Process Safety: Are Jitters Justified?

This Month’s Puzzler

We’ve run our nitric acid purification process (see figure) for about ten years. Recently, we shut it down for minor repairs. Less than an hour into the subsequent startup, an explosion occurred. The building was filled with acrid orange-yellow gas. This prompted a unit evacuation. We barely had time to complete the emergency shutdown procedures before the general evacuation. Fortunately, nobody was hurt.

Here’s the simplified startup sequence we use: confirm all product and raw material valves are closed except vent valves — only V-100 has a car-sealed open; open waste valve (timer); unlock pump P-100 (choosing either A or B); set P-100 to 0.9 gal/min until the level gauges (LG-103) indicate column C-101 has achieved normal (45%) level; shut down P-100; unlock TC-104 after confirming that isolation valves on H-101 are open; initiate condenser flow (H-101); unlock FC-102 and set steam flow to 360 lb/hr; vent noncondensables from the steam trap using the gate valve upstream; monitor TI-101— when it reaches 265°F, set LC-101 to automatic; restart P-100; raise the high level alarm to 85% and set the low level alarm to 30%; manually adjust the cooling so temperature indicator TI-103 stays below 100°F and TI-104 remains at less than 130°F.

We’ve run this process unchanged for many years. Unfortunately, we’ve lost about 40% of our senior engineers and operators after an investment company purchased the plant.

What do you think went wrong? What can we expect as far as a U.S. Occupational Safety and Health Administration (OSHA) investigation? What can be done to improve the safety of this system? Corporate engineering wants us to start up in three weeks because damage was minor.

Take A Multifaceted Approach

You should consider three aspects: possible proximate causes of the explosion;
OSHA PSM (29 CFR 1910.119) accident investigation; and constrained resources and diplomacy.

First, as far as possible causes, the release of acrid orange-yellow gas indicates that nitric acid decomposed. This can occur either thermally or because of incompatible chemicals. Thermal decomposition generates water vapor, NO₂, and O₂ and by itself won’t account for the explosion. Nitric acid is an oxidizer and is incompatible with a number of other compounds, including organic chemicals, flammable hydrocarbons, H₂S, ammonia and SO₂. Get a list of incompatible chemicals from the vendor. Oxygen generated by nitric acid decomposition in conjunction with organics (say, impurities) possibly could have created a “flammable range;” this could have led to an explosion. You must look thoroughly into all steps and liquids involved during the startup. Were any changes made in feed or equipment prior to the startup that could explain the explosion?

Next, let’s strategize about the accident investigation. Corporate engineering terming the damage “minor” ignores personnel safety considerations. Without a good understanding of potential causes for the explosion, starting up the plant would be imprudent. Explain to them that OSHA PSM (29 CFR 1910.119 (m) mandates a prompt and thorough accident investigation and remedial action.

The accident investigation process broadly should focus on finding proximate (immediate) and ultimate causes of the incident. Proximate causes could include, for example, changes in process, operations or personnel (poor training). Ultimate causes, on the other hand, could reflect structural or management issues such as inadequate commitment to safety, insufficient training, poor records, lack of employee participation, etc.

For the accident investigation, you can draw upon a vast number of resources, including experienced outside consultants. At the end of the investigation, you should feel sufficiently confident that you have identified the most probable proximate cause(s) and have taken corrective steps. In addition, to ensure long-term safety, you must address ultimate cause(s).

The loss of experienced workers and lack of safety appreciation at corporate level create a difficult situation. You must maintain your focus on safety and the environment but must do this in the context of corporate’s financial focus. Consider:

• Short-term, emphasize the need and regulatory mandate for accident investigation. Quantify the profits the company will lose because of non-compliance and potential for another accident.
• In the mid-term, think about expanding your procedure to include relevant sections on safety precautions in startup, normal operation and shutdown. Add appropriate alarms and interlocks to minimize unsafe events. Also, bear in mind that head-pressure-based instruments are very sensitive to liquid density and will show incorrect level during startup or operations if liquid density changes; provide density correction.
• In the long run, address structural issues such as management commitment (or lack thereof), training, safety systems, etc. Given corporate’s focus on finance, you must help them recognize “safety risks” and the need for resources to ensure a safe plant. Try to quantify benefits or potential losses.

Instilling safety culture would be a slow process but long-term rewards would be immense.
GC Shah, Senior Advisor, Safety and Environmental,
Wood, Houston

Plan A Graceful Exit

Every major accident in the past twenty years ended with corporate blaming the field engineers and middle managers for its own neglect. Expect to wind up a scapegoat but conduct a good investigation; it will look good on your resumé.

The late Trevor Kletz, the renowned safety guru, cited three good reasons for avoiding a fast startup after an accident: 1) you don’t know how to prevent a reoccurrence; 2) equipment might be damaged; and 3) you’ve done nothing to reassure operators and the public that everything is okay.

The biggest problem with your plant is lack of experience. Instructions can’t be taught because they don’t match reality. Often, nobody includes operating instructions in the as-built exercise. Procedures become less written and more rote. Corporations don’t pay adequate attention to updating instructions, drawings, files, etc., so these fall into disrepair. The best solution is to bring in a few retired operators and engineers as consultants. One change you will want to push is to automate the process as much as practical.

Now, let’s use a microscope. The accident occurred before the process was running in a stable mode. Could something left over from the shutdown have contributed? Could it be the startup procedures differ from those for normal operation? Did something unique in this shutdown affect the procedures in a way unforeseen by a safety review? This could be as simple as somebody forgetting to close a vent valve.

I don’t see a lot of redundancy in your controls. Temperature control is crucial in the bottom of this type of tower; the type of measurement and its location could result in stable control or a potential blind spot. In addition, a steam system often can pose issues from the header steam traps to the boiler return: built-up condensate means poor heat transfer and wound-up steam control valves. One safety recommendation would be to add more instruments and perhaps switch from K-thermocouples, typical for older systems, to RTDs.

A key problem is the single level instrument in the bottom of the flash column. If it reads false-high, and steam was added to the column, a flash boil-up could occur that would pop the rupture disc, as happened. So, I recommend a non-contact level sensor and a redundant measurement.

Here’s another recommendation that will prevent an evacuation: relief to the scrubber. That will eliminate the emission problem. That’s probably on OSHA’s checklist — so if you bring it up first, you’re being cooperative.

Next, look at the maintenance. Was everything working on the day of the accident? Was anything recently repaired, replaced or bypassed? Cast a wide net. What was the condition of streams into and out of the column? Include the equipment upstream and downstream and, especially, check the utilities.

Let’s move on to the procedure. The basic procedure looks sound, provided the cooling fluid on the condenser is correct and the condenser isn’t fouled. Turning steam on a column without a condenser would cause the rupture disc to blow within a few minutes but only if the reboiler steam loop was out of control or the condenser was undersized or reboiler oversized. Walk down the procedure with operators on all shifts who experienced the accident. Look for deviations from the written procedure. Then, repeat this exercise, separately, with a retired operator. Again, look for deviations.

So, in summary, look for anything that would increase the heat load inside the column. In the end, you will want to recommend automation, new more-accurate operating procedures, some real-time checks on operator performance, and retraining. You may not be there to see these improvements but it looks good if you do a professional job of lighting the way.
Dirk Willard, consultant
Wooster, Ohio

October’s Puzzler

We manufacture formaldehyde using DuPont’s Formox process in a 30-yr-old system. Methanol is oxidized over a molybdenum-iron oxide catalyst at 600°F in a fixed-bed reactor: CH₃ + ½O₂ → CH₂O + H₂O. We replaced the catalyst several months ago — we had stretched the service life of the old catalyst to 18 months from the usual year because of the pandemic.