DOI: 10.3303/CET25117088 Paper Received: 15 January 2025; Revised: 11 March 2025; Accepted: 23 April 2025 Please cite this article as: Kukuczka P., El Boustani M., Villemur C., Masse F., Lacome J.-M., Becu E., Bolvin C., 2025, Preventing Inadvertent Mixing During Chemical Unloading Operations, Chemical Engineering Transactions, 117, 523-528 DOI:10.3303/CET25117088 CHEMICAL ENGINEERING TRANSACTIONS VOL. 117, 2025 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Fabrizio Bezzo, Flavio Manenti, Gabriele Pannocchia, Almerinda di Benedetto Copyright © 2025, AIDIC Servizi S.r.l. ISBN 979-12-81206-17-5; ISSN 2283-9216 Preventing Inadvertent Mixing During Chemical Unloading Operations Patricia Kukuczka*, Marguerita El Boustani, Claire Villemur, François Massé, Jean- Marc Lacome, Emma Becu, Christophe Bolvin French National Institute for Industrial Environment and Risks (INERIS), rue Jacques Taffanel, 60550 Verneuil-en-Halatte, France patricia.kukuczka@ineris.fr Two or more products are said to be “chemically incompatible” when their contact leads to the occurrence of a chemical reaction, which is likely to generate accelerated corrosion, a fire, a release of energy with an increase in pressure and/or temperature, an explosion or the dispersion of a toxic cloud... Accidental mixing of incompatible chemicals during unloading operations can lead to severe industrial accidents, with significant risks for safety and environment. The wide variety of substances and reactions that can occur on an industrial site, generating hazardous phenomena of varying intensity on the one hand, and the complexity of the causes leading to these incompatible mixtures on the other hand, make it difficult to assess the severity and probability of these scenarios, and hence the acceptability of the risks according to regulatory requirements. This article presents the work being done in France to evaluate and manage the risks related to incompatible mixtures during unloading operations on industrial facilities. This study presents an analysis of historical accident data (ARIA, eMARS, FRED) and proposes a risk management framework based on the bow‐tie approach. The methodology includes a detailed accidentology study, identification of initiating events (delivery error and destination error) and an evaluation of safety barriers. This approach must be preceded by a detailed study of the products concerned and the inadvertent mixtures to avoid. Results indicate that the majority of incidents involve the generation of toxic gases (notably chlorine) and are mainly due to human error and organizational failures. The paper concludes with recommendations for improving unloading procedures and enhancing safety practices. 1. Introduction Several accidents have occurred worldwide due to accidentally mixing chemical components said to be ‘chemically incompatible’, such as on 21 October 2016 in Kansas, where an error in unloading led to sulfuric acid mixing with sodium hypochlorite (CSB, 2017). The mixture of the two chemicals produced a cloud containing chlorine and other components. Consequently, over 140 individuals sought medical attention, and thousands were ordered to shelter in place due to the release of toxic clouds. On 16 February 2017 in Germany (ARIA 49285), hydrochloric acid was spilled into a sulfuric acid tank during ship unloading. The resulting exothermic reaction led to the rupture of the tank and the emission of a cloud of toxic sulfuric acid, several hundred meters wide, which drifted over the town. Breathing difficulties were experienced by 150 people, 5 of whom were taken to hospital. During unloading operations, as demonstrated by the accidents mentioned above, the chemical incompatibility of the unloaded material with a product contained in a storage capacity can generate a strong gas production with the possible formation of toxic products within the storage and/or a rise in temperature and pressure. A significant increase in pressure within the storage tank due to the high gas production may cause its rupture. A tank's total loss of integrity may result in liquid products to spread on the ground with the evaporation of vapors (potentially toxic and/or flammable) and/or pollution. The risk assessment must consider these operations of loading carefully and unloading as a scenario of potentially incompatible mixtures. Currently, incompatible mixtures are complex to predict, making it difficult to anticipate this risk. A review of European and even international practices (Ineris, 2019) showed that the 523 prevention of incompatible mixtures in Europe is more frequently achieved by regulations and guides relating to worker protection laws and safety reports (equivalent to hazard studies). For example, the problem of incompatible mixtures during unloading operations is a significant concern for worker safety (Netherlands) and for preventing human error in Italy. It turns out that Germany is the only country with specific rules for preventing incompatible mixtures during the transfer of sodium hypochlorite. In France, it is the Environment Code which gives the regulatory and legislation framework for industrial risk management and introduces the provisions to carry out hazard studies. Since 2017, within the framework of a collaborative project with managers of industrial risk assessment and the French Ministry of Environment, Ineris, the National institute for industrial environment and risks, has been developing research to address this issue and help industry stakeholders to better assess industrial risk and predict incompatible mixtures. This paper summarizes the work done to achieve a method for considering the risk of incompatible mixtures during unloading operations in industrial chemical risk assessment in France. An analysis of past accident data is presented in the first part. This study allowed us to identify the most frequent accident scenarios linked to chemical incompatibilities. The safety barriers implemented to prevent these scenarios, and the related probability study are presented in the second part. Based on the findings from this safety barriers’ study, various hazard studies carried out by Ineris, and with the support from the Ministry of the Environment and from several industrial risk managers, Ineris has proposed best practices for unloading operations to reduce the risks. They are presented in the third part. 2. Analysis of accidentology In a first approach, experience feedback helps to identify the causes of accidents and the consequences of incompatible mixtures during unloading operations. An analysis of 72 accidents due to incompatible mixtures during unloading operations from 1953 à 2019 has been carried out using data extracted from the ARIA (French database on technological accidents) and the European eMARS databases. The events were classified according to: − The types of incompatible mixtures (e.g. sodium hypochlorite/hydrochloric acid, sodium hypochlorite/sulfuric acid, etc.). − The primary causes (such as human error, poor design, errors in documentation, etc.). Sodium hypochlorite or bleach is very often involved in an incompatible mixture, as shown by the following statistics extracted from the 72 analyzed accidents: − Sodium hypochlorite / Hydrochloric acid: 24 % − Sodium hypochlorite / Sulfuric acid: 16 % − Sodium hypochlorite / Acetic acid: 16 % − Hydrochloric acid / Sulfuric acid: 16 % − Sodium hypochlorite / Ferric chloride: 13 % − Sodium hypochlorite / Sodium bisulfite: 5 % − Sulfuric acid / Sodium bisulfite: 5 % − Hydrochloric acid / Nitric acid: 5 % In most of the cases, the incompatibility reactions that occur produce one or more gaseous reaction products. Most of these are chlorine, as the statistics in figure 1 show. Figure 1: Gaseous reaction products released during the accidents analyzed Excluding the uncertain or unknown causes of the 72 accidents identified, 57 events could be analyzed. Human error and organizational failure alone account for more than two-thirds of the causes of unloading accidents 524 identified. If errors occurred or had consequences, it was often due to poor design of the installation (lack of information on the tanks, lack of Foolproof System), or due to a chain of errors or actions that were not carried out or not correctly carried out (incorrectly completed document, failure to check contents, etc.). The accident analysis revealed that only one case linked to an error from the supplier’s side, who delivered an unwanted product to a manufacturer led to an incompatible reaction. Analysis of the 57 events reveals the following causes: - Poor design of the unloading area: absence of a retention tank, only one padlocked cabinet for two incompatible products, padlocked cabinets but the same key for all the cabinets, proximity of two incompatible product discharge outlets, single connection point or problem with the tightness of pipes and valves. - Irregular labeling of unloading points or discharge outlets and storage tanks: masked or erased, insufficient for formal identification, illegible, absent, or common system not applied across the site. - Failure to check connections. - Failure to check delivery documents. - Misunderstanding between the driver and site personnel when locating unloading sites. - Failure to accompany the driver to the unloading site. - Delivery outside site opening hours or on the wrong date. - The absence or inadequate training of drivers or the person in charge of deliveries. - Non-existence of or non-compliance with the unloading procedure. Non-compliance with procedures is generally a response to superior and organizational constraints, such as time pressure or production, or to multi-tasking situations. Analysis of the 72 accidents enabled to identify accidental hazards that occurred as a result of incompatible mixing. In 90 % of cases, a toxic dispersion occurred, but pollution, overpressure, and exothermic reaction phenomena were also encountered. Besides, the formation of gas and the build-up of pressure inside a tank may lead to breaches and even ruptures. A more detailed study of the accidental hazards caused by incompatible mixing and modelling of the associated hazardous phenomena is developed in the next paragraph. From the analysis of the accidentology, the two following accident situations can be considered as representative to lead to incompatible mixtures: 1. A product loading error occurred at the supplier's premises. The transporter arrived at the site with a product that was not expected and/or was incorrectly identified. 2. The carrier arrives at the site with the expected product. However, the product is deposited in the wrong tank containing an incompatible product. This is therefore a tank error or an error in the content of the tank. 3. Potential accidental hazards generated by incompatibility mixing After the analysis of the types of incompatible mixtures and the main primary causes of accidents involving incompatible mixtures during unloading operations in the previous section, the accidentology analysis focused on the different types of accidental hazards when incompatible mixing occurs. Indeed, the chemical incompatibility of the product spilled with a product contained in the storage capacity can generate a strong gaseous production with the possibility of formation of toxic products within the storage and/or a rise in temperature and pressure. Gas may first be released into the atmosphere through a vent, continuously releasing a plume or cloud. If the gas is toxic, it would disperse and dilute in the atmosphere, generating toxic effects on humans and the environment. If the pressure build-up in the storage tank is significant, due to the high gas production resulting from the chemical reaction between incompatible products, it may cause the storage tank to rupture or burst pneumatically. But if a tank loses its integrity, then liquid products would spread over the ground and could lead also to pollution with the evaporation of vapors (potentially toxic and/or flammable) depending on the characteristics of the products and on the mixing conditions (temperature, composition, etc.). In order to assess the severity of these events, especially in the framework of regulatory requirements, there is a need for modelling these events in terms of impacts for human, goods and environment. The usual method of modeling accidental hazards involves balancing the chemical reactions involved in order to determine the mass flow rate of reaction products produced by incompatible mixtures. In the absence of information on the kinetics of the reactions and their exothermicity on a real scale, which must be studied on a case-by-case basis, Ineris commonly assumes that the gases generated are instantaneously released into the atmosphere. In the case of sudden increases of temperature and pressure in the tank during the incident, the phenomena of pneumatic bursting and fire can be considered depending on the characteristics of the products and the tank. 525 Determining the source term to characterize the release (release rate, chemical composition, release temperature, etc.), combined with toxicity thresholds and the use of an accidental atmospheric dispersion model, makes it possible to obtain effect distances on humans. 4. Safety barriers and probabilities Based on accident data, literature and observations made during various studies carried out for manufacturers using chemicals, safety barriers have been identified to prevent the occurrence of incompatible mixtures or to limit and mitigate the consequences of incompatible mixtures. In order to ensure the relevance and the requested performance of these safety barriers to reach an acceptable risk level according to regulatory requirements, a generic bow-tie of incompatible mixtures during unloading operations was developed (Ineris, 2012). The bow-tie diagram is used as a visualization tool of risks to study in detail the conditions under which accidental hazards may occur and their possible effects. Bow-tie diagram is the combination of a fault tree and event tree representations around a central unwanted event (ERC), with primary causes on the left and consequences on the right. 4.1. Inventory of safety barriers Five safety barriers deemed relevant from practices observed in the field have been selected: 1. Control of the truck's orientation on site, from the entrance to the unloading area/connection point. 2. Checking of the transport documents and/or of the labelling to verify consistency between the point of delivery/unloading area and the content of the truck. 3. Sample analysis and authorization to continue the procedure. 4. On-line analysis of product to be delivered or analysis in premix tank. 5. Anomaly detection coupled with the stopping of the unloading. It can be noticed that some safety barriers consist exclusively in technical elements, while others mix human and organizational components. Safety barriers can only be considered in the risk assessment process once their performance has been demonstrated. These barriers must comply with the general criteria set out in the French decree of 09/29/2005. For each safety barrier, a number of key points need to be taken into consideration in order to justify the barrier's performance, which are independence, efficiency, response time, reliability and maintain performance over time (Ineris, Omega 10, Omega 20). For example, the independence criteria of the safety barrier can be ensured in two ways: - The safety task is performed by a different person from the one who carried out the operation: this corresponds to a form of “organizational” independence. - The safety task is part of a work sequence different from the operating one: this corresponds to a form of “temporal” independence. According to safety barrier standards, foolproof systems cannot be considered as effective safety barriers. Nevertheless, their use is considered a good practice for reducing the probability of product error during unloading operations. 4.2. Probability estimation Several methods are possible for estimating the probability of creating an incompatible mixture during an unloading operation. This probability can be determined directly from the hazardous event “incompatible mixture during unloading” by using databases such as the British FRED (HSE, 2019) database or deduced from the frequency of initiating events using bow-tie diagrams. In our case, the central unwanted event is the incompatible mixing during unloading from a tanker truck into a tank. The two accident situations identified through accidentology can be translated in the bow-tie into the following two initiating events: - Delivery error: the product in the tanker is not the one expected. - Destination error: the tanker contains the expected product but has not been connected to the right tank. Estimation of the probability based on the central unwanted event The British database FRED provides the frequency of occurrence of an accident linked to a mixture of incompatible products during an unloading operation as a function of the level of risk control implemented on the industrial site. The three levels of risk control are defined as follows: 526 - Below average: The procedure for receiving and unloading a tanker on the site is not well supervised. The connection lines to the tanks for unloading are not locked, spaced out and correctly identified. Detection systems are sometimes used. - Average: The procedure for receiving and unloading a tanker on site is well written. The connection lines to the tanks for unloading are locked and correctly identified. Coding systems are always used. - Above average: The procedure for receiving and unloading a tanker on site is well written. It is also clear that the site is taking steps to maximize and increase the safety of this operation. The connection lines to the tanks for unloading are locked and the keys are controlled. The lines are spaced out and correctly identified. Detection systems are always used. Probability estimation of initiating events The probability of incompatible mixing from the initiating events can be determined by using bow-ties. Two types of data are required for quantification: the frequencies of the initiating events and the confidence levels of the safety measures. A representation of a bow-tie with the two initiating events, delivery error and destination error, is shown in figure 2. The analysis of past accidents shows that connection to the wrong tank is the most critical event in terms of frequency, because it is the most representative. In comparison, the delivery of a wrong product is possible, but less frequent. Figure 2: Bow-tie of incompatible mixture when unloading from a tanker truck into a reservoir 5. Good practices in the field Based on past accidents analysis, risk assessment through hazardous phenomena characterization, safety barriers analysis, bow-tie representations and observations on industrial sites, it has been possible to identify good practices for unloading operations to avoid incompatible mixtures. Figure 3 below illustrates the operation of unloading chemicals into two nearby tanks designed to hold two different and potentially incompatible products. Figure 3: Example of pump unloading 527 The following good practices have been observed: - On site, the unloading operation is carried out in the presence of the driver and a site operator, according to an internal procedure, a control checklist and a signed work permit. - On arrival at the industrial site, the documents presented by the driver are checked at reception desk to ensure that the expected delivery matches the contents of the tanker. - Accompanying the tanker truck from its arrival at the site reception to its connection to the unloading circuit follows a very precise procedure, which also involves various control and analysis stages: checking that the volume to be unloaded matches the available volume in the tank, analyzing a sample to verify the conformity of the product present in the tanker truck, etc. - Similarly, filling the tank and checking the dedicated sensors, as well as disconnecting the system, are carried out in several phases described in the internal unloading procedure. 6. Conclusion and outlook This work aimed at taking better account of the risks associated with incompatible products coming into contact during a tanker unloading operation. An analysis of accidentology on events related to incompatible mixtures during unloading operations reveals that in 90 % of cases, the phenomenon generated by incompatible mixing is the dispersion of toxic gas, and sodium hypochlorite is very often involved (75 % of cases). To prevent this risk, five main barriers have been identified on sites in France, which enable to reduce the risk of the two following initiating events: 1. Delivery error (product delivered is not what was expected). 2. Destination error (the product delivered is the right one, but not connected to the right tank). The probability of creating an incompatible mixture can be estimated by distinguishing three levels of risk control using existing databases or determined by creating bow-ties. This work led to the development of a range of tools for the French authorities and industry to facilitate risk analysis of mixtures of incompatible products during tanker unloading. In addition, Ineris is currently carrying out an experimental study on different scales as part of the GRICHIM project, started in 2022 aiming at studying the risks related to mixing between hydrochloric acid and bleach involving Ineris, the ministry of environment and funded by industrials. Based on experimental tests from laboratory scale to full scale, this project aims at creating a refined tool for calculating the emissive source term (the flow of toxic gas) generated by a mixture of incompatible substances in the event of an unloading error. References Analysis, research and information on accidents database, n°49285, www.aria.developpement- durable.gouv.fr/accident/49285/ from the Bureau for Analysis of Industrial Risks and Pollutions, France. Decree of September 29, 2005 on the assessment and consideration of the probability of occurrence, kinetics, intensity of effects and severity of consequences of potential accidents in hazard studies for classified facilities subject to authorization, France. European approach to mixtures of incompatible products or substances during tanker unloading operations, Ineris, Ineris-177963-1969696-1.0. December 2019 (in French). European Commission database, eMARS, emars.jrc.ec.europa.eu/en/emars/accident/search. HSE (Health and Safety Executive), 2019. FRED (Failure Rate and Event Data) for use within Risk Assessments, UK. Key lessons for preventing inadvertent mixing during chemical unloading operations, U.S. Chemical Safety and hazard investigation Board (CSB), December 2017. Omega 10 - Performance evaluation of engineered safety barriers, Ineris, 2018 (in French). Omega 20 - Assessment of Human Safety Barriers, Ineris, 2009 (in French). 528 http://www.aria.developpement-durable.gouv.fr/accident/49285/ http://www.aria.developpement-durable.gouv.fr/accident/49285/ 18kukuczka.pdf Preventing Inadvertent Mixing During Chemical Unloading Operations