-
1INVESTIGATION REPORT
REPORT NO. 2003-01-I-MSOCTOBER 2003
(3 Injured, Potential Offsite Consequences)
FIRST CHEMICAL CORPORATIONPASCAGOULA, MISSISSIPPI
OCTOBER 13, 2002
KEY ISSUESEVALUATION OF REACTIVE HAZARDS
APPLYING LESSONS LEARNED
LAYERS OF PROTECTION
WORK PRACTICES
FACILITY SITING
COMMUNITY NOTIFICATION
EXPLOSION AND FIRE
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD
-
2
-
3This investigation report examines an explosion and fire
thatoccurred on October 13, 2002, at the First ChemicalCorporation
facility in Pascagoula, Mississippi. The decompositionof
mononitrotoluene inside a distillation column resulted in a
runawayreaction and explosion, with potentially catastrophic
offsite conse-quences. This report identifies the root and
contributing causes ofthe incident and makes recommendations on
evaluating reactivehazards, applying lessons learned, layers of
protection, work prac-tices, facility siting, and community
notification.
The U.S. Chemical Safety and Hazard Investigation Board (CSB)
isan independent Federal agency whose mission is to ensure the
safetyof workers, the public, and the environment by investigating
andpreventing chemical incidents. CSB is a scientific investigative
organi-zation; it is not an enforcement or regulatory body.
Established bythe Clean Air Act Amendments of 1990, CSB is
responsible fordetermining the root and contributing causes of
accidents, issuingsafety recommendations, studying chemical safety
issues, andevaluating the effectiveness of other government
agencies involvedin chemical safety.
No part of the conclusions, findings, or recommendations of
CSBrelating to any chemical incident may be admitted as evidence
orused in any action or suit for damages arising out of any matter
men-tioned in an investigation report (see 42 U.S.C. 7412
[r][6][G]).CSB makes public its actions and decisions through
investigationreports, summary reports, safety bulletins, case
studies, incidentdigests, special technical publications, and
statistical reviews.More information about CSB may be found at
www.csb.gov.
Abstract
Information about availablepublications may be obtained by
contacting:U.S. Chemical Safety and Hazard
Investigation Board2175 K Street NW, Suite 400Washington, DC
20037-1848
(202) 261-7600
CSB publications may bepurchased from:
National TechnicalInformation Service
5285 Port Royal RoadSpringfield, VA 22161-0002
(800) 553-NTIS or(703) 487-4600
Email: [email protected]
For international orders, see:www.ntis.gov/support/
cooperat.htm.
For this report, refer to NTISnumber PB2004-101629
Salus Populi Est Lex SupremaPeoples Safety is the Highest
Law
-
4
-
5EXECUTIVE
SUMMARY............................................................
11
1.0 INTRODUCTION
.......................................................... 131.1
Background.......................................................................
131.2 Investigative Process
.......................................................... 141.3
First Chemical Pascagoula Facility
.................................... 14
1.3.1 Facility Description
............................................. 141.3.2 Proximity to
Other Industrial
Complexes and Residences ................................ 151.4
Mononitrotoluene Process
................................................ 16
1.4.1 Manufacturing and Refining ...............................
161.4.2 #1 MNT Distillation Column ............................
16
2.0 DESCRIPTION OF INCIDENT ....................................
192.1 Pre-Incident Events
........................................................... 192.2
Incident Description
.......................................................... 23
2.2.1 Day of Incident
................................................... 232.2.2 Area of
Impact and Potential Consequences ...... 242.2.3 Emergency Response
.......................................... 26
2.3 Reconstructive Analysis
..................................................... 262.3.1 Grid
Search ........................................................
262.3.2 Steam Control Stations
....................................... 272.3.3 Thermal Stability
Testing .................................... 292.3.4 Vessel
Integrity Testing ........................................ 33
3.0 ANALYSIS OF INCIDENT
............................................. 353.1 Reactive
Chemical Hazard Management ......................... 35
3.1.1 Background on Mononitrotoluenes....................
353.1.2 Hazard Evaluation for Batch Distillation
Project
.................................................................
353.1.3 Instrumentation for Batch Process ......................
373.1.4 Procedures for Batch Process ..............................
373.1.5 Good Management Practices .............................
383.1.6 Applying Lessons Learned ..................................
39
3.2 Monitoring and Instrumentation
....................................... 393.3 Safe Work Practices
.......................................................... 413.4
Maintenance Program and Equipment Integrity ............... 44
3.4.1 Steam Valves
....................................................... 443.4.2
Distillation Column .............................................
44
3.5 Overpressure Protection
................................................... 453.6 Control
Room Construction and Location ....................... 463.7
Process Information and Retention of Records .................
493.8 Community Notification System
....................................... 50
Contents
-
63.9 Review of Previous/Similar Incidents
................................ 513.9.1 Pascagoula Facility
.......................................... 513.9.2 Other Incidents
............................................... 51
3.10 Regulatory Analysis
...........................................................
543.10.1 Process Safety Management Standard ............ 543.10.2
Risk Management Program ............................. 553.10.3
Other Regulatory Standards ........................... 553.10.4
OSHA Investigation ........................................
563.10.5 Previous CSB Recommendations on
Reactive Chemicals .........................................
573.10.6 Additional Good Management Practices......... 58
4.0 ROOT AND CONTRIBUTING CAUSES .................... 614.1 Root
Causes
.....................................................................
614.2 Contributing Causes
........................................................ 63
5.0 RECOMMENDATIONS
................................................ 65
6.0 REFERENCES
................................................................
69
APPENDIX A: Causal Factors
Diagram....................................... 71
Contents (contd)
-
7Figures
1 Facility Overview
...............................................................
15
2 #1 MNT Distillation Column (C-501)and Related Equipment
..................................................... 21
3 Temperature at Column Bottoms,September 21October 13, 2002
..................................... 22
4 Aerial Map of FCC Facility
............................................... 25
5 Steam Line to Reboiler
...................................................... 27
6 Breach in Valve Seat for Bypass Line
................................. 28
7 DCS Readout of Steam Flow to ReboilerWhen System was Believed
to be Isolated ........................ 29
8 Mononitrotoluene Induction TimeTemperatureData on Linear
Scales ........................................................
31
9 Damage to Control Room Roof and Door ........................
47
Table
1 Condensed Event Timeline,September 7October 13, 2002
....................................... 19
Figures and Tables
-
8ACC American Chemistry Council
ANSI American National Standards Institute
API American Petroleum Institute
ARC Accelerating rate calorimeter
ASME American Society of Mechanical Engineers
C Degrees Celsius
CCPS Center for Chemical Process Safety
CFR Code of Federal Regulations
CSB U.S. Chemical Safety and Hazard Investigation Board
DBB Double block and bleed
DCS Distributed control system
DNT Dinitrotoluene
EPA U.S. Environmental Protection Agency
ESD Emergency shutdown
F Degrees Fahrenheit
FCC First Chemical Corporation
HSE Health and Safety Executive (United Kingdom)
IChemE Institution of Chemical Engineers (United Kingdom)
IEC International Electrotechnical Commission
ISA Instrument Society of America
LEPC Local emergency planning committee
meta-MNT Meta-mononitrotoluene
mmHg Millimeters of mercury
MNT Mononitrotoluene
MPC Mississippi Phosphates Corporation
MSDS Material safety data sheet
NFPA National Fire Protection Association
ortho-MNT Ortho-mononitrotoluene
Acronyms and Abbreviations
-
9OSHA Occupational Safety and Health Administration
para-MNT Para-mononitrotoluene
PHA Process hazard analysis
PNMC Para-nitrometacresol
psi Pounds per square inch
psig Pounds per square inch gage
PSM Process safety management (OSHA)
PSV Pressure safety valve
RMP Risk management program (EPA)
RP Recommended practice (API)
SIS Safety interlock system
SOCMA Synthetic Organic Chemical Manufacturers Association
TNT Trinitrotoluene
-
10
-
11
An explosion at the First Chemical Corporation (FCC) facilityin
Pascagoula, Mississippi, on October 13, 2002, propelledlarge
fragments of debris offsite, several of which landed nearcrude oil
storage tanks. The offsite consequences could have
beencatastrophic.
Steam leaking through manual valves heated mononitrotoluene(MNT)
inside a distillation column, which was shut down at the timeof the
incident and thought to be isolated. The column containedabout
1,200 gallons of MNT, a potentially highly energetic
reactivematerial when heated. The material decomposed over several
days,resulting in a runaway reaction and explosion.
Debris from the explosion caused a fire in an MNT storage tank
thatburned for almost 3 hours, and numerous smaller fires both
onsiteand offsite. Some of the debrisincluding one piece weighing
over6 tonslanded in an adjacent facility.
FCC emergency responders fought the onsite fires, while
localcommunity firefighters fought small fires along the public
roadway.The Jackson County Emergency Management Agency called
ashelter-in-place for the local community. FCC personnel began
airmonitoring; later that morning, the U.S. Environmental
ProtectionAgency (EPA) arrived onsite and also monitored air
quality.
The U.S. Chemical Safety and Hazard Investigation Board
(CSB)incident investigation revealed the following root causes:
The FCC Pascagoula facility did not have an adequate manage-ment
system for evaluating the hazards of processing MNT, anddid not
apply lessons learned from hazard analyses of similarprocesses in
the plant.
There was no system to ensure that the MNT column wasequipped
with sufficient layers of protection, including alarms,safety
interlocks, and overpressure protection.
The system for ensuring consistent work practices when
isolatingequipment was ineffective.
The program to ensure the integrity of isolation valves in
thesteam line connected to the MNT column was inadequate.
Executive Summary
An explosion at theFirst Chemical Corporation facility
in Pascagoula, Mississippi, onOctober 13, 2002, propelled
large
fragments of debris offsite,several of which landed near
crude oil storage tanks.
The column contained about1,200 gallons of MNT,
a potentially highly energeticreactive material when heated.
Some of the debrisincludingone piece weighing over 6 tons
landed in an adjacent facility.
-
12
CSB also determined that neither the construction of the
controlroom nor its proximity to the process was evaluated to
ensure thatemployees would be protected from catastrophic events.
Likewise,the system for notifying the surrounding community about
chemicalreleases or other hazardous incidents was inadequate to
ensure thatlocal residents were informed and knew what steps to
take.
CSB makes recommendations to E. I. du Pont de Nemours andCompany
(which acquired the facility in November 2002); thePascagoula
facility; Jackson County, Mississippi; the American Chem-istry
Council (ACC); and the Synthetic Organic Chemical Manufac-turers
Association (SOCMA).
-
13
1.1 Background
The rupture of a 145-foot-tall distillation column (C-501)1
usedto refine mononitrotoluene (MNT) caused the October 13,2002,
explosion and fire at the First Chemical Corporation (FCC)facility
in Pascagoula, Mississippi. The column was thought to beisolated
and in standby mode at the time of the explosionapproxi-mately 5:25
amthough it contained a significant amount of MNT.
Debris from the explosion, including metal fragments and
packing2
from the column, was scattered throughout the facility and
propelledoffsite. One large fragment of the distillation column
punctured anearby para-MNT storage tank and ignited its contents,
which burnedfor almost 3 hours. A 6-ton column segment was hurled
1,100 feetand landed near a crude oil storage tank at a refinery
across thehighway. Flying glass injured three FCC employees, who
were in theunit control room at the time of the explosion. All
three employeesreceived first-aid, and one required additional
medical treatment.3
The FCC fire brigade fought the onsite fires, including the
largepara-MNT storage tank fire and numerous fires initiated by
burningmaterial on ejected column packing. Local community
emergencyresponders provided backup and firefighting support for
numeroussmall fires outside the facility. The sheriff s department
providedtraffic control. FCC personnel, the U.S. Environmental
ProtectionAgency (EPA), and the U.S. Coast Guard monitored the air
aroundthe facility.
Because this incident had potentially significant offsite
impacts andlikely involved a reactive material, the U.S. Chemical
Safety andHazard Investigation Board (CSB) launched an
investigation to deter-mine the root and contributing causes, and
to issue recommendationsto help prevent similar occurrences.
Introduction
1The #1 MNT still (C-501) was referred to as both the still and
the column.These terms are used interchangeably throughout this
report.2Packing material was removable stainless-steel grating
inside the column used to aid inthe distillation process.3This
treatment was for an Occupational Safety and Health Administration
(OSHA)-recordable injury.
The rupture of a 145-foot-talldistillation column used to
refine
mononitrotoluene causedthe October 13, 2002, explosion andfire
at the First Chemical Corporation
facility in Pascagoula, Mississippi.
The column was thought to beisolated and in standby mode at
the
time of the explosionapproximately5:25 amthough it containeda
significant amount of MNT.
A 6-ton column segment was hurled1,100 feet and landed near
a crude oil storage tank at a refineryacross the highway.
-
14
1.2 InvestigativeIn conducting its independent investigation,
CSB examined physicalevidence, interviewed current and former FCC
employees, andreviewed company documents and scientific literature.
CSB investiga-tors visited neighboring companies, including Chevron
and MississippiPhosphates Corporation (MPC), and surveyed the
surrounding area inan effort to collect debris from the explosion.
CSB contracted fortesting of chemical samples and piping
components, and also consultedwith experts in the process and
chemistry used at FCC. A communitymeeting was held on January 15,
2003, to gather information aboutthe incident from local residents
and interested parties.
1.3 First Chemical
1.3.1 Facility Description
FCC is located on a 60-acre parcel east of Pascagoula,
Mississippi,in the Bayou Cassotte Industrial Park. At the time of
the incident,ChemFirst Inc., of Jackson, Mississippia member of the
SyntheticOrganic Chemical Manufacturers Association (SOCMA)ownedthe
facility. The plant employed 137 people and eight
full-timecontractors.
E. I. du Pont de Nemours and Company (DuPont) was in the
pro-cess of purchasing the FCC facility at the time of the incident
anddelayed the acquisition to review the consequent damage.
DuPontofficially acquired ChemFirst Inc. (the parent company of
FCC) onNovember 6, 2002.
The facility is a major producer of aniline4 and nitrotoluene
interme-diates and derivatives used in a variety of industries. It
is one of thelargest producers of aniline, and the worlds second
largest and onlyU.S. producer of nitrotoluenes.
4Aniline is an oily liquid from the aromatic amine family of
chemicals, with the chemicalformula C6H5NH2.
Pascagoula Facility
Process
The facility is a major producer ofaniline and nitrotoluene
intermediatesand derivatives used in a varietyof industries.
-
15
Figure 1. Facility overview.(Note: The crane is attached to the
column damaged
in the explosion.)
Large bulk storage tanks for raw materials and finished
products,warehouses and maintenance areas, control rooms and other
officefacilities, and the main office complex are located onsite
(Figure 1).One building near the ruptured column housed the process
areacontrol room, locker room, offices, and a quality control
laboratory.
1.3.2 Proximity to Other IndustrialComplexes and Residences
The FCC facility is bordered by the following:
To the south, MPC, a fertilizer manufacturerA large ammo-nia
storage tank is located onsite; in addition, MPC also ownsa large
gypsum pile north of FCC.
-
16
To the east, a Chevron refinerySeveral crude oil storage
tanksare located approximately 500 feet from the FCC property
line.A highway and a rail spur are also located to the east of
FCC.
To the west, 0.25 mile, the Bayou Cassotte, a shipping route
forbusinessesA residential area is located to the west of
thebayou.
1.4 Mononitrotoluene
1.4.1 Manufacturing and Refining
MNT is used in the production of dyes, rubber chemicals, and
agricul-tural chemicals. It is an aromatic5 nitro compound that is
made byreacting toluene with nitrating acid, typically a
combination of nitricand sulfuric acids. At the conclusion of the
nitration reaction, theproductat this point consisting of MNT,
residual acid, toluene, andwateris sent to a separator, where the
spent acid is concentratedand recycled. The rest of the product
goes through a washing stepand then flows to a toluene stripper to
remove residual toluene. Theresultant purified MNT liquid flows to
a three-column distillation unitto separate the three isomers6 of
MNTortho-, meta-, and para-MNT.
1.4.2 #1 MNT Distillation Column
The vessel involved in the explosion, the #1 MNT
distillationcolumn (C-501), was the first of three distillation
columns in the unit.It was 7 feet in diameter and approximately 145
feet tall.
5An aromatic compound contains six carbon atoms that are
interconnected, sometimesreferred to as a benzene ring.6An isomer
is two or more chemical compounds having the same atoms in the
sameproportion but differing in properties because of differences
in molecular structure.There are three isomers of MNT.
Process
MNT is used in the productionof dyes, rubber chemicals,
andagricultural chemicals.
The . . . purified MNT liquid flowsto a three-column
distillation unitto separate the three isomersof MNTortho-,
meta-,and para-MNT.
-
17
During normal operation, the column ran under vacuum to
facilitatethe separation process. Temperatures ranged from around
350degrees Fahrenheit (F) at the bottom of the column to near
ambientat the top. Two steam-heated reboilers7 supplied heat. Eight
tem-perature indicators were positioned throughout the column,
thoughthey were not equipped with alarms.
A pump removed material from the bottom of the column
(predomi-nantly para- and meta-MNT), which was sent to a second
distillationcolumn for separation of the isomers. This material
might also becirculated back to C-501. A reflux pump removed liquid
(predomi-nantly ortho-MNT) from the top collector tray; the liquid
flowedthrough a cooler and was either sent to storage or returned
to thetop of the column. The column was filled with stainless-steel
packingmaterial to aid in the distillation process.
The facility central steam plant provides
300-pounds-per-square-inch-gage (psig) steam to the reboilers. The
steam line to eachreboiler is a 3-inch line with inlet and outlet
manual block valves anda flow control valve in series. A bypass
line around the control valvecontains a manual block valve.
7A reboiler for a distillation column is a heat exchanger that
generally has processmaterial flowing through one side and a
heating medium, such as steam, flowingthrough the other side. When
steam is used, it heats the process materialwhich,in turn, warms
the material in the bottom of the vessel, causing the components
withlower boiling points to vaporize.
-
18
-
19
2.1 Pre-Incident Events
Five weeks before the incident, on September 5, 2002,
thePascagoula FCC facility experienced problems with the
sulfuricacid concentrator upstream of the MNT unit. FCC decided to
shutoff the feed to the MNT distillation columns, including the #1
MNTcolumn (C-501), on September 7 (Table 1).
2.0 Description of Incident
8Total reflux means that steam continued to be fed to the
reboilers, but no fresh feedflowed to the column. Although material
was continuously recycled through thecolumn, no product was removed
and sent to storage.
C-501 contained approximately 1,200 gallons of MNT at the
time;the column was left on total reflux.8 Due to low product
demand, thedecision was made not to start up the columns in the MNT
unit untilwork associated with the plant-wide shutdown (scheduled
for earlyOctober) was completed. The 1,200 gallons remained
inventoried inthe column, and the manual valves remained closed.
There was nofollowup audit of isolation of the column prior to
commencing thelonger term shutdown.
Table 1Condensed Event Timeline, September 7October 13, 2002
Date (2002) Event
Sept 7 Feed to distillation columnshut down; column left on
total reflux
Sept 22 Fire in hydrogen unit;steam isolation valves closed
Sept 27 Vacuum broken on distillation column
Sept 29 Entire facility shut down formaintenance turnaround
Oct 5 Plant boilers brought back online
Oct 513 Temperature steadily increases atcolumn bottom
Oct 13 Distillation column wall breached;seconds later, at 5:25
am, columnruptures
FCC . . . shut off the feed to theMNT distillation columns,
including
the #1 MNT column (C-501),on September 7. C-501 contained
approximately 1,200 gallonsof MNT at the time.
-
20
It was believed that the September 22 fire in the #2 hydrogen
unitcould have affected steam production for the facility.
Operatorsquickly attempted to isolate the heat sources to columns
that werenot considered priority at the time, such as columns on
reflux (includ-ing C-501). For both steam stations, operators
closed the manualvalve to the reboilers, downstream of the control
valve (shown asvalve 2 in Figure 2). The manual valve in the bypass
line (valve 1)was normally left in the closed position. The
distributed controlsystem9 (DCS) sent a signal to the control valve
(valve 3) to close.
For the next 5 days, the valves on the steam line remained
closed;however, DCS information reviewed after the incident
indicates thatthe temperature in the base of the column did not
fall below 300F.The temperature would have been expected to
decrease to aroundambient if no heat was being added.
On September 27, in preparation for maintenance on the
refluxcooler, unit operators broke the vacuum in C-501 (i.e.,
pressurizedthe column) by injecting nitrogen into the system.
Nitrogen feed wasprovided through a tubing connection to the top
head vapor dischargeline. Because the pressure gauge measured only
the degree of vacuumon the column and had a range of 0 to 200
millimeters mercury(mmHg), there were no data to verify that the
vacuum was fullybroken.10
Operations personnel did not actively monitor the
temperature.Figure 3 shows a chart of the DCS data for the bottom
twotemperature indicators.
9A distributed control system is an automated system used to
control and monitor achemical process.10Failure to fully break the
vacuum in the column likely led to air being introduced,which was
not subsequently purged. The presence of air can increase the
reaction rateof MNT, as discussed in Section 3.0.
It was believed that the September 22fire in the #2 hydrogen
unit couldhave affected steam productionfor the facility.
For the next 5 days, the valves on thesteam line remained
closed; however,. . . the temperature in the base of thecolumn did
not fall below 300F.The temperature would have beenexpected to
decrease to aroundambient if no heat was being added.
Operations personnel did not activelymonitor the
temperature.
-
21
Figure 2. #1 MNT distillation column (C-501) and related
equipment.
Valve Key
Bypass valve
Outlet blockvalve
Flow controlvalve
Inlet block valve
Steam stationsare identical
1
1
O-MNT tostorage
CWS CWR
Internal(chimney)
tray
#1 MNTcolumn(C-501)
Shell andtube
reboiler
P/M-MNTto storage/
C-502
Reliefvalve
To collection tank
To steam eductors
300 # steamsupply
FIC
Flowcontroller
234
Refluxpump
Refluxcooler
2
3
4
*
*
Normalliquid level
Shell andtube
reboiler
-
22
(Note: Thermocouple TT-5037 [the top line shown for 10/11/2002]
was atthe bottom of the vessel, and TT-5039 was above the reboiler
inlet line.)
Figure 3. Temperature at column bottoms, September 21October 13,
2002.
On September 29, the plant steam boilers were shut down
forscheduled maintenance. The temperature in C-501 cooled to
nearambient. Power was lost to DCS on October 1 and restored
thenext day; the hard drive on the control system was lost on
October 3and restored the following day. No DCS data are available
for thesetimes.
Maintenance on the boilers was completed on October 5, and
thesystem was brought back online. The temperature of the material
inthe bottom of the column increased to approximately 415F by
mid-morning.
Column bottoms temperatures 9-21 through 10-13
0
200
400
600
800
1000
1200
1400
9/16/02 9/21/02 9/26/02 10/1/02 10/6/02 10/11/02 10/16/02
Date
Tem
p (F
)
TT5037
TT5039
-
23
2.2 Incident
2.2.1 Day of Incident
The temperature of the material in the #1 MNT column
(C-501)continued to rise following the boiler startup on October 5,
until itreached over 450F on the morning of October 13. There is
noevidence that the temperature was being monitored by
operations.11
The higher temperature at the base of the column likely
vaporizedsome material, which was carried up the column and
accumulatedon the chimney tray at the top. On the morning of
October 12, ahigh-level alarm for the tray actuated; it was
silenced by the operator,but no further action was taken.
Early on October 13, an operator in the area of C-501
heardrumbling, which was followed by an increasingly loud sound
de-scribed as being similar to a relief valve venting.12 Operators
in thearea noticed material venting at a high velocity from an
apparenthorizontal breach in the upper half of the column; it was
described assmoke or steam or snow. One eyewitness described the
material asblowing to the east, toward the Chevron facility.
One operator left the control room to investigate and quickly
deter-mined that the only safe action was to return. He instructed
twoother operators to stay inside the control room, which was
locatedonly about 50 feet from the base of the column.
According to eyewitness testimony, a few seconds to minutes
later,the column ruptured. The force of the explosion knocked down
thethree operators who were standing just inside the control room
door;they received cuts and abrasions from shattering glass. One
operatorsaid he saw a fireball move past the door.
The explosion propelled the top 35 feet of C-501both the
vesselhead and approximately 30 feet of the cylindrical
shelloffsite. Allthe structured packing inside the column was
ejected, and burning
Description
11No alarms were associated with the temperature
indicators.12CSB examined the relief valve and downstream tank
after the incident and determinedthat the valve did not open.
The temperature of the material inC-501 continued to rise
following
the boiler startup on October 5,until it reached over 450F
on the morning of October 13.
The explosion propelled the top35 feet of C-501both the
vessel
head and approximately 30 feetof the cylindrical
shelloffsite.
-
24
residue on the packing material inside the column was also blown
outand offsite. A large column sidewall fragment hit a storage
tankapproximately 500 feet away, resulting in a fire in and around
thevessel. The tank held more than 2 million pounds of para-MNT.The
cooling tower for the unit was also struck by debris and
caughtfire.
The pressure of the explosion damaged a number of buildings
onsite,including the control room. Almost all of the acoustical
drop ceilingsin the control room and adjacent laboratories and
breakroomscollapsed. The roof was extensively damaged, cinderblock
wallswere cracked and distorted, and the exterior doors were
buckledand glass broken. An administration building located over
400 feetfrom C-501 was significantly damaged, including impact from
a pieceof shrapnel that punctured the cinderblock wall adjacent to
an office.Roll-up doors and corrugated siding on a number of
additional steel-frame construction buildings were damaged.
2.2.2 Area of Impact andPotential Consequences
The explosion propelled large fragments from the vicinity of
thecolumn. A piece of shrapnel struck a pipe rack directly above
a500,000-pound anhydrous ammonia tank onsite. A 6-ton piece
ofcolumn sidewall was hurled approximately 1,100 feet onto
Chevronproperty; it landed an estimated 50 feet from a
250,000-barrel crudeoil storage tank. A valve and portions of
piping were also found onChevron property as much as 1,700 feet
from the column.
Within this radius of potential impact were several pieces of
equip-ment that contained flammable and toxic material, including
tanksand piping. As previously discussed, a crude MNT storage tank
atFCC (which contained para-MNT) was hit by shrapnel and
caughtfire. There were a number of other potential receptors,
includingchlorine cylinders and sulfuric acid tanks. If debris had
hit thisequipment, it is likely that the incident would have caused
significantsecondary releases of material. (See Figure 4 for an
aerial map ofFCC and the surrounding area.)
A large column sidewall fragment hita storage tank approximately
500 feetaway, resulting in a fire in and aroundthe vessel. The tank
held more than2 million pounds of para-MNT.
A piece of shrapnel struck a pipe rackdirectly above a
500,000-poundanhydrous ammonia tank onsite.A 6-ton piece of column
sidewallwas hurled approximately 1,100 feetonto Chevron
property.
-
25
Figure 4. Aerial map of FCC facility.(Circle shows an
approximate 2,000-foot radius from
the #1 MNT column [C-501], the area of the debris search.)
First Chemical
MPCChevron
#1 MNT column(C-501)
-
26
2.2.3 Emergency Response
Following the explosion, the operators gathered and accounted
foreach employee. They then used water monitors and other
firefightingequipment to put out the small fires caused by burning
debris. Localfirefighters extinguished fires along the public
highway. The largestfire was in the para-MNT storage tank. All
fires were extinguishedby 8:30 am on October 13.
Wind blew the black smoke from the facility in an easterly
andsoutheasterly direction over Chevron property and the Gulf of
Mexico.The Jackson County Emergency Management Agency called a
shelter-in-place13 for nearby residents, and a no-fly zone was
established for1 mile around the facility.
2.3 ReconstructiveTo assist in determining the causes of the
explosion in the #1 MNTcolumn (C-501), the CSB investigation team
analyzed various aspectsof the explosion and factors leading up to
it. CSB commissioned ageographic grid search for pieces of the
vessel, and also tested thesteam control stations and chemical
samples.
2.3.1 Grid Search
FCC contracted out the initial search for explosion debris.
Thecontractor found light fragments (e.g., aluminum packing and
strap-ping) mainly to the south and east, up to 0.7 mile from the
facility; aportion of this material landed on a Chevron storage
tank due southof the column.
Heavy fragments were concentrated mainly in a large storage
tankfarm to the east, also on Chevron property. The largest piece
ofdebris was a section of the top of the column, which weighed
13A shelter-in-place is called to minimize potential exposure to
chemicals. The stepsinclude going inside a secure enclosure such as
a house, closing all windows and doors,turning off ventilating
equipment to prevent chemical ingress, and monitoring
localtelevision or radio stations for further instructions.
Analysis
The Jackson County EmergencyManagement Agency called a
shelter-in-place for nearby residents, anda no-fly zone was
established for1 mile around the facility.
-
27
approximately 13,500 pounds. It was found about 1,100 feet
fromthe base of C-501. The 7-foot-diameter head of the column
wasnot found during these searches.
In November, FCC again used the contractor for a search of
twocooling water ponds located on Chevron property.
Magnetometerswere used; the head of the column was not found,
though severalother large pieces were recovered. Among the items
were a largesection of grating, a 4-foot-long section of 1-inch
piping, and twovalvesone weighing 50 to 60 pounds.
In an effort to locate additional physical evidence, including
the headof the column, CSB investigators searched a used equipment
area onMPC property in December. CSB also commissioned a contractor
tosearch areas not covered previously within a 2,000-foot radius of
thecolumn. The entire search area covered over 81 acres.14
2.3.2 Steam Control Stations
CSB examined the means by which heat could have been applied
tothe MNT that remained in C-501 after it was shut down.
Separatesupply lines carried steam to the two reboilers at the base
of thecolumn. Manual valves downstream of the control valves in
bothlines and both bypass lines were closed on September 22, as
con-firmed by log entries, interviews, and the as-found position of
thevalves. In addition, the flow control valves had been
commandedclosed from DCS. CSB tested both valve stations to
determine if theyhad leaked and the likely cause. Each station
consisted of four valves,as shown in Figure 5.
CSB contracted to have the steam stations tested in the
as-foundcondition of the valves to determine leak rate. Test data
showed thatthe manual valve in the bypass line for one of the
stations was leakingsignificantly, over 180 pounds/hour. Corrosion
and erosion caused abreach in the valve; and the steam flow caused
holes to form in theseat of the valve, one of which is shown in
Figure 6.
14The column head and other associated debris were never
located.
Figure 5. Steam line to reboiler.(The numbered valves
represent:[1] manual valve in bypass line,
[2] outlet block valve, [3] automaticflow control valve, and[4]
inlet block valve.)
CSB examined the means by whichheat could have been applied
to the MNT that remained in C-501after it was shut down.
4
2
3
1
-
28
Examination of the other steam station indicated that it leaked
as well.Although the manual valve in the bypass line (i.e., valve 1
in Figures2 and 5) did not appear to leak, the facing on the outlet
block valve(downstream of the flow control valve) was severely
scored fromcorrosion products and debris in the system. Because the
flowcontrol valve was not intended to be a tight shut-off valve, it
is likelythat steam leaked through the main branch.
Based on examination of the outlet-blocking valve for that
station(i.e., valve 2), it is believed that debris and particulates
may haveprevented the valve from seating properly. The steam system
wasmoistmeaning that it contained liquid as well as steam vapor,
whichcontributed to additional erosion and corrosion of the piping
system.
These results verify that steam likely leaked through manual
valvesand continued to heat material in C-501, even though the
valveswere in the closed position. These findings are consistent
with DCSdata, which indicate that there was flow through the line
when thevalves were closed and believed to be isolating the steam
source fromC-501 (Figure 7).
DCS data, though exhibiting an erratic pattern, indicate even
higherflow rates than were found during CSB testing. Although the
regis-tered flow rates indicated in the DCS data may not be
correct, theyillustrate that flow was occurring in the system at a
time when thecolumn was believed to be isolated.
Figure 6. Breach in valve seat for bypass line.
[Test] results verify that steam likelyleaked through manual
valves andcontinued to heat material in C-501,even though the
valves werein the closed position.
-
29
2.3.3 Thermal Stability Testing
The chemistry of nitrotoluenes has been studied for a number
ofyears. Nitrotoluenes may decompose when exposed to high
tem-peratures instantly or to elevated temperatures for an extended
time.The decomposition mechanism generates gases, which can
buildpressure if the material is confined.
C-501 was shut down with 1,200 gallons of material in the
baseand exposed to heat for an extended time. CSB investigators
theo-rized that a thermal decomposition of MNT caused the
explosion.
To verify this theory, CSB arranged for testing of fresh MNT
samplescollected upstream of C-501. (Because of the incident, there
was no
Figure 7. DCS readout of steam flow to reboiler when system was
believed to be isolated.
Nitrotoluenes may decompose whenexposed to high temperatures
instantly or to elevated temperaturesfor an extended time.
C-501 was shut down with 1,200gallons of material in the base
and
exposed to heat for an extended time.CSB investigators theorized
that athermal decomposition of MNT
caused the explosion.
0
200
400
600
800
1000
1200
1400
1600
1800
10/4/02 10/5/02 10/6/02 10/7/02 10/8/02 10/9/02 10/10/02
10/11/02 10/12/02 10/13/02 10/14/02
Date
Flow
(pou
nds/
hour
)
Flow in FV505A
Flow in FV505B
-
30
material to sample in the column itself.) The feedstock
samplescontained all three isomers of MNT. They were representative
ofthe MNT that would be expected to be in the column, except
thatthey contained approximately 3 percent toluene, which would
havebeen removed from the feedstock by the toluene stripper prior
toentering C-501. Because of the low amount of toluene present,
thesamples were tested as received. No other contaminants were
foundin the samples.
Adiabatic calorimetry testing was conducted on the samples.15
Theinitial test used the heat-wait-search method, in which the
sampletemperature is increased until reaching an exotherm, after
which thesample is allowed to self-heat under adiabatic conditions.
This testwas used to determine the temperature at which
decompositionbegins. The MNT sample showed an exotherm beginning at
273degrees Celsius (C [523F]), with maximum rates of temperature
andpressure rise of 1,500C/min and 100 bar/min.
The adiabatic calorimeter was also used to perform induction
time16
measurements between 240 and 265C (464 and 509F). Thevalues were
extrapolated to estimate the induction times underconditions
similar to those at FCC.
Between 415 and 454Froughly the temperature range of MNTcolumn
bottoms during several days prior to the explosiontheinduction time
for self-heating would have decreased from about 35days to just
over 1 day, respectively, as shown in Figure 8. Thecolumn bottoms
temperature was measured at 454F a few hoursbefore the explosion.
Thus, the induction data are consistent with aself-heating
reaction.
15Adiabatic calorimetry is a chemical testing technique that
determines the self-heatingrate and pressure data of a chemical
under near-adiabatic conditions. (Adiabatic refersto any change in
which there is no gain or loss of heat to the environment.)
Thismeasurement technique estimates the conditions for, and
consequences of, a runawaychemical reaction.16Induction time is the
amount of time that a material must be held at a certain
tempera-ture before an exotherm (in this case, a decomposition) is
observed. Materials maydecompose if they are exposed to their onset
temperature (lowest temperature atwhich decomposition activity is
observed), or if they are held at an elevated (but
lower)temperature for an extended time.
Between 415 and 454Froughlythe temperature range of MNTcolumn
bottoms during several daysprior to the explosionthe inductiontime
for self-heating would havedecreased from about 35 days to justover
1 day, respectively.
The induction data are consistentwith a self-heating
reaction.
-
31
Figure 8. Mononitrotoluene induction timetemperature dataon
linear scales.
These results are consistent with information found in
literatureconcerning the decomposition of MNT. In a paper presented
at anInstitution of Chemical Engineers (IChemE) symposium, the
authorsnote that a number of incidents occurred when MNT was heated
toexcessively high temperatures or held at more moderate
temperaturesfor an extended time (Harris, Harrison, and MacDermott,
1981).The latter phenomenon is referred to as the induction effect.
Forlarge batches of material (on the order of the amount in C-501
priorto the incident) that are exposed to temperatures between 401
and419F, a violent decomposition will occur within 8 to 25 days.
Thisis consistent with conditions at FCC prior to the incident.
In a Journal of Loss Prevention Process Industries article, Chen
andChai-Wei (1996) note that the decomposition of MNT occurs intwo
phases. Phase one is a slower self-heating initiated at 284F,
andphase two is an accelerated self-heating initiated at 392F.
For large batches of [MNT]. . .that are exposed to
temperatures
between 401 and 419F, a violentdecomposition will occur
within 8 to 25 days.
0
10
20
30
40
400 425 450 475 500
Temperature, F
Indu
ctio
n Ti
me,
day
s
-
32
As part of its investigation of the incident, DuPont also
considered thepossibility of an additional decomposition that
involved material on aninternal tray toward the top of the column.
The material was thoughtto be mostly ortho-MNT because it had a
lower boiling temperatureand was the isomer most likely to
accumulate in the upper part of thevessel. According to DCS data,
the tray lost its contents within a matterof seconds just before
the explosion. DuPont attributed this loss to thetray being damaged
by a pressure impulse due to decomposition in thebase of the
column.
The predominantly ortho-MNT contacted fouling residue when
itspilled onto the packing below. DuPont tested the solids in
theresiduewhich contained enamine, azo, and azoxy
groupsanddetermined that they significantly lowered the onset
decompositiontemperature. The presence of air in the column, as
well as pressure,was also determined to make the material more
reactive.
DuPont determined that the following factors contributed to
asecondary decomposition in the top part of C-501:
The MNT on the top tray was the more reactive isomer,
ortho-MNT.
The presence of solids on the packing lowered the
onsettemperature of decomposition.
Air was introduced into the column during maintenance work.
The column was kept under pressure rather than being keptunder
vacuum after maintenance.
As part of its independent investigation, CSB reviewed the
results ofthe DuPont investigation. Additional evidence in
literature suggeststhat the factors present could have caused a
more energetic reaction.In his book Distillation Operation, Kister
(1990) notes a previousincident in which MNT was held at 150F and
air was introduced.A previously unknown exotherm set in, causing an
explosion. Duh etal. (1997) note that ortho-MNT is more unstable
than the otherisomers, as represented by a lower onset temperature
and a higherheat of reaction. Although it cannot be stated
conclusively that asecondary explosion occurred in the top of
C-501, it is a plausibleexplanation for the burst of energy that
separated the vessel. (Seethe causal factors diagram in Appendix
A.)
DuPont tested the solids in the[fouling] residue . . . and
determinedthat they significantly lowered theonset decomposition
temperature.The presence of air in the column, aswell as pressure,
was also determinedto make the material more reactive.
Although it cannot be statedconclusively that a
secondaryexplosion occurred in the top ofC-501, it is a plausible
explanationfor the burst of energy that separatedthe vessel.
-
33
2.3.4 Vessel Integrity Testing
To determine if thinning of the column wall may have been a
causalfactor in the incident, CSB investigators examined the upper
portions ofC-501 and found that the metal had thinned to only 30
percent of itsoriginal thicknessmost likely due to external
corrosion under theinsulation. This finding raised the possibility
that vessel integrity was afactor in the incident.
The design drawing17 and nameplate for C-501 show the
designpressure as 15 pounds per square inch (psi).18 When
thermalstability testing was performed, the pressure in the test
chamberreached approximately 240 psi before the testing equipment
shutdown, indicating that the pressure in the vessel likely
exceeded thisvalue.
The thermal stability testing contractor calculated that the
ultimatepressure generated inside C-501 due to decomposition could
havebeen as high as 3,800 psi. Even if the vessel wall was not
thinned,the column could not have withstood this pressure. CSB
concludedthat the vessel would eventually have ruptured even if
there was nodegradation of wall thickness.
17MNT Tower (AS-501) Aniline Plant, First Chemical Corporation,
Pascagoula,Mississippi, Dwg. No. E1552-305A.18The design pressure
for vessels generally includes a safety factor. A vessel is
expectedto withstand a somewhat higher pressure than design before
failing.
The thermal stability testing contractorcalculated that the
ultimate pressure
generated inside C-501 due todecomposition could have been
as high as 3,800 psi.
CSB concluded that the vesselwould eventually have rupturedeven
if there was no degradation
of wall thickness.
-
34
-
35
Among the factors contributing to the incident at FCC are
thefollowing: Inadequate understanding of the potential hazard of
thermal
decomposition in continuous processing equipment.
Insufficient instrumentation to allow monitoring and control
ofthe process to prevent a catastrophic release.
Lack of a system to ensure isolation of heat sources.
Inadequate preventive maintenance, which allowed leaks
inisolation valves.
The consequences of this incident were also exacerbated
byinadequate evaluation of the location and structure of the
controlroom, and poor community notification.
3.1 Reactive Chemical
3.1.1 Background onMononitrotoluenes
The distillation column involved in the October 13 incident
(C-501)separated three different isomers of MNT. Bretherick (1999)
notesthat explosions have occurred during fractional distillation
to separatemixed nitrotoluene isomers when they were excessively
heated orwhen materials were held at more moderate temperatures for
anextended time. MNT may decompose explosively if heated above190C
(374F; Lewis, 1996).
3.1.2 Hazard Evaluation forBatch Distillation Project
The isomers of MNT can be separated by either batch or
continu-ous distillation. C-501 was part of a continuous process
(i.e., MNTfeedstock was continuously sent to it, and it was
continually heated toseparate the lower boiling material from the
other isomers).
3.0 Analysis of Incident
Hazard Management
The isomers of MNT can beseparated by either batch or
continuous distillation. C-501 waspart of a continuous
process.
-
36
FCC personnel considered MNT to be stable when it was
separatedin the continuously operating stills. They could not
recall any previ-ous incidents in which the temperature or pressure
had rapidlyincreased in the MNT stills.
In 1996, the Pascagoula facility decided to perform additional
MNTisomer separation using a column that was already onsite
(AS-310).The separation took place using batch technology, where a
specificvolume of material is pumped into the column in batches and
thenheated to the desired temperature until the appropriate amount
ofortho-MNT is distilled. This batch distillation process involved
alarger inventory of material than the continuous process and had
notbeen performed previously at the site.
FCC performed a process hazard analysis (PHA) of the equipment
inthe batch process in March 1996. The PHA included
literaturesearches on the thermal stability of MNT, as well as data
fromprevious incidents involving the material. As a result of this
effort,operating limits were added to the procedures, and
recommenda-tions were implemented that resulted in additional
safeguards beingadded to the batch vessel.
According to at least one data source documented in e-mails
andinteroffice memoranda, a safe distillation temperature was no
morethan 374F (190C). It was noted that this value agreed
withaccelerating rate calorimeter (ARC)19 work performed on behalf
ofFCC, where an onset of an exotherm20 was detected around 365Ffor
the material that would be charged to the batch still. The
safeconditions under which to operate the still were set at
-
37
100F. However, one of the laboratories presented the
followingcaution in its report:
. . . Lengthy exposure to high temperature, even below
theexotherm detection point, can influence the behavior.
Thesechemicals may therefore undergo decomposition at
lowertemperatures than those found in this study depending on
theirprevious exposure history. (Italics added for emphasis.)
3.1.3 Instrumentationfor Batch Process
In April 1996, a list was developed to ensure that the PHA
recommen-dations were addressed prior to startup of the batch
distillation. One ofthe recommendations was the addition of an
interlock to stop the flowof the heating medium (i.e., hot oil) to
the reboiler if the temperature inthe column was too high. The
column also contained an interlock thatstopped hot oil flow to the
reboiler if the pressure in the vessel was toohigh (i.e.,
represented by a loss of vacuum).
3.1.4 Proceduresfor Batch Process
The procedures for performing distillation on the batch
column(AS-310) contained notes under a section called Safety
Items.Among these notes were the following:
Any time the still pot bottoms temperature exceeds 400degrees F
shut down the hot oil flow and closely monitor thebottoms
temperature.
For operations personnel:
Do not allow the temperature in the still pot to exceed395F for
more than 1 hour due to product breakdown.
Do not allow the heat to stay on the still pot if the
desiredvacuum is not available!
One of the recommendations wasthe addition of an interlock to
stop
the flow of the heating medium(i.e., hot oil) to the
reboiler
if the temperature in the columnwas too high.
-
38
3.1.5 Good Management Practices
Managing chemical reactivity is a core competency of the
chemicalindustry. The Center for Chemical Process Safety recently
publishedEssential Practices for Managing Chemical Reactivity
Hazards (CCPS,2003). Although the design and operation of the MNT
batch andcontinuous units at FCC predate this publication, many of
the stepstaken in the batch distillation of MNT were consistent
with CCPSguidance and demonstrate the degree of diligence in place
duringprocess development.
However, there was no system to apply evaluation results from
thebatch process to continuous processing equipment. No
hazardanalysis system was in place for the continuous MNT
distillationcolumns becausein this older, ongoing production
processthepotential hazards were not fully recognized.
Good management practices recommended by CCPS includecollecting,
identifying, and testing for chemical reactivity hazards;assessing
reactivity risks; identifying controls and management options;and
reviewing and auditing the program. The FCC literature
searchfocused on thermal stability; additional testing to confirm
stability;conducting a PHA to evaluate risks; addressing
recommendations,including adding interlocks to stop heat input
based on high tempera-ture; and having explicit warnings in
operating proceduresallcritical items in an effective program.
At the time of the incident, there was no high temperature
interlockin place to shut off the heat source to the continuous MNT
column(C-501), similar to the one that had been added to the
AS-310column. Also, the operating procedures for C-501 did not
empha-size the cautions that were listed in the AS-310
procedures.
C-501 processed a lesser volume of material than the batch
columnand had a successful operating history. Because of these
factors,FCC took a different approach in hazard evaluation of the
twoprocesses and did not do a formal hazard evaluation of
C-501.However, the operating practices associated with
C-501includingleaving material in the column when the unit was shut
down and notverifying positive isolation of the heat sourcemade the
conditions inthe vessel at the time of the incident similar to
those in the batchcolumn.
. . . Many of the steps takenin the batch distillation of
MNTwere consistent with CCPS guidance. . . However, there was no
systemto apply evaluation results fromthe batch process to
continuousprocessing equipment.
At the time of the incident, there wasno high temperature
interlock in placeto shut off the heat source to thecontinuous MNT
column (C-501),similar to the one that had been addedto the AS-310
column.
The operating practices associatedwith C-501including
leavingmaterial in the column when the unitwas shut down and not
verifyingpositive isolation of the heat sourcemade the conditions
in the vesselat the time of the incident similar tothose in the
batch column.
-
39
3.1.6 Applying Lessons Learned
CCPS (2003) notes that:
Multiple facilities in an organization may have similar
chemicalreactivity hazards . . . or use similar technology to
control theassociated hazards. If so, it may be more efficient for
a corpo-rate office or personnel to assume responsibility for
someimprovement activities . . . This can also facilitate
communica-tion of incidents and best practices between
facilities.
Although this comment focuses on sharing best practices
amongdifferent facilities, it also applies to different units or
processes at thesame facility.
The MNT continuous unit processed the same material as the
batchunit. If FCC had a program in place to proactively identify
hazards inthe continuous unit, or broadly applied knowledge
acquired duringhazard review of the batch unit, it is likely that
additional hardwareand administrative safeguards would have been
implemented. Thisproactive approach of conducting evaluations when
new information isacquired is preferable to conducting them only
when existing equip-ment or procedures are changed.
3.2 MonitoringThe #1 MNT column (C-501) processed material that
could undergodecomposition. An important aspect of safely
processing such materialis to have appropriate instrumentation in
the form of indicators, alarms,and active controls. Indicators and
alarms warn operators of upsets.As another layer of protection,
active controlssuch as safety interlocksand emergency shutdown
(ESD) systemsuse the output from indica-tors to automatically
correct problems. This instrumentation should befunctional at all
times, even when equipment is in abnormal operatingconditions, such
as extended shutdown.
In Guidelines for Engineering Design for Process Safety,
CCPS(1993a) notes that the concept of layers of protection applies
to thedesign of control systems: Facilities which process
hazardousmaterials should be designed with multiple safety layers
of
and Instrumentation
If FCC had a program in placeto proactively identify hazards in
thecontinuous unit, or broadly appliedknowledge acquired during
hazardreview of the batch unit, it is likely
that additional hardware andadministrative safeguards would
have been implemented.
C-501 processed material that couldundergo decomposition. An
important
aspect of safely processingsuch material is to have
appropriate
instrumentation in the formof indicators, alarms,
and active controls.
-
40
protection. CCPS reiterates that multiple layers are often
necessaryto achieve high levels of certainty that protection will
be availablewhen needed. Automatic action safety interlock systems
(SIS) or ESDsystems provide a layer of protection if primary
barriers to failuresuch as critical alarms, operator supervision,
and manual interven-tiondo not correct a deviation. In some
processes, it may benecessary to have a quench system to remove
heat if the temperaturerapidly increases. The interlock installed
on the batch MNT distilla-tion column (A-310) in 1996 to stop hot
oil flow to the reboiler inthe event of high temperature is an
example of an active control(Section 3.1).
As discussed previously, FCC did not evaluate or fully
understandthe potential hazards of handling MNT throughout the
continuousprocess, as reflected in the lack of instrumentation on
C-501. Sevenof the eight temperature indicators, positioned from
the bottom to thetop of the column, were functioning at the time of
the incident. Theindicators sent a DCS signal to the operators
computer screens.However, unlike the batch distillation process,
there were no alarmson the indicatorsand there were no interlocks
on the column,which would stop the heat input if the temperature
was too high.
Essential Practices for Managing Chemical Reactivity
Hazardsemphasizes that the basic process control system and
protectivesafeguards must be designed, operated, and maintained to
a highstandard (CCPS, 2003). Analysis techniques to evaluate both
thebasic process control system and SIS are not only an issue in
newconstruction, but also throughout active operation (CCPS,
1993b).
ANSI/ISA-84.0121 notes that the following steps are necessary
todetermine the appropriate safety system level for
instrumentation(including sensors, alarms, and shutdowns):
Conduct a PHA
Assess risks
Apply protective layers
Determine if further safeguards are required.
21This joint publication by the American National Standards
Institute (ANSI) and theInstrument Society of America (ISA),
Application of Safety Instrumented Systems forthe Process
Industries, provides guidelines on how to design, operate, and
maintainsafety-instrumented systems, such as high-temperature
interlocks. Other industrystandards include those of the
International Electrotechnical Commission (IEC, 2003).
Automatic action safety interlocksystems or ESD systems provide
alayer of protection if primary barriersto failuresuch as critical
alarms,operator supervision, and manualinterventiondo not correcta
deviation.
FCC did not evaluate or fullyunderstand the potential hazards
ofhandling MNT throughout thecontinuous process, as reflected inthe
lack of instrumentation on C-501.
Unlike the batch distillation process,there were no alarms on
theindicatorsand there were nointerlocks on the column, whichwould
stop the heat input if thetemperature was too high.
Facilities which process hazardousmaterials should be designed
withmultiple safety layers of protection.
-
41
ANSI/ISA-84.01 provides no specific guidance on these steps,
notingthat each company selects preferred tools for risk
evaluation.
When the batch column (AS-310) was brought online in 1996,FCC
conducted a PHA and determined that an additional interlockwas
necessary to stop the flow of heating medium to the reboiler ifthe
temperature in the vessel was too high. There was no evidencethat a
PHA was performed on C-501 or that consideration wasgiven to the
appropriate level of instrumentation. The last line ofdefense in
protecting a column is often the relief device (Section 3.5).
Having an evaluation system to determine the necessary level
ofinstrumentation and control, similar to the one outlined in
ANSI/ISP-84.01, would have provided FCC with the opportunity to
review itsinstrumentation for process monitoring and process
control. Such areview would have helped to ensure that critical
equipment wasconsistently instrumented throughout the facilityand
may have ledto the addition of safeguards on C-501, which would
have de-creased the likelihood of the October 13 incident.
3.3 Safe Work PracticesEffective training, standardized
procedures for safe practices, andcommunication are essential to
ensure that work practices are completeand consistent throughout a
facility. As discussed in Section 3.1, FCCdid not evaluate or fully
understand the potential hazards of handlingMNT throughout the
continuous process, which was further demon-strated by the lack of
an effective system to ensure safe work practices.
Effective operating procedures should:
Address all modes of operation, including abnormal
situationssuch as extended shutdowns for all foreseeable causes
andstartup after shutdown.
Specify the critical parameters to monitor (such as
temperature),even when the column is shut down.
Provide information about the hazards of materials
beingprocessed, operating limits, and actions to take if limits
areexceeded.
Specify how to accomplish critical tasks such as isolation.
There was no evidence that a PHAwas performed on C-501 or
that
consideration was given to theappropriate level of
instrumentation.
-
42
The FCC procedure that guided operation of C-501 was entitled#1
MNT Still/#2 MNT Still and Toluene Stripper.22 It providedno
cautions about the nature of MNT, potential instabilities of
thematerial, or safe operating limits and the consequences of
deviations.
In contrast, the operating procedure for the MNT batch
process23
included cautions and required operators to shut down the
heatsource if the temperature exceeded 400F. The procedure for
thebatch process also included actions to take in the event of
self-heating.
The procedural section on emergency shutdown of C-501 appliedto
steam failure (presumably to the overhead eductors) or coolingwater
failure. No other situationssuch as isolating the column dueto
upsets in other processing units, as happened on September 22were
discussed. In the case of steam failure, the instruction
directedoperators to place the steam to the reboiler control valves
in manualand closed position, and block in condensate return off
eachreboiler.
The flow valves were not designed to be tight shutoff valves.
Theinstructions did not specify that the steam line to the
reboilers shouldbe double blocked and bled,24 even though
operations personnelnoted that they knew those were the steps
necessary to isolate theline. In addition, the practice at the time
of the incident did notinclude placing blinds in the steam line,
which would have providedan additional degree of isolation.
Although the normal practice was to leave material in the
columnduring shutdown (unless it was to be entered for
maintenance), theprocedures did not provide any guidance on
monitoring conditions inthe column (including temperature) while it
was shut down. FromOctober 5when the boiler was restarteduntil the
day of the
22#1 MNT Still/#2 MNT Still and Toluene Stripper, Document No.
1201.003-1003,Revision 11, FCC.23AS-310 MNT Distillation, Document
No. 1201.003-1702, Revision 6, FCC.24Double-block and bleed (DBB)
and blinding are two methods of isolatingmaterial. For DBB, two
valves are closed and a drain is opened betweenthem so that any
accumulated material flows through the drain and notthrough the
valve. A blind is a solid plate installed in piping to
preventmaterial flow.
The procedural section on emergencyshutdown of C-501 applied to
steamfailure (presumably to the overheadeductors) or cooling water
failure.No other situations . . . werediscussed.
The flow valves were not designed tobe tight shutoff valves.
From October 5when the boilerwas restarteduntil the day of
theincident, the temperature steadily roseand was well in excess of
the 400Flimit specified in the batch distillationprocedure.
-
43
incident, the temperature steadily rose and was well in excess
of the400F limit specified in the batch distillation procedure
developed in1996.
Along with procedures, communication about current conditionsand
training are vital to the safe and efficient operation of a
processfacility. Effective training teaches employees how to safely
performtheir jobs under normal and abnormal situations. CCPS
(2003)notes that communication and training cannot be overlooked
whendeveloping programs to control chemical reactivity hazards:
Alloperating personnel should have a good idea of what will happen
if. . . a process is operated in the wrong range.
Although level accumulation on the top tray of C-501 was not
thecause of the decomposition reaction, a high-level alarm was
receivedwhile the process was believed to be nonoperational. The
alarmwas acknowledged on the computer screen, but no further
actionwas taken. Good practice includes evaluating alarms and
determin-ing the reason for their activation.
As noted in Section 3.1, the lack of a system to identify the
hazardsassociated with MNT in the continuous process resulted in an
inad-equate understanding of the sensitivity of the material to
heat. Whenequipment is not operatingand heat is not being
removedMNTmust be positively isolated from heat sources to keep the
temperaturefrom increasing. A comprehensive training program would
haveprovided another opportunity to assess the hazards and
communicatethem to operations personnel.
An effective system of safe work practices would have ensured
that:
All necessary steps were followed for the isolation of
equipment
The hazards of the material were communicated
The procedures codified relevant information.
If the steam supply was effectively isolated from the column,
the chainof events that led to this incident would not have
occurredeventhough C-501 was inventoried with material. In
addition, if thetemperature in the column had been monitored during
the time thematerial inside was heating, operators may have been
prompted totake corrective action.
Although level accumulationon the top tray of C-501 was not
the cause of the decompositionreaction, a high-level alarm
wasreceived while the process wasbelieved to be nonoperational.The
alarm was acknowledged
on the computer screen, butno further action was taken.
The lack of a system to identify thehazards associated with MNT
in
the continuous process resultedin an inadequate understanding
of
the sensitivity of the material to heat.
If the steam supply was effectivelyisolated from the column, the
chain of
events that led to this incident wouldnot have occurredeven
though
C-501 was inventoried with material.
-
44
3.4 MaintenanceMaintenance activities complement operations and
contribute toprocess safety by ensuring the mechanical integrity of
equipment.Maintenance planning and implementation are integral to
the safeand efficient operation of process systems. Corrosion,
erosion, andfatigue can cause failures in equipment and result in
process fluidsinadvertently entering equipment or being
released.
The importance of preventive maintenance to process safety
man-agement cannot be overemphasized. (CCPS, 1995c). An
effectivepreventive maintenance program establishes inspection
frequencies forprocess equipment that is vulnerable to such
conditions as corrosion,erosion, and fatigue.
3.4.1 Steam Valves
The MNT system maintenance practices at FCC were less
thanadequate. There was no evidence that the reboiler steam
supplyvalves had ever been evaluated to determine what
maintenanceactivities were necessary to ensure proper function.
Post-incidenttesting of critical steam isolation valves determined
that the valve seatsleaked a significant amount of steam, even when
the valves were inthe closed position. This uncontrolled and
unrecognized steam flowcontributed to the failure of the #1 MNT
column (C-501).
3.4.2 Distillation Column
Interviews with FCC facility personnel revealed that they
thought theoperating temperature of C-501 was sufficiently high to
prevent theaccumulation of moisture under external insulation and
corrosion ofthe carbon steel surface. Because of this assumption,
FCC did notmonitor the condition of the steel. However, the C-501
operatingprocedure25 stated that the mid-bed operating temperature
is about300F and the top of the column is about 140F.26
25#1 MNT Still/#2 MNT Still and Toluene Stripper, Document
No.1201.003-1003,Revision 11, FCC.26Below 140F, the moisture is
expected to vaporize.
Program andEquipment Integrity
Post-incident testing of critical steamisolation valves
determined that thevalve seats leaked a significant amountof steam,
even when the valveswere in the closed position. Thisuncontrolled
and unrecognizedsteam flow contributedto the failure of C-501.
CSB found significant externalsurface corrosion under the
upperareas of C-501, including one areawhere the wall was degraded
to30 percent of its original thickness,with a corresponding
reductionin pressure capacity.
-
45
CSB found significant external surface corrosion under the
upperareas of C-501, including one area where the wall was degraded
to30 percent of its original thickness, with a corresponding
reduction inpressure capacity. Although the thinned wall did not
cause theincident, it is evidence of inadequacy in the FCC
inspection andmaintenance program at that time.
3.5 OverpressureThe #1 MNT column (C-501) was designed,
fabricated, and testedin accordance with the American Society of
Mechanical Engineers(ASME) pressure vessel code; it had a nameplate
rating of 15 psig. A3-inch nominal pressure safety valve (PSV-502)
attached to the over-head vapor line, with a set pressure of 15
psig, provided overpressureprotection.
Industry literature and test data show that MNTif exposed to
hightemperaturesmay violently decompose and generate large
volumesof vapor. The PSV must have adequate flow capacity to limit
themaximum pressure in a column caused by a runaway reaction.
Determining the relief valve size on a reactive chemical system
iscomplex and requires physical test data on reaction kinetics and
flowcharacteristics. Laboratory test results of MNT are required to
deter-mine if the vented contents are a pure gas, a pure liquid, or
a combina-tion of bothcommonly known as two-phase flow.
In the absence of effective safeguards to prevent a runaway
reaction,such as safety interlocks and safety work practices
(discussed previ-ously), FCC relied on the PSV for C-501 to provide
protection inthe event of a thermal decomposition. CSB determined
that thecapacity of the PSV was inadequate to prevent
overpressurizationand catastrophic failure of the column.
Protection
Industry literature and test data showthat MNTif exposed to
high
temperaturesmay violentlydecompose and generate large
volumes of vapor.
FCC relied on the [pressuresafety valve] for C-501 to
provide
protection in the event of a thermaldecomposition. CSB
determined that
the capacity of the PSV wasinadequate to prevent over-
pressurization and catastrophicfailure of the column.
-
46
As part of thermal stability testing, the CSB contractor
estimated that avessel the size of C-501, with a design pressure of
15 psi, wouldifplaced on the overhead vapor linerequire a
58-inch-diameter reliefvalve. This excessively large size would
call for alternate methods ofoverpressure protection, including
increasing the number or alteringthe location of relief
devices.27
Because FCC had no documentation on the design basis for
theinstalled PSV on C-501, CSB was unable to determine the
scenarioused. The American Petroleum Institute (API)
RecommendedPractice (RP)-521, Guide for Pressure-Relieving and
DepressuringSystems, notes that several scenarios must be
considered in determin-ing the required capacity of a safety relief
valve, including chemicalreaction. API states that pressure relief
considerations should includeestimated vapor generation from both
normal and uncontrolledconditions. When a pressure relief device
cannot feasibly controlpressure, other design strategies may be
employed to prevent equip-ment damage, including automatic shutdown
systems.
If FCC had an effective system in place to evaluate the
overpressureprotection for C-501, it would likely have determined
that the reliefvalve was inadequate. This determination could have
led to a com-prehensive review of the overpressure protection
scheme (i.e., loca-tion, size, and number of relief valves) and the
addition of safeguards toprevent a decomposition reaction.
3.6 Control RoomShattering glass from the control room door
injured three people inthe control room at the time of the incident
(5:25 am; Figure 9).The time of day was likely a factor in limiting
the number of injuries.
The control room for the aniline unit (including the MNT
columns)was constructed of masonry block, with sheet metal on the
roof and
27The location of relief devices, as well as their sizing, must
be considered whenevaluating overpressure protection for vessels.
Kister (1990) notes that the vapor spaceat the bottom of a column,
just below the packing supports, may be considered as alocation for
pressure relief devices. In one case, a low-positioned relief
preventedoverpressure when a device at the top of the column would
have been ineffective.
Construction andLocation
If FCC had an effective system inplace to evaluate the
overpressureprotection for C-501, it would likelyhave determined
that the relief valvewas inadequate.
-
47
Figure 9. Damage to control room roof and door.
sides. The building was located approximately 50 feet from the
#1MNT column (C-501). The explosion resulted in structural damageto
the walls of the building and the roof (Figure 9). Several
otherbuildings onsite were damaged, including the administration
building,which was located approximately 450 feet from C-501.
Facility siting guidelinesparticularly those published by CCPS
andAPIcover the location and construction of control rooms in
thechemical and petrochemical industries. API RP-752 (1995)
wasdeveloped for facilities covered by the Process Safety Code of
theChemical Manufacturers Association (now the American
ChemistryCouncil [ACC]). FCC was previously a member of CMA and was
amember of SOCMA (which adopted the Process Safety Code) at thetime
of the incident.
API RP-752 includes a step-by-step analysis, beginning with
occu-pancy screening and proceeding to hazard identification,
buildingevaluation, and risk management. It is applicable to both
new andexisting buildings. The guideline notes that some companies
use arange of 200 to 400 personnel hours per week to determine
whencontrol room occupancy requires a higher level of analysis.
The control room for the FCC aniline unit would typically have
hadoccupancy well in excess of this range. The peak occupancyor
The control room for the aniline unit(including the MNT columns)
wasconstructed of masonry block, with
sheet metal on the roof and sides.The building was located
ap-
proximately 50 feet from C-501.
Facility siting guidelinesparticularlythose published by CCPS
and API
cover the location and constructionof control rooms in the
chemical and
petrochemical industries.
-
48
number of personnel that may be exposed in a given period(e.g.,
such as at a production or safety meeting)should also
beconsidered.
Another consideration for occupancy is the ability to evacuate
abuilding, though API RP-752 notes that:
Process materials that have the potential for runaway reac-tions
or chemically or thermally induced decomposition mayproduce toxic,
fire, or explosion effects with little or nowarning . . . and . . .
building evacuation may not be a viableoption.
API RP-752 lists components that may explode due to
chemicaldecomposition as materials of concern. CCPS (1996) notes
thatprocesses of concern include those that have the potential for
uncon-trolled chemical reactions. Methods of calculating the
potentialconsequences of releases include TNT-equivalency,
Multi-Energy,and Baker-Strehlow.
Hazard evaluation tools, such as the Dow Fire and Explosion
Indexand the Mond Index, can be used to assist in prioritizing
buildings.
The last step in the guidance is to assess risk and determine
thenecessity for preventive or mitigative measures. Preventive
measuresinclude adding redundant instrumentation and emergency
shutdowns,or altering process conditions or materials to reduce the
potential forrunaway reactions. Mitigative measures include
eliminating ormodifying windows in buildings, or reinforcing or
otherwise modifyingstructures to withstand pressure.
If FCC had performed such an analysis, it would have likely
deter-mined that the location and structure of the control room
presented arisk to occupants. This conclusion could have led
to:
Preventive measures, such as adding instrumentation to
columnsprocessing highly energetic material.
Mitigative measures, such as removing windows and puttingsolid
doors on the control room, reinforcing walls, or relocatingthe
control room.
. . . Processes of concern includethose that have the potential
foruncontrolled chemical reactions.
Preventive measures include addingredundant instrumentation
andemergency shutdowns, oraltering process conditions ormaterials
to reduce the potentialfor runaway reactions.
Mitigative measures includeeliminating or modifying windowsin
buildings, or reinforcingor otherwise modifying structuresto
withstand pressure.
-
49
3.7 ProcessThroughout the investigation, CSB reviewed
procedures, testingdata, and equipment files. However, some of the
informationprovided by FCC was incomplete or in error. For example,
norecords were provided for the scenarios considered in sizing
therelief valve on the #1 MNT column (C-501). Therefore, CSBwas
unable to draw conclusions as to failures in the design
phase,except to note that subsequent testing of MNT demonstrated
thatthe valve was not sized for a thermal decomposition, which was
avalid consideration for this material.
CSB also inquired about previous studies regarding the location
andstructure of the control room. FCC personnel stated that
theybelieve a study was performed, but there was no
documentation.
CSB sought documentation to support exclusion of the
MNTdistillation area from requirements of the Occupational Safety
andHealth Administration (OSHA) Process Safety Management
(PSM)Standard, 29 CFR 1910.119. Again, FCC personnel noted that
theevaluation occurred, but there was no documentation. (See
Section3.10 for a discussion of regulatory analysis.)
Upon request, FCC provided two material safety data sheets(MSDS)
for MNT. The 1992 MSDS noted that MNT: Decom-poses slowly at 392F.
The 1998 MSDS did not include thiswarning, though it was produced
after the MNT batch project,when testing and literature searches
showed that MNT wassusceptible to thermal decomposition (Section
3.1.2).
The MNT continuous process was commissioned in the late
1960s,prior to the electronic storage of information. FCC personnel
notedthat much of the information was lost when people left the
company(due to downsizing, resignations, or retirements) and during
the sale ofa portion of the facility to Albermarle, in which
documents were takenoffsite for review and in some cases not
returned. Personnel also notedthat a hurricane destroyed some
files.
A comprehensive information management system is essential
tomaintaining safe operations. Operations personnel must have
accessto reliable information on the safety of process material and
equip-ment. Neither the MSDSs nor FCC operating procedures
containedappropriate cautions about MNT. As noted in Section 3.1.6,
therewas no system in place to evaluate the hazards and apply
lessons
Information andRetention of Records
Neither the MSDSs nor FCCoperating procedures contained
appropriate cautions about MNT.
There was no systemin place to evaluate the hazards
and apply lessons learnedfrom other processes.
-
50
learned from other processes. The lack of a comprehensive system
tomanage and distribute information, however, meant that even if
thehazards had been evaluated and the potential results known,
thatinformation may not have been effectively communicated.
3.8 CommunityAn effective community notification system alerts
people to the factthat an incident occurred and informs them when
the situation isover. As part of the notification system or
educational campaign,people are instructed on the appropriate steps
to take to protectthemselves.
CSB evaluated the emergency response and community
notificationsystem. This effort included a meeting with the local
emergencyplanning committee (LEPC) and a community meeting with
localresidents. It also included surveying several industrial areas
withresidential neighbors to determine good practices in
communitynotification and emergency response. The survey revealed
multiplemethods of communicating information about chemical
incidents,including sirens and reverse 9-1-1 systems. Local
residents in thoseareas had been trained on shelter-in-place
procedures.
CSB determined that the Jackson County public
communicationsystem was ineffective. A shelter-in-place was called,
but it was noteffectively communicated to local residents by the
mediawhich isessential to ensure that appropriate actions are taken
by residents andneighboring companies. There is also a need for
improved commu-nity education and training on what steps to take in
the event of ashelter-in-place. Although post-incident monitoring
and analysis ofwind direction indicated that the smoke moved away
from residentialareas, timely communication with residents would
have decreasedtheir anxiety.
Numerous County, State, and Federal agencies and
corporateneighbors responded to this incident, including local fire
and police,the Chevron refinery fire department, the U.S. Coast
Guard, andthe County Sheriff. Police and fire personnel quickly
closed BayouCassotte Industrial Road. The sheriff issued the order
to shelter-in-place. The Federal Aviation Administration
established a no fly
Notification System
CSB determined that the JacksonCounty public communication
systemwas ineffective. A shelter-in-placewas called, but it was not
effectivelycommunicated to local residents . . .
-
51
zone over the facility and surrounding area to safeguard
aircraft.State and Federal EPA arrived onsite and established
environmentalmonitoring stations outside the perimeter of the
facility.
The FCC night-shift supervisor assumed the role of onsite
incidentcommander. He coordinated facility firefighting, accounted
foremployees, and directed ambulances to the three injured
employees.
FCC operators quickly shut down and isolated all process and
plantutility units. Based on site interviews of first responders
and unitoperators, the response to the initial explosion and fire
was rapid.
3.9 Review of
3.9.1 Pascagoula Facility
FCC experienced an explosion and fire in a batch process
underdevelopment for a third party in 1986. A runaway
self-heatingreaction in a process used to distill
meta-chloroaniline overwhelmedequipment relief devices. The
incident involved a runaway reactionand overpressurization of
equipment in a column that had no provi-sions to mitigate a thermal
runaway. The column was destroyed,and debris was propelled
offsite.
One of the recommendations was to perform hazard analyses
ofexisting processes. FCC did not apply lessons learned from this
eventto the MNT distillation system. If a thorough review of the
safetysystems and overpressure protection for distillation columns
had beenconducted at that time, the inadequacies in column design
and opera-tion may have been identified and actions taken to lessen
the likelihoodof the October 13 incident.
3.9.2 Other Incidents
CSB reviewed incidents involving similar materials or similar
causalcircumstances. Each of the following incidents involved
material thatwas held at temperatures thought to be safe, but which
proved to bethermally unstable.
Previous/SimilarIncidents
One of the recommendations[from a 1986 incident] was to
performhazard analyses of existing processes.
FCC did not apply lessons learnedfrom this event to the
MNT distillation system.
-
52
Hickson & Welch Ltd, 1992
A September 21, 1992, incident at Hickson & Welch
Ltd,Castleford, United Kingdom, killed five workers (Health and
SafetyExecutive [HSE], 1994). It involved similar materials and
alsoresulted in an explosive thermal decomposition. Workers
attemptingto clean a still used in an MNT distillation process
applied steam tothe still for 3 hours to soften accumulated sludge,
which was rich indinitrotoluenes and nitro cresols.
HSE determined that the residue initiated a runaway reaction,
whichcaused a deflagration and intense fire. Among the findings of
HSEwas that the sludge contained organic nitro compounds; it
wasknown that exposing such compounds to high temperatures or
tomoderately elevated temperatures over an extended time could
causea thermal decomposition. HSE further found that upper
manage-ment knew of these hazards from previous incidents at the
plant.The company had in place a system of thermal stability
testing thatwas intended to supply managers with the information
necessary tosafely operate the distillation plant. However, there
was no attempton the part of Hickson & Welch management to
characterize thesludge material or the hazards related to its
removal, specificallypotential thermal instability.
Union Carbide, 1972
On August 7, 1972, at a Union Carbide facility located in
Institute,West Virginia, a transfer line containing dinitrotoluene
(DNT)28
exploded (Bateman, Small, and Snyder, 1974). This event
wasfollowed by numerous other explosions and small secondary
fires,resulting i