Use

Case Histories to

Safety

Energize Your HAZOP

Glenn E. Mahnken, FM Global

T
Photos: 2000 Factory Mutual Insurance Company. Reprinted with permission.

he process safety management programs of many companies include formal process hazards analyses, using methods such as hazard and operability (HAZOP) studies and what-if reviews, as key elements of these programs. Kletz (1) summarizes the purpose of a HAZOP as follows: ... to provide a nal check on a basically sound process design, to make sure that no unforeseen effects have been overlooked. To nd the latent design deciencies that could lead to hazards or operability problems in the eld, a team of highly motivated, knowledgeable, and experienced individuals engages in a collective critical thinking process that is guided by a methodical standard procedure. By denition, the HAZOP team that thinks more critically (or creatively) will be the more

Reviewing incident reports at a HAZOP meeting is more than just a lessons learned activity. It can spur sharper thinking and lead to a more telling analysis of your processes.
likely to discover the unforeseen effects that might result in a preventable major accident. As noted, the team is working with a basically sound design, so the sought after effects are often quite subtle. To nd as many of these as possible, the team must energetically probe and challenge the process design and be able to sustain its efforts over many hours of questioning and answering.

CEP

March 2001

www.aiche.org/cep/

73

Safety
Table 2. Selected case histories from the AIChE Loss Prevention Symposia (1971 2000). Author(s) R. C. Dartnell, Jr. and T. A. Ventrone A. H. Searson T. J. R. Stephenson and C. B. Livingston Title Explosion of a Para-NitroMeta-Cresol Unit Fire in a Catalytic Reforming Unit Explosion of a Chlorine Distillate Receiver Year 1971 Incident type Unexpected thermal degradation of PNMC caused the rupture of a 3,000 gal stainless steel storage tank into five pieces inside a building. Corrosion as a result of a process change led to rupture of piping and release of hydrocarbons. Hydrogen formed in a corrosive environment where Cl2 concentration was low, then carried over into the process where Cl2 concentration was high. The vapors ignited due to unknown ignition source. Maintenance was underway to add a branch line to a steam main, which had not been adequately isolated from a process vent prior to welding. Gasket on a level connection for a reactor burst suddenly, allowing the release of polypropylene vapor, which ignited after about 20 min, probably due to buildup of static electricity in the cloud. During shutdown due to power failure, a 24 in. bellows expansion joint failed, allowing 15,000 gal of polypropylene to to escape. Vapor cloud traveled 250300 ft to furnaces and ignited within about 2 min. Upsets during startup caused high level/low temperature in a feed drum, resulting in cold brittle fracture of a weld. Loss of containment of polypropylene. Vapor cloud ignited. Power failure caused control valves to shut. Thrust forces on pipe caused control loop supports to puncture the pipe, resulting in loss of containment of flammable liquid. Operator opened the door to a pressure filter that was still under pressure. Reactants had different densities and did not mix initially. Gas bubbles evolved by reaction at interface caused mixing and runaway acceleration of the reaction. Electrostatic discharge during unloading of polymer from a tanker truck into a silo. Operation had operated without incident for many years. No flow of oil when a process heater was fired up and the safeguards had been field-adjusted out of range. Consequences Fire, explosion damage to building, injuries, one fatality. Vapor cloud explosion and major fire, injuries. Chlorine receiver blew apart into five pieces, also causing extensive damage to nearby equipment. When the welder cut into the steam main, an explosion occurred. Despite 4,0005,000 gpm water deluge, the fire spread to neighboring units causing considerable material damage. Sprinkler systems contained the fire toTrain 2.

1971 1972

T. A. Kletz

Case Histories on Loss Prevention

1973

T. A. Kletz

Emergency Isolation Valves for Chemical Plants

1975

S. A. Saia

Vapor Clouds and Fires in a Light Hydrocarbon Plant

1976

A. L. M. vanEinjnatten

Explosion in a Naphtha Cracking Unit

1977

14 fatalities, 106 injuries.

V. G. Geishler

Major Effects from Minor Features in Ethylene Plants

1978

Fire, property damage, business interruption.

T. A. Kletz S. J. Skinner

Organisations Have No Memory Explosive Evolution of Gas in Manufacture of Ethyl Polysilicate Dust Explosions in Storage Silos: Polyvinyl Alcohol

1979 1980

Operator was killed. Cover was blown off the reactor and the plant was enveloped in hydrogen chloride fumes. Explosion: silo swung over in flames onto the top of the truck and the transfer line. 6 in. dia. tube ruptured and allowed 1,800 gal of oil to escape. Fire ensued and caused substantial property damage. Oil fire spread to electrical cables and into the control room. Caused emergency evacuation of the control room. A $17.6 million loss. The tanker rocketed. Alcohol fire. Vapor cloud explosion.

D. R. Pesuit

1981

R. E. Sanders

Plant Modifications Troubles and Treatment

1982

T. O. Gibson

Learning Value from a Recent Loss

1983

Electrical fault in an indoor transformer containing 235 gal of mineral oil.

D. J. Lewis

A Review of Some Transportation Accidents, Identification of Causes and Minimization of Consequences

1986

High pressure caused a cryogenic ethylene tanker truck to explode. It was parked near an alcohol unloading rack. The cause was considered to be freezing of the safety relief valve.

74

www.aiche.org/cep/

March 2001

CEP

Author(s) P. G. Snyder

Title Brittle Fracture of a High Pressure Heat Exchanger Explosion and Fire at a Phenol Plant

Year 1987

Incident type Combination of deviations lead to brittle fracture at 3,400 psig during hydrostatic pressure testing of a steam generator following an outage. High temperature as a result of a leaking steam valve, in conjunction with abnormal conditions that arose during process restart, caused explosion of a 25,000 gal tank containing cumene hydroperoxide. Blown fuse in instrumentation power supply caused series of abnormal conditions, including high condensate level in a steam drum, which overflowed into the steam header. Condensate was introduced into a hot 20 in. dia. line when a steam valve was opened. High temperatures occurred as a result of an electrical short in control wiring while gas turbine was on turning gear. The short caused fuel valves to open and ignition transformer to energize. High temperature and runaway reaction occurred in a rail tank car containing a load of methacrylic acid that was insufficiently inhibited. Wrong material was loaded into a chemical barge. High gas flow to a reactor resulted when an air-to-open valve suddenly went to the full open position (as a result of a plugged orifice in the valve positioner). High temperature occurred in a tank containing 30 m.t. CO2, when an internal heater failed "on." The high temperature resulted in high pressure. The relief valve on the tank failed to open. High temperature (hot spot) developed in a carbon bed absorber connected to the vent line of a 1,000 bbl intermediate effluent storage tank. Low water level occurred in a high-temperature boiler in a process plant due to failure to follow proper procedures and failure of the low-level interlock. High level of carbon disulfide liquid during a cleaning operation resulted in overflow into the heating zone and sudden volatilization of the liquid. Low flow of air from one of the cylinders of a double-acting reciprocating air compressor resulted in high temperature and concentration of lubricating oil mist in the air stream. High temperature occurred in the plastic duct and scrubber due to loss of quenching for the hot flue gases when a pulp mill recovery boiler tripped offline and interlocks failed. More hydrogen was present than was expected in the gas-oil stream sent from a hydrogen desulfurizing unit to a 15,000 m3 storage tank.

Consequences No injuries. Refinery production was curtailed to 6070% for 4 mo. Phenol Unit 1 was almost completely destroyed by fire. Severe damage to adjacent Unit 3. Fuel tank fire. The line ruptured. Three people were sprayed with steam and condensate. Two fatalities.

R. F. Schwab

1988

T. O. Gibson

Learning Value from a Blown Fuse

1989

B. W. Bailey

Iron Fire in Heat Recovery Unit

1990

Fuel gas burned inside the combustor exhaust duct. The 600 psig heat recovery unit caught fire and was destroyed. Car exploded. Parts were found 300 yards away. Overhead electrical lines were severed, shutting down production. Incompatible reactive chemicals mixed. 4872 h state of alert. Near miss. Gas vented into the area of the reactor.

S. E. Anderson and R. W. Skioss

More Bang for the Buck: Getting the Most from Accident Investigations

1991

D. J. Leggett

Management of a Reactive Chemicals Incident: Case Study Case Histories of Some Power and Control-based Process Safety Incidents Catastrophic Failure of a Liquid Carbon Dioxide Storage Vessel Carbon-initiated Effluent Tank Overpressure Incident

1992

M. L. Griffin and F. H. Garry

1993

W. E. Clayton and M. L. Griffin

1994

The tank exploded. Three fatalities, $20 million property damage, 3 mo. lost production. The vent stream was in the flammable range, ignited and propagated back to the storage tank. The tank roof was blown off (~200 ft). The boiler was dry fired. Serious internal damage to boiler and steam drum. No injuries (near miss). Explosion blew out a wall. Extensive fire in the ductwork. Minor injuries. The air stream ignited and an explosion propagated a "galloping detonation" in the compressed air pipeline. All plastic duct work destroyed, scrubber collapsed onto cable tray. Mill was shut down for extended period. Property damage over $5 million. The tank exploded as a result of electrostatic discharge during a sampling operation. One fatality. Massive fire in storage dike.

R. E. Sherman, K. C. Crawford, T. M. Cusick, and C. S. Czengery S. Mannan

1995

Boiler Incident Directly Attributable to PSM Issues

1996

D. S. Hall and L. A. Losee F. P. Nichols

Carbon Disulfide Incidents DuringViscose Rayon Processing Air Compressor Delivery Pipeline Failure

1997

1998

H. L. Febo

Plastics in Construction The Hidden Hazard

1999

Y. Riezel

Fixed Roof Gas-Oil Tank Explosion

2000

CEP

March 2001

www.aiche.org/cep/

75

Safety
Table 1. Case history synopsis hypothetical HAZOP worksheet (in hindsight). Company: ABC Facility: XYZ Plant Process: Waste Gas Incinerator Design Intent: Burn AOG and SVG off-gases HAZOP Item No. 2.1.1 Deviation Cause Consequences Study-Section: 2.1 SVG piping: fan to incinerator HAZOP Date: Leader/Scribe: Team Members: Engineering/ Administrative Controls Operators follow procedures for shutdowns. High concentration alarm. F* C* R* Questions/ Recommendations 2.1.1.1 Check procedures for Valves L and K Are procedures clearly documented? Do procedures cover abnormal situations? 2.1.1.2 Check gas alarm response time is it fast enough?

No flow

Valves L and K closed improperly

(1) Increase concentration of combustible gases in SVG piping. (2) Potential explosion if gas goes into explosive range and gas reaches incinerator.

Bypass SVG to flare on high: high gas concentration alarm. Flame arrestor.

2.1.1.3 Check bypass response time vs. travel time to incinerator. 2.1.1.4 Review flame arrestor design vs. expected blast pressures. 2.1.1.5 Review flame arrestor design vs. expected reaction forces.

Damage-limiting construction.

* F = frequency; C = consequence severity; R = risk ranking.

How case histories can help Clearly, a variety of psychological factors come into play that can encourage or hold back the HAZOP team during deliberations (2). The intent is to help encourage critical thinking by making short presentations of previous chemical process industries (CPI) plant accidents to the team (3). Of course, as a general prerequisite for the success of any HAZOP, the participants must already own the process (4), i.e., the team members must have a strong sense of urgency and be highly motivated by virtue of their roles and responsibilities as process designers, plant engineers, supervisors, operators, and technicians. In this context, case history presentations can be made at the start of a meeting, or during a break to help engage and galvanize the team by telling a short war story and, at the same time, demonstrating the connection between HAZOP guidewords and real world accidents. The immediate benet of the case history presentation is not quantiable in terms of the HAZOP output; one simply surmises that a properly designed 10-minute presentation can be worthwhile, because a group with an accident example fresh in their minds will be more critical and more creative in their deliberations through the course of the study. A long-term benet, assuming case history presentations become an integral part of the plants HAZOP sessions, is that participants will gradually accumulate a body of loss experience and invaluable loss-prevention wisdom

based upon reported CPI plant losses. This benet is not quantiable either; it relates to the value of learning any kind of history that we desire to avoid repeating. In this respect, the HAZOP session affords a unique opportunity to present these history lessons to busy engineers and plant personnel who generally are not easy to assemble for such purposes.

Use a synopsis presentation format HAZOP meeting time is almost inevitably in short supply. And, since the main intent of presenting the case history is not to study the details of the accident, but rather to help energize the critical thinking process, a synopsis presentation format is most appropriate. In the context of the study, providing the basic sequence of events of the accident, along with a ow schematic, selected loss lessons and key conclusions will suffice as long as these are offered in a manner that engages the interest of the team. The presentation can also include a hypothetical HAZOP worksheet page that illustrates how the accident might have been foreseen in a HAZOP study. This worksheet serves as a minitraining example for new participants and a refresher for those with previous such experience. Of course, the reasons for making the case history presentation also need to be explained to the group at the start of the presentation. The person presenting the case history need not be the group leader or the same individual. Team members can take

76

www.aiche.org/cep/

March 2001

CEP

Figure. 1. Source slide.

Case History Synopsis

Based on the paper: Flashback from Waste Gas Incinerator into Air Supply Piping S. E. Anderson, A. M. Dowell, III, P.E., and J. B. Mynaugh Rohm and Haas Texas, Inc. P.O. Box 672 Deer Park, TX 77536 Paper 73c prepared for presentation at the 25th Annual AIChE Loss Prevention Symposium, August 18-22, 1991 Figure 5. Cause slide.

Initial Cause
Field operators misunderstood radio instructions from the control room to close the AOG valve to the incinerator Valve L was closed by mistake and Valve K was being opened SVG was blocked in: VOCs increased Valve L was then reopened, sending the SVG to the incinerator, which ashed back

Figure 6. Consequences slide. Figure 2. Summary slide.

Consequences (Partial list)

SVG ame arrestor was broken from its mounting bolts and sheared into 2 pieces Stainless steel piping connecting the SVG ame arrestor to SVG fan was broken free from its supports and came to rest on top of the fan Explosion was not stopped by the ame arrestor Incinerator had numerous radial cracks in the refractory brick

Accident Summary
Miscommunication between outside operators and control room resulted in closing the wrong valve A waste gas incinerator experienced a ashback with a pressure wave in the supply piping Damage to ame arrestor, piping, fan, and the incinerator

Waste Gas Incinerator

AOG Waste Gases from Process

SVG piping going up to reactor rack fell from the third level to the ground Plastic (FRP) piping connected to the SVG fan suction was sheared and broken

Valve L

Missile damage to incinerator bustle The manual wheel for Valve K was broken off at the gear box casing No injuries But, at the time of the explosion, an operator was holding onto the wheel for Valve K

Vent Gases (SVG) from Process Valve K SVG Fan

To SVG Flare

Figure 3. Schematic slide. Figure 7. Conclusions slide.

Some Conclusions
Figure 4. Process slide.

Process Description
Waste gas incinerator burns off-gases from two separate sources: AOG and SVG SVG stream is normally routed to the waste gas incinerator at less than 10% of the lower explosive limit (LEL) At 25% LEL, an alarm sounds At 50% LEL, the SVG stream bypasses to the are

Unusual circumstances of human factors, unsteady-state events, and a rapid challenge combined to overcome the well-designed safety systems. Much of the serious damage was the result of poor construction. Consult the original paper for additional ndings and many recommendations that have general application for this type of equipment.

CEP

March 2001

www.aiche.org/cep/

77

Safety

A re could cost you ...

turns being assigned a case history as prework to study before the meeting, and, using already prepared overhead slides or handouts, make the presentation to the rest of the team at a convenient break in the meeting. The original case history article should preferably be familiar to the presenter beforehand, but discussion of the accident details should be minimal. The original article can be made available to interested participants for followup reading outside of the meeting.

Example presentation A well-known case history paper describing a waste-gas-incinerator explosion at a chemical plant was presented at the 25th annual AIChE Loss Prevention Symposium (5). As described in the original paper, the accident evolved as follows: The AOG process, which supplied one of the two waste gas streams feeding into an incinerator, shut down safely and tripped offline. The incinerator remained in operation, burning waste gas from a second process, called SVG. In preparing the AOG line for a restart, operators accidentally closed the wrong valves, resulting in the SVG gas ow being blocked in. The control room operator received a low SVG ow alarm and radioed to the eld operators to reopen the SVG valve to the incinerator. The SVG ow to the incinerator was quickly restored and an explosion occurred, resulting in overpressure damage to the incinerator refractory, as well as the dislocation of piping, valves, a ame arrestor, and the main SVG blower. Fortunately, there were no injuries to the operators who were working in the vicinity of the explosion.

more than you know.

A synopsis of this accident, prepared in a slide format intended for presentation to HAZOP groups, is given in Figures 1 through 7. Table 1 represents a hypothetical HAZOP worksheet that predicts the accident (in perfect hindsight, of course). The worksheet attempts to demonstrate to the team how, by using critical thinking and following HAZOP methodology, they might have been able to identify some of the possible causes and consequences, as well as develop the corresponding action items to help prevent or mitigate an actual accident.

Literature Cited
1. Kletz, T., Hazop and Hazan: Identifying and Assessing Process Industry Hazards, 4th ed., Taylor & Francis, London, p. 34 (1999). 2. Leathley, B., and D. Nicholls, Improving the Effectiveness of HAZOP: A Psychological Approach,Loss Prevention Bulletin, Issue No. 139, p. 8 (1998). 3. Mahnken, G., et al., Using Case Histories in PHA Meetings, Paper 6c, presented at AIChE 34th Annual Loss Prevention Symposium, Atlanta (Mar. 69, 2000). 4. Kletz, T., Hazop and Hazan: Identifying and Assessing Process Industry Hazards, 4th ed., Taylor & Francis, London, p. 33 (1999). 5. Anderson, S. E., et al., Flashback from Waste Gas Incinerator into Air Supply Piping, Paper 73c, AIChE 25th Annual Loss Prevention Symposium, Pittsburgh (Aug. 1821, 1991). 6. Loss Prevention on CD ROM, AIChE, New York (1998). The set contains presentations from all 31 Loss Prevention Symposia sponsored by AIChEs Safety and Health Division from 1967 to 1997, plus early CCPS conference and workshop proceedings from 1987 through 1994. (See www.aiche.org/pubcat.) 7. Kletz, T., What Went Wrong: Case Histories of Process Plant Disasters, 4th ed., Gulf Publishing, Houston (1998). 8. Sanders, R. E., Chemical Process Safety: Learning from Case Histories, Butterworth Heineman, Boston (1999).

Sources of accident case history reports The annual AIChE Loss Symposium Papers (6) include many accident case history studies that are detailed and, often, written rst hand by the accident investigators or participants. Table 2 is a selected list of these reports from 19712000 that can be used in the manner described above. Other sources are available as well, such as case historybased loss prevention books (7, 8), loss prevention journals, e.g., the Loss Prevention Bulletin, and published investigative reports. A good source of these reports is the U.S. Chemical Safety and Hazard Investigation Board, Washington, DC. The CSB allows downloading of its investigation CEP reports at www.csb.gov.

< Discuss This Article! >

To join an online discussion about this article with the author and other readers, go to the ProcessCity Discussion Room for CEP articles at www.processcity.com/cep.

G. E. MAHNKEN is a loss prevention specialist with FM Global (formerly known as Factory Mutual), Norwood, MA ((781) 440-8000 ext. 8644; Fax: (781) 440-8718; E-mail: glenn.mahnken@fmglobal.com). He has been with the company for 15 years, and holds a BA in biology from Antioch College and a BS in chemical engineering from the National Technical University of Athens, Greece. He is a member of AIChE.

78

www.aiche.org/cep/

March 2001

CEP