Process Safety: Shutdown Failures
Wednesday, September 23, 2015 @ 10:09 AM gHale
It was over 20 years ago when an ammonium nitrate explosion at Terra Industries in Iowa left 4 dead and 18 injured. The incident showed major issues in the process safety management (PSM) regimen during a shutdown. While this tragic incident happened over two decades ago, it still resonates today.
When it comes to safety incidents, there are the huge incidents that live on forever like Bhopal, India or BP Texas City to name a few.
But then there are other incidents that go relatively unnoticed, but prove to be learning experiences. In an occasional series, ISSSource will edit reports about incidents that showed how a small mistake, or series of mistakes, led to a big safety incident. This installment will look at the Terra Industries ammonium nitrate blast that showed workers need to monitor equipment during a shutdown.
A massive explosion occurred in the ammonium nitrate (AN) portion of Terra Industries’ fertilizer plant in Port Neal, IA, Dec. 13, 1994.
The explosion occurred after the process had been shut down and ammonium nitrate solution was left in several vessels. Multiple factors contributed to the explosion, including strongly acidic conditions in the neutralizer, application of 200-psig steam to the neutralizer vessel, and lack of monitoring of the plant when the process was shut down with materials in the process vessels. Serious damage to other parts of the plant caused the release of nitric acid into the ground and anhydrous ammonia into the air.
The plant produced nitric acid, ammonia, ammonium nitrate, urea, and urea-ammonium nitrate. Ammonia from the urea plant off-gas or from ammonia storage tanks ended up added to the neutralizer through a sparger in the bottom of the vessel, and 55 percent nitric acid added through a sparging ring in the middle of the vessel. The product, 83 percent AN, went to a rundown tank via an overflow line for transfer to storage. A pH probe located in the overflow line controlled the nitric acid flow to the neutralizer to maintain the pH at 5.5-6.5. The temperature in the neutralizer was at 267°F. The neutralizer and rundown tank vented to a scrubber, where the vapors ended up absorbed by 55-65 percent nitric acid and makeup water to produce 50 percent ammonium nitrate. A stream of 50 percent AN recycled back to the neutralizer.
About two weeks prior to the event, workers found the pH probe in the overflow line to be defective, at which time the plant switched to manual pH sampling. Two days prior to the event, the pH measured at 1.5 and did not make it back into the acceptable range until about 1 a.m. on Dec. 12.
The AN plant shut down at 3 p.m. Dec. 12 because the nitric acid plant was out of service. At 3:30 p.m., operators purged the nitric acid feed line to the neutralizer with air. At 7 p.m., operators pumped the scrubber solution to the neutralizer. Then, 200-psig steam (which is around 387°F) went in through the nitric acid feed line to the nitric acid sparger to prevent backflow of AN into the nitric acid line. The explosion occurred at 6 a.m. Dec. 13.
AN can become more sensitive to decomposition, deflagration, and detonation at low pH levels, at high temperatures, in low-density areas (e.g., in areas containing gas bubbles), in confined spaces, and in the presence of contaminants, such as chlorides.
Calculations showed the nitric acid line clearing would have lowered the pH at the time of the shutdown to about 0.8. The steam sparge was left on for 9 hours, providing enough heat to raise the solution to its boiling point in about 2 hr. The air and steam sparge created gas bubbles in the solution. Chlorides, carried over from the nitric acid plant, were also present in the AN solution.
The Environmental Protection Agency (EPA) investigation concluded the conditions that led to the explosion occurred due to the lack of safe operating procedures.
There were no procedures for putting the vessels into a safe state at shutdown, or for monitoring the process vessels during shutdown. The EPA found other producers either emptied the process vessels during a shutdown or maintained the pH above 6.0. Also, other producers either did not allow steam sparges or, if steam sparges ended up used, there was direct supervision by operators.
The EPA also noted no hazard analysis had been done on the AN plant, and personnel interviewed “indicated they were not aware of many of the hazards of ammonium nitrate.”
Operating procedures need to cover all phases of operation. In this event, the lack of procedures for shutdown and monitoring the equipment during shutdown led operators to perform actions that sensitized the AN solution and provided energy to initiate the decomposition reaction.
Because there had been no hazard identification study, personnel did not know about the conditions that sensitize AN to decomposition.
A hazard assessment of the shutdown step would have revealed the pH of the neutralizer could not end up measured if there was no solution flowing through the overflow line, and the temperature of the neutralizer could not be accurately measured without any circulation in the tank. A complete hazard identification study would have covered backflow of ammonium nitrate into the nitric acid line, and better design solutions could have been identified.
The Terra Industries incident is a good case in point to show where failures of process safety management (PSM) systems can be deadly and costly.
Major accidents have emphasized the need for process safety within the chemical and petrochemical industries. For example, the founding of the Center for Chemical Process Safety (CCPS) was a response by industry to the methyl isocyanate release at Bhopal, India, in 1984 that killed over 2,000 people and injured tens of thousands. A fire and explosion at a PEMEX LPG terminal in Mexico City, also in 1984, killed more than 600 people and injured around 7,000.
Major environmental damage also occurred because of process safety incidents. The firefighting efforts during a fire in a Sandoz warehouse in Basel, Switzerland, in 1986 caused the release of different chemicals, including pesticides, because responders failed to contain the water runoff. The release caused massive destruction to aquatic life in the Rhine River as far as 250 miles away; fishing ended up banned for six months. The environmental consequences of the Exxon Valdez spill in 1989 and the Deepwater Horizon incident in 2010 have been well-documented.
Accidents almost always have more than one cause. For quite a few years, safety experts have used the Swiss cheese model to help managers and workers in the process industries understand the events, failures, and decisions that can lead to a catastrophic incident or near miss. According to this model, each layer of protection is depicted as a slice of Swiss cheese, and the holes in the cheese represent potential failures in the protection layers, such as:
• Human errors
• Management decisions
• Single-point equipment failures or malfunctions
• Knowledge deficiencies
• Management system inadequacies, such as a failure to perform hazard analyses, failure to recognize and manage changes, or inadequate follow-up on previously experienced incident warning signs
Incidents are typically the result of multiple failures to address hazards effectively — represented by the holes in successive slices aligning. A management system may include physical safety devices or planned activities that protect and guard against failure. An effective PSM system has the effect of reducing the number of holes and the sizes of the holes in each of the system’s layers, thereby reducing the likelihood that they will align.
This was an excerpt from a report written by Albert Ness from the Center for Chemical Process Safety. He had 39 years of experience with Rohm and Haas, GE Plastics, the Dow Chemical Co., and ABS Consulting as a research and development engineer in plastics, agricultural chemicals, and ion exchange resins, and then, starting in 1989, as a process safety specialist.