| Plant Maintenance Resource Center
Recurring Causes of Recent Chemical Accidents
| |
|
|
|
|
Recurring Causes of Recent Chemical Accidents
Author : James C. Belke
This paper was originally presented at an International conference and Workshop on Reliability and Risk Management organised by AIChE/CCPS in September 1998, San Antonio, Texas AbstractThe US Environmental Protection Agency (EPA) and the Occupational Safety and Health Administration (OSHA) have investigated recent accidents at petroleum refineries, chemical manufacturing facilities, tolling operations, chemical distributors, and other types of facilities. Recurring causes of these accidents include inadequate process hazards analysis, use of inappropriate or poorly-designed equipment, inadequate indications of process condition, and others. Of particular note, installation of emissions or pollution control equipment has preceded several significant accidents, highlighting the need for stronger systems for management of change. Other recent accidents have been preceded by a series of similar accidents, near-misses, or low-level failures, pointing to the need for more attention to lessons-learned implementation and more thorough company investigation of near-misses and low-level failures as means of avoiding major accidents. This paper presents brief case studies of several recent chemical accidents investigated by EPA and OSHA, and illustrates common root causes and other recurring themes of those accidents. These accident investigations were conducted by the EPA/OSHA Joint Chemical Accident Investigation Team. The aim of this team is to identify the root, or underlying, causes of major chemical accidents and to develop recommendations to prevent future similar accidents. IntroductionThis paper presents brief case histories of several recent chemical accidents investigated by EPA and OSHA and illustrates common causes and other recurring themes of those accidents. When the underlying causes of numerous accidents are brought to light and compared against one another, recurring causes are sometimes identified - patterns that might be overlooked if investigations stop at the tip of the iceberg, or if each accident is viewed in isolation. There is value in identifying recurring root causes. The value is in determining adverse trends, in discerning the vulnerabilities and unforeseen side-effects of new technology, in identifying the obsolescence of aging equipment and systems, and in assessing the shortfalls of safety management systems in general. However, generalizing about root causes can be taken too far. One common and useful method of determining root cause is to keep asking "why?". This method must be used with a good dose of engineering judgement. The idea is to ask "why?" enough times to get to the underlying systemic cause of the event, but not so many times that the cause becomes obscured in an overarching general concern which is too vague to address. This sort of over-analysis results in abstractions and doesn’t serve any useful purpose. It’s important to keep this in mind when determining root causes; the ‘common themes’ presented in this paper are intended to be specific enough that they can be useful. It will be useful to define some terminology that is used in this paper. Root causes are the underlying prime reasons, such as failure of particular management systems, that allow faulty design, inadequate training, or deficiencies in maintenance to exist. These, in turn, lead to unsafe acts or conditions which can result in an accident. Contributing causes are factors that, by themselves, do not lead to the conditions that ultimately caused the event; however, these factors facilitate the occurrence of the event or increase its severity. Of course, people may debate about which factors are root causes, which are contributing causes, and which are neither, but in this day and age, major accidents generally involve more than one cause. Virtually none of the accidents that EPA and OSHA investigated involved only a single cause. More commonly, half a dozen root and contributing causes were identified. The importance of using accident investigation to identify non-causal factors should also be noted. Non-causal factors are those systematic deficiencies that may be identified during the course of an accident investigation that aren’t directly related to the cause of the accident. A thorough accident investigation will usually uncover several plausible scenarios that might have led to the accident. In fact, only one of the scenarios actually transpired, but the others might have occurred, if circumstances had been different. Each of these scenarios may identify program deficiencies which need to be addressed. Accident investigations are a valuable tool for safety program evaluation, and all deficiencies identified in alternate scenarios should be addressed. Sometimes, it can’t be determined exactly which scenario occurred. However, whenever possible, it’s important to understand which critical factors ultimately led to the accident and which did not. The common causal factors or "themes" identified in this paper are all directly related to the accidents that occurred. Brief Accident HistoriesEPA and OSHA have investigated numerous major chemical accidents over the last several years. Most of these accidents involved fatalities, and had some significant impact on people in nearby residential communities. All involved worker injuries and substantial on-site property damage. The following list includes some of the more notable among these. Some of these were joint EPA/OSHA investigations, while others were investigated by EPA alone (OSHA investigated all of these accidents for violation of occupational health and safety laws. However, OSHA did not participate with EPA in a more in-depth "root cause" investigation for some of the incidents.):
Common FactorsThese accidents involved different events, varying circumstances, and a unique set of causes. However, when the incidents are compared to one another, some common themes can be discerned. These include the following: 1. Inadequate hazard review or process hazards analysisIn almost every accident EPA and OSHA have recently investigated, some aspect of hazard review or process hazards analysis (PHA) was found to be lacking. This can take a variety of forms. In some cases, the PHA did not address known equipment failure scenarios. For example, at Shell Chemical Company in Deer Park, the PHA did not consider the possibility of check valve shaft blow-out, even though the facility and other Shell facilities had experienced near-miss blow-outs in the past. In fact, the PHA at Shell Deer Park was actually suspended in order to conduct repairs following one such incident. At Georgia Pacific in Columbus, Ohio, the PHA did not consider the runaway batch reaction resulting from a "dump-in" scenario (i.e., failure to control the rate of chemical addition to an exothermic process), and emergency pressure relief systems were not capable of relieving the pressure rise associated with such an event. The only line of defense against the event was the operator, and this was not enough. In some accidents, a PHA was performed but it did not identify all process hazards. For example, at Napp Technologies in Lodi, New Jersey, Material Safety Data Sheets (MSDSs) were relied upon as the primary source of hazard information for gold precipitating agent, a water reactive chemical. However, while MSDSs usually provide substantial information on chemical hazards, they often provide very little information on process hazards. The MSDSs did not reveal accident history, identify or account for potential sources of water, or address the proper technology and design of equipment necessary to safely blend water reactive substances. Even for situations not involving complex chemical processing operations, MSDSs are not always sufficient to identify all reactivity, thermal stability, or explosive hazards. In other accidents, no hazard review or PHA was performed on the process involved in the accident. This was the case at Terra Industries in Port Neal, Iowa, at PDTI in Savannah, Georgia, and at Pennzoil in Rouseville, Pennsylvania. If hazards are never reviewed or analyzed, then avoiding accidents is more a matter of luck than design. 2. Installation of pollution control equipmentSeveral of the accidents described above occurred following the installation of devices to eliminate or reduce vapor emissions. This is a reflection of inadequate hazards analysis and inadequate management of change procedures. These incidents are discussed separately, instead of being included in the general discussion above, because of the frequency of their occurrence. Each case involved a process change made with good intentions (i.e., protecting the environment), but the full implications to personnel safety were not considered.
New equipment, even when well-designed, can create additional hazards if it is not properly integrated into existing systems. These accidents highlight the need for rigorous implementation of management of change procedures so that all hazards of new equipment are analyzed and accounted for. 3. Use of inappropriate or poorly designed equipmentIn several accidents, equipment used for a task was inappropriate or not in accordance with current standards:
Many other causal factors contributed to each of these accidents, but use of inappropriate or poorly designed equipment clearly stands out as a primary cause in these and other recent accidents. 4. Inadequate indications of process conditionIn several accidents, process instrumentation did not provide operators with indications needed to clearly identify unsafe process conditions:
Each of these accidents occurred or was made more severe because the instrumentation necessary to safely control the process was not available. Operators were essentially forced to "fly blind". 5. Warnings went unheededHistory shows repeatedly that major disasters are often preceded by a series of smaller accidents, near-misses, or accident precursors. This was true in some of the most notorious accidents in recent decades. In the Challenger space-shuttle accident, engineers at NASA and its contractor, Morton Thiokol, were well aware of previous malfunctions in solid rocket booster O-ring joints, and that 4 of 21 previous shuttle launches had experienced booster O-ring leakage. Engineers even met with launch managers on the morning of the accident to consider the safety implications of the O-ring problem. It was known that low ambient temperatures exacerbated the problem, and the day of the accident was the coldest launch day yet. In spite of knowledge of past problems and the explicit warnings from engineers, project managers decided to proceed with the launch over engineering objections. At Bhopal, India, smaller accidents had occurred at the plant prior to the disastrous methyl isocyanate (MIC) release in 1984, and small MIC leaks had been noted on numerous previous occasions highlighting the need for automatic MIC leak detection. In fact, workers stated that experiencing eye irritation (a symptom associated with low levels of airborne MIC) was not an unusual phenomenon, but these warnings went unheeded. The same type of warnings existed in several of the recent accidents investigated by EPA and OSHA. Prior to the accident at Georgia Pacific, the facility had recently experienced a near miss involving similar circumstances to those resulting in the later accident. An operator added chemicals to a batch resin process at too high a rate. Other alert operators noted the procedural deviation, and were able to prevent an accident. The company investigated the incident and disciplined the first operator. No other actions were taken. In the case of Shell, the company had experienced mechanical integrity problems involving the same type of check valve on at least four earlier occasions at Deer Park and other Shell plants. One of these events involved a serious flammable gas leak at a facility in Saudi Arabia. Fortunately, the gas never ignited. The plant which experienced the earlier incident conducted an investigation, but the recommendations which might have prevented the later accident at Deer Park were never implemented there. At Tosco, operators had experienced hydrocracker temperature excursions on several previous occasions, but were able to bring process temperatures back into normal operating ranges without shutting down the unit (the standard procedure) or suffering adverse consequences. Other process upsets had been investigated, but lessons learned were generally not incorporated into operating practice. Causes That Didn’t Make the ListIf understanding recurring causal factors and root causes is important in learning about accident patterns, it’s perhaps nearly as important to recognize what root causes have not "made the list". These include training and operator error. For example, in the Shell Deer Park accident investigation, EPA and OSHA identified a total of 7 root and contributing causes and 13 recommendations. None of them explicitly addressed training or operator error. This may seem surprising, since these are often considered "the usual suspects" in accident investigations. However, while operator performance clearly plays a crucial role in safe plant operation, it is only one aspect of a proper safety management system. For most major chemical accidents, EPA and OSHA believe that it is rarely the action or inaction of a single operator that is the sole or even primary cause of an accident. The Safety Precedence Sequence illustrates that numerous barriers must fail before operator action can cause an accident:Safety Precedence Sequence:
Note that personnel action is almost on the bottom of the list. In keeping with this philosophy, during root cause accident investigations EPA and OSHA normally focus attention on the actions of operators as they reflect the performance of the organization and its management systems. Viewed from this perspective, operator errors, excluding willful negligence or malfeasance, are often symptoms and not really root causes. If an incident investigation program frequently assigns operator error and inadequate training as root causes, or if the recommendations frequently include disciplining operators or conducting more training, this may be a sign that the program isn’t identifying or addressing the true root causes. Likewise, if a safety management system relies on properly trained operators to take correct action as the only line of defense against a major disaster, then a facility that employs such a system is asking for trouble in the long run, because humans make mistakes. ConclusionFrom the perspective of the individual facility manager, catastrophic events are so rare that they may appear to be essentially impossible, and the circumstances and causes of an accident at a distant facility in a different industry sector may seem irrelevant. However, from our nationwide perspective at EPA and OSHA, while chemical accidents are not routine, they are a monthly or even weekly occurrence, and there is much to learn from the story behind each accident. Catastrophic chemical accidents still occur too often. Furthermore, when we look beyond the obvious to the underlying systemic causes of an accident, we see that the same root and contributing causes keep popping up again and again. This indicates that government and industry together are not doing a good enough job at sharing accident information and implementing lessons learned.
DisclaimerThe views expressed in this document are the opinions of the author and may not represent official agency positions. References:Kharbanda, O.P. and Stallworthy, E.A. Safety in the Chemical Industry: Lessons from Major Disasters, G.P. Publishing, Inc., Columbia, Md, 1988 Engineers, Center for Chemical Process Safety, Guidelines for Investigating Chemical Process Incidents, American Institute of Chemical Engineers, New York, 1992 Conger, D. and Elsea, K., Root Cause/Incident Investigation Workshop, Course Notes, Conger & Elsea, Inc., Woodstock, GA, 1997. Kletz, T.A., The Unforeseen Side-Effects of Improving the Environment, Process Safety Progress, Volume 12, No. 3, June 1993. Rogers, William P., Armstrong, Neil A., Acheson, David C., Covert, Eugene E., Feynman, Richard P., Hotz, Robert B., Kutyna, Donald J., Ride, Sally K., Rummel, Robert W., Sutter, Joseph F., Walker, Jr., Arthur B.C., Wheelon, Albert D., Yeager, Charles, Keel, Alton G., Report of the Presidential Commission on the Space Shuttle Challenger Accident, National Aeronautics and Space Administration, Washington, DC, 1986 U.S. Environmental Protection Agency, EPA Chemical Accident Investigation Report: Pennzoil Product Company Refinery Rouseville, Pennsylvania, March 1998 U.S. Environmental Protection Agency, EPA Chemical Accident Investigation Report: Powell Duffryn Terminals, Inc., Savannah, Georgia, May 1998 U.S. Environmental Protection Agency and United States Occupational Safety and Health Administration, EPA/OSHA Joint Chemical Accident Investigation Report: Napp Technologies, Inc., Lodi, New Jersey, October 1997 U.S. Environmental Protection Agency and United States Occupational Safety and Health Administration, EPA/OSHA Joint Chemical Accident Investigation Report: Shell Chemical Company, Deer Park, Texas, June, 1998 U.S. Environmental Protection Agency and United States Occupational Safety and Health Administration, EPA/OSHA Joint Chemical Accident Investigation Report: Surpass Chemical Company, Albany, NY, January 1998 draft
Copyright 1996-2009, The Plant Maintenance Resource Center . All Rights Reserved.
|
