Serious Errors in the Plant Design Coupled with Incorrect - American

ARTICLE pubs.acs.org/IECR

Five Dead and Five Injured in a Dimethyl Terephthalate Plant Accident: Serious Errors in the Plant Design Coupled with Incorrect Maintenance Management N. Piccinini and M. Demichela* SAfeR, Centro Studi su Sicurezza, Affidabilita e Rischi, Dipartimento di Scienza Applicata e Tecnologia, Politecnico di Torino, Corso Duca degli Abruzzi, 24, 10129 Torino, Italy ABSTRACT: At 2:10 in the afternoon of 25 July 1968, an explosion in a tank at the SIR (Societa Italiana Resine) petrochemical industry in Porto Torres (Sassari, Sardinia) caused the death of five people and the injury of five others. This article reports the events that led to the accident and explains the analysis activities that led to the reconstruction of the dynamics of the accident. The reconstruction of the etiology of the accident has been synthesized in an Incidental Sequence Diagram, a similar logical tree to the Fault Tree, in which the serious errors in the plant design are highlighted together with the poor management of some of the maintenance works.

1. INTRODUCTION The evolution of the chemical industry throughout the world has unfortunately been studded with serious industrial accidents. Surely the not so young will remember what happened at Bhopal in India (1984), Mexico City (1984), Seveso in Italy (1976), and Flixborough in the U. K. (1974), but how many engineering students are aware of the dynamics of these accidents?1 The increase in safety culture in the world of work, which is requested by all and sundry, cannot but start from the history of the unfortunately numerous accidents that have already occurred. Each trainer or professor, within the frame of his/her topic, should present some concrete cases (bridge collapses, dam collapses, etc.) and have the students analyze them. Also for this purpose, an analysis of an explosion of a tank containing a modest quantity of methyl alcohol which caused the death of five people and the serious injury of another five (mostly due to burns) is hereafter presented. The event occurred at 2:10 p.m. on 25 July 1968 at the SIR (Societa Italiana Resine) petrochemical industry in Porto Torres (North Sardinia) which, at the time, was undergoing an important expansion. Despite many years passing, it is believed that the analysis of this serious accident, concerning both the plant design errors and the errors made in the management of the maintenance works, is still topical and lends itself well to considerations on the necessity of increasing safety culture at all levels: from the unskilled workers to those in charge of the plant, from the designers to the managers of the maintenance works. 2. PRIOR EVENTS The accident occurred because of the structural collapse of an existing tank in the “75 Monomer” plant area. This plant was used for the production of dimethylic ester of terephthali acid, which is the basic substance for the subsequent production of polyester used to obtain synthetic textile fibres. r 2011 American Chemical Society

The raw material of the synthesis process is p-xylene, which is oxidized to terephthalic acid and which in turn, having been reacted with methyl alcohol, changes into dimethyl terephthalate (DMT) and water. The thus obtained DMT is the raw material that is used to obtain polyester through polycondensation with ethylene glycol;2 this reaction took place in another plant that was not involved in the accident. It was therefore necessary, for the normal process conditions, to have stores of pure methyl alcohol, tanks to contain the mixtures of methyl alcohol, and water coming from the aforementioned reaction, distillation columns, and centrifuges for the separation of the liquid phase from the solid phase, etc. The 75-Monomer plant was new: it was started up just six months before the accident. Between July 16 and 18, 1968, the factory management decided to shut down this plant, together with all the other plants, following a serious water shortage that had affected the entire petrochemical complex. The plant foreman had therefore started the usual preliminary operations to shut down the plant between July 18 and 23, and at 4 p.m. of this last day the plant had been completely shut down with the storage tanks, full of raw material and intermediate products, being periodically breathed with inert gas, except for those involved in the plant changes that will be mentioned hereafter. Taking advantage of the shut down, the plant foreman had decided to carry out a slight modification job which involved insertion, by welding, of a new line of the length of about 15 m of carbon steel pipe with a diameter of 11/2 in., which was to connect the lock of pump P-38 and P-39 to the already existing line on the rack (dashed line in Figure 1, where the original layout drawing is shown). Special Issue: Russo Issue Received: August 3, 2011 Accepted: December 21, 2011 Revised: December 19, 2011 Published: December 21, 2011 7619

dx.doi.org/10.1021/ie201717v | Ind. Eng. Chem. Res. 2012, 51, 7619–7627

Industrial & Engineering Chemistry Research

ARTICLE

Figure 1. Lay-out of the storage tanks.

Having had verbal authorization from the management, he proceeded with the job. As can be seen from the plan in Figure 1, the pipes involved in the aforementioned job (black lines) were not directly connected to the MA-14 tank (connected to gray lines, carrying methanol), where the explosion took place. The draining operations of tank TK-19 (not shown in Figure 1), of pumps P-38 and P-39 and of the lines where the new pipe system was to be inserted had been carried out from July 21 to 23 through washing with both water and steam. The explosiveness tests carried out on the outside before the jobs were undertaken had confirmed the absence of inflammable mixtures in the surrounding area. The pipes, which went from TK-19 to pumps P-38 and P-39, had been intercepted with the insertion of 8 blind disks (blank flanges). Furthermore, all the auxiliary safety measures had been undertaken, such as covering the sewage systems and spraying the area with water to prevent the sparks produced by the welding from falling in uncontrollable points. The welding work, which was started in the morning of July 25, 1968, went on until 12 midday without any problems. In the early afternoon, at 1 p.m., the welder still had to carry out the last welding operation; when this welding job had already been finished, an explosion occurred in the MA-14 tank at exactly 2.10 p.m. It should be noted how the MA-14 tank, although not involved in any way in the work under way, had been completely emptied of its methanol contents on July 23, but had not been drained. The emptying operations were conducted in two subsequent stages: first the liquid was sucked out using pump P-59 and then the last residuals were unloaded through the bottom ball plug valve which was connected to a flexible hose. With this last operation, the extraction of the methanol from MA-14 was considered finished. It is however important to recall how a liquid film layer surely remained attached to the inside of the tank and the internal

Table 1. Typology of the Tanks Serving the 75-Momomer Plant vessel

contents

note

Western Set (from Right to Left) MA-14 TK-24

recuperated methanol DMT

TK-22

DMT

TK-10

DMT

TK-21

DMT + methanol + DMF

TK-16

distillable residuals of methanol

TK-25

unprocessed DMT

TK-23 TK-17

unprocessed DMT unprocessed DMF

TK-6

NaOH solution

exploded

unprocessed dimethyl terephthalate

Eastern Set (from Left to Right) TK-4

recuperated p-xylene

MA-5

oxidized store

MA-4

oxidized store

TK-19

adjusted methanol

TK-3 MA-6

p-xylene oxidized compounds

to be connected to the new line

atmosphere inevitably remained saturated with methanol vapor. It is also important to realize that, in the period of time between the day the tank had been emptied and the day of the explosion (in other words from July 23 to 25), the breathing network was working, and it is therefore possible that methanol, under the form of condense, could have flown back into the thank through the lateral pipe. 7620

dx.doi.org/10.1021/ie201717v |Ind. Eng. Chem. Res. 2012, 51, 7619–7627


ARTICLE

Figure 2. Mechanical scheme of the tank MA-14. (1) Breather network (N2); (2) drainage of the breather network; (3) nonomer stripping apparatus (dimethyl ester); (4) return of the bittern from the centrifugation; (5) return of the condense from the monomer fusion system; (6) return of the bittern tail ends (>55°) from the three distillation columns of the watermethanol mixtures; (7) emptying pump; (8) unloading intercepted by a manual ball plug valve; (9) upper manhole; (10) lateral manhole; (11) level control flange; (12) threaded socket for 1.500 thermometrical plug; (13) threaded socket for 1.000 thermocouple; (14) 400 hatch for level alarms; (15) external level indicator with an ethylene glycol hydraulic guard.

3. THE PRODUCTION PLANT 3.1. The 75-Monomer Plant. The area involved in the accident is made up of two sets of tanks (Figure 1) whose typology is reported in Table 1. The tanks containing the melted DMT and the MA-14 tank were caulked and supplied with a heating system made up of a coil in which hot water flowed. The MA-14 tank was also equipped with an axial rotating blade mixer. The drawing of this tank, which had a volume of 20 m3 and a weight of 3.5 t, is given in Figure 2. The plant for the production of the monomer was located in front of these two sets of tanks and it rose to a height of about 35 m over several floors. The rack for all the pipes was between the tanks and the plant at a height of +5 m. The changes that were made before the accident were carried out on some of these pipes.

A new pipe system was being installed on the methanol line which connected the TK-19 tank, through the P-38 and P-39 pumps, with ramification to the CTR-3 and CTR-5 centrifuges inside the 75-Monomer plant, to the TK-18, TK-20, and TK-21 tanks. 3.2. The Breather Network. The presence of breather networks supplied with inert gas was necessary in the plant to allow both the emptying of the liquids from the tanks to fill the emptied spaces with inert gas in order to prevent the entrance of air from the outside and to guarantee an appropriate inert atmosphere in all the different apparatus (distillation columns, drums, centrifuges, etc). There were three breather networks, two of which had the possibility of being connected to each other while one of these two was connected to the MA-14 tank by two pipes: one was 7621


Industrial & Engineering Chemistry Research the real breather pipe and the other one was for the draining of the methanol condense. Apart from being connected to all the tanks of the complex, the breather lines were also connected to the distillation column in order to allow air to escape from them. The inert gas could be made up of (as was the case under examination): carbon dioxide, combustion gas (mixtures of nitrogen and carbon dioxide), or pure nitrogen. The carbon dioxide was obtained, in the industrial complex, as a byproduct of the synthesis of ammonia, while the combustion gas was obtained from a propane gas burner and the nitrogen, which was considered as an emergency system, was obtained from cylinders bought from third parties. Usually, combustion gases were used; once they were obtained, they were pressurized and stored at 16 bar in a capacious tank. From here, after a reduction to 6 bar, the gases were distributed throughout the factory network. At the edge of the 75 Monomer plant set, this pressure was reduced to the working value of about 30 mm of H2O through two membrane valves located in series. There was a measurement and alarm system on the network at 6 atm in order to guarantee that this value was maintained. On the other hand, there was no alarm on the low pressure value. The maximum inert gas flow of the described system was 250 N m3/h. The following apparatus was also connected to the breather network, which was in direct contact with the MA-14 tank: 1. three distillation columns of an overall volume of about 150 m3 ; 2. the stripping system at a height of 8 m made up of four liquid ring pumps plus a drum with a freezing coil to condensate the methanol with return to the MA-14 tank when it was too full; 3. a 50 m3 tank containing methanol; 4. two 5 m3 tanks containing methanol; 5. the methanol vapor capturing systems, placed at a height of 25 m, one for each distillation column. From surveys carried out in order to verify the reasons for the explosion, it results that apparatus number 5 was involved in the accident. Each of these methanol capturing systems was connected to a drum surmounted by a coolant; on the top of this coolant there was a rupture disk calibrated to resist pressures a little above the operating pressure. Furthermore, a breathing valve was mounted above the drum with the purpose of preventing the distillation columns from having either low pressure or high pressure. These valves had the following set points: they allowed the inert gas to exit into the atmosphere when the network pressure was above 54 mm of H2O and allowed the external air to enter into the network for low pressures that could generate inside the plant exceeding the value of 24 mm of H2O. In normal working conditions, the 75 Monomer plant was supplied with a continuous flow of inert gas in order to compensate the different losses, which were evaluated at about 250 N m3/h.

4. DAMAGES TO THE PLANT As far as the damage to the plants caused by the explosion of the MA-14 tank is concerned, the following can be highlighted: (i) The MA-14 tank was lying, leaning toward the West and was completely uprooted from the base, moved about 30 cm toward the Northeast and turned over by 10° in an anticlockwise direction. (ii) The bottom of this tank was not only completely cut off from the base, but it was also moved toward the North by

ARTICLE

about 50 cm and turned round in an anticlockwise direction by about 15°. (iii) The internal heating coil had come out from the cut off area, toward East, by about three-quarters of its length (about 2 m). (iv) The methanol extraction pipe, connected to the tank by the P-59 pump, was completely ripped away from the P-59 pump, and was moved toward the East by about 35 cm and toward the North by about 40 cm. (v) The level indicator ball-cock had been projected outside the tank toward Southeast until it hit the P-38 pump at a distance of about 6 m from the MA-14 tank. (vi) The concrete enclosure wall (20 cm high and 12 cm thick) of the MA-14 tank, located at a distance of 1 m toward the South and 30 cm toward East from the tank, had been completely uprooted; the enclosure wall of TK-6, located at a distance of about 4.50 m, had also been uprooted. (vii) The sheet metal that covered the caulking of the MA-14 tank was almost completely wrecked. (viii) Above the tank, two connection lines between TK-16 and the 75 Monomer plant were bent upward by about 1 m. The damage done to the TK-22 tank which, together with the MA-14 tank, was one of the most damaged, is important for the reasons explained hereafter. The TK-22 tank, which had the same dimensions as the MA14 tank and which was at a distance of about 6 m from it, was lying uprooted from the base by about 10 cm; at the moment of the site visit, this was found to be filled with 1 m of solid DMT. This tank demonstrated signs of fire on the upper external part and the rupture disk had exploded. Furthermore, there was no glass peep hole (Ø 200 ) of the melted DMT supply pipe and this had caused a modest outflow of DMT on the upper part of the TK-22 cover. This peep hole glass had been removed some days before the plant had been shut down and for this reason a modest amount of melted DMT had come out and had consequently solidified on the ferrule of the tank. However, this small opening allowed the explosion fire face to enter inside the TK-22 tank and this caused the partial combustion of the DMT which was sublimed on the internal walls and on the vault of the tank.

5. CAUSES OF THE ACCIDENT In the following paragraphs a description of the field and technical data supporting the reconstruction of the accident causes are given. 5.1. Formation of the Flammable Mixture. The hazard of fire from liquid methanol or from the explosion of its vapors is remarkable, as clearly emerges from its principle chemical physical characteristics which are reported in Table 2.4 Table 2. The Main ChemicalPhysical Characteristics of Methanol

7622

boiling point

64.8 °C

lower flammability limit upper flammability limit

6.7% in vol. 36.4% in vol.

flash point

12 °C

self-ignition temperature

470 °C



ARTICLE

Table 3. State of the Connections Existing on the MA-14 Tank 1. stripping apparatus of the monomer crystals

this had never worked and, moreover, was not in contact

2. return of the bittern centrifugation water

the blind flange was closed

3. return of the methanol condense coming from the monomer fusion

the blind flange was closed

4. return of the bittern tail ends from the distillation columns 5. emptying pump line

the gate valve was closed the gate valve was closed

with the atmosphere

6. bottom discharge

the gate plug valve was closed

7. the upper and lateral man holes; the level control flange; the

regularly closed

thermometer socket; the thermoelectric pliers; the indicator and alarm hand hole

It is well-known that its combustion reaction: CH3 OH þ

3 O2 f CO2 þ 2H2 O 2

occurs without the development of smoke and the flame is therefore practically invisible. Normally, as in this case, blackening and smoking do not occur. Given the nature of the accident that occurred, it can consequently be deduced that a sufficient quantity of air, which exceeded the flammability limits, must have entered into the MA-14 tank and, furthermore, that a temperature equal to or higher than the self-ignition temperature existed at some point along the tank or in the pipe system. All the possible entrances to the MA-14 tank, as far as the entrance of air is concerned, are reported in Table 3. It can be noted how that if any of the valves or devices listed in Table 3 had been open, external air could not have entered or diffused inside the tank because of the positive pressure (30 mm H2O) that should have been encountered inside the tank and which would have been ensured by the correct functioning of the breather network. Therefore, the only possible way of access of the air into the MA-14 tank was obviously the breather network itself. As the production of inert gas was functioning regularly and no alarms sounded concerning low pressure on the mean pressure network (2° step), it has been identified that the only way air could have entered was through the two-way breather valve placed on top of the CH3OH vapor condense drum and connected to the three distillation columns. The shut-down of these columns on July 22 caused a successive rapid recall of a remarkable volume (∼150 m3) of inert gas, because of condensation of the methanol vapors contained in the columns, thus causing a drop in pressure in the arrival pipe with the consequent entrance of air through the breather valve of the breather network. This air was drawn into the tank when the MA-14 tank was emptied on July 23 and this led to the formation of an explosive mixture both inside the tank and in the inert gas supply pipes. This flow should have removed and bled the CH3OH/air mixture that had formed. In reality, this explosive mixture was still remaining inside the MA-14 tank and in the connected pipes two days later. Another way the air could have entered is through the 200 diameter hole at the top of the TK-22 tank, due to the absence of a glass peep hole, a fact to which reference has already been made in point 4. The plant workers did not realize, and at the same time could not have realized, that air was present in the pipes as they did not

have any instrument or alarm signal that could have warned them of such a situation. 5.2. Cause of the Ignition. From the verifications that were made the probable cause of the primer was the presence of a small piece of welding cord (20 mm long, 4 mm wide and 3 mm thick) on the breather pipe connected to the MA-14 tank. This material could have been left there by the welder who, intending to eliminate the waste material on the point of the welding electrode, could have wiped it on the pipe; a temperature of well above 470 °C, the temperature necessary and sufficient to provoke the explosion of the explosive mixture, is reached in the examined point, that is, in the area corresponding to the inside of the pipe during this operation. During empirical tests carried out on the same pipe and with the same electrode, an internal heating up to red heat was observed, that is, reaching up to a temperature >800 °C;5 in this way a burning area of about 2 cm2 was formed. To verify the reliability of such a primer source, but also of the times in relation to the explosion moment, the testimony given by the welder is reported: “During the morning I had welded five points on the same line. I was supposed to continue with the work that same afternoon and there was still one more welding to do. I started work again at 1p.m. o’clock and finished the welding at almost the same time the explosion occurred. The welding had been finished the first go and while I was lifting the cover, having placed the pliers......over the pipe to be welded and over my legs. It was precisely at that moment that the explosion occurred, but both things happened practically at the same time, both the end of the job and the explosion”.5 Considering that the length of the pipe system, from the point at which the welding was carried out to the MA-14 tank, was of about 12 m, and that the speed of the fire face inside the pipe could have been about 0.5 m/s, it can be deduced that about 24 s passed between the moment the pipe became red hot and the tank exploded.3 This time is congruent with both the testimony of the aforementioned welder and the fact that the welding procedure was finished.

6. DESIGN ERRORS PERTAINING TO THE 75 MONOMER PLANT 6.1. The breather network. Given the normal working conditions, the safety of the 75 Monomer plant was in particular connected to the perfect functioning of the breather network. As far as this is concerned, it is necessary to point out how (a) there was no control system or low pressure alarm system on the low pressure network, that is, the one that actually supplied all the tanks; (b) no alarm signal existed on the breather valve that would indicate when this valve was functioning in aspiration 7623



ARTICLE

Figure 3. Incidental sequence diagram (ISD) representing the accident dynamic.

mode; (c) no direct or indirect device which could signal the presence of oxygen existed in the entire breather network and in particular in the low pressure ramifications. As far as the aforementioned points are concerned, the objection could be made that the previous measures would have been superfluous as a positive high pressure of 30 mm of H2O

always existed inside the breather network. This objection cannot be considered valid for the following reasons: 1. If this had been the case, breather valves would not have been installed on the plant, but rather another type of valve (e.g., PSV pressure valves) that would be able to discharge the high pressure. 7624


Industrial & Engineering Chemistry Research 2. As the breather valve had been calibrated in such a way as to allow the breather gas to exit into the atmosphere when the pressure in the network exceeded 54 mm of H2O and, vice versa, the entrance of external air when the pressure in the network dropped to below 24 mm of H2O, it results that the difference between the positive pressure existing in the network (30 mm of H2O) and the value of the minimum low pressure of the valve (24 mm of H2O) in the most favorable conditions (that is, close to the pressure reduction station) was only 54 mm of H2O. 3. It can therefore be ascertained that the value of 54 mm of the water column constitutes a very narrow margin to consider the plant safe from the entrance of air. For example, even the simple lack of the glass from the peep hole in the TK-22 tank, as mentioned in section 4, could have been sufficient, with the pressure being brought to zero in a part of the plant, to create a stable situation of hazard. 4. It is also important to mention that the moving of a gaseous flow along a pipe created a drop in pressure at the ends of the pipe, and therefore there were surely lower pressure values than the 30 mm of H2O foreseen for the reduction stations at the entrance of the plant in the points furthest from the breather network (the breather valve was surely one of these points). Therefore, considering the previous set-point values (point 2), it results that the entire inert gas amount introduced into the breather network was consumed to replace the plant losses (e.g., the flanged joints, stuffing boxes, etc.) and not even a small amount exited from the breather valve. 5. Direct confirmation of how the breather pressure of 30 mm of H2O was a too narrow value emerges from the fact that this value increased to 250 mm of H2O after the accident. 6. As far as what has been mentioned above is concerned, it again results that the maximum functioning capacity of the breather network (250 N m3/h) was completely insufficient to rapidly drain the accidental entrance of air from the breather valve. In other words, the possible “air bubble” would not have been promptly sent out the same way it had come in, but was able to travel inside the plant and form an explosive mixture with the methanol vapors and, finally, be slowly disposed off through the circuit losses. At this point, it should be recalled how the dilution with inert gas (e.g., nitrogen) of an explosive mixture conspicuously reduces the upper limit of flammability of this mixture, but it has little effect on the lower limit. In practice, the lower flammability limit of the methanol remains almost constant at an atmospheric temperature until a dilution with nitrogen of 50% in volume occurs.6 7 Apart from what has been mentioned in point 6, the possible “air bubble” that could have formed inside the apparatus, for example, following the partial or total emptying, could have remained there for a long time because of how the plant had been constructed. In particular, the way the tanks had been connected to the breather network was conceptually wrong. The scheme of the MA-14 connection is shown in Figure 4 as an example while the appropriate connection modalities of a generic tank to both the breather network and the blow-down network are shown in Figure 5 for comparison purposes. There was no blow-down network in the 75 Monomer plant.

ARTICLE

Figure 4. Connection of the tank MA-14.

Figure 5. Correct connection of a tank to blow-down system and inert gas line.

6.2. The MA-14 Tank. The MA-14 tank had no rupture disk. This goes against good technical regulations and with what was prescribed by the Italian legislation in that period. Moreover, the tank collapsed in correspondence to the welding point between the bottom of the tank and the ferrule. In other words, there was a complete breaking off of the bottom of the tank from the cylindrical wall with dramatic consequences in terms of victims, as previously mentioned. This fact depends on the typology of coupling that was used between these two parts of the tank (see Figure 2): much simpler (a single welding cord) than the more articulated and complex one that was used between the cylindrical wall and the roof of the tank; this led to a much weaker bottom-ferrule coupling than the upper ferrule-roof one. This was a serious error that was made during the design and subsequent construction of the tank. In fact, the possible accidental increase in pressure should not have led to the dispersion of the product, but only to the uncovering of the tank. In the studied case, there would surely not have 7625


Industrial & Engineering Chemistry Research been victims if such a constructive criteria had been followed. What is mentioned above further shows how no evaluation of the risk of formation of an internal high pressure had been made at the design stage or during the construction of the MA-14 tank, so much so that it was not even equipped with a rupture disk. 6.3. The Plant in General. As far as the maintenance management aspects are concerned, it has to be noted how the pipe system of the whole plant containing hazardous and harmful liquids or gases was not marked by distinguishing colors, nor were the meaning of these markings known to the maintenance workers, for example, through the use of explicative tables.

7. ETIOLOGY OF THE ACCIDENT 7.1. Logical Connection of the Events. The logical and temporal sequences of the events that in various connected ways led to the very serious accident are reported in Figure 3 in graphic form. This sequence has been represented using an incidental sequence diagram (ISD) in which the failure of the different protection systems is highlighted.7,8 These protection systems were mostly based upon the close respect of the procedures, both in the plant and in the subsequent maintenance activities. In general, the development of an accident or any undesired event (Top Event) can be ascribed to a process malfunction and to the failure of both the automatic and manual protection systems; these may be due to different initiating events or human errors of different kinds. The representation in Figure 3 is a similar causes/consequences logical graph to the better known Fault Tree representation. The construction of these graphs proceeds downward with small logical steps from the Top Event to the initiating events, while their reading, or their numerical solution, proceeds in the opposite way: upward from the primary or initiating events. Apart from the logic gates, the INH (inhibit) gate has also been used in the described approach.9 This gate is specifically dedicated to drawing attention to the protection system: the input event of the inhibit gate becomes a more severe output if the protection system is already out of order when called to intervene and therefore does not block the evolution of the phenomenon. An analysis of the ISD in Figure 3 makes it possible to clearly examine how the etiology of the accident, and above all the seriousness of its consequences, are connected to the serious errors that were made during the plant design stage and to the disastrous management of some of the maintenance works. 7.2. Design Errors 1. The breather network was greatly under-dimensioned. It is not admissible that this network could supply a inert gas flow (250 N m3/h) at only 30 mm of H2O to the ends of the production unit set. Did the designer evaluate the residual pressure in the furthest point from the plant at a height of +35 m (the distillation column)? 2. The absence of a low pressure alarm. The only low pressure alarm of the inert gas network was placed after the first pressure reduction stage: from 16 to 6 atm . It is evident how this would cover any eventual deficiencies in the inert gas production systems at the beginning, but would be completely inefficient in the case of possible losses in pressure at the end of any part of the 75 Monomer plant. 3. The presence of a breather valve. The installation of a twoway breather valve in the uppermost part of the plant,

ARTICLE

placed there to protect it from any possible risks of crushing from the distillation columns, is evidence of the awareness of the designers of the insufficiency of the breather network. Moreover, the presence of the breather valve led to the certainty that, sooner or later, air would have entered the plant with the consequent formation of an explosive mixture. How could the designers have been so sure that such an explosive mixture would not encounter a primer? 4. The absence of an alarm system on the breather valve. Granted (but not agreed) that this valve was necessary, it did not have any alarm device that could signal its functioning in aspiration mode or the relative temporal duration. 5. Erroneous mechanical design of the MA-14 tank. Unlike the tanks close to the TK series, the MA-14 tank was not equipped with a rupture disk. Not only this, the upper part of the tank was structurally more robust than the lower part and therefore, following the increase in pressure, it was the lower part that broke off with the relative leakage of the circular flame at the ground level. This caused five people to die from mortal burns and the injury of another five. 6. Erroneous connection of the tanks to the breather network. As clearly emerges from the comparison of Figure 4 and Figure 5, a possible “air bubble” penetrating into the inside of the MA-14 tank had little to no possibility of being bled in a short time. 7.3. Errors in the Management of the Maintenance Intervention 1. The lack of drainage of the MA-14 tank was the reason why an explosive mixture formed inside the tank. Moreover, it can be seen that its contents (methanol) had been completely removed, but it had not been considered necessary to drain the tank. 2. Erroneous organization of the welding jobs. In particular the grounding cable of the welding machine was connected to the general grounding network of the 75 monomer plant at a distance of over 50 m from the welding machine itself, instead of being connected to the pipe system on which the welding was being conducted and close to it. This could have led to the formation of secondary electric arcs in some uncontrolled points (e.g., not well bridged flanged coupling). One of these arcs could have been the cause of the primer of the explosion. 3. Inadequate training of the welder concerning the nature (process fluids) of the pipe systems present on the rack and close to the newly installed one. However, leaving aside his knowledge of the plant, it is unexplainable why he proceeded with the cropping of the electrode on the pipe (600 , stainless steel) close to the breather network (70 cm) rather than on that being mounted (1.500 in carbonic steel). Moreover, the pipes on the rack were not marked with the correct color signals. 4. Inadequate protection from the fall of burning sparks. Instead of isolating the work area using fixed fireproofed protection (e.g., asbestos sheets), there was a worker there with a rubber hose who was spraying water. Unfortunately this fire protection method led to an increase in the number of victims. 5. Erroneous planning of the maintenance works. The seriousness of the accident arose from the circumstance 7626


Industrial & Engineering Chemistry Research that numerous technical teams were at work for maintenance purposes close to where the welder was working “with fire” to install the new pipe. This way of working goes against all good technical standard procedures. 6. Lack of substitution of the glass in the peep hole on the top of the TK-22 tank, which had been removed a few days previously when the plant had been shut down. This second communication route with the external environment would not only have favored the entrance of air when the TK-19 tank and then the MA-14 tank were emptied, but would also have been the cause of the formation of the explosive mixture inside the MA-14 tank; the former tank had in fact been drained with steam and filled with water while the MA-14 one had not. However, an opening with a diameter of 200 would practically reduce the pressure in the inert gas distribution network to zero in most of the remaining part of the plant. 7.4. General Lessons to Be Learned. This section summarizes some of the critical lessons acquired from the analysis of the accident,1012 drawn from the many finer points (mainly referred to design) reported in the previous sections, that, in any case, constitute important learning. Safety Measures and Control Systems. When using flammable materials it is of great importance to avoid oxidant atmospheres that may trigger an explosion; this can be achieved by the use of inert gases like nitrogen. It is also of great importance to avoid ignition sources such as static electricity, hot surfaces, or sparks originating from other operations such as welding works. For process operations, sensors to monitor the evolution of critical safety parameters identified during process analysis should be incorporated into the plant equipment. This applies not only strictly to the process variables, but also to the variables relevant for the utilities. Organizational Measures. Workers must be aware at any point of the hazards involved in chemical processes. The training must be extended to any temporary worker even if they are present in the establishment for a short time. An effective system of work permits must be used to ensure safe conditions when maintenance works are to be performed. Appropriate operating procedures must be provided, according to the process analysis. Correct labeling rules and procedures, including verification, have to be implemented

ARTICLE

found on the breather pipe can be considered reliable; on the other hand, it has been considered irrelevant to establish where the exact point of the primer was as it has been established that precautions were not taken to avoid either the formation of explosive mixtures or of generating possible primers that could have caused the accident. The study of past accidents is an effective method to learn lessons to avoid recurrence of similar situations in the future. These lessons can be related to the plant design, the implementation of safety measures, and the development of organizational systems.

’ AUTHOR INFORMATION Corresponding Author

*E-mail: [email protected].

’ REFERENCES (1) Lees, F. P. Loss Prevention in the Process Industries; ButterworthHenemann: Burlington, MA, 2001. (2) Leiza, J. R.; Asua, J. M. Copolymers. In Kirk-Othmer Encyclopedia of Chemical Technology; Wiley: New York, 2002. (3) Williams F. A. Combustion. Encyclopedia of Physical Science and Technology, 3rd ed.; Academic Press: San Diego, CA, 2003. (4) Green, D. W.; Perry, R. H. Perry’s Chemical Engineers’ Handbook, 8th ed.; McGraw-Hill: New York, 2008. (5) Piccinini N. Consulenza Tecnica: 1974 (Documents in Italian available only at the Court of Sassari, Italy). (6) Fiumara, A. La sicurezza nei processi chimici: le combustioni esplosive. Nota I.—Limiti di infiammabilita del Metanolo e dell’etere di metilico. Rivista Combust. 1971, 25, 327. (7) Piccinini, N.; Scarrone, M.; Ciarambino, I. Probabilistic Analysis of Transient Events by an Event Tree Directly Extracted from Operability Analysis. J. Loss Prev. Process Ind. 1994, 7, 23. (8) Piccinini, N.; Ciarambino, I. Operability Analysis Devoted to the Development of Logic Trees. Rel. Eng. Syst. Safety 1997, 55, 227. (9) Demichela, M.; Piccinini, N.; Ciarambino, I.; Contini, S. On the Numerical Solution of Fault Trees. Rel. Eng. Syst. Safety 2003, 82, 141. (10) Kletz, T. What Went Wrong?: Case Histories of Process Plant Disasters and How They Could Have Been Avoided; Butterworth-Heinemann: Burlington, MA, 2009. (11) Sales, J.; Mushtaq, F.; Christou, M. D.; Nomen, R. Study of Major Accidents Involving Chemical Reactive Substances: Analysis and Lessons Learned. Process Safety Environ. Protect. 2007, 85, 117. (12) Singh, B.; Jukes, P.; Poblete, B.; Wittkower, B. 20 Years on lessons learned from Piper Alpha. The evolution of concurrent and inherently safe design. J. Loss Prevent. Process Ind. 2010, 23, 936.

8. CONCLUSIONS The explosion of a tank that occurred at 2:10 p.m. on July 25, 1968 at the SIR (Societa Italiana Resine) petrochemical plant in Porto Torres (Sassari -Sardinia) is discussed in this article. The explosion caused the death of five people and another five were seriously injured. The dynamics of the event have been reconstructed through a careful and detailed technical investigation. The reconstruction of the etiology of the accident has been synthesized in an Incidental Sequence Diagram, a similar logical tree to the Fault Tree. The serious errors made during the plant design stage, but also the dreadful management of some maintenance works, have been highlighted in this diagram. Synthesizing the dynamics of the accident, it should be recalled how the formation of the explosive methanol/air mixture inside the exploded MA-14 tank was caused by the entrance of air through the breather network. As far as the nature and location of the primer point is concerned, the smear of welded material 7627


Serious Errors in the Plant Design Coupled with Incorrect - American

Recommend Documents