- Email: [email protected]
Pasadena
Appendix
Pasadena
A6.1 A6.2 A6.3 A6.4 A6.5
The Site and thePlant A6/2 Events Prior to the Explosion A6/2 The Explosion A6/2 Aft/2 The Emergency and the Aftermath Some Lessons of Pasadena A6/4
APPENDIX
6/2
PASADENA
Shortly after 1.00 p.m. on 23 October 1989, a release occurred on a polyethylene plant at the Phillips 66 Company's chemical complex at Pasadena, near Houston, Texas. Avapour cloud formed and ignited, giving rise to a massive vapour cloud explosion. There followed a series of further explosions and a fire. Twenty-two people on the site were killed and one later died from injuries, making a death toll of 23. The number injured are variously given as 130 and 300. A report on the investigation of the accident has been issued by OSHA (1990a). Other accounts include those of Mahoney (1990),T. Richardson (1991) and J.N. Scott (1992). Selected references on Pasadena are given inTable A6.1. A6.1 The Site and the Plant The Phillips works was sited in the Houston Chemical Complex along the Ship Channel, the location of a number of process companies. The plant on which the release occurred was Plant V, one of the two active polyethylene plants in the complex. The plant operated at high pressure (700 psi) and high temperature. The process involved the polymerization of ethylene in isobutane, the catalyst carrier. Particles of polyethylene settled out and were removed from settling legs. A6.2 Events Prior to the Explosion On the previous day work began to clear three of the six settling legs on Reactor No. 6, which were plugged. The three legs were prepared by a company operator and were handed over to the specialist maintenance contractors, Fish Engineering. The configuration of a typical leg is shown in Figure A6.1. At 8.00 a.m. on Monday, 23 October, work began on the second of the three blocked legs, Leg No. 4. The isolation procedure was to close the DEMCO ball valve and disconnect the air lines to it. The maintenance team partially disassembled the leg and were able to remove part of the plug, but part remained lodged in the pipe 12-18 in. below the ball valve. One of the team was sent to the control room to seek assistance. Shortly after, at 1.00 p.m., the release occurred. Although both industry practice and Phillips corporate safety procedures require isolation by means of a double block system or a blind flange, at local plant level a procedure had been adopted which did not conform to this. It was subsequently established that the DEMCO ball valve was open at the time of the release. The air hoses to the valve had been cross-connected so that the supply which should have closed it actually opened it. The hose connectors for the 'open' and 'close' sides of the valve were identical, thus allowing this cross-connection to be made. Although procedures laid down that the air hoses shouldnot be connected during maintenance, there was no physical barrier to the making of such a connection. The ball valve had a lockout system but it was inadequate to prevent the valve being inadvertently or intentionally opened during maintenance. Table A6.1
Selected references on Pasadena
Anon. (1989 LPB 90, p. 0); Anon. (1990 LPB 94, p. 30); Mahoney (1990); OSHA (1990a); Redmond (1990); Vervalin (1990b); Bond (1991 LPB 97); Kletz (1991J); T. Richardson (1991); J.N. Scott (1992)
A6.3 The Explosion The mass of gas released was estimated as some 85,200 lb of a mixture of ethylene, isobutane, hexene and hydrogen, which escaped within seconds. The release was observed by five eyewitnesses. A massive vapour cloud formed and moved rapidly downwind. Within 90-120 s the vapour cloud found a source of ignition. Possible ignition sources were a gas-fired catalyst activator with an open flame; welding and cutting operations; an operating forklift truck; electrical gear in the control building and the finishing building; 11 vehicles parked near the polyethylene plant office; and a small diesel crane, although this was not operating. TheTNTequivalent of the explosion was estimated in the OSHA report as 2.4 tons. An alternative estimate from seismograph records is 10 tons. There followed two other major explosions, one when two 20,000 USgal isobutane storage tanks exploded and the other when another polyethylene plant reactor failed catastrophically, the timings being some 10-15 rain and some 25-45 min, respectively, after the initial explosion. One witness reported hearing 10 separate explosions over a 2-h period. Debris from the explosion was found 6 miles from the site. All 22 of those who died at the scene were within 250 ft of the point of release and 15 of them were within 150 ft. Injuries which occurred outside the site were mainly due to debris from the explosion. The explosion resulted in the destruction of two HOPE plants.
A6.4 The Emergency and the Aftermath People in the immediate area of the release began running away as soon as they realized that gas was escaping. The alarm siren was activated, but the level of noise in the finishing building was such that there was a question whether some employees there failed to hear it. The immediate response to the emergency was provided by the site fire brigade, which undertook rescue and care of the injured and began fighting the fire. Twenty-three persons were unaccounted for, but for an extended period the area of the explosion remained dangerous to enter. Severe difficulties were experienced in fighting the fires resulting from the explosion. There was no dedicated fire water system, water for firefighting being drawn from the process water system. The latter suffered severe rupture in the explosion so that water pressure was too low for firefighting purposes. Fire hydrants were sheared off by the blast. Fire water had to be brought by hose from remote sources such as settling ponds, a cooling tower, a water treatment plant and a water main on a neighbouring plant. These difficulties were compounded by failures of the fire pumps. The electrical cables supplying power to the regular fire pumps were damaged by the fire so that these pumps were put out of action. Further, of the three backup diesel fire pumps one was down for maintenance and one quickly ran out of fuel. Despite these problems the fire was brought under control within some 10 h. The handling of the emergency was handicapped by the facts that the intended command centre had been damaged and that telephone communications were disrupted. Telephone lines were jammed for some hours following the accident.
PASADENA
A P P E N D I X 6/3
Reactor loop Demco. valve Flushing isobutane line
Ethylene line
,i
ii
Vent (purge)valve
Product take-off valve
Figure A6.1 Typical piping settling leg arrangement on reactor (Occupational Safety and Health Administration, 1990a) The emergency response was co-ordinated by the site chief fire officer and involved the local Channel Industries Mutual Aid (CIMA) organization, a co-operative of some 106 members in the Houston area. More than 100 people were evacuated from the administration building across the Houston Ship Channel by the US Coast Guard and by Houston fireboats; they would otherwise have had to cross the area of the explosion to reach safety. The media were quickly aware of the explosion and within an hour there were on site 150 media personnel from 40 different organizations.
The financial loss in this accident is comparable with, and may exceed, that of the Piper Alpha disaster. Redmond (1990) has quoted a figure of $1400 million, divided almost equally between property damage and business interruption losses. On the basis of a review of company reports and of the defects found during the investigation of the disaster, OSHA issued a citation to the company for wilful violations of the 'general duty' clause. The citation covered the lack of hazard analysis; plant layout and separation distances; flammable gas detection; ignition sources; building
APPENDIX
6/4
PASADENA
ventilation intakes; and the fire water system; the permit system; isolation for maintenance. A6.5 Some Lessons of Pasadena
Some of the lessons to be learned from Pasadena are listed in Table A6.2.
Management of major hazard installations The OSHA report details numerous defects in the management of the installation. Some of these are described below. Hazard assessment of major hazard installations According to the report, the company had made no use of hazard analysis or an equivalent method to identify and a s s e s s the hazards of the installation. Plant layout and separation distances The report was critical of the separation distances in the plant in several respects. It stated that the separation distances between process equipment plant did not accord with accepted engineering practice and did not allow time for personnel to leave the polyethyelene plant safely during the initial vapour release; and that the separation distance between the control room and the reactors was insufficient to allow emergency shut-down procedures to be carried out.
Location of control room As just mentioned, the control room was too close to the plant. It was destroyed in the initial explosion. Building ventilation intakes The ventilation intakes of buildings close to or downwind of the hydrocarbon processing plants Were not arranged so as to prevent intake of gas in the event of a release. Minimization of exposure of personnel Closely related to this, there was a failure to minimize the exposure of personnel. Not only the control room but the finishing building had relatively high occupancy.
Table A6.2 Some lessons of Pasadena Management of major hazard installations Hazard assessment of major hazard installations Plant layout and separation distances Location of control room Building ventilation intakes Minimization of exposure of personnel Escape and escape routes Gas detection system Control of ignition sources Permit-to-work systems Isolation procedures for maintenance Integrity of fire water system Dependability of fire pumps Audibility of emergency alarm Follow-up of audits Planning for emergencies
Escape and escape routes As already stated, the separation distances were not such as to allow personnel on the polyethylene plant to escape safely. Further, the only escape route available to people in the administration block (other than across the ship channel) was across the area of the explosion. Gas detection system Despite the fact that the plant had a large inventory of flammable materials held at high pressure and temperature, there was no fixed flammable gas detection system. Control of ignition sources The control of ignition sources around the plant was another feature criticized in the OSHA report. Permit-to-work systems The OSHA report stated that an effective permit system was not enforced for the control of the maintenance activities either of the company's employees or of contractors.
Isolation procedures for maintenance In this incident the sole isolation was a ball valve, which was meant to be closed but was in fact open. There was no double block system or blind flange. The practice of not providing positive isolation was a local one and violated corporate procedures. The implication is that it had not been brought to light by any safety audits conducted. Integrity of fire water system The practice of relying for fire water on the process water system and the failure to provide a dedicated fire water system meant that the fire water system was vulnerable to an explosion. Dependability of fire pumps The electrical cables to the regular fire pumps were not laid underground and were therefore vulnerable to damage by explosion and fire. One of the back-up diesel pumps had insufficient fuel and one had been taken out for maintenance without informing the chief fire officer. Audibility of emergency alarm As described, the level of noise in some areas was such that the employees might not have been able to hear the siren. Follow-up of audits The OSHA report criticized the company's failure to act upon reports issued previously by the company's own safety personnel and by external consultants, which drew attention to unsafe conditions. Planning for emergencies The disaster highlighted a number of features of emergency planning. The company had put a good deal of effort into planning and creating personal relationships with the emergency services, by means such as joint exercises, and these paid off. The value of planning, training and personal relations was one of the most positive lessons drawn. Another area in which a proactive approach proved beneficial was in relations with the media. Senior personnel made themselves available, and the company evidently felt it received fair treatment.
PASADENA
One weakness of the emergency planning identified was that it had not envisaged a disaster of the scale which actually occurred. The incident brought out the need to be able to respond clearly to calls from those liable to be affected about the toxicity of the fumes and smoke generated in such an event.
APPENDIX
6/5
The behaviour of rescue helicopters posed a problem. Personnel on the ground had no means of communication with them and the craft tended to come in low, creating the danger of blowing flames or toxic fume onto those below. A need was identified for altitude and distance guidelines for helicopters.
Pasadena
A6.1 A6.2 A6.3 A6.4 A6.5
The Site and thePlant A6/2 Events Prior to the Explosion A6/2 The Explosion A6/2 Aft/2 The Emergency and the Aftermath Some Lessons of Pasadena A6/4
APPENDIX
6/2
PASADENA
Shortly after 1.00 p.m. on 23 October 1989, a release occurred on a polyethylene plant at the Phillips 66 Company's chemical complex at Pasadena, near Houston, Texas. Avapour cloud formed and ignited, giving rise to a massive vapour cloud explosion. There followed a series of further explosions and a fire. Twenty-two people on the site were killed and one later died from injuries, making a death toll of 23. The number injured are variously given as 130 and 300. A report on the investigation of the accident has been issued by OSHA (1990a). Other accounts include those of Mahoney (1990),T. Richardson (1991) and J.N. Scott (1992). Selected references on Pasadena are given inTable A6.1. A6.1 The Site and the Plant The Phillips works was sited in the Houston Chemical Complex along the Ship Channel, the location of a number of process companies. The plant on which the release occurred was Plant V, one of the two active polyethylene plants in the complex. The plant operated at high pressure (700 psi) and high temperature. The process involved the polymerization of ethylene in isobutane, the catalyst carrier. Particles of polyethylene settled out and were removed from settling legs. A6.2 Events Prior to the Explosion On the previous day work began to clear three of the six settling legs on Reactor No. 6, which were plugged. The three legs were prepared by a company operator and were handed over to the specialist maintenance contractors, Fish Engineering. The configuration of a typical leg is shown in Figure A6.1. At 8.00 a.m. on Monday, 23 October, work began on the second of the three blocked legs, Leg No. 4. The isolation procedure was to close the DEMCO ball valve and disconnect the air lines to it. The maintenance team partially disassembled the leg and were able to remove part of the plug, but part remained lodged in the pipe 12-18 in. below the ball valve. One of the team was sent to the control room to seek assistance. Shortly after, at 1.00 p.m., the release occurred. Although both industry practice and Phillips corporate safety procedures require isolation by means of a double block system or a blind flange, at local plant level a procedure had been adopted which did not conform to this. It was subsequently established that the DEMCO ball valve was open at the time of the release. The air hoses to the valve had been cross-connected so that the supply which should have closed it actually opened it. The hose connectors for the 'open' and 'close' sides of the valve were identical, thus allowing this cross-connection to be made. Although procedures laid down that the air hoses shouldnot be connected during maintenance, there was no physical barrier to the making of such a connection. The ball valve had a lockout system but it was inadequate to prevent the valve being inadvertently or intentionally opened during maintenance. Table A6.1
Selected references on Pasadena
Anon. (1989 LPB 90, p. 0); Anon. (1990 LPB 94, p. 30); Mahoney (1990); OSHA (1990a); Redmond (1990); Vervalin (1990b); Bond (1991 LPB 97); Kletz (1991J); T. Richardson (1991); J.N. Scott (1992)
A6.3 The Explosion The mass of gas released was estimated as some 85,200 lb of a mixture of ethylene, isobutane, hexene and hydrogen, which escaped within seconds. The release was observed by five eyewitnesses. A massive vapour cloud formed and moved rapidly downwind. Within 90-120 s the vapour cloud found a source of ignition. Possible ignition sources were a gas-fired catalyst activator with an open flame; welding and cutting operations; an operating forklift truck; electrical gear in the control building and the finishing building; 11 vehicles parked near the polyethylene plant office; and a small diesel crane, although this was not operating. TheTNTequivalent of the explosion was estimated in the OSHA report as 2.4 tons. An alternative estimate from seismograph records is 10 tons. There followed two other major explosions, one when two 20,000 USgal isobutane storage tanks exploded and the other when another polyethylene plant reactor failed catastrophically, the timings being some 10-15 rain and some 25-45 min, respectively, after the initial explosion. One witness reported hearing 10 separate explosions over a 2-h period. Debris from the explosion was found 6 miles from the site. All 22 of those who died at the scene were within 250 ft of the point of release and 15 of them were within 150 ft. Injuries which occurred outside the site were mainly due to debris from the explosion. The explosion resulted in the destruction of two HOPE plants.
A6.4 The Emergency and the Aftermath People in the immediate area of the release began running away as soon as they realized that gas was escaping. The alarm siren was activated, but the level of noise in the finishing building was such that there was a question whether some employees there failed to hear it. The immediate response to the emergency was provided by the site fire brigade, which undertook rescue and care of the injured and began fighting the fire. Twenty-three persons were unaccounted for, but for an extended period the area of the explosion remained dangerous to enter. Severe difficulties were experienced in fighting the fires resulting from the explosion. There was no dedicated fire water system, water for firefighting being drawn from the process water system. The latter suffered severe rupture in the explosion so that water pressure was too low for firefighting purposes. Fire hydrants were sheared off by the blast. Fire water had to be brought by hose from remote sources such as settling ponds, a cooling tower, a water treatment plant and a water main on a neighbouring plant. These difficulties were compounded by failures of the fire pumps. The electrical cables supplying power to the regular fire pumps were damaged by the fire so that these pumps were put out of action. Further, of the three backup diesel fire pumps one was down for maintenance and one quickly ran out of fuel. Despite these problems the fire was brought under control within some 10 h. The handling of the emergency was handicapped by the facts that the intended command centre had been damaged and that telephone communications were disrupted. Telephone lines were jammed for some hours following the accident.
PASADENA
A P P E N D I X 6/3
Reactor loop Demco. valve Flushing isobutane line
Ethylene line
,i
ii
Vent (purge)valve
Product take-off valve
Figure A6.1 Typical piping settling leg arrangement on reactor (Occupational Safety and Health Administration, 1990a) The emergency response was co-ordinated by the site chief fire officer and involved the local Channel Industries Mutual Aid (CIMA) organization, a co-operative of some 106 members in the Houston area. More than 100 people were evacuated from the administration building across the Houston Ship Channel by the US Coast Guard and by Houston fireboats; they would otherwise have had to cross the area of the explosion to reach safety. The media were quickly aware of the explosion and within an hour there were on site 150 media personnel from 40 different organizations.
The financial loss in this accident is comparable with, and may exceed, that of the Piper Alpha disaster. Redmond (1990) has quoted a figure of $1400 million, divided almost equally between property damage and business interruption losses. On the basis of a review of company reports and of the defects found during the investigation of the disaster, OSHA issued a citation to the company for wilful violations of the 'general duty' clause. The citation covered the lack of hazard analysis; plant layout and separation distances; flammable gas detection; ignition sources; building
APPENDIX
6/4
PASADENA
ventilation intakes; and the fire water system; the permit system; isolation for maintenance. A6.5 Some Lessons of Pasadena
Some of the lessons to be learned from Pasadena are listed in Table A6.2.
Management of major hazard installations The OSHA report details numerous defects in the management of the installation. Some of these are described below. Hazard assessment of major hazard installations According to the report, the company had made no use of hazard analysis or an equivalent method to identify and a s s e s s the hazards of the installation. Plant layout and separation distances The report was critical of the separation distances in the plant in several respects. It stated that the separation distances between process equipment plant did not accord with accepted engineering practice and did not allow time for personnel to leave the polyethyelene plant safely during the initial vapour release; and that the separation distance between the control room and the reactors was insufficient to allow emergency shut-down procedures to be carried out.
Location of control room As just mentioned, the control room was too close to the plant. It was destroyed in the initial explosion. Building ventilation intakes The ventilation intakes of buildings close to or downwind of the hydrocarbon processing plants Were not arranged so as to prevent intake of gas in the event of a release. Minimization of exposure of personnel Closely related to this, there was a failure to minimize the exposure of personnel. Not only the control room but the finishing building had relatively high occupancy.
Table A6.2 Some lessons of Pasadena Management of major hazard installations Hazard assessment of major hazard installations Plant layout and separation distances Location of control room Building ventilation intakes Minimization of exposure of personnel Escape and escape routes Gas detection system Control of ignition sources Permit-to-work systems Isolation procedures for maintenance Integrity of fire water system Dependability of fire pumps Audibility of emergency alarm Follow-up of audits Planning for emergencies
Escape and escape routes As already stated, the separation distances were not such as to allow personnel on the polyethylene plant to escape safely. Further, the only escape route available to people in the administration block (other than across the ship channel) was across the area of the explosion. Gas detection system Despite the fact that the plant had a large inventory of flammable materials held at high pressure and temperature, there was no fixed flammable gas detection system. Control of ignition sources The control of ignition sources around the plant was another feature criticized in the OSHA report. Permit-to-work systems The OSHA report stated that an effective permit system was not enforced for the control of the maintenance activities either of the company's employees or of contractors.
Isolation procedures for maintenance In this incident the sole isolation was a ball valve, which was meant to be closed but was in fact open. There was no double block system or blind flange. The practice of not providing positive isolation was a local one and violated corporate procedures. The implication is that it had not been brought to light by any safety audits conducted. Integrity of fire water system The practice of relying for fire water on the process water system and the failure to provide a dedicated fire water system meant that the fire water system was vulnerable to an explosion. Dependability of fire pumps The electrical cables to the regular fire pumps were not laid underground and were therefore vulnerable to damage by explosion and fire. One of the back-up diesel pumps had insufficient fuel and one had been taken out for maintenance without informing the chief fire officer. Audibility of emergency alarm As described, the level of noise in some areas was such that the employees might not have been able to hear the siren. Follow-up of audits The OSHA report criticized the company's failure to act upon reports issued previously by the company's own safety personnel and by external consultants, which drew attention to unsafe conditions. Planning for emergencies The disaster highlighted a number of features of emergency planning. The company had put a good deal of effort into planning and creating personal relationships with the emergency services, by means such as joint exercises, and these paid off. The value of planning, training and personal relations was one of the most positive lessons drawn. Another area in which a proactive approach proved beneficial was in relations with the media. Senior personnel made themselves available, and the company evidently felt it received fair treatment.
PASADENA
One weakness of the emergency planning identified was that it had not envisaged a disaster of the scale which actually occurred. The incident brought out the need to be able to respond clearly to calls from those liable to be affected about the toxicity of the fumes and smoke generated in such an event.
APPENDIX
6/5
The behaviour of rescue helicopters posed a problem. Personnel on the ground had no means of communication with them and the craft tended to come in low, creating the danger of blowing flames or toxic fume onto those below. A need was identified for altitude and distance guidelines for helicopters.