nitrogen is used in your plant, and make sure that all nitrogen pipes are clearly labeled.
Î Inspect hoses used in nitrogen service as you would any hose containing toxic gas. Do not use a hose found to be leaking.
Î Never assume the oxygen concentration in a vessel or any other confined space is acceptable. Always measure it before
working near a vessel opening or inside any confined space.
Î Make sure that the ventilation systems in your plant are working correctly. They are not just for comfort – they also remove
potentially hazardous air contaminants.
Î Recognize that a confined space can be created by temporary obstructions such as plastic or canvas tarps or other temporary
weather protection enclosures.
Î Read the US Chemical Safety Board bulletin on nitrogen asphyxiation, available from www.csb.gov.
Be aware of nitrogen and other inert gas hazards!

Mechanical Integrity of Tubing May 2012
Proper installation, maintenance, and inspection of metal tubing is important in

preventing fires and toxic material releases in process plants. Don’t forget about
tubing just because it is usually small. Even a small leak can cause a fire which
can grow much larger, and small releases of toxic materials can be dangerous.
Here are some reported incidents.
• A ½-inch stainless steel tube between a glycol pump and a process vessel
failed at a fitting near the process vessel. The resulting leak sprayed onto a
reboiler and ignited causing significant equipment damage. The tubing failure
was concluded to be the result of vibration caused by the glycol pump.
• A 1-inch stainless steel supply tube to a gas scrubber failed at a nut and ferrule
compression fitting. The resulting gas leak ignited but self-extinguished
without major damage. The exact cause of the tubing failure was not
determined, but pressure charts indicated that there had been an over-pressure
excursion before the
incident. Also, the tubing
could have been damaged
or weakened during
storms in the previous
hurricane season.
• During startup of an LNG
plant, a gas leak from ½-
inch tubing for a pump
seal was detected. Repairs
were done by a technician
who had not been properly
trained. When the plant
was re-started, the tubing
failed completely causing
an LNG leak and fire.
Note: The pictures are examples of tubing failures and are not from the incidents described.
What can you do?

 Review your plant procedures for installation, inspection, and maintenance of tubing.
 Remember that tubing may not be as durable as pipe and may be more easily damaged. Avoid impacts to tubing and
tubing connections.
 Report any damaged or leaking tubing which you observe in your plant and follow up to ensure it is repaired.
 Be aware that the installation and repair of tubing must be done by a qualified and properly trained technician.
 Use the proper tools and procedures, including for bending and crimping, for installation and maintenance of tubing.
 Use the correct components – tubing, ferrules, nuts, and fittings. Do not mix components from different
manufacturers.
 Ask the supplier of your tubing and tubing fittings to provide information on proper installation and maintenance of
their product.
Don’t forget tubing in your mechanical integrity programs!

What if you unload the wrong material into a tank? April 2012
1 2 A delivery truck arrived at a plant with a

solution of nickel nitrate and phosphoric acid,
named “Chemfos 700” by the supplier. A plant
employee directed the truck driver to the unloading
location, and sent a pipefitter to help unload. The
pipefitter opened a panel containing 6 pipe
connections (Picture 1), each to a different storage
tank. Each unloading connection was labeled with
the plant’s name for the material stored in the tank.
The truck driver told the pipefitter that he was
delivering Chemfos 700.
Unfortunately, the pipefitter connected the truck
3 unloading hose to the pipe adjacent to the Chemfos
700 pipe, labeled “Chemfos Liq. Add.” (Picture 2).
The “Chemfos Liq. Add.” tank contained a solution
of sodium nitrite. Sodium nitrite reacts with
Chemfos 700 to produce nitric oxide and nitrogen
dioxide, both toxic gases. Minutes after unloading
began, an orange cloud was seen near the storage
tank (Picture 3). Unloading was stopped
immediately, but gas continued to be released.
2,400 people were evacuated, and 600 residents
were told to shelter in place. 6 people were treated
for injuries from breathing toxic gas, and the cost
was nearly $200,000.
Why did this happen? What can you do?

This incident was investigated by the United States National Î Know about any hazardous reactions which can occur if
Transportation Safety Board (Accident No. DCA99MZ003, materials in your plant are accidentally mixed.
November 19, 1998). Some contributing causes included: Î When unloading materials from a shipping container,
Î The piping connections and hose couplings were identical, check, then double check, to make sure it contains the
and the pipe labels were similar. material you think it does, and that it is connected to the
Î Unloading procedures had been changed, and the pipefitter correct storage tank.
had not been trained on the modifications. Î Make sure unloading pipe connections are clearly
Î The pipefitter was not aware of existing written procedures. labeled, including the use of a code or numbering system to
Î Nobody double checked that the truck was connected to the avoid confusion of materials with similar names.
correct pipe before starting to unload. Î If materials which can react hazardously are unloaded in
the same area, or unloading locations are confusing, inform
Some additional concerns, not specifically mentioned in the management and suggest how this could be improved. For
investigation report, include: example, you could separate unloading locations, use
Î Two materials with very similar names reacted to release a different types of unloading connections, or use special valve
toxic gas when mixed. locking systems to make improper connection more difficult.
Î Materials which can react to form a toxic gas were Î Ensure that unloading is done by trained and qualified
unloaded in the same area. workers, and manage any change in procedures.
Be sure you unload the right material to the right place!

Norwegian, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, and Thai.
Double Block and Bleed March 2012

The December 2011 Beacon described an incident where a missing plug on a vent line
Vent to
resulted in a flammable material leak which caught fire, causing a fatality. That incident
a SAFE
3
CLOSED reminded us of the importance of caps and plugs on process vent lines and drains. How-
location ever, sometimes vents or drains should not be capped or plugged. Some (but not all!) uses
of a “double block and bleed” isolation system may be examples. For example, the vent on
1 2
a double block and bleed used to stop material flow by a safety shutdown system most
likely needs to be open when the plant is in operation. But, be careful – sometimes the
bleed from a double block and bleed should be capped or plugged. This may be the case
Fluid for a double block and bleed used only to isolate equipment for maintenance, which may
Supply Process only be open during maintenance isolation. Understand your application and how to
operate it correctly!
Vessel
How does a double block and bleed work?
OPEN
A double block and bleed is often used for a more positive isolation of a process fluid
from other equipment. It normally consists of two block valves (Valves 1 and 2 in the
1. Double Block and Bleed valves pictures) and a bleed valve (Valve 3) to a safe location, consistent with local environ-
set for feeding fluid mental regulations. When the process fluid is feeding the downstream equipment, the
valves are set as shown in Picture 1, with the isolation valves 1 and 2 open, and the bleed
Vent to valve 3 closed. When the downstream equipment is to be isolated from the process fluid,
a SAFE 3 OPEN the valves are set as shown in Picture 2, with isolation valves 1 and 2 closed, and bleed
location valve 3 open. If isolation valve 1 leaks, or is accidently opened, the fluid will be prevented
from flowing to the downstream equipment by the second isolation valve 2. There will be
1 2 no pressure accumulation between the two isolation valves because leaking or trapped
material will flow to “a safe place” through the bleed valve 3.
When might it be used?
Fluid
Some uses of double block and bleed include:
Supply Process • In some automatic shutdown systems, to stop material flow, such as in some fuel gas
Vessel systems for burners.
• To provide isolation of hazardous material, temperature, or pressure during equipment
CLOSED maintenance or temporary shutdown.
• To isolate steam heat from a batch process where it is required in some steps, but heating
2. Double Block and Bleed valves
can be hazardous in other process steps.
set for isolating fluid
• To isolate process material feeds which are required for some operations but which can
be hazardous if fed during other operations.
What can you do?

 Know about any double block and bleed valve sets in your plant, and make sure you know when the bleeds should be open
and when they should be closed or plugged for each installation (it may be different for different services).
 Understand how to properly operate a manual double block and bleed system – close and open valves in the right order.
Know whether the bleed should be closed or plugged, or left open, for each double block and bleed installation.
 For an automatic safety shutdown system, the bleed is often not plugged, but check with your plant engineers to be sure.
 Know what may be vented through the bleed, and be sure that it vents to a safe place. Your plant engineers will have to
determine what “a safe place” is, depending on what the fluid is, and on its temperature and pressure. If you have a concern, ask
your plant management to confirm that material released from the bleed will be safely vented.
 Recognize that valve manufacturers supply double block and bleed systems as a single assembly which incorporates all
three valves, and be aware of any such installations in your plant. These prefabricated valve sets may look different from other
double block and bleed installations in your plant.
Know how to properly use your double block and bleed systems!
Norwegian, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, and Thai.
Mechanical Integrity – The Bolts Are Too Short! February 2012
The pictures show improperly bolted flanges that a

…or they aren’t all there! plant found during safety inspections. In the top
pictures, some or all of the bolts are too short, and the
nuts are not completely on the bolts. This means that
the joint may not be as strong as it should be. Flanges
are designed so that the entire nut-bolt combination
holds the forces on the flange. If the nut is only
partially screwed onto the bolt, the connection may
not be strong enough.
In the picture to the left, two of the four bolts are
missing. This flange will only be about half as strong
as the piping designer intended!
What can you do?

 If your job includes putting equipment together, assembling flanged pipe, bolting manhole covers or other
bolted connections on equipment, or other equipment assembly, remember that the job is not complete until all of
the bolts are properly installed and tightened.
 Some equipment requires special bolt tightening procedures. For example, you may have to use a torque
wrench to correctly tighten the bolts to the specification, or tighten the bolts in a special order. Make sure that you
follow the correct procedure, use the correct tools, and that you are properly trained in the equipment assembly
procedure.
 Check pipes and equipment for properly bolted flanges as part of your plant safety inspections. As simple
guidance, bolts that do not extend beyond the nuts should be reviewed by a plant piping craftsman or engineer.
 If you observe improperly bolted flanges in your plant, report them so they can be repaired, and make sure the
required repairs are completed.
 Inspect new equipment, or equipment which has been re-assembled after maintenance, to make sure it is
correctly assembled and properly bolted before starting up.
Finish the job – make sure flanges are properly bolted!

Marathi, Norwegian, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Tamil, Telugu, Thai, Turkish, and Vietnamese.
What happens when the lights go out? January 2012

A maintenance worker went into the
electrical room to shut off a non-process
circuit. By mistake, he turned off the circuit
breaker for the plant programmable logic
controller (PLC ) power. He realized his error,
reset the PLC circuit breaker and turned off
the intended circuit breaker. The short power
interruption to the PLC caused some process
equipment to stop while other equipment
continued to operate. The result was a process
trying to run with partial controls. The process
operation was upset, isolation valves closed,
and toxic material was vented at a rate that
overloaded a vent scrubber. Fortunately, no
one was injured and the release did not leave
the plant site.

 We do not know how well the individual  Know what happens if the power fails for a single piece
breakers were labeled, or how well the of equipment, or to a part of the plant, but the rest of the
electrician was trained. In a process hazard equipment continues to operate. What happens if power is
analysis (PHA), this type of failure should be lost to computer displays or the control panel, but not to the
considered when discussing human factors. process?
Unfortunately, the potential consequences of a  Ensure that all electrical controls, including electrical
small event such as this may be missed in the panels and circuit breakers, are properly and clearly labeled.
scope of a PHA. At home you may be able to flip a few circuit breakers until
 When doing a PHA, be sure that you know you get the right one, but not at work!
what happens to instruments, valves, and other  If you are asked by a PHA team to verify the proper
equipment in case of failure of electric power or operation of a device or procedure, take that task seriously.
other utilities such as instrument air. Do they Follow the test procedure and document what you observe.
move to a “fail-safe” position or remain in their  When power failures occur, follow emergency
last position? If you are not sure, follow the procedures. These should tell you what actions are needed
rule: “when in doubt, check it out”. to keep the plant safe, and how to safely resume operation
 Knowing the failure state of a single device following a power failure.
may not be enough to understand what happens  Review and practice utility failure procedures
to a process if a large number of devices move periodically and correct any problems or omissions.
to the failure position at the same time. Think Confirm that you will be able to find the emergency
about what happens if a lot of equipment loses procedures in the event of a power failure.
power at the same time.
Be prepared for utility failures!

Caps and Plugs - One Day You Will Miss Them! December 2011
A piece of debris fell from temporary
scaffolding used to support people and material. It
fell onto the straight handle of a quarter turn ball
valve on a ¾-inch (about 20 mm) vent on a large
process pipe. The falling debris caused the vent
valve to open. The large pipe contained flammable
material, which was released through the vent. The
released material ignited. The resulting fire killed
one contract worker and seriously burned two
others.
When the incident occurred, there was no cap
or plug on the vent line from the process pipe. The
quarter turn ball valve was the only thing
preventing a hazardous release of flammable
material.
This incident occurred because something fell
onto the valve and opened it. Can you think of
other ways this valve might have leaked or been
accidentally opened?

 You should have more than one  Always replace all caps and plugs on vent pipes, drain pipes, sample
barrier between a hazardous material pipes, or other caps/plugs that you need to remove to do a job. The job
and the outside environment or the is not finished until you return all equipment to its original condition.
workplace. A single leaking or  Look for missing or damaged plugs and caps on pipe connections in
accidentally opened valve should your plant, and make sure they are replaced or repaired.
not result in a dangerous release of  Don’t forget that some vent valves are intended to be open (not
hazardous material. plugged or capped) – for example the vent on a double block and bleed
 It is easy to forget to replace isolation. If you are not sure whether a cap or plug is needed, ask
somebody who understands the design of the piping!
caps or plugs on vents or drains
from process pipes. Usually the
 Look for places where a single leaking or accidentally opened valve
could result in a hazardous release of material or pressure. Report them
person who removes the cap or plug
and make sure that some kind of back up is provided – for example, a
intends to come back and replace it
cap, plug, blind, or a second isolation valve.
later, but everybody in a process  Consider alternate placement of the valve handles on vents or drains
plant is very busy and it can be so they cannot be accidentally opened by leaning or stepping on them.
forgotten.  Consider other types of vent valve instead of a ¼-turn ball or plug
 There can be a dangerous release valve – for example, a diaphragm, globe, or gate valve, which is less
of hazardous material, flammable or likely to be accidentally opened.
toxic, through a very small pipe.  Be sure to do a management of change review before making any
modifications to a drain or vent.
Don’t let a single failure cause a serious incident!

One Incident – Three Beacons! November 2011

(and there could have been more)
If you have been a regular reader of the Beacon for several
years, you may recognize the pictures to the left. The top
picture shows a large fire at an oil refinery near Sunray, Texas
on February 16, 2007. The second picture shows some of the
damage. Three workers were injured and the refinery was
temporarily shut down. This incident was the subject of three
Beacons, with three very different safety lessons:
October 2008: “Ice ruptures unused pipe and causes fire”
May 2010: “Fireproofing structural supports”
September 2011: “Hazards from abandoned equipment”
There are more things to learn from this single incident.
You can go to www.csb.gov and look for the Valero Refinery
Propane Fire investigation to see the complete report.
The Beacon is 10 years old!

The Beacon is 10 years old this month! Since
November 2001, the Beacon has shared
process safety lessons with plant workers
throughout the world in an ever increasing
number of languages. The current direct
mailing list contains over 21,000 email
addresses. CCPS thanks its member
organizations, the Beacon sponsors, the
Beacon Committee, and over 40 volunteer
translators for making it possible to share this
October 2008 May 2010 September 2011 information and improve safety in our industry.

Î There is more than one thing to learn from every Î Know how to recognize incidents and near misses,
incident or near miss in your plant. and how to report them so they can be investigated.
Î Nearly every incident has multiple root causes. Î If you are involved in an incident investigation,
Î Incidents can have multiple contributing causes. insist that the investigation be complete. Identify all of
Here are some examples of contributing causes: the root and contributing causes so you can learn as
safety equipment or shutdown systems which didn’t much as possible.
work, failure of control systems and procedures to Î When you read an incident report, or the Beacon,
control a plant disturbance, failure of emergency look for all of the lessons learned and think about how
response systems and procedures. they apply to your plant.
Î You can’t learn anything from an incident or near Î Look for more information about a Beacon
miss which is never reported! incident. We don’t have much space so we have to leave things out!!!
Look for ALL of the lessons from every incident!
September 2011
Hose Hazards! October 2011

Hoses can be a significant hazard in a process plant. They must be
properly maintained, stored, and inspected. Here are some examples of
incidents caused by hose failure:
¾ An unloading hose on a chlorine railroad tank car failed (top and middle
pictures) because of corrosion. It was found that the hose was not made of
the correct material. It was stainless steel instead of the specified Hastelloy
C, a metal alloy. Nearly 25 tons of chlorine was released, 63 neighbors
sought medical attention, hundreds had to shelter in place, and a highway
was closed.
¾ A hose used to unload cylinders of phosgene, a highly toxic gas, failed
(bottom picture). A worker was exposed and later died in the hospital. The
hose was made of the specified material of construction, although
company engineers had recommended changing to a different material. It
was found that an adhesive tag on the hose trapped phosgene which slowly
diffused from inside the hose through the plastic hose core. This caused
faster corrosion under the label, and that is where the failure occurred.
¾ There are many reports of dirty hoses causing contamination of process
equipment, product contamination, and dangerous chemical reactions.
¾ If a hose is blocked with solid material, it will pressurize up to the line
pressure. If the blockage breaks free, a projectile could be released
causing significant damage, or, if the hose is worn or weakened, it could
burst.

Î Hoses are frequently connected and Î Always inspect hoses before using them.
disconnected from piping, making - Check the outside for corrosion or signs of leakage. Metal
connection failure more likely. braided hoses which have frayed or corroded braids should be replaced.
Î Hoses are often not properly handled - Be sure that you are able to see the entire outside of the hose
and stored, making damage and failure when you inspect it. Is part of the hose covered by something which
more likely. keeps you from seeing damage?
Î Frequent flexing of hoses stresses them, - Look inside to make sure the hose is clean, and not blocked.
increasing the chance for failure. - Check that seals (gaskets or O-rings) are in good condition.
Î Improper hose storage, and using the - Check that the fittings which connect a hose are not damaged.
same hose for different purposes, increases Î Make sure that hoses are inspected or replaced as required by your
the risk of contamination. plant’s maintenance schedule.
Î Plastic hose liners may be resistant to Î Review your plant’s procedures for ensuring that the material of
corrosion from chemicals, but are subject to construction of hoses is correct.
permeation. Over time this damages the Î Make sure you use the correct hose – particularly that it is the
liner and the outside metal covering could correct material of construction and pressure rating. Don't improvise!
be corroded and weakened. Î Make sure hoses are properly and securely connected to piping, and
Î Incidents have occurred because hoses properly supported. Long, heavy hoses are particularly vulnerable.
were incorrectly labeled with the wrong Î Properly clean and store hoses to prevent contamination or damage.
material of construction. Î Protect hoses from damage where vehicles could run over them.
Use the RIGHT hose, and be sure it is clean and in good condition!
Marathi, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
September 2011
Hazards from Abandoned Equipment September 2011

• In a Texas refinery in February 2007, propane
leaked from cracked control station piping which
had been out of service for 15 years. A huge fire
resulted (pictures), injuring four people,
evacuating the refinery, shutting it down for 2
months, and causing losses of $50 million. You can
read more about this incident in the October 2008
and May 2010 Beacons.
• In a food processing plant, piping was taken out of
service because of asbestos insulation, but the
piping was left in place. Eventually the block
valves leaked resulting in product contamination.
• Water leaked into an abandoned electrical box
causing a ground fault and a power system trip.
• A process using phosphorus trichloride (PCl3), a
highly water-reactive material, was shut down. A
PCl3 tank was supposed to be emptied and left in
place. It was not completely emptied. Several
years later there was a leak. The PCl3 reacted with
water on the ground to create a toxic hydrogen
chloride cloud.
 Plants often stop using equipment, piping, and  Always do a management of change review when removing
even entire plants or production units for weeks, equipment from service, either temporarily or permanently, or
months, or even years. This can be because of when removing abandoned equipment. Consider what isolation,
economic conditions, seasonal variation in product de-inventorying, and de-energizing is required for equipment not
demand, or changes in the process. in use. Follow your plant’s lock out – tag out procedures.
 Equipment which is not in use must be isolated  Make sure that equipment which is abandoned with the
from operating equipment, emptied of all intention of “removing it later” is actually removed.
chemicals, and de-energized. Your plant should  Raise management awareness of unused piping or equipment.
have lock out – tag out procedures to provide You may know about piping or equipment which is no longer
guidance on what should be done. used and has been forgotten.
 When a process is modified and equipment is  Periodically inspect equipment which is out of service to
removed from service, it may be isolated during the ensure that it doesn’t create a hazard to operating equipment, or
plant modifications with the intent to remove it the environment. Look for signs of damage, corrosion, or leakage.
later. But, is it really ever removed? Is the old Pay special attention to block valves, blinds, and other devices
equipment left in place, rusting and deteriorating? which isolate out of service equipment from operating equipment.
Manage change when abandoning and removing equipment!

Marathi, Persian, Polish, Portuguese, Romanian, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
Flammable Vapor Release Hazards in Congested Areas August 2011

On February 7, 2010, six workers were killed and at least 50 others were injured in a natural gas explosion at a power
plant under construction in Middletown, Connecticut, USA. The explosions resulted from planned work activities that led
to large releases of flammable natural gas in the presence of workers and ignition sources.
At the time of the incident, workers were conducting a "gas blow," in which natural gas is forced through the piping at
a high pressure and volume to remove debris, part of the commissioning and startup phase of the project. Natural gas was
being blown from an open-ended pipe between two large structures in an area near the power generation building (1).
This location, while outdoors, was congested because of surrounding power generation equipment (2). Efforts were made
to eliminate or control potential ignition sources in the area. However, ignition sources remained, both outside and inside
the building. The released natural gas found an ignition source and exploded (3).
This incident occurred during construction and startup of a power plant, and involved a large amount of flammable
gas. However, it is not uncommon for many kinds of process plants to be required to vent flammable liquid or vapor
from piping or equipment for maintenance or shutdown. Recent Beacons (January and May 2011) have discussed vapor
cloud explosions outdoors and inside buildings. This incident is another example.
1 2 3

Î A congested area means an area which contains a lot Î Do not assume that hazardous gas or vapor vented
of equipment, piping, structures, buildings, and even outdoors will disperse safely. Inspect the area and think about
natural features such as irregular terrain or trees. the effects of confinement.
Î Release of a small amount of flammable vapor in a Î If releasing flammable liquid or gas is unavoidable, vent
congested area can result in a dangerous vapor cloud. to a safe location away from personnel and ignition sources,
Î The explosion of a flammable vapor cloud in a preferably to a vent system designed to safely treat hazardous
congested area is likely to be more violent and vapors. Avoid congested areas or other places where vapors
destructive than a similar vapor cloud explosion in a could accumulate rather than disperse.
more open area. Î Do a thorough hazard analysis whenever hazardous
Î The United States Chemical Safety Board (CSB) has material venting is necessary, to minimize the release, control
recommended to industry and regulatory organizations potential sources of ignition, and safeguard people and
that the practice of releasing flammable gas to the property.
atmosphere for the purpose of fuel gas pipe cleaning be Î NEVER rely on your sense of smell to detect the presence
prohibited, and that alternate, non-flammable gases be of hazardous gas.
used. Î See the January and May 2011 Beacons for additional
suggestions.
Never assume that outdoor release of flammable gas is safe!

The Beacon is usually available in Afrikaans, Arabic, Chinese, Danish, Dutch, English, French, German, Greek, Gujarati, Hebrew, Hindi, Italian, Japanese, Korean, Malay,
Marathi, Persian, Polish, Portuguese, Russian, Spanish, Swedish, Telugu, Thai, Turkish, and Vietnamese.
Shift Work July 2011

Recently there have been reports of incidents in the air
transportation industry related to people falling asleep while required
to perform critical jobs:
• On March 22, 2011, two airplanes landed at Reagan National

Airport, Washington DC, around midnight without control tower
clearance because the air traffic controller was asleep.
• On February 19, 2011, an air traffic controller working the midnight

shift was tired and unable to remain awake, forcing his colleague to
do multiple jobs in violation of procedures.
Most process industry plants operate 24 hours a day, and operators

are required to work through the night, and to work rotating shift
schedules. A disrupted sleep schedule resulting from shift work can
cause sleepiness for many people, with potential for dangerous
operating errors. Operating personnel must be alert and able to
respond to potential problems at any time of the day or night!
There are things you can do to keep awake and alert when working
at night. You should recognize the problem and take responsibility for
getting enough quality sleep during the hours you are away from the
plant. Your management also has a critical role to play in making sure
that work schedules allow you the opportunity to get the sleep you
need. 14th Century German painting, “The Seven Sleepers”

Major process incidents can occur at any time People are not designed for irregular sleep patterns. Shift workers
of the day or night! Shift workers must always be face frequent sleep disturbances which can cause excessive
alert and able to effectively respond to potential sleepiness. You can minimize the effects. Some examples:
process incidents. Here are some examples of Î Make sure you get enough quality sleep while you are away from
process incidents which occurred at night: work.
Î The 1984 Bhopal, India toxic gas release that Î Make sure you have a good place to sleep during the day – dark,
killed thousands of people occurred shortly after quiet, without disturbances.
midnight. Î Take a nap immediately before you go to work.
Î The 1986 Chernobyl nuclear disaster started Î Work with others to help keep you alert.
with loss of control and an explosion at about 1 Î Be active – take walks and move around as much as possible.
AM. Î Don’t plan tedious or difficult tasks when you are likely to be
Î The 1989 Exxon Valdez oil tanker grounding most tired. Studies show that night shift workers are most sleepy
and oil spill occurred shortly after midnight. around 4-5 AM.
Î The 2010 Deepwater Horizon explosion (top Î If you are having problems staying awake, consult a doctor. You
picture), which killed 11 people and caused the may have a sleep condition that can be remedied.
largest marine oil spill in history, occurred at Î Search the Internet for more ideas on keeping alert while working
about 10 PM. at night and rotating shifts.
Make sure you get enough good quality sleep when working rotating shifts!
June 2011
Are you prepared for a natural disaster?
Earthquakes, hurricanes and typhoons, tornadoes, tsunamis, 1
wildfires, floods – we have read news of all of these and other
natural disasters in recent years. All of these catastrophes cause
terrible damage directly. They can also cause additional damage due
to the impact they can have on hazardous material storage and
processing facilities. Do you know what kind of natural disasters
might happen at your plant? Do you know what to do to prepare for
these disasters, and how to recover following a disaster?
1 – Fire at an oil refinery in Japan following the March 11, 2011 Tōhoku
earthquake; 2 – A tornado in Oklahoma; 3 – A wildfire in California; 4 – Damage to
the Fukushima nuclear power plant following the March 2011 earthquake
2 3 4

In a 2010 report “Flirting with Natural  Understand the direct impact that a natural disaster can
Disasters”, FM Global, one of the world's have on your plant, and also the impact of utility
largest commercial property insurance interruptions caused by the disaster.
companies, discussed some of the reasons  Review your plant emergency plans for disaster. Be sure
why organizations fail to prepare for natural that the plans make sense – can you actually perform the
disasters. Some of the findings include: tasks required with the available time and resources? If you
 People underestimate the risk of natural see problems, inform your management of your concerns.
disaster – they think “it won't happen here.”  Make sure that all equipment and Personal Protective
 As more time passes without a disaster, Equipment (PPE) needed to prepare for, and to respond to, a
people find it easier to deny its likelihood. natural disaster and its aftermath is available, properly
 Companies overestimate how well maintained, and ready for use.
prepared they are for dealing with a natural  Participate in natural disaster preparation and response
disaster. drills, take them seriously, and report any problems you see
 Many companies focus on recovery from during drills.
disaster rather than proactive activities to  Download and read the FM Global report from
minimize damage. www.fmglobal.com/disaster.
“An ounce of prevention is worth a pound of cure.” - Benjamin Franklin

Messages for Manufacturing Personnel www.chilworth.com
Flammable material release inside building causes explosion! May 2011
In June 2009 there was a major explosion at a meat

processing plant in Garner, North Carolina, USA. A new
natural gas line had been installed to supply fuel to a water
heater. The new pipe was being purged with natural gas to
remove air. The natural gas from the purge was released into
a building intermittently over a 2 ½ hour period. An
explosive mixture formed and ignited. The explosion
destroyed the building, killed 4 workers, injured 67 people,
and caused a release of 18,000 pounds of ammonia.
Most people would recognize natural gas as a fuel which
could cause an explosion. But remember that the release of
any flammable gas or volatile flammable liquid from piping
or equipment has the potential to cause a similar incident.
Many manufacturing processes use flammable gases or
liquids, and most factories, offices, and laboratories use
natural gas, propane, or other flammable fuels. In preparation
for maintenance, start-up, or other work, it may be necessary
to purge the flammable process material or fuel from the
pipes or equipment. This incident reminds us of the
importance of purging that flammable material to a safe place
where it can be safely contained, treated, or dispersed. Never
allow flammable materials to accumulate in a building, room,
or any other confined space.

Î A small amount of flammable gas Î Understand the fire and explosion hazards of the materials in
or vapor can create an explosive vapor your plant. Don’t forget about natural gas, propane, and other fuels!
cloud in a building or room. For Î When purging equipment and piping (for example, when
example, it only takes about 11 preparing equipment for maintenance), make sure flammable
pounds (5 kg) of propane to create a materials are vented to a safe location, away from personnel and
flammable mixture in a room 20 ft. ignition sources. Follow your plant procedures for safely purging
long, 20 ft. wide, and 11 ft. high (6 m. flammable materials.
x 6 m. x 3.5 m). The 11 pounds (5kg) Î Whenever possible, purge flammable vapors and gases to
of propane packs as much energy as collection systems which go to flares, scrubbers, or other treatment
110 pounds (50 kg) of TNT! systems. Avoid purging indoors, and conduct a thorough hazard
Î Any closed space such as a analysis to identify job specific precautions to protect personnel if
building or room can allow a released this is unavoidable.
flammable material to accumulate to Î Use flammable gas detectors to monitor areas where flammable
an explosive concentration. materials may be vented or purged.
It doesn’t take much released flammable vapor in a room to cause a big explosion!
April 2011
Å Don’t let a small leak…
The pictures show how rapidly a small water
leak at a construction site became a large and
catastrophic leak. The pictures were taken just a
few minutes apart!
This incident reminds us in the process
industries that it is important to report and
repair any leaks that we detect in piping or other
equipment. ALL leaks, no matter how small,
are potentially dangerous. Leaks of toxic,
combustible, or flammable materials usually
have higher risks, but, as shown in the pictures,
…become a BIG leak! Æ
a leak of any material can be
dangerous. A small leak of a very toxic
material can be immediately dangerous,
and a small leak of a flammable or less
toxic material may grow rapidly, and
become large enough that it is a major
fire, explosion, or health hazard.
What can you do?
Î Immediately report any leak that you observe in the course of your work. Signs of a leak include
puddles, drips, discolored paint or insulation, and unusual odors. Follow up to make sure that the leak
is repaired in a timely manner.
Î Identify leaking material and follow your plant procedures to ensure safety until the leak can be
repaired. Some examples: confine or absorb the leaking material, drain it to a safe place, set up
warning signs or barricades to warn people of the hazard and keep them away, make sure that ignition
sources are eliminated if the leaking material is flammable or combustible. Your plant emergency and
leak procedures will include specific actions appropriate for the materials in your plant.
Î Recognize that it may take time to prepare the plant for maintenance to repair the leak – pipes or
vessels may have to be emptied, equipment may have to be shut down, equipment may have to be
isolated from the area where work is to be done. Monitor the leak from a safe location until it can be
repaired, so appropriate actions can be taken if the leak increases in size.
Î When monitoring or inspecting equipment normally hidden from view (for example, covered by
insulation), look for evidence of leaks and report your observations so repairs can be made.
There is no such thing as a “small” leak!

Marathi, Persian, Polish, Portuguese, Russian, Spanish, Swedish, Telugu, Turkish, and Vietnamese.
Bad things can come in small packages! March 2011
An incident occurred while decontaminating a pail containing hazardous waste. An operator was
neutralizing a small quantity of process waste which had been drained into a pail during a
maintenance operation. It contained small amounts of metallic sodium, a material that reacts violently
with water. The procedure was to add dry methanol to the waste in the pail, warm it, and allow it to
react for 6-7 hours. The operator followed the procedure and, after the reaction period he poured the
liquid waste from the pail. He was preparing to flush the pail when more material from the pail
spilled, contacted water from rainfall, and set off an exothermic reaction that injured the operator.
The pictures show pails, drums, and other small containers of hazardous waste, stored prior to
disposal. It is important to remember that there can be serious hazards, even for hazardous materials
and wastes stored in relatively small quantities. In particular, small containers can be very hazardous
for people working near the materials – perhaps adding additional waste to the containers or
conducting some kind of neutralization, decontamination, or other chemical operations. It is also
important to consider the storage conditions for hazardous waste – for example, are there hazards from
high temperature (polymerization, decomposition) or low temperature (freezing)?
Why did it happen? What can you do?
The waste pail was found containing 2-3 • Label all containers, especially those containing
inches of sludge from the maintenance process waste.
procedure, and was not labeled. The • Remember that even small containers can present a
operator asked other operators about the big hazard.
waste and was told to dispose of it in the • Test unknown materials so you know what they are,
usual way. However, the sludge contained and safe waste disposal procedures can be developed.
a layer of solids that prevented the sodium • Make sure that maintenance procedures include
from contacting the methanol and reacting instructions on safe waste labeling and disposal.
as desired. The procedure did not require • During routine drainage operations report anything
the operator to mix the neutralized solution unusual (for example, sludge or unexpected solids) to
to ensure complete reaction. your supervisor.
Little containers can cause dangerous explosions!

Marathi, Norwegian, Persian, Polish, Portuguese, Russian, Spanish, Swedish, Thai, Telugu, Turkish, and Vietnamese.
Understand the Reactivity of Your Heat Transfer Fluid! February 2011
When thinking about chemical reaction

hazards in your plant, remember to
consider possible reaction between heat
transfer fluids and your process materials
in case of a leak in a heat exchanger,
condenser, reboiler, reactor jacket or coil,
or other heat transfer equipment.
A plant had an explosion in the outlet
piping of an oxidation reactor which
ruptured a 36 inch pipe. The explosion was
caused by the reaction of nitrate salt, used
as a heat transfer fluid to remove heat from
the reactor, leaking into the piping where
carbonaceous deposits had been trapped in
a short dead-leg. Reactive chemical testing
indicated that the reaction resembled closely the decomposition of TNT explosive. Fortunately,
nobody was injured. The incident showed that it was critical to avoid leaks of the nitrate salt, to detect
leaks if they did occur, and to have a safe shutdown procedure if there was a leak.
While this incident involved a relatively reactive heat transfer fluid (nitrate salt), many process
materials can react with common heat transfer fluids such as water, steam, brine solutions, ethylene
glycol solutions, or heat transfer oils. The reactions may produce heat or generate gas and pressure.
What can you do?

• Make sure that your process hazard analysis studies consider the potential for leaks of non-process
fluids, including reaction hazards. For example, consider heat transfer fluids; additives such as
corrosion inhibitors or biocides in heat transfer fluids; lubricating oils used in pumps, agitators,
compressors, or other rotating equipment; material which might drain into vessels from vent
collection systems; and any other materials which might get into your process equipment.
• Know how to detect utility fluid leaks into your plant equipment – including reactors or heat
exchangers that can have thousands of tubes and require rigorous maintenance and inspection
procedures to prevent leaks. You need to know:
• How can you recognize that a leak into the process is occurring?
• If there is a leak, what specific changes will you see in the way your process behaves?
• Are there any specific process parameters which would provide useful information for
detecting a leak?
• What should you do if you suspect a leak?
Don’t forget that heating and cooling fluids can be reactive with your process!
Vapor Cloud Explosions January 2011
A vapor cloud explosion occurs when a sufficient amount of

flammable or combustible material is released, mixes with air, and is
ignited. Some causes of the release of the vapor or gas fuel include:
• Loss of process containment from failure of a pipe, reactor, storage
tank, or other process vessel containing flammable or combustible
liquid, or a flammable gas.
• Rapid discharge of flammable vapor to the atmosphere through a
pressure relief system.
• Release of flammable liquid stored under pressure – for example,
Liquefied Petroleum Gas (LPG). The discharged liquid will rapidly
boil at atmospheric pressure, forming a flammable vapor cloud.
If the flammable vapor cloud is ignited, it can explode, producing
a blast wave which can cause major destruction at a large distance.
This is particularly true for releases in congested or confined areas,
for vapor clouds that have drifted into such areas, and for reactive
materials. In addition, heat from the fireball can cause significant
injury or damage.
Some of the worst disasters in the history of the process industries
have been vapor cloud explosions. Some examples include:
• June 1974, Flixborough, England (28 fatalities)
• October 1989, Houston, Texas (23 fatalities)
• March 2005, Texas City, Texas (15 fatalities)
• December 2005, Buncefield, England (no fatalities but 43 injuries
and major damage)
• October 2009, Jaipur, India (12 fatalities)
What can you do?
• Make sure that piping and equipment inspections and preventive maintenance tasks are completed as
required to ensure mechanical integrity of process equipment. Containment of fuel is the best way to prevent
vapor cloud explosions. Ignition sources for flammable vapor clouds – for example, heaters, vehicles,
unclassified electrical areas, hot work, static discharge – are difficult to control.
• Ensure that safe work practices are followed, including hot work procedures in areas near flammable
inventories.
• If you detect any leak, no matter how small, on equipment containing flammable or combustible liquid or
flammable vapor, report it immediately and know how to initiate emergency procedures.
• If your plant contains flammable or combustible materials, you should have written emergency procedures
for a leak. Review and understand these procedures, participate in drills, and know what you must do to
protect yourself and others in case of a leak. Know when and how to use appropriate personal protective
equipment (for example, flame resistant clothing) and leak detection equipment such as portable flammable
material detectors.
Keep flammable materials inside the process equipment!
Sponsored by
CCPS
Messages for Manufacturing Personnel Supporters
Are you ready for winter? December 2010
It is time to be are ready for cold weather! Winter weather can cause major problems for
process plants. Some examples:
• Water pipes can freeze, possibly causing loss of critical cooling water flow or damaging fire
protection systems using water.
• Condensate lines from steam traps can freeze causing the traps to be ineffective.
• Some process materials can freeze at winter temperatures, or solids may precipitate from
process solutions, causing loss of flow and requiring maintenance operations to clear blocked
pipes or equipment.
• Incoming raw materials may arrive frozen, or with solid precipitated from a solution in the
bottom of the transport container (drum, truck, railroad car, ISO container). Note that this may
be a concern even if your plant is in a place which does not have cold winter temperatures – the
shipment may have passed through cold weather on the way to your plant, frozen, and not had
enough time to thaw before arrival.
• Don’t forget about the physical hazards of ice and snow – the possibility of slips and falls.
And look for places where large icicles or heavy accumulations of ice might form – for
example on structures near steam vents, near cooling towers, or where water spray fire
protection systems have been activated.
• Remember that water expands when it freezes. The pressure from the ice can be enough to
break pipes and rupture or damage process equipment.
• You can get short periods of cold weather even in areas which normally have mild winters –
be prepared for this possibility.
• Read the December 2001 and October 2008 issues of the Beacon for some examples of winter
weather process safety problems (“read only” copies available at www.sache.org).
What can you do?

• Have a “winterization” checklist to ensure that your plant is ready for cold weather. It should include things such as
checking that steam or electric tracing of pipes and equipment is turned on and working, insulation is in good condition,
heating systems in warehouses are working, safety showers and eye wash stations are prepared for cold weather, anti-
freeze protection of engine driven equipment such as fire water pumps, and other things appropriate to your plant.
• Review procedures for thawing frozen pipes and equipment, and incoming raw materials which might freeze in cold
weather, and make sure you understand them. Think about this even if you are in a warm climate – do you receive
materials which could freeze on the way to your plant?
• Review non-routine activities and jobs for cold weather impact.
• Be ready for thawing temperatures, when leaks may appear, or ice accumulations on piping and structures may fall to
the ground.
Be prepared for cold weather!

Sponsored by
CCPS
Two valve actuator rupture incidents! November 2010
1 – Gas leaked from the process through the stem of a 10 inch gear operated
valve into the gear operator. The gear operator was designed to relieve gas if
this happened, but the relief system did not work. The gear operator became
pressurized and a 5 inch plate blew off the top of the valve operator.
Fortunately, nobody was hit by the plate. The investigation found that the
relief vent on the valve operator (and another one on a nearby valve) had
been painted over (arrow) and it did not vent properly. Plant personnel were
not aware of the potential for gas migration into the gear box, and the need
to verify that the operator gear box was properly vented.
2 – A natural gas pressure reducing system used the natural gas to operate a
control valve. The valve actuator ruptured, and a large fragment went flying
several meters. We do not have enough information on this incident to know
whether the valve actuator was overpressured, or if it was corroded,
1
damaged, or otherwise defective, but these are possible causes of the failure.
Again, fortunately, nobody was hit by the pieces of the failed valve actuator.
Do you know?
• It is possible for pressurized process gases and other fluids to leak from
the process into valve actuators. The resulting pressure may be sufficient to
cause the actuator to fail.
• Some equipment (for example, the valve actuator in Incident 1 above)
includes small vent openings or relief plugs which should never be blocked,
plugged with debris, or painted over.
• Some valves and other instruments may use process gases as the source of
pressure to activate the devices.
• Any device under pressure, including valve actuators, can fail and
potentially cause injury if it is subjected to excess pressure by mis-operation
2 or improper maintenance practices.
What can you do?

• For all equipment that can be pressurized, understand how the high pressure relief systems are intended to
function. Don’t forget equipment such as valve actuators, especially if they use process gas for motive power.
• Make sure that you have complete documentation of excess pressure relief systems, and know how to
recognize if they are not working properly or are compromised in some way.
• Many maintenance operations such as painting and insulation are done by contractors or temporary workers
who do not understand the plant. They may inadvertently compromise safety, for example by painting over the
valve operator vent as described above, or by insulating over the stem of a valve preventing movement. Assume
that these workers do not understand the equipment and give them specific training on how to do the job before
they start any work. Observe their work, and inspect the equipment that they have worked on before putting it
back into service.
Know what protects all of your equipment against excess pressure!

Sponsored by
CCPS
Hazardous Material Storage and Shipment October 2010
1 2 3
Everybody in your plant has worked diligently to manufacture

4
materials safely, but you still aren’t finished with process safety! How
do you store the products, by-products, and hazardous wastes which
have been produced? How do you safely transport them to customers or
waste disposal facilities? Things can still go wrong – the pictures show
several examples:
1 – A drum of hazardous waste stored in a warehouse was contaminated
with an incompatible material which reacted. The drum exploded, went
through the roof (arrow), and landed on top of the warehouse.
2 – A leaking ISO container filled with flammable material caught fire while in transit on the road.
3 – A reactive monomer was put in a railroad tank car with the wrong kind of lining, was contaminated by
iron from the tank car, and polymerized resulting in a tank car explosion.
4 –Improperly packaged used lithium batteries caught fire while being transported to a disposal facility.
What can you do?

• Make sure that all containers from small sample jars all the way up to railroad tank cars and other large
containers are clearly labeled so that everybody knows what is in them.
• Label laboratory and plant waste containers as to what can and CANNOT be discarded in the same container.
• Do not allow packaged wastes to be stored for extended periods of time at your site
• When preparing materials for shipment, make sure that you understand all of the requirements for safely
shipping those materials, including proper containers, packaging, labeling, shipping papers and any other
requirements.
• Inspect containers BEFORE filling them with hazardous materials. Look for potential leak points.
• Know the requirements for safe storage of materials in warehouses or other storage areas, and follow them.
• Follow your plant procedures for receiving hazardous materials including shipping papers or container
labeling, and how to handle a damaged or leaking container.
• If you observe a damaged container anywhere in your plant in the course of your work, immediately report it
so corrective action can be taken.
Store and ship hazardous materials safely!

The Beacon is usually available in Afrikaans, Arabic, Chinese, Danish, Dutch, English, French, German, Greek, Gujarati, Hebrew, Hindi, Hungarian, Indonesian, Italian,
Japanese, Korean, Malay, Marathi, Norwegian, Persian, Polish, Portuguese, Russian, Spanish, Swedish, Tamil, Thai, Telugu, Turkish, Urdu, and Vietnamese.
Sponsored by
CCPS
Has anybody seen our process safety information (PSI)?? September 2010
What is Process Safety Information (PSI)? It is the information
1
about the process chemistry, equipment and technology of your
plant. It is collected from many places inside and outside your
company: research and development, engineering, operations, and
also suppliers of raw materials, process technology, and equipment.
As an operator or maintenance person, your first exposure to the
PSI may have been at a Process Hazard Analysis (PHA). The PSI
was that stack of drawings, manuals, documents, and books that
provided information to the PHA team. PSI is also frequently used
in Management of Change (MOC) reviews. It is important to
understand the existing system so you can evaluate the
consequences of proposed changes. For example, a new valve must
meet the specifications for the pipe where it is installed. That
2 means the valve, gaskets, bolts, and other components all need to
be correct. How do you know? Verify them according to the piping
specifications in the PSI from the plant engineering design.
Some other important examples of PSI include piping and
instrumentation drawings (1), hazardous area classification
drawings (2), and the reports from process hazard analyses (3),
management of change reviews, incident investigations, personal
protective equipment requirements, operating and maintenance
procedures, and others.
1. A piping and instrumentation drawing (P&ID)

2. A hazardous area classification drawing
3. Part of the documentation of a Process
Hazard Analysis (PHA) study
What can you do?

PSI is essential to safe plant operation and maintenance, but it is valuable only if it is correct, up to date, and
used. And you must know where to find it! Here are some examples of things you can do to ensure that the PSI
for your plant is correct, and we are sure you can think of many other examples:
• If asked to go into the plant and update piping drawings, take that job seriously. A valve not shown on the
drawing may be the difference in preventing a spill – you can’t close it if you don’t know it is there!
• If you find that an operation is normally done differently from the written operating procedure, tell your
supervisor, so that either the procedure is modified, or the operation is done as required by existing procedures.
• If you find an error on a drawing, tell your supervisor or plant engineer so it can be corrected.
• If you are trying to use a drawing and there are too many corrections, tell your supervisor or an engineer that
the corrections make the drawing confusing, and a new drawing is needed.
• Remember that control system documentation is part of the PSI and must be updated when changes are made.
Where is your Process Safety Information?

Sponsored by
CCPS
August 2010
Early lessons from a tragedy
The Deepwater Horizon fire
Oil flow from the well head The oil spill from space on
May 24, 2010
On April 20, 2010 an explosion on the Deepwater Horizon

drilling rig, operating in the Gulf of Mexico off of the coast of
Louisiana, killed 11 workers and injured 17 others.
Approximately 36 hours later the rig sank. The resulting oil
spill from the damaged well head is the largest in United States
history. This incident has been a major news story throughout
the world. As this Beacon is being written, oil continues to leak
from the well. It is too soon to know the specific causes of this
incident, and there will be a number of investigations in the
months ahead. However, it is not too early to think about what we can all learn about the importance of
understanding what can go wrong in our own plants, and how we can be better prepared to respond to an
emergency. Emergency procedures and equipment are not used very often – after all, emergencies are rare
events! But, they can happen, and so we must always ensure that we understand how to recognize warning
signs of an incident, know how to be sure that emergency equipment is in good working order, and
frequently practice emergency procedures.
What can you do?

• Find out and understand the worst things that can go wrong in your plant.
• Learn to recognize warning signs of a potential major incident.
• Make sure that you know your role in preventing a major incident if you observe any of its warning signs.
• Know how to maintain equipment intended to protect against major incidents in your plant.
• Familiarize yourself with critical procedures intended to protect against major incidents in your plant.
• Know what to do after a major incident, both to protect yourself and others, and to minimize damage.
• Ensure there are frequent emergency drills and practice of emergency procedures at your plant, so you are
familiar with what to do in a real incident.
Do you know how to respond to an emergency in your plant?
Sponsored by
CCPS
July 2010
Passive Safety Equipment
April – Insulating cover on a May – damaged fireproofing June – a hole in the wall of a
long bolt flangeless valve on a pipe bridge support column tank farm containment dike
Can you figure out what the April, May, and June 2010 issues of the Process Safety Beacon have in
common? All of them discuss a type of safety equipment that can generally be described as passive. Passive
safety devices do not have to detect an unsafe condition or take any action to perform their protective safety
function. They have no sensors or moving parts. They do their job because of their construction – for
example, the insulating characteristics and thickness of insulation or fireproofing, or the height and
impervious material of construction of a dike wall.
Here are some other examples of passive safety equipment which you might have in your plant:
containment buildings for toxic materials, blast resistant control rooms or other buildings, blast resistant
buildings for storage of potentially unstable materials such as organic peroxides, flame or detonation arrestors,
insulation on storage tanks to limit heat exposure to a fire (standards for sizing relief valves for preventing
overpressure of a storage tank engulfed in a fire allow credit for insulation on the tank).

• Even though passive safety equipment does not have • Find out what kind of passive safety equipment
any sensors or moving parts, it does require ongoing you have in your plant, and understand what
inspection and maintenance. As shown in the previous safety function it performs.
three issues of the Beacon, insulation can be removed • Find out what must be done to maintain the
from equipment or it can deteriorate or be damaged; passive safety equipment in your plant, and make
fireproofing can be damaged or removed; dike walls can sure these maintenance activities are done. Ask
have holes in them; and other types of passive safety the people responsible for maintenance to explain
equipment can deteriorate or be damaged. the required maintenance.
• It is easy to forget about passive safety equipment, and • Learn how to recognize damage to the passive
to forget its importance for plant safety because it is just safety equipment in your plant so you can report it
part of the plant background that you see as you go about and have it repaired.
your job, and you never notice its condition. • Periodically include inspection of passive safety
equipment in your plant safety inspections.
What passive safety equipment do you have in your plant?

Sponsored by
CCPS
June 2010
Containment Dikes and Pads
Most people recognize that containment dikes around storage tanks, and sloped
containment pads for pumps, process buildings and structures, truck and rail car
unloading areas, and other potential spill locations have an important environmental
protection function – preventing contamination of soil and surface water. But, do you
know that they often also have important safety functions? Some examples include:
• limiting the spread of a fire and preventing exposure of other equipment if a
flammable material spills and is ignited
• preventing contact of incompatible reactive materials in case of leak or spill
• limiting the spread of spilled corrosive material and preventing contact with equipment
which could be damaged by contact with the corrosive material
In 2001, the US Chemical Safety and Hazard Investigation Board (CSB) investigated
a fire that destroyed a petroleum blending facility in Texas. Poor dike design and
maintenance resulted in burning liquid spreading the fire from tank to tank, eventually
engulfing the whole plant.
ÅSpill containment dikes for

chemical storage tanks
A sloped containment pad

directs any spills from a truck
unloading facility to a chemical
sewer trench Æ
What can you do?

• Periodically include containment dikes around storage
tanks, sloped containment areas, and drainage trenches as
part of your routine plant safety inspections. Look for
physical damage, spilled material, accumulation of rain
water in dikes, or blocked drainage. Look for debris,
equipment, or anything which restricts flow of a spill.
• Make sure that your plant procedures include pumping
out or draining rain water from containment dikes – if a
dike is partly filled with rain water, it may not be able to
contain a large spill.
• If you have any kind of valves or other piping to remove
rain water from a containment dike, make sure these are
closed or otherwise blocked when not being used. The arrow shows a hole in a containment dike. More
• If you do any maintenance or construction work on a damage can be seen at the base and the top of the dike wall.
storage dike which results in damage to the integrity of the Other examples of damage include cracks in dike walls or
dike, make sure the damage is repaired before the job is floors, holes where pipes have been installed passing
finished. through dike walls, and anything else which would allow
spilled material to flow out of the dike area.
Inspect and maintain your containment dikes and pads!

Sponsored by
CCPS
May 2010
Fireproofing Structural Supports
No fireproofing in this area Bare
Column
Fireproofed Fireproofed
Columns Column
The April 2010 Beacon discussed the use of fireproofing to protect process piping components, specifically
long bolt flangeless valves. Fireproofing is a fire resistant insulating material which is also often applied to the
surface of structural steel to delay heating of that steel from fire exposure. The primary purpose is to improve
the capability of structural steel to maintain its integrity until the fire is either extinguished or other active fire
protection systems can provide adequate cooling protection. Without fireproofing, exposed structural steel,
such as the pipe rack support columns in the photograph at left, or the support columns in the photograph on
the right, can rapidly lose strength and fail, possibly within minutes. The failure of the piping and equipment
supports can break pipes or cause vessels to fail, releasing more flammable material, and causing a larger fire.
Å Some examples of damage to fireproofing on steel

pipe bridge supports – the fireproofing has been
removed, or has become degraded and fallen off.
What can you do?

• As you go about your work, look for damage to fireproofing on
support columns or beams for pipe bridges, buildings, outdoor
process equipment structures, and other equipment supports.
• Periodically include inspection of fireproofing as a part of your
routine plant safety inspections.
• Report observed damage and make sure that it is repaired.
• If you are doing any work that requires temporary removal of
fireproofing on structural elements, make sure that the
fireproofing is replaced when the job is finished.
• If you damage any fireproofing on structural elements in the
course of other work, report the damage and make sure it is
repaired.
• Be aware that damaged fireproofing can also allow the entry of
water which can further damage the fireproofing and corrode the
steel under the fireproofing.
Take care of fireproofed structural steel so it can take care of you!

Sponsored by
CCPS
Fire Protection - Long Bolt Flangeless Valves April 2010
1 2 3
Would you recognize the metal cover (yellow arrow) in Picture 1 as an important piece of safety
equipment? If it was damaged or missing, would you know to report it so that it could be repaired or
replaced?
The metal cover wraps something called a “long bolt flangeless valve” (also called long bolt,
sandwich, flangeless, or wafer valves). Some examples, with the covers removed, are circled in red in
Pictures 2 and 3. These valves have no integral flanges for bolting to pipe or vessel flanges, and have
exposed bolts longer than 3 inches (about 7 cm.). If there is a fire in the area, the long bolts may be
contacted directly by flames (impingement). The heat causes the bolts to expand and lengthen,
allowing the gaskets on the two sides of the valve to leak. If the leaking material is flammable or
combustible, it will add fuel to the fire (Picture 4). If the pipe is under pressure, a large, spraying fire
that results in more damage can occur.
The metal cover wraps the long bolts with a fire resistant material and encloses the entire assembly
with a stainless steel covering to protect it from flame and heat impingement. It is an important safety
device. It must be properly re-installed if removed for maintenance. It must also be inspected
periodically to be sure it is in good condition, and any damage must be reported so it can be repaired.
Note larger fire at the

What can you do?
long bolt flange joint • If you have long bolt flangeless valves on piping in
combustible, flammable or LPG service, make sure the
covers are properly maintained at all times.
• A cover on a long bolt flangeless valve can hide
corrosion or other damage. The covers should be removed
periodically to inspect the flanges and valves under the
cover, and immediately replaced following the inspection.
• Passive fire protection on such a valve will only be
rated for a short duration fire, and an inherently safer
Bolted flange fires engineered solution would be to replace the flangeless
4
valve with a fully flanged valve.
Understand your Safety Equipment!

Sponsored
By:
(March 22-
22-24, 2010
San Antonio, Texas)
Facility Siting March 2010
Five years ago, on March 23, 2005, a series of explosions
occurred at an oil refinery in Texas City, Texas during the restart of a
hydrocarbon isomerization unit. 15 workers were killed and 180 were
injured. All fatalities and many of the injuries occurred in and around
trailers that had been placed near the isomerization unit to support
maintenance activities on other units. A distillation column was
overfilled and overpressurized. The relief valve opened, releasing hot
hydrocarbon to the atmosphere through a vent stack to the
atmosphere. This was not the first time a release had occurred from
the vent stack, but this time the release was much larger. The
resulting flammable vapor cloud ignited causing a massive explosion.
This incident highlights the importance of the location of occupied
buildings, both permanent and temporary, relative to highly
hazardous processing facilities. In response to industry and public
concern, the American Petroleum Institute (API) has created or
updated two Recommended Practices on management of hazards
associated with permanent (RP752) and portable (RP753) buildings.
What can you do?
While it is easy to think that facility siting and location of
occupied buildings are only a concern for management, there is a lot
that people working in the plant have to contribute. For example:
• Understand your plant’s facility siting studies. Know which areas
of your plant are off limits for temporary buildings. Make sure that
any changes in building location, or in plant operations near
occupied buildings, are thoroughly evaluated using the site
Damage to portable trailers from the Management of Change (MOC) process.
March 2005 Texas City explosion • Point out differences between facility siting studies and the way
buildings are actually used. For example, management may believe that a local control hut in the plant is used
infrequently, but operators may know that it is actually regularly occupied for long periods of time.
• Don’t seek refuge from a potential explosion in a building that is not designed for a blast. An explosion creates
a pressure wave, and buildings which are not built to withstand an explosion are likely to be heavily damaged or
completely destroyed. A person is more likely to be injured by the collapse of a building which is not blast
resistant than by the same pressure wave in an open area.
• As soon as you become aware of a flammable material release which could create a flammable vapor cloud,
follow your plant’s emergency procedures, including sounding evacuation alarms to ensure that non-essential
personnel evacuate process units and nearby buildings.
• Assure that nonessential personnel are not allowed in the process area during high hazard operations - for
example, plant start-up, emergency shutdown, plant upsets.
• Insist that process upsets that result in hazardous material releases are properly investigated and corrective
actions taken.
Be sure that your occupied buildings are safe!
Celebrating 100 issues
of The Beacon and 25
years of process safety
http://www.aiche.org/CCPS/Publications/Beacon/index.aspx collaboration through
Messages for Manufacturing Personnel CCPS.
President Kennedy moments

Lest We Forget! February 2010, Issue No. 100
before the assassination What do these dates have in common: December 7, 1941, November
22, 1963, September 11, 2001? They are all dates of events which
everybody in the United States will always remember. Unfortunately they
were tragedies – the attack on Pearl Harbor, the assassination of President
Kennedy, and the terrorist attack on the World Trade Center in New York.
These are dates that we remember in the United States. In your culture or
country the dates and events will be different and those above may be less
memorable – after all much of the rest of the world had been at war for
several years before December 1941, and many other countries have
A piece of the fuselage of United
Flight 93 on Sept. 11, 2001 suffered major terrorist attacks. Think about the important dates in your
history and why you remember them.
What about July 20, 1969? Do you know that date? It’s the day that the
first man walked on the moon. That was a more glorious day in history but
perhaps not as well remembered. Why? Psychologically, we tend to
remember the bad things more than the good. Remembering the bad can
cause us pain or sense of loss, but we continue to remember.
It is the same with serious process events. Next month, it will be 5
years since the explosion at a refinery in Texas City, Texas, which killed
15 people and injured 180. There are dates in every company’s history that
are remembered for serious events. Is there a ceremony to reflect on their
anniversary? Probably not, but they are as important as the release of the
most successful products. Remembering them can be a painful experience,
especially for those who lost close friends and coworkers, but we must
Aftermath of the March 23, 2005 remember so we can work to make sure these tragedies never happen
Texas City refinery explosion again.

• The process industries throughout the world form a common • Ask senior workers about incidents of the past. They
culture, defined by the kinds of industrial plants that we do not have to be serious explosions, but could be
operate, and the hazards of the materials and processes that process upsets that nearly caused an incident, or process
we use. This culture crosses national boundaries, and there failures that caused a major quality or operational
are dates in our history which we must never forget. Two of problem.
those were remembered in the November and December 2009 • Document the incidents of the past in a form where
Beacons – November 19, 1984 (Mexico City LPG terminal they can be easily revisited.
fire and explosion) and December 3, 1984 (Bhopal, India • Share these lessons with new people in your plant,
toxic gas release). from the plant janitor to the plant manager, so they all
• “Man seems to insist on ignoring the lessons available from can learn from them.
history.” – Norman Borlaug, American botanist and 1970 • Use the log of past events during Process Hazard
Nobel Peace Prize recipient for contributions to the world Analyses and other hazard reviews to remind everybody
food supply of what can happen.
• “We live in the present, we dream of the future, but we learn • Read and share the Beacon to understand incidents
eternal truths from the past.” – Madame Chiang Kai-Shek that have occurred somewhere else, and what you need
to do to make sure they don’t happen to you!
“There is nothing new in the world except the history you do not know.”
– Harry S. Truman, US President
On behalf of all of the readers of the Beacon in 33 languages, CCPS and the CCPS
Process Safety Beacon Committee would like to thank all of our volunteer translators
for their efforts on behalf of process safety throughout the world in 2009. With this
issue of the Beacon, we celebrate 100 issues since November 2001.
All translators are volunteers, and the only compensation that they receive is the knowledge that their efforts are helping
to improve process safety throughout the process industries. Because of their volunteer efforts, CCPS is able to distribute
the Process Safety Beacon in 33 languages as of December 2009. If you know, or meet, any of our translators in the
course of your work, please thank them personally for their work. If you are interested in translating the Beacon into a
language which is not currently available, please contact us at ccps_beacon@aiche.org and we will provide you with
information on the procedure for translation.
Afrikaans: Francois Holtzhausen, Sasol Malay: Busari Jabar and Amiruddin Bin Abu
Bakar, PETRONAS
Arabic: Khalid Walid Haj Ahmed, Alfaisal Marathi: Shirish Gulawani, Thermax Limited -
University Chemical Division
Brazilian Portuguese: Antonio Lauzana, Norwegian: Janne-Kristin Nyquist, Reichhold AS
Petrobras / Repar
Chinese: Li Yi and Zhu Ronghui, Kunming Persian (Farsi): Mostafa Sadeghpour
Cellulose Fibers Co., Ltd National Iranian Oil Refining and Distribution
Company (NIORDC)
Danish: Ole Raadam, Becht Engineering Co., Polish: Agnieszka Majchrzak, Płock, Poland
Inc.
Dutch: Marc Brorens, BP Rotterdam Refinery Portuguese: Nuno Pacheco, Repsol Polímeros
and Helder Figueira, DuPont Safety Resources
French: Robert Gauvin, SNC-LAVALIN INC. Russian: Sergey V. Belyaev, EHS Manager
NOTE: Robert has provided French translations of all 100 issues of the
Beacon !
German: Dieter Schloesser, Basell; Martin Spanish: Julio Miranda, P. Eng
Fuchs, Chemtura Manufacturing Germany
GmbH; Karl-Fred Woerner Celanese/Ticona
Greek: Vassiliki Moukriotou, Magdalini Swedish: Iva Rauswall Frisk and Claes Broman,
Karakitsiou, Anastasios Keramopoulos, Borealis AB
HELLENIC PETROLEUM SA
Gujarati: Mayoor Vaghela, HELPS Safety Tamil: Varun Bharti, Cholamandalam MS Risk
Consultant Services Ltd.
Hebrew: Reuven Wachs, HSE consultant; Thai: Surak Sujaritputangoon, HMC Polymers
Benny Sagiv, ICL Global; Martin Stone, Bromine Co., Ltd., and Donruethai Tantiwaraporn,
Compounds Ltd.; Boaz Harel, Eilat Ashkelon Postgraduate Student, Coventry University, UK
Pipeline Co. Ltd.; Yossie Weber, Weber Safety
Engineering Ltd.; Ofer Navot, Intel
Hindi: Rekha Sharma, Chilworth Technology Traditional Chinese: S.G.Lin
(Pvt. Ltd)
Hungarian: Maria Molnarne, BAM, Berlin Turkish: Hasim Sakarya, Dow
Indonesian: IIPS (Alvin/Darmawan/Vidya/ Urdu: Rizwan A. Taqi

Wahyu)
Italian: Cesare Mazzini and Monia Casana, Vietnamese: Ha Van Truong, BP
Uniqema
Japanese: Takuya Kotani and colleagues, SCE- Telugu: V.Ravi Kumar, Nagarjuna Fertilizers and
NET Chemicals Limited
Korean: Hwan Bae, SK Corporation
CCPS Sponsors, the Beacon
Committee, and volunteer
Beacon translators wish all
Beacon readers a happy,
http://www.aiche.org/CCPS/Publications/Beacon/index.aspx prosperous and safe New
Messages for Manufacturing Personnel Year 2010.
Corrosion and Erosion January 2010
1 2 3
4 Mechanical integrity is one of the biggest challenges for an

effective process safety management program. Think about it – in
your plant, there may be hundreds of vessels, thousands of feet of
pipe, and hundreds of pumps, compressors, instruments, and other
equipment. All of it must be kept in good operating condition to
ensure safe, reliable, and profitable operation. Management of
corrosion and erosion of process piping and equipment must be a
5
major component of any effective mechanical integrity program.
The pictures show some examples of corrosion and erosion
problems which were identified in plant inspections. (1) and (2) –
external corrosion of pipes in a plant; (3) – close up of erosion
damage to the face of a flange; (4) – close up of eroded body and
seat of a gate valve; (5) – erosion damage on the body of a valve.

• Corrosion is the deterioration of metal by electro- • Understand mechanical integrity programs in your plant,
chemical reaction with substances or microbes in its and your role in ensuring that these programs are effective.
environment. These substances can be process materials • Observe pipes, vessels, and other equipment when you are
contained in a vessel, pipe, or other equipment, or materials working in the plant. Look for stains on the outside of
in the outside environment – for example, water, salt, or insulated lines and other signs of damaged or corroded
contaminants in the atmosphere. The rusting of steel is an equipment. Follow up to make sure that repairs are made.
example of corrosion. • If you are taking equipment or piping apart, look for
• Erosion Corrosion is the degradation of material surface evidence of corrosion damage – for example, corrosion
due to mechanical action, often by impinging liquid, under insulation, internal corrosion in pipes or other
abrasion by a slurry, or particles, bubbles, or droplets equipment, damage to flanges or valves.
suspended in fast flowing liquid or gas. • When replacing pipes, valves, or other equipment, be
• Corrosion has been responsible for major losses in the careful to use the same material of construction.
process industries. For example, in 2006, part of a major oil • Understand the corrosion and erosion corrosion properties
field had to be shut down for several months because of of the materials in your plant, and what you must do to
multiple oil spills resulting from severe pipeline corrosion. minimize corrosion problems.
Watch out for corrosion and keep the chemicals inside the equipment!
Sponsored by CCPS
Process Safety
Incident Database
http://www.aiche.org/CCPS/Publications/Beacon/index.aspx (PSID)
Messages for Manufacturing Personnel (http://www.psidnet.com/)
The Bhopal Tragedy – 25 Years Ago December 2009
One of the worst tragedies in the history of the

process industries occurred 25 years ago this month.
A highly toxic gas, Methyl Isocyanate (MIC), was
released from a pesticide plant in Bhopal, India
shortly after midnight on December 3, 1984. The
number of fatalities may never be known, but
estimates have been in the range of 2000-4000, with
estimated injuries of 100,000 or more people. The
International Medical Commission on Bhopal
estimated that, as of 1994, more than 50,000 people
remained partially or totally disabled as a result of
exposure to MIC. 1
Bhopal was a reactive chemistry incident. MIC
1 – MIC storage tank
reacts exothermically with water. An MIC storage
(removed from
tank was contaminated with water, and the reaction underground
generated heat and pressure causing a relief valve to vault)
open. Safety systems had been taken out of service 2 – Flare stack where
without doing a management of change evaluation, or MIC was
released
they were unable to deal with the release. 3
3 – Sodium hydroxide
Approximately 40 tons of highly toxic MIC was scrubber (not
released into the community, exposing tens of working during
thousands of people. incident)
2 4 4 – Control room as it
looked in 2004

• Reactive chemistry incidents continue to occur • Learn more about what happened at Bhopal
in the process industries. For example, on from Internet resources and the December 2004
September 15, 2009, the US Chemical Safety Process Safety Beacon (a “read only” copy of
and Hazard Investigation Board released a that Beacon can be viewed at www.sache.org).
report on a runaway chemical reaction incident • Apply the lessons from Bhopal to your facility
in Florida which killed 4 people and injured 32 – for example, understanding all process
(www.csb.gov). hazards, including reactive chemistry hazards;
• The material released from a relief valve, understanding the worst case consequences of a
rupture disk, or other pressure relief device must possible accident; maintaining critical safety
discharge to a safe location or treatment system. systems; emergency response preparation.
• Critical safety systems must always be • Never become complacent about the hazards in
properly maintained and fully operational. your facility – remember what can go wrong!
Remember and learn from Bhopal and other tragedies!

CCPS CENTER FOR
CHEMICAL PROCESS SAFETY
Process Safety Beacon Sponsored
by
http: //www.aiche.org/ccps/safetybeacon.htm
An AIChE Industry CCPS
Technology Alliance Supporters
December 2004
Bhopal—A Tragic Event
What Happened?
It was just after midnight,

December 3, 1984 in
Bhopal, India. A
succession of events
occurred in the Union
Carbide India Limited
facility that led to the
release of ~40 metric tons
Union Carbide Bhopal Plant of methyl isocyanate (MIC)
gas. The consequences
were tragic: according to the
Indian government, more than
What You Can Do 3800 people died shortly after the
release and thousands were
- More than any other in the history of the chemical industry,
this incident demonstrates why robust safety systems are critical
injured.………………......……….
when handling hazardous materials. This incident was also one of
the driving forces which defined process safety management as
we know it today.
How Did This Happen?
- Understand the reactivity hazards of all materials in your
process. Read the reactivity section of your MSDS's, fully The basic cause has been agreed
understand all reactivity instructions in your operating procedures upon by most experts who
and be knowledgeable about why your safety systems (e.g. investigated this event: a significant
interlocks, relief devices, scrubbers) are there and how they work. quantity of water entered the MIC
- If a material in your area reacts with water: 1) be cautious storage tank. Water reacted with
when washing equipment for maintenance or whenever a water MIC, temperature and pressure rose
hose is used, and 2) remember that compressed air may contain and several safety systems could not
condensed water – be sure process air is free of water before deal with the event. Eventually, the
blowing lines. vessel's relief device lifted,
- Understand the emergency procedures you are to take if the releasing MIC vapor.……
temperature or pressure increases quickly in vessels storing
hazardous materials, especially those which are reactive. 20 years later, the exact water
source remains controversial.
- Encourage your management and technical group to have a
discussion about the “worst case” for the facility you work in and However, it is clear that installed
what safeguards have to be maintained to prevent that scenario safety systems did NOT prevent a
from occurring. large release of toxic gas.
Understand the "worst case scenario“ & “layers of protection” for your facility!
for the purpose of resale by anyone other than CCPS is strictly prohibited. Contact us at ccps_beacon@aiche.org or 212-591-7319
This edition is also available in Spanish, French, Portuguese, Chinese and German. Contact CCPS at ccps_beacon@aiche.org for information.
Sponsored by CCPS
Process Safety
Incident Database
http://www.aiche.org/CCPS/Publications/Beacon/index.aspx (PSID)
Messages for Manufacturing Personnel (http://www.psidnet.com/)
BLEVE! November 2009

Twenty-five years ago, on November 19, 1984, a major fire
and series of catastrophic explosions occurred at a Liquefied
Petroleum Gas (LPG) storage and distribution terminal in
Mexico City. About 600 people were killed, around 7,000
injured, 200,000 people were evacuated, and the terminal was
destroyed. The blasts were detected on a seismometer 20
kilometers from the terminal. Nine explosions were recorded,
the largest being 0.5 on the Richter Scale.
Because of the damage, the cause of the accident was not
definitely established. It appears that a large quantity of LPG
leaked from a pipeline or tank, spilled into a walled enclosure,
and formed a flammable vapor cloud which ignited. The
resulting flash fire and explosion impacted other LPG storage
spheres, tanks, and piping, releasing additional LPG and
exposing other tanks to fire. Many of the explosions were of a
type called Boiling Liquid Expanding Vapor Explosions
(BLEVEs). These were caused by the failure of LPG vessels
which had been exposed to flames or heat from the fires.
After the incident, it was reported that there had been many
problems with inoperative or bypassed safety devices, a missing
relief valve, poor housekeeping, and inaccurate instruments.

• A BLEVE occurs when a vessel containing liquid above its normal • Be sure that the fixed water spray fire
boiling point and under pressure fails catastrophically. When the protection systems in your plant are
vessel fails, the pressure immediately drops to atmospheric, and the available and working. They provide
hot liquid rapidly boils, generating a large quantity of vapor. The important protection against a BLEVE.
damage is caused by the pressure wave from rapid expansion of the • Understand firefighting procedures to
released vapor, and from flying pieces of the vessel and piping. If the protect emergency response personnel.
material is flammable, it can ignite and create a large fireball. • Know what the worst events that
• A BLEVE can occur for many reasons, including excessive could occur in your plant are, what
pressure in the vessel, damage to a pressurized vessel from systems are in place to ensure these
mechanical impact or corrosion, and exposure of a pressurized vessel events do not happen, and your
to external fire. responsibility to verify that these
• A vessel exposed to external fire may fail below its design pressure, systems are working properly.
resulting in a BLEVE, if the vapor space of the vessel is exposed to • Immediately report any problems
flames. The flames heat and weaken the metal, causing it to fail. with protective safety systems and
• Water spray fire protection systems such as fixed deluge systems or follow up to make sure they are fixed.
fire water monitor nozzles are an effective way to keep vessels cool
PSID Members Free Search for
enough to maintain their mechanical integrity when exposed to fire.
“BLEVE”
Be aware of the potential for a BLEVE if there is a fire in your plant!

Sponsored by
CCPS
October 2009
Overflow + Ignition = Tank Farm Fire! (Part 2)
A large storage tank containing a flammable
liquid overflowed. Two operators responded to
the report of a possible spill by driving a truck to
the area to investigate. Within minutes, there was
a loud explosion followed by a fire. It is believed
that the truck provided the ignition source. It
took emergency response personnel a day and a
half to extinguish the fires which spread through
the tank farm. More than a dozen employees
were hospitalized and there was significant
property damage.
See the September 2009 Beacon for a discussion of what you can do to prevent tank overflow.
• An internal combustion engine (gasoline or diesel) can be • Never drive into an area where you
an ignition source for a flammable vapor cloud. Internal suspect there might be a flammable vapor
combustion engines are commonly used in motor vehicles, cloud!
and also in other portable equipment used in plant operation, • Remember that other equipment driven by
maintenance, and construction. an internal combustion engine can also act
• The temperature of hot surfaces of an engine can exceed the as an ignition source. Such equipment might
autoignition temperature of many common flammable vapors. include mobile or portable generators, air
• If a flammable vapor is present in the air taken into an compressors, engine driven pumps, and
engine, the flammable vapor provides additional fuel and can lawn mowers, for example.
cause the engine to run faster. • Many plants which handle flammable
• Diesel engines have been reported to continue running using materials require a hot work permit for
the flammable atmosphere as a source for fuel and air. The operation of a motor vehicle or other engine
reason is that diesel engines operate by igniting the fuel by in certain areas. You should be familiar with
compression heating while gasoline engines use spark plugs. your plant policies and requirements and
always follow them.
• If the engine of a vehicle you are driving
begins to rev up by itself, shut it down and
get out immediately. You may have driven
into a flammable atmosphere!
• Some facilities require that all engines be
fitted with a positive air shut off. Know if
your plant requires this. If it does, make sure
that you are fully trained on how this
equipment works, how and when to use it,
What was left of the truck! and how to maintain it.
Don’t drive into an explosion!

Sponsored by
CCPS
September 2009
Overflow + Ignition = Tank Farm Fire! (Part 1)
A large storage tank containing a flammable liquid
overflowed. The spill was not detected until a
security guard noticed a strong odor. He immediately
reported his concern to operations personnel. Two
operators responded, driving a truck to the area to
investigate. Within minutes, there was a loud
explosion followed by a fire. It is believed that the
truck provided the ignition source. It took emergency
response personnel a day and a half to extinguish the
fires which spread through the tank farm. More than
a dozen employees were hospitalized and there was significant property damage. The incident investigation
found that the tank was being filled and, unknown to the operators, the tank level gauge AND the high level
alarm had failed. The operators did not monitor the filling operation closely because they believed that the
tank still had plenty of capacity.
Coming in the October 2009 Beacon -- More lessons from this incident
including discussion of motor vehicles as potential ignition sources.

• Overflowing a tank or other process vessel has • Recognize that transferring a flammable liquid is a
been an important contributing cause to many hazardous operation with significant consequences if
major incidents in the process industries. Recent something goes wrong. Monitor flammable liquid transfers
examples include the Texas City, Texas refinery closely so you can detect and respond to spills and leaks.
explosion in March 2005 (a distillation column • Before starting a transfer, make sure there is enough
was overfilled), and the Buncefield, England fire room in the destination tank for the material you intend to
in December 2005 (overflow of a flammable liquid transfer. Check both source and destination tank level,
storage tank). temperature, and pressure at frequent intervals during
• In many overflow incidents, there has been a transfers, and investigate any unexpected variation in the
failure of vessel level instrumentation and high rate of change.
level alarms. • When transferring liquids, estimate how much time it
should take to fill the destination tank at the expected flow
rate, and investigate if the transfer takes too long.
• Complete each step of the transfer procedure before
moving on to the next step, and record and sign off on the
procedure if required.
• If you are aware of the failure of any critical instruments
or alarms in your plant, report them immediately so they
can be repaired.
• Follow up on reported failures to make sure that repairs
are made in a timely fashion.
Don’t try to put 10 gallons of liquid in a 5 gallon pail!

Japanese, Korean, Malay, Marathi, Norwegian, Persian, Polish, Portuguese, Russian, Spanish, Swedish, Thai, Turkish, and Vietnamese.
Sponsored by
CCPS
August 2009
Never underestimate the hazard!
In December 2008, a graduate student was
working in a university research laboratory. She
was attempting to transfer approximately 2 oz.
(60 ml) of t-Butyl Lithium from one laboratory
container to another. T-Butyl Lithium is a
pyrophoric material – it ignites spontaneously
when exposed to air. The initial investigation of
the incident found that the student had not been
properly trained on the transfer procedure, and
was not wearing the proper clothing and
personal protective equipment. The material was
released, splashed onto the student, caught fire,
and set her clothing on fire. She suffered serious
burns, and died of her injuries several weeks
later.
When you work in a plant which contains
large quantities of flammable or toxic hazardous
materials, you may underestimate the hazards of
materials which are handled in small quantities.
Nearly all plants require that samples be taken
and transported to a laboratory for analysis. Many plants have in-plant laboratories where plant operators carry
out quality control tests. These operations involve small quantities of materials. The laboratory tests may also
require the use of chemicals which are not handled anywhere else in the plant, and you may not be as familiar
with the hazards of these materials. Remember that even a small quantity of a hazardous material can cause
serious injury, damage, or even a fatality.
What can you do?

• Know the hazards of all chemicals you work with, even if you only use small quantities. Don’t forget any
chemicals that are only used in small amounts in your plant quality control laboratories.
• Respect all hazardous materials, even if you handle them in small quantities.
• Make sure that you are fully trained on all plant sampling operations, and on how to use any special
equipment required to safely take and transport samples.
• Understand what kind of protective clothing and personal protective equipment is required to protect yourself
from the hazardous materials you work with, and always use all of the required protective clothing and
equipment, including when working in the laboratory.
• Know where to find, and how to use, emergency equipment such as safety showers and eye wash stations
when you are handling chemicals.
• Always use the required containers for taking samples, and proper sample carriers for transporting samples.
• When you take a sample to a laboratory, make sure that you follow procedures to ensure that it is received by
qualified laboratory personnel, and that they know what is in the sample container, including proper labeling.
Even a small amount of a hazardous chemical is dangerous!

Japanese, Korean, Malay, Marathi, Norwegian, Persian, Polish, Portuguese, Russian, Spanish, Swedish, Thai, Turkish, and Vietnamese.
Sponsored by
CCPS
July 2009
What is a Safety Instrumented System?
Alarm
Instrument Air
High Pressure
PT initiates shutdown Vents
S
Pressure Pressure > 100 psi Valve is closed
(Field Sensors) (Logic Solver) (Final Elements)
A safety instrumented system (SIS) takes automated action to keep a plant in a safe state, or to put it into a
safe state, when abnormal conditions are present. The SIS may implement a single function or multiple
functions to protect against various process hazards in your plant. There are many other names that you may
use for this kind of a system, for example, safety shutdown system, emergency shutdown system, safety
interlock, protective instrumented system, or safety critical system. In most cases, each function in an SIS
consists of three components, as shown in the drawing above:
• a sensor which monitors the process to detect an upset or abnormal condition (for example, a
pressure sensor)
• a logic device which receives the signal from the sensor, determines if the condition is hazardous,
and, if so, sends a signal to take action
• a final control device, which receives the signal from the logic device and implements the
appropriate action in the plant (for example, opening or closing a valve, shutting down a pump)
SISs are designed at different safety integrity levels (SILs) based on the risk posed by the process hazard.
The higher the SIL, the more likely there will be multiple, redundant components (for example, more than one
sensor, logic solver, or final element) and more rigorous testing and management requirements.

• Safety systems, such as an SIS, are covered by a • Understand the causes and consequences of
design basis and a mechanical integrity (MI) abnormal operation in your plant.
program. • Know if you have an SIS in your plant, how it
• SIS MI includes procedures for inspection, works, what conditions cause it to act, what it does,
preventive maintenance, proof test, and repair. and what you must do if the SIS activates.
• MI frequency is specified to ensure that the SIS is as • Know where to find the documentation for the SISs
reliable as required by the plant designer. in your plant.
• MI relies on knowledgeable people who follow • Make certain that SISs are properly inspected and
rigorous work practices to determine the condition of tested so they remain in good working condition.
the SIS equipment. • Notify your supervisor if an SIS is not working
• When an SIS is activated, you should know what properly, and follow your plant procedures to
actions to take, such as emergency response maintain safe operation while repair is completed.
activities.
Know how the Safety Instrumented Systems in your plant work!

Japanese, Korean, Malay, Marathi, Norwegian, Persian, Polish, Portuguese, Russian, Spanish, Swedish, Tamil, Thai, Turkish, and Vietnamese.
Sponsored by
CCPS
Don’t forget safety in a difficult economy! June 2009
Economic times are difficult in nearly every country. Sales and profits are down and many companies are
losing money. Plants are operating at reduced rate, and some are being shut down. As profits fall, there is
increased pressure to reduce operating cost, including reduction in staff. More frequent shutdowns and
startups, or operation at reduced rates, may impact safe operations and stress people. The increased stress on
workers can cause inattention to detail and mistakes. Despite these pressures, both management and workers
must remain focused on safety, and process safety. Ensure that training and preventive maintenance, both
essential to safety and long term economic success, are not compromised. Decisions to reduce staffing need to
be carefully considered using your facility’s management of change process, and you must ensure that safety
critical activities are not compromised by staff reductions.
Even during economic downturns, spending for needed process safety measures must be
maintained ... companies should weigh each decision to make sure that the safety of plant
workers, contractors, and communities is protected. In the long run, companies that continue
to invest in safety will reap benefits far into the future.
-- John Bresland, Chairman, United States Chemical Safety and Hazard Investigation Board
What can you do?

• Maintain continued emphasis on safety values and standards in a difficult economy. We must maintain our
focus on process safety under all circumstances..
• Understand what activities are safety critical in your facility, and make sure these activities are not
compromised by economic pressures.
• Suggest opportunities to perform important safety related maintenance and modifications and improvements
during periods of reduced demand. The recession may present a good opportunity to conduct these activities.
Market demand is low and the plant may be shut down or running at reduced rate anyway.
• If you are aware of critical safety equipment or safety activities which are being adversely impacted by cost
saving measures, make sure that your management is aware of the issues Decisions may have been made on
cost without fully understanding the potential safety impact.
• Use management of change reviews to fully understand the impact of all changes, including staffing changes,
reduced operating rate, changes in operating schedule, and other cost cutting plant modifications.
Don’t let short term economic pain cause long term safety damage!
Japanese, Korean, Malay, Marathi, Norwegian, Persian, Polish, Portuguese, Russian, Spanish, Swedish, Tamil, Thai, Turkish, and Vietnamese.
Sponsored by
CCPS Process
http://www.aiche.org/CCPS/Publications/Beacon/index.aspx Safety Incident
Messages for Manufacturing Personnel Database (PSID)
Mechanical Integrity May 2009
1 2 3
A compressed air tank failed, blowing the bottom off of the
tank (1) and sending fragments flying into a concrete wall,
puncturing the wall (2). Investigation following the incident
revealed several serious problems with the condition of the
tank, including severe corrosion and rust at the bottom of the
tank (3), where it failed, and an improper weld repair (4)
which had been made to the tank at some time in the past.
Although the weld repair did not contribute to this incident, it
is a symptom of improper maintenance and inspection, and
could have caused a tank failure. Fortunately, nobody was in
4 the area when the tank failed, and there were no injuries.
What can you do?

• Look at vessels, piping, and other equipment as you walk through your plant, and report anything which appears to be
corroded or improperly maintained. Include visual inspection of piping, vessels, compressed gas cylinders, and other
equipment in routine safety inspections. Follow up and make sure that problems are corrected.
• Understand the equipment inspection and maintenance program in your plant, and understand your role in ensuring that
all activities are completed as required.
• When you do mechanical work that requires removal of insulation from equipment, take the opportunity to look at the
condition of the equipment and report any corrosion or other problems that you observe. Corrosion under insulation may
be hidden, but mechanical work which requires removal of the insulation provides an opportunity to observe problems.
• Make sure that all welds and other repairs follow all required standards, and meet the original design specifications for
the equipment.
• Assure that all pressure vessels in your plant, including portable tanks and tanks which are a part of “packaged
systems” (for example, compressors, refrigeration units, compressed air systems, etc.), are included in the plant
mechanical integrity inspection program and are being inspected by qualified pressure vessel inspectors. This may
include inspection for internal corrosion at an appropriate frequency.
• Make sure that compressed air tanks and other portable compressed gas cylinders are stored in dry locations to prevent
external rust and corrosion.
Watch out for damaged or corroded equipment!

Japanese, Korean, Malay, Marathi, Norwegian, Persian, Portuguese, Russian, Spanish, Swedish, Tamil, Thai, Turkish, and Vietnamese.
Sponsored by
CCPS Process
http://www.aiche.org/CCPS/Publications/Beacon/index.aspx Safety Incident
Messages for Manufacturing Personnel Database (PSID)
Be Prepared! April 2009
Passengers and
crew evacuating
US Air Flight
1549 following
emergency
water landing in
the Hudson
River in New
York City Æ
The passengers and crew of US Airways Flight 1549 from New York City to Charlotte, North Carolina expected a
routine flight on January 15, 2009. But, approximately 2 minutes after takeoff, the plane struck a flock of birds and lost
power in both engines. The plane was at low altitude (about 3000 feet, 1000 meters), had no power, and was in a large
urban area. There was danger, not only to passengers and crew, but to tens of thousands of people on the ground. It was
time for the crew (Captain Chesley B. Sullenberger, First Officer Jeffrey B. Skiles, and Flight Attendants Sheila Dail,
Doreen Welsh, and Donna Dent) to put everything they had learned from many years training and experience into
practice, and quickly. The pilots determined that they could not re-start the engines, and did not have sufficient altitude
to glide to any airport. Their only option was a water landing in the Hudson River. The cabin crew prepared passengers
for an emergency landing, while the pilots prepared and flew the aircraft. The pilots successfully landed in the Hudson
River west of mid-town Manhattan. All 150 passengers and 5 crew members safely evacuated the plane and were
rescued by nearby commercial and rescue boats. The time from when the airplane struck the birds until it landed in the
river was about 6 minutes! The entire crew was later awarded the Master's Medal of the Guild of Air Pilots and Air
Navigators for “a heroic and unique aviation achievement.”
What can you do?

A manufacturing process, like a modern airplane, is a complex machine. Most of the time, it works very well,
but you never know when something might go wrong and you will have to respond to an emergency. You
must always be prepared by understanding your plant, how it works, how it will respond to your actions, and
what to do in an emergency. And, you can also understand the hazards of your plant, anticipate what might go
wrong, and how you should respond.
• Take training seriously. For example, every airline flight begins with a safety awareness announcement – do
you pay attention to it? Emergencies are rare, but they can happen to you. You must know how to respond.
You may not have much time to decide what to do, and preparation and training are critical to proper action.
• Before starting any activity, take a few moments to think about what might go wrong, what the potential
consequences are, how your equipment will react, and what you will do. If you don’t know, get help from your
supervisor, and do not start the activity until you are comfortable that you understand how to respond to an
emergency.
• Participate in emergency response and “table top” PSID Members Free Search for “Emergency
drills so you are better prepared. Response" and "Evacuation”
Training and forethought prepare you for emergencies!

Sponsored by
CCPS
March 2009
Fatality caused by unloading the wrong chemical into a storage tank!
A truck of sodium hydrosulfide solution arrived at a factory at about 3:30

AM, and was to be unloaded to a storage tank in the area near the top center
of the diagram at the right. The truck driver had never been to the plant
before, and asked the plant shift supervisor for assistance. The shift
supervisor had been told to expect a chemical shipment, and assumed that
the chemical would be ferrous sulfate, which is the only chemical that he
had ever received on his shift. He directed the truck driver to the unloading station for ferrous sulfate, where the truck is
shown in the diagram. The shift supervisor did not verify the identity of the chemical in the truck, although the shipping
papers did properly identify the contents as sodium hydrosulfide. The supervisor signed the shipping papers without
reading them and left the area. No plant employees remained in the unloading area.
The truck driver connected his truck to a hose which was connected to the ferrous sulfate storage tank as shown in the
photographs. He began to unload the sodium hydrosulfide solution into the ferrous sulfate tank. Unfortunately, sodium
hydrosulfide and ferrous sulfate react to form hydrogen sulfide, a highly toxic gas. Shortly after the unloading began, a
plant employee in the basement of the building noticed a pungent odor and lost consciousness. He regained
consciousness and made his way outside where he got help from other employees, who called emergency response
personnel. They found the truck driver unconscious inside the building, and he was pronounced dead at the scene.
Investigators determined that the driver had been overcome by hydrogen sulfide gas.
What can you do?
• ALWAYS positively confirm the identity of any chemical which you add to any vessel. Check the identity of the
material, double check it, and then check it again before beginning the chemical transfer!
• NEVER assume that you know the contents of any truck, railroad car, drum, or other raw material container which
arrives at your plant without carefully checking all labels, vehicle placards, and shipping papers.
• Follow all of your plant’s procedures for identifying materials, which might include checking shipping papers, letters of
analysis, or sampling and testing incoming materials. Ensure that all unloading personnel are trained and understand
procedures. If unloading procedures do not exist at your facility, communicate the deficiency to your supervision.
• Remember that the consequences of accidently mixing incompatible chemicals can be severe – including potential for
explosion or generation of highly toxic materials.
• Be aware of potential hazardous reactions between chemicals stored at your facility. Consider use of special fittings and
unloading connections to make unloading mistakes more difficult, helping to prevent them.
• Make sure that all unloading connections and pipes, as well as all storage tanks, are clearly labeled.
Never add any chemical to a vessel without confirming that it is the right material!
Sponsored by
CCPS
February 2009
More lessons from fire while filling containers
As promised in the January 2009 Beacon, we will discuss another
lesson from the incident reviewed in both the December 2008 and
January 2009 issues of the Beacon. A fire started in a packaging area
while a 300-gallon portable steel tank (a “tote”) was being filled with
ethyl acetate. In previous Beacons, we discussed static electricity as
an ignition source, the importance of bonding and grounding, and the
use of dip pipes or bottom loading for filling containers with
flammable liquids. In this issue we will discuss another important
lesson from the same incident.
The consequence of this incident became much more severe
because the initial fire spread to an adjacent flammable material
storage warehouse. The wall separating the two areas was not fire-
rated. Large non-fire-rated doors between the warehouse and
packaging area were kept open, and were not equipped with self-
closing mechanisms. Also there was no fire protection system
(sprinklers or other fire suppression system) in the flammable
material packaging area.
Spill containment is important whenever you are filling containers with any material, whether flammable or not. For
flammable materials, containment helps to limit the area potentially impacted by a fire. And, for all materials
containment keeps spills from getting into drains, sewers, surface water drainage, or onto uncontaminated soil. While
improper spill containment was not identified as a factor in this particular incident, the incident is a reminder of why
containment is important.
What can you do? A Review
• Conduct flammable material container filling operations in areas We have done three Beacons (December 2008,
which have been properly designed for this service. This would January 2009, and this issue) on a single incident
include, for example: which occurred while filling containers with a
• Adequate fire protection facilities flammable liquid. When filling containers or other
• Separation of equipment, fire walls and fire rated vessels with flammable liquids, you should strongly
doors consider these safe design features:
• Spill containment. • bottom filling
• Proper electrical classification of all equipment • grounded/bonded equipment
• Be sure that there is proper spill containment around any • spill containment
containers which you are filling. The spill containment must be • inert gas in vapor space (nitrogen or carbon
liquid tight, made of a material appropriate to contain the liquid dioxide, for example)
being handled, and of sufficient size to contain a spill which • liquid inlet velocity controlled until dip pipe
could occur. covered
• Conduct a management of change review for any unusual • some type of emergency shutoff
operations which involve filling of containers in areas not • sprinkler system, or other fire protection system
originally designed for that purpose, and be sure to consider • other features as required by codes and
ignition source control, fire protection, and spill containment in standards for safe handling of flammable liquids
this review.
Fill flammable liquid containers in properly designed areas!

The Beacon is usually available in Afrikaans, Arabic, Chinese, Danish, Dutch, English, French, German, Gujarati, Hebrew, Hindi, Hungarian,
Indonesian, Italian, Japanese, Korean, Malay, Marathi, Persian, Portuguese, Russian, Spanish, Swedish, Tamil, Thai, Turkish, and Vietnamese.
Sponsored by
CCPS
January 2009
Fire while filling portable container!
If you read the December 2008 Beacon, you will notice
that the pictures are the same! Yes, this is the same
incident. A fire started in a packaging area while a 300-
Figure 1:
gallon portable steel tank (a “tote”) was being filled with Actual fill
ethyl acetate. See the December Beacon for more system
information. In December, we discussed the importance of
proper bonding and grounding of all conductive equipment
to prevent static electric sparks, which can ignite a
flammable atmosphere. We have often emphasized in the
Beacon that all incidents have multiple lessons, and we are
using the same incident to make several additional points.
Note, as shown in Figure 1 (top), that the tote was being
filled with a short nozzle, and the flammable ethyl acetate
dropped into the tote as a stream through the air, and
undoubtedly also formed small droplets and mist particles.
Static electric charge can be created by liquid freely
falling through air, and can result in sparks which can
cause ignition of a flammable atmosphere.
The recommended practice (by the National Fire
Figure 2:
Protection Association – NFPA 77) for filling portable Recommended
metal tanks is to bottom-fill, which can be done with a dip fill system
pipe. You should use a slow velocity of 1 meter per second
(3.3 feet per second) or less until the dip pipe is submerged
to about 150 millimeters (6 inches). Figure 2 (bottom)
shows the recommended system.
We are still not finished with this incident! We will talk
about some more lessons in the February Beacon. PSID Members Free Search for "Static Charge"
What can you do?

• Always use properly designed equipment for filling any containers with flammable liquids. Some things to
consider:
• Use dip pipes or bottom filling
• Use appropriately low flow rate when there is potential for free falling liquid
• Properly ground and bond all equipment and containers
• Use fill nozzles and hoses designed for flammable material handling, for example, a hose with an
integral metal braid bonded to piping or fittings connected to the hose
• When you read the BEACON, look for other lessons from the incidents described. We have a limited amount
of space, and there is much more to learn from the incidents we discuss than we can describe in a single page!
Avoid free fall of flammable liquids when filling containers or tanks!

On behalf of all of the readers of the Beacon in 29 languages, CCPS
and the CCPS Process Safety Beacon Committee would like to thank
all of our volunteer translators for their efforts on behalf of process
safety throughout the world in 2008.
All translators are volunteers, and the only compensation that they receive is the knowledge that their efforts are helping
to improve process safety throughout the process industries. Because of their volunteer efforts, CCPS is able to distribute
the Process Safety Beacon in 29 languages as of December 2008. If you know, or meet, any of our translators in the
course of your work, please thank them personally for their work. If you are interested in translating the Beacon into a
language which is not currently available, please contact us at ccps_beacon@aiche.org and we will provide you with
information on the procedure for translation.
Afrikaans: Francois Holtzhausen, Sasol Korean: Hwan Bae, SK Corporation

Arabic: Khalid Walid Haj Ahmed, Alfaisal Malay: Pillai Sreejith, Trident Consultants
University and Amiruddin Bin Abu Bakar,
PETRONAS
Brazilian Portuguese: Antonio Lauzana, Marathi: Shirish Gulawani, Excel
Petrobras / Repar Industries Ltd., and Thermax Limited
Chinese: Li Yi, Kunming Cellulose Fibers Persian (Farsi): Mostafa Sadeghpour
Co., Ltd National Iranian Oil Refinery and
Distribution Company(NIORDC)
Danish: Martin Anker Nielsen and Ole Polish: Fabian Cieslik, 3M, and
Raadam, Becht Engineering Co., Inc. Agnieszka Majchrzak, Płock, Poland
Dutch: Marc Brorens, BP Rotterdam Portuguese: Nuno Pacheco, Repsol
Refinery Polímeros and Helder Figueira, DuPont
Safety Resources
French: Robert Gauvin, Pétromont Russian: Sergey V. Belyaev, EHS
Manager
German: Dieter Schloesser, Basell Spanish: Julio Miranda, ACM Automation
Inc.
Gujarati: Mayoor Vaghela, HELPS Safety Swedish: David Aronsson, DSM Anti-
Consultant Infectives
Hebrew: Yigal Riezel Tamil: Varun Bharti, Cholamandalam MS
Risk Services Ltd.
Hindi: Alok Agrwal, Chilworth Safety & Thai: Surak Sujaritputangoon, HMC
Risk Management Polymers Co., Ltd.
Hungarian: Maria Molnarne, BAM, Berlin Traditional Chinese: S.G.Lin, Taiwan
PolySilicon Corp.
Indonesian: IIPS Turkish: Hasim Sakarya, Dow
(Alvin/Darmawan/Vidya/ Wahyu)
Italian: Cesare Mazzini and Monia Vietnamese: Ha Van Truong, BP
Casana, Uniqema
Japanese: Takuya Kotani and
colleagues, SCE-NET
Sponsored by
CCPS
December 2008
Static Electric Discharge Causes Fire
A fire and series of explosions occurred in a chemical distribution
facility. The fire started in a packaging area while a 300-gallon
portable steel tank (a “tote”) was being filled with ethyl acetate, a
flammable material (figure). An operator placed the fill nozzle in the
opening on top of the tote and suspended a steel weight on the nozzle
to keep it in place. As the tote was filling, the operator heard a
“popping” sound and saw the tote engulfed in flames. The fill nozzle
was laying on the floor spilling ethyl acetate. Employees tried
unsuccessfully to extinguish the fire with a fire extinguisher, and then
evacuated the area. The fire spread to a warehouse, igniting other
stored flammable and combustible liquids. One employee received
minor injuries and a firefighter was treated for a heat-related illness.
Because of the smoke and rocketing barrels and debris, nearby
businesses were evacuated. The warehouse was destroyed and
business was interrupted.
It was determined that an ignitable vapor-air mixture formed near
the tote fill opening. While the body of the tote, the weigh scale, and
the pump were grounded, the steel parts of the fill nozzle and hose
assembly (and the steel weight) were not bonded and grounded, and
were isolated by the synthetic rubber fill hose. Static electricity likely
accumulated on these parts and sparked to the stainless steel tote
body, igniting the vapor that accumulated around the fill opening
during filling.

• Static electricity is generated when liquid • Ensure that conductive piping and
flows through pipes, valves, and other equipment is bonded and grounded,
equipment and properly designed for flammable
• Correct bonding and grounding ensures service. This includes vessels,
that static electricity does not accumulate pumps, pipe, valves, nozzles,
and cause a spark. instrument probes, filling pipes and
• Static sparks can ignite many flammable nozzles, drums and other portable
vapor-air mixtures. containers, and any other conductive
• Bonding is electrically connecting equipment.
conductive objects to equalize electrical • Make sure that ground connections
potential and prevent sparks. in your plant are regularly checked to
• Grounding is connecting a conductive ensure that they are working
object to the earth to dissipate electricity properly.
from accumulated static, or other sources. • When filling containers with
flammable liquids, minimize the
amount of free fall that can create
static in the liquid.
Always ground all conductive components of a flammable material handling system!

Sponsored by
CCPS
November 2008
Laboratory Refrigerator Explosions – Electrical Classification
The pictures show damage to two
laboratories resulting from explosions caused
by improperly stored flammable materials in
household refrigerators. Flammable materials
can accumulate in a closed space such as a
refrigerator, because of leaking containers or
spills. It is possible for the concentration of
flammable vapors to reach the lower explosive
limit, creating a explosive atmosphere. A
household refrigerator is not designed to
prevent ignition of flammable vapors, and has
many potential ignition sources – for example,
the interior light switch and light, the thermostat for the temperature control, and other internal wiring and
electrical components. A spark from any of these can ignite flammable vapors causing an explosion.
Process samples sometimes are stored in a plant control room, possibly only for a few minutes, but perhaps
for several months. The storage area electrical classification must meet the correct standards and samples must
be properly stored to prevent personnel exposure as well as fires and explosions. Even a laboratory hood can
contain ignition hazards.
While this incident occurred in a laboratory, there is a lesson for any facility which handles flammable and
combustible materials – make sure that all electrical equipment used in hazardous areas is properly
designed for use in these areas. And, you must also ensure that all equipment designed for use in areas
handling flammable and combustible materials is properly maintained. In particular, make sure that any
portable electrical equipment brought into a classified area is appropriate for use in that area. Your facility’s
electrical classification design is based on the potential risk of a flammable atmosphere, and determines the
design of electrical equipment which can be used safely in the various parts of the plant.

• What is the electrical classification • Make sure that all equipment used to store hazardous materials in your
for various areas in your plant? laboratories is properly designed and maintained for that service.
• How to recognize electrical • Learn about the electrical classification of hazardous areas in your
equipment, particularly portable workplace.
• Learn to recognize the proper electrical equipment for use in hazardous
equipment, which is not appropriate
areas.
for use in hazardous areas? • Do not bring portable electrical equipment into a classified area without
• How to recognize potential ensuring that it is properly designed for that area classification.
problems with electrical equipment • When doing routine safety inspections, inspect wiring of instruments,
in hazardous areas – for example, motors, lights, switches, electrical boxes, and other electrical equipment to
damage to wiring, damage to make sure it is properly installed and maintained.
enclosures and gaskets? • When bringing samples into a general use area, make sure that the storage
location is designed for the hazards of the samples.
Understand how to safely use electrical equipment in hazardous areas!

Sponsored by
CCPS
October 2008
Ice ruptures unused pipe and causes fire!
A section of piping in a refinery unit was taken out
of service during a process modification. The
unused piping was not physically removed, nor was
it isolated from the active piping with slip blinds.
Instead, it was isolated from the connected piping by
closed isolation valves. The active piping contained
liquid propane under high pressure, and the propane
contained a small amount of liquid water entrained
as a separate water phase. Debris jammed in the seat
prevented one of the isolation valves from closing
fully. This allowed wet liquid propane to leak from
the active piping into the unused piping. The water,
which is heavier than propane, accumulated at a
low point in the unused piping. During the winter, the water which had accumulated in the
unused piping froze. When water freezes it expands, and this expansion caused a crack in
the unused pipe. When the weather warmed, the ice melted and propane leaked from the
active piping through the leaking isolation valve, and then out through the cracked pipe. A
large flammable vapor cloud formed and ignited. The resulting fire caused four injuries, the
refinery had to be evacuated, and it was shut down for nearly two months. The fire caused
major damage to other equipment and piping, resulting in additional release of flammable
materials and escalation of the fire. More than two tons of chlorine was also released from
containers impacted by the fire.
• It is easy to forget about “unused” equipment and piping, • Make sure that all process modifications, including
particularly when it has been out of service for many removal of equipment or piping from service, have a
years. This equipment may not be inspected, and it may be management of change review.
left out of operating procedures such as draining • Make sure that all equipment in your plant which is not in
condensate out of low points, and freeze protection routine use is either physically disconnected from active
programs. equipment and piping, or positively isolated using slip
• Valves can leak, and cannot be relied upon to provide blinds or other reliable isolation systems.
positive isolation of piping and equipment. • Consider potential hazards of accumulation of material in
• Water, unlike most materials, expands when it freezes. If pipe branches which are not routinely used, or which have
the water is isolated in a closed piece of equipment or an low flow rates.
isolated section of pipe, the ice formed by the freezing • Be prepared for cold weather in winter. Make sure that
water causes enormous pressure and is capable of you follow procedures to prepare the plant for winter, to
rupturing pipe and equipment. prevent freezing of critical equipment.
• Branch connections of process piping with little or no
flow may create the same hazard of water accumulation at
low points.
PSID Members use Free Search for "Isolated."
Is your unused piping and equipment disconnected or positively isolated?

Indonesian, Italian, Japanese, Korean, Malay, Marathi, Persian, Polish, Portuguese, Russian, Spanish, Swedish, Tamil, Thai, Turkish, and Vietnamese.
Sponsored by
CCPS
Plant Security September 2008
On this anniversary of terrorist attacks on the United States in
September 2001, we remember that such attacks have occurred
in many other places throughout the world, before and after the
New York and Washington attacks (for example, the Tokyo
subway; London; Madrid; Bali, Indonesia; Ahmedabad, India;
several attacks in Russia, many incidents in various countries in
the Middle East). There are few countries which have not had
experience with sabotage or terrorist attack. The hazardous
nature of the materials handled in the process industries requires
everyone’s vigilance to ensure that our plants are secure, to
protect ourselves, our fellow employees, and our neighbors. If
you work in a chemical storage or processing facility, you are in the best position to observe and address
potential security vulnerabilities in your plant. As you go about your work, look for potential security problems,
and report them to management so they can be corrected.
What can you do?
As you work in the plant every day, you have opportunities to see potential
security problems. Look for them, and report them. Here are a few examples,
and you and your management can easily develop a much longer list:
• Security lights which are not working, or are inadequate if they are working
• Broken latches on gates or doors in the plant fence
• Loose gates, or gates with large gaps under them
• Gaps in or under fences, damage to fences, fences which are too low,
erosion of the ground under fences A fence overgrown with
bushes and trees
• Objects near fences on the outside which would assist in climbing over the
fence
• Chains and locks improperly secured
• Gates, doors, or windows on the outside boundary of the plant left open, or
propped open.
• Gates or doors to the outside which get stuck without fully closing
Also, you should know and follow the security procedures at your plant – for
example: Cars parked near a fence can
help intruders climb the fence
• Always wear required identification badges, and, if you see somebody
without proper identification, report it to your supervisor or security officers.
• Don’t let other people borrow your plant access card or identification card.
A lock on the web of a chain link fence – not as strong

as if chained and locked around the fence post
Plant security is everybody’s responsibility!

Sponsored by
CCPS
August 2008
Measuring Process Safety Performance
The July 2008 Process Safety Beacon discussed the
meaning of “Process Safety”, and also said that traditional
measures of safety performance such as injury rates, lost
time injuries, etc., are not good measures of how good a
job we are doing on process safety. So, how can we tell
whether or not our process safety management activities
are effective? How can we tell if our performance is
improving over the years? How do we know how one
plant, or unit in a plant, is performing compared to others?
How will we decide where to focus our attention so we
can get better? If the traditional safety measures are not
good for monitoring process safety performance, we need
to invent new measures that will. Many industry
organizations, including CCPS, are actively working to develop new ways to measure process safety
performance. But these tools cannot be effective unless everybody in the process industry workforce
understands what these tools are, and why they are needed. And, most important, we all have to understand
what our role will be in using any new process safety measurement tools. We need to understand what types of
events we need to report, and how to report them in our organization.

• CCPS, working with a number of industrial, labor, and • Understand what your company is doing to
government organizations, has developed tools for measure process safety performance. Learn
measuring process safety performance. The report and understand the specific measures that
recommending specific measurement tools was issued in your company is using.
December 2007, and can be found at the CCPS web site, • Know what kinds of incidents need to be
http://www.aiche.org/ccps/. reported under your company’s process
• Two types of measurements proposed – lagging indicators, safety measurement program.
which measure actual outcomes and past performance (the • Be familiar with how to report process
number of process safety incidents which have occurred), safety incidents in your plant.
and leading indicators which measure process safety • Be diligent in reporting incidents.
management activities, and which are believed to be useful Remember that a company cannot improve
in predicting future performance. process safety performance if it does not
• Lagging indicators will measure, for example, the number know about incidents that occur in the plant.
of releases of hazardous material or energy from plant • Understand leading indicators of process
equipment, fires and explosions, and process related injuries. safety performance for your plant and how to
• Leading indicators will measure, for example, plant report them.
mechanical integrity, action item follow up, management of • Download and read the CCPS report on
change, and process safety training. measuring process safety performance.
How does your organization measure process safety performance?

Sponsored by
CCPS
July 2008
What is “Process Safety”?
Not all hazards are the same or can cause equal consequences. Personal or occupational safety hazards, such
as slips, falls, cuts, and vehicle accidents usually affect one individual worker. On the other hand, process
safety hazards may cause major accidents involving the release of potentially dangerous materials, fires and
explosions or both. Process safety incidents can have catastrophic effects and can result in multiple injuries
and fatalities, as well as substantial economic, property, and environmental damage. Process safety incidents
can harm workers inside the plant and members of the public who reside nearby. That is why Process safety
management focuses on the design and engineering of facilities, hazard assessments, incident investigation,
management of change, inspection, testing, and maintenance of equipment, effective process controls and
alarms, operating and maintenance procedures, training of personnel, and human factors.
Process Safety Personal Safety

An Analogy
Professor Andrew Hopkins of the Australian National University suggests the following example to show the difference
between personal safety and process safety. An important safety concern in the airline industry is injuries to baggage
handlers from lifting and carrying – for example, back and muscle strains (personal safety). But no airline would ever
think that their efforts to reduce these injuries would improve flight safety (equivalent to process safety). Different
activities and programs are required to manage these different safety concerns.

• Good personal safety performance does not ensure • Understand the specific hazards of the materials
good process safety performance. While there is much in your facility and your responsibility in the safe
in common, such as a good safety culture and attitude, handling of these materials.
good process safety performance requires a thorough • Understand the specific hazards of the
understanding of the specific hazards associated with the manufacturing, storage, transport, repackaging, or
chemicals being handled or stored, and the process other processing operations conducted at your
operations being carried out in a particular plant. facility.
• Traditional safety measures such as injury rates, lost • Understand your role in process safety
time accident rates, and days lost from work may not be activities, including process hazard analysis,
good indicators of process safety performance. Next management of change, incident reporting and
month’s Beacon will discuss potentially useful process investigation, maintenance and testing, and
safety measures. following safe work practices and procedures.
Process safety is everybody’s responsibility!

Sponsored by
CCPS
Halon cylinder becomes rocket! June 2008

A fire protection system using Halon (a liquefied gas fire
Location of extinguishing agent) was being inspected. As part of the
valve impact
on concrete
system inspection, two employees were moving a Halon
platform cylinder to be weighed on a portable scale. The cylinder
was dropped and its top valve hit a concrete platform.
Trajectory
of cylinder The impact of the cylinder valve on the concrete caused
the threads on the screw connection which held the valve
on the cylinder to fail, resulting in complete separation of
the valve from the cylinder. The cylinder’s internal
Portable
pressure was 600 psig (~ 41 bar). The combination of
scale pressure and size of the cylinder hole caused the cylinder
to discharge its contents rapidly, and it flew through the
air like a rocket! It went nearly ¼ mile (0.4 km), over a tank farm and across two roads, before hitting a
fence. Fortunately, there were no injuries, no significant equipment damage, and no process releases as a
result of this incident.
Aerial view of
incident site
Control room Tank farm

building
Close up of valve
impact on concrete Close up of
Equipment
platform thread
yard
damage

• All compressed gas cylinders have the potential to • Treat every cylinder as capable of becoming a
become destructive missiles. projectile if dropped and the top valve sheared off.
• Fire protection system cylinders may be built to fire • Follow compressed gas cylinder safe handling
extinguisher standards, and may not have a requirements for securing cylinders from falling, and
requirement for a protective cap over the top valve using protective top valve caps, if they exist, for all
assembly for impact protection when handling. This cylinders when they are not in use.
may vary according to local regulations around the • Be aware of any compressed gas cylinders in your
world. facility which do not have provision for protective
• Fire protection system cylinders and other high-flow- caps, and handle them with particular care.
rate cylinders, including liquefied gases like propylene • The inspection and maintenance of Halon and other
used for torch-cutting, require larger flow openings fixed fire protection systems is often provided by
than most compressed gas cylinders. Because of the specialized and qualified outside contractors. Ensure
larger openings, these high-flow-rate cylinders have that your contractors handle cylinders safely.
greater thrust potential than standard compressed gas
cylinders.
Handle compressed gas cylinders with care!

Indonesian, Italian, Japanese, Korean, Malay, Marathi, Persian, Polish, Portuguese, Russian, Spanish, Swedish, Thai, and Turkish.
Sponsored by
CCPS
Is sugar an explosion hazard? May 2008
YES, if it is a fine powder or dust! Any material which can burn is

capable of causing a catastrophic dust explosion if it is suspended as a fine
dust or powder in air or other oxidizing atmosphere. On February 7, 2008
there was a severe explosion in a sugar refinery near Savannah, Georgia,
USA. The explosion injured more than 30 people, and the death toll had
reached 13 as of the end of March 2008. The explosion is still being
investigated, and the detailed causes are not yet known. However, the initial
investigation indicates that this was a dust explosion.
Many people are not aware of the explosion hazard of many dusts and
fine powders. Some examples of materials which may be a dust explosion
hazard if present as a fine powder include almost any organic material -
grain flour, sugar, plastic, corn starch, pharmaceuticals. Powdered metals
such as aluminum and magnesium also present a dust explosion hazard.
CCPS PSID
Members search
Dust Explosion
Do you know what conditions are necessary for a dust explosion?

The conditions needed for a dust explosion can be represented as a pentagon (see figure at left above):
• FUEL – The presence of a combustible dust. Particle size is important – smaller particles are more likely to be both
ignitable and dispersible.
• OXIDANT – usually oxygen in the air, which is generally enough to support an explosion.
• SUSPENSION – The dust needs to be dispersed into the air. The dust may normally be dispersed in air in the process
equipment. In a building, this could be done by a large leak or spill, a small initial dust explosion, or any other disturbance
which could shake dust layers off of equipment or lift dust off of the floor.
• IGNITION SOURCE – Energy is required to ignite the mixture. This may be something with as little energy as static
electricity or a stronger energy source such as an open flame or an electrical fault.
• CONFINEMENT – For example, the walls, ceilings, floors and roof of a building create confinement. Plant equipment
including process equipment, storage silos, dust collectors, and ducting also creates confinement..
Sometimes an initial explosion occurs and lifts larger amounts of dust that may have accumulated in the plant and
disperses this dust into the air. This creates the conditions for a second, much larger explosion, which can be catastrophic.
A small amount of dust – a layer as small as 1/32 inch (less than 1 mm) thick on exposed surfaces – can create an
explosive dust cloud once suspended. A dust layer can be considered to create a hazardous condition if it covers an area,
on all surfaces, greater than 5 % of the floor area of a room. How can you tell if there is too much dust? Two guidelines
which people have used are that there is too much dust accumulation (1) when you cannot tell the color of the equipment
or floor beneath the layer of dust, or (2) when you write your name in the dust and very slight ridges form at the edge of
the letters. Good housekeeping is a necessary safe work practice when dust hazards are concern. Other safe work
practices for dust include reducing static discharge potential through the use of grounding and bonding, proper electrical
area classification and equipment selection. If your plant handles potentially explosive dusts, make sure that you
understand the hazards, and all of the safe work practices and safety equipment needed for safe operations.
Know the hazards of the materials in your plant!

Sponsored by
CCPS
Gasoline pipeline damaged by construction causes fire April 2008
A construction crew was installing a new underground

water pipe. While digging, the excavation equipment
accidently struck and punctured a pipeline carrying
gasoline. The leaking vapors were ignited causing a
serious explosion and fire which killed five construction
workers, seriously injured four others, required
evacuation of people within ½ mile (0.9 Km) of the
incident site, severely damaged a nearby house, and
caused other property damage. A primary cause of the
incident was that the exact location of the gasoline pipe
was not known by the excavation workers. They were
following markings on the ground made by the pipeline
company, which were different from the engineering
plans. The engineering drawings showed the pipe curving
out around the trunk of a tree, which had been cut down
after the pipeline was built. Workers and supervisors did
not visually verify the pipe location using hand tools as
required by good practice.
Courtesy of Creative Commons ShareAlike 1.0 License:

Courtesy of CalOSHA http://creativecommons.org/licenses/sa/1.0/

This incident occurred in a trans- • Before starting any excavation operation, ask if anyone has
portation pipeline in a community, but verified the location of underground pipes, electrical cables, or
there are similar hazards in many other critical or hazardous items in the area to be excavated. This
chemical, refining, or other should be a part of your facility’s excavation permit program.
manufacturing facilities. Many plants • Conduct safety reviews before any construction activities.
have underground pipelines carrying • Report any near misses in excavation activities – pipes found
hazardous materials. These may be the where none were expected, or in a different location than expected.
plant’s own pipelines, or pipelines • Learn the location of any hazardous pipelines which go through
passing through the plant site which your facilities, and how to respond if there is a leak for any reason.
are owned and operated by somebody • If you are digging in the area of any pipelines or other hazardous
else – a pipeline company, a facilities, make sure you understand and are trained in appropriate
neighboring plant, or the local natural emergency procedures.
gas company.
CCPS PSID members – Use Free Search – “pipeline”
Know what is underground before you dig!

The Beacon is usually available in Afrikaans, Arabic, Chinese, Danish, Dutch, English, French, German, Gujarati, Hebrew, Hindi,
Hungarian, Indonesian, Italian, Japanese, Korean, Malay, Marathi, Persian, Polish, Portuguese, Russian, Spanish, Swedish, and Thai.
Sponsored by
CCPS
Do your shutoff systems actually work? March 2008
What happened?
A small chemical feed system was designed to refill
automatically. It had a high shut off interlock that
stopped the feed pump and closed a feed valve to
prevent overflowing the tank. The level control system
had a malfunction, the tank was filled above the design
level, and the high level switch tripped. Before the
control system could close the valves and stop the
pump, the tank overflowed. Fortunately, no employees
were injured and the spill was contained to limit
environmental damage.

While the system was designed with the correct • During a process hazard analysis, or any other safety
safeguards, they were not functional as a system. review, ask if anyone has verified that automatic shutoff
The pump and shutoff valve were too far from systems actually work effectively.
the receiving tank to stop flow before the tank
• When starting up a new or modified safety system, test
overflowed – the liquid in the pipe downstream
operation of the entire system to verify that it operates as
of the valve was enough to overflow the tank
intended.
even though the valve had closed. Alternatively,
the high level switch could be installed lower in • Review testing procedures for critical shut off systems,
the tank to shut the flow off sooner and account and make sure they actually test the complete system, not
for the materials between the shut off valve and just single components of the system.
the receiving tank. In general, it is good practice
• Do not accept small spills as the “cost of doing
to locate a device to prevent tank overflow as
business”. Small spills indicate problems which may be
close to the tank being protected as possible.
prevalent in the facility and should not be regarded as
normal. Where there is one inadequate design,
CCPS PSID Members:
maintenance practice, or operating procedure, others are
See "Free Search: Level Control" often present.
Don’t assume that safety systems work – check them!
The Beacon is usually available in Arabic, Chinese, Danish, Dutch, English, French, German, Gujarati, Hebrew, Hindi, Hungarian,
Indonesian, Italian, Japanese, Korean, Malay, Marathi, Persian, Polish, Portuguese, Russian, Spanish, Swedish, and Thai.
Sponsored by
CCPS
How Can You Use “The Beacon”? February 2008
One important issue in maintaining a good process safety culture in any organization is to
maintain a sense of vulnerability. In other words, we must always remember, and respect,
the hazards associated with our processes and materials. If we have good and effective
process safety management systems, one result is that we will have fewer incidents. This
can lead to complacency - we forget why we are doing all of the activities in the process
safety management system which result in good performance and few or no incidents. So, it
is important to use resources like "The Beacon" to remind ourselves of what can happen if
we don't do those activities – such as Hazard Identification and Risk Analysis (including
assigning our most knowledgeable people to Process Hazard Analysis studies), Operating
Procedures, Asset Integrity and Reliability, Management of Change, Emergency
Management, Incident Investigation, Auditing, and others. In all of the incidents we discuss
in the Beacon, there has been a failure in one or more of these important process safety
management systems

• Nearly all incidents are the result of more than one • Good – post the Beacon in places where workers will see
failure. Some failures result in near misses - that is they it and read it – for example, bulletin boards, locker rooms,
did not cause an incident this time, but could have. lunch rooms, control rooms, the gate house.
• Almost every month, “The Beacon” receives a number • Better – use the Beacon as the basis for safety meetings or
of emails pointing out other lessons that can be learned other safety discussions with operators and other workers.
from the incident discussed, which have not been included
• Better yet – Develop additional information which relates
in the Beacon.
the topic in the Beacon to the operations in your own plant,
• Because of the limited space available in “The Beacon”, including any similar incidents or near misses in your
we must pick one of the many lessons from each incident, company, and discuss this information with workers.
and focus the Beacon on that lesson. But there are always
• Best – Unit or plant management leads a discussion of
other lessons.
the Beacon with workers and challenges them to find other
• Whenever possible, if the reports on the incidents lessons in the incident described, beyond those discussed in
described are publicly available, we will provide a the Beacon. Challenge plant safety committees to use the
reference in the Beacon cover email note. Beacon in their work.
Learn from the experience of others!

The Beacon is usually available in Arabic, Chinese, Danish, Dutch, English, French, German, Gujarati, Hebrew, Hindi,
Hungarian, Italian, Japanese, Korean, Malay, Marathi, Persian, Portuguese, Russian, Spanish, Swedish, and Thai.
Sponsored by
CCPS
2007 Beacon Review – Remember the Lessons Learned! January 2008
The Beacon Committee would like to thank the following volunteer translators for their help
during 2007. Their efforts have made the Beacon a publication read around the world.
Arabic: Khalid Walid Haj Ahmed, Gulf Brazilian Portuguese: Antonio Chinese: Li Yi, Kunming Cellulose
Chemicals & Industrial Oils Co. Lauzana, Petrobras / Repar Fibers Co., Ltd
Danish: Martin Anker Nielsen Dutch: Marc Brorens, BP Rotterdam French: Robert Gauvin, Pétromont
Refinery
German: Dieter Schloesser, Basell Gujarati: Mayoor Vaghela, HELPS Hebrew: Yigal Riezel and Shlomit
Safety Consultant Magidovich
Hindi: Alok Agrwal, Chilworth Safety Hungarian: Maria Molnarne, BAM, Indonesian: Alvin/Darmawan/Vidya/
& Risk Management Berlin Wahyu - IIPS
Italian: Cesare Mazzini and Monia Japanese: Takuya Kotani and Korean: Hwan Bae, SK Corporation
Casana, Uniqema colleagues, SCE-NET
Malay: Pillai Sreejith, Trident Marathi: Shirish Gulawani, Excel Persian (Farsi): Mostafa
Consultants Industries Ltd Sadeghpour, National Petrochemical
Co.
Portuguese: Nuno Pacheco, Repsol Russian: Sergey V. Belyaev, EHS Spanish: Julio Miranda, JGM Process
Polímeros and Helder Figueira, Manager Safety
DuPont Safety Resources
Swedish: David Aronsson, DSM Anti- Thai: Surak Sujaritputangoon, HMC Traditional Chinese: S.G.Lin, Taiwan
Infectives Polymers Co., Ltd. Polypropylene Co., Ltd.
January:
Tank August:
Collapse Temporary
Confined
Spaces
April:
June: Emergency
Safety Response
Culture
November: September:
Cold Hot Work
Embrittle- Permits
ment
Did you know?

A key word indexed, searchable archive of all past issues of the CCPS Process Safety Beacon is available on the Internet
at http://sache.org/beacon/products.asp. The archive is free of charge for the “read only” version - past Beacons can be
viewed, but cannot be printed. To access the printable version of past issues of the Beacon, please contact CCPS for
information on membership in SACHE (Safety and Chemical Engineering Education).
Best wishes for a SAFE, happy, and productive 2008!

The Beacon is usually available in Arabic, Chinese, Danish, Dutch, English, French, German, Gujarati, Hebrew, Hindi,
Hungarian, Italian, Japanese, Korean, Malay, Marathi, Persian, Portuguese, Russian, Spanish, Swedish, and Thai.
Sponsored by
CCPS
Oil Tank Fire Caused by Static Discharge December 2007
An 80,000 barrel (3.6 million gallon, 12,700 cu. M.) floating roof storage tank
exploded and burned while being filled with diesel oil at a petroleum product
storage terminal. The tank contained approximately 7000 barrels (300,000
gallons, 1,100 cu. M) of diesel oil at the time of the incident, and had previously
contained gasoline. The fire burned for 21 hours and damaged two nearby
storage tanks. There were no injuries or fatalities, but the total loss was over two
million US dollars, nearby residents were evacuated, and schools in the area
were closed for two days.
Initially, the fire was blamed on a lightning strike, but a thorough incident
investigation by the United States National Transportation Safety Board (NTSB)
found that the causes included an improper procedure for switching the content
of the tank from gasoline to diesel oil, and an unsafe filling procedure. NTSB
concluded that the flow rate (velocity) of material flowing into the tank was too
high while the tank level was low and the incoming liquid discharged into the
vapor space of the tank, The high flow rate caused a static electric discharge in
the tank vapor space, which contained a flammable atmosphere.
Do you know? What You Can Do?

• Ensure that you have, and follow, safe operating procedures for any
• When changing the contents of any vessel routine change of the contents of a tank.
(tank, tank truck, railroad tank car), without • For a non-routine change of the contents of a tank, make sure that a
thoroughly cleaning the tank and purging the management of change review is done and that safe operating
vapors, you can possibly create an procedures are developed and used.
unexpected flammable atmosphere in the • To minimize the potential for static discharge, follow the guidelines in
tank. The flammable atmosphere might not API RP 2003. This requires that the velocity of material discharging
be expected based on the properties of the into a storage tank which can contain a flammable atmosphere be no
new material being introduced to the tank. more than 3 ft/sec until the fill pipe is submerged in the liquid, either 2
• High flow velocity of material discharging pipe diameters below the liquid level or 2 feet, whichever is less.
into the vapor space of a tank can cause • Learn more of the many lessons from this incident from the US NTSB
static levels sufficient to ignite flammable investigation report at:
vapor inside the tank. http://www.ntsb.gov/publictn/2004/PAR0402.htm
Remember that rapid flow of liquid into air can cause static electric sparks!
The Beacon is usually available in Chinese, Danish, Dutch, English,

English, French, German, Gujarati, Hebrew, Hindi, Italian,
Japanese, Korean, Malay, Persian, Portuguese, Spanish, Swedish, and Thai.
Sponsored by
CCPS
Cold Embrittlement and Thermal Stress November 2007
A pump which supplied hot oil to a heat exchanger

in a gas processing plant stopped for several hours.
With no flow of hot oil to the exchanger, the
temperature in the heat exchanger, normally 100
degrees C (212 degrees F) or higher, dropped to 48
degrees below zero C (54 degrees below zero F).
Ice was observed on the outside of the heat
exchanger. The hot oil pump was re-started, and hot
oil flow resumed to the heat exchanger. The low
temperature had caused the steel heat exchanger to
become brittle, and the 150 C temperature
differential from the sudden flow of hot oil caused
additional stress. This resulted in a brittle fracture of
the heat exchanger. A vapor cloud estimated to
contain more than 10 tons of flammable gas was
released, and subsequently ignited by a heater. The
explosion and fires killed 2 workers, injured 8
others, and the fire burned for 2 days. The gas
supply to a large part of Australia was disrupted for
nearly 3 weeks, impacting the lives of an estimated
4 million people. Total economic loss was estimated
at over 1 billion Australian dollars.
Do you know? What You Can Do
• Some steels and other metals can become brittle • Know the design temperature range of the
when exposed to very low temperatures. equipment in your plant – both the high and the
• Cold embrittlement can result in failure of process low temperature limits for safe operation.
equipment such as vessels, heat exchangers, or • Know if you have any equipment in your plant
piping. This failure can be rapid and catastrophic, which might be subject to cold embrittlement.
resulting in release of a large amount material. • Understand and follow all procedures which
• Introduction of hot material into a cold pipe, are required to ensure that equipment is not ex-
vessel, or other process equipment causes stress posed to excessively high or low temperatures,
because of the temperature gradient, and this stress or to excessive temperature gradients which
may be sufficient to cause equipment damage, or might stress and damage the equipment.
even failure of the equipment. • Learn more about this incident by searching
the Internet for “1998 Esso Longford gas
PSID Members see "Free Search--Embrittlement" explosion”.
Know the temperature capability of your plant – both high and low!

English, French, German, Gujarati, Hebrew, Hindi, Hungarian,
Italian, Japanese, Korean, Malay, Persian, Portuguese, Russian, Spanish, Swedish, and Thai.
Sponsored by
CCPS
We Have Liftoff!!! October 2007
What Happened?
A plant was doing a pneumatic pressure test on a pipe connected to a tank. There was no blind flange
between the piping being tested and the tank. The tank was isolated from the pressurized piping with
a closed block valve. The block valve leaked, allowing the pressure from the pneumatic test to leak
into the tank. The tank (which either did not have a pressure relief device installed, or the pressure
relief device was too small) was overpressured, and it failed at the bottom. The tank lifted into the air
and came to rest on the top of the plant.
What can you do?

¾ During pressure tests, or any other maintenance or non-routine activities involving pressure, make
sure that all equipment is capable of withstanding the test pressure, is positively isolated from the
source of pressure, or has adequately sized pressure relief devices for the testing conditions.
¾ Equipment can be protected from being overpressured more reliably by using blinds, or by
physically disconnecting piping, rather than using valves to isolate the equipment from pressure.
¾ Do a process safety review before starting any non-routine operations to identify potential hazards
and required safeguards during the operation.
¾ Keep workers away from the area where pressure testing operations are being conducted.
¾ If possible, pressure test lines using liquid pressure (hydrostatic pressure) rather than pneumatic
(gas) pressure - the energy which can be released from a liquid overpressure is MUCH LESS than
from a gas overpressure.
Isolate equipment from pressure – leave the rockets to the space program!

English, French, German, Gujarati, Hebrew, Hindi, Hungarian,
Italian, Japanese, Korean, Malay, Persian, Portuguese, Russian, Spanish, Swedish, and Thai.
Sponsored by
CCPS
Hot Work Permits September 2007
1
2
What Happened? What can you do?

On the left, a foreman (F), a welder (W), and 2 maintenance workers ¾ Recognize hazardous hot work
(M) were welding on Tank 1. Proper hot work procedures were not activities – welding, cutting, grinding,
followed. There was no check of the atmosphere for flammable vapors operation of gas or diesel engines, or
using a flammable gas detector. Instead, Tank 1 was checked for any other spark producing activity
which could ignite flammable vapors.
flammable vapors by inserting a lit welding torch into the tank – an
¾ Understand and follow your facility’s
unsafe practice in itself. The tanks were interconnected, but not hot work permit procedures.
properly isolated, and some contained flammable vapors, which vented ¾ Ensure that hot work permits are
into the welding area and ignited. The foreman and the 2 maintenance issued by properly trained and qualified
workers were killed, and the welder was seriously injured. Also note personnel.
the makeshift “work platform” – a ladder placed between the Tanks 1 ¾ If you have any doubt about the
and 2, on which people were working. safety of a hot work activity (or any
other work activity!), stop the work
On the right, welding was being done near a gasoline truck, again immediately and bring your concerns to
without following proper hot work permit procedures. Flammable the attention of management.
vapors ignited causing a fire and explosion. One end of the truck was ¾ Use a flammable gas detector
found against a building on the other side of the street! One person was designed to safely identify a flammable
killed and another was seriously injured. atmosphere.
Know and follow safe hot work procedures!


Sponsored by
CCPS
Hazards of Temporary Confined Spaces August 2007
Do you think you could create a dangerous

confined space by pulling the black plastic
sheet over the open pipe end in the picture?
YES, this can create a dangerous confined
space! Two workers used the black plastic
sheet to block sunlight so they could use a
“black light” to inspect the open pipe.
Unfortunately, approximately 150 feet
away, and several floors below this work
location, there was an open nitrogen line
connected to the piping. The nitrogen
flowed through the pipe and out of the
open pipe end shown. The black sheet used
to cover the open pipe end provided
sufficient confinement to trap nitrogen
under the sheet in the work area and create a hazardous oxygen deficient
atmosphere. One worker under the sheet was killed by nitrogen asphyxiation, and
another was severely injured.
There were a number of other people working in the immediate area, but the low
oxygen atmosphere incapacitated the workers under the sheet so quickly that they
passed out before they realized that they were in danger, and they never cried for
help. They were only discovered when a somebody nearby saw a hand sticking out
from under the sheet and got no response when he called to the worker.
¾ A hazardous confined space can be created by ¾ Recognize potentially hazardous confined spaces and follow
anything that can restrict air flow and ventilation your facility’s procedures for safely working in confined spaces.
required to maintain a safe atmosphere for ¾ Do not go into an area with little or no ventilation, and open
breathing. vessels, pipes, or other open process equipment, without proper
¾ The hazardous atmosphere can result from work permits and monitoring of the atmosphere to ensure that it is
toxic vapors, or from reduction of the oxygen safe.
content of the atmosphere in the confined space ¾ Remember that you may have to follow open pipes for many
by inert gases such as nitrogen or carbon dioxide. hundreds of feet to ensure that all sources of potentially hazardous
¾ Any open process vessel or pipe is a potential contaminants are properly disconnected, blinded, or otherwise
source for vapors which can create a hazardous isolated.
atmosphere. ¾ If you change the conditions in a work area (for example,
¾ Hazardous vapors can travel long distances working under the plastic covering the pipe end), make sure that
through connected piping and vessels, and can be you have qualified people do a field hazard evaluation to identify
released through an open pipe or vessel far away hazards and provide appropriate controls.
from the source of the vapor. ¾ Review the April 2004 CCPS Process Safety Beacon for more
information on the hazards of nitrogen asphyxiation.
Recognize confined spaces and treat them with respect!

Sponsored by
CCPS
Fire Caused by Hose Repaired with Duct Tape! July 2007
On an offshore oil platform, operators were transferring methanol

from a portable chemical transporter tank connected by a hose to a
storage tank. When the tank was lifted by a crane to gravity feed the
storage tank, methanol began spraying out from a hole in the hose.
The methanol ignited on the top deck. Methanol that was sprayed
over the side also ignited by the hot exhaust of a compressor located
immediately below the transfer point on the second deck. The fire
was compounded by the breaking of the transfer tank’s sight glass
when a crewman attempted to kick the valve closed. The fire spread
as relief valves on two other chemical transport tanks opened.
After twenty-two 30-pound hand-held chemical fire extinguishers,
two 125-pound wheeled fire extinguisher units, and the firewater
system were used, the fires on both decks were contained. One man
received second-degree burns. After the fires were extinguished, it
was discovered that the hose used to feed methanol from the
transporter to the storage tank was split and had been repaired with
duct tape prior to the operation!
What You Can Do?
• NEVER make temporary or unauthorized repairs on equipment in hazardous material service
without a management of change review by qualified personnel.
• ALWAYS inspect equipment before using it. If there is any sign of damage, corrosion, improper
repair, or any other defect, replace the equipment before you start the job.
• Avoid transferring flammable products near ignition sources such as compressors.
Check your equipment before you start the job!

Sponsored by
CCPS
Process Safety Culture June 2007
January 1986, Space Shuttle Challenger February 2003, Space Shuttle Columbia breaks up July 1988, Piper Alpha
explodes during launch during re-entry Oil Platform destroyed
by fire and explosion
What do these incidents, which were all major failures of complex technical systems,
have in common? In all of them, the incident investigations identified problems in the
organization’s “safety culture” as an important contributing factor. But, what is
“safety culture”? The United Kingdom Health and Safety Executive defines safety
culture as “ ... the product of the individual and group values, attitudes, competencies
and patterns of behavior that determine the commitment to, and the style and
proficiency of, an organization's health and safety programs.” It sounds pretty
complicated, and CCPS suggests a simpler definition: “Safety culture is how the
June 1974, Flixborough, England organization behaves when no one is watching.” While management has a key
chemical plant explosion leadership role in establishing a good safety culture in an organization, everybody
must contribute. In this Beacon, we will focus on one important aspect of safety
culture – maintaining a sense of vulnerability – and cover others in future issues.
Since catastrophic accidents are not very common, it is easy to begin to believe that
nothing bad can happen. People can become complacent, and have a false sense of
security. Good operations can be compromised. Critical protective systems and
procedures may not be maintained, or may be changed without proper understanding
March 2005, Texas City, Texas oil of the possible consequences. Eliminating serious incidents requires constant attention
refinery explosion to the potentially catastrophic results of hazardous activities.
What You Can Do?

• Be vigilant about the hazards of the materials and processes in your plant.
• Recognize “near miss” events to remind you of what could have gone wrong.
• Use incidents which occur in other facilities, such as the incidents reported in the Beacon, to remind you of
the possibility of similar problems at your plant.
• Always operate within safe operating limits, and established operating procedures. When this isn’t possible,
notify your supervision immediately.
• Use approved procedures for authorizing changes to established procedures, including thorough risk
evaluation and approval by knowledgeable authorities.
A good safety culture depends on everyone!

Sponsored by
CCPS
The Great Boston Molasses Flood of 1919 May 2007
On January 15, 1919, people in north Boston, Massachusetts heard a

loud rumbling noise and watched in horror as a 50 foot (15 m) high
tank containing 2.3 million US gallons (8700 cubic meters) of molasses
suddenly broke apart, releasing its contents into the city. A wave of
molasses over 15 feet (5 m) high and 160 feet (50 m) wide surged
through the streets. How slow is molasses in January? This wave
traveled at an estimated speed of 35 miles per hour (60 km/hour) for
more than 2 city blocks. 21 people were killed, over 150 injured, and
the damage estimate was equivalent to over 100 million US dollars in
Before After today’s currency.
What caused this catastrophic tank failure? Some of the causes
identified by the investigation included:
• The tank was not properly inspected during construction.
• The tank was not tested after construction and before filling it with
molasses.
• The tank had been observed to be leaking at the welds between the
tank’s steel plates before the failure, but no action had been taken.

• You might think that an incident that • If you observe leakage, corrosion, or other indication of potential
occurred over 80 years ago is not relevant to failure in a storage tank, report it immediately to management.
today’s industry. But, we still have catastrophic • Make sure that any new tank, or one being returned to service
failures of storage tanks today (see pictures following repair or inactivity, is properly inspected and tested before
below), and for similar reasons. filling.
• A large quantity of any liquid, even a non- • Ensure you know the operating capacities of your tanks and double
hazardous material such as molasses or water, check the level before filling.
can be dangerous if rapidly released in large • Don’t throw out your old incident reports. Read them again, and
quantities, simply because of its volume and remember the lessons. We can learn a lot from things that happened a
mass. long time ago.
January 1988 – Floreffe, Pennsylvania, USA,

tank failure releases over 4 million US
gallons (15,000 cu. m) of diesel oil into the
Monongahela River.
January 2000 – Cincinnati, Ohio, USA, tank

failure releases 365,000 gallons (1400 cu. m)
of fertilizer solution into the Ohio River.
Remember the lessons of the past!


Sponsored by
CCPS
Mr. Potato Head is Down! April 2007
A local community
celebration featured the
ascension of several hot air
balloons. Some of the
balloons drifted over a
chemical plant and got
caught in a strong downward
air current. They were unable
to remain aloft and several
came down inside the plant!
The situation was potentially
dangerous because hot air
balloons use open flame gas burners to heat the air, and the plant handled flammable materials. There were
also a number of power lines that the balloonists had to avoid as they made emergency landings. Fortunately
the plant operators and emergency response team members were very well trained and experienced. While
their training and practice had never anticipated an event like this, they were able to use their knowledge and
emergency response training to safely and effectively deal with the situation. All of the balloons were safely
retrieved, and there were no injuries or significant damage.
• Good emergency response training, practice, and • Know the emergency response plans for your
drills can help you be prepared to deal with many facility, and participate in training, drills, and practice
emergency situations, even those which are difficult sessions so you will be ready in case of a real
to anticipate. The specific events we use for drills emergency.
may never happen, but something similar might. One
•Be aware of local special events, how they might
important reason for drills is to learn how to react to
impact your plant, and how your plant might impact
emergency situations and to be able to think in an
the event. For example, in a plant in China, the plant
emergency.
manager said that he had to be prepared for the
possibility that burning embers from fireworks would
land in the plant during Chinese New Year
celebrations in a nearby residential area.
•Are you located near a sports stadium, a fairground
or park, a convention center, or a major highway
which can have heavy traffic during major community
events? How could external events impact your plant?
Can emergency responders get to your plant quickly
during high traffic events?
Be prepared – for anything!

The Beacon is usually available in Arabic, Chinese, Dutch, English,

Japanese, Korean, Persian, Portuguese, Spanish, Swedish, and Thai.
Thai.
Sponsored by
CCPS
Instrumentation – Can you be fooled by it? March 2007

What happened?
A column was
1 overfilled. However,
before the incident, as
shown in this
instrument chart, the
2 level indication in the
bottom of the column
(the dark blue line - 1)
3 slowly decreased!
YES you can! What You Can Do

The level was Know what can fool you. Review examples of
measured with a incidents where the instrumentation provided
displacement level information that did not represent the data that
indicator. Normally was wanted (for example, density of the liquid,
when the displacer not level). This is not always an easy concept to
(green) is partially grasp, so consult with the engineers and
covered with liquid, technicians who know the system best.
it properly indicates
Understand how instrumentation works, and
level based on the changing force on the displacer as the liquid level
how it will respond to conditions outside the
changes (first and second drawings). But, on the day of the incident,
normal operating range, including, for
the column was overfilled with cold liquid, completely submerging the
example, control loops, venturis, orifice plates
displacer in cold liquid (third drawing). The level was above 100%,
and impulse lines, differential pressure cells,
and the level indicator showed a high level alarm condition
level floats. Know whether instrumentation is
continuously. A high level alarm indicates an abnormal condition, and
normally energized, and the failure mode for
this should be an alert that something is not normal. In this incident,
valves, instruments and control loops following
there was no response to the alarm condition.
loss of pneumatic or electrical energy.
With the liquid completely covering the displacer, the instrument did
Know what you should be observing as part of
not indicate liquid level. Instead, the force on the displacer gave a
normal operations, for example, balancing
measure of the relative density of the displacer and the liquid in which
transfers into and out of equipment, changes in
it was submerged. In other words, the instrument was not designed to
level. And, NEVER ignore alarms – find out
function properly if the level was high enough to completely submerge
what caused the alarm!
the displacer. The column was heated during the startup. As the
temperature of the liquid increased (the green line in the graph above – Understand whether components can be tested
Line 2), the density of the liquid decreased (the purple line - 3). The on line or whether an “out of service” test is
change in density of the liquid changed the force on the displacer, required to confirm that an instrument is
resulting in a decrease in the “level” indication (fourth drawing, with working.
hot liquid), even though the column level was actually increasing. The
column overflowed, flammable material was released, and there was a PSID members use Free Search for
major explosion and fire. "Instrumentation" or "Level Control."
Understand how your equipment works – and how it can fool you!

Japanese, Korean, Portuguese, Spanish, Swedish, and Thai.
Sponsored by
CCPS
February 2007
Vacuum Hazards - Collapsed Tanks
The tank on the left collapsed because material was pumped out after
somebody had covered the tank vent to atmosphere with a sheet of
plastic. Who would ever think that a thin sheet of plastic would be
stronger than a large storage tank? But, large storage tanks are designed
to withstand only a small amount of internal pressure, not vacuum
(external pressure on the tank wall). It is possible to collapse a large tank
with a small amount of vacuum, and there are many reports of tanks
being collapsed by something as simple as pumping material out while
the tank vent is closed or rapid cooling of the tank vapor space from a
thunder storm with a closed or blocked tank vent. The tank in the
photograph on the right below collapsed because the tank vent was
plugged with wax. The middle photograph shows a tank vent which has
been blocked by a nest of bees! The February 2002 Beacon shows more
examples of vessels collapsed by vacuum.

Engineers calculated that the total force from atmospheric Recognize that vents can be easily
pressure on each panel of the storage tank in the left blocked by well intended people. They
photograph was about 60,000 lbs. often put plastic bags over tank vents
The same calculation revealed that the total force on the or other openings during maintenance
plastic sheet covering the small tank vent was only about 165 or shutdowns to keep rain out of the
lbs. Obviously this force was not enough to break the plastic, tank, or to prevent debris from entering
and the tank collapsed. the tank. If you do this, make sure that
Many containers can withstand you keep a list of all such covers and
much more internal pressure than remove them before startup.
external pressure – for example a Never cover or block the
soda can is quite strong with atmospheric vent of an operating tank.
respect to internal pressure, but it is Inspect tank vents routinely for
very easy to crush an empty can. plugging when in fouling service.
Vacuum – it is stronger than you think!

Sponsored by
CCPS
2006 Beacon Review – Remember Lessons Learned January 2007
January – Time sensitive April – Mechanical integrity The Beacon would

chemicals like to thank the
following volunteer
translators for their
help during 2006.
Their efforts have
made the Beacon a
publication read
around the world.
Arabic: Salem Alhajraf , Kuwait

May – Dust explosions July – Incompatible chemicals Institute for Scientific Research
Brazilian Portuguese: Paulo
Haro,, Petrobras
Haro
Chinese: Li Yi, Kunming
Cellulose Fibers Co., Ltd.
Dutch: Marc Brorens
Brorens,, Nerefco
and Nico Versloot
Versloot,, TNO
French: Robert Gauvin
Gauvin,,
Petromont
German: Dieter Schloesser
Schloesser,,
Basell
Gujarati: Mayoor Vaghela
Vaghela,,
HELPS Safety Consultant
September – Buncefield October – Gas cylinder Hebrew: Yigal Riezel and
fire – overfilling tanks storage explosion and fire Shlomit Magidovich
Hindi: Alok Agrwal
Agrwal,, Chilworth
Safety & Risk Management
Italian: Cesare Mazzini and
Monia Casana
Casana,, Uniqema
Japanese: Takuya Kotani and
colleagues, SCE-
SCE-NET
Korean: Hwan Bae
Bae,, SK
Corporation
Portuguese: Helder Figueira,
Repsol Polí
Polímeros
Spanish: Julio Miranda, ACM
Automation
CCPS thanks the Process Safety Beacon Committee for contributing material and providing their
Swedish: David Aronsson
Aronsson,,
knowledge and expertise to review the Beacon each month: Don Abrahamson,
Abrahamson, OxyChem
OxyChem;; Kathy
Anderson, Vertellus Specialties Inc.; Lanny Duvall, Celanese; Frederic Gil, BP; *John Herber
Herber,, 3M; DSM Anti-
Anti- Infectives
Daniel Horowitz, US CSB; *George King, Dow; Dave Krabacher
Krabacher,, Cognis
Cognis;; Dave Leggett, Baker Risk; Thai: Surak Sujaritputangoon
Sujaritputangoon,,
Holly Little, Johnson Polymer; Bill Marshall, Lilly; Michael Marshall,
Marshall, US OSHA; Jack McCavit
McCavit,, CCPS HMC Polymers Co., Ltd.
Emeritus Member; William Olsen, Merck; Mike Rogers, Syncrude
Syncrude;; Roy Sanders, PPG; Mike Smith, Traditional Chinese: S.G.Lin
S.G.Lin,,
Shell; John Stoney
Stoney,, Rhodia
Rhodia;; *Tony Thompson, Monsanto (retired); Daniel Wiff
Wiff,, Nova; Nico Versloot
Versloot,,
Taiwan Polypropylene Co., Ltd.
TNO; Adrian Sepeda
Sepeda,, CCPS Emeritus Member; Jan Windhorst
Windhorst,, Nova (* - Committee Co-
Co-Chairs)

English, French, German, Gujarati, Hebrew, Hindi, Italian, Japanese,
Korean, Portuguese, Spanish, Swedish, and Thai.
Sponsored by
CCPS
December 2006
Liquefied Gas Cylinder Failure
A liquid nitrogen (Dewar) cylinder in a university chemistry
laboratory catastrophically failed due to over pressurization,
causing substantial damage. Fortunately the incident occurred
at 3 AM and the building was not occupied, so there were no
injuries. The over pressurization blew out the bottom of the
cylinder and propelled the cylinder upwards. The cylinder
pressure relief valve and rupture
disc had been replaced by two
brass plugs at some time in the
past by an unknown person.
Before the incident, the cylinder
may have been leaking through
an old gasket, providing
sufficient release of gas to
Intact cylinder and remains of prevent over pressure.
ruptured cylinder Approximately twelve hours
before the explosion, the leaking gasket had been replaced and the cylinder
refilled with liquid nitrogen. With the new gasket, the cylinder was now
completely sealed, and pressure could build up. The cylinder ruptured when its
internal pressure rose above 1000 psi (69 bar). The catastrophic failure of the
nitrogen cylinder was a result of the removal of the pressure relief devices. Laboratory Damage

Liquefied and pressurized gas cylinders Never modify any equipment containing hazardous
are commonly used in laboratories and in materials or energy without qualified engineering evaluation,
manufacturing plants. and always conduct a management of change review.
In this incident, the force released by If you observe a high pressure or liquefied gas cylinder that
the failure of the cylinder was estimated at appears to have been modified, or is corroded or otherwise
250,000 pounds (~ 113,000 kilograms- damaged, report it to supervision immediately so it can be
force). removed from service.
Cryogenic storage must either be Ensure that cylinders are properly maintained and
refrigerated to maintain the low periodically inspected, including the pressure relief devices.
temperature and pressure, or slowly bleed If you use pressurized gas cylinders, make sure you are
off enough vapor to maintain pressure and properly trained in the safe handling of high pressure cylinders.
cool the remaining inventory. Share this incident with your colleagues in the laboratory
An incident this powerful can release who may use pressurized gas cylinders.
other hazardous materials in nearby Read the Texas State Fire Marshall’s Alert on this incident:
containers, vessels, and piping, causing an http://www.tdi.state.tx.us/fire/documents/fmred022206.pdf
even more severe incident.
CCPS PSID Members, see Free Search - Cylinder
Don’t let a gas cylinder become a rocket!

Sponsored by
CCPS
November 2006
Hazards of Relief Devices in Series
A vessel has a rupture disk and a pressure relief
valve in series to protect against high pressure in the
vessel. There is a pressure gage on the pipe between
the rupture disk and the relief valve. As a part of
your regular plant inspection, you are supposed to
check the pressure gage. The gage normally reads
zero. Today you observe a pressure of nearly 50
Rupture
psig (~3.5 barg) as shown.
Disk
Do you understand why this is a significant
hazard? How does pressure between the rupture disk
and the pressure relief valve affect the performance
of the vessel overpressure protection system?
Pressure Relief Valve

A rupture disk bursts when the pressure on the process Check to ensure that your training
side of the disk exceeds the pressure on the downstream program covers this situation.
side by the design pressure of the rupture disk. So, a 100 Do you know what to look for to
psi (6.9 bar) rupture disk will burst when the pressure on recognize a rupture disk and relief valve
the process side of the disk is 100 psi (6.9 bar) greater in series?
than the pressure downstream of the disk. If you have installations like this, be
The pressure might be caused by a small “pinhole” sure to check the pressure regularly.
leak in the rupture disk which will allow material to If you observe pressure between a
slowly leak through the disk and build up pressure, or it relief valve and a rupture disk, be sure to
could be the result of a burst rupture disk. investigate and correct the problem as
Because there is nearly 50 psig (3.5 barg) pressure on soon as possible.
the downstream side of this rupture disk, if the pressure Make sure you understand the reason
was caused by a pinhole leak, the rupture disc will not for all process data that you are asked to
burst until the pressure in the vessel is equal to the observe and record, know when an
rupture disk design pressure plus 50 psi (3.5 bar). If this observed reading warns of a hazardous
is a 100 psi disk, it will not burst until the vessel pressure situation, and know what action to take to
is nearly 150 psig (~10.3 barg). This might result in correct the problem.
failure of other equipment attached to the vessel -
perhaps a sight glass, a hose, or a gasket which cannot CCPS PSID Members, see Free Search--
withstand the higher pressure. Relief Valves
Don’t just write down the data – understand what it means!

Sponsored by
CCPS
Do you store cylinders properly? October 2006
Fire starts June 24, 2005 was a hot, sunny summer day in St. Louis,
here following with temperatures reaching 97F (36C). Operations at a
propylene gas cylinder packaging and distribution facility proceeded
release from normally during the morning and early afternoon.
overheated However, about 3:20 pm, a technician retrieving
cylinder cylinders from an outside storage area saw a ten-foot high
flame coming from a cylinder and activated the fire
Spreading fire alarm. Propylene gas had been released from the relief
device on a cylinder valve and ignited. Workers and
three minutes
customers evacuated. The fire spread to adjacent
later
cylinders, which ignited and began exploding, flying into
other areas of the facility, and spreading the fire. After 4
minutes, the fire covered most of the facility’s flammable
Facility gas cylinder area and explosions were frequent.
Damage
Community
Damage
Dozens of cylinders and cylinder parts were propelled into the community and were found on sidewalks, front
yards, backyards, courtyards, parking lots, and under cars. Damage included a burned empty commercial
building, fire-damaged cars, a three-foot hole in the wall of one residential building, broken windows, and
other destruction to residential and commercial buildings. Cylinder parts were found as far as 800 feet away.
Some materials stored in containers such as drums, Follow guidelines for safe storage of chemical
cylinders, and pails can be heated to a hazardous containers found in the material safety data sheet.
temperature if they are stored outdoors and exposed to For gas cylinders, follow guidelines from industry
direct sunlight. associations such as the Compressed Gas Association,
The hazard can be a result of decomposition, consensus standards such as those from the National
polymerization, or other chemical reaction, or it can Fire Protection Association, and recommendations
simply be over pressurization of the container because from material suppliers.
of the vapor pressure of the contents, as in the incident Minimize the number of cylinders in process areas.
described above. Read the United States Chemical Safety and
In this incident, direct sunlight, and an unusually Hazard Investigation Board Safety Bulletin on this
hot day, probably raised the temperature of the incident for more information about the incident and
cylinder and its contents to about 150F (65 C), recommendations for prevention of similar incidents:
http://www.csb.gov/index.cfm?folder=news_releases&page
sufficient to open the relief device and release the gas.
=news&NEWS_ID=296
Don't store volatile or temperature sensitive materials outside in the hot sun!

Sponsored by
CCPS
Overfilling Tanks – What Happened? September 2006
On Sunday December 11, 2005, gasoline (petrol) was being

pumped into a storage tank at the Buncefield Oil Storage
Depot in Hertfordshire, England. At about 1:30 AM a stock
check of the tanks showed nothing abnormal. From about 3
AM, the level gauge in one of the tanks recorded no change
in reading, even though flow was continuing at a rate of about
550 cu. meters/hour (2400 US gallons/minute). Calculations
show that the tank would have been full at about 5:20 AM,
and that it would then overflow. Pumping continued and the
excess gasoline overflowed from the top of the tank and
cascaded down the sides, forming a liquid pool and a cloud of
flammable gasoline vapor. At about 6:00 AM the cloud
ignited and the first explosion occurred, followed by
Photograph courtesy of Royal Chiltern Air Support Unit
additional explosions and a fire which engulfed 20 storage
tanks. Fortunately there were no fatalities, but 43 people were
injured. 2000 people were evacuated, there was significant damage to property in the area, and a major
highway was closed. The fires burned for several days, destroying most of the site and releasing large clouds
of black smoke which impacted the environment over a large area.
Photo Photo courtesy of

courtesy of Hertfordshire
Royal Constabulary
Chiltern
Air
Support What can
Unit you do?
Did you know? When you transfer material, make sure that you
Overfilling of process vessels has been one of the know where it is going.
causes of a number of serious incidents in the oil and When you are pumping into a tank, if the level or
chemical industries in recent years – for example, the weight indicator in that tank does not increase as you
explosion at an oil refinery in Texas City, Texas in would expect, stop the transfer and find out what is
March 2005. happening.
The tank involved in this incident had an Make sure that all safety alarms and interlocks are
independent high level alarm and interlock, but it did tested at the frequency recommended by the plant
not work – the cause of the failure is still under process safety management procedures.
investigation. If you have alarms and interlocks which are not
A spill of flammable material such as gasoline can regularly tested, ask if they are safety critical and
form a dense flammable vapor cloud which can grow should be on a regular testing program.
and spread at ground level until it finds an ignition Read the reports about this incident at
source, which can cause the cloud to explode. http://www.buncefieldinvestigation.gov.uk
If you are pumping material, be sure you know where it is going!


Benjamin Franklin
Born January 17, 1706
Early researcher on static
http: //www.aiche.org/ccps/safetybeacon.htm electricity
August 2006
Static Electricity
A customer was filling an ungrounded gasoline
can in the cargo area of a truck when the
vapors were ignited by a static electric
discharge. The fire caused severe damage to
the truck and the gasoline station. The
customer suffered severe burns on both legs,
and it could have been much worse if four
bystanders had not managed to extinguish the
flames using their own clothing.
This incident reminds us of the consequences of failing to recognize static electric
ignition hazards of containers, piping, and any equipment used to handle flammable
and combustible liquids or gases, combustible mists, or combustible dusts.

Static electric charges on material, equipment, and
people result from materials contacting each other and
Always ground conductive containers - drums, pails,
then being separated. Electric charge can transfer from portable tanks, tank trucks, railroad cars, and any other
one of the materials to the other, and this charge will vessels - when transferring flammable or combustible
build up if it cannot flow to ground. materials.
Solids or liquid drops falling through air can create Make sure that process equipment is properly grounded,
static charges on the solids or drops. and that grounding is periodically tested.
Static electric discharges can be sufficiently energetic Minimize free fall of solids or liquids through the air
to ignite a flammable atmosphere – for example the when filling vessels and containers.
vapors from a flammable liquid or a combustible dust If you do maintenance on equipment, make sure that
cloud. all grounding connections are properly replaced and
The first defense against static ignition is to eliminate tested following the maintenance.
the flammable atmosphere if possible. If this is not If you work in an area that requires special procedures
possible, it is important to prevent and control to prevent static discharge – for example, special shoes or
electrostatic charge accumulation. clothing or use of other special equipment – be sure to
Bonding means that conductive parts of equipment are understand and follow all procedures.
connected to each other so there can be no electric The pictures below show some examples of good
discharges between the parts. grounding and bonding practices.
Grounding means that conductive parts of equipment
are connected to an electrical ground, preventing electric CCPS PSID Members see Static Spark" and "Static
discharges to ground. Electricity.“ in Free Search
Never have ungrounded conductive parts in a system handling flammables!


Process Safety Beacon
Sponsored by
CCPS
July 2006
Do you have storage pallets that look like this?
Small charges for several batch processes were transferred into small
containers and placed on a pallet near the reactors so they would be easily
available when needed. The picture on the right shows a re-creation of the
raw material pallet.
There was a fire in the manufacturing building which started on or near
the pallet. The fire was extinguished by the building sprinkler system and
there were no injuries. However, the fire caused extensive damage to
electrical power, control and instrumentation wiring, and the plant was
shut down for a long time while the damage was repaired. The picture on
the left below shows the actual pallet after the fire, and the picture on the
right shows some of the damaged cable and wiring.
The investigation revealed that the some of the

materials in the containers were incompatible and,
over time, chemicals had leaked from damaged
containers, overfilled containers, or from spills on
the outside of containers. Some of this material fell
through the open grate floor into a cable tray below
the floor. It was difficult to see the spilled material
in the cable tray, or to clean it up, and eventually
some of the spilled materials reacted, got hot, and
burst into flame.

Many chemicals are incompatible with Know about the compatibility of chemicals in your plant, and
each other, and can cause fires or toxic follow your plant’s procedures for keeping incompatible
fumes when they react. materials apart in storage and use. Many plants use a chemical
When incompatible materials react, compatibility chart to summarize this information.
they may get hot enough to ignite and Inspect all chemical containers regularly and ensure that they
start a fire. are properly labeled. Replace any containers which are
Spilled incompatible materials may not damaged or leaking.
react immediately – the reaction might Clean up all spills of materials immediately. Don’t let spilled
start slowly and only get hot enough to material accumulate, waiting to contact other materials in the
burst into flame after some time. future.
Good housekeeping is not just about Fill and empty chemical containers in approved locations
appearance – spilled chemicals can cause where this can be done safely.
fire and health hazards. Do not store chemical containers near fire exits, safety
CCPS PSID Members see "Reactive" in showers or eye wash stations, near electrical boxes and cable
Free Search trays, or other important equipment.
If you don't keep it clean, who will?

DOW RESTRICTED - For internal use only

CENTER FOR
S Process Safety Beacon
Sponsored by
CCPS
June 2006
Is this valve open?……. or closed?
Valve Wrench Collar
Many people would expect this valve to be closed
Valve Wrench - the position of the valve handle (in this case, a
“valve wrench”) is perpendicular to the pipe. But
close inspection of the valve position indicator
shows it is parallel to the pipe, clearly indicating
the valve is open! WHY? The valve wrench
collar is square and can be positioned in two ways
– one with the valve wrench parallel to the valve
position indicator and the other with the valve
wrench perpendicular to the position indicator.
Position Indicator
This confusing setup was one cause of an incident
which injured 6 people, resulted in 13 million
US dollars in damage, shut down a refinery for several months and required off site evacuations.
Operations personnel used this valve to isolate a pump for maintenance and mistakenly believed the
valve was closed. It was not! The result: release of a large quantity of flammable liquid at 150 psig
(10 bar g) and 350 degrees F (175 degrees C), followed by an explosion and fire.
Actual
Position
What can you do?
and flow Look for equipment that does not work the way
you would expect. Have it modified! Pay special
The valve
wrench
attention to confusing control displays, valve
collar position indicators, equipment running status
indicators and instrument displays.
Did you know? Local culture and/or practices can change the
People have expectations for how equipment way things are “expected” to appear. For
will work based on what they see. It is critical example, some translations of this Beacon will
that equipment align with these expectations to read from right to left. If you use equipment
avoid setting traps for operators and mechanics. manufactured in another country, it may not
We may remember that a device works in an operate the way you expect it to – it is also
unusual manner when we have time to think deserving of special attention.
about it. But, in an emergency or when we are Take a few minutes to read the United States
distracted by other events, we forget. Then, we Chemical Safety and Hazard Investigation Board
revert to our basic assumption that things work case study on this incident. It will provide
the way we expect them to. In this incident, a additional information as well as other causes for
valve handle was perpendicular to a pipe, and this incident.
people assumed it was closed. http://www.csb.gov
Equipment should operate the way you expect!

English, French, German, Hebrew, Hindi, Italian, Japanese,
Korean, Portuguese, and Spanish, and Thai.
CENTER FOR
Sponsored by
CCPS
Dust Explosion Hazards May 2006
The picture on the left shows a monument to the anthracite coal miners of
northeastern Pennsylvania, located in the town of Jim Thorpe (named after the
famous Olympic athlete). It is a single rock of anthracite coal – over 7 tons of
nearly pure carbon. The sign on the monument indicates that it has an energy
content of 205 million BTU (216,000 million joules), equivalent to about 50 tons
of TNT! So, should we be worried about this huge amount of energy located in the
middle of a small town? Of course not, because it would be extremely difficult to
ignite this large rock of coal, and, if ignited, it would burn very slowly.
But, what would happen if we ground up a few kilograms of that coal into a fine
powder, as in the picture at the right, and suspended that powder in the air as a dust
cloud in a building or other confined space? If we lit a match or provided some other
ignition source such as an electric spark, the result might be a massive and damaging
dust explosion. The picture below shows the results of such an explosion, which killed
6 people and injured 37.
Did you know?

¾ Most solid materials which will burn can form an explosive dust
cloud if the particle size of the solid is small enough. Some examples of
materials which can explode as a dust include wood, flour, sugar, grain,
plastics, many solid organic chemicals, and many metals.
¾Accumulations of dust on floors, tops of vessels or tanks, support
beams, in cable trays, above suspended ceilings, can form an explosive
cloud if somehow disturbed and lifted into the air.
¾A dust layer 1/32 inch (less than 1 mm) thick on exposed surfaces
can create an explosive dust cloud once suspended in air.
¾A dust layer can be considered to create a hazardous condition if it
covers an area, on all surfaces, greater than 5 % of the floor area of a
room.
What can you do?

¾ Be aware of the potential for a dust explosion when you handle solid materials which can burn. Follow the
specified safe operating procedures for handling powders and dusts in your plant.
¾Do not allow dust to accumulate on floors, on top of equipment, on beams, or other places. Be aware of
those “hard to see” areas such the top of tanks or above a suspended ceiling and check them for dust
accumulation regularly. Watch all areas, even those corners and hidden spaces.
¾ Be particularly careful to prevent dust accumulation on hot surfaces such as light fixtures, electric motors,
steam pipes, etc., where the heat may cause the dust to ignite.
¾ Be sure that any equipment used to clean up dust (for example, an electric vacuum cleaner) is appropriate
for use in an atmosphere which could contain an explosive dust.
Be aware of dust explosion hazards.


Korean, Portuguese, and Spanish, and Thai.
CENTER FOR
Sponsored by
CCPS
April 2006
Mechanical Integrity
The flange on the left is badly corroded and the bolts
are in very poor condition - a leak waiting to happen.
Fortunately, the poor condition was noted during a
plant inspection and the flange was replaced (as shown
on the right).
The picture on the left shows a corroded control valve.
Could you count on this valve to operate when you
need it? The picture on the right shows the
replacement valve, which, if properly maintained and
tested, is much more likely to function correctly when
BEFORE needed. AFTER
Did you know?
In 2004, process safety incidents reported to
the Canadian Chemical Producers Association
indicate that 25% were caused by problems
with process equipment mechanical integrity.
Further analysis of the same data shows that
mechanical integrity failure is a cause of up to
50% of the incidents in several years between
1998 and 2003.
ALL OF US are the first line of defense for
plant integrity issues like the ones shown here.
This picture shows an improvised pipe support We are in the plant every day and have the
made from scaffolding, springs and clamps. opportunity to see and report these problems.
What You Can Do

Plan regular plant tours to look for mechanical But, don’t wait for “official” plant safety
integrity problems – such as corroded equipment, tours and inspections. Be constantly aware of
piping and valves, inadequate piping support, small visual and other signs of equipment mechanical
drips or wet spots around flanges. integrity problems.
Listen as well as look! For example, does that If you see or hear something that concerns
pump sound different? If so, perhaps maintenance you, report it promptly and follow-up to make
should check it in case there is something wrong. sure steps are taken to correct the situation.
“You can see a lot just by looking!” (Yogi Berra, New York Yankees)

Korean, Portuguese, Spanish, and Thai.
CENTER FOR
Sponsored by
CCPS
Pressure Relief Systems – Do you see any hazards here? March 2006
1 2 3
YES there are! What You Can Do

1 The discharge from the relief valve in picture ¾Relief valves and rupture disks are part of an
#1 is directed toward a personnel access platform emergency pressure relief system. Its design must not
above. If the relief valve opens while someone is only prevent equipment overpressure, it must also
working on the platform, that person would be make certain that material discharged does not lead to
exposed to the discharged material and possibly personnel injury. The system needs to ensure that
injured. there is no fire, explosion, or toxic material exposure
hazard from the material released through a relief
2 The relief valve discharge in picture #2 is
valve or rupture disk.
through a long, unsupported pipe. The force
generated by the material flow could bend, break or ¾Plant modifications include new platforms, vessels,
restrict the discharge pipe, any of which could lead piping and a variety of other additions. Potential
to personnel exposure or a failure of the system to exposure to effluent from existing AND new pressure
operate as intended. relief devices must be included in your management
of change process.
3 The discharge from the relief valves in picture ¾Drain, vent and sample valves from equipment or
#3 is directed downward, toward an area where piping as well as vessel overflows can have similar
people could be working. As in the first picture, hazards. Any material which could be released from
anyone working in this area when a relief valve process equipment, including pressure relief valves or
opens could be injured. The discharge pipes are also rupture disks, must discharge to a safe location.
long and unsupported as in picture #2.
¾ANY open pipe has the potential for an unexpected
These pictures illustrate hazards found in many discharge. The release could occur for a variety of
plants which handle chemicals. Relief devices often reasons and it will often be a surprise. Use extra
discharge to a ‘convenient’ location - and that may caution when working around them - expect the
not be the same as a ‘safe’ location! unexpected!
ANY open pipe is a potential chemical discharge!


English, French, German, Hebrew, Hindi, Italian, Korean,
Portuguese, and Spanish
CENTER FOR
http://www.ccpsonline.org/safetybeaconfrm.asp
Sponsored by
CCPS
2005 Beacon Review – Remember Lessons Learned February 2006
February – Corrosion April – Overheating The Beacon would like

under Insulation causes explosion to thank the following
volunteer translators
for their help during
2005. Their efforts have
made the Beacon a
publication read
around the world.
Robert Gauvin of Petromont
for the French translations;
Vanessa Rodrí
Rodríguez with the
United States EPA Office of
Emergency Management,
May – Fire in storage area July – Piper Alpha oil platform and Julio Miranda of
destroyed (1988) -
maintenance isolation Celanese Canada for the
Spanish translations;
Dieter Schloesser of Basell
for the German translations;
Paulo Haro of Petrobras for
the Brazilian Portuguese
translations;
Helder Figueira, Nuno
Pacheco, Jorge Santana and
Antonio Candeias with
Repsol Polí
Polímeros for the
August – toxic reaction in sewer November – Hurricane Katrina Portuguese translations;
– emergency response for Li Yi of Kunming Cellulose
natural disasters Fibers Co., Ltd. for the
Chinese translations;
Marc Brorens of Nerefco for
the Dutch translations;
Alok Agrwal of
Cholamandalam MS Risk
Services Ltd. for the Hindi
translations;
Cesare Mazzini and Monia
Casana of Uniqema for the
Italian translations;
CCPS and the members of the Beacon Committee thank Salem Alhajraf of the Kuwait
Institute for Scientific
Adrian Sepeda for 3 years as the CCPS Staff Consultant responsible Research for the Arabic
for the Beacon. translations;
Did you know that you can download past Beacons starting in March
March 2005 from the Chemical Yigal Riezel and Shlomit
Engineering Progress (CEP)
CEP) web site (http://www.aiche.org/CEP/
(http://www.aiche.org/CEP/)) if you are an American Institute Magidovich for the Hebrew
of Chemical Engineers member or have access to an electronic subscription
subscription to CEP? translations.

English, French, German, Hebrew, Hindi, Italian, Portuguese, and Spanish
Spanish
CENTER FOR
http://www.ccpsonline.org/safetybeaconfrm.asp
Sponsored by
CCPS
Time Sensitive Chemicals – and Sharing Lessons January 2006
Through 50 CCPS Process Safety Beacons!
Many chemicals have a ‘shelf life’, they become unstable or reactive
with time in storage. For example, some monomers require inhibitor
to prevent polymerization, and, after a period of time, the inhibitor is
consumed. The manufacturer of such chemicals will normally
provide an “expiration date” for the material, and it is important to
use the material or properly dispose of it before that expiration date.
A company had two “near misses” – bulging or ruptured drums –
because time sensitive chemicals had been stored too long.
Fortunately nobody was hurt, and damage was minor. The
company had a good system for reporting and sharing near
misses, and these incidents were shared throughout the
organization. Another plant saw the reports, and immediately
checked all of the material in the warehouse. They found four
drums of the same material which were past the expiration
date and had begun to polymerize. Luckily, none of the drums
had ruptured. The plant safely discarded the material and a
potential explosion or injury was avoided.
Did You Know? What You Can Do
• Some reactive chemicals must be used by a • Know if chemicals in your workplace can become
specified date or they will become unstable. unstable during storage – check the MSDS, with
• Other chemicals can accumulate impurities your safety specialist, or contact the supplier.
(such as peroxides) over time and can also • Understand and follow your company’s procedure
become unstable. for managing time sensitive materials (make sure
• Material Safety Data Sheets (MSDS) you have one!); they should not be stored too long.
should tell you if materials can become • Report all incidents and near misses to help
unstable with time or need special storage prevent future incidents.
conditions.
• Share incidents with us at the CCPS Beacon so we
• Reporting and investigating “near misses” can all learn from your experiences, and READ
is an excellent way to prevent future AND SHARE THE BEACON!
incidents.
• That the December 2005 Beacon was the
50th issue, sharing lessons from safety
incidents with thousands of people in 11
languages.
PSID Members see Free Search: Reactive Chemicals
Learn from experience – report and share incidents and near misses!

Spanish
CENTER FOR
Sponsored by
CCPS
Startup Hazards December 2005
A number of chemical facilities have had disastrous events occur

during startup activities. In many cases, these events point to the
need for a higher level of attention and care than that needed for
routine processing. WHY? Startup hazards are increased by
inexact operating instructions, lack of experience in startup
operations, and a plant in a non-standard condition – for example,
feed tanks empty, manual valves in the wrong position, new or modified equipment. Time
pressures to get the plant back in operation may be high, and operators may have worked long
hours during the shutdown, making them less alert. Many plants require manual operation during
startup. Continuous plants may startup so infrequently that plant personnel have little experience
with required steps.
¾Have complete and accurate written startup
¾Of 38 major incidents investigated by the U.S.
procedures and checklists, and use them.
Chemical Safety and Hazard Investigation Board
(CSB) since 1998, three occurred during startup ¾Use Management of Change reviews before
of continuous process equipment. modifying any startup procedures.
¾These three incidents resulted in 22 fatalities ¾Ask questions and get help with startup
and more than 170 injuries. operations which are not familiar to you.
¾Other serious incidents occurred during startup ¾Check with the responsible people that
of batch processes or during maintenance shutdown activities have been completed and
operations that followed a power outage. equipment approved for use.
¾Startups may be rare, so refresher training may ¾Verify equipment functionality and setup before
be needed. startup, including pre-startup safety review after
major maintenance or modifications.
¾Make sure all valves are in the proper position.
¾Maintain excellent communication between
outside operations and the control room!
PSID Members see Free Search: Startup
Plan for safety for start to finish!


Spanish
CENTER FOR
CCPS extends its
sympathy to all victims of
Hurricane Katrina and
other natural disasters
Messages for Manufacturing Personnel throughout the world.
Hurricane Katrina – Emergency Response and Recovery November 2005

In August 2005, Hurricane Katrina devastated the
United States Gulf Coast causing over 1000 fatalities
and billions of dollars in damage. Critical oil and
chemical facilities were impacted by this storm. This
storm, the 2004 Tsunami, and other natural events –
floods, earthquakes, blizzards, tornadoes – demonstrate
that none of us are immune to catastrophic impacts of a
natural disaster. They remind us of the importance of
emergency planning at all levels – from a plant incident
to a natural disaster impacting millions of people.
Preparation and planning are essential to minimize
damage, rescue victims, and recover from the disaster.
¾ Every facility – plant, depot, warehouse, ¾ Learn your facility AND community
laboratory , office – should have a plan for emergency response plans and understand
emergency response for all types of natural and what you have to do.
human caused incidents. Does yours include ¾Participate in drills and take them seriously.
weather related incidents? ¾Develop a personal emergency response
¾Everybody has a role! Some are direct plan for your family. Think about what kind of
responders, such as members of the fire brigade, disasters could occur where you live –
others are responsible for shutting down hurricanes, tornadoes, earthquakes, fires,
operations, still others are required to leave their floods. Make sure everybody in your family
work area to get out of danger. But, everyone knows where to go and how to get there.
has something they MUST do! Think about how to get back in touch if you
¾Practice is essential to good emergency are separated.
response. That is why we have fire drills and ¾Excellent emergency response is a result of
other tests. Follow up the drills with a critique – excellent preparation. So be READY!
what went well and what could have been done
better?
Fire after an
earthquake in
Turkey in 1999 Æ
ÅAftermath of
an earthquake in
Japan in 2003
PSID Members see Free Search: Hurricane
Your Response to an Emergency Should Be No Accident!


Spanish
CENTER FOR
CCPS Welcomes
CEC Combustion
Services Group as
Messages for Manufacturing Personnel a New Member
Gas Leak Destroys Plant October 2005

Here’s What Happened
This foundry suffered a natural gas
explosion that resulted in three
fatalities, six hospitalizations, and $30
million US in damages. The portion
of the facility where the explosion
occurred was completely destroyed.
One of the fatalities occurred at the
time of the initial explosion, but two
others were caused by a collapsing building. Evacuation from buildings
in the facility and emergency response efforts were hampered by acrid Photographs and incident description
supplied by CEC Combustion Services
smoke and a broken water main. Group: http://www.combustionsafety.com
How Did This Happen ? Did You Know?

• Not all natural gas or Propane is odorized. Usually a mercaptan is
Although the facility handles both added as the odorant.
propane and natural gas, evidence • The lower explosive limit for natural gas is only 4.3% by volume
suggests that an undetected in air. It takes very little to get in to the explosive range.
natural gas leak slowly supplied • Not all flammable vapors behave the same. Usually, natural gas
gas to a confined space. It reached and hydrogen are lighter than air and may accumulate in high
an explosive level and found an spaces. Propane is heavier than air and flows along the ground like a
ignition source. river of vapor that pools in low spots.
There were several warning, or
near-misses, before the explosion. What You Can Do
Twice the preceding week, gas • ALL gas leaks are dangerous! Even very small leaks can supply
odors had been detected. In the enough fuel to cause a destructive explosion. Report, find and
first incident, the leak source was correct every gas leak.
never found and the odor was • If you smell gas, SAFELY evacuate the area. Do not turn on
blamed on wind blowing the gas lights or equipment that might supply an ignition source. Stop all
“smell” into the building from hot work IMMEDIATELY!
outside. The second near-miss • To stop a leak, be aware that closing valves or shutting down
resulted in a plant evacuation and equipment may provide an ignition source. Know where remote
occurred because a tank outside shut off valves and switches are and use them.
of the building leaked gas into a • When you test for explosive atmospheres be sure to use the right
pipe that opened in the building. type of test equipment that is calibrated according to manufacturer’s
Both incidents contributed to a recommendations and specifications.
desensitization of the hazards of
• Once the leak is controlled, ventilate confined spaces carefully!
natural gas.
When you ventilate a fuel rich atmosphere, it will pass through the
PSID Members see Free Search: Natural Gas explosive range and any ignition source will cause an explosion.
Don’t Ignore Even Small Fuel Leaks. Test Suspicious Atmospheres.


Spanish
CENTER FOR
Dedicated
to all those that
lost their lives or
loved ones in the
9-11-01 terrorist
Messages for Manufacturing Personnel attacks
September 11, 2001----- September 2005

2001-----Never
Never to be Forgotten!
September - a month that
brings memories of the tragic
events of September 11,
2001. Four airplanes were
hijacked by an organized
group of terrorists. Two
planes struck the World
Trade Center Towers in New
York City—causing both to
tragically crash to the ground.
A third struck the Pentagon in Washington DC and a fourth crashed in a
field in Pennsylvania. Thousands of lives were lost along with billions
of dollars in property damage amidst untold human suffering. The efforts of the emergency response
organizations were truly heroic and played a major role in restoring order out of the chaos.
What has happened since… What You can do…
There have been a number of actions by governments, An informed, watchful workforce is a major
trade and professional associations and individual element in any site's security effort.
companies, including:
Question things that look out of place: packages,
Ì the US federal government created the Department people and transportation vehicles should have been
of Homeland Security (DHS) which continues to “requested” by someone at your site. If they are
aggressively improve security systems across the present for no apparent reason, there is immediate
country cause for concern. Get the right people involved in
Ì State and local governments have reviewed their investigating these questionable activities and events.
security systems and have made a variety of significant
Your site may have a variety of security
improvements
procedures dealing with suspicious packages, bomb
Ì the US Coast Guard and Department of threats, emergency response and others. Take time
Transportation have published federal regulations to read them and understand your role in carrying
dealing with security issues
them out.
Ì AIChE’s Center for Chemical Process Safety
Be particularly diligent if your site handles
(CCPS) developed and distributed "Guidelines for
hazardous chemicals. These facilities are especially
Analyzing and Managing the Security
sensitive and should receive special attention.
Vulnerabilities at Fixed Chemical Sites"
Ì American Chemistry Council members have Housekeeping is an important element in site
implemented the Security Code of Responsible CareR security. A clean plant is a plant where “unusual
items” are readily detected.
Ì Many chemical facilities globally have completed a
Security Vulnerability Analysis (SVA) and have Recognize that increased security may result in
implemented recommendations increased inconveniences. Be tolerant of them.
STAY ALERT! Our collective watchfulness creates the foundation for our future well being.

Spanish
CENTER FOR
Sponsored
by
CCPS
August 2005
Toxic Reaction in Sewer is Fatal
Several construction employees
working near a collection pit were
overcome with hydrogen sulfide
gas. The gas was released nearby
when sodium hydrosulfide was
accidentally mixed with sulfuric
acid. Three workers collapsed
almost immediately and three
others tried to rescue them. Two
of those rescuers also collapsed. In
all, ten workers were exposed to
This accident investigated by and pictures provided by the U.S. Chemical Safety and the toxic gas. Two died and eight
Hazard Investigation Board. Visit their site at http://www.csb.gov
others were injured.
How Did This Happen ? What You Can Do

Fifteen trucks of sodium hydrosulfide • Use disposal systems only for the chemicals they are
(NaSH) had been delivered to the facility designed to handle. Recognize that trenches, sewers,
in the previous 24 hours. Each truck is and other disposal systems contain a variety of
believed to have spilled about 5 gallons chemicals which can generate toxic gas or cause heat
(19 liters) in to the collection pit. to be liberated if non-compatible materials are mixed.
Construction employees were working in
the area and needed to enter the • Understand the expected reactions for accidentally
collection pit. Operations drained the pit mixing chemicals normally present at your site. Take
into what was believed to be the special precautions for any reactions that produce
wastewater system. Instead, the pit toxic gas or liberate heat. If you have an interaction
drained in to a sewer line where sulfuric matrix, take time to understand it! Other hazardous
acid was present in quantities sufficient gases that might easily be generated in a sewer
to react with the NaSH. include chlorine, sulfur dioxide, and carbon dioxide.
As soon as the two chemicals mixed, Recognize that some toxic gases dull your sense of
they reacted and toxic hydrogen sulfide smell so you may have to react quickly.
gas was released. The toxic gas escaped
• Some disposal systems are designed to be sealed.
from the sewer system through the seal of
a fiberglass manhole cover near the Promptly report any leaks and missing seals to
workers. supervision for maintenance.
• Know your role in an emergency. NEVER try to
PSID Members see Free Search: Hydrogen sulfide; truck rescue someone if you do not have the proper life
loading; truck unloading; sewer systems saving rescue equipment and training.
Disposal Systems Can Become Dangerous Reactors !

Spanish
Dedicated
CENTER FOR
S http: //www.aiche.org/ccps/safetybeacon.htm
to all those that
lost their lives or
were injured in
the Piper Alpha
Messages for Manufacturing Personnel tragedy
July 2005
Piper Alpha Oil Platform Destroyed Here’s What Happened
Seventeen years ago (July 6, 1988), leaking
natural gas condensate on the Piper Alpha oil
platform in the North Sea exploded. The
explosion disabled the communications center
and was followed by a fireball and a large oil
pool fire. The fire ruptured a major gas line
that was transporting gas from another oil
platform to Piper Alpha. That massive gas
release caused a larger explosion and fire which
engulfed the entire platform. Within an hour,
other gas lines ruptured and the fire was
completely out of control.
165 workers and 2 rescuers were killed. The
platform was totally destroyed.
PSID Members see: Phase of Operation—Maintenance
*Guidelines for Investigating Chemical Process Incidents, 1992, CCPS of AIChE
during Operation
The Piper Alpha platform drilled for oil and processed

• Communicate effectively at shift turnover.
natural gas from other platforms. A maintenance crew Inform the oncoming shift what equipment
was working on a pump in the gas processing unit. As is out of service and why. A log book can
part of their work, they removed a relief valve from the be a very effective tool for this task!
pump’s discharge line—but did NOT install a regular • Do not short cut maintenance or safety
blind flange to cover the opening. They did not complete procedures. Complete all permits, make
the repair work that shift so they told the shift supervisor
sure that the oncoming shift knows about
that the pump should not be used. Unfortunately, this
message was not given to the operators on the next shift.
them and understands their importance.
When the primary pump failed, the operators started the

• Know the hazards your unit imposes on
pump that had been taken out of service. Gas condensate other units and the hazards they impose on
immediately escaped from the opening where the relief yours. Know what to shut down when there
valve should have been. An explosion and fire occurred is a problem.
damaging fire walls and the control room. The heat from • Restore automatic fire protection systems
this fire ruptured gas transportation pipelines from other to service as soon as they are available.
platforms—which added to the fire and ensuing damage.
Take special precautions when they are out
The fire water pumps had been placed in the “manual” of service for repair or testing and return
position since divers were in the sea earlier during the them to service as soon as possible!
day and no one activated the system during the
emergency. Emergency evacuation routes from the • Know emergency evacuation routes for all
crew’s living quarters were blocked by smoke and fires. types of emergencies and hazard locations.
Incomplete Maintenance Activity + Poor Shift Turnover = Disaster


English, French, German, Hebrew, Hindi, Portuguese, and Spanish
CENTER FOR
Sponsored
by
CCPS
June 2005
Too Many Start-
Start-Stop Switches Here’s What Happened
The evening shift was assigned to clean an
agitated mixing vessel. The supervisor asked the
lead operator to complete the “Lock out.” The
lead operator tagged and locked out the motor
starter in the Motor Control Center, verified the
motor would not start by pressing the Start
button and put a lock and “Danger—Do Not
Operate” tag on the Start-Stop station near the
vessel. The supervisor then issued the Confined
Space Entry permit and two workers entered the
vessel and cleaned it for the rest of the shift.
The oncoming day shift needed to reissue the
Confined Space Entry permit. When they tried
the Start button on the Start-Stop station, the
agitator started! The agitator motor was NOT
PSID Members see: Free Search--Agitator locked out!
What You Can Do
How Did This Happen ? Follow all safety procedures as written.
Do not take short cuts or assign your duties
Easier than you might imagine. Did the Lock-out undo
to someone else.
itself? No, but the wrong motor was locked out. How
can that happen when the starter was labeled the same as Keep abreast of changes in your unit.
the agitator? And, why didn’t the agitator start when the Know what has been changed and how that
change might affect your job.
Start button was tested the first time?
Use your Management of Change
Here’s how. Several months before, the agitator motor procedures to ensure that all out-of-service
was changed out to a larger size. The size increase equipment is labeled so that it cannot be
required a larger motor starter and wiring. Because the confused with equipment being used.
plant might need the “old” system again some day, it Consider disconnecting electrical leads
was not removed. Instead, a new Start-Stop station was whenever uncertainty exists.
installed near the vessel, in fact, right next to the old Check and re-check, especially where
Start-Stop station. The “old” Start-Stop station was on safety is concerned. Look around the area.
the flange part of a column next to the vessel and the Is anything unusual?
“new” Start-Stop station was in the web of that same Remember that your safety depends on
column. When the technician locked out and tested the others and your own personal actions.
system, he was testing the “old” system which was Don’t bet your life on someone else’s word.
disconnected. The “new” system was still active! Verify safety checks yourself.
When you do a safety check, make sure it is on the right equipment !

CCP
CCPS CENTER FOR
Sponsored
by
An
AnAIChE
AIChEIndustry
Industry CCPS
Technology
TechnologyAlliance Supporters
Alliance Messages for Manufacturing Personnel
May 2005
Storage Area Completely Destroyed Here’s What Happened
A major fire destroyed this motor oil and automotive
fluids blending, storage and packaging facility one
evening after all regular employees had left. Because
the facility was not designed to contain runoff and
had no on-site fire fighting capabilities, such as a
sprinkler system or fire hydrants, the civic authorities
had no option but to let it burn. The nearest source of
fire fighting water was more than a mile away.
The facility was totally destroyed. One business
nearby was also destroyed and many homes were
damaged. Approximately 900,000 gallons/3.4
megaliters of liquid waste and 2,500 cubic
This accident investigated by and picture provided by yards/1,900 cubic meters of contaminated soil and
the U.S. Chemical Safety and Hazard Investigation
Board. Visit their site at http://www.csb.gov debris had to be removed for disposal. There were no
injuries, but the company decided not to rebuild and
PSID Members see: Free Search—Tank fire 100 community jobs were lost.

• Be aware that combustible liquids are fire
Evidence of how the fire started was hazards just as flammables are. They may be
destroyed, but it is believed that a harder to ignite, but once started they burn with
combustible liquid, perhaps on a rag, spectacular results.
contacted a hot motor or light. After it • Take care when handling combustible liquids.
started to burn, there were no protective Be sure to use containers specifically designed to
systems in place to stop or control it and the store or dispose of combustibles and their waste
fire water supply was too far away for civic products, such as oily rags which can easily ignite
responders to use quickly. due to a wicking effect. Don’t just throw them
Dikes surrounded the tank farm, but the away like trash or leave them in the work area.
walls were not liquid tight. As vessels failed, • Inspect your work area for fire hazards and
flaming liquid quickly spread involving other protection systems. Make sure that fire
vessels. Because there was inadequate suppression and control procedures are in-place
separation between the tank farm and and available. Pay particular attention to passive
warehouses, flames moved quickly from area protection systems and look for cracks or holes in
to area. dikes and walls around storage tanks.
• Know what to do in a fire emergency. Know
The facility did not have any on-site fire how to report the fire, how to use a fire
detection systems and did not conform to any extinguisher, how to shut down equipment
voluntary fire code standard. quickly, and your escape route.
Combustible Liquids + Heat = Fire… and Eventual Job Loss

CCP
CCPS CENTER FOR
Sponsored
by
An
AnAIChE
AIChEIndustry
Industry CCPS
Technology
Pressure Explosion Results Here’s What Happened April 2005
A tank in this 55 year old facility that produces

caramel coloring exploded, killing one worker and
heavily damaging other equipment. Vessel
fragments were thrown as far as 150 yards/130
meters and the top head of the vessel was propelled
100 yards/90 meters. Shell fragments damaged
adjacent structures and equipment including an
aqua ammonia tank. This resulted in the release of
26,000 pounds/12,000 kgms of aqua ammonia,
causing nearby residents to be evacuated or told to
This accident investigated by and picture provided by shelter in place.
the U.S. Chemical Safety and Hazard Investigation
Board. Visit their site at http://www.csb.gov Other major damage included collapsed concrete
block walls, destruction of the spray dryer area as
What You Can Do shown in the photograph, and the rupture of a 6
inch natural gas line. Fortunately, automatic shut-
This incident shows that pressure, by itself,
off valves in the gas line prevented a major gas
can cause a major accident!
release.
• Never completely block in a vessel. Some
form of emergency or manual pressure relief (or How Did This Happen?
vacuum break) system must be available.
The explosion was a simple case
• Vessels that are heated should be monitored
of over-pressurization.
closely—especially if there are no safety
instrumented systems or interlocks to shut off The contents of the feed tank were overheated by
the heat source if needed. steam coils, causing the vapor pressure to rise.
There were no temperature alarms or interlocks to
• Before connecting an air or nitrogen line to a
vessel, make sure that the vessel can withstand automatically stop the steam flow or notify
the full supply pressure or that the vessel has a operations that there was a problem. Because the
suitable relief system set low enough to protect operators were distracted by having to re-label a
the vessel. previously packaged order, they did not notice
• When doing jobs that distract you from your that the temperature in the tank had risen above
regular operations job, periodically check the specifications. At the same time the temperature
equipment to confirm that it is still operating was rising, the operators closed a vent line and
normally. opened an air pressurization line to the tank in an
• Do not underestimate the power of over- effort to “blow out” high viscous material. That
pressurization and its ability to cause act completely blocked in the vessel which had no
catastrophic failure. Metal fragments can travel emergency relief system. The result—
long distances and do significant damage! catastrophic failure to relieve the pressure.
PSID Members see: Free Search--Overpressure
All Pressured Up and No Place to go = BOOM !


English, French, German, Hebrew, Hindi, Portuguese, and Spanish.
CCP
CCPS CENTER FOR
Sponsored
by
An
AnAIChE
AIChEIndustry
Industry CCPS
Technology
March 2005
Tower Top Rockets Off
Five weeks before the explosion, this tower was taken out of
service. Approximately 1,200 gallons (4,500 liters) of the
hydrocarbons being processed remained in the tower.
During those five weeks, steam was sporadically and
inadvertently added to the tower. The steam slowly heated
the residual material, but since the tower was not operating,
the temperature rise was unnoticed by operations.
On the morning of the accident, operations heard a rumbling
coming from the tower and then a loud sound similar to a
relief valve venting. They sought shelter in a nearby control
room. Within minutes the 145 foot (44 meter) tall tower
exploded injuring three workers.
The explosion blew the top 35 feet (11 meters) of the tower
off and hurled debris a mile (1.6 kilometers). Vessels as far
This accident investigated by and picture provided by
the U.S. Chemical Safety and Hazard Investigation as 500 feet (150 meters) away were damaged and several
Board. Visit their site at http://www.csb.gov fires started. A portion of the top section of the tower was
never found.
When operations decided to shut the steam off,
they closed the steam supply valves, but those • Know the “shut down” and “make-safe”
valves were corroded and a small amount of steam procedures for your unit. Practice them in
leaked through. Over the next 5 weeks, the 1,200 your mind.
gallons of hydrocarbons that remained in the tower • Many accidents happen each year
began to decompose into unstable chemicals because of valves that leak through.
because of the inadvertent long term heating. Whenever a process is shutdown, verify that
manual valves are providing tight shutoff.
A PHA of a similar but batch production process Take corrective actions if they are not.
was conducted several years earlier and revealed
that the chemicals used would decompose above • Recognize that all buildings are not safe
370 0F (188 0C). This information was never havens. In some cases the building may
shared with those operating the continuous process. collapse if an explosion is nearby. Know
which buildings are safe and which are not.
Therefore, no temperature interlocks were installed
and there was no mention of high temperature • Pay attention and react to unusual sounds
decomposition reactions in the operating and pressure/temperature readings, even if
instructions. the unit is down. They may be indicating a
PSID Members see: Free Search—Distillation column major problem.
ACT before the REACTION is Uncontrollable !


CCP
CCPS CENTER FOR
Sponsored
by
An
AnAIChE
AIChEIndustry
Industry CCPS
Technology
February 2005
Insulation Does NOT Prevent Corrosion
Corrosion Attacks Piping Corrosion Attacks Structural Supports

Under insulation corrosion does not discriminate. It
attacks process piping, vessels, and structural supports.
The photograph on the left shows major The sphere in the photograph on the right
external corrosion of a pipe transferring collapsed during hydro testing. The legs
Phenol. The pipe was insulated and failed were fire proofed, hiding corrosion of the
before the corrosion was discovered. structural steel. When the sphere was
Although no one was injured, it was very partially filled with water, it collapsed. One
expensive to correct the environmental person was killed and one was seriously
damage and make piping system repairs. injured.
PSID members see: Free Search--Corrosion
Why This Happened What You Can Do to Detect or Prevent Hidden Corrosion
Thermal insulation and fire proofing ¾ Know what structures and equipment in your process have the
potential for under insulation corrosion.
provide the “cover” for corrosion to hide
Check low points where moisture might accumulate
under and the right environment for it to
start and grow in. This cover may trap ¾ Be aware of and look for the signs of hidden corrosion:
Rust stains or discoloring
moisture or spilled chemicals, that under
Bulges, blisters or bubbles
certain circumstances, form corrosive
conditions that attack the underlying Small leaks, drips or wisps of vapor or odors
steel. Because it is hidden from sight, the ¾ Inspect—look, but don’t touch.
corrosion often progresses undetected for If you disturb a severely corroded area, a leak may
many years and may result in failure. occur. Plan inspections and, when necessary, shut down
systems before removing corrosion.
Be alert for the signs of hidden corrosion !

CCP
CCPS CENTER FOR
January 2005
The Beacon would
An AIChE Industry like to thank the
An AIChEAlliance
Industry
Technology
Technology Alliance Messages for Manufacturing Personnel following volunteer
translators for their
2004 in Review---Remember the lessons learned! help during 2004.
Their efforts have
Understand the made the Beacon a
Know your role in publication read
consequences of change
outages! around the globe.
Thank You to…

Awilda Fuentes, Vanessa
Rodríguez and Armando
Santiago with EPA -
Office of Emergency
Management for the
January Spanish translations;
March
Li Yi with Kunming
Flixborough: Evaluate Temporary Cellulose Fibers Co., Ltd.
August for the Chinese
changes translations;
Robert Gauvin with

Pétromont for the
French translations;
Helder Figueira, Nuno

Pacheco, Jorge Santana
and Antonio Candeias
with Repsol Polímeros
Chlorine transfer hose failure: for the Portuguese
June Material received must have a translations;
quality assurance program
Delia Habel with BP
Germany for the
July Bhopal: Test safety German translations;
systems for the worst
Paulo Haro with
case scenario Petrobras for the
Brazilian Portuguese
translations;
Jean-Paul Lacoursière
with J.P. Lacoursière Inc.
for the French
translations;
Stay within expansion
joint design limits December Marc Brorens with BP for
the Dutch translations;
Whenever flammables are released,
September Anonymous with Rohm
a fire is just a spark away! & Haas for the German
translations;
Pillai Sreejith and Alok

Agarwal with
Cholamandalam MS Risk
Services Ltd. for the
Hindi translations.
The Beacon is usually available in Chinese, Dutch, English, French,

French, German, Hindi, Portuguese, and Spanish
CCPS CENTER FOR
Sponsored
by
December 2004
Bhopal—A Tragic Event
What Happened?
It was just after midnight,

December 3, 1984 in
Bhopal, India. A
succession of events
occurred in the Union
Carbide India Li mi ted
facility that led to the
release of ~40 metric tons
Union Carbide Bhopal Plant of methyl isocyanate (MIC)
gas. The consequences
were tragic: according to the
Indian government, more than
What You Can Do 3800 people died shortly after the
release and thousands were
- More than any other in the history of the chemical industry,
this incident demonstrates why robust safety systems are critical
injured.………………......……….
when handling hazardous materials. This incident was also one of
the driving forces which defined process safety management as
we know it today.
- Understand the reactivity hazards of all materials in your
process. Read the reactivity section of your MSDS's, fully The basic cause has been agreed
understand all reactivity instructions in your operating procedures upon by most experts who
and be knowledgeable about why your safety systems (e.g. investigated this event: a significant
interlocks, relief devices, scrubbers) are there and how they work. quantity of water entered the MIC
- If a material in your area reacts with water: 1) be cautious storage tank. Water reacted with
when washing equipment for maintenance or whenever a water MIC, temperature and pressure rose
hose is used, and 2) remember that compressed air may contain and several safety systems could not
condensed water – be sure process air is free of water before deal with the event. Eventually, the
blowing lines. vessel's relief device lifted,
- Understand the emergency procedures you are to take if the releasing MIC vapor.……
temperature or pressure increases quickly in vessels storing
hazardous materials, especially those which are reactive. 20 years later, the exact water
source remains controversial.
- Encourage your management and technical group to have a
discussion about the “worst case” for the facility you work in and
However, it is clear that installed
what safeguards have to be maintained to prevent that scenario safety systems did NOT prevent a
from occurring. large release of toxic gas.
Understand the "worst case scenario“ & “layers of protection” for your facility!
CCP
CCPS CENTER FOR
Sponsored
by
An AIChE Industry
An AIChEAlliance
Industry
CCPS
Technology Supporters
Technology Alliance Messages for Manufacturing Personnel
Unapproved Procedure Change = Fire November 2004

Visit the CSB document on MOC at:
http://www.csb.gov/safety_publications/docs/moc082801.pdf
What Happened?
This small stripper was used to separate a light
solvent from a heavier oil. Annually, the unit
was shut down for internal inspection and
cleaning. The practice had been to allow 24
hours for cooling down before starting
maintenance work and opening the stripper.
This time, the shutdown team decided to shorten
the cool down period to 12 hours to reduce the
time the unit would be out of service.
The unit was shut down, allowed to cool for 12
hours and then the stripper was opened. Almost
immediately, smoke began to come out of the
open manway. There were no visible flames and
no one was injured, but it was obvious that
something had caught on fire.
What you can do

• Understand the reason for each processing
Why did this Happen? and maintenance preparation step.
A Long Standing Procedure was Changed Don’t assume—KNOW!
without Understanding ALL Consequences! • Know how and when to use your facility’s
• It was believed that the 24 hour cool down management of change (MOC) process. Ask to
period was to protect workers from hot be sure that all changes have been reviewed and
surfaces. No one understood that those approved before taking action.
same hot surfaces might cause residual • The process safety information should
solvent or oil to catch on fire. contain autoignition temperatures if the process
• Oxygen was introduced in to the vessel before operates above them. If your process does,
the temperature had dropped below the make sure you are well below those
autoignition point of some of the residual temperatures before allowing air to enter.
materials. This completed the fire triangle by Equipment containing chemicals must be
adding oxygen to the fuel and heat already cooled below the autoignition temperature
present. before opening!
PSID members see: Free Search—MOC and Free Search—Vacuum Column
Thoroughly Evaluate Changes—Know, Don’t Guess the Consequences!

This edition is also available in German, French, Spanish, Portuguese and Chinese. Contact CCPS at ccps_beacon@aiche.org for information.
CCP
CCPS CENTER FOR
Sponsored
by
An AIChE Industry
An AIChEAlliance
Industry
CCPS
October 2004
Available When Needed???
A visible Hidden Hazard!
We don’t know where this
picture is from, but we thought
it could be used to convey an
important message. Sometimes
hazards are right in front of us
and we fail to see them for
what they are… because they
are so obvious! In this case, it
would be impossible to:
1) Get to the valve quickly, and
2) Operate the valve in an
emergency.
As you go about your daily duties, think about this picture and look for similar “visible”
hidden hazards in your facility.
• A chain AND two branches prevent this valve from being operated. The valve and handle
are painted red which lead us to believe it’s part of a fire water system—usually a pretty
important system in an emergency. This valve won’t be easy to access in an emergency and its
pretty obvious it hasn’t been turned in YEARS! This facility must not have a program to test
emergency systems regularly. What would you do if your job was to open or close this valve?
• This is an excellent example of an emergency system that is NOT operable. Your facility
may have valves or other equipment that are even more inaccessible. You don’t notice them
because they are used infrequently and tend to be forgotten---until they are needed. Where do
they exist in your facility?
• Being able to access and operate critical pieces of equipment is essential in today’s process
and manufacturing operations in all industries. It doesn’t matter if it is a valve, electrical
pushbutton, or just having a clear line of sight to a field temperature or pressure gage. If you
can’t get to it and use it as intended when needed, it is a hazard—sometimes a visible Hidden
Hazard. Do you have any of these visible Hidden Hazards in your workplace?
• The next time you come across a situation where access is difficult, or you have concerns
regarding operability of equipment in your facility, discuss it with your supervisor or
department / area safety committee.
Look Through the Camouflage and IDENTIFY your Hidden Hazards!
CCP
CCPS CENTER FOR
Sponsored
by
An AIChE Industry
An AIChEAlliance
Industry
CCPS
Overflow + Ignition Source = Tank Farm Fire September 2004
This is what can happen when a tank containing a flammable liquid overflows!
What Happened?
Late one evening, a large storage tank containing a flammable liquid began to overflow. It was
not detected until a security guard noticed a strong odor. He immediately called the area
operations personnel to report his concern. Two operators responded by driving a truck to the area
to investigate. Within minutes, there was a loud explosion and fire. (It is believed that their truck
provided the ignition source that caused the initial deflagration and ensuing fires.) It took plant
and civic personnel a day and a half to extinguish the fires which moved from one tank to the next.
More than a dozen employees were
What YOU Can Do
hospitalized and there was significant
property damage. • Transferring flammable liquids is always a risk with
potentially significant consequences. Monitor transfers
closely so you can detect and respond to spills and leaks
How Did it Start? early!!!!
The tank was being filled but the operators did • Never drive into a flammable cloud! Vehicles can
provide ignition sources—such as a hot engine manifold
not know that the level indication AND the or muffler. These are often well above the autoignition
safety alarm systems had failed. They did not temperature of many flammables. Remember, if a cloud is
monitor the filling operation closely because ignited by the vehicle you are driving, you will have a
front row seat and be the center of the explosion.
they believed that the tank still had plenty of
•Take every report of an unusual occurrence or odor
capacity remaining. And, they did not take the seriously and respond quickly and thoroughly. Note: If
security guard seriously or respond promptly the engine of the vehicle you are driving begins to
when he reported the strong odor since he was rev up on its own, shut it down and get out
new on the job. Like most significant events, a immediately. You may have driven into a
flammable atmosphere.
number of things “failed” –all at the same time! PSID Members See Free Search—Tank Fire
Whenever Flammables are Released, a Fire is Just a Spark Away !
CCP
CCPS CENTER FOR
Investigated by
U.S.
U.S. Chemical
Chemical Safety
and
and Hazard
Hazard
Safety
An AIChE Industry Investigation
Investigation Board
Board
An AIChEAlliance
Technology Industry
Technology Alliance Messages for Manufacturing Personnel http://www.csb.gov
Chlorine Transfer Hose Failure August 2004

Here’s What Happened:
Chlorine was being transferred from a railroad tank
car when the transfer hose burst. Both automatic and
manual emergency shutdown systems failed so the
release was unabated for about three hours.
Approximately 48,000 pounds (21,800 kg) of chlorine
escaped before emergency responders were able to
stop the release. They entered the chlorine cloud
wearing “Class A” safety gear and climbed on top of
Chlorine
the car to close the manual shut off valves.
gas cloud Near by neighbors either evacuated or “sheltered-in-
place.” The adjacent Interstate was closed to traffic
See the CSB investigation report summary on their web site,
http://www.csb.gov/completed_investigations/docs/CSB_DPC
for 1 ½ hours. Of the 63 people that sought medical
FinalDigest.pdf evaluations due to respiratory distress, 3 were
hospitalized. The release also damaged trees and
What YOU Can Do other vegetation in the area.
Know what to do in an emergency! Always check to How Did this Happen?

ensure that emergency shutdown equipment has a The ruptured hose should have had an
current test tag. If it does not, report it. Test the entire
inner Teflon liner reinforced with a
shut down loop before you rely on it. Your job—make
Hastelloy C-276 exterior metal braiding.
sure it will work when needed!
Instead, the exterior metal support
Conduct a pre-use check before using any braiding was stainless steel and was
replaceable equipment, such as hoses, sample easily corroded by chlorine permeation
containers, instruments, etc. to be sure that they are fit through the Teflon liner. The hose failed
for the service. If in doubt—do not use it!
after less than 2 months of service.
When receiving new equipment make
Both the purchase and shipping
sure that it is exactly what was ordered.
papers indicated that the hose was
Some materials are difficult to tell from
others, but performance may be constructed of the proper materials, but it
significantly different! was not tested or verified upon receipt.
Ask for “positive materials identification” testing An emergency shut down system
where different materials look alike. This is especially activated by an employee before
important where a mix-up can lead to a hazardous event. evacuation failed to work because of
Make this part of the area’s process hazards analysis. severe build up on the valve ball.
PSID members see Free Search—hose
Make Sure What You Install is Adequate for the Service

CCPS CENTER FOR
Sponsored by
An AIChE Industry
Technology Alliance
Messages for Manufacturing Personnel http://info.knovel.com/ccps
Misalignment + Corrosion = Failure! July 2004

This TFE lined stainless steel expansion
joint was part of a piping system
containing a high concentration of HCl.
The expansion joint was not installed
properly and HCl had embrittled the
stainless steel bellows. This embrittlement
along with fatigue caused by improper
alignment and insufficient restraint caused
the joint to fail. The catastrophic failure
you see in this picture occurred the day
after it passed a visual inspection.
Fortunately, the system pressure was low,
the leak was small, and no one was around
when it failed. In this case, there were no
What You Can Do injuries. However, if the circumstances
Remember—Expansion joints are usually the had been only slightly different…
weak point in a piping system!
How Did this Happen?
• Expansion joints are precision engineered equipment
and MUST be installed correctly! • The piping to the vessel where
• Ensure that all equipment is installed per this expansion joint was used was
manufacturer’s specifications!!! Use the facility’s misaligned by approximately ¾ inch.
management of change (MOC) process to review ANY This caused stress on the expansion
modification or change. joint.
• When making visual inspections, note every change • The three retaining bolts that limit
from previous inspections and notify the inspection compression and extension were not
department of those changes. Protect yourself against installed on the expansion joint
sudden failure during the inspection. Sometimes visual because of space limitations. This
inspection while the equipment is in service is not allowed excessive movement and
enough. The equipment may have to be disassembled placed even more stress on the joint.
or simply replaced at a defined interval. • The specification for this joint had
• Know and plan around common causes of failures: changed during a retrofit of the process
1) Expansion joints are usually weak spots in piping systems. for a new chemical service, but the
2) Misalignment may cause stress cracking. expansion joint was not replaced with
3) HCl embrittles stainless steel. one of proper specification, requiring a
Inspection and maintenance programs should not higher grade of stainless. This likely
overlook common causes and expected failure modes contributed to the HCl embrittlement
for expansion joints. of the stainless steel making it prone to
PSID members see Free Search—Expansion Joint stress cracking and failure.
Expansion Joints have Design Limits—Make Sure they are not Exceeded !
CCPS Process Safety Beacon
This Edition Sponsored by
Pfizer
CENTER FOR
An AIChE Industry
Technology Alliance
Messages for Manufacturing Personnel http://www.pfizer.com
Flixborough—30 Years Ago… June 2004
What Happened? Why this Happened

One of the six reactors in series needed The temporary modification was not adequately
repairs. To minimize downtime, it was reviewed for potential adverse consequences!
decided to bypass that one reactor and
repair it off line. A temporary bypass line • The temporary bypass was made with two bends in it
was installed using a pipe with an because the nozzles on the two tanks were at different levels.
The impact of internal forces and flow stresses were not
expansion bellows on each
considered on the expansion bellows.
end and supported by
scaffolding. Because of the • Expansion bellows were left in place on each end of the
rush to resume production, bypass line. The suitability of this design and manufacturer’s
recommendations were not considered.
the new bypass was not tested prior to
start up nor were engineering standards • The weight of the temporary bypass was not securely
or manufacturer’s recommendations supported—it was simply placed on scaffolding. The amount
considered. of movement and the effect of that movement on the bellows
were not considered.
Approximately three months later, the
expansion bellows in the bypass line What You Can Do
failed and released an estimated 30 tons
of flammable cyclohexane. The resultant • Always follow your company’s Management of Change
vapor cloud ignited killing 28 people and (MOC) procedure. Remember, temporary changes
injuring 89 more. The entire plant was demand the same rigorous review as do permanent
destroyed and hundreds of homes and changes. If you do not utilize a MOC procedure, discuss
stores were damaged. the value it could provide to your facility.
See the Chemical Safety Board web site: • Make changes only after thorough hazard reviews have
http://www.csb.gov/safety_publications/docs/moc08 been conducted and approved by qualified experts.
2801.pdf for MOC related accidents.
PSID Sponsors see: • Use good engineering practices and manufacturer’s
Free Search—Management of Change recommendations.
Evaluate Every change, even Temporary ones—for Expected and Unexpected Consequences
This Edition Sponsored
by
CENTER FOR
An AIChE Industry
Technology Alliance
Messages for Manufacturing Personnel www.acutech-consulting.com
Start your Hot Work Safely… May 2004
Before
After
…and you won’t End it with a BANG!
What Happened? What You Can Do to Prevent it from

Happening to You
A welder was grinding near Operations
this flow transmitter
• Look around the area where the hot work will be performed and do a
enclosure. There was a
thorough gas check of all potential sources---not just the obvious ones.
small leak in the transmitter Use extra care when checking in or near small enclosures (like the one
assembly and the enclosure in this incident).
filled with flammable
vapors. Vapors escaping the • If your job duties include using gas detection equipment, you should
have been trained in its use. Remember, equipment must be calibrated
box were ignited by the
per manufacturer’s recommendations or it may not give the correct
grinding sparks causing a reading!
small explosion which
injured the welder and • Know where leak sources could occur, and be sure to sample there.
destroyed the transmitter. If conditions are likely to change, consider continuous monitoring.
Operations had performed a
gas test in the area before Maintenance
issuing the hot work permit • Look around the work area for sources of flammable material and be
but the leak in the enclosure aware of any strange odor. Remember, you will be supplying the
went undetected. ignition source so all that is needed is fuel.
• Ask the operator exactly where a gas test was performed. If one was
PSID Sponsors see: not done, insist that it be done. If it did not cover all potential source
Free Search—Hot Work areas, insist that a retest be done.
Hot Work + Undetected Gas Leak = Damage and Injury

This edition is also available in Spanish, French, Portuguese and German. Contact CCPS at ccps_beacon@aiche.org for information.
This Edition
Sponsored by
CENTER FOR
An AIChE Industry
Technology Alliance
Messages for Manufacturing Personnel http://www.iomosaic.com
Do You See the Hazard? April 2004

What Happened?
Top Manway An employee was assigned to
sample the atmosphere in a reactor
by using a flexible hose equipped
with a rubber hand pump. To do so,
he went to the open top man way
and was later found dead. The
reactor had been opened for
catalyst unloading and was being
purged with nitrogen. While the
cause of this accident has not been
positively determined, it is quite
possible that nitrogen exiting the
vessel overcame (asphyxiated) the
You Can’t. The Hazard is Invisible ! employee.
What You Can Do to Prevent it from How Did This Happen?

Happening to You Since nitrogen is a colorless, odorless
gas that does not provide any indication
We all recognize the hazard of entering a confined
of danger, it is truly an invisible hazard.
space with an atmosphere containing a low oxygen
level, but we should also remember that…. Air normally contains approximately
While purging an open vessel: 20.8% oxygen. However reducing that
level just a little reduces a person’s
¾ Be aware that possible oxygen deficient areas
can extend beyond a confined space, especially ability to function.
during initial gas testing and monitoring of a vessel. Atmospheres with less than 19½%
¾ If there are any doubts, use a self contained oxygen are defined by OSHA as “oxygen
breathing apparatus and an observer to call for help, deficient” and can be fatal over a
if needed, when working near purged equipment relatively short period of time.
openings. – This is especially true for emergency
responders to a possible asphyxiation accident. Normal breathing is controlled by the
amount of carbon dioxide in the body.
¾ Control access to the potentially dangerous area, Excess exposure to nitrogen can replace
post Danger Signs at vessel openings, and use a
Safe-to-Work permitting system that includes a sign- the carbon dioxide and cause breathing
in/sign-out log system separate from the Confined to stop completely.
space log.
Nitrogen “tricks” the body into
See the Chemical Safety and Hazard Investigation Board (CSB) not breathing.
Web site, http://www.csb.gov/safety_publications/docs/SB-
Nitrogen-6-11-03.pdf , for additional information on nitrogen
asphyxiation. PSID Sponsors see: Free Search—Nitrogen Purge
If in Doubt … Please Stay Out !!!

This edition is also available in Spanish, French, Portuguese and German. Contact CCPS at ccps_beacon@aiche.org for information.
This Edition
Sponsored by
CENTER FOR
An AIChE Industry
Technology Alliance
Messages for Manufacturing Personnel http://www.iomosaic.com
The Electricity just went off… March 2004
On August 14, 2003 shortly

after 4:00 PM EDT, a massive
Northeast coast
power outage occurred in the
power failure area
northeastern U. S. and eastern
Canada that affected about 50
million people. The cause and
cure remain to be determined,
but the effect was immediate
and profound.
Amid this disaster, one thing
seemed to be missing. There
were no catastrophic releases
of toxic chemicals, major fires
or explosions from chemical
or petrochemical plants!
Is your plant safe ? Would your plant do as well?
What You Can Do to Keep Your Plant Safe in an Electrical Outage
• Research—Make
Research sure you know this…
• Find out which instruments and equipment are on the emergency power system and which ones are
not. Know how to compensate for the controls that will be lost.
• Review the operating instructions of the emergency power system. Know how long it is expected to
operate. If you have an emergency generator, make sure you have operating instructions, fuel and
any other items needed for its operation.
• Know the power off-fail position of key instruments and equipment. Most are probably designed to
go to a “fail-safe position,” but for those that are not, you should have instructions on what to do.
• Preplan—Think
Preplan through what you would do…
• Think about the 1st, 2nd and 3rd things you would immediately do if the power failed. Make sure
these things take care of potential emergencies and that the plant is safe.
• Know the calls and notifications that you need to make and know how to make them quickly.
• Review your emergency response plan and emergency procedures for actions to be taken.
• Accidents can occur during restart after a power outage. Know the safe restart procedure!
• Practice—Walk
Practice and talk through what needs to be done…
• Talk with your co workers about what they would do and why. Develop a common plan for
response to power failures. Know how to respond when all alarms sound at once.
• If you can, conduct or participate in power failure drills including the testing of emergency
generators. If this is not possible, mentally walk through power failure actions.
The sudden lack of electricity can be shocking. Know your

your role in outages!
This edition is also available in Spanish, French and German. Contact CCPS at ccps_beacon@aiche.org for information.
CCPS CENTER FOR
Sponsored
by
February 2004
Flammable Gas in Enclosed Space = BOOM !
A pickup truck with a small
cylinder of acetylene stored
in the cab was parked for the
weekend. Unfortunately, the
cylinder had a VERY small
leak. Because all the
windows were closed, a
flammable atmosphere was
developed inside the truck’s
cab. When the owner
returned on Monday and
opened the door---BOOM.
How This Relates to Process Safety and You can see the results.
What You Can Do to be Safe !
This event may seem to have little relationship to process safety
in chemical plants, but NUMEROUS building and vessel How Did This Happen?
explosions have occurred under similar conditions!!!
• Acetylene is one of those
• Storing flammables of any kind in an enclosed area is gases that has a very wide
risky business. Small leaks can lead to flammable flammability range. In fact,
mixtures in a portion of, or an entire building. Then, only
an ignition source is needed—and, ignition sources are acetylene is flammable in
very easy to find! concentrations from 2.5% to
• Store flammable liquids in containers and cabinets 82% in air.
specially designed for such use. Be especially alert for • It took only a very small
solvents used in maintenance activities. leak to eventually fill the cab
• Store flammable gases in the open or well ventilated of this truck with the ¼ pound
areas so that small leaks can dissipate and NOT of acetylene needed to reach a
accumulate. Particularly watch out for instrument flammable mixture.
calibration gases and welding bottles.
• Remember that some gases are heavier than air and • When the door was opened,
some are lighter. Provide the appropriate ventilation. the flammable mixture
“found” an ignition source.
• Know and consider where and how explosive mixtures
might accumulate in piping systems or process vessels, • In this case, the driver was
such as in the head space of atmospheric tanks. Be seriously injured, but luckily,
prepared to recognize when flammables are present and
was not killed.
react quickly to prevent ignition.
Flammable materials in unventilated areas is an explosion waiting to happen!
This edition is also available in German, French and Spanish. Contact CCPS at ccps_beacon@aiche.org for information.
CCPS CENTER FOR
Sponsored
by
An AIChE Industry
Technology Alliance
January 2004
Avoid Improper Fuel to Air Mixtures
On June 11, 2003, an explosion

destroyed the natural gas furnace at
the NOVA Chemicals Bayport
plant. Before the explosion, an
operator noticed flame stability
problems with the low NOx
burners and began to manually
adjust the airflow. During the few
minutes that adjustments were
being made to manage the burners,
a loud puff was heard followed by
a major explosion in the furnace.
Damage included total destruction
of the furnace and adjacent
Photograph of the heater and adjacent column
column. Fortunately, no one was
injured, however the consequences
What You Can Do ! could have been much worse.
To prevent a similar explosion at your plant: How Did This Happen?
• Ensure that a thorough hazard review and management It appears that the explosion
of change is conducted was caused by clogging in the
• Ensure that adequate performance testing is conducted nozzles on the new Ultra Low
• Ensure that the burners and flow lines are cleaned and NOx burners resulting in an
devoid of debris before startup unstable flame. However, there
• Log and record any operating issues that occurred were several other contributing
during your shift factors that reinforce the
• Communicate any issues during shift-to-shift meetings importance of establishing
effective design, construction
• Ensure that the operating procedures, safe operating and operating management of
limits and control parameters for all new equipment change processes when
are accurate and well understood. You may have only introducing new technology.
minutes to act to prevent an explosion. PSID Members check: “Furnace” in
Free Search
Learning from this incident is being presented here with the permission of NOVA Chemicals. If you have questions or comments,
please call Daniel Wiff, NOVA Chemicals Process Safety Advisor @ 412-490-4649.
A more detailed report on this incident is available by request to ccps_beacon@aiche.org.
Flame Instability is Dangerous.

Ensure that you understand the consequences of Change.
This edition is also available in German, French and Spanish. Contact CCPS at ccps_beacon@aiche.org for information.
CCPS CENTER FOR
Sponsored
by
Technology Alliance
December 2003
Trees, Trees, Confusing Trees
Above are three pictures of “Christmas trees.” The center one is what we expect to see this time of
year. In the chemical industry we see the other (piping) “Christmas trees” year-round at work.
These “Christmas trees” are actually concentrated concoctions of piping, valves, instruments tubing,
gages and fittings. In many cases, these systems were never really “designed,” they just evolved—
one valve, one gage, and one instrument at a time. When the changes were originally made in the
field, they seemed to make sense; but as time went on, they grew in to a bigger and bigger mess—a
dangerous mess!
m
So, What happened? In the case on the left, an operator added an incorrect gas to a Gas Stea
still by mistakenly opening the wrong valve in the Christmas Tree. Fortunately, this
mistake only killed the reaction and no damage was done. But just think what
might have happened if an other incompatible chemical had been added .
What You Can Do
Recognize a piping “Christmas Tree” for what it really is—
What Allowed this to Happen?
a potential trap waiting for you to make a valving alignment
mistake. The real problem is that the
Management of Change (MOC)
Don’t accept just “making do” with what’s there. Make process did not work very well.
sure that coworkers know the correct operating procedures Operator usability was not
and keep communications flowing. considered and the PHA did not
recognize the human factors
Label—Label—Label! Label all valves and pipes so that issue--visual confusion added by
their function can be determined easily and quickly. the changes.
Simply Enjoy Christmas Trees at home, but Analyze them at work !
The CCPS Process Safety Beacon wishes you a Happy Holiday season!
season!
CCPS CENTER FOR
Sponsored
by
Technology Alliance
November 2003
But the pressure rating was okay…!?
The picture on the immediate left

shows a new rotameter. The other
picture shows what happened when
it was exposed to excessive
pressure at high temperatures.
In this case, the line down stream of
the rotameter had a history of
plugging. Several times in the past,
150 psig steam was used
successfully to clear the plug.
When it plugged again, steam was
used but this time the outcome was
different!
WHY?
What You Can Do

Remember that most equipment has
lower pressure ratings at high temperatures. The Facts:
Looking only at the pressure rating can get ¾The rotameter was rated for 175 psig at 200o F.
At 360o F, the rating drops to only 80 psig. Steam
you in trouble when heating is also used to clear the plug was 150 psig and 360o F.
involved. Know your equipment ¾The rotameter failed because it could not
limitations and compensate where needed! withstand the steam pressure at the elevated
Don’t assume that a practice is safe temperature.
just because it has not caused an accident The History:
before. You may have been lucky or the ¾Using steam to clear this line had been done
situation might have been slightly different many times in the past but was officially
before. This time may result in an accident. discontinued approximately two years ago.
However, it was practiced “un-officially” during
All operating and maintenance off-shifts.
activities must be done “by-the-book” on ¾The supervisor was uncertain of the pressure
all shifts. Don’t try new things without rating of the piping and rotameter and had second
evaluating the change (MOC) and do not thoughts. When he saw that the steam hose was
revert to old outdated practices. already connected, he decided to proceed.
Temperature and Pressure Ratings—usually an inverse relationship!

CCPS CENTER FOR
Sponsored
by
October 2003
Don’t pop your top…
A very simple job—fill the tank with

water. This is a common occurrence at
a manufacturing plant and has minimal
hazards. In this case, site personnel
were being extra cautious. They started
the water flow and confirmed that air
was coming out of the vent on top of
the tank. Everything seemed to be
fine…BUT
BUT, the source of the water
was the plant fire water system---and
the flow was VERY high! The vent
did not have enough capacity to relieve
This top…Belongs here! all of the displaced air, pressure built
up in the tank, and BOOM—the
BOOM top
blew off when the roof seam failed.

Transferring Liquids: What You
Can Do to be Safe !
Tank vents are usually sized to handle normal
processing activities, such as pumping in to or out of Watch out for “Temporary”
the tank during product transfers. Venting and operations—this tank vent was
vacuum break capacities are determined using probably sized for
formulas, or engineering calculations. These normal processing
calculations are often called the “vent system design conditions, not for
basis.” fire water addition.
If uncertain---CHECK!
Problems occur when the inflow or outflow of liquid is
greater than the capacity of the vent system. For Testing—SafeOut—Cleaning:
inflow, it leads to an increase of pressure inside the there are many times that a vessel
must be filled with water. Each
tank because the vapor can’t get out fast enough. time it is, make sure that the fill
rate is slow enough for the vent
It doesn’t take much pressure (in some cases just a few system to handle the displaced
inches of water) to cause a lot of damage. Tanks vapor. And just to be sure,
usually have large surface areas, so when pounds per monitor the pressure in the vent
square inch is multiplied by a large number of square space to make sure it is less than
inches, the force can be huge! In this case, the roof the vessel's pressure rating.
seam was the weak point and failed first.
When unsure, add water at
PSID Members look in Free Search—Tank Overpressure
“normal” processing rates.
Liquid transfer can lead to major vessel damage.

“Transfer rate” must not exceed “vent capacity.”
This edition is also available in German. Contact CCPS at ccps_beacon@aiche.org for information.
CCPS CENTER FOR
Sponsored
by
An AIChE Industry AIChE
Technology Alliance
September 2003
Dust did This ????
This facility produced automotive

insulation and handled combustible
solids as a raw material. While a part
of the plant was down for cleaning a
thick cloud of dust was generated. It
somehow ignited causing a pressure
wave strong enough to disturb and
suspend more dust. When this new
dust ignited, it caused an even stronger
secondary explosion.
Photograph courtesy of The U. S. Chemical Safety and Hazard Investigation Board.
Visit their web site at http://www.csb.gov for more information The result…tragically, there were 7
fatalities, more than 30 people injured
Combustible Dusts: What You Can Do and the building was destroyed.
to be Safe !
9If your facility handles materials that How Did This Happen?
generate dust, find out if they are
combustible and know their hazards. If •Employees did not understand the explosive
unsure, DON’T ASSUME! Find out. hazards of dust. This dust explosion pentagon
9Dust accumulation on equipment, shows the components necessary for a dust
building support steel, duct work and in explosion to occur:
Fuel Ignition
suspended ceilings could contribute to a
secondary explosion. Review cleaning
procedures and find out what you can Dispersion Confinement
do to keep dust from accumulating.
9Pay attention to “small” dust leaks. Oxygen
They can be more than just a house- fuel+ oxygen+ dispersion+ confinement+ ignition =
keeping problem. They can be a major
safety issue. •Dust control measures were inadequate and
9Be aware of any unsealed or hidden ignition sources were present.
areas where dust might accumulate. •The first explosion may have been minor, but it
9Take care not to generate a dust cloud caused dust on other equipment and hidden
when working in or cleaning an area or locations, such as building support steel,
equipment. suspended ceilings, and duct work, to be air borne.
9Do what you can to identify and When this second wave of dust ignited, it
control ignition sources. Closely follow generated a much stronger explosion.
your Hot Work procedures and
maintain electrical equipment
to proper code classifications. PSID Members look in: Free Search---Dust
Dust can be MUCH more than just a housekeeping problem !

This edition is also available in German. Contact CCPS at ccps_beacon@aiche.org for information.
CCPS CENTER FOR
http://www.aiche.org/ccps/safetybeacon.htm
Sponsored
by
Technology Alliance
August 2003
Simply Mixing Chemicals…
This picture shows what can happen
if the hazards of reactive chemistry
are not recognized. A worker was
preparing a solution for use and
accidentally mixed two incompatible
chemicals in a small bucket. A
violent exothermic chemical reaction
began immediately and generated
enough heat to boil the material. The
hot mixture spewed out of the bucket
and splashed on the worker causing
serious burns to several parts of his
body.
Photo source: Navy Safety Center web site In the case described above, the
worker was the only one
…can be Hazardous to your Health injured, but if a similar
uncontrolled reaction had
Reactive Chemistry: What You Can Do to be Safe taken place in a vessel, what
(Sources: CCPS Safety Alert, Reactive Material Hazards and,
Essential Practices for Managing Chemical Reactivity Hazards)
would the result have been?
9If unsure—DON’T
DON’T mix! Get confirmation. Why did this Happen?
9Always get changes approved before making The incident investigation revealed
them. that:
9Read the current MSDS for all new chemicals and •The worker had no idea that mixing
review the process safety information for these two chemicals would result in
consequences of inadvertent mixing. such a violent reaction.
9When mixing chemicals, make certain that you •A general understanding of the
are mixing the chemicals intended. Check and possible consequences was not present.
recheck the labels and warnings.
9When mixing chemicals in an open •Appropriate hazard controls and
container, make sure that you are procedures were not fully implemented.
wearing the right PPE. Be Aware!!! Many materials react with
9If your area has a chemical interaction matrix, each other—and sometimes very
make sure you read and understand it. violently! By-products of these
reactions may include heat (sometimes
9Read the CCPS publication, Reactive Material enough to cause rapid violent boiling)
Hazards (http://www.aiche.org/ccps/safetyalerts.htm) and the formation of other materials
PSID Members—look in Free Search—Key word: “Reactive” that might be very corrosive or toxic.
Mixing Chemicals can have unexpected consequences. Caution, Caution, Caution!

for the purpose of resale by anyone other than CCPS is strictly prohibited. Contact us at ccps@aiche.org or 212-591-73
This edition is also available in German. Contact Adrian Sepeda at adrian_l@swbell.net for a copy.
CCPS Sponsored
CENTER FOR
CEHMICAL PROCESS SAFETY
An AIChE Industry
Process Safety Beacon by
AIChE
Technology Alliance
July 2003

Static Electricity + Flammables + Air = ??
This is a picture of a sieve By design, plastic beads fall by gravity
covered in soot after static through this sieve. The beads contain
electricity sparked an
trace amounts of pentane, a flammable,
explosion.
volatile material which is liberated
Sieve trays during processing. The sieve was
Soot and designed with an air sweep to keep the
flame damage pentane fume concentration below the
flammable limit. One evening, when
everything appeared to be operating as it
should, the operators heard a loud
BANG! They quickly investigated and
saw flames coming out of the sieve.
Quick action by the fire brigade
controlled the fire and no one was
You Guessed it– Explosion & Fire ! injured, but the plant was down for
repairs.
How Could this have Happened?
What Can You Do to Prevent
• Plastic beads falling through air generate an
electrical charge. When this charge is large enough, Similar Problems?
it discharges. ¾ Regularly check ALL safe guards
This is a static electrical spark!! to be sure that they are still in place
•These beads contained trace amounts of pentane, a and working properly. This includes
volatile flammable material. As the beads fell, some interlocks—are they there, are they
of the pentane vaporized and made the atmosphere working? Remember, air purges can
flammable. be safeguards too.
•The air purge that was suppose to sweep the ¾Be aware that static electricity may
flammables out of the sieve was not working be anywhere. Good design and well
properly. This critical safety system failed—too maintained systems control it.
little air flow allowed a flammable atmosphere to
develop! ¾ Some equipment has grounding
cables. If they are damaged, replace
•The purge air flow system was not interlocked to them quickly to remove the “spark”
the sieve operation so no alarm sounded at low air potential.
flow.
¾Make sure that all three components
•And, as we all know--a spark in a flammable of the fire triangle do not exist at one
atmosphere = KABOOM!!! time and in one place.
PSID Members—check for “Static” in the free search area.
Critical Safety Devices come in many forms. Know them and use them!
for the purpose of resale by anyone other than CCPS is strictly prohibited.
Contact us at ccps@aiche.org or 212-591-7319. http://www.aiche.org/ccps/safetybeacon.htm
Sponsored
CCPS Process Safety Beacon by
An AIChE Industry
Technology Alliance
AIChE
June 2003
Interlocked for a Reason…

This heater was severely damaged during

start up as a result of a fire box explosion.
The operator had some difficulty with the
instrumentation and decided to complete
the start up by bypassing the interlocks.
This allowed the fuel line to be
commissioned with the pilots out. The
main gas valve was opened and gas filled
the heater. Then… K A B O O M, M the
heater exploded destroying the casing and
damaging several tubes. Fortunately, no
one was injured.
Why Did this Happen?

The operator thought that he
could speed up the job by
shortcutting some of the
…a Very Good Reason ! “unnecessary” things in the start
up procedure. He misjudged the
What Can You Do? importance of the interlocks.
•Always use interlocks and other protective systems as He thought they could be by-
they are intended to be used. passed…just this one time, but
•Make sure that they are properly calibrated and receive he was wrong. They were
needed maintenance so that they work when needed. important …… this time and
every time!
•Never disable an interlock or other protective device
unless a Management of Change has been completed
and approved.
•Follow established start up procedures. If they are not
correct, tell your supervisor and get them corrected.
•Don’t make untested or unapproved changes just this PSID Members—check the following
incidents--*137, *149, *317 and *343.
one time.
Every Protective Device has a Purpose. Don’t Defeat it !

CCPS PROCESS SAFETY BEACON
An AIChE Industry
May 2003

A “GOOD IDEA” CAN TURN BAD . . .
A mechanic was draining oil from this
large gear box. The oil was draining
out very slowly, so he decided to
speed the job up by connecting an air
hose to push the oil out faster. It didn’t
take long for the results shown to
happen. The cast iron gear box
fractured, blowing a large piece off and
onto the floor. Fortunately, no one was
hurt.
Why Did This Happen?
• The gear box was not a pressure
vessel
• More air was added than could be
vented, so the pressure built up
WHEN YOU IGNORE MANAGEMENT OF CHANGE! • MOC was not used to review the
change
What Can You Do?

Here’s What Should Happen:
• Many pieces of equipment in a
chemical plant are NOT designed
Good ideas improve operations and reduce
for pressure. Check the
risk every day. However, before
equipment folder, but if there is
implementing a good idea, it is essential to
no ASME code stamp, assume
review the change to ensure that it doesn’t
that it is not pressure rated.
introduce any new hazards or risks to the
• Adding air to the gear box was a workplace. In this incident, the mechanic
change and should have been should have recognized what he was about
checked through the site’s MOC to do as “not like-in-kind” and reviewed the
process. change through the MOC process. This
• Be alert to subtle changes that would have identified that the gear box was
might not be safe. not designed for pressure.
Not everything works better under pressure. Connect utility hoses with care !
AIChE © 2003. All rights reserved. Reproduction for non-commercial, educational purposes is encouraged. However,
reproduction for the purpose of resale by anyone other than CCPS is strictly prohibited.
Sponsored
by
An AIChE Industry
Technology Alliance AIChE
April 2003

What? No Spark? This terminal had just started storing large
quantities of flammable liquids. Activated
Photograph courtesy of EPA
carbon drums were used in the vent system
to control hydrocarbon emissions and odors.
Each tank was to have a flame arrestor and a
foam fire protection system, but they were
not installed before filling the tanks.
Suddenly, there was an explosion and a fire.
Emergency response personnel arrived,
residents living nearby were evacuated, and
fire fighting and emergency control started.
It took 3 days to put the fire out and deal
with other issues such as contaminated fire
water run off and spillage from other tanks.
Reference Web site http://www.epa.gov/swercepp/pubs/pdtirept.pdf
What Went Wrong? How Can a Carbon Bed be an Ignition Source?

There are many causes of this accident,
but let’s focus on the fire triangle. • When organic materials pass through
All three components of the “Fire activated carbon, a chemical reaction occurs
Triangle” (heat, fuel and oxygen) were that can cause significant amounts of heat to be
present. Let’s see how that happened: generated. In fact, the carbon got so hot that
• Fuel came from the organic materials in it reached the autoignition temperature of
the vessel vapor space; the tank vent gas. That was the “spark” that
• Oxygen came from the air in the led to this explosion!
vessel vapor space (the vessels •A few autoignition temperatures you might
were not nitrogen blanketed) and, want to know about:
• the only remaining • acetylene 305 oC
component needed to start
Fu
• n-butane 405 oC
at
el
Heat Did it
the fire was Heat.
He
come from a loose • hydrogen 400 oC

Oxygen
electrical connection, static • propane 450 oC
electricity, or hot work? • methane 540 oC
No! In this case, the vent system carbon • carbon disulfide 90 oC
filters led to the explosion and fire.
Check out the EPA alert on carbon drums at http://www.epa.gov/swercepp/pubs/carb-ads.pdf
Sponsored
CCPS Process Safety Beacon by
An AIChE Industry
Technology Alliance AIChE
March 2003
Reactive Chemistry:
Not always when
or where you want
2 it!
3 4
OX
A thermally unstable material (a peroxide -- but many chemicals have similar properties) was
being fed from a weigh tank to a reactor. Normal practice is to empty the weigh tank, leaving
the transfer piping empty. In this instance, a leak developed. A quick repair was expected so
valves were closed leaving the pipe FULL of peroxide. The reactor temperature was well
above the point at which the peroxide decomposes. Heat from the reactor slowly warmed the
material in the piping as the repair effort continued past the expected completion time. The
material finally reached its decomposition temperature. The result--overpressure that ruptured
the piping. Luckily, there were no injuries, just a lot of surprised people.
Unstable materials need CONSTANT attention—especially during non-routine operations!
How Do I Know If I Have What Can I Do?

“Unstable Materials”? This incident is a great example of how things can go wrong!
•You may already have the • You must be constantly aware of temperature when
information in your own process handling thermally sensitive materials
safety information (PSI) files • Blocking in unstable materials often invites an incident
•Check the MSDS—many have a • Repairs can cause abnormal operations and new hazards
Stability and/or Reactivity section • If a material can be heated to its decomposition point,
•Check the manufacturer’s special procedures and precautions are needed
information—sometimes it’s there • Heat can come from almost anywhere, including
•NFPA or DOT hazard rating are connected equipment, the sun, heat tracing, mechanical
often helpful energy, welding and…
•ASK someone in technical or safety
Sponsored by
CCPS Process Safety Beacon Risk, Reliability
An AIChE Industry and Safety
Technology Alliance
Messages for Manufacturing Personnel Engineering
February 2003
Could It Happen Here!

How Well Are You Trained to Respond to Fires?
A nighttime fire fighting exercise Controlled burn of Sodium Hydride
The first picture is a nighttime fire fighting training exercise. The second is of a controlled burn of
Sodium Hydride with fire suppression material around it, following an incident where this
material caught fire.
Here are some things you can do to prevent fire from occurring or to make
sure it is handled safely and correctly.
Fire Prevention and Planning Responding to Fire
Understand possible fire scenarios then Always sound a fire alarm before fighting a
know how to report a fire fire
Check bonding and ground wires to Call for help and make sure it is coming
prevent static ignition when handling before fighting a fire
flammables liquids or combustible dusts
{PSID members see incident 422} Fight fires only if you have been trained to
do so
Know your emergency routes, locations of
emergency shelters and rally points Make sure you leave a safe unobstructed
path for retreat when fighting a fire
Take fire extinguisher training, yearly if
possible “Stop, Drop and Roll” if your clothing or
hair catches fire.
Different classes of fires (rubbish,
flammables/combustibles, electrical or Make contingency plans and train on
metals) require different extinguishing handling and disposing of hazardous
materials. Make sure you have the right materials after a fire has occurred,
fire fighting equipment for all potential including medical response to hazardous
fires exposures
Look for the new CCPS book “Guidelines for Fire Protection”, coming May 2003
CCPS Process Safety Beacon Sponsored by
Technology Alliance
January 2003
Check the Clearance

Many plants are required to perform on-line maintenance or construction using large scale tools and
equipment (cranes, hoists, bundle pullers, welding machines, vacuum trucks). The transport and
operation of such equipment onto operating plant sites can pose a significant risk and result in
accidents unless steps are taken to make sure that process facilities are secure.
Following are some key safety considerations:

► Check that adequate space is allocated when moving construction equipment onto a plant site.
Check clearances on overhead power lines, instrument conduits and pipe racks.
► Pre-plan all turns and ensure that construction equipment does not strike people, process
equipment, or areas where workers gather.
► Take large mobile equipment apart into smaller components when possible before transit.
Never travel with the jib assembled on a tall crane.
► Always travel at a slow speed and have a groundsman or signalman walk ahead of the load.
► Pay particular attention to the wind effects on moving suspended loads and take all the
necessary precautions.
► Remember that long loads are highly susceptible to grade changes or ground conditions. A
slight dip or rise in the road of a few inches may cause a boom to swing several feet.
Make sure that equipment is securely positioned before use and

that it will not strike people, equipment or buildings.
Sponsored by
CCPS Process Safety Beacon 3M
An AIChE Industry
Technology Alliance Company
December 2002
Security – It’s everybody’s Job

After the attacks on September 11, 2001, when our
nation's leaders told us "to remain vigilant", they were
speaking to all of us. We have heard that chemical plants
may be attractive targets for terrorists due to their
potentially large impacts on neighboring communities,
or by theft of chemicals. That makes us the front line of
defense. The more watchful we all are, the greater
chance that suspicious behavior can be spotted - and
stopped - before harm can be done. We are not anti-
terrorism experts but we can do a lot to protect
ourselves, our companies, and our communities.
Here is a quick list:

► All companies have security policies and practices – understand them, and practice them. Wear your
employee badge, and note that your coworkers do the same. When you “badge in” do not allow others
to “tailgate” in on your pass. Park only where allowed.
► As you make your inspection rounds, keep your eyes open for potential weaknesses in the plant’s
security. Look for anything out of place or different. Point these deficiencies out to your supervisor or
the security department.
► Review your plant’s emergency procedures – evacuation, emergency response, etc.
► Pay attention to the required paperwork for contractors and visitors. If it doesn’t appear correct,
contact your supervisor. Be particularly alert to new bulk shipment drivers.
► Housekeeping is a never-ending part of operations. If a plant is kept neat there are fewer places to
hide something and small leaks can be easily detected and cleaned up before they become larger
hazards.
► Check in-coming shipments for proper tamper seals. If they are missing, notify the proper person.
That load may have been contaminated, or some of the contents stolen on the way to your location.
► Make sure all deliveries are handled according to your location’s procedures – especially those
arriving outside normal receiving hours.
► Be careful what information you share with people outside your company. A lot of confidential
information can be lost to someone who is overly curious. Some of these people will use the names of
plant managers and others to appear to be trustworthy.
Report any and all strange phone calls received to your supervisor. Following 9/11
several chemical plants received questionable calls inquiring about their operations.
Don’t be embarrassed to raise any questions if you notice something different. We
would all prefer to be safe than sorry.
These are difficult times. Our past practices and procedures may no longer address
the new concerns raised by terrorist attacks. America has met these challenges in
the past through the attention and determination of people just like you. Keep your
eyes open, and if something doesn’t appear to be correct – ASK!
Sponsored by
CCPS Process Safety Beacon Monsanto
An AIChE Industry
Technology Alliance Company
November 2002
WHAT HAS YOUR STEAM UP

The Incident:
At first glance, this appears to be a traffic incident – but take a closer look! You are looking at a process
safety event. The photos graphically explain what happens when HOT asphalt is added into a trailer that has
been recently cleaned with water. Unfortunately, the excess water is not removed from the trailer before
adding the asphalt - the water rapidly turns to steam and expands in volume about 1600 times. The result -
significant damage. In this case it’s a tanker, but it could just as easily have happened to a vessel or piping
system. No injuries occurred.
Common Causes of failures like this:

This type of event has happened MANY times, often involving heat transfer fluids, mineral oils or other
“heavy” organic materials (like the asphalt above). The event begins when a HOT material is added to a
vessel or piping which contains materials with a boiling point under the temperature of the hot material. In
general, the larger the difference between the temperature of the hot material and the boiling point of the
lower boiling material, the more significant the damage. As heat is transferred from the hotter material,
vaporization of the lower boiling material occurs and the pressure that results can cause lots of damage!
What Can I do?

During ANY material transfer, if the liquid being transferred is hotter than 212F/100C – take steps to
make certain there is no water in the downstream equipment.
Water removal is often difficult in complex piping systems: Low point drains MUST be opened,
piping must be carefully examined for “traps” and flanges may need to be opened in MANY
locations.
Shipping containers are frequently cleaned with water; any shipping container must be assumed to
contain water unless steps have been taken to remove it.
Proceed slowly when starting up processes following shutdowns, especially with fluids that are very
hot.
HOT liquids have many hazards! Don’t forget they can lead to significant pressure buildup if
added to vessels containing water or other materials with boiling points lower than the
temperature of the hot fluid.
CCPS Process Safety Beacon Sponsored by
An AIChE Industry CWRT
Technology Alliance
October 2002
It’s a bird, it’s a plane, it’s………………A PUMP!
The Incident
A 75 HP centrifugal pump was operated with both suction and discharge valves closed for about 45
minutes. It was believed to be completely full of liquid. As mechanical energy from the motor was
transferred to heat, the liquid in the pump slowly increased in temperature and pressure until finally -
the pump failed catastrophically. One fragment weighing 5 pounds was found over 400 feet away.
Luckily, no one was in the area so there were no injuries.
Why would events such as this What can I do?

happen? • If you discover a “blocked in” pump in
• This situation is different than operating a operation, use extreme caution. Shut the
pump “deadheaded” – where the suction pump down remotely; keep people FAR
valve is open but there is no flow through the away until it has cooled.
pump. Here, pressure relief occurs back • Use care when starting pumps.
through the pump suction line. Communication about which pump is
• In the past, this event likely would have valved for operation must be very clear.
ended with a seal failure - seal leakage would • Some plants try to have an individual
have been sufficient to relieve the pressure. near the pump when it is started. This
New seal designs are significantly improved. may not be possible in all situations, but
This older “relief system” can no longer be it can eliminate many problems.
counted upon. • If possible, open the casing drain on a
• As processes have become more automated it pump that will be out of service for an
is now much easier to accidentally start a extended period. But, check to make sure
pump or operate the wrong valve. you are not creating another problem
• Spare pump arrangements can also be a (environmental, cost, etc) by doing so!
problem if the “incorrect” pump is started. • And, a routine tour of a manufacturing
For example, the “north pump” has valves area can identify many things – a blocked
aligned for operation but the “south pump” is in pump operation is just one of them!
started.
Pumps move liquids for us everyday, but they can also generate
heat – a significant hazard if it has no place to go!
Sponsored by
CCPS Process Safety Beacon AIChE’s SVA
Training
An AIChE Industry
Technology Alliance Program
September 2002
In Remembrance of
SEPTEMBER 11th, 2001
The Incident
September brings memories of the events of September 11, 2001: the tragic loss of life, the
destruction to the World Trade Center and Pentagon, the bravery of the passengers who brought
down the plane in Pennsylvania, the heroism of the emergency response personnel. Far too many
items to list here, but a day we will remember for the rest of our lives.
What has happened since? What can I do?
The US government, organizations, and Be alert! Know who is in your area and why
individual companies have taken a number of they are there. Watch for out-of-place objects
actions. For personnel who work in facilities - a clean, orderly facility makes this easier to
with hazardous chemicals, these include: accomplish.
• American Chemistry Council (ACC) has Be aware! Take time to tour your workplace.
added a Security Code to Responsible ACTIVELY look for unusual items or people
Care; other trade groups are taking – if you see anything that seems out of place
similar steps, notify management or your security group.
Be informed! Understand and follow your
• CCPS has published a document
location’s security practices. Pay special
describing how to conduct a Security
attention to your site access control system.
Vulnerability Analysis (SVA). This
Everyone should follow these rules on site,
method, or one which is similar, can be
including visitors and contractors.
used to assess your site’s security risks.
Be smart! The world can be a very
ACC sites must complete this task prior
unfriendly place - September 11 tragically
to year end 2003, and
demonstrated this to all people worldwide.
• A number of groups are offering training We, as individuals, must be suspicious of
classes on issues impacting chemical site actions and things around us.
security.
Be ESPECIALLY cautious in areas that contain very hazardous materials.

Anything unusual in these areas should be reported immediately.
This issue
Sponsored by
An AIChE Industry
Technology Alliance
August 2002
FASTER THAN A SPEEDING BULLET
The pictures are made available by the company involved to improve safety awareness across the industry.

A piece of equipment was being pressure tested at approximately 5,000 psi. During the pressure check, two
employees were inspecting for leaks. Without warning, a ¾” threaded thermowell failed at the threaded joint,
the force separated it at a very high rate of speed and it struck one of the employees in the leg, leading to a
very serious injury.
Common causes of failures What can I do?
like this: • While complete failures of joints are rare, they can
and do occur. In this incident, the force on the
• threaded connections can be
thermowell was approximately 1-3/4 ton, and the
weak points, especially if the
failure propelled the thermowell at roughly 90
threads are corroded, stripped
MPH. When increasing pressure in equipment
or if the threaded connection is
attempt to stand a safe distance away or behind
not fully made up
barricades until the final pressure is reached.
• these problems are often hidden
• Whenever threaded connections are disassembled,
from view; finding a problem
inspect BOTH sets of threads for corrosion, signs
may be possible only if the
of cross threading, etc. If there is a problem, get it
connection is disassembled and
repaired before putting pressure on the joint.
all threads inspected
• Threaded connections can be “backwelded” - this
• in the above incident, what
will improve the overall strength of the joint. The
made the accident very serious
disadvantage, of course, is now the joint can not be
was the fact that someone was
disassembled easily.
standing right in front of the
thermowell when the joint • For systems where significant corrosion is present,
failed flanged connections are generally better than
threaded.
When threaded equipment is taken apart, look carefully for stripped threads, corrosion or
anything that looks abnormal – it may be a WEAK POINT in your system!
CCPS Process Safety Beacon Messages for
Manufacturing
An AIChE Industry Personnel
Technology Alliance
July 2002
The Seal That

Didn’t Perform!
What is a Seal? Here’s What Happened:

(Hint: We are not talking about
The pump in this picture was destroyed because the mechanical
the circus!)
seal failed. The light hydrocarbon being pumped was released; it
Many, probably most, pumps have some
ignited and burned – causing extensive local damage. No one was
type of mechanical seal. In GENERAL
near the pump when the fire occurred, so there were no injuries.
terms, it is a device which prevents
significant leakage of the fluids in pumps
and other powered machinery items.
Seals come in a number of different What can I do?
designs and a wide array of different • When you walk through areas, always be alert for liquids
materials of construction. While the around pumps. Liquid presence may mean a seal leak.
function of a mechanical seal is relatively • Operate the pump the way it was designed to function. For
simple, selecting the correct seal for a instance, if the seal has a barrier fluid or seal purge, make
given application requires judgment and sure there is fluid in the reservoir and that it is flowing to the
experience. pump. Understanding these special systems and their proper
operation will extend seal life and minimize failures.
Why do they Leak? • Never ‘dead head’ (no liquid flow) a pump. Pumps and seals
Nothing complicated here: can heat significantly when there is no liquid flow. This can
1) they wear out, lead to a number of unwanted consequences, including seal
2) they are not installed correctly, failure.
3) they are not operated properly, or • During maintenance activities, be sure the installed seal is
4) they are made of wrong materials. made of the correct materials.
• When you detect a leaking seal, take the pump out of service
Leakage rates can be very significant promptly and get it repaired. Seal leaks quickly get worse
with some types of failures! with time.
Understand the special features of the mechanical seals in your

facility – monitor their performance and take care of them!
Manufacturing
Technology Alliance
June 2002
DON’T GET YOUR PIPES IN A TWIST

This picture was just too
good to pass up! We do not
know where it came from. It
may show, unlike our
previous photos, something
that does not exist in real life.
If someone would like to say,
“yep, that’s my location”,
please let us know! We’ll
send you a t-shirt (or
something!) for your trouble.
The next time you hear these statements, think of this picture!
“We need to be able to pump everything to everywhere!” Life is complicated – and sometimes
our desire for flexibility creates REALLY complex facilities.
“Line up tank 146, through the new bypass line, to the old stainless heat exchanger and then
to the south tank!” We need to be clear and precise when we communicate with each other.
“No need to look at the operating instructions, I remember the valving for that setup!” In
many cases, we don’t refer to these documents as often as we should.
“Every one of those lines has a management of change form!” Management of change is a
powerful tool, but looking at this piping – one line at a time, by itself – seems to miss something.
Management of change must also deal with how the change fits into the existing facility.
“Harry, you need to use a 2” x 12” plank to get to that valve!“ Operability is a key parameter
for new equipment. What you see here would seem to be difficult to operate (maybe an
understatement?)! Being able to reach equipment is an important feature.
“We never dismantle piping – might need it someday!” Removing any equipment item is
difficult, but when it becomes a hindrance to operability someone needs to make the right
decision.
“Nancy, when you break the flange to replace that gasket, lets get a bucket underneath to
catch any drips!” Maintainability is another key parameter for new equipment.
“We pride ourselves on being in complete compliance with all regulations!” And, the facility
depicted above may indeed be in compliance. But, sometimes we need to stand back and ask the
simple question – is this facility easy to run safely?
Operating a plant is a complex task requiring a number of different skills. Doing

them all, correctly, every time, is essential!
AIChE © 2002. All rights reserved. Reproduction for non-commercial, educational purposes is encouraged.
However, reproduction for the purpose of resale by anyone other than CCPS is strictly prohibited. Contact us at
ccps@aiche.org or 212-591-7319. http://www.aiche.org/ccps/safetybeacon.htm
Manufacturing
Technology Alliance
May 2002
….AND HE BLEW THE HOUSE DOWN
Here’s what What is an explosion?

happened… There are lots of definitions,
The picture here is the typical but the explosion above
result of an event that happens resulted from a basic
hundreds of times every year combustion process.
– an explosion There were three steps:
• release of a combustible
In this case, the “fuel” was material (hydrogen in
believed to be hydrogen this case)
generated from the computer • accumulation of that
backup battery charging material in a “cloud”,
system seen in the and then
background. Ventilation of • an ignition source
this relatively small portion of provides the “spark” for
the 50,000 square foot combustion.
building was either not Obviously, the larger the
working or poorly designed. accumulation, the larger the
The small amounts of explosion!
hydrogen released during the
battery charging operation
apparently accumulated and
then an ignition source led to What about hydrogen?
the explosion. As you can Hydrogen is an interesting gas, it is very “light” (it will rise quite
see, the roof was blown off rapidly in air) and has a very wide range of flammability. A large
(about 400 square feet), the number of hydrocarbons are combustible in a range of 2-15%;
damage is extensive - but, no hydrogen is combustible in a range of 4-74% (by volume), which is
one was in the building so – very wide by comparison. Also, the amount of energy required to
luckily - no injuries. A ignite a hydrogen cloud is very low. These properties, in many
typical event, happens all the respects, make hydrogen an ideal material for explosions in areas
time! where it can be confined.
So, what do you do?
In this incident, a good ventilation system would likely dilute the small amounts of escaping hydrogen to
maintain a concentration below the lower flammable limit – “dilution is the solution”! Indoor battery
charging operations MUST take hydrogen generation rates into account, and an appropriately designed
ventilation system installed, operated and maintained.
Whenever a flammable substance is present in a confined area, release

of that material creates a potential explosion scenario.
PSID Members refer to incidents: *120, *245, *327
Manufacturing
Technology Alliance
April 2002
10,…9,…8,…7,...”Houston, we have launch!
The Incident….
An operator was
The cylinder that got away
supposed to
remove one of
How’d that happen?
the two FM-200 Compressed gas cylinders have an enormous amount of stored
fire suppression energy just waiting to be mishandled, dropped, or vigorously
cylinders from abused. If this energy is released suddenly, they act like a jet
service, but engine; not just like - they pretty much are a jet without the
things didn’t go combustion process. Exhaust vapor from a broken valve
exactly according creates a force that moves the jet, or cylinder here, in an
to plan. As you opposite direction of the exiting vapor. It was fortunate that
can see in the this cylinder selected to travel up instead of across the room.
first picture, The pictures speak for themselves – the forces involved are
there’s only one
significant, and major damages to property and people are
of them. During
removal of its potential outcomes when this energy is released suddenly.
twin, the cylinder
managed to
escape and make
a clean get away, What do you look for?
clear through the Remember this story and the pictures next time you’re working with
ceiling and onto compressed gas cylinders. They have an incredible amount of power -
the roof! Look jet power. That’s why it’s important to practice all those precautions
carefully at the you hear about – keep them chained up, make sure valve covers are in
second picture place when moving, follow manufacturer’s recommended practices,
and you can etc. And especially, don’t allow something to occur which knocks
identify the need
the valve off. If that happens it could be “Houston, we have a
for roof repairs!
problem”.
Manufacturing
Technology Alliance
March 2002
LAYERS OF PROTECTION HERE’S WHAT HAPPENED……

Y
Yoouu N
NEEE
EDD TThheem
m During a non-routine procedure, materials
were transferred into a vessel. A number
of items were present (i.e., “layers of
protection”) to prevent vessel damage,
including:
• A high pressure alarm (in this case,
the alarm was acknowledged earlier
when it was assumed to be caused by
a faulty instrument)
• A pressure control system which
allows pressure to be vented to
another system in the area (in this
case, this “second system” was out of
service), and
• A pressure relief/vacuum system
which vented to the atmosphere (this
system contained a flame arrestor
which was found to be plugged).
• The net result of all these failures was
a ruptured roof on the tank
What do layers of protection accomplish?

• A well designed facility includes multiple items of protection for equipment;
• These frequently include a number of the following: operator monitoring, procedures, alarms, interlocks, pressure
rated equipment and relief/vacuum valves, and
• In most cases, multiple systems must fail before vessel damage occurs
What can I do to protect equipment?

• NEVER assume an alarm is functioning improperly -if an alarm becomes a
nuisance, take immediate steps to have it repaired;
• Review alarm status for equipment early in your shift, understand why ALL
alarms are present;
• Pressure/vacuum relief valves are often the LAST line of defense which prevents
vessel damage, maintenance systems must be in place to properly test these
devices;
• Pluggage in vent lines must be managed - if a line has a tendency to plug, cleaning
frequencies should be adjusted to maintain the line in a “clean” state; and
• Non-routine operations often have fewer or weaker layers of protection when
compared with “routine” operations, all items preventing equipment damage are
especially critical.
Contact us at ccps@aiche.org or 212-591-7319.
Manufacturing
Technology Alliance
February 2002
A little “nothing” can really be deflating!

Here’s what
happened……
VACUUM is a powerful force!
When steam cleaning COMMON causes of vacuum damage to tanks include:
the interior of a railcar • The vessel has insufficient strength to withstand a vacuum; a vessel with a 50
most of the air was
psig (or higher) ASME pressure rating is frequently capable of withstanding a
displaced. When work
full vacuum;
was stopped at the end
of the day all valves • vacuum is created when liquid is transferred from a vessel or when hot vapor
were closed. As the car condenses, neither of which is replaced by air/nitrogen or other non-
cooled, the steam condensable material, and
condensed, creating a
vacuum, causing the • a vacuum relief system is not present or is not functioning properly.
railcar to collapse
Things to consider to prevent equipment damage from vacuum:
During painting, a tank’s
vacuum relief valve was • install a system to provide vacuum relief. As one of the pictures graphically
covered with plastic to demonstrates, railcars and trucks MAY NOT have this equipment. These
prevent potential devices will allow air to enter the vessel and prevent vacuum formation.
contamination of the • if installed, vacuum relief devices must be inspected and tested on a regula r
contents. When liquid basis. They are just as critical as pressure relief devices.
was pumped out the • understand which vessels in your department are not rated for full vacuum.
plastic covering These are the vessels vulnerable to vacuum related incidents,
prevented air/nitrogen • demonstrate caution whenever liquids are transferred or vapors are condensed
from replacing the liquid because of shutdown, maintenance, cleaning, etc..
volume. A vacuum
• be sure that the addition of air, nitrogen, or other vacuum breaking materials
developed leading to the are not impeded.
partial collapse of the
tank. WHENEVER vacuum relief systems are removed, covered, modified,
etc., special precautions are needed to prevent an incident !
Contact us at ccps@aiche.org or 212-591-7319.
CCPS
An AIChE Industry
Process Safety Beacon Messages for
Manufacturing
Personnel
Technology Alliance
January 2002
Explosions
Every year, hundreds of equipment
items are damaged in an explosion.
These events are often described in
familiar terms:
?? a flammable vapor, air and an

ignition source generate
pressure,
?? which ruptures
piping/buildings/equipment (like
these column trays),
?? leading to property damage,
downtime, lost business and, in
some cases, serious injury or
death to personnel in the
There are many ways to prevent explosions - this message
immediate area.
will BRIEFLY discuss one : How much flammable material
is needed to generate an explosion? The short answer is - in
most cases, LESS THAN YOU MIGHT THINK!
Most flammable materials have a flammable range, a concentration of the flammable

material in air, which will support combustion. If the concentration of the substance is
above or below these “flammable limits”, combustion will not occur. Please recognize that
these values depend upon a number of variables, including the material itself, the pressure,
and the oxygen concentration.
Let’s go take a fairly simple example – PROPANE, a material In a typical manufacturing site,
many of us have in our home B-B-Q grills. How much propane flammable materials are
is needed to fill a 2-car garage (say 20’ by 20’ by 10’) to its handled in hundreds or
lower flammable limit? Propane’s flammable limits in ambient thousands of gallons. It is
conditions are between 2.3% and 9.5% (by volume) in air (ref: obvious that careful control is
SAX, 9th edition). SO…. needed for these materials.
-garage volume = 20 * 20 * 10 = 4000 ft3 Very small quantities, even
-lower explosive limit amount = 2.3% * 4000 ft3 = 92 ft3 those involved with valve
of propane vapor leakage, can generate events
-which is equivalent to about 3 gallons of liquid – which have very severe
Answer: NOT MUCH! consequences!
{PSID Members see Incident *327}
However, reproduction for the purpose of resale by anyone other than CCPS is strictly prohibited.
Contact us at ccps@aiche.org or 212-591-7319
Manufacturing
Technology Alliance
December 2001
Snow and Ice Hazards – they can cause more than

slips and falls!
For many of us, it’s that time of the year again!
Snow and ice build-ups on equipment and buildings can have undesirable
consequences when they finally decide to fall. Damage can include
bent/broken sections of tubing, small piping and cable trays; injury to
personnel can occur if someone is in the area at the time. But, did you know
snow and ice “slides” have opened valves?
INCIDENT DESCRIPTION
A release of material occurred from a ¾” drain valve on piping connected to an atmospheric storage tank.
How the valve opened was unknown. The incident was investigated; a theory was developed that melting
snow slid from the top of the tank and landed on the straight handle of a ¼ turn ball valve - and this caused
the valve to open. There were skeptics – and more than one! So, the investigation team carried a bucket of
snow to the top of the tank and let it slide in the direction of the valve. The theory was proven! - Snow
falling from the top of the tank can open a ¾”, “straight handle” ball valve.
In a similar situation at another facility, a mass of ice broke away from a structure and landed on a similar ¼
turn straight handle condenser drain valve. Again, release of material followed.
ACTIONS
LESSONS LEARNED
TAKEN
Snow and ice build-up represent significant hazards – for a number of
These incidents prompted reasons. While the consequences in most cases will not be major, there is
a review of the plant’s potential for events of concern. Obviously, the best preventive measure is
piping and valve installation of equipment that will not allow snow or ice to accumulate.
installation practices. Where this is unsuccessful, controlled removal (e.g., carefully cut small
Modifications were made, pieces with steam and allow them to safely fall to grade) is an action to
drain valves were installed consider. When this cannot be done, precautions should be taken which
in the vertical position, limit damage when the material eventually does fall to grade.
lever-style (straight) Also, inadvertent operation of ¼ turn drain valves has occurred in many
handles must be installed facilities, this example is for falling snow/ice. Other causes include :
such that the valve is inadvertent contact with moving objects (hoses, people, ladders or
opened by pulling up on materials), vibration, etc. Experience indicates that round handles are an
the lever, not by pushing effective means to prevent a number of releases. Many locations have also
down. Circular style adopted a practice of installing a mechanical plug (or blind flange) in all
handles offer similar valve openings, which could allow release of a hazardous material.
protection.
Contact us at ccps@aiche.org or 212-591-7319
Manufacturing
Technology Alliance
November 2001
Trace quantities of flammables can cause an event like this!

Flammables in a vessel vapor space is a hazard present in many facilities. In most cases, it is associated
with handling flammable liquids; control systems include inert gas (e.g., nitrogen) padding, electrical
grounding, hot work permit procedures, etc.
But, a flammable vapor space can also develop in vessels which contain only TRACE amounts of
flammable materials! Here are a few of the ways this could occur:
• A reaction involving a chemical with trace quantities of a flammable material; when the main
component is consumed in the reaction, these small quantities accumulate in the vessel’s vapor
space, or
• A liquid containing small quantities of soluble or entrained flammable impurities flows through a
vessel, the flammable material is released and trapped in the vapor space, or
• Adsorption of a liquid which contains trace quantities of a non absorbed flammable impurity which
can be left to accumulate in the vapor space.
Important Items
to Look for to
Identify this
Hazard
• a stagnant vessel vapor
space, and
• trace amounts of
flammable chemicals
which could be
released from the
liquid.
What To Do If You Have This Hazard

• treat the vessel as if it held a flammable material
• install a purging flow in the vapor space to maintain a flammable concentration less
that 25% of the lower explosive limit
However, reproduction for the purpose of resale by anyone other than CCPS is strictly prohibited.

Ccps Process Safety Beacons Aio 2001 To 2018 15079

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ccps Process Safety Beacons Aio 2001 To 2018 15079

Uploaded by

Copyright:

Available Formats

This issue sponsored by

Do you know? What can you do?

tank causing it to rupture and explode. Adjoining segments of the

Your plant is talking to you through near misses – is anybody listening?

What can you do?

A small amount of contamination can cause a big problem!

In recent years, many natural disasters have been

major earthquake and subsequent tsunami.

These events and others like them had, or could

What can you do?

Be prepared for natural disasters!

Do not underestimate the hazards of liquefied gases!

Did you know? What can you do?

Make purged enclosure checks a part of your plant routine!

Don’t ignore safety alarms – there might really be a “wolf”!

in the trash can, but instead of taking those last 4

Why is it important? What can you do?

What can you do?

Protect your plant from collision!

A seemingly small change, without an adequate Management of Change (MOC)

Did you know?

complex system. The valve should have

A minor change can have a big impact!

Did you know? What can you do?

Everybody has something to contribute when investigating an incident!

acid (which contained some hydrocarbon) from a refinery alkylation

Did you know? What can you do?

Report corroded equipment and holes in tanks!

In 1991, an explosion and fire occurred in a 50,000 barrel-per-day Fluid

Liquid water + hot material = steam explosion danger!

vessel in a pilot plant. An oxidation reaction was being done in a

Did you know? What can you do?

Remember that combustible liquid mists can burn or explode!

What can you do?

Always put the right stuff in the right place!

three crew members (Virgil "Gus" Grissom, Edward

High oxygen concentration has been a contributing

Oxygen – necessary for life but hazardous if not controlled!

Ignition Sources – Once More December 2016

Some ignition sources are fairly obvious. A glowing cigarette, an active

What can you do?

The Beacon – sharing process safety lessons for 15 years!

Did you know? What can you do?

You can’t control a hazard that you haven’t identified!

In 2014 there was a fire on a passenger vessel

What can you do?

You can’t manage a change that nobody has recognized!

Did you know? What can you do?

Managing static – a key part of reducing ignition sources!

Understanding chemical compatibility July 2016

Last month’s Beacon was about the danger of

What can you do?

Know what happens when you mix chemicals!

Take your safety knowledge home and share it!

More repeat incidents! May 2016

Did you know? What can you do?

Learn from history so it doesn’t repeat!

Hot Work Maintenance workers were doing

The incident investigation found the

• The flame arrester on an oil tank was

What can you do?

Flame arresters need inspection and maintenance!

Safety device or control device? March 2016