Cascading Failures vs Failing Safely

In the world of Human Factors, we have a saying, “failing safely,” which translates into… all humans make mistakes – it’s our job to identify those error/mistake traps and design work to lessen those error opportunities.  In Process Safety we used to use the phrase “cascading failures”, which is the opposite of “failing safely.”  In a cascading failure scenario, it is the perfect example of Heinrich’s Domino Causation model where the first domino falls, hitting the next domino, and the chain of events continues as there is nothing in place to stop it.

In the recent CSB investigation report, we see this cascading failure in the images taken at the time of ignition to the end of the event:

⇒

Most safety pros are familiar with “fire walls” and how they are a physical barrier to prevent (or at least slow the movement) the spread of fire in an area.  But not all “safety barriers” are physical barriers.

The CSB found the following, which allowed this event to escalate/cascade into a much larger consequence:

1. Pump Mechanical Integrity
   • ITC did not have a formal mechanical integrity procedure in place that defined requirements for maintaining the mechanical integrity of Tank 80-8 and its associated equipment, including the Tank 80-8 circulation pump. A formal mechanical integrity program for pumps in highly hazardous chemical service could have prevented this incident by providing ITC with additional opportunities to identify pump issues prior to the incident. The mechanical seal on the pump failed on March 17, 2019, allowing butane-enriched naphtha product to release from the pump while it continued to operate.
2. Flammable Gas Detection Systems
   • Tank 80-8 was not equipped with a flammable gas detection system to warn personnel of a hazardous atmosphere resulting from loss of containment from the tank or its associated equipment. In 2014, a hazard review team recommended the addition of flammable gas detection systems near Tank 80-8; however, ITC did not implement this recommendation and did not document why it was not implemented. Without a flammable gas detection system, there were no alarms to alert personnel about the initial release of butane-enriched naphtha product around the Tank 80-8 piping manifold. Consequently, the butane-enriched naphtha product continued to release from the failed pump for approximately 30 minutes, completely undetected, before its flammable vapors eventually ignited.
3. Remotely Operated Emergency Isolation Valves
   • Tank 80-8 and the other aboveground storage tanks in the First & Second 80’s tank farm were not equipped with remotely operated emergency isolation valves (ROEIVs) designed to mitigate process releases remotely from a safe location. The primary drivers for identifying the need for this type of equipment would have been through the implementation of hazard assessments, such as those required by OSHA’s Process Safety Management (PSM) standard and the U.S. Environmental Protection Agency (EPA) Risk Management Program (RMP) rule, as well as insurance company audits and/or corporate risk evaluations results. On the day of the incident, the large volume of butane-enriched naphtha product contained in Tank 80-8 could not be remotely or automatically isolated, and it continued to release via the failed pump, fueling the fire that continued to intensify around the tank. As the Tank 80-8 fire intensified, flames from the fire spread to adjacent tank piping manifolds in the tank farm and eventually compromised the equipment, causing breaches in piping that allowed the hydrocarbon and petrochemical products contained in the storage tanks to release into the common containment area.
4. Tank Farm Design
   • Although the First & Second 80’s tank farm was designed largely in accordance with applicable National Fire Protection Association (NFPA) 30 requirements, elements of the tank farm design, including
     • tank spacing,
     • subdivisions,
     • engineering controls for pumps located inside the containment area, and
     • drainage systems

made it difficult for emergency responders to slow or prevent the spread of the initial fire and allowed the fire to spread to other tanks within the tank farm.

While NFPA 30 defines minimum requirements for tank farm design, additional industry guidance documents provide more robust tank farm design recommendations. While ITC was not required to implement additional industry guidance recommendations, many of which were developed after the construction of the First & Second 80’s tank farm, implementation of such recommendations could have prevented the escalation of this incident.

CAUSE

The CSB determined that the cause of the incident was:

the release of flammable butane-enriched naphtha vapor from the failed Tank 80-8 circulation pump, which accumulated in the area and ignited, resulting in a fire.

Contributing to the severity of the incident was:

1. The absence of a flammable gas detection system to alert the operators to the flammable mixture before it ignited approximately 30 minutes after the release began,
2. The absence of remotely operated emergency isolation valves (ROEIVs) to safely secure the flammable liquids in Tank 80-8 and the surrounding tanks in the First & Second 80’s tank farm.
3. Elements of the tank farm design, including tank spacing, subdivisions, engineering controls for pumps located inside the containment area, and drainage systems also contributed to the severity of the incident by allowing the fire to spread to other tanks within the tank farm. The resulting accumulation of hydrocarbon and petrochemical products, firefighting foam, and contaminated water in the secondary containment area ultimately contributed to a breach of the containment wall and a release of materials to the local waterways.

Finally, the CSB determined that because of the atmospheric storage tank exemption contained in the OSHA PSM standard and the flammability exemption contained in the EPA RMP rule, ITC was not required to develop and implement a formal PSM program for Tank 80-8 and its associated equipment that could have provided a process to identify and control the specific hazards that resulted in this incident, which also contributed to this incident.

CLICK HERE to see the full CSB Report