Comment is mandatory

Lessons Learned Bulletin No. 6

Chemical Accident Prevention & Preparedness

Natech Accidents

The aim of the bulletin is to provide insights on lessons learned from accident reported in the European Major Accident Reporting System (eMARS) and other accident sources for both industry operators and government regulators. In future the CAPP Lessons Learned Bulletin will be produced on a semi-annual basis. Each issue of the Bulletin focuses on a particular theme.

Summary

 ---------------------------
In preparing this bulletin, 20 major accidents from the Joint Research Centre’s (JRC) eMARS and eNatech database and other open sources were studied. Events were chosen to highlight that a wide variety of natural hazards can trigger major accidents. The natural hazards selected are lightning, heavy rainfall, extreme temperature, earthquake, tsunamis and floods. A study on the status of Natech risk reduction in EU Member States was performed by means of a questionnaire survey:
http://enatech.jrc.ec.europa.eu



Please note:

------------------------------
The accident descriptions and lessons learned are reconstructed from accident reports submitted to the EU’s Major Accident Reporting System:

https://emars.jrc.ec.europa.eu

as well as other open sources.
EMARS consists of over 900 reports of chemical accidents contributed by EU Member States and OECD Countries.

Lightning

Lightning is one of the most frequent causes of tank fires in terms of Natech events. Lightning strikes can damage equipment directly, e.g. by causing the rupture of tank shells, or of pipes and connections. Furthermore, they can also impact safety and electrical control systems, which in turn can lead to process upsets and hazardous-materials releases. The most frequent Natech scenario involves, however, the ignition of flammable vapours present on the tank roof.

Accident 1

Manufacture of food
products and beverages

Sequence of events
On 24 July 2000, thunderstorms were observed near a sugar refinery, causing the company to stop loading trucks. Around 16:35, an operator shut the bottom valve of the tank used for the loading operations. About ten minutes later, lightning struck the roof of one of the tanks for alcohol storage and caused an explosion. The roof of the tank was projected upwards and fell back into the tank. A fire then occurred. The fire did not extend beyond the tank and the shell remained intact, but the shock created cracks in the tank’s bottom valve. No one was injured in the accident but the damage caused as a result was estimated to be more than 2.3 million Euros.

Causes
The accident was caused by lightning that struck the tank.

Important findings
• The tank was not fitted with flame arrestors on the vents even though a lightning risk

evaluation study 18 months prior to the accident had recommended presence of flame arrestors on the vents and breathing valves on the tanks.

• Direct protection devices against lightning (lightning conductors) were installed, but perhaps the wiring system designed for carrying the currents originating from atmospheric discharges (equipotential bonding between different tanks and the earthing points), located in certain positions to protect specific areas against lightning hazards, were inadequate.
• Another lightning struck a few moments before near an electricity tower. The energy conducted to earth certainly caused changes in the soil characeristics near the storage site.

Lessons learned
• Lightning is a common hazard at above ground storage tanks and should be addressed in the safety report.
• Appropriate safety equipment, such as flame arrestors should be in place, especially after it has already been recommended by a specific risk evaluation study.


[eMARS Accident # 394 and ARIA No. 1832]

 

 

Natech Accidents


Nature of Natech accidents

Natural hazards, such as earthquakes, floods, lightning, landslides, etc., that impact chemical installations can result in loss of containment and cause hazardous-materials releases, fires and explosions. These hazards can cause multiple and simultaneous LOC events over extended areas, destroy safety barriers and lifelines, and create a difficult response environment. These so-called “Natech” accidents often have significant social, environmental and economic consequences. Awareness of this type of risk is growing and the need for including it in chemicalac accident prevention and mitigation is widely recognized. However, important gaps in the reduction of Natech risk persist.

Statistics

A study on the status of Natech risk reduction in EU Member States was performed by means of a questionnaire survey. Figure 1 shows the types of natural hazards that triggered Natech accidents over the period 1990 –

2009 which was reported by 5 countries in the frame of the survey. It shows that lightning, floods and low temperature were the most common accident triggers. It is in-teresting to note that most of the natural hazards that triggered Natech accidents were considered in the respective countries’ rules, codes and guidelines for chemical-
accident prevention.


The selected cases also include a number of lessons learned, not all of which are described. The bulletin highlights those that it considers of most interest for this topic, with the limitation that full details of the accident are often not available and the lessons learned are based on what can be deduced from the description provided. The authors thank the country representatives who provided advice to improve the descriptions of the selected cases.



Figure 1: Natural-event triggers in the Natech accidents reported by the responding countries in the frame of this study.
 

 

Accident 2

Thunderstorm at a refiner

As a result of a thunderstorm there was a significant interruption to a refinery’s electricity supply that resulted in the loss of reflux cooling to a distillation column within the Selective Hydrogenation Unit. The initial trip of the reflux pump was noted and the pump restarted, but a second trip went unnoticed. The steam supply to the column reboiler was on manual control and therefore did not trip leading to a rise in column pressure. The pressure safety valves, designed to protect equipment against overpressure, did not function properly, leading to overpressure in the column and overhead system. This resulted in a large volume of gas being released to atmosphere after gaskets failed at several locations. (Source: SafeWork Australia)

• The impact of lightning on the power supply can be an indirect cause of loss of containment due to process upsets. This should be considered in the site’s risk assessment and critical safety elements that might be affected should be evaluated accordingly.


Similar accidents: eMARS Accident # 483 eNatech accident #47 and #18; ARIA No. 40953;
http://www.hse.gov.uk/comah/sragtech/casetexaco94.htm]

Accident 3

Pharmaceutical plan

Sequence of events
Following a spell of torrential rains (about 300 mm from 31 October to 2 November with a 3-hour extremely heavy rain-fall), insufficient draining of the water from the catchment area housing the industrial zone caused flooding. The water level in the entire site reached 20 cm to 1 metre. Since manufacturing was underway, the staff sounded the alert even before observing a rise in the water level in the plant. The operator triggered the internal emergency plan on Sunday 2 November around 4.00 a.m. and set up a crisis management division comprising 6 units (intervention, communication, engineering, information, operation and logistics). The operator deployed significant resources to raise or evacuate the equipment and material, keep the most important (from a safety and financial standpoint) chemicals away from water, stop manufacturing processes along with a safety fold back of equipment (safety stand-by phases identified in the safety cases of chemical reactions except for a reactor being heated which had to be cooled before shut down) and plan out power cuts before the water could flood sensitive equipment. The chemical plant was completely flooded where the water level was between 0.2 and 1 meter. Damage within the plant was relatively limited thanks to the prompt action taken by the operator. The flooding, however, resulted in significant water damage on some equipment or in certain premises.

Heavy rainfall and floods

Heavy rain has on several occasions caused sinking of tank roofs, thereby exposing the tank contents to the atmosphere. In addition, during periods of sustained rainfall, sites can flood in case of insufficient water drainage or due to increased groundwater levels. Heavy rain can also exacerbate the consequences of spills by providing a medium for the dispersion of the released substances. In some cases, the release may exceed the capacity of the secondary containment (especially if combined with localized flooding). For this reason, it may be necessary to consider tertiary measures, e.g., a drain to a contained and enclosed storage location, that prohibit the release (or contaminated flow) can be from reaching nearby water bodies or draining into public water and sewage systems.

The displacement of equipment is of particular concern in the case of massive flooding due to flood-induced buoyancy and water drag that can strain or break connections between pipework and equipment or cause pipelines to rupture. A number of potential consequences are associated in particular with floodwaters, including:
• The impact can cause minor leaks, or in some cases, more severe ruptures and continuous releases.

• Where the pressure of floodwaters is sufficient to cause a tank to collapse or implode, the complete inventory of the concerned unit will be instantaneously released.

• The floating objects may also strike equipment causing leaks or ruptures.  

 

Figure 2: The affected site (Source: ARIA No .35426)

Causes
The torrential rains during the previous days resulted in the flooding of the site. The zone was not located in an easily flooded zone but since the site was located in a natural depression, it was flooded even though the platform was raised from 0.8 to 1.5 metres at the time of construction of the site. The flood occurred due to insufficient draining of the water from the catchment area housing the industrial zone given the torrential down-pour over a short span.

Important findings
• The zone was not classified as flood-prone zone, even though less intense showers had been experienced five years before the incident. The water level then had reached 662.2 meters (site platform stood at 662.5 meters), whereas on the date of the event the water reached a level of 663 metres.

(Continued form accident 3)

Pharmaceutical plan

Lessons Learned
• Flooding can occur even in a zone that is not classified as flood-prone; therefore, early warning is crucial to put together the crisis management units and organise all rescue operations.
• There was significant damage to some equipment. Hence, it is important to prevent crucial instruments or laboratory equipment from coming into contact with water. In addition, chemicals that violently react with water should be stored at a height above the maximum water level for all flooding scenarios or be protected by dams.
• Operators should be prepared for a possible inundation of the plant in case of heavy rainfall. There should be a deliberate effort to maintain awareness of historic extremes of flooding in and around a site. Even areas that are not labelled as flood-prone can become inundated when rainfall is extremely heavy.

[eNatech accident #36]

 Extreme temperature

High temperatures
High temperatures provide ambient conditions that are conducive to ignition of substances stored outside. They can lead to pressure increases in storage facilities, including railcars, where pressure relief valves can actuate to prevent the equipment or vessel from bursting.



Accident 5
Refinery flooded due to heavy rain

Sequence of events
On June 24, 2005, fire swept through thousands of flammable propylene gas cylinders at a gas repackaging plant. Dozens of exploding cylinders were launched into the surrounding community and struck nearby homes, buildings, and cars, causing extensive damage and several small fires. The area was experiencing a heat wave with bright sunlight and temperatures reaching 36C on the day of the accident.

Accident 4
Refinery flooded due to heavy rainfall

A dam overflowed following continuous torrential showers that lasted several days and flooded the facilities of a refinery located in the heart of a town’s port area. The site’s production was stopped due to the water level that rose to as high as one meter at a site in the facility. A violent fire ensued, as well as several explosions of tanks, electrical equipment (transformers) and pipes. Four hours later, two fire areas still persisted in the gas and crude oil sectors of the refinery. The fire was extinguished after 20 hours. Two people died and four were injured. Significant material damage resulting from the accident led to the closing of the refinery and suspension of all activities.

The sequence of fires was caused by the flood which in effect lifted waste oil, displacing it from the drainage system. The waste oil that was floating on the surface of the floodwater then came into contact with hot parts of the installation, causing several fire patches as well as explosions in pipelines and electrictransformers.

• This incident illustrates that operators of dangerous establishments should consider implementing effective procedures to prevent the rapid distribution of flammable liquids by flood waters.

• In addition, a good maintenance practice is to ensure that sewers are clean so as not to block the drainage of the water.

[eNatech accident #41; ARIA No. 23637;
Similar accidents: eNatech accident #52 and #13]

Causes
The accident occurred due to both the high outside temperature and the low set point of the pressure relief valves in the propylene cylinders. Also, it was determined that the pressure relief device for gas venting was set well below the recommended set point, a particular concern in high temperature conditions. Furthermore, when exposed to high temperatures and direct sunlight, propylene cylinders can spontaneously vent through their relief devices. It is suspected that this situation occurred to create a domino effect that spread the fire to all the cylinders. Spontaneous venting creates a release of propylene that, when ignited, can heat surrounding cylinders and cause them to vent in turn.  

Important findings
• The investigation revealed that direct sunlight and radiant heat from asphalt paving heated returned propylene cylinders and these cylinders, containing less gas than full cylinders, heated at a faster rate than the full ones. As the cylinder wall temperatures rose, the internal pressures increased causing the relief device on a cylinder valve to open and vent propylene.

• The company divided the cylinder storage into “full” and “empty” or “returned” sections. The “returned” section, where the fire originated, is for cylinders returned for refilling, which may not always be empty when returned.

• Containers, like propylene cylinders have a “set point” which is the so-called target pressure for the contents inside the cylinder. It was found that in this case, pressure relief set points were too low for propylene and allowed gas to vent during hot weather, well below the pressure that could have damaged the cylinders. For various other reasons (possibly design-related), some valves already began releasing gas even before pressure reached the set point.

 

• Above all, three similar events occurred at a facility of the same parent company one month before and the company should already have addressed all such dangerous situations.

Lessons Learned
• High ambient temperatures, increase the risk of catastrophic fires at facilities handling propylene cylinders. Adopting best practices for storing and handling propylene cylinders can reduce this risk at gas distribution facilities.
• Revising current practices to provide a greater margin between the minimum relief opening pressure and the vapour pressure of propylene will reduce the risk of premature venting, even when best practices are not followed.
• Deluge systems or fixed fire nozzles should be installed as a mitigation measure to cool cylinders in case of a fire.
• Flammable gas cylinders should be protected from weather conditions, for example, they may be stored under a “half-roof” structure to avoid direct contact with sunlight.
• The pressure relief valves should be reviewed regularly and safety standards must be updated due to the past numerous accidents.


More information:
http://www.csb.gov/praxair-flammable-gas-cylinder-fire
Similar accidents reported by the CSB: Air Liquide, Phoenix, Arizona – June 1997; Airgas, Tulsa, Oklahoma – August 2003; and  Praxair, Fresno, California – July 2005

 

Accident 6
Container explosion and fire


In 11 July 2011 an explosion of containers of explosives occurred at a naval base, killing 13 persons and injuring more than 60. The explosion occurred following a fire starting one and a half hour earlier. The subsequent explosion killed four Navy personnel and six civilian firefighters who had been tackling the small blaze that led to the explosion. Extensive damage was caused in a wide area surrounding the blast. The neighbouring power plant was severely damaged and electricity production capacity in the country was reduced to approximately 60% of peak summer power requirements. Apparently, 98 containers of explosives that had been stored for two and a half years in the sun on a naval base. Eventually, the heat wave led to a brush fire that reached the naval base where the containers were stored in an outdoor area. It is possible that the brush fire set light to containers of confiscated gunpowder that had been stored at the facility.

• High temperature could have been a contributing factor to this accident. The operator failed to recognise the potential hazards. In addition, explosives were left unattended in the naval base for two years without any regular control imposed. Moreover, it appeared that firefighters started their intervention without having precise knowledge about the hazards of the explosive materials stored in the containers.


[eNatech accident #30; ARIA No. 40877]

Extreme temperature

Low temperatures
Extremely low temperatures or long spells of intense cold can also elevate accident risk. Low temperature extremes may cause the freezing and bursting of pipes, in particular where heating devices do not generate enough heat to offset the low temperatures. As a consequence, product in the pipe may contract and cause pipes to burst when melting occurs due to the rise in pressure. In case of ice formation, the weight of the ice can also provoke structural damage to equipment and break pipes.

 

Accident 7
General chemicals manufacture


Sequence of events
A cyclohexane leak was discovered at a chemical site due to a pressure drop on the supply line of a production facility. The substance was being transferred at 20°C and at 2 to 3 bar through lagged overhead or underground piping. The leak occurred from the rupture of a DN 50 mm pipe due to the dilation of liquid cyclohexane in the overhead part of the pipe between two blockages of crystallized cyclohexane. It took 30 hours to identify the leak, discovered only by following the odour of the cyclohexane.
As a consequence, 1200 tonnes of cyclohexane were released causing environmental and economic damage to the company.

Causes
The temperature varied greatly over the weekend of mid-December. Lacking a functional temperature control, the varying temperature in the pipe caused the cyclohexane to expand and contract. A malfunction of the pipe heating device (T < 6.5°C) led to the formation of the blockages in the pipe canal. Ultimately, the DN 50 mm branch pipe ruptured at the expansion loop, creating a hole about the size of the palm of one’s hand. The expansion loop was the part most exposed to the changes in temperature because of its shape and position up above the pipe-way, (the trench holding the pipework)(see Figure 3).

Important findings
• In early December 2002, freezing temperatures caused the cyclohexane to solidify in the manifold. The large variation in the temperature caused an expansion/contraction of the cyclohexane which contributed to the rupture of the pipe.
• The DN50 mm manifold was permanently open even in the event of non-use and only the adiponitrile (ADN) production unit admission valve was closed.
• The location of the released cyclohexane was found by its odour, indicating that no monitoring technology had been implemented on the pipe.

Lessons Learned
• Operators must be aware of the physical characteristics of the dangerous substances, on site such as their tendency to solidify in extreme cold temperature. These factors should be included in the HAZOP or other hazard identification studies for the affected chemical process (See also Chemie Pack accident at http://www.onderzoeksraad.nl/uploads/items-docs/1805/Rapport_Chemie-Pack_EN_def.pdf). Also, where significant variations of outside temperature can be expected, operators should identify possible hazards that might be triggered.
• The cyclohexane spilled was revealed by its odour. Relying on odour alone for detection is not a recommended practice on sites where large volumes of dangerous substances are stored. Proper detection in case of release of dangerous substance is crucial to enable staff to act immediately in case of an emergency.

[eMARS Accident #414; eNatech accident #25 and ARIA No. 23839]




Figure 3: The affected process (Source: ARIA No. 23839)
 

Accident 8
Crushing of a butadiene rail tanker


An empty (but not degassed) butadiene railcar tanker was temporarily stopped in a marshalling yard. The effect of ambient cold temperature (-17°C), the gaseous phase of the butadiene liquefied (boiling point temperature -4.4°C) and the tanker underwent relative depressurisation before collapsing. The injection of nitrogen intothe non-degassed tanker cars, a procedure typically carried out to avoid tank depressurisation during cold weather periods, had been omitted.
• Even though marshalling yards are considered differently from industrial facilities in most countries, it is still imperative to take necessary precautions during periods of intense cold and procedures or transport regulations should address also extreme weather phenomena.

[ARIA No. 39508]

 

Accident 9
LNG fire


Inside a liquid CO2 production plant, one of the four vertical storage columns undergoing filling exploded in a BLEVE. Due to the domino effect, a second storage column exploded and a third column was blasted into the laboratory 30 m away, killing five employees on the spot. Projectiles due to the BLEVE were responsible for four other deaths; 15 persons were injured.

The likely cause of this explosion was an overfilling condition due to a frozen level detector (freezing of water not completely extracted from the CO2). Moreover, the component material of the two exploded tanks was not adapted to low-temperature applications.
• It is imperative that in case of use equipment which are sensitive to low temperature, such as different mechanical devices, sensors or emergency intervention equipment, these must be monitored regularly.

More information: http://www.aria.developpement-durable.gouv.fr/wp-content/uploads/2013/08/flash_intense_cold_nov2012.pdf  and CSB (US Chemical Safety Board) Propane Fire at Valero Refinery in Sunray, Texas http://www.csb.gov/valero-refinery-propane-fire/




Other Natech hazards

Earthquakes


Earthquakes cause damage to industrial facilities through direct shaking impact or soil-liquefaction-induced ground deformations that can affect structures built in susceptible zones. Structural earthquake damage that does not result in the release of hazardous substances is of no immediate concern for safety, although the associated economic losses can be significant. The predominant damage modes in this category include elephant-foot or diamond buckling, stretching or detachment of bolts, deformation of failure of columns and support structures. Minor to severe releases during earthquakes can be due to the failure of flanges and pipe connections, as well as failed tank shells or roofs, while tank overturning or collapse would inevitably lead to major releases.

During a severe earthquake that hit a large chemicals facility, acrylonitrile was released to the atmosphere from a failed tank roof, and into containment dikes from two other tanks which suffered pipe breaking at the tank base. A significant amount of acrylonitrile overflowed the containment dikes and was lost in the ocean through the drainage channel as surface runoff. With the concrete containment dikes having been cracked by the earthquake, a considerable amount of substance leaked into the soil and reached the coastal aquifer below the site.

• In natural hazard prone areas an installation’s emergency plan needs to consider the risks of natural hazard impact. This includes the preparation of stand-alone emergency plans that do not rely on the availability of offsite utilities and response resources.

[eNatech accident #2]
Similar accidents: eNatech #44 #49 #50 and #51



Figure 4: The LPG tank farm at the Chiba refinery after the earthquake-triggered fires and explosions (2012 Google, ZENRIN)

Tsunamis

Tsunamis are large masses of water that are set in motion by earthquakes or landslides. The associated hydrodynamic and hydrostatic water forces, as well as debris impact, can cause tank and pipe floating and displacement, overturning and destruction, and the breaking of pipe connections and ripping off of valves. Tsunami impact can also wash away tank foundations and damage electrical systems due to water intrusion. In addition, the tsunami waters can widely disperse flammable spills, and with ignition being highly probable under these circumstances, large-scale fires can Result.

A major tsunami caused multiple pipe breaks and many small hydrocarbon spills from pipe connections when it hit a refinery located at the coast. The releases ignited, causing a major fire that involved three tanks filled with sulphur, asphalt and gasoline, and which destroyed a significant part of the refinery.

• Where land-use planning restrictions are difficult to implement for existing installations, supplementary prevention and preparedness measures are required to protect hazardous facilities from tsunami impact.


[eNatech accident #21]


Figure 5: Burned tanks at the Sendai refinery hit by the tsunami (Photo Credit: C. Scawthorn)
 

 

Motto of the semester

---------------------------

 Jim Wallis:
Sometimes it takes
a natural disaster to
reveal a social disaster


MAHBulletin

Number 6, December 2014
JRC93386

 

ContACt

For more information on related to this bulletin on lessons learned from major industrial accidents, please contact

zsuzsanna.gyenes@jrc.ec.europa.eu
or emars@jrc.ec.europa.eu
Security Technology Assessment Unit
European Commission
Joint Research Centre
Institute for the Protection and Security of the Citizen
Via E. Fermi, 2749
21027 Ispra (VA) Italy http://mahb.jrc.ec.europa.eu/

If your organisation is not already receiving the MAHBulletin, please contact emars@jrc.ec.europa.eu. Please include your name and email address of your organisation’s focal point for the bulletin.

All MAHB publications can be found at
http://ipsc.jrc.ec.europa.eu/index.php?id=503

 


The RAPID-N tool

Figure 6: RAPID-N output for release of a flammable substance from a storage tank upon
earthquake  impact

A new web-based system developed by the JRC assesses and maps the potential impact of natural hazards on chemical installations. Called RAPID-N, the system provides a framework for estimating the risk of hazardous-material releases following natural disasters (so-called Natech risk). It identifies Natech-prone areas and assesses the risk associated, to support land-use planning, emergency-response planning, damage estimation and early warning.

A recent study highlighted significant gaps in the development of methodologies for analysing and mapping Natech risk in the EU and in OECD countries. RAPID-N was developed in response to calls by governments for a decision-support tool for Natech risk management. It provides an integrated, web-based framework for Natech risk analysis and mapping. Calculating on-site natural-hazard parameters and using fragility curves to determine damage probabilities at process and storage unit level, RAPID-N estimates the overall risk of damage and the consequences associated. The results are presented as risk summary reports and interactive risk maps.

RAPID-N can be applied at different stages of the Natech risk-management process. For prevention and preparedness it assesses the potential consequences of different Natech scenarios to develop Natech risk maps for use in land-use and emergency planning. In the response phase, it can be used for rapidly locating facilities where Natech accidents may have occurred based on up-to-date natural-hazard information, so that first responders and the population in the vicinity of the facilities can receive timely warning.

The RAPID-N framework is in principle applicable to any kind of natural hazard. It is currently implemented for earthquake impact on industrial facilities. Work is underway to extend the system to analyse also floods and pipelines.

http://rapidn.jrc.ec.europa.eu

Contact information: elisabeth.krausmann@jrc.ec.europa.eu


_____________________________________________________________________________________
Please note: The selected cases also include a number of lessons learned, not all of which are described. The bulletin highlights those that it considers of most interest for this topic, with the limitation that full details of the accident are often not available and the lessons learned are based on what can be deduced from the description provided. The authors thank the country representatives who provided advice to improve the descriptions of the selected cases.