Earlier this year I was asked to participate in an incident review involving a flashfire/explosion in a tote-filling process. (NOTE: the official term is an Intermediate Bulk Container or IBC) As I have written about many times, the #1 cause of these flash fires/explosions inside a container/vessel is the generation of static electricity; but this incident occurred in a tote was that “purged with Nitrogen” (N2). So how can a container/vessel that is purged with N2 have a flashfire/explosion? Simple… the N2 purge was NOT designed to ensure the atmosphere inside the container was lower than the flammable’s Limiting Oxygen Concentration (LOC), also called Limiting Oxidizer Concentration and Minumum Oxygen Concentration (MOC). Over the past several years we have come across a number of facilities who were using Nitrogen as their “sole savior” against all flammable liquid container/vessel fires/explosion. Be damned to good engineering practices/design – let’s splash fill or fill the container faster to improve the efficiency of the process… after all, nothing can happen because we have an N2 purge. This line of thinking and actions cost a business over $900K in damages and a lot of lost business when their “tote filling line” erupted into flames one night. How could this happen with an N2 purge?
We sat down at the table and having already known what had happened and the supposed “safeguards” at play, I asked to see the “design basis” for the N2 purge and the room fell silent. Eventually, the question was asked… “What the H_LL (his emphasis not mine) is an N2 Purge Design Basis?“
So what is an N2 Purge Design Basis and why did their purge not work?
Nitrogen is an inert gas and it works very good at keeping atmospheres “inert” (e.g. not enough oxygen to support life); however, not having enough O2 to support life and preventing ignition of flammable gases/vapors is altogether different worlds! We, humans, need at least 19.5% Oxygen to function properly, but most flammable gases and vapors can ignite with only half that much oxygen in the atmosphere. And such, Toluene (the flammable being filled into the totes in this incident) needs only around 9-10% oxygen to burn when in an N2 inert atmosphere. So here is how this incident went down…
NOTE: this is being shared with the anonymous client’s permission in the hopes that it may prevent others such incidents.
First, most flammable liquids are handled/stored/processed in atmospheric vessels and this comes with a HUGE challenge when trying to inert the headspaces of these vessels. As we fill the vessel, the headspace atmosphere exits the vessel via a vent, but as we pump liquid out of the vessel, the vent allows outside air (e.g. 20.8% Oxygen) to enter the headspace atmosphere of the vessel. So our “design basis” MUST take these two (2) basic acts into its design; with filling the vessel and agitating the vessel being MUCH HIGHER risks than emptying the vessel.
How does an operator know their headspace is below the LOC? This implies we need to measure the Oxygen levels in the vessel BEFORE the operator does certain tasks. Heck, most of my clients these days have alarms and interlocks on their N2 purge safety systems; but at the very minimum, the operator MUST have some process indicator that the “safeguard” has achieved its intended function before proceeding with his/her filling/agitation/etc.
In the case of the “tote-filing” incident, the process was originally designed and constructed for filling 55-gallon drums, which the facility had done incident-free for over 12 years (i.e. the entire life of the process). This filling process was NOT a PSM/RMP process due to the OSHA exemption 1910.119(a)(1)(ii)(B). When the customer asked if the facility could fill totes as well as drums, the obvious answer was… “well, of course, we can”. After all the process had the ability to be SAFELY modified to to fill totes – it was just never modified as they always had filled drums… safely for 12 years. Yes, they liked to tout their safety record of 12 years with no incident!
Being that this “simple filling process” (their words) was not one of the facility’s PSM/RMP covered processes, no MOC was conducted on the changes that were made to the process so that totes could be filled. Engineering, or EHS, was not asked to get involved and the modifications were made within the Department and Maintenance.
The Department Manager, the person who made the decision on his/her own, did not fully understand the hazards of Toluene (a NON-Conductive flammable liquid) or the design basis for the N2 purge system that had been used on the drum filling for the past 12 years. The facility had filled totes before in another building with a very similar filling process, but that process involved alcohol and was part of a covered process and was managed much differently.
The N2 Purge system was based on a timer and this time was based on the volume of a 55-gallon drum, not a 330-gallon tote. The N2 purge would occur for a fixed period of time BEFORE the flow began and during the filling operation. The manufacturer, who specializes in flammable liquid fill stations, had it’s “design basis” for the 55-gallon drums and it was done quite nicely. But when the facility began filling totes a number of ignorant errors were made that resulted in a large loss (luckily no injuries).
Error #1 – with the larger tote, the N2 purge was not “on” long enough as the timer was still set for filling 55-gallon drums. Post-accident testing indicated, at best the atmosphere inside the tote may have gotten down to 15% before the “splash-filling” commenced. Toluene has a LOC of 9.5% in an N2 atmosphere, so 15% oxygen was plenty to create a flammable atmosphere within the tote.
Error #2 – the drums that had been filled for 12-years were metal drums that sat directly on the metal overflow pan which was directly grounded. The totes being filled were plastic internal with wire mesh support and because the tote base was too large for the filling area, it did not sit down inside the fill basin like the drum(s) and thus the path to ground was greatly compromised.
Error #3 – due to the increased fill times for the larger totes, the facility increased the flow rate of the NON-CONDUCTIVE flammable liquid well beyond its SAFE UPPER LIMIT for NON-CONDUCTIVE flammable liquids. In essence, they wanted to fill a tote at the same rate as they were filling 55-gallon drums. This mistake is actually how they also escaped this incident with no injuries, as the worker was away from the tote doing other things when the flashfire/explosion occurred – when filling drums the worker was at the drum(s).
Error #4 – due to the original set-up intended for drums, the totes would not properly align under the “filling spear” (e.g. dip pipe) so it could not be used. To compensate for this, instead, the facility used a make-shift hose that would be laid across the top of the tote and just hung inside the tote man-way. This, in my professional opinion, was the BIGGEST error as this “splash filling” at a flow rate WELL ABOVE the 15ft/sec maximum for a non-conductive flammable liquid is what generated the ignition source inside the tote.
So we had a NON-CONDUCTIVE flammable liquid with a Flashpoint of around 40F being pumped at 3X’s the speed it should have been on a winter day with an ambient temperature of 49F and was being delivered to a PLASTIC TOTE that had highly questionable bonding and grounding and was “splash-filled” with a N2 purge designed for 55-gallon drums and that were adequately grounded/bonded and the flow rate was LESS THAN the suggested flow rate for this NON-CONDUCTIVE flammable liquid (for 12-years). And we wondered why we had an incident with this modified process? My only question was why did it take two (2) months to happen? My answer… WINTERTIME arrived and the ambient conditions made Toluene a perfect hazard for this setup!
This incident, if there ever was one, is a perfect example of why I NEVER allow clients to put all their proverbial risk eggs in the N2 purge/blanket basket! It seems many have drifted from sound engineering practices that have been around for 50+ years (e.g. dip legs, flows, bonding/grounding) to relying on an N2 purge/blanket to cover all our bases. This is an INSANE way of looking at flammable liquids/gases process safety. An N2 purge is a nice ADDITIONAL LAYER of Protection, but we MUST never fully rely on it as our sole PREVENTION safeguard against a flashfire/explosion.
Lastly, when we have an N2 purge/blanket as a safeguard, we MUST manage this “safety system” almost like its an entirely different “covered process”. This means we need PSI, PHA/Evaluations of LOPC and Lack of delivery, SOPs/SWPs, Training, MI inspection/testing, etc. on our N2 system. If this is a “leased system” then it is incumbent upon us to ensure that the supplier is doing all the above AND we would still use their materials in our SOPs. And don’t forget, ANY CHANGE to our N2 system MUST be done via a MOC review – so the supplier MUST be in the loop so they know that any change they wish to make to “their system” MUST be communicated to the facility and they MUST participate in the MOC review.
Bottom line… if we claim our N2 purge/blanket as a safeguard (regardless of PSM/RMP applicability) then we MUST have a design basis AND understand the design and its LIMITATIONS.
This N2 FLOW design basis MAY work well for certain containers/vessels and NOT WORK AT ALL on LARGER containers/vessels.
The N2 FLOW design basis MAY work well for certain flammable liquids/gases and NOT WORK AT ALL on other flammable liquids/gases.
The N2 GAS may work well for certain flammable liquids/gases and WORK POORLY on flammable liquids/gases.