The organisation charged with overseeing chemical plant safety in the USA has outlined four key measures that need to be implemented following the release of its report into a 2008 leak of fuming oleum. Sean Ottewell reports.
The Washington-based US Chemical Safety Board (CSB) is an independent federal agency charged with investigating industrial chemical accidents. The agency's board members are appointed by the president and confirmed by the Senate. CSB investigations look into all aspects of chemical accidents, including physical causes such as equipment failure as well as inadequacies in regulations, industry standards, and safety management systems.
The organisation has just released its final report on the uncontrolled oleum release from INDSPEC Chemical Corporation in Petrolia, Pennsylvania, which forced the evacuation of three surrounding towns in October 2008.
In the report the CSB encourages companies that handle hazardous chemicals to follow proper management-of-change procedures, monitor deviations from written operating procedures, and implement appropriate safeguards to mitigate human errors (http://www.chemsafety.gov/UserFiles/file/INDSPEC Final.pdf)
The accident that took place on Saturday, 11 October 2008, forced over 2000 residents of Petrolia, Bruin, and Fairview, to evacuate or to shelter-in-place for approximately eight hours.
Oleum, also known as fuming sulphuric acid, was released when a tank transfer operation was left unattended during weekend operations and an oleum storage tank overflowed. The oleum formed a toxic sulphur trioxide gas, which mixed with moisture in the air to form a dense, corrosive, sulphuric acid cloud that threatened the neighbouring towns.
CSB chairman John Bresland said: "The managers of companies that handle highly hazardous substances, such as oleum, need to exercise special care that appropriate process safeguards are in place. In this accident, the CSB found that for many years, operators had been using an auxiliary pump power supply that lacked safety interlocks to prevent tank overfilling."
Owned by the Occidental Petroleum Corporation and located approximately 50miles northeast of Pittsburgh, the INDSPEC facility produces resorcinol, a chemical used for making tyres and other products.
The CSB report noted that three operators were involved in bulk liquid loading and unloading work from Monday to Friday. However, to maintain operations on a continuous, seven-day-per-week schedule, an operator would regularly perform work on weekends, transferring oleum from pressure vessels to storage tanks used to supply the resorcinol manufacturing process.
The CSB investigation determined that the normal power supply for the three oleum transfer pumps was equipped with a safety interlock, which would automatically shut off the flow of oleum when the receiving tank was full, preventing a dangerous overflow. However, the oleum storage building also had an auxiliary or 'emergency' power supply that had been installed in the late 1970s. It was originally intended as a temporary way to keep the pumps functioning during interruptions of the normal power supply but eventually the emergency power supply became a permanent fixture. Facility management never installed interlocks for the emergency power and written operating procedures did not address how or when the emergency power supply should be used.
The CSB found that to save time on weekends, operators typically ran two oleum transfer pumps simultaneously, using both the normal (interlocked) and emergency (non-interlocked) power supplies. Current managers and engineers stated they were unfamiliar with the practice. The practice had not been considered or described in process hazard analyses or operating procedures for the transfer operations.
- the day of the accident, an operator began transferring oleum at about 11.45am using two pumps and both power supplies. Although he shut down one of the pumps, he evidently did not shut down the other pump, which was connected to the non-interlocked emergency power supply, before departing the facility at 2.15pm. One of the storage tanks began overfilling with oleum; about an hour later acid mist began escaping from a vent, and by 4.30pm the mist was flowing from the building. Facility personnel were unable to control the release, and both the facility and the surrounding towns were evacuated.
"By installing the emergency power supply without the same safety devices as the normal power supply, former facility managers traded safety for efficiency," said CSB investigator Jeff Wanko, who led the investigation. "Facilities should evaluate changes, even those considered to be temporary, to determine their potential to cause an accident. That which is temporary can easily become permanent."
The CSB case study report identifies four key safety lessons for companies:
- Change management. In the 1980s, the facility changed the structure of the emergency power supply from temporary wiring to permanent conduit. The facility did not evaluate the significance of this change. Evaluate all changes - even those considered temporary - as permanent, including hazard analysis, procedures, training, and drawings. Establish and enforce time limits for temporary changes.
- Safeguard evaluation. The facility installed the emergency power supply without the engineering controls that already existed on the normal power supply and without improving alarms and shutdown systems. Although operator action was the sole protection against tank overfill, the facility gave operators only verbal instruction on the use of the emergency power supply.
In the hierarchy of controls, administrative and procedural control ranks below engineering control as a safeguard. Ensure that all modes of operation are equipped with equally robust safeguards for similar hazards.
- Operating procedures. The facility's storage system design required operators to transfer oleum on the weekend to ensure operations were unaffected during the week. Operators used a work practice developed years earlier to transfer oleum using two pumps concurrently. This work practice was never recorded in written operating procedures. Work practices can develop that do not reflect written operating procedures. Workers may use alternate practices to streamline tasks. Such alternate practices can introduce potential hazards that have not been formally evaluated. Management must engage operators in every step of procedure development and remain vigilant in evaluating how work is actually performed.
- Process hazard analysis. The facility never included information on the emergency power supply in piping and instrumentation diagrams and written operating procedures. Personnel hazard assessment (PHA) teams were therefore unable to evaluate the consequences of emergency power supply use. The quality of PHAs suffers when piping and instrumentation drawings and procedures are not accurate. Facilities must develop protocols requiring drawings and procedures be updated as soon as changes occur.