Microsoft Word - 1.docx CHEMICAL ENGINEERING TRANSACTIONS VOL. 77, 2019 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Genserik Reniers, Bruno Fabiano Copyright © 2019, AIDIC Servizi S.r.l. ISBN 978-88-95608-74-7; ISSN 2283-9216 Learning from Reactive Chemicals Incidents at Dow Klaas B. van Gelder Geography Leader Reactive Chemicals,Dow Benelux N.V., H.H. Dowweg 5, ADD-1/BLDG 446, 4542 NM Hoek, The Netherlands kbvangelder@dow.com Chemical facilities and laboratories typically handle and store hundreds of different chemicals. Many of these chemicals are flammable, toxic, reactive or otherwise hazardous. Often, chemicals require specific conditions to handle or store them safely or have maximum shelf life requirements. Knowledge of the properties and hazards of the chemicals in the facility is key to prevent incidents. Most companies have developed a Process Safety program to identify these hazards and implement layers of protection to prevent incidents. But despite all these efforts, incidents still happen. When accidents do happen, it is important to investigate which layers of protection failed, to prevent the event from happening again and to share the learnings within the company - or even within the chemical industry. This paper discusses Dow’s Reactive Chemicals Program and how learnings from incidents are distributed within the company and describes two Reactive Chemicals incidents that occurred – and were shared - within Dow. 1. Introduction Chemical facilities, whether large scale production facilities or laboratories, typically handle and store hundreds of different chemicals, including raw materials, intermediates, utilities and final products. Raw materials supplied in bulk, by truck, railcar or ship, are typically unloaded into to storage tanks. Chemicals that are not supplied in bulk, like IBC’s, drums or jerry cans, are usually stored in warehouses or storage cabinets in laboratories. Many chemicals require special handling and storage conditions regarding the head space atmosphere or temperature to maintain stability and to prevent potentially hazardous situations. Production facilities use the raw materials to produce the final products. This is done under carefully controlled conditions in reactors that are designed to control the energy release and potential pressure generation. Feeds to the reactors are often pretreated to remove potential catalyst poisons or other trace materials that can adversely affect the final product. The reactor effluent is led through finishing trains to recover materials that can be recycled in the process as well as to assure product quality. The quantities of the chemicals involved can be enormous, and the complexity of the operation can increase the risk that a significant incident could occur.Although laboratories use much smaller quantities of chemicals, these chemicals can be toxic, flammable, highly reactive or explosive. Manual operations are more common in laboratories than in production facilities, adding to the risk of human error as well as human exposure. Knowledge of the properties and the hazards of the chemicals that are used, and the chemistry that is practiced, is key in both production facilities and laboratories to prevent accidents. Most companies have included a Reactive Chemicals component in their Process Safety program. Historically, Dow has developed a separate Reactive Chemicals Program that is closely aligned with - and overlaps with - the company’s Process Safety program. Although the chemical industry spends a lot of time, effort, and money on the prevention of accidents, they still happen. Investigating these accidents to find the root cause, implementing corrective actions to prevent them from happening again and leveraging the learnings across the company should be an integral part of any safety program. This paper discusses Dow’s Reactive Chemicals program in general, emphasizing a few key topics and discusses how learnings from incidents are shared within the company. A few examples of incidents that occurred within Dow, including their root causes and preventive actions, are presented as well. DOI: 10.3303/CET1977072 Paper Received: 12 January 2019; Revised: 26 May 2019; Accepted: 27 June 2019 Please cite this article as: van Gelder K., 2019, Learning from Reactive Chemicals Incidents at Dow, Chemical Engineering Transactions, 77, 427-432 DOI:10.3303/CET1977072 427 2. Dow’s Reactive Chemicals Program The Reactive Chemicals Program (Frurip 2012) at the Dow Chemical Company has been in place for over 50 years and has evolved into a leading industry model (CCPS, Guidelines for Hazard Evaluation Procedures 2008). The program was initiated in the late sixties and is based on the Global Reactive Chemicals Standard, a short document that can be considered as the constitution of Dow’s Reactive Chemicals Program. More detailed requirements are documented in the Loss Prevention Principles (LPP’s) and the Operating Discipline Management System (ODMS). The Reactive Chemicals Program focuses on preventing reactive chemicals incidents. A strong management system is in place with effective requirements and tools. These include, but are not limited to, training, expectations for new leaders, review of changes, scenario identification, incident investigation, maintaining corporate memory, layers of protection analysis and regular Reactive Chemicals, and Process Hazard Analyses for all facilities that handle chemicals, including laboratories. The Reactive Chemicals Program as a whole is owned by the Process Safety Function. The day-to-day execution of many aspects of the program is the responsibility of the Reactive Chemicals Function, a group of dedicated experts who provide a variety of services to assist Dow’s businesses and functions to identify and manage reactivity and flammability hazards associated with the chemicals in their processes and facilities. This is done using a wide range of tools, from literature searching to testing and modeling. In addition, the Reactive Chemicals Experts support the different types of safety reviews that are required, assist in defining layers of protection, provide training and deliver seminars on diverse topics related to safe handling and storage of hazardous chemicals. They also provide support for Reactive Chemicals incidents through the Reactive Chemicals Immediate Response work process (Frurip et. al. 2009). Dow’s Reactive Chemicals Program is based on three principles: prevention, knowledge, and owner responsibility. The goal of the program is to prevent situations that can put people, equipment, or the environment at risk. Second, we want to know how much energy is present in our systems and the conditions under which this can be released so that we are able to define sufficient layers of protection to prevent incidents. Finally the owner is responsible for identifying the hazards related to the chemicals in the facility - as well as the chemistry that is practiced - and to take sufficient measures to prevent incidents. In this context the owner is defined in a very broad sense. In principle, every employee owns the Reactive Chemicals Program to some extent. Most of the requirements in the Reactive Chemicals Standard will be familiar to anyone working in the chemical industry. However, the way they are implemented at Dow may be different from how these are implemented in other companies. 2.1 New Leader Review The Reactive Chemicals Standard requires that every new leader completes a New Leader Review within 90 days after accepting responsibility for the facility. This New Leader Review assures that the leader has sufficient knowledge of the properties and hazards of the chemicals handled in the facility, the chemistry practiced and of the layers of protection that are in place to prevent incidents. After this review, the leader is authorized as final approver for all changes. Included in the New Leader Review are the worst case scenarios in the facility, key protection layers identified from risk assessments such as Layer of Protection Analysis (LOPA), mechanical integrity performance/key areas of concern, and the incident history of the facility and the technology. Key members of the review team are Reactive Chemicals and Process Safety experts. Depending on the facility and the technology, experts from EH&S, R&D, Engineering or the business/technology may also join the review. A typical review can take up to a full day and includes a presentation by the leader, who is expected to discuss the above mentioned topics, complete an extensive questionnaire, and demonstrate an understanding of operations during a walk-through of the facility. This requirement assures that facility leaders quickly learn the hazards associated with operating the facility and emphasizes Dow’s commitment to safety. Although preparations for this review are intensive and time- consuming, most leaders see this as a very valuable process because it forces them to become familiar with all the safety related aspects of the facility within a short period of time. 2.2 Management of Change Changes to existing facilities can create significant hazards if they are not properly managed (Kletz 2001). The Reactive Chemicals Standard requires that every change that is not like-for-like follows the Management of Change (MOC) process. In general, three levels of change are recognized. Level 1 changes are low level changes that can be reviewed and approved locally. Level 2 changes have a larger impact and need a more extensive review, including an independent reviewer. These changes can only be approved by the Facility Leader or his 428 delegate. The last level is the Potential Significant Impact (PSI) change, a change that has the potential to seriously affect people, the facility, the environment or the business. In addition to local expertise, these changes require the inclusion of an independent reviewer who is not associated with the change, as well as the inclusion of technical subject matter experts, as appropriate. In addition, these PSI changes can only be approved by the Facility Leader after he or she has passed the New Leader Review. The MOC process is web-based and ensures that changes are properly classified and are reviewed by the required experts. A decision tree to determine the change level is part of the MOC tool. Different areas of expertise are involved in the review as needed (e.g., hardware, software, procedures or chemistry). Every facility has predefined experts in these areas that can be assigned as reviewers. The reviewers are automatically assigned by the tool and the reviewers are notified. Each reviewer is presented with a standard list of questions that have to be answered before a final decision can be made. Every reviewer has to approve the change before it can be implemented. The Global Reactive Chemicals Standard requires that every change is reviewed for potential Reactive Chemicals hazards. Therefore, a Reactive Chemicals review is a fundamental part of the MOC process. 2.3 Incident Investigation and Learning Experiences Despite all these efforts, reactive chemicals incidents still happen. The Reactive Chemicals experts can be involved during an incident to help mitigate it, or after the incident to support the root cause investigation. Every Reactive Chemicals Incident is investigated. Learnings from root cause investigations are shared within the technology, the business or globally, as appropriate, to make sure that these events will not happen again. The Global Reactive Chemicals Standard requires that learnings from historical incidents that are relevant to the technology are remembered and part of the Reactive Chemicals training program. Three communication formats are used to share learnings. The first format is a “One Page Learning Experience Report.” This is a single page document describing the incident, the consequences, the learnings from the Root Cause Investigation and the preventive measures that were defined to prevent reoccurrence. Leaders are expected to review the report and leverage the information within their facilities, as applicable. Key questions posed are “Can this happen in your facility?” and “What can you do to prevent this?” The second format is “Global Learning Experience Report.” This is an extensive report of the incident and the Root Cause Investigation, usually accompanied by a full PowerPoint presentation and cause and effect diagram. Leaders are expected to discuss these reports with their teams and evaluate if sufficient layers of protection are available to prevent this type of incident in their facility. The third format is a “Call to Action.” This approach is used if prompt, specific actions are required throughout the corporation to prevent a similar event. This format contains a list of required follow-up actions. The actions are assigned to the facility leaders and are expected to be completed on a specific timeline. Follow-up is tracked through a web-based action tracking tool. 3. Learning from incidents As previously discussed, Dow’s comprehensive Reactive Chemicals program includes the analysis of incidents as well as the sharing of learnings. The incidents below were selected as examples to share in this paper because either the incident is either viewed as a potentially common issue in the chemical industry or is seen as a rare incident that carries worthwhile learnings. 3.1 Shelf life management Many chemicals have a maximum shelf life, after which time the chemical should be destroyed. The concept of maximum shelf life applies to monomers in which the inhibitor is slowly consumed over time, but also to chemicals that are known to form peroxides in contact with air. Although these hazards are well known and are part of the standard hazard assessment process, implementing an effective management system to ensure that chemicals are disposed of before their shelf life expires, or those that do exceed their shelf life are properly disposed of, is still a challenge. Description During an inspection a number of bottles with chemicals that are known to form peroxides were discovered in the back of a cabinet. A number of these bottles contained visible solid crystals near the lid. Some of these bottles had exceeded their shelf life by years. Reactive Chemicals experts suspected that the crystals were peroxides. Due to the potential explosivity and shock sensitivity of the crystalized material, the lab was evacuated, and the bomb squad removed the bottles in full protective clothing and detonated them at a safe location. Fortunately, nobody from the inspection team that found the bottles was tempted to move or open 429 them. After the incident, a Global Call to Action was distributed. Every laboratory leader was required to a) initiate a thorough inspection of the lab, specifically looking for chemicals that had exceeded their shelf life, b) document the known peroxide formers in the lab and c) ensure that the operating discipline was in place to properly manage adherence to the shelf life of potentially unstable chemicals. 3.2 Vacuum Tower Metal Packing Fire Description After a short shutdown, operations was preparing to start up the plant. As part of these preparations, the distillation tower was being pre-conditioned. The tower operates under vacuum, with a bottom temperature in the 200-220 oC range. The column contains 2 sections of structured packing. The tower was pre-heated and was under vacuum (~20 mbar) overnight, awaiting start-up. Unknown to operations, a small leak in the seal of the bottom pump allowed air to enter the tower. Because the column was not in operation, the vacuum pumps had sufficient capacity to maintain the vacuum conditions inside, and the pressure did not increase enough to trigger an alarm. Most likely, the packing was not clean and contained some organic contaminants. These ignited upon contact with air and started smoldering. Due to the low heat transfer capacity at the prevalent conditions, the temperature continued to rise until the packing itself was ignited. The smoldering fire went unnoticed until the shell of the column, weakened by the very high internal temperatures, collapsed and broke the vacuum. The tower collapsed vertically downward by approximately 1 meter, but did not fall over because the piping at the top provided sufficient support. The collapse, followed by a rush of cold air, most likely extinguished the smoldering fire. A survey of the damage indicated temperatures in excess of 1520 oC had been present in the column. Fortunately, nobody was injured in this incident. Causes and learning A root cause investigation identified causes including the following: • High heat input into the reboiler: heating to pre-condition the column was a manual operation. There was no automatic control logic to position the steam valve to the reboiler during this operation. During pre-conditioning, the temperature at the bottom went up well above the intended level of 200 oC. • High surface area of the tower packing: this is a desired condition in operations. However, the high surface area reduced the self-ignition temperature of the organic components present in the column and enhanced the oxidation of the underlying metallic packing. • Less than adequate follow-up on high/low temperature alarms: the control system that was used allowed several alarm conditions to be combined into one alarm. For this tower, the high and low temperature alarms were combined in a single alarm setting. Shortly after the fire was initiated, the alarm activated. The operator wrongly assumed that the alarm was triggered by low temperature because the steam flow to the reboiler had been stopped just before. He did not investigate which condition triggered the alarm. • Bottom pump allowed to run dry: there was no interlock in the control logic to prevent the bottom pump from running dry. When preparing the column for operation while repeatedly flushing and emptying the column; most likely, the pump had run dry repeatedly, damaging the seal. Learnings from this incident include the realization that packing fires can occur in vacuum columns with a high surface area packing; this was a different set of conditions from the more widely recognized scenario when the column is opened and intentionally exposed to air. During normal operation, if a small amount of air leaks into a column, any energy that is released by oxidation reactions may quickly dissipate due to the intense heat and mass transfer within the column. However, if there is no reflux (or the column is experiencing severe maldistribution), organic material that is present on the high surface area packing can self-heat and eventually Figure 1: the collapsed shell of the tower 430 ignite resulting in a packing fire. In particular, column clean-up/start-up/shut-down procedures should be assessed to determine if the “wrong” set of conditions can plausibly develop at any point during the transient operations. Combination alarms should be avoided whenever possible. If combination alarms are unavoidable, when acknowledging such an alarm the operator should always confirm what the actual alarm condition is and act accordingly. Assuming’ is not sufficient! 3.3 Deflagration to Detonation Transition in an Ethylene Pipeline Description Maintenance was being done on a pipeline that was normally used to transport ethylene. At two locations about 350 m apart, a number of valves and bleeders had to be changed, requiring line opening and hot work (grinding and welding). The first location was a booster station connected to a valve station; the second location was a measuring station. The 6” main line was pigged and flushed with nitrogen a few days before the incident. The piping at the booster station was cleared of ethylene by means of a ground flare. Once the line was cleared, the valves marked with a star (see Figure 2) were closed to separate the booster station from the main pipeline. The bleeders in the booster loop were closed; the other bleeders remained open. Data analysis later showed that the pressure in the booster station piping slowly increased again to ~7 bar, most likely caused by evaporation of small pockets of liquid ethylene. This pressure slowly decreased by about 0.3 bar over the next 2 days. During this period, the Motor Operated Valves (MOV’s) were open and the booster station piping was separated from the main pipeline by a single manual valve. Before the work started, all valves were closed. Grinding of the bleeder near the booster station (marked with a red circle in the picture) most likely ignited a small amount of ethylene that had diffused into the pipeline over the course of time. The deflagration transitioned into a detonation. The sound and pressure wave traveled through the pipeline to the measuring station. Two workers were present at that location. One worker was injured. There were clear signs of a pressure wave exiting the pipe, and workers in the immediate area said they heard a sharp sound, like an explosion or a like door slamming shut. There was no evidence of a flame exiting the open end of the pipeline, but some cloths and an umbrella that were laying around were blown away. The contractor doing the grinding mentioned that he heard a ‘sizzling’ sound and a simultaneous ‘boom’ in the distance. Causes and learnings The root cause investigation focused on finding each of the elements of the fire triangle. The ignition source was identified as the grinding that was done to remove the bleeders. The oxidizer was readily identified as air that entered the section of piping over time through the open bleeders. The day-night temperature cycle and the line being open at both ends contributed to air entering the pipe. The fuel was obviously ethylene. The extensive investigation identified the following root causes: Figure 2: schematic representation of the two locations Figure 3: Schedule of the bleeder. 431 • The sequence of clearing the piping at the booster station was inadequate and allowed ethylene to contaminate piping sections that were already cleared. The clearing sequence resulted in piping sections, containing ethylene at elevated pressure, to be separated by a single valve from already cleared sections at ambient pressure. This single valve was leaking and was the source of the ethylene that ignited. • Sampling was not representative of the composition inside the pipeline. The design of the bleeder did not allow the tube from the tester to enter the pipeline and capture a representative sample of the contents of the pipe, resulting in a negative test (no flammables present). Key learnings and action items from this incident: • Evaluate all procedures for clearing (sections of) pipelines of flammable materials to ensure that inerted and non-inerted sections of pipe are not separated by a single valve. • When samples are taken preceding hot work, it should be ensured that these samples are representative of the contents of the equipment that will be subject to the hot work. 3.4 Assuming instead of checking Description Five 1 m3 Intermediate Bulk Containers (IBC’s) of 1-Methyl-2-Pyrrolidone (NMP) were ordered. When the IBC’s arrived, the Certificate of Analysis (COA) was checked against the order, and the first IBC was checked and properly labeled to contain NMP. It was then assumed that all IBC’s were the proper material and the shipment was accepted. The IBC’s were unloaded and stored in the designated area, marked NMP. The NMP was intended as a solvent for cleaning equipment. Prior to the cleaning operation, the IBC’s were picked up, transported to the process area, and pumped into the equipment. When the third container was being unloaded into the equipment, an operator passed by and noticed that the container was not labeled ‘NMP;’ rather, the label mentioned a different type of amine. Upon further investigation, three of the five containers were found not to contain NMP - and one had already been unloaded. Fortunately, this did not result in a hazardous situation because the products were not reactive. Causes and learnings Two independent lines of defense failed. First, when accepting the raw material, an assumption was made that all IBC’s were fine because the first one was properly labelled and in accordance with the COA. Second, when the IBC was picked up to be loaded into the equipment, it was assumed that the IBC contained NMP because it was located in the designated storage area and the label was not checked. A key learning was to never ‘assume’ anything; always check! 4. Conclusions An effective safety management program, that includes identification and quantification of potential hazards as well as implementing layers of protection, is essential to ensure safe operation of chemical facilities, whether they are laboratories or world-scale production facilities. A key part of the safety program is learning from incidents that happen in spite of the ongoing efforts to prevent them. These incidents should be investigated to find the root causes and the learnings should be shared within the company, or even the chemical industry, to prevent them from happening again. References CCPS, Guidelines for Hazard Evaluation Procedures, 3rd ed., Center for Chemical Process Safety, New Jersey: John Wiley & Sons, Inc. (2008). Frurip, D.J., The Essential Elements of a Successful Reactive Chemicals Program, Chemical Engineering Transactions, 26, 2012, pp. 1-6. Frurip D.J., K. Bakkum, H. Johnstone, K.B. van Gelder, Amy Tesolin-Gee, Brian Vallieu, Reactive Chemicals Emergency Response and Post-event Calorimetric Testing, Process Safety Progress 29(1):2-10, January 2009 Kletz T, Learning from Accidents, Third edition 2001, Gulf Professional Publishing, Oxford, United Kingdom 432