DOI: 10.3303/CET2291027 Paper Received: 17 January 2022; Revised: 15 March 2022; Accepted: 13 May 2022 Please cite this article as: Scotton M.S., Barozzi M., Copelli S., 2022, Detailed Reconstruction and Safety Analysis of a Pre–seveso Accident, Chemical Engineering Transactions, 91, 157-162 DOI:10.3303/CET2291027 CHEMICAL ENGINEERING TRANSACTIONS VOL. 91, 2022 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Valerio Cozzani, Bruno Fabiano, Genserik Reniers Copyright © 2022, AIDIC Servizi S.r.l. ISBN 978-88-95608-89-1; ISSN 2283-9216 Detailed Reconstruction and Safety Analysis of a Pre–Seveso Accident Martina Silvia Scotton, Marco Barozzi, Sabrina Copelli* Università degli Studi dell’Insubria, Dipartimento di Scienza e Alta Tecnologia, Via Valleggio 9, 22100, Como (Italy) sabrina.copelli@uninsubria.it Industrial safety has been a topic of growing interest during the last decades, mainly because of the increased awareness and knowledge about safety issues. In this framework, the detailed reconstruction of the dynamics of an explosion (1 killed and 8 injured) occurred, on the 26th of June 1971, at Noury Italy (a plant dedicated to the production of chemicals for hardening plastics) is worth of interest and it could be used to improve actual safety guidelines related to the storage of peroxides. The accident happened before whatever Seveso Directive release. Therefore, root-causes reconstruction and related risk assessment were carried out making a comparison between a hypothetical plant layout at that time and a modern plant layout implemented with minimum safety systems, such as acoustic alarms and adequate bypass lines. The accident reconstruction was carried out by doing a deep literature research, mainly based on newspaper clippings of the time, to both re- model the accident at best and draw the most likely layout of the plant. The latter is of fundamental importance to carry out a risk assessment procedure by applying the Recursive Operability Analysis (ROA), which allows for a direct generation of the fault trees that can provide an easy estimation of the probability of occurrence of all unwanted events. This method was applied to the Noury Italy case study to show the criticalities of the storage equipment also underlining the possible improvements which could be implemented also in the ‘70s, therefore preventing the fatal explosion. 1. Introduction In this work an accident caused by a huge dust explosion occurred in the summer of 1971 at the Noury plant, located near Varese (Italy), was reconstructed, and analyzed. The reconstruction of both the event and the plant layout at that time was based upon information retrieved principally from newspapers and testimonies. The accident occurred before the introduction of the Seveso Directive but after the introduction of the first hazards identification techniques (e.g., HazOp by ICI). The risk assessment analysis was applied on both the original plant and an “ideal” plant, implemented with suitable protection systems, to be able to compare the reduction of the probability of occurrence of the explosion in the case of adoption of minimum safety measures. The plant was dedicated to the production of a variety of plastics through hardening agents. As it was not exactly known which kind of organic peroxide was used and stored at Noury Italy, it was assumed the use of benzoyl peroxide (C14H10O4); therefore, both the reconstruction and the safety analysis were carried out considering such a compound. It is well known that organic peroxides are unstable chemicals, making them commercially important as polymerization initiators and curing agents. The inherent instability of organic peroxides stems from their oxygen-oxygen (-O-O-) bond, known as peroxide functional group. Because of this characteristic, organic peroxides require special storage and handling precautions. As previously stated, the risk assessment was carried out for both a process layout that was potentially feasible for the ‘70s and a peroxide storage unit with minimal safety levels (also available at that time) that are required nowadays. The method used was the Recursive Operability Analysis (ROA), a method that can be used to easily identify Top Events probabilities for industrial accidents. Results showed that the use of proper safety devices can highly increase process safety, leading to much lower probabilities. 157 2. Materials and methods The Hazards Identification step of the Risk Assessment for the plant was carried out by applying a Recursive Operability Analysis (ROA), which is a very powerful technique capable of being applied to a variety of different industrial sites to identify both hazards and accidental scenarios, especially those ones related to combustible dusts (Barozzi et al., 2020; Scotton et al., 2021). This method requires, at first, to identify nodes and process variables to fill in a ROA-Table (see Table 1). Such a Table exhibits some differences with respect to a classical HazOp Table; particularly, the information related to Node, Deviation and Variable are merged into a single column and, moreover, causes and consequences are interconnected in a structured way based upon the principle of causality. Table 1: Standard ROA table (Barozzi et al., 2020) Rec NDV Causes Consequences due to protections failure Plant state with protections working correctly Protections Notes TE Manual Automatic safety systems actions Alarm (optical/acoustic) Operator actions on components 1 2 3 4 5 6 7 From each row it is possible to generate a Cause Consequence Diagram (CCD) following the method proposed by Contini et al. (2016). Finally, combining all the Incidental Sequences Diagrams (ISDs) coming from the CCDs related to a given Top Event detected in the analysis, the final Fault Tree is obtained. The final Fault Tree can be analyzed using dedicated software, such as OpenFTA 1.0 (Formal Software Construction Ltd, Cardiff, UK), which was applied within this work. 2.1 Case study The explosion occurred inside a low temperature warehouse, devoted to the storage of the organic peroxide, at 8:15 am of the 26th of June 1971. It was estimated that inside the depot, at that time, 3000 kg of organic peroxide were stocked; after the accidental ignition, a violent explosion occurred razing to the ground the entire factory and causing 1 dead and 8 seriously injured people, also with important damages to the surrounding structures. A governative Italian organization reported that the economic loss was estimated about 700 million of Italian Lire, which could be compared to an equivalent of 6 million euros today, assessed against the inflation (Istat - Rivaluta). The scheme of the low temperature warehouse was reconstructed as shown in Figure 1. In Figure 1a the original 1971 layout is reported; while in Figure 1b a modified version, which includes minimum safety devices (a bypass line activated by an interlock, I-01), is reported. The main components of the plant are: a low temperature warehouse (CF-01), an evaporator unit (E-01), a compressor group (C-01), a condenser (CO-02), various filters (F-01, F-02) and a lamination valve (VL-01). A list of all the process variable involved is reported in Table 2. a b Figure 1: Scheme of the Noury chiller (a) and layout of the modified process (b) 158 Table 2: Variables involved in the analysis Variable ID Description F Refrigerating Fluid Flowrate [L/min] TCF Temperature inside the Refrigerated Unit (CF-01) T1 Temperature of the Refrigerating Fluid entering the Evaporator (E-01) T2 Temperature of the Refrigerating Fluid exiting the Evaporator (E-01) T3 Temperature of the Refrigerating Fluid exiting the Compressor (C-01) T4, in Temperature of the Refrigerating Fluid entering the Lamination Valve (VL-01) T4, out Temperature of the Refrigerating Fluid exiting the Lamination Valve (VL-01) T4, bis Temperature of the not compressed Refrigerating Fluid sent directly to VT-04 The explosion was supposed to be caused by an increase of temperature inside the cooled warehouse, probably due to the blockage, during the night, of the compressor group, as reported by local newspapers. Failing the compression of coolant, the temperature in the chiller raised, reaching the threshold of the Self - Accelerating Decomposition Temperature (SADT) of the stored peroxide. Indeed, the SADT is the lowest temperature at which a product in a typical package will undergo a self-accelerating decomposition. The decomposition of an organic peroxide is an exothermic reaction which can trigger and accelerate the decomposition of the remaining peroxide. The resulting reaction can be violent, and the heat generated might ignite flammable vapors. Table 3 shows an extract of the complete ROA Table, related to the chiller unit (Node 1). Table 3: ROA Table for Chiller Unit (Node 1) Rec NDV Causes Cons. due to Protections Failure Plant state with protections working Protections Notes TE Manual Automatic safety devices Alarms Operator actions 1.0 1.h.TCF V-02 closed (UC-01 manual activated) OR V-02 broken closed OR 1.l.F OR 1.h.T1 Explosion due to the Organic Peroxide combustion Explosion due to the Organic Peroxide combustion - - - High T acoustic alarm which can activate emergency measures TE1 1.1 1.l.F Wearing bearings OR Leaks from welding 1.h.TCF 2.h.T2 4.h.T4,in 4.h.T4,out 3.h.T3 4.h.T4, bis 1.h.TCF 2.h.T2 4.h.T4, in 4.h.T4, out 3.h.T3 4.h.T4, bis - - - Low coolant flow rate 1.2 1.h.T1 TIC – 01 not functioning OR VT – 04 broken/no switch OR VT – 03 broken/no switch C-01 not functioning OR 4.h.T4, bis OR 4.h.T4, out 2.h.T2 1.h.TCF High temperature of the Refrigerating Fluid Entering the Evaporator The explosion, caused by the blockage of the compressor unit would have been avoided by implementing safety systems, for example installing a high temperature acoustic alarm (TAH-01), and inserting a bypass line activated by an interlock (I-01) with a second compressor unit which is enabled in the event of failure of the main 159 line. This new scheme of the depot, reported in Figure 1b, has been analyzed by applying the ROA as well, to evaluate the reduction of probability of occurrence of the explosion by making minimal changes to the layout of the plant. The analysis, related only to the TE record is reported in Table 4. Table 4: ROA Table for Record 1.0: modified plant layout Rec NDV Causes Cons. due to Protections Failure Plant state with protections working Protections Notes TE Manual Automatic safety devices Alarms Operator actions 1.0 1.h.TCF V-02 closed (UC- 01 manual activated) OR V-02 broken closed OR 1.l.F OR 1.h.T1 Explosion due to the Organic Peroxide combustion Normal Storage Conditions TAH-01 Operator intervention to restart the compressor / Securing the product I-01 High T acoustic alarm which can activate emergen cy measure s TE 3. Results and discussion At this point, ROA is complete, and it is possible to generate the fault trees for each identified Top Event. Among all the possible Top Events detected using a ROA, only fault trees related to the accident “organic peroxide decomposition and combustion (leading to an explosion)” was reported and commented. Particularly, Figure 4a reports the Fault tree related to the “1971 layout” of the plant, while Figure 4b reports the “ideal” layout suitably improved by implementing the previously reported protection devices. The generated fault trees can be solved with dedicated software, such as OpenFTA or FaultTree+ (Kritzinger, 2017). In this case, OpenFTA 1.0 was used. It is important to underline that the solution of the fault trees can be done only referencing to suitable failure rates/human errors databases. a) 160 Figure 2: Fault Trees for the Top Event “Organic peroxide combustion/decomposition”: a) original plant layout; b) modified plant layout (compressed version). Table 5 reports all the failure rate/human error values used within the present work, taken from literature databases (Bello and Colombari, 1980; Smith, 2011). Table 5: Failure rates and related probabilities of occurrence for all the basic events involved within this case study. Basic event Type of failure/event Failure/Event Rate Probability C-01 blocked Compressor Failure - 2.6E-01 Wearing of C-01 bearings Worn bearings 2-0E-5 [1/h] 1.6E-01 V-02 rupture Rupture of the pneumatic valve 3.0E-07[1/h] 2.6E-03 UC-01 open Human error - 5.0E-03 VL-01 broken Component malfunctioning - 1.0E-01 C-02 malfunctioning Component malfunctioning - 3.0E-05 E-01 malfunctioning Component malfunctioning - 3.0E-05 F-01 blocked Clogged filter - 3.0E-05 F-02 blocked Clogged filter - 3.0E-05 Leaks from welding 3.0E-09[1/h] 2.6E-05 VT-03 no switch Stuck valve - 1.0E-01 VT-04 no switch Stuck valve - 1.0E-01 TIC-01 broken Tr reading error 1.00E-06[1/h] 8.7E-03 S-01 broken Not functioning - 3.6E-02 I-01 failure Interlock fail / electrical failure - 1.0E-05 TAH-1 failure Acoustic alarm failure 6.00E-06[1/h] 5.1E-02 Omission procedure Human error - 2.0E-03 For the computation of the probabilities of occurrence, a Poisson distribution for a mission time of one year was assumed. Thus, it is possible to numerically solve the FTs, for a mission time of one year. Table 6 collects the main results obtained for the Top Event representing organic peroxide combustion followed by the explosion of the warehouse. Moreover, in Table 5, a comparison between results obtained for the analysis of the original layout and for the safety devices implemented one is reported. 161 Table 6: FTs results for the Main Top Event Basic event Original layout Modified layout # of MCS 13 26 Max order of MCS 1 3 Probability 5.34E-01 2.87E-07 From the results reported in Table 6 it is possible to notice that the probability of occurrence of the TE was unacceptable (5.34E-01) because the missing of whatever either safety protection device or procedure. The simple introduction of little plant layout modifications, that is two new protection devices and a new emergency procedure (TAH-01, I-01 and Operator intervention to restart the compressor / Securing the stored product) led to a significative decrease in the order of magnitude of the probability associated with the considered TE (6 order of magnitude). Moreover, the maximum order of the MCS changed from 1 to 3, implying an increase of the plant safety. Such evidence highlights the fundamental role of both protective (interlocks, alarms, redundance of components, bypass lines, etc..) and preventive (operator intervention on plant components to face elementary failures that do not require an immediate hardware substitution implying a plant stopping) measures, although minimal as reported in the case study presented in this work. 4. Conclusions The aim of this work, in addition to the reconstruction of the Noury accident basing only on few data recovered from local newspapers, was the determination of the probability of occurrence of the Noury Top Event with the related root causes analysis. A Recursive Operability Analysis and a Fault Tree Analysis on both the original and the modified plant layout, that is the plant complemented by the introduction of a bypass line equipped with a second compressor unit and an acoustic alarm dedicated to temperature monitoring inside the cooled warehouse, were carried out. From these analyses it was possible to demonstrate that little plant modifications, combined with an eventual inertization of the refrigerating unit with nitrogen, could have been introduced also in 1971 and would have helped to significantly reduce the probability of occurrence of the accident (or, at least, its magnitude). Moreover, it was possible to show the importance of the numerical estimation of the probability of occurrence of accidental events. In this framework, the application of the ROA for a quick and reliable analysis is very well suited. This technique can be also a powerful tool to update risk assessments following process modifications, as shown in the second analysis related to addition of the bypass line. In conclusion, the analysis reported in this work shows the importance of carrying out risk assessment to estimate the probability of occurrence of accidental events and underlines the ease of the ROA application, even in a context where it is difficult to recover all the data related to the process (ROA requires few data to obtain a reliable and complete analysis). References Barozzi M., Scotton M. S., Derudi M., Copelli S., 2020, Recursive Operability Analysis as a Tool for Risk Assessment in Plants Managing Metal Dusts, Chemical Engineering Transactions, 82, 43–48. Bello, G.C., Colombari, V., 1980, The human factors in risk analyses of process plants: The control room operator model ‘TESEO., Reliability Engineering, 1, 3–14. Contini S., Contini P. M., Torretta V., Sala Cattaneo C., Raboni M., Copelli S., 2016, Comparison of classical and cause consequence diagrams recursive operability analysis: the t2 laboratories accident, Chemical Engineering Transactions, 53, 109–114. Istat - Rivaluta [WWW Document], n.d. URL http://rivaluta.istat.it:8080/Rivaluta/ (accessed 13/12/2021). Kritzinger, D., 2017. 4 - Fault tree analysis, in: Kritzinger, D. (Ed.), Aircraft System Safety, Woodhead Publishing, 59–99. Nouryon, Safety of organic peroxides [WWW Document], 2021. URL https://www.nouryon.com/globalassets/inriver/resources/brochure-safety-of-organic-peroxides-lowres- en_us.pdf (accessed 13/12/2021) Scotton, M.S., Barozzi, M., Copelli, S., 2021. Recursive operability analysis as a tool for ATEX classification in plants managing explosive dusts. Chemical Engineering Transactions 86, 337–342. Smith, D.J., 2011. Reliability, Maintainability and Risk, 8th Edition. ed. 162