There are so many learnings in this incident that every single business should analyze these against their current safety systems. Many of the issues that the Chemical Safety Board (CSB) investigation investigation identified are present in many other processing units handling Highly Hazardous Chemicals and Extremely Hazardous Substances. This is a breakdown of the items that the CSB has made public. Here they are:
Background: On November 15, 2014, nearly 24,000 pounds of methyl mercaptan was released. The release resulted in the fatalities of three operators and a shift supervisor. The four employees died from a combination of asphyxia and acute exposure to toxic chemicals including methyl mercaptan. All four victims were located inside the manufacturing building—three on the third floor and one descending the stairs between the third and second floor.
#1 – Application of Inherently Safer Design (ISD)
Following Bhopal, the company made significant modifications to its methyl isocyanate (MIC) process (this was the chemical involved in the Bhopal catastrophe) that incorporated inherently safer design (ISD). These ISD approaches included the use of an open building structure with equipment to direct leaks of highly toxic chemicals to an incinerator for destruction. However, the company did not effectively apply similar ISD to other chemicals it also classified as highly toxic, such as methyl mercaptan and chlorine. As a result, the methyl mercaptan release on November 15, 2014, occurred inside an enclosed and poorly ventilated building. See below for the failures in the ventilation design, inspection/testing, and maintenance.
#2 – Process building design
The portion of the process where the incident took place is enclosed within a building that has no documented design function and appears to serve no essential manufacturing purpose. Ask yourself… is my process enclosed and if yes, what purpose does the enclosure serve? Is it designed to contain a release, direct a release to an emergency treatment system, etc. If it is not serving a purpose, applying ISD to this building design would lead us to consider removing the enclosure so that in the event that ventilation controls were lost, there would be some “natural ventilation” to aid in reducing exposures and flammable atmospheres. However, housing the process equipment inside the enclosed manufacturing building exposed personnel to highly toxic chemical exposure and asphyxiation hazards that the company had not effectively identified or controlled. The manufacturing building design introduces all of the increased personnel hazards, but offers none of the beneficial off-site risk reduction of a containment building. The manufacturing building is not designed to limit the impact of a toxic chemical leak by containing the leak and routing it to a destruction device such as an incinerator or scrubber. Vapors from highly toxic chemical leaks are trapped and concentrated inside the building, increasing risk to workers. Additionally, by the design, the manufacturing building ventilation system discharges these highly toxic chemical leaks from the roof of the manufacturing building to the outdoor surroundings, resulting in reduced risk-reduction benefit to the public (vapor density of methyl mercaptan is 1.6). The manufacturing building ventilation fans were classified as critical process safety equipment, meaning their failure could result in a high consequence event. A design objective of the ventilation fans was to “control contaminants to acceptable workplace exposure levels.” However, neither fan was in operation at the time of the incident. The CSB’s preliminary calculations indicate that even with both fans operating, ventilation would likely have been insufficient to avoid a lethal atmosphere inside the manufacturing building because of the amount of toxic gas released.
#3 – Ventilation
At the time of the incident, the manufacturing building ventilation fan for the portion of the unit where the methyl mercaptan was released was not operating despite an “urgent” maintenance work order written on October 20, 2014, nearly a month prior to the incident. The loss of the ventilation fan did not result in any additional safety precautions, such as enhanced operational or emergency response planning, restricted worker access to the manufacturing building, or increased personal protective equipment (PPE) requirements. As a result of the release, the manufacturing building stairways were contaminated with highly toxic and highly flammable methyl mercaptan. The stairways were not a safe location for workers. However, these stairways provide the primary means to access the equipment or exit the building in the event of an emergency. The stairways are designed for fire escape, but the facility had not effectively evaluated entry or exit for toxic gas hazards or in an oxygen-deficient environment. There is no ventilation provided in the manufacturing building’s stairways. Furthermore, the internal doors between those stairways and the process areas do not provide an effective barrier to keep hazardous gases released in the process areas from entering the stairways.
How many have viewed their enclosed egress stairway(s) as a safe means from a TOXIC event as well as a fire event? Heck we have a hard enough time to keep our fire doors CLOSED and not propped open with tools, chairs, barrels, etc. Now we need to ask the question… should we have a catastrophic failure (whatever failure mode it may be) can personnel have a safe means of egress. PLEASE do not convince our on minds that 10 minute escape packs are the answer – they are PPE; LAST LINE OF DEFENSE. Look at this as an ENGINEERING solution such as pressurizing stairways or providing adequate negative ventilation. We can utilize a lot of the same controls that we apply to our fire doors if we need certain doors to remain open. Tie these doors magnetic holders into our toxic detectors, just like we tie our fire doors into our fire alarms.
The manufacturing building air dilution ventilation system had never been evaluated by a PHA or robust engineering analysis. The area of the manufacturing building where the largest methyl mercaptan release occurred during the incident has never been tested for ventilation flow rate or effective distribution of dilution air. Although mechanical integrity procedures call for annual air flow testing, the manufacturing building ventilation system for the immediate area impacted by the methyl mercaptan release (the wet end fan) had never been tested for flow rate or effective distribution of dilution air.
#4 – Chemical detectors
The methyl mercaptan detection system did not effectively warn workers or protect the public from highly toxic chemical exposure. The methyl mercaptan detector concentration alarm point is above the permissible exposure limit for workers and the response to a detector alarm is not sufficient to protect the public. For example, during the hours prior to the November 15, 2014 incident, multiple highly toxic chemical gas detectors alarmed (sounded). However, the emergency response team (ERT) was not notified and the area was not cleared of personnel. In addition, methyl mercaptan releases on November 13 and 14, 2014, were identified by methyl mercaptan detectors, but were never reported as releases nor investigated as serious process safety incidents.
How we manage our detector readings and alarms is CRITICAL. Even the set points of these detectors is CRITICAL. The level we choose needs to be CLEAR as to what purpose these detectors are intended to serve. Using IDLH levels can be an acceptable design for an indication that the area be declared an emergency and SCBA is required. But if we want to claim our detectors as an early warning system then IDLH is NOT the level we want to use. This logic MUST BE documented in our PSI if the detectors are being used for a HHC/EHS.
The (IBU) process analyzer houses are infrequently entered, but they are equipped with more robust asphyxiation safeguards (oxygen detectors and alarms) than the normally occupied manufacturing building. However, the manufacturing building—which lacks the same level of asphyxiation safeguards—has significantly larger inventories of hazardous chemicals, has unventilated areas, and is regularly occupied by workers.
#5 – PHAs and relief system design scenarios
The process hazard analyses (PHAs) and relief system design scenarios did not effectively identify hazards from non-routine operations, such as opening valves to connect the liquid methyl mercaptan piping to the vapor waste gas vent header—the piping connection that provided the pathway for the methyl mercaptan release in this incident. Along the methyl mercaptan feed line there were three locations where it was connected by valves to the waste gas vent header piping. At the time of the incident, one of these valves was fully open and a second valve was slightly open.
This is a tough one, as these non-routine operations are often so non-routine that a PHA team or facilitator may not even be aware of these operations. But this leads me to my discussion around LAYERS OF PROTECTION by CONTROLLING ALL our actions within a covered process. This leads me to my position on using a SAFE WORK PERMIT for ALL activities that are not specifically covered in an SOP or Maintenance procedure that has been reviewed and annually certified (knowing that neither PSM/RMP require maintenance procedures to be annually certified). We have to be control freaks and EVERYTHING we do within, on, or adjacent to a covered process MUST BE CONTROLLED under some formal mechanism.
The company has been in the process of implementing a five-year program to validate that pressure relief systems comply with existing company standards, process safety regulations, and industry codes and standards. The company has not made this program a sufficiently high priority and additional outside resources are needed for effective completion. Although the program is more than four years into the five-year plan, IBU relief systems are only 35% complete. The CSB identified pressure relief systems in the insecticide manufacturing process that are improperly designed and do not meet the requirements of industry codes and standards. As a result, these relief systems do not effectively ensure that highly toxic, highly flammable, and asphyxiating chemicals are discharged to safe locations. For example, during the incident an atmospheric release of highly toxic and highly flammable liquid methyl mercaptan likely occurred through a relief system intended to release and disburse nitrogen vapor. This relief system is part of the 35% of systems the company considers complete and in compliance with industry codes and standards. However, the alignment of block valves at the time of the incident revealed a highly toxic methyl mercaptan release scenario that the company’s five-year relief system compliance program never considered.
I find this one just downright shameful! I am sorry but we are on going on 23 years of the PSM standard and we are now just getting around to validating pressure relief systems? How in the heck does one do a PHA and list the relief system as a “safeguard” knowing that they have not been validated. Make the scenario HIGH RISK and write a recommendation to validate the relief system!! Officially the PHA should never have been conducted if there were questions regarding the validity of the relief system (e.g. PSI); but when a PHA scenario finds that the RV system was NOT designed for said scenario this must be addressed ASAP as a PHA recommendation and not some separate project many years later.
The company involved in this incident is better than most and yet this incident occurred and claimed the lives of four workers. We would be FOOLS if we think, even for a second, that these failures can not and will not occur at our workplace. WE MUST LEARN from these mistakes or we are setting ourselves up for yet another tragedy. Process Safety incidents are often times low frequency with a SEVERE CONSEQUENCES and so this makes it hard for many process safety professionals to gain traction in making improvements that no one can seem to envision them “happening here”. This CSB information OPENS the door for a discussion at our facility’s. The points CSB makes are to the point and well stated – we just need to ask “do any of these flaws play a role at my facility”. Don’t just ask the questions, but ask for the documentation that supports the fact that these issues have been PROPERLY addressed.