Safety Bulletin U.S. Chemical Safety and Hazard Investigation Board

MANAGEMENT OF CHANGE No. 2001-04-SB | August 2001

interrupted process operations and Introduction also stopped the production of steam. At the delayed coking unit, he U.S. Chemical Safety and Hazard Investigation Board (CSB) issues the on-line drum had been filling Tthis Safety Bulletin to focus attention on the need for systematically for about an hour and was managing the safety effects of process changes in the chemical industry. approximately 7 percent full. The This bulletin discusses two incidents that occurred in the United States in other drum was full and was being 1998. Each case history offers valuable insights into the importance of cooled. having a systematic method for the management of change (MOC). An MOC methodology should be applied to operational deviations and Although electric power was variances, as well as to preplanned changes—such as those involving restored after 2 hours, an technology, processes, and equipment. additional 10 hours passed before steam production was re- established. During the interim, the tarry oil in the piping between though the operation is conducted the furnace and the partially filled Case No. 1 continuously. drum cooled and started to Background After a drum is filled, the flow of solidify. oil is diverted to a freshly emptied Once steam was restored, the vessel. The full drum contains a On November 25, 1998, a fire at the operators were unsuccessful in Equilon Enterprises oil refinery tarry mass, which solidifies to a attempting to inject it into the drum coal-like substance (coke) when delayed coking unit in Anacortes, through the normal route because Washington, caused six fatalities cooled by the addition (Figure 1). A loss of electric power of steam and then water. and steam supply approximately The top and bottom of 37 hours prior to the fire had the drum are opened at l Figure 1. Equilon Enterprises oil refinery fire. resulted in abnormal process the completion of the conditions. cooling cycle, and the solid mass of coke is Process Description then cut into pieces and removed from the vessel. A delayed coker converts heavy tar-like oil to lighter petroleum Incident products, such as gasoline and fuel Description oil. Petroleum coke is a byproduct of the process. Drums1 of coke are Pre-Incident Activity— actually produced in batches, A severe storm on November 24 caused an electric power outage in 1 Within the oil industry, a drum is a the refinery. The storm tower or vessel in which materials are processed, heated, or stored. Coke drums can be very large and typically stand several stories high. 2 of the plugged piping. (When filled drums. The process established, but the rate of flow normally injected, steam creates supervisor was aware of the was low. passages in the tarry mass through seriousness of the previous Opening the Vessel—Personnel which cooling water can later flow. incident. He left instructions expected a tarry mass to drain from It also drives off remaining residual directing the night shift not to add the drum. The supervisor and volatile petroleum and sulfur any water, and instead to allow the process operator directed that the compounds from the coke.) drum and its contents to simply drum be opened with a minimum stand and cool overnight. On the A process interruption in 1996 had number of people present. Because following morning, he met with the also resulted in a partially filled they were also concerned that the operators to determine how to drum. At that time, water was limited flow of steam might not empty the partially filled drum. No injected into the drum to cool the sufficiently strip all the toxic engineers, who could have material inside. However, when compounds from the tar inside the provided technical support, were the drum was opened, a torrent of vessel, they required that the present at this meeting. water, heavy oil, and coke spewed workers removing the bolts on the out—which created a hazard and Preliminary Operations—The drum heads wear self-contained required a major cleanup. An supervisor and operators observed breathing apparatus. internal investigation team that the exposed part of the bottom The top head was unbolted and recommended that procedures be flange of the drum felt cool to the lifted from the drum. The bottom written for cooling/emptying touch. They also noted that head was also unbolted and held partially filled drums. However, temperature-sensing devices in place by a hydraulic dolly. The this task was not completed. located beneath the insulation on operator then activated a release the outside surface of the drum On the day of the fire, neither the mechanism to lower the dolly. indicated approximately 230 process supervisor nor the Witnesses reported hearing a degrees Fahrenheit (°F), as operators had any written whooshing sound and seeing a compared to the 800°F of a procedures for handling partially white cloud of vapor emanate from typically full drum. the bottom of the drum. The hot One operator suggested adding 100 petroleum vapor burst into flames. barrels of water to the drum. The process supervisor, an CSB Safety Bulletins offer advisory However, the supervisor was operator, and the four contract information on good practices for concerned about such a course of personnel assisting were caught in managing chemical process hazards. action because of the previous the fire and did not survive Actual CSB case histories provide supporting information. Safety incident. Upon further discussion, (Figure 2). Bulletins differ from CSB they decided—because part of the After the incident, Equilon Investigation Reports in that they do drum felt cool, and the relocated the controls for the not comprehensively review all the temperature-sensing devices read causes of an incident. hydraulic dolly to allow workers to only 230ºF—that it was not very position themselves farther from a hot inside and it was safe to open drum when opening it. the vessel as long as they first injected some steam. Followup Analysis—The supervisor U.S. Chemical Safety and Hazard and operators analyzed the Investigation Board An operator connected a steam situation and devised process Office of Investigations and Safety hose to the oil inlet piping at the changes to empty the drum. The Programs bottom of the drum. Several 2175 K Street NW, Suite 400 relative coolness of the bottom witnesses said that the steam Washington, DC 20037 flange erroneously suggested to warmed the top of the piping, but 202-261-7600 them that the temperature inside the bottom remained cool. It is http://www.chemsafety.gov the drum was also cool—when, in likely that steam flow had been 3

the low l . . . the Equilon incident l Figure 2. Fire control efforts at Equilon refinery. temperature underscores the need to readings were Matt Wallis, Skagit Valley Herald not have MOC policies that representative of include abnormal the hot core. situations, changes to It was assumed that the entire procedures, and drum contents deviations from standard had cooled to operating conditions. safe levels during the 2 days since the power failure. to trigger further review. It is However, heat essential to prepare operating transfer procedures with well-defined calculations limits for process variables for all would have common tasks. Once onsite indicated that personnel are trained on MOC weeks would be policy and are knowledgeable required for the about normal limits for process l The relative coolness of drum contents to cool sufficiently variables, they can make informed via heat losses to the ambient the bottom flange judgments regarding when to environment. erroneously suggested apply the MOC system. . . . that the temperature Lessons Learned Once a deviation is identified that triggers the MOC system, it is Chemical processing enterprises inside the drum was also management’s responsibility to should establish policies to cool—when, in fact, only gather the right people and manage deviations from normal resources to review the situation. the material adjacent to operations. Systematic methods The skills of a multidisciplinary for managing change are the inside walls had team may be required to sometimes applied to physical thoroughly identify potential cooled. alterations, such as those that hazards, develop protective occur when an interlock is measures, and propose a course of bypassed, new equipment is fact, only the material adjacent to action. added, or a replacement is “not in the inside walls had cooled. kind.” However, the Equilon The Equilon incident could have Unknown to the coker unit incident underscores the need to been avoided if the “change” was personnel present, the core of the have MOC policies that include managed by a team experienced in mass remained insulated from heat abnormal situations, changes to hands-on operations, safety loss. Within the core, residual heat procedures, and deviations from procedures, and engineering continued to break down the standard operating conditions. calculations. Written procedures petroleum, creating a pocket of hot for cooling and emptying partially For an MOC system to function pressurized volatile oil. Had the filled drums, as recommended by effectively, field personnel need to limitations of temperature- sensing an Equilon investigation team in know how to recognize which devices been better understood, 1996, might also have reduced the deviations are significant enough personnel may have realized that likelihood of this incident. 4 l The Equilon incident duration of the variance. Variances should require the Case No. 2 could have been avoided approval by a suitable level of if the “change” was management, based on the Background process risks involved. Also, managed by a team they should be documented to On October 13, 1998, a reaction experienced in hands-on assure consistent vessel explosion and fire at the operations, safety understanding by all affected CONDEA Vista Company individuals and departments detergent alkylate plant in procedures, and of what specific departure Baltimore, Maryland, injured four from normal practice is to be people (Figure 3). engineering calculations. allowed. A formal hazard analysis may be Process Description The Center for Chemical Process appropriate depending on the Linear alkyl benzene is used to Safety, an industry-sponsored produce biodegradable detergents, organization affiliated with the l “To assure that . . . which are widely used in American Institute of Chemical industrial, commercial, and Engineers, offers this useful deviations from normal residential cleaners. At CONDEA guidance in its publication, practice do not create Vista, this chemical was Guidelines for Technical Management manufactured by mixing powdered of Chemical Process Safety (1989): unacceptable risks, it is aluminum chloride (the catalyst) In any operation, situations will important to have a with liquid hydrocarbons, arise that were not foreseen variance procedure, or chlorinated hydrocarbons, and when the operating procedures benzene. were developed. At such times, to have incorporated personnel may want to conduct the same means of Incident Description operations in a way that differs control into other from, or contradicts, the process Pre-Incident Activity—About 3 technology or the standard management systems.” months prior to the incident, the operating procedures. Baltimore facility changed its To assure that these deviations process technology and from normal practice do not complexity of the change or discontinued the direct addition of create unacceptable risks, it is variance. A hazard analysis for aluminum chloride to the reactor. important to have a variance the Equilon situation would have Instead, powdered aluminum was procedure, or to have likely determined the limitations added to the reactor, where it incorporated the same means of the temperature readings and combined with hydrogen chloride of control into other that it was unsafe to open the to form the necessary aluminum management systems. The drum. It would have also chloride. Shortly after the plant variance procedure will identified the possible release of a switched to the new process, the require review of the planned deviation, and acceptance of large volume of very hot liquid as reactor became fouled with a the risks it poses. The a significant risk. sludge-like catalyst residue. variance procedure should When the process was shut down require the explanation of the for maintenance, the operators were deviation planned; the reasons unable to empty the liquid that it is necessary; the safety, remained in the reactor. Sludge health, and environmental considerations; control had settled in the vessel, plugging measures to be taken; and the bottom outlet nozzle. 5

sample was tested, recorded a 5 to 10 degree Celsius l Figure 3. Site of ruptured reactor, CONDEA Vista it reacted with (°C) temperature rise. After Company detergent alkylate plant. water, yielding a observing the reactor temperature white gas stabilize, the chemist and the (hydrochloric engineer went home for the night. acid) and Because the process supervisor had generating heat. not been in the plant that day, the Although the shift supervisor spoke to him by chemist tested telephone and suggested injecting various aqueous a short burst of steam at the bottom solutions, he nozzle of the reactor. The process concluded that supervisor agreed. The shift water—in spite of supervisor wrote a one-line its reactivity with instruction for the night shift to use the sludge—was steam to clear the plugging. an appropriate solvent for The two shift supervisors had a clearing the brief conversation at shift turnover. sludge from the The night shift supervisor reactor. understood that he was to use steam to break up the plug. Unsuccessful attempts were made Later that morning, the technology However, the procedure intended to clear the nozzle by injecting manager assigned an engineer to by the day shift supervisor and the high-pressure nitrogen into the work with the chemist in solving process supervisor—though not piping. The reactor was also the plugging problem. The detailed—was to inject a short flushed with a high flow of oil for engineer estimated the volume of burst of steam, not to apply it several hours, but this too failed to solid in the reactor and performed continuously. clear the plugging. some calculations for potential energy release and for the ability of The night shift supervisor The following day, excess liquid water to absorb the heat generated. instructed an operator to add steam was removed from the reactor Together, the chemist and the to the reactor. Minutes after the through a side nozzle, and a engineer recommended that water operator started to continuously sample of the remaining sludge be added to the reactor to dissolve inject the steam, it reacted with the was extracted. The next morning, the solids. They suggested an 8:1 metallic aluminum and the the sample was given to a plant ratio, with the water added at as aluminum chloride residue in the chemist, who was asked for advice fast a rate as possible. This sludge. The reactor vessel on dissolving the remaining approach was based on the idea exploded (Figure 4). sludge. that rapidly adding a surplus Effects of Explosion and Fire—No Reactivity Testing—The chemist volume of water would absorb the one was present in the immediate first conducted a laboratory energy released by the reaction and vicinity of the reactor when it experiment to check whether fresh minimize the temperature rise. exploded, and there were no powdered aluminum catalyst Addition of Water and Steam to fatalities. Two employees and one reacted with water. He concluded Reactor—Water was added to the contractor received first- and that it did not. (Facility personnel reactor while the vessel agitator second-degree burns; they were were aware that aluminum was running. A temperature wearing fire-resistant work chloride reacts with water, indicator in the control room clothing, which provided a releasing heat.) When the sludge measure of protection. Another 6 contractor injured his back when he fell. Property damage was l Figure 4. CONDEA Vista plant fire. estimated at $13 million. WBAL-TV Lessons Learned

From both a project and an operational standpoint, the incident at CONDEA Vista emphasizes the importance of systematically managing changes. Post-incident investigations noted that the density of the new catalyst (powdered aluminum) was higher than that of aluminum chloride. The higher density material— combined with problems related to initial overfeeding of the aluminum—overtaxed the mixing capability of the agitator and allowed aluminum to settle in the bottom of the reactor, where it plugged the lower nozzle and have to be added quickly and accumulated as sludge. l The higher density without interruption to avoid a The plan devised by the chemist material—combined with significant heat release. and the engineer for dissolving the problems related to l The temperature-sensing device sludge posed hazards. Of did not accurately indicate the particular concern were the initial overfeeding of the process temperature because it following: aluminum—overtaxed was located in a stagnant l Gases2 that evolved during the the mixing capability of pipeline between the reactor and bench-scale tests could vent the agitator and allowed another vessel. The chemist and freely. However, the reactor— the engineer relied on misleading though equipped with vent aluminum to settle in the temperature indications when piping and a relief system— bottom of the reactor, they noted the stabilization of the presented a much more where it plugged the reactor temperature before contained environment. The leaving for the day. amount of reactive material lower nozzle and A hazard analysis of the proposed involved was much greater; the accumulated as sludge. procedure could have assisted in scale-up factor was large. the identification of potential safety l The concept of absorbing the issues. Ideally, the extent of quickly adding a surplus of a energy of reaction by means of analysis undertaken should be reactive substance (water) was tailored to the degree of risk.

2 potentially hazardous. At higher temperatures, water can react The CONDEA Vista incident also with aluminum to form hydrogen. Water Although the concept was can also react with aluminum chloride to feasible, it required precise highlights the importance of produce hydrogen chloride, which—in execution. The water would preparing written procedures for turn—can react with aluminum to produce hydrogen. 7

variances in operating conditions covers operational variances in and practices. In this case, the Summary addition to physical alterations. If absence of written instructions you do not have a systematic Neither the Equilon Enterprises oil increased the likelihood of method for handling changes, refinery fire nor the CONDEA miscommunication between the develop and implement one. Vista Company explosion and fire two shift supervisors, which led to involved emergencies that required the unsafe application of steam in rapid decision making. In each the reactor vessel. l If your organization has instance, time was available to an MOC policy, review it l . . . the absence of look into the circumstances more thoroughly. Each situation could to be sure that it covers written instructions have been avoided with a more operational variances in increased the likelihood analytical and structured approach to problem solving. addition to physical of miscommunication alterations. between the two shift l Neither the Equilon supervisors, which led to To maximize the effectiveness of the unsafe application of Enterprises oil refinery fire nor the CONDEA your MOC system, include the steam in the reactor following activities: Vista Company vessel. l Define safe limits for process explosion and fire conditions, variables, and involved emergencies activities—and train personnel Another lesson learned is the value to recognize significant changes. of having an authorization or that required rapid Combined with knowledge of approval step as part of an MOC decision making . . . Each established operating system for abnormal situations. If situation could have been procedures, this additional such a procedure had been in training will enable personnel to place, a technical manager would avoided with a more activate the MOC system when have reviewed the proposed analytical and structured appropriate. procedure and may have detected l Apply multidisciplinary and its deficiencies. approach to problem specialized expertise when solving. analyzing deviations.

l Use appropriate hazard analysis The Occupational Safety and techniques. Health Administration’s (OSHA) l Authorize changes at a level Process Safety Management commensurate with risks and standard and the U.S. Environ- hazards. mental Protection Agency’s (EPA) Risk Management Plan require l Communicate the essential covered facilities to manage elements of new operating changes systematically. It is good procedures in writing. practice to do so, irrespective of the l Communicate potential hazards specific regulatory requirements. and safe operating limits in If your organization has an MOC writing. policy, review it to be sure that it 8 l Define safe limits to For Further Reading process conditions, Center for Chemical Process Safety (CCPS), 1992. Guidelines for Hazard nd variables, and activities— Evaluation Procedures, 2 Edition With Worked Examples, American and train personnel to Institute of Chemical Engineers (AIChE). recognize significant CCPS, 1989. Guidelines for Technical Management of Chemical Process changes. Safety, AIChE. Sanders, Roy E., 1999. Chemical Process Safety – Learning From Case Histories, Butterworth-Heinemann, pp. 215-247. l Provide training in new procedures commensurate with their complexity.

l Conduct periodic audits to determine if the program is effective.

The U.S. Chemical Safety and Hazard Investigation Board (CSB) is an independent Federal agency whose mission is to ensure the safety of workers and the public by preventing or minimizing the effects of chemical incidents. CSB is a scientific investigative organization; it is not an enforcement or regulatory body. Established by the Clean Air Act Amendments of 1990, CSB is responsible for determining the root and contributing causes of accidents, issuing safety recommendations, studying chemical safety issues, and evaluating the effectiveness of other government agencies involved in chemical safety. No part of the conclusions, findings, or recommendations of CSB relating to any chemical incident may be admitted as evidence or used in any action or suit for damages arising out of any matter mentioned in an investigation report (see 42 U.S.C. § 7412(r)(6)(G)). CSB makes public its actions and decisions through investigation reports, summary reports, safety bulletins, incident briefs, safety recommendations, special technical publications, and statistical reviews. More information about CSB may be found on the World Wide Web at http://www.chemsafety.gov.

Information about available publications may be obtained CSB investigation reports may be purchased from: by contacting: National Technical Information Service U.S. Chemical Safety and Hazard Investigation Board 5285 Port Royal Road Office of Congressional and Public Affairs Springfield, VA 22161 2175 K Street NW, Suite 400 (800) 553-NTIS OR (703) 487-4600 Washington, DC 20037 Email: [email protected] (202) 261-7600 For international orders, see: http://www.ntis.gov/support/cooperat.htm.

Salus Populi Est Lex Suprema People’s Safety is the Highest Law