The Seveso accident

The current issue addresses lessons learned from runaway reactions, in memory of the 40th anniversary of the Seveso disaster. It was a devastating chemical disaster; an explosion occurred around 12:37 pm on July 10, 1976 in a TCP (2,4,5-trichlorophenol) reactor of the ICMESA chemical plant near the small town Seveso, approximately 20 kilometres of Milan, Italy. The accident resulted in the release of six tonnes of 2,3,7,8-tetrachlorodibenzo-p-dioxin (TCDD), a highly toxic substance and persistent environmental pollutant (POP), that settled over 18 km2 (6.9 sq mi) of the surrounding area. Following the disaster, the European Union named its new legislation for the control of major accident hazards the Seveso Directive (82/501/EEC).

Please note:

The accident descriptions and lessons learned are reconstructed from accident reports submitted to the EU’s Major Accident Reporting System

https://emars.jrc.ec.europa.eu

as well as other open sources. EMARS consists of over 900 reports of chemical accidents contributed by EU Member States and OECD Countries.

The cases selected for this bulletin also generated a number of lessons learned, not all of which are detailed in this bulletin. The bulletin highlights those lessons learned that the authors consider of most interest for this topic, with the limitation that full details of the accident are often not available and the lessons learned are based on what can be deduced from the description provided. The authors thank the country representatives who provided advice to improve the descriptions of the cases selected.

Accident 1

General chemicals manufacture:
High concentration of reactant and wrong design

Sequences of the event
During the polymerisation of dicyclopen tadiene (DCPD), the reaction vessel was loaded with 40 t mixture of monomers containing about 75% of DCPD (30 t) instead of the required 50% (20 t). The process involved in the accident was synthetic resins production by heat polymerisation. The high concentration of DCPD caused a runaway reaction that burst the reaction vessel and caused a large fire. Three people died inside the plant and 11 were injured. All the equipment in an area of about 100x100 m2 was destroyed. Heavy parts of the installation were found in a range of 1 km from the plant. The investigation report also indicated localised water and soil contamination from firefighting operations.

Causes
It seems that the operator mistakenly filled the reaction vessel with a mixture of monomers containing more DCPD than required. The presence of an excess content ratio of DCPD led to a runaway reaction.

Important findings
• The investigation revealed deficiencies in company safety procedures. For example, operators failed to consult the reaction formula

and related procedures before starting the polymerisation.
• Apparently, personnel were unaware of the sensitivity of the reaction to the proportion of DCPD.
• The vessel was equipped with a safety valve, but its capacity was insufficient to control the reaction.


Lessons Learned
• Operators handling reactive chemical hazards should have a good understanding of the chemistry of the reaction. The training of the personnel should include information on reactive chemical hazards.
• Operating procedures should include verification of procedures, ingredients, and equipment prior to process start. Systematic pre-process verifications ensure that the sequence of procedures is well understood.
• Again, this case illustrates the importance of sizing of vents and safety valves to have effective mitigation measures in place in case of a runaway reaction.


[EMARS Accident #617; Similar accidents:
http://www.csb.gov/t2-laboratories-inc-
reactive-chemical-explosion/and
http://www.csb.gov/synthron-chemical-explosion/; EMARS Accidents #472, #572, and ARIA No. 40312]

Runaway reactionand its possible causes

Thermal runaway is a process by which an exothermic reaction goes out of control. It is characterised by progressive increases in rate of heat generation, temperature and pressure. Thermal runaway begins when the heat generated by a reaction exceeds the heat removal capabilities of the hardware in which the reaction is being carried out (Barton et.al. 1989; IChemE Symposium series no. 115). Thermal runaway can occur because, as the temperature increases, the rate at which heat is removed increases linearly but the rate at which heat is produced increases exponentially (see Figure 1) (HSE INDG254, 2014). Because the heat production of the reaction can increase exponentially, while the cooling capacity of the reactor increases only linearly with the temperature, the cooling capacity becomes insufficient and the temperature increases and a runaway reaction or thermal explosion develops (F. Stoessel, 2008). Many industrial-scale and oil refinery processes have some level of risk of thermal runaway. These include hydrocracking, hydrogenation, alkylation (SN2), oxidation, metalation and nucleophilic aromatic substitution. For example, oxidation of cyclohexane into cyclohexanol, cyclohexanone and orthoxylene into phthalic anhydride have led to catastrophic explosions when reaction control failed.


Figure 1: Temperature and heat removal rates (Reproduced based on HSE INDG254, 2014)

A typical example of a runaway reaction is demonstrated through an exothermic batch reaction. A classical procedure is as follows: Reactants are charged into the reactor at room temperature and heated up under stirring to the reaction temperature and held where cycle time and yield are optimised. After the reaction has been com-pleted, the reactor is cooled down and emptied. What happens when the reactor is at the reaction temperature, but a cooling failure oc-curs, for example due to power failure or operator error (forgot to start the stirrer)? If at this instant unconverted material is still pres-ent in the reactor, the temperature will increase due to the comple-tion of the reaction. This temperature increase will be proportional to the amount of non-reacted material. At the temperature reached at the end of this period, a secondary decomposition reaction may be initiated. The heat produced by this reaction may lead to a further increase in temperature (http://www.safety-s2s.eu/).

General causes
• Thermal runaway may result from unwanted exothermic side reaction(s) that begin at higher temperatures, following an initial accidental overheating of the reaction mixture.
• Thermal runaway is most often caused by failure of the reactor vessel’s cooling system, but there can be other causes, for example, an incorrect mixture of substances, failure of the mixer, etc.
• Failure of the mixer can result in localized heating, which initiates thermal runaway. Similarly, in flow reactors, localized insufficient mixing causes hotspots to form, wherein thermal runaway conditions occur, which cause violent blowouts of reactor contents and catalysts. Incorrect equipment component installation is also a common cause.
• Lack of knowledge on hazards associated with the chemical reaction, process chemistry and thermochemistry can also lead to a thermal runaway reaction. For example, it may lead to a tolerance of occasional violations of temperature and pressure parameter limits, and that the operator fails to interpret violations as a sign that the process is at risk.
• Process design and maintaining design integrity (e.g., proper maintenance, appropriate upgrades and replacement) over the lifetime of the process are also critical to reducing the risk of runaway reactions. Accidents have been caused because temperature controls, the stirrer or other process equipment were not correctly specified for the process, or they malfunctioned due to lack of maintenance.
• There are a number of techniques for preventing a runaway reaction or mitigating its effects, such as inhibitors, high-volume emergency venting, quenching and dumping, etc. The mitigation systems should be properly designed on the basis of the specific needs of the process involved.
• Redundant electric power systems can be important to ensure the reactive process can be completed safely in case of a power cut.
• Poorly documented or tested batch procedures and insufficient training are have also been known to contribute to runaway reactions.
• Any process or equipment changes should undergo a management of change procedure. Changes such as production increases (“scale-up”), changes in formula or suppliers of one or more process inputs, have all been cited as factors in past runaway accidents.

Statistics for runaway reaction accidents
This issue of the Lessons Learned Bulletin offers insight into major accidents relating to runaway reactions. In preparing this bulletin, 90 accidents were studied, including 65 major accident reports in eMARS (https://emars.jrc.ec.europa.eu), six cases from the Japanese Failure Knowledge Database (http://www.sozogaku.com/fkd/en/), ten accident reports from the French ARIA database (http://www.aria. developpement-durable.gouv.fr/); seven accidents were chosen from the U.S. Chemical Safety Board collection of investigations (www.csb.gov) and finally, two cases were studied from the UK Chemical Reaction Hazards Forum (http://www.crhf.org.uk).

The accident reports selected had many commonalities. For example, management of change procedure was not in place in at least seven cases. Also, insufficient training to operators on the chemical reactive hazards before starting operation was a contributing cause in six cases. Mitigation measures for controlling reaction rate, such as venting were not considered in five accidents.

Further to these general observations, some common causes or contributing factors (occurring in at least two or three cases) include:
• an incorrect formula (wrong recipe)
• the operator forgot to start the stirrer or forgot to check the tem-perature
• water or reactant was added all at once (instead of in small por-tions) or in wrong concentration
• the reactant stuck on the wall of the reactor and when the man-hole was opened it exploded.

The authors acknowledge that some lessons learned from these accidents are very similar to each other or some of them are repetitive.

Figure 2: Number of major accidents caused by runaway reaction by industry type (Source: eMARS)

Indeed, failure to conduct a proper hazard analysis and lack of com-munication on critical process control information (e.g., parameters, measures, response to deviation, etc.), are the main factors influ-encing accident sequence of events. As these cases show, the lack of a hazard analysis in particular can lead to inappropriate process design, insufficient control and mitigation measures, and failure to recognise risks associated with scale-up and other process changes, and failure to provide sufficient. The selection of accidents shows how these factors can initiate and influence the sequence events with sometimes disastrous consequences. The following two charts present the industrial activities and the chemical processes associated with the eMARS thermal runaway reaction accidents. The most affected types of industries, as shown in Figure 2 are general chemi-cals manufacturing (55% or 36 cases) that often run polymerisa-tion and distillation processes. Almost 20% of the events (12 cases) involved production of pesticides. Figure 3 below shows the types of process cited in the eMARS accidents, with polymerisation and pesti-cide production as the most common. Of these, 20% (12 cases) were also cited as batch processes.

Figure 3: Types of chemical process involved (Source: eMARS)

Accident 2

Manufacture of plastics in primary forms: Polymerisation reaction of acrylic acid

Sequence of events
On September 29, 2012 an explosion and subsequent fire in an acrylic acid (AA) intermediate tank (V-3138) occurred at the Nippon Shokubai Co., Ltd. Himeji Plant in Japan. During his shift, an employee of a special chemical products plant noticed a release of white smoke through the vents on an intermediate storage tank containing AA. The 70 m³ tank had been filled in preparation for a distillation column filling test. Moreover, it was heat insulated and inerted with nitrogen. Having noticed the smoke, the employee sounded the alarm. A crew of internal firefighters attempted to stop the exothermic polymerisation reaction by sprinkling with water cannons, since the addition of water and inhibitor was no longer feasible due to the smoke. When these measures proved insufficient, the plant operator called the municipal fire department. Approximately an hour later, the highly exothermic reaction led the product to boil. The rise in tank pressure generated cracks in the tank shell and the contents began to leak from the cracks. Upon arriving at the scene, firefighters were notified by company technicians of a tank explosion risk. Despite this warning, they began to set up additional water cannons to back up the internal crew. Suddenly, a BLEVE-type explosion burst the tank and several pieces of debris with a large quantity of overheated polymers were projected within a 70 m radius. Subsequently, 66 m³ of AA and 28 m³ of toluene were released from 5 adjacent tanks damaged during the blast, and poured into the retention basin fuelling a localised pool fire ignited by a hotspot. The explosion resulted in 37 victims. One firefighter died from burn injuries, five were seriously injured, and an additional 31 responders sustained slight injuries. Two of the three rescue vehicles were destroyed and over 500 employees in neighbouring companies were evacuated. The fire was only brought under control the following day. The entire site was closed, in accordance with an administrative order, for a full month and the unit affected was closed for 9 months, causing a 10% drop in the world’s acrylic acid production capacity.


Figure 4: Schematic of the acrylic acid intermediate tank
(Source: Investigation Report)

Causes
Based on the investigation, the direct causes of the accident were determined as the followings:
• The circulation of Recycle to Top (see Figure 4) was not commis-sioned and caused acrylic acid to remain stagnant for a significant long period of time at high temperature in the upper portion of the tank.

• Dimer formation accelerated in the tank liquid creating high tem-perature zones. The heat generated by dimerization caused the liquid temperature to increase. The increase in temperature also caused the acrylic acid start to polymerise, causing a further rise in temperature.
• Due to lack of thermometers and inadequate temperature moni-toring, it was not possible to detect the abnormal condition until polymerisation had proceeded.

Important findings
• Due to its unstable double bond, acrylic acid is readily converted into a dimer via dimerization reaction and to polymerise through polymerisation reaction. In order to inhibit the polymerisation, it is usually kept in an atmosphere containing at least 5 vol% of oxygen and added with inhibitors.  An incident of accidental acrylic acid polymerisation had occurred on the same type of tank in another unit in 1994, but only tanks receiving liquids from a column bottom at over 80°C had been fitted with continuous measurement devices. There was no other follow-up.
• During process design, the tank’s cooling capacity had not been taken into account as a safety factor, due to the concentration of inhibitor in the liquid and the presence of a steam heating regulation system. Hence, the temperature of the liquid upstream of the tank inlet had not been checked either.
• The process control system had been disassembled shortly pri-or to the accident due to repeated malfunctions. An analysis of safety-related consequences of this decision was not performed.
• Technicians were not given up-to-date start-up and operating procedures for the upward circulation system. The circulation system had only been operated an exceptional basis in the previous 2 years (subsequent to a process modification). A single information panel the technician of the need to open the system for a large storage volume. It was placed 15 m from the technician’s station.
• Due to lack of thermometers and inadequate temperature moni-toring, it was not possible to detect the abnormal condition until polymerisation had proceeded.
• The staff was not aware of the importance of tracking temperature in the tank because it was thought that high (reaction) inhibitor content in the liquid was sufficient to reduce all potential risks. In addition, normal operations usually involved low volumes. For this reason, it appears that instrumented process controls, monitors and associated training were not prioritised. Moreover, previous incidents of polymerisation had been controlled by means of sprinkling water; leading to the belief that polymerisation could be controlled similarly.

Lessons learned
• All phases and all possible containment situations associated with process contents need to be subjected to a hazard analysis. It cannot be allowed, as in the case, that there is no analysis of what could be the effects of prolonged presence of a substance in an unstable condition (e.g., high temperature). Normal operating conditions may have several variations and these variations should all be analysed for hazard potential.
• In corollary, each possible scenario requires its own analysis to determine appropriate control measures. The process in this case should have been analysed for the heat of reaction and off-gas rates for all potential reactions (desired and undesired), including the heat resulting from accumulation of reagents or slow forming intermediates, with control measures designed appropriately to prevent any unwanted process escalations.

(Continued from Accident 2)

• In corollary, each possible scenario requires its own analysis to determine appropriate control measures. The process in this case should have been analysed for the heat of reaction and off-gas rates for all potential reactions (desired and undesired), including the heat resulting from accumulation of reagents or slow forming intermediates, with control measures designed appropriately to prevent any unwanted process escalations.
• This process involved mistakes in implementing last-minute changes as well as planned changes.
• Last-minute changes, such as dismantling of control equipment, should never be allowed. Reactive processes are founded on a well-calibrated sequence of interactions between inputs based on the presence of specific operating conditions.
• A technical or procedural modification to a reactive process, even minor in nature, can fundamentally alter the initial risk analysis and, with it, the design of safety barriers. It is therefore important to have MoC procedures in place to analyse risks related to these changes. No change should be allowed if the impacts of the change are not fully understood. An evaluation of training needs associated with changes is part of the MoC process, and is particular relevant for planned permanent changes to process procedures, such as the addition of a circulation system in this case.
• Operations staff should be aware of risks of ignition, decomposition or runaway reaction, the control parameters deemed critical and what to do if there are deviations. Feedback from prior accidents, the outcome of a HAZOP analysis, and other updates should be systematically communicated to all relevant staff. Technician training and drills should also focus on infrequent and extraordinary phases, such as equipment testing.



Figure 5: The acrylic acid intermediate tank after the explosion (Source: Investigation report)

[Investigation Report at https://www.shokubai.co.jp/en/news/file.cgi?file=file1_0071.pdfand ARIA No. 42817.
Similar accidents: EMARS Accident #38; UK Chemical Reaction Hazards Forum No. 88 at http://www.crhf.org.uk/incident88.html; IChemE HAZARDS XVII Paper No. 46 

Accident 3

General chemicals manufacture:
Scale up design of process equipment

Sequence of events
On the night of April 12, 2004, during an attempt to make the first production batch of triallyl cyanurate (TAC) at MFG Chemical, Inc. (MFG) in Dalton, Georgia, a runaway chemical reaction released highly toxic and flammable allyl alcohol and toxic allyl chloride into the near-by community. In the laboratory, the TAC process worked perfectly. However, when they attempted to make it in the production reactor, the process radically overheated and released a toxic and flammable vapour cloud that forced the evacuation of nearly 200 families. The fire department ordered an evacuation of residents and businesses within a half-mile of the facility.

Causes
The direct cause of the runaway reaction was the incorrect scaling up of a 30 gallon (13 l) laboratory reactor to a 4000 gallon (15000 l) production vessel. Company personnel failed to realize that the reactor volume to surface area ratio increases considerably as the reactor size increases, which lead to less cooling capacity per unit volume of reaction mass. Having missed that important point, operators added the entire quantity of the reactants and the catalyst, to the reactor at once, and were unable to control the reaction rate.

Important findings
• The production procedure did not specify the incremental addition and neutralization steps used in the first two test batches.
• Apparently, the company did not conduct an adequate evaluation of the reactive chemistry hazards involved in manufacturing TAC before attempting the first production batch. It is true, that the personnel knew about the exothermic nature of neutralization part between caustic soda and the hydrochloric acid. As such, they planned to circulate coolant through the reactor jacket to prevent the mixture from overheating. However, they did not have knowledge about the exothermic reaction between allyl alcohol and the cyanuric chloride. The company laboratory tests results supported the assumption that the heat generated during the neutralization phase would require the highest rate of reactor cooling.
• The company did not perform a comprehensive process design and hazard review of the laboratory scale-up to full production before attempting the first batch. As a consequence, the heat removal capacity of the production vessel was not efficient. The company failed to learn from the existing technical literature on chemistry hazards and scaling up.
• It seems, that the allyl alcohol manufacturer had not clearly communicated to the company management that they needed to implement the related national regulations, which caused the fact that the company did not develop a comprehensive process hazard analysis, pre-startup review and emergency response ele-ments required under these regulations and national standards.
• The company did not provide a hazardous vapour/liquid containment system on the reactor emergency vent. As such, the toxic vapour/liquid was released straight to the atmosphere and the nearby creek.
• Furthermore, the company employees conducted emergency response activities without the necessary procedures, training or personal protective clothes. As a consequence, one employee suffered chemical burns.

Lessons learned
• The production procedure contained no chemical addition rate restrictions, critical for controlling the reaction rate. Lack of precise and adequate operational procedures can increase the risk of the occurrence of major accidents. Knowledge of the hazards and building operational procedures using the information on the hazards are crucial steps in chemical facilities.
• Given the fact that the company had no information about the possible exothermic decomposition reaction, scaling up the laboratory reactor to a production vessel, they failed to consider a correct surface-to-volume ratio to remove excess heat. A company that handles or produces reactive chemicals should have comprehensive knowledge about the hazards and laboratory scale-up.
• Having an emergency vent system in place could have prevented a toxic release to the atmosphere and pollution to the nearby creek. Emergency plans should reflect on possible consequences of a toxic release. These plans should consider the necessary emergency response activities, both inside and outside the facility, and sheltering or evacuation, depending on the type of hazards identified by the chemical plant.
• Also, it is imperative that personnel responsible for intervention in case of an emergency have adequate training and protective equipment.
• When scaling up a reaction, the operator should account for the impact of vessel size on heat generation and heat removal. Consider the impact of higher temperature gradients in plant scale equipment compared to a laboratory or pilot plant reactor. Agitation is almost certain to be less effective in a plant reactor, and the temperature of the reaction mixture near heat transfer surfaces may be higher (for systems being heated) or lower (for systems being cooled) than the bulk mixture temperature. (CCPS Safety Alert, 2004).
• The operator failed to learn from past accidents involved TAC production published already in 1979 (IChemE Loss Prevention Bulletin Issue No. 25). Moreover, in those cases it was already discovered that the quantity of the reactant should be added in controlled rates to avoid sudden raise of the temperature.

[http://www.csb.gov/mfg-chemical-inc-toxic-gas-release/; Similar accidents: http://www.csb.gov/synthron-chemical-explosion/ and IChemE LPB Issue No. 239 pp.7; http://www.csb.gov/t2-laboratories-inc-reac-tive-chemical-explosion/]

Accident 4

Production and storage of pesticides, biocides,
fungicides: Decomposition explosion

Sequence of events
A new reactor for production of 0,0-dimethyl-phosphorochloridothio-ate (MP-2) was used for the first time. Similar equipment was already in use for the same production but the new reactor was micropro-cessor controlled, especially for controlling the chlorine addition rate and the cooling in order to maintain the process conditions (30°C and atmospheric pressure) because the chlorination of 0,0-Dimethyl-phosphorodithiotic acid (MP-1) to MP-2 is exothermic. The reaction took place during the extraction of naphtha. Process by-products were thioperoxy-diphosphoric acid tetramethyl ester (MP-11), hydrogen chloride and sulphur. During commissioning, the temperature controller was temporarily blocked while the microprocessor was being tested. Production was then started, but the temperature controller remained blocked. 

Owing to a high chlorine addition rate and no cooling, the temperature rose to more than 120°C about 2 hours after the production started. The solvent (naphtha) evaporated and a sudden fast decomposition occurred. The increased pressure caused a fracture of the rupture disc, a deformation of the reactor lid and an elongation of the bolts of the lid. Flammable gasses were released through the venting system and through the opened reactor lid into process hall. The vapour cloud ignited and exploded when it reached the control room. On the basis of the deformations of the reactor and of the building, the operator of the establishment estimated that the pressure in the reactor reached values of 25-35 bar and that the overpressure in the building reached values of 100-150 mbar. The fire was extinguished by the internal fire brigade assisted by the local fire brigade. Six control room operators were injured.

Causes
The temperature sensor was blocked and the temperature in the reac-tor increased too fast with addition of chlorine and lack of cooling. This led to a fast decomposition reaction that deformed the reactor and the release of flammable gases that eventually exploded. It is likely that the electrical installations in the control room were the source of ignition. Important findings
• Operators did not appear to have been trained on commissioning and operating procedures, and in particular on the importance of process controls. When the production started the operators did not pay attention to the temperature that was recorded.
• The process included a venting system and a relief pipe with a rup-ture disc. Nonetheless, these pieces of equipment did not offer suf-ficient relief capacity to manage the potential volume of gas that could be released due to an accelerated decomposition process.

Lessons learned
• Reactive processes rely on strict process control to avoid accidents. As such, all necessary measures should be in place to minimize deviation from the “recipe” and its operating parameters, including temperature, pressure, sequence of procedures, input volumes, input concentration, and other parameters as may be important to the process. For this reason, it is essential to provide an appropriate level of training on all procedures and equipment prior to staff assigned to reactive process units. Redundancy measures, such as control room display and overrides of critical parameters, can also be considered as additional layers of protection.
• The hazard analysis should determine specifications for control measures based on potential scenarios. These features cannot be determined on the basis of generic assumptions, but should be de-rived directly from an analysis of the specific process at hand.
• In order to control ignition sources, it is important that appropriate distance is kept between the control room and the production hall. The investigation revealed that electrical installations in the control room were the source of ignition that caused the explosion.
• In this particular case the operator should consider possible vapour phase reactions in the hazard analysis. These might include combustion reactions, as it occurred in this case when flammable vapour was released to the atmosphere.

[EMARS Accident #234 and ARIA No. 27. Similar accidents: EMARS Accident #44; http://www.csb.gov/bayer-cropscience-pesticide-waste-tank-explosion/ ; ARIA No.38418 and http://www.sozogaku.com/fkd/en/cfen/CC1000016.html]

Accident 5

Dye product manufacturing plant:
Secondary decomposition reaction

Sequence of events
A violent explosion and fire occurred in a dye production plant on April 8, 1998 in Paterson, New Jersey, injuring nine employees, two of whom seriously burned. On the day of the accident a chemical reaction was ongoing in one, 40 years old, 7500 l carbon steel reactor (2.7 m high). Workers had turned on the steam supply to the reactor, beginning what they assumed would be a routine six to eight-hour production run of a dye used to tint petroleum fuel products. But within less than half an hour, a runaway reaction had started and acceler-ated beyond the heat removal capability of the kettle. The resulting high temperature led to a secondary decomposition reaction causing an explosion. As a consequence, the over-pressure blew the hatch of the reactor, releasing the kettle contents. The explosion ejected flammable material through the roof of the building, raining down chemicals onto the surrounding community. Residents in a 100 city-block area were confined to their homes, voluntarily sheltering in place for up to three hours while officials evaluated health risks. 

Figure 6: Simplified process diagram (Source: CSB)

Causes
The initial runaway reaction was most likely caused by a combination of factors. Notably, the reaction was started at a temperature higher than normal and the steam used to initiate the reaction was left on for too long. Moreover, the use of cooling water to control the reaction rate was not introduced soon enough. The investigation found that the operator had not adequately evaluated the hazards of the reactor such that appropriate control measures were in place. As a result, the reactor did not have sufficient cooling capacity, adequate emergency shutdown capability or venting systems, to a temperature escalation.


Important findings
• According to the investigation, two process changes were introduced in 1990 (addition of a reactant in one shot instead of four) and 1996 (batch volume increase). Both changes could potentially create more opportunity for temperatures to exceed. However, none of these changes were subject to the plant’s Management of Change (MoC) procedures.

• The parent company’s original research described two exothermic chemical reactions:
  - The desired exothermic reaction, to form the dye product, which is initiated at an onset temperature of 38°C (100°F) and begins to proceed rapidly at a temperature of approximately 75°C (167°F), and
  - The undesired, exothermic reaction that results from the thermal decomposition of the dye product, which is initiated at an onset temperature 195°C (383°F).
• The findings regarding the decomposition reaction were not com-municated to the site.
• Temperature-control problems had occurred in eight of 32 previous batches, but none of those near-misses events had been analysed.
• The kettle cooling system had not sufficient capacity to safely control the exothermic synthesis reaction. Similarly, the rupture disks were too small to safely vent high pressure in the kettle in the event of either of the two foreseeable runaway reactions. Nor was the vessel equipped with safety equipment, such as a quenching or reactor dump system, that could stop an ongoing reaction or reduce its impact.
• The operator did not provide personnel with adequate training on how to respond to avoid injury if a runaway reaction could not be controlled.

Lessons learned
• Safe operations and control measures for reactive processes need particular attention in the design phase. Each individual reactive process requires its own hazard identification to determine an appropriate prevention and mitigation system influencing both process design and equipment decisions. These choices depend on numerous factors, including process parameters and inputs, adjacent and connecting processes and equipment, the volume of potential releases and impacts, as well as potential human and environmental exposure. In this particular case, despite research findings back in 1989, the reactor was not provided with sufficient cooling capac-ity or adequate emergency shutdown or venting systems.
• Reactive processes can be highly sensitive to even the smallest changes in process design, operations, maintenance, and equipment. For this reason, any potential change to the process should be evaluated as a candidate for the MoC procedure. If there are any doubts raised about the safety risks involved, a full MoC procedure should be implemented.
• This accident also violated several safety management system norms, in particular:
- Ensuring that the process hazard analysis is fully documented with appropriate training before operation start-up;
- Ensuring full documentation and training of all relevant personnel on operational procedures and operating parameters, including how to respond to deviations and emergency situations;
- Systematic investigation and analysis of near misses, and unsafe process deviations and follow-up (implementation, documentation and communication to all involved staff of any resulting recommendations).
• Awareness of the state of art of knowledge in chemical reactivity can also help to prevent accidents. Good practice guidelines such as the Lees’ Loss Prevention in the Process Industries or those pubished by the Centre for Chemical Process Safety were available in connection with reactive chemical processes. However, the company’s process safety management program did not require adherence to those publications.

[http://www.csb.gov/morton-international-inc-runaway-chemical-reaction/, ARIA No. 13397. Similar accidents: http://www.csb.gov/t2-laboratories-inc-reactive-chemical-explosion/ EMARS Accidents #164 and #903; http://www.sozogaku.com/fkd/en/cfen/CC1200039.html]

Motto of the semester
___________________

“It’s an unpredictable runaway chemical reaction no one predicted.”
Robert Wright

 
MAHBulletin

ContACt

For more information related to this bulletin on lessons learned from major industrial accidents, please contact

zsuzsanna.gyenes@jrc.ec.europa.eu or emars@jrc.ec.europa.eu

Security Technology
Assessment Unit
European Commission Joint Research Centre Institute
for the Protection and Security
of the Citizen
Via E. Fermi, 2749
21027 Ispra (VA) Italy http://mahb.jrc.ec.europa.eu/

If your organisation is not already receiving the MAHBulletin, please contact emars@jrc.ec.europa.eu. Please include your name and email address of your organisation’s focal point for the bulletin.
All MAHB publications can be found
at Minerva Portal

   Checklist on protective measures

• Are process procedures fully and accurately documented in appropriate detail, including:
   - Specification of the feed rate to prevent overcharging
   - Specification of the batch temperature and inlet temperature of the dosed reactant
   - pH control parameters
   - The rate at which all chemical reactions should occur
   - The rate at which the chemical reaction should increase with increases in temperature
   - The thermal stability of the reaction mixture over a wide temperature range

• Do the procedures clearly identify the critical parameters and acceptable ranges?
• Do process operators understand how the process works, how to recognise deviations and their associated risks? Are the instructions clear, concise and unambiguous?
• Do the procedures give appropriate hazards warnings at each step to clearly explain what must be done including identifying required safeguards?
• Do the procedures clearly indicate what personnel should do if the process starts operating outside one of the critical parameters?
• Does the process have adequate and appropriate instrumentation for monitoring deviations from critical parameter ranges?
• Does the presence and calibration of chemical and physical monitoring equipment reflect critical process parameters?
• Is there a chemical-interaction matrix for materials present in the reaction mixture with reactivity classification? If so, is this information communicated to process operations staff?
• Have potential reaction contaminants been identified, such as air, water, rust, oil and grease, i.e., typical substances in a plant environment?
• Are operators trained on all safety aspects of the process including engineering controls, but also on general work practices that reduce risks, such as wearing appropriate personal protective equipment, etc.? Is the training documented and up-to-date with current process requirements?
• What is the history of changes to the process? Have they been consistently recorded? Have they been subjected to a management of change evaluation?
• Has there been a process scale-up (an increased volume of production) from the original specifications? Did the company perform a management of change process before implementing the scale-up?
• When scaling up a reaction, account for the impact of vessel size on heat generation and heat removal: The volume of the reaction mixture increases by the cube of the vessel radius but the wetted heat-transfer area increases only by the square of the radius.
• Is there a high-temperature alarm and trip to shut off the reactant feed?
• What design measures are used to limit the reaction rate besides temperature control?
• Did the company perform hazard identification on the process to identify potential reaction hazards in materials, as well as the desired and adverse reactions? Have the results been communicated to the operational staff?
• What are the components of the mitigation and emergency response system (e.g., quenching, venting, and inhibitors)?
• How were the components of the mitigation and emergency system selected?
• Are there redundant mitigation measures for controlling reaction rate, such as venting, an independent back-up cooling system, quenching, etc?
• Do mitigation and emergency response measures aligned with potential accident scenarios?
• Do the size and other capacity specifications fit the needs of the worst probable scenario?
• Does the process incorporate control measures in the design, such as the use of semibatch processing (in which the batch temperature and any off-gassing can be maintained through controlled addition of the reagent)?

The AICHE has also published a checklist of issues to consideration with an explanation of the importance of item at http://www.aiche.org/sites/default/files/docs/pages/CCPSAlertChecklist.pdf