1INVESTIGATION REPORT

REPORT NO. 2003-01-I-MSOCTOBER 2003

(3 Injured, Potential Offsite Consequences)

FIRST CHEMICAL CORPORATIONPASCAGOULA, MISSISSIPPI

OCTOBER 13, 2002

KEY ISSUESEVALUATION OF REACTIVE HAZARDS

APPLYING LESSONS LEARNED

LAYERS OF PROTECTION

WORK PRACTICES

FACILITY SITING

COMMUNITY NOTIFICATION

EXPLOSION AND FIRE

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

2

3This investigation report examines an explosion and fire thatoccurred on October 13, 2002, at the First ChemicalCorporation facility in Pascagoula, Mississippi. The decompositionof mononitrotoluene inside a distillation column resulted in a runawayreaction and explosion, with potentially catastrophic offsite conse-quences. This report identifies the root and contributing causes ofthe incident and makes recommendations on evaluating reactivehazards, applying lessons learned, layers of protection, work prac-tices, facility siting, and community notification.

The U.S. Chemical Safety and Hazard Investigation Board (CSB) isan independent Federal agency whose mission is to ensure the safetyof workers, the public, and the environment by investigating andpreventing chemical incidents. CSB is a scientific investigative organi-zation; it is not an enforcement or regulatory body. Established bythe Clean Air Act Amendments of 1990, CSB is responsible fordetermining the root and contributing causes of accidents, issuingsafety recommendations, studying chemical safety issues, andevaluating the effectiveness of other government agencies involvedin chemical safety.

No part of the conclusions, findings, or recommendations of CSBrelating to any chemical incident may be admitted as evidence orused in any action or suit for damages arising out of any matter men-tioned in an investigation report (see 42 U.S.C. 7412 [r][6][G]).CSB makes public its actions and decisions through investigationreports, summary reports, safety bulletins, case studies, incidentdigests, special technical publications, and statistical reviews.More information about CSB may be found at www.csb.gov.

Abstract

Information about availablepublications may be obtained by

contacting:U.S. Chemical Safety and Hazard

Investigation Board2175 K Street NW, Suite 400Washington, DC 20037-1848

(202) 261-7600

CSB publications may bepurchased from:

National TechnicalInformation Service

5285 Port Royal RoadSpringfield, VA 22161-0002

(800) 553-NTIS or(703) 487-4600

Email: info@ntis.fedworld.gov

For international orders, see:www.ntis.gov/support/

cooperat.htm.

For this report, refer to NTISnumber PB2004-101629

Salus Populi Est Lex SupremaPeoples Safety is the Highest Law

4

5EXECUTIVE SUMMARY............................................................ 11

1.0 INTRODUCTION .......................................................... 131.1 Background....................................................................... 131.2 Investigative Process .......................................................... 141.3 First Chemical Pascagoula Facility .................................... 14

1.3.1 Facility Description ............................................. 141.3.2 Proximity to Other Industrial

Complexes and Residences ................................ 151.4 Mononitrotoluene Process ................................................ 16

1.4.1 Manufacturing and Refining ............................... 161.4.2 #1 MNT Distillation Column ............................ 16

2.0 DESCRIPTION OF INCIDENT .................................... 192.1 Pre-Incident Events ........................................................... 192.2 Incident Description .......................................................... 23

2.2.1 Day of Incident ................................................... 232.2.2 Area of Impact and Potential Consequences ...... 242.2.3 Emergency Response .......................................... 26

2.3 Reconstructive Analysis ..................................................... 262.3.1 Grid Search ........................................................ 262.3.2 Steam Control Stations ....................................... 272.3.3 Thermal Stability Testing .................................... 292.3.4 Vessel Integrity Testing ........................................ 33

3.0 ANALYSIS OF INCIDENT ............................................. 353.1 Reactive Chemical Hazard Management ......................... 35

3.1.1 Background on Mononitrotoluenes.................... 353.1.2 Hazard Evaluation for Batch Distillation

Project ................................................................. 353.1.3 Instrumentation for Batch Process ...................... 373.1.4 Procedures for Batch Process .............................. 373.1.5 Good Management Practices ............................. 383.1.6 Applying Lessons Learned .................................. 39

3.2 Monitoring and Instrumentation ....................................... 393.3 Safe Work Practices .......................................................... 413.4 Maintenance Program and Equipment Integrity ............... 44

3.4.1 Steam Valves ....................................................... 443.4.2 Distillation Column ............................................. 44

3.5 Overpressure Protection ................................................... 453.6 Control Room Construction and Location ....................... 463.7 Process Information and Retention of Records ................. 493.8 Community Notification System ....................................... 50

Contents

63.9 Review of Previous/Similar Incidents ................................ 513.9.1 Pascagoula Facility .......................................... 513.9.2 Other Incidents ............................................... 51

3.10 Regulatory Analysis ........................................................... 543.10.1 Process Safety Management Standard ............ 543.10.2 Risk Management Program ............................. 553.10.3 Other Regulatory Standards ........................... 553.10.4 OSHA Investigation ........................................ 563.10.5 Previous CSB Recommendations on

Reactive Chemicals ......................................... 573.10.6 Additional Good Management Practices......... 58

4.0 ROOT AND CONTRIBUTING CAUSES .................... 614.1 Root Causes ..................................................................... 614.2 Contributing Causes ........................................................ 63

5.0 RECOMMENDATIONS ................................................ 65

6.0 REFERENCES ................................................................ 69

APPENDIX A: Causal Factors Diagram....................................... 71

Contents (contd)

7Figures

1 Facility Overview ............................................................... 15

2 #1 MNT Distillation Column (C-501)and Related Equipment ..................................................... 21

3 Temperature at Column Bottoms,September 21October 13, 2002 ..................................... 22

4 Aerial Map of FCC Facility ............................................... 25

5 Steam Line to Reboiler ...................................................... 27

6 Breach in Valve Seat for Bypass Line ................................. 28

7 DCS Readout of Steam Flow to ReboilerWhen System was Believed to be Isolated ........................ 29

8 Mononitrotoluene Induction TimeTemperatureData on Linear Scales ........................................................ 31

9 Damage to Control Room Roof and Door ........................ 47

Table

1 Condensed Event Timeline,September 7October 13, 2002 ....................................... 19

Figures and Tables

8ACC American Chemistry Council

ANSI American National Standards Institute

API American Petroleum Institute

ARC Accelerating rate calorimeter

ASME American Society of Mechanical Engineers

C Degrees Celsius

CCPS Center for Chemical Process Safety

CFR Code of Federal Regulations

CSB U.S. Chemical Safety and Hazard Investigation Board

DBB Double block and bleed

DCS Distributed control system

DNT Dinitrotoluene

EPA U.S. Environmental Protection Agency

ESD Emergency shutdown

F Degrees Fahrenheit

FCC First Chemical Corporation

HSE Health and Safety Executive (United Kingdom)

IChemE Institution of Chemical Engineers (United Kingdom)

IEC International Electrotechnical Commission

ISA Instrument Society of America

LEPC Local emergency planning committee

meta-MNT Meta-mononitrotoluene

mmHg Millimeters of mercury

MNT Mononitrotoluene

MPC Mississippi Phosphates Corporation

MSDS Material safety data sheet

NFPA National Fire Protection Association

ortho-MNT Ortho-mononitrotoluene

Acronyms and Abbreviations

9OSHA Occupational Safety and Health Administration

para-MNT Para-mononitrotoluene

PHA Process hazard analysis

PNMC Para-nitrometacresol

psi Pounds per square inch

psig Pounds per square inch gage

PSM Process safety management (OSHA)

PSV Pressure safety valve

RMP Risk management program (EPA)

RP Recommended practice (API)

SIS Safety interlock system

SOCMA Synthetic Organic Chemical Manufacturers Association

TNT Trinitrotoluene

10

11

An explosion at the First Chemical Corporation (FCC) facilityin Pascagoula, Mississippi, on October 13, 2002, propelledlarge fragments of debris offsite, several of which landed nearcrude oil storage tanks. The offsite consequences could have beencatastrophic.

Steam leaking through manual valves heated mononitrotoluene(MNT) inside a distillation column, which was shut down at the timeof the incident and thought to be isolated. The column containedabout 1,200 gallons of MNT, a potentially highly energetic reactivematerial when heated. The material decomposed over several days,resulting in a runaway reaction and explosion.

Debris from the explosion caused a fire in an MNT storage tank thatburned for almost 3 hours, and numerous smaller fires both onsiteand offsite. Some of the debrisincluding one piece weighing over6 tonslanded in an adjacent facility.

FCC emergency responders fought the onsite fires, while localcommunity firefighters fought small fires along the public roadway.The Jackson County Emergency Management Agency called ashelter-in-place for the local community. FCC personnel began airmonitoring; later that morning, the U.S. Environmental ProtectionAgency (EPA) arrived onsite and also monitored air quality.

The U.S. Chemical Safety and Hazard Investigation Board (CSB)incident investigation revealed the following root causes:

The FCC Pascagoula facility did not have an adequate manage-ment system for evaluating the hazards of processing MNT, anddid not apply lessons learned from hazard analyses of similarprocesses in the plant.

There was no system to ensure that the MNT column wasequipped with sufficient layers of protection, including alarms,safety interlocks, and overpressure protection.

The system for ensuring consistent work practices when isolatingequipment was ineffective.

The program to ensure the integrity of isolation valves in thesteam line connected to the MNT column was inadequate.

Executive Summary

An explosion at theFirst Chemical Corporation facility

in Pascagoula, Mississippi, onOctober 13, 2002, propelled large

fragments of debris offsite,several of which landed near

crude oil storage tanks.

The column contained about1,200 gallons of MNT,

a potentially highly energeticreactive material when heated.

Some of the debrisincludingone piece weighing over 6 tons

landed in an adjacent facility.

12

CSB also determined that neither the construction of the controlroom nor its proximity to the process was evaluated to ensure thatemployees would be protected from catastrophic events. Likewise,the system for notifying the surrounding community about chemicalreleases or other hazardous incidents was inadequate to ensure thatlocal residents were informed and knew what steps to take.

CSB makes recommendations to E. I. du Pont de Nemours andCompany (which acquired the facility in November 2002); thePascagoula facility; Jackson County, Mississippi; the American Chem-istry Council (ACC); and the Synthetic Organic Chemical Manufac-turers Association (SOCMA).

13

1.1 Background

The rupture of a 145-foot-tall distillation column (C-501)1 usedto refine mononitrotoluene (MNT) caused the October 13,2002, explosion and fire at the First Chemical Corporation (FCC)facility in Pascagoula, Mississippi. The column was thought to beisolated and in standby mode at the time of the explosionapproxi-mately 5:25 amthough it contained a significant amount of MNT.

Debris from the explosion, including metal fragments and packing2

from the column, was scattered throughout the facility and propelledoffsite. One large fragment of the distillation column punctured anearby para-MNT storage tank and ignited its contents, which burnedfor almost 3 hours. A 6-ton column segment was hurled 1,100 feetand landed near a crude oil storage tank at a refinery across thehighway. Flying glass injured three FCC employees, who were in theunit control room at the time of the explosion. All three employeesreceived first-aid, and one required additional medical treatment.3

The FCC fire brigade fought the onsite fires, including the largepara-MNT storage tank fire and numerous fires initiated by burningmaterial on ejected column packing. Local community emergencyresponders provided backup and firefighting support for numeroussmall fires outside the facility. The sheriff s department providedtraffic control. FCC personnel, the U.S. Environmental ProtectionAgency (EPA), and the U.S. Coast Guard monitored the air aroundthe facility.

Because this incident had potentially significant offsite impacts andlikely involved a reactive material, the U.S. Chemical Safety andHazard Investigation Board (CSB) launched an investigation to deter-mine the root and contributing causes, and to issue recommendationsto help prevent similar occurrences.

Introduction

1The #1 MNT still (C-501) was referred to as both the still and the column.These terms are used interchangeably throughout this report.2Packing material was removable stainless-steel grating inside the column used to aid inthe distillation process.3This treatment was for an Occupational Safety and Health Administration (OSHA)-recordable injury.

The rupture of a 145-foot-talldistillation column used to refine

mononitrotoluene causedthe October 13, 2002, explosion andfire at the First Chemical Corporation

facility in Pascagoula, Mississippi.

The column was thought to beisolated and in standby mode at the

time of the explosionapproximately5:25 amthough it containeda significant amount of MNT.

A 6-ton column segment was hurled1,100 feet and landed near

a crude oil storage tank at a refineryacross the highway.

14

1.2 InvestigativeIn conducting its independent investigation, CSB examined physicalevidence, interviewed current and former FCC employees, andreviewed company documents and scientific literature. CSB investiga-tors visited neighboring companies, including Chevron and MississippiPhosphates Corporation (MPC), and surveyed the surrounding area inan effort to collect debris from the explosion. CSB contracted fortesting of chemical samples and piping components, and also consultedwith experts in the process and chemistry used at FCC. A communitymeeting was held on January 15, 2003, to gather information aboutthe incident from local residents and interested parties.

1.3 First Chemical

1.3.1 Facility Description

FCC is located on a 60-acre parcel east of Pascagoula, Mississippi,in the Bayou Cassotte Industrial Park. At the time of the incident,ChemFirst Inc., of Jackson, Mississippia member of the SyntheticOrganic Chemical Manufacturers Association (SOCMA)ownedthe facility. The plant employed 137 people and eight full-timecontractors.

E. I. du Pont de Nemours and Company (DuPont) was in the pro-cess of purchasing the FCC facility at the time of the incident anddelayed the acquisition to review the consequent damage. DuPontofficially acquired ChemFirst Inc. (the parent company of FCC) onNovember 6, 2002.

The facility is a major producer of aniline4 and nitrotoluene interme-diates and derivatives used in a variety of industries. It is one of thelargest producers of aniline, and the worlds second largest and onlyU.S. producer of nitrotoluenes.

4Aniline is an oily liquid from the aromatic amine family of chemicals, with the chemicalformula C6H5NH2.

Pascagoula Facility

Process

The facility is a major producer ofaniline and nitrotoluene intermediatesand derivatives used in a varietyof industries.

15

Figure 1. Facility overview.(Note: The crane is attached to the column damaged

in the explosion.)

Large bulk storage tanks for raw materials and finished products,warehouses and maintenance areas, control rooms and other officefacilities, and the main office complex are located onsite (Figure 1).One building near the ruptured column housed the process areacontrol room, locker room, offices, and a quality control laboratory.

1.3.2 Proximity to Other IndustrialComplexes and Residences

The FCC facility is bordered by the following:

To the south, MPC, a fertilizer manufacturerA large ammo-nia storage tank is located onsite; in addition, MPC also ownsa large gypsum pile north of FCC.

16

To the east, a Chevron refinerySeveral crude oil storage tanksare located approximately 500 feet from the FCC property line.A highway and a rail spur are also located to the east of FCC.

To the west, 0.25 mile, the Bayou Cassotte, a shipping route forbusinessesA residential area is located to the west of thebayou.

1.4 Mononitrotoluene

1.4.1 Manufacturing and Refining

MNT is used in the production of dyes, rubber chemicals, and agricul-tural chemicals. It is an aromatic5 nitro compound that is made byreacting toluene with nitrating acid, typically a combination of nitricand sulfuric acids. At the conclusion of the nitration reaction, theproductat this point consisting of MNT, residual acid, toluene, andwateris sent to a separator, where the spent acid is concentratedand recycled. The rest of the product goes through a washing stepand then flows to a toluene stripper to remove residual toluene. Theresultant purified MNT liquid flows to a three-column distillation unitto separate the three isomers6 of MNTortho-, meta-, and para-MNT.

1.4.2 #1 MNT Distillation Column

The vessel involved in the explosion, the #1 MNT distillationcolumn (C-501), was the first of three distillation columns in the unit.It was 7 feet in diameter and approximately 145 feet tall.

5An aromatic compound contains six carbon atoms that are interconnected, sometimesreferred to as a benzene ring.6An isomer is two or more chemical compounds having the same atoms in the sameproportion but differing in properties because of differences in molecular structure.There are three isomers of MNT.

Process

MNT is used in the productionof dyes, rubber chemicals, andagricultural chemicals.

The . . . purified MNT liquid flowsto a three-column distillation unitto separate the three isomersof MNTortho-, meta-,and para-MNT.

17

During normal operation, the column ran under vacuum to facilitatethe separation process. Temperatures ranged from around 350degrees Fahrenheit (F) at the bottom of the column to near ambientat the top. Two steam-heated reboilers7 supplied heat. Eight tem-perature indicators were positioned throughout the column, thoughthey were not equipped with alarms.

A pump removed material from the bottom of the column (predomi-nantly para- and meta-MNT), which was sent to a second distillationcolumn for separation of the isomers. This material might also becirculated back to C-501. A reflux pump removed liquid (predomi-nantly ortho-MNT) from the top collector tray; the liquid flowedthrough a cooler and was either sent to storage or returned to thetop of the column. The column was filled with stainless-steel packingmaterial to aid in the distillation process.

The facility central steam plant provides 300-pounds-per-square-inch-gage (psig) steam to the reboilers. The steam line to eachreboiler is a 3-inch line with inlet and outlet manual block valves anda flow control valve in series. A bypass line around the control valvecontains a manual block valve.

7A reboiler for a distillation column is a heat exchanger that generally has processmaterial flowing through one side and a heating medium, such as steam, flowingthrough the other side. When steam is used, it heats the process materialwhich,in turn, warms the material in the bottom of the vessel, causing the components withlower boiling points to vaporize.

18

19

2.1 Pre-Incident Events

Five weeks before the incident, on September 5, 2002, thePascagoula FCC facility experienced problems with the sulfuricacid concentrator upstream of the MNT unit. FCC decided to shutoff the feed to the MNT distillation columns, including the #1 MNTcolumn (C-501), on September 7 (Table 1).

2.0 Description of Incident

8Total reflux means that steam continued to be fed to the reboilers, but no fresh feedflowed to the column. Although material was continuously recycled through thecolumn, no product was removed and sent to storage.

C-501 contained approximately 1,200 gallons of MNT at the time;the column was left on total reflux.8 Due to low product demand, thedecision was made not to start up the columns in the MNT unit untilwork associated with the plant-wide shutdown (scheduled for earlyOctober) was completed. The 1,200 gallons remained inventoried inthe column, and the manual valves remained closed. There was nofollowup audit of isolation of the column prior to commencing thelonger term shutdown.

Table 1Condensed Event Timeline, September 7October 13, 2002

Date (2002) Event

Sept 7 Feed to distillation columnshut down; column left on total reflux

Sept 22 Fire in hydrogen unit;steam isolation valves closed

Sept 27 Vacuum broken on distillation column

Sept 29 Entire facility shut down formaintenance turnaround

Oct 5 Plant boilers brought back online

Oct 513 Temperature steadily increases atcolumn bottom

Oct 13 Distillation column wall breached;seconds later, at 5:25 am, columnruptures

FCC . . . shut off the feed to theMNT distillation columns, including

the #1 MNT column (C-501),on September 7. C-501 contained

approximately 1,200 gallonsof MNT at the time.

20

It was believed that the September 22 fire in the #2 hydrogen unitcould have affected steam production for the facility. Operatorsquickly attempted to isolate the heat sources to columns that werenot considered priority at the time, such as columns on reflux (includ-ing C-501). For both steam stations, operators closed the manualvalve to the reboilers, downstream of the control valve (shown asvalve 2 in Figure 2). The manual valve in the bypass line (valve 1)was normally left in the closed position. The distributed controlsystem9 (DCS) sent a signal to the control valve (valve 3) to close.

For the next 5 days, the valves on the steam line remained closed;however, DCS information reviewed after the incident indicates thatthe temperature in the base of the column did not fall below 300F.The temperature would have been expected to decrease to aroundambient if no heat was being added.

On September 27, in preparation for maintenance on the refluxcooler, unit operators broke the vacuum in C-501 (i.e., pressurizedthe column) by injecting nitrogen into the system. Nitrogen feed wasprovided through a tubing connection to the top head vapor dischargeline. Because the pressure gauge measured only the degree of vacuumon the column and had a range of 0 to 200 millimeters mercury(mmHg), there were no data to verify that the vacuum was fullybroken.10

Operations personnel did not actively monitor the temperature.Figure 3 shows a chart of the DCS data for the bottom twotemperature indicators.

9A distributed control system is an automated system used to control and monitor achemical process.10Failure to fully break the vacuum in the column likely led to air being introduced,which was not subsequently purged. The presence of air can increase the reaction rateof MNT, as discussed in Section 3.0.

It was believed that the September 22fire in the #2 hydrogen unit couldhave affected steam productionfor the facility.

For the next 5 days, the valves on thesteam line remained closed; however,. . . the temperature in the base of thecolumn did not fall below 300F.The temperature would have beenexpected to decrease to aroundambient if no heat was being added.

Operations personnel did not activelymonitor the temperature.

21

Figure 2. #1 MNT distillation column (C-501) and related equipment.

Valve Key

Bypass valve

Outlet blockvalve

Flow controlvalve

Inlet block valve

Steam stationsare identical

1

1

O-MNT tostorage

CWS CWR

Internal(chimney)

tray

#1 MNTcolumn(C-501)

Shell andtube

reboiler

P/M-MNTto storage/

C-502

Reliefvalve

To collection tank

To steam eductors

300 # steamsupply

FIC

Flowcontroller

234

Refluxpump

Refluxcooler

2

3

4

*

*

Normalliquid level

Shell andtube

reboiler

22

(Note: Thermocouple TT-5037 [the top line shown for 10/11/2002] was atthe bottom of the vessel, and TT-5039 was above the reboiler inlet line.)

Figure 3. Temperature at column bottoms, September 21October 13, 2002.

On September 29, the plant steam boilers were shut down forscheduled maintenance. The temperature in C-501 cooled to nearambient. Power was lost to DCS on October 1 and restored thenext day; the hard drive on the control system was lost on October 3and restored the following day. No DCS data are available for thesetimes.

Maintenance on the boilers was completed on October 5, and thesystem was brought back online. The temperature of the material inthe bottom of the column increased to approximately 415F by mid-morning.

Column bottoms temperatures 9-21 through 10-13

0

200

400

600

800

1000

1200

1400

9/16/02 9/21/02 9/26/02 10/1/02 10/6/02 10/11/02 10/16/02

Date

Tem

p (F

)

TT5037

TT5039

23

2.2 Incident

2.2.1 Day of Incident

The temperature of the material in the #1 MNT column (C-501)continued to rise following the boiler startup on October 5, until itreached over 450F on the morning of October 13. There is noevidence that the temperature was being monitored by operations.11

The higher temperature at the base of the column likely vaporizedsome material, which was carried up the column and accumulatedon the chimney tray at the top. On the morning of October 12, ahigh-level alarm for the tray actuated; it was silenced by the operator,but no further action was taken.

Early on October 13, an operator in the area of C-501 heardrumbling, which was followed by an increasingly loud sound de-scribed as being similar to a relief valve venting.12 Operators in thearea noticed material venting at a high velocity from an apparenthorizontal breach in the upper half of the column; it was described assmoke or steam or snow. One eyewitness described the material asblowing to the east, toward the Chevron facility.

One operator left the control room to investigate and quickly deter-mined that the only safe action was to return. He instructed twoother operators to stay inside the control room, which was locatedonly about 50 feet from the base of the column.

According to eyewitness testimony, a few seconds to minutes later,the column ruptured. The force of the explosion knocked down thethree operators who were standing just inside the control room door;they received cuts and abrasions from shattering glass. One operatorsaid he saw a fireball move past the door.

The explosion propelled the top 35 feet of C-501both the vesselhead and approximately 30 feet of the cylindrical shelloffsite. Allthe structured packing inside the column was ejected, and burning

Description

11No alarms were associated with the temperature indicators.12CSB examined the relief valve and downstream tank after the incident and determinedthat the valve did not open.

The temperature of the material inC-501 continued to rise following

the boiler startup on October 5,until it reached over 450F

on the morning of October 13.

The explosion propelled the top35 feet of C-501both the vessel

head and approximately 30 feetof the cylindrical shelloffsite.

24

residue on the packing material inside the column was also blown outand offsite. A large column sidewall fragment hit a storage tankapproximately 500 feet away, resulting in a fire in and around thevessel. The tank held more than 2 million pounds of para-MNT.The cooling tower for the unit was also struck by debris and caughtfire.

The pressure of the explosion damaged a number of buildings onsite,including the control room. Almost all of the acoustical drop ceilingsin the control room and adjacent laboratories and breakroomscollapsed. The roof was extensively damaged, cinderblock wallswere cracked and distorted, and the exterior doors were buckledand glass broken. An administration building located over 400 feetfrom C-501 was significantly damaged, including impact from a pieceof shrapnel that punctured the cinderblock wall adjacent to an office.Roll-up doors and corrugated siding on a number of additional steel-frame construction buildings were damaged.

2.2.2 Area of Impact andPotential Consequences

The explosion propelled large fragments from the vicinity of thecolumn. A piece of shrapnel struck a pipe rack directly above a500,000-pound anhydrous ammonia tank onsite. A 6-ton piece ofcolumn sidewall was hurled approximately 1,100 feet onto Chevronproperty; it landed an estimated 50 feet from a 250,000-barrel crudeoil storage tank. A valve and portions of piping were also found onChevron property as much as 1,700 feet from the column.

Within this radius of potential impact were several pieces of equip-ment that contained flammable and toxic material, including tanksand piping. As previously discussed, a crude MNT storage tank atFCC (which contained para-MNT) was hit by shrapnel and caughtfire. There were a number of other potential receptors, includingchlorine cylinders and sulfuric acid tanks. If debris had hit thisequipment, it is likely that the incident would have caused significantsecondary releases of material. (See Figure 4 for an aerial map ofFCC and the surrounding area.)

A large column sidewall fragment hita storage tank approximately 500 feetaway, resulting in a fire in and aroundthe vessel. The tank held more than2 million pounds of para-MNT.

A piece of shrapnel struck a pipe rackdirectly above a 500,000-poundanhydrous ammonia tank onsite.A 6-ton piece of column sidewallwas hurled approximately 1,100 feetonto Chevron property.

25

Figure 4. Aerial map of FCC facility.(Circle shows an approximate 2,000-foot radius from

the #1 MNT column [C-501], the area of the debris search.)

First Chemical

MPCChevron

#1 MNT column(C-501)

26

2.2.3 Emergency Response

Following the explosion, the operators gathered and accounted foreach employee. They then used water monitors and other firefightingequipment to put out the small fires caused by burning debris. Localfirefighters extinguished fires along the public highway. The largestfire was in the para-MNT storage tank. All fires were extinguishedby 8:30 am on October 13.

Wind blew the black smoke from the facility in an easterly andsoutheasterly direction over Chevron property and the Gulf of Mexico.The Jackson County Emergency Management Agency called a shelter-in-place13 for nearby residents, and a no-fly zone was established for1 mile around the facility.

2.3 ReconstructiveTo assist in determining the causes of the explosion in the #1 MNTcolumn (C-501), the CSB investigation team analyzed various aspectsof the explosion and factors leading up to it. CSB commissioned ageographic grid search for pieces of the vessel, and also tested thesteam control stations and chemical samples.

2.3.1 Grid Search

FCC contracted out the initial search for explosion debris. Thecontractor found light fragments (e.g., aluminum packing and strap-ping) mainly to the south and east, up to 0.7 mile from the facility; aportion of this material landed on a Chevron storage tank due southof the column.

Heavy fragments were concentrated mainly in a large storage tankfarm to the east, also on Chevron property. The largest piece ofdebris was a section of the top of the column, which weighed

13A shelter-in-place is called to minimize potential exposure to chemicals. The stepsinclude going inside a secure enclosure such as a house, closing all windows and doors,turning off ventilating equipment to prevent chemical ingress, and monitoring localtelevision or radio stations for further instructions.

Analysis

The Jackson County EmergencyManagement Agency called a shelter-in-place for nearby residents, anda no-fly zone was established for1 mile around the facility.

27

approximately 13,500 pounds. It was found about 1,100 feet fromthe base of C-501. The 7-foot-diameter head of the column wasnot found during these searches.

In November, FCC again used the contractor for a search of twocooling water ponds located on Chevron property. Magnetometerswere used; the head of the column was not found, though severalother large pieces were recovered. Among the items were a largesection of grating, a 4-foot-long section of 1-inch piping, and twovalvesone weighing 50 to 60 pounds.

In an effort to locate additional physical evidence, including the headof the column, CSB investigators searched a used equipment area onMPC property in December. CSB also commissioned a contractor tosearch areas not covered previously within a 2,000-foot radius of thecolumn. The entire search area covered over 81 acres.14

2.3.2 Steam Control Stations

CSB examined the means by which heat could have been applied tothe MNT that remained in C-501 after it was shut down. Separatesupply lines carried steam to the two reboilers at the base of thecolumn. Manual valves downstream of the control valves in bothlines and both bypass lines were closed on September 22, as con-firmed by log entries, interviews, and the as-found position of thevalves. In addition, the flow control valves had been commandedclosed from DCS. CSB tested both valve stations to determine if theyhad leaked and the likely cause. Each station consisted of four valves,as shown in Figure 5.

CSB contracted to have the steam stations tested in the as-foundcondition of the valves to determine leak rate. Test data showed thatthe manual valve in the bypass line for one of the stations was leakingsignificantly, over 180 pounds/hour. Corrosion and erosion caused abreach in the valve; and the steam flow caused holes to form in theseat of the valve, one of which is shown in Figure 6.

14The column head and other associated debris were never located.

Figure 5. Steam line to reboiler.(The numbered valves represent:[1] manual valve in bypass line,

[2] outlet block valve, [3] automaticflow control valve, and[4] inlet block valve.)

CSB examined the means by whichheat could have been applied

to the MNT that remained in C-501after it was shut down.

4

2

3

1

28

Examination of the other steam station indicated that it leaked as well.Although the manual valve in the bypass line (i.e., valve 1 in Figures2 and 5) did not appear to leak, the facing on the outlet block valve(downstream of the flow control valve) was severely scored fromcorrosion products and debris in the system. Because the flowcontrol valve was not intended to be a tight shut-off valve, it is likelythat steam leaked through the main branch.

Based on examination of the outlet-blocking valve for that station(i.e., valve 2), it is believed that debris and particulates may haveprevented the valve from seating properly. The steam system wasmoistmeaning that it contained liquid as well as steam vapor, whichcontributed to additional erosion and corrosion of the piping system.

These results verify that steam likely leaked through manual valvesand continued to heat material in C-501, even though the valveswere in the closed position. These findings are consistent with DCSdata, which indicate that there was flow through the line when thevalves were closed and believed to be isolating the steam source fromC-501 (Figure 7).

DCS data, though exhibiting an erratic pattern, indicate even higherflow rates than were found during CSB testing. Although the regis-tered flow rates indicated in the DCS data may not be correct, theyillustrate that flow was occurring in the system at a time when thecolumn was believed to be isolated.

Figure 6. Breach in valve seat for bypass line.

[Test] results verify that steam likelyleaked through manual valves andcontinued to heat material in C-501,even though the valves werein the closed position.

29

2.3.3 Thermal Stability Testing

The chemistry of nitrotoluenes has been studied for a number ofyears. Nitrotoluenes may decompose when exposed to high tem-peratures instantly or to elevated temperatures for an extended time.The decomposition mechanism generates gases, which can buildpressure if the material is confined.

C-501 was shut down with 1,200 gallons of material in the baseand exposed to heat for an extended time. CSB investigators theo-rized that a thermal decomposition of MNT caused the explosion.

To verify this theory, CSB arranged for testing of fresh MNT samplescollected upstream of C-501. (Because of the incident, there was no

Figure 7. DCS readout of steam flow to reboiler when system was believed to be isolated.

Nitrotoluenes may decompose whenexposed to high temperatures

instantly or to elevated temperaturesfor an extended time.

C-501 was shut down with 1,200gallons of material in the base and

exposed to heat for an extended time.CSB investigators theorized that athermal decomposition of MNT

caused the explosion.

0

200

400

600

800

1000

1200

1400

1600

1800

10/4/02 10/5/02 10/6/02 10/7/02 10/8/02 10/9/02 10/10/02 10/11/02 10/12/02 10/13/02 10/14/02

Date

Flow

(pou

nds/

hour

)

Flow in FV505A

Flow in FV505B

30

material to sample in the column itself.) The feedstock samplescontained all three isomers of MNT. They were representative ofthe MNT that would be expected to be in the column, except thatthey contained approximately 3 percent toluene, which would havebeen removed from the feedstock by the toluene stripper prior toentering C-501. Because of the low amount of toluene present, thesamples were tested as received. No other contaminants were foundin the samples.

Adiabatic calorimetry testing was conducted on the samples.15 Theinitial test used the heat-wait-search method, in which the sampletemperature is increased until reaching an exotherm, after which thesample is allowed to self-heat under adiabatic conditions. This testwas used to determine the temperature at which decompositionbegins. The MNT sample showed an exotherm beginning at 273degrees Celsius (C [523F]), with maximum rates of temperature andpressure rise of 1,500C/min and 100 bar/min.

The adiabatic calorimeter was also used to perform induction time16

measurements between 240 and 265C (464 and 509F). Thevalues were extrapolated to estimate the induction times underconditions similar to those at FCC.

Between 415 and 454Froughly the temperature range of MNTcolumn bottoms during several days prior to the explosiontheinduction time for self-heating would have decreased from about 35days to just over 1 day, respectively, as shown in Figure 8. Thecolumn bottoms temperature was measured at 454F a few hoursbefore the explosion. Thus, the induction data are consistent with aself-heating reaction.

15Adiabatic calorimetry is a chemical testing technique that determines the self-heatingrate and pressure data of a chemical under near-adiabatic conditions. (Adiabatic refersto any change in which there is no gain or loss of heat to the environment.) Thismeasurement technique estimates the conditions for, and consequences of, a runawaychemical reaction.16Induction time is the amount of time that a material must be held at a certain tempera-ture before an exotherm (in this case, a decomposition) is observed. Materials maydecompose if they are exposed to their onset temperature (lowest temperature atwhich decomposition activity is observed), or if they are held at an elevated (but lower)temperature for an extended time.

Between 415 and 454Froughlythe temperature range of MNTcolumn bottoms during several daysprior to the explosionthe inductiontime for self-heating would havedecreased from about 35 days to justover 1 day, respectively.

The induction data are consistentwith a self-heating reaction.

31

Figure 8. Mononitrotoluene induction timetemperature dataon linear scales.

These results are consistent with information found in literatureconcerning the decomposition of MNT. In a paper presented at anInstitution of Chemical Engineers (IChemE) symposium, the authorsnote that a number of incidents occurred when MNT was heated toexcessively high temperatures or held at more moderate temperaturesfor an extended time (Harris, Harrison, and MacDermott, 1981).The latter phenomenon is referred to as the induction effect. Forlarge batches of material (on the order of the amount in C-501 priorto the incident) that are exposed to temperatures between 401 and419F, a violent decomposition will occur within 8 to 25 days. Thisis consistent with conditions at FCC prior to the incident.

In a Journal of Loss Prevention Process Industries article, Chen andChai-Wei (1996) note that the decomposition of MNT occurs intwo phases. Phase one is a slower self-heating initiated at 284F, andphase two is an accelerated self-heating initiated at 392F.

For large batches of [MNT]. . .that are exposed to temperatures

between 401 and 419F, a violentdecomposition will occur

within 8 to 25 days.

0

10

20

30

40

400 425 450 475 500

Temperature, F

Indu

ctio

n Ti

me,

day

s

32

As part of its investigation of the incident, DuPont also considered thepossibility of an additional decomposition that involved material on aninternal tray toward the top of the column. The material was thoughtto be mostly ortho-MNT because it had a lower boiling temperatureand was the isomer most likely to accumulate in the upper part of thevessel. According to DCS data, the tray lost its contents within a matterof seconds just before the explosion. DuPont attributed this loss to thetray being damaged by a pressure impulse due to decomposition in thebase of the column.

The predominantly ortho-MNT contacted fouling residue when itspilled onto the packing below. DuPont tested the solids in theresiduewhich contained enamine, azo, and azoxy groupsanddetermined that they significantly lowered the onset decompositiontemperature. The presence of air in the column, as well as pressure,was also determined to make the material more reactive.

DuPont determined that the following factors contributed to asecondary decomposition in the top part of C-501:

The MNT on the top tray was the more reactive isomer, ortho-MNT.

The presence of solids on the packing lowered the onsettemperature of decomposition.

Air was introduced into the column during maintenance work.

The column was kept under pressure rather than being keptunder vacuum after maintenance.

As part of its independent investigation, CSB reviewed the results ofthe DuPont investigation. Additional evidence in literature suggeststhat the factors present could have caused a more energetic reaction.In his book Distillation Operation, Kister (1990) notes a previousincident in which MNT was held at 150F and air was introduced.A previously unknown exotherm set in, causing an explosion. Duh etal. (1997) note that ortho-MNT is more unstable than the otherisomers, as represented by a lower onset temperature and a higherheat of reaction. Although it cannot be stated conclusively that asecondary explosion occurred in the top of C-501, it is a plausibleexplanation for the burst of energy that separated the vessel. (Seethe causal factors diagram in Appendix A.)

DuPont tested the solids in the[fouling] residue . . . and determinedthat they significantly lowered theonset decomposition temperature.The presence of air in the column, aswell as pressure, was also determinedto make the material more reactive.

Although it cannot be statedconclusively that a secondaryexplosion occurred in the top ofC-501, it is a plausible explanationfor the burst of energy that separatedthe vessel.

33

2.3.4 Vessel Integrity Testing

To determine if thinning of the column wall may have been a causalfactor in the incident, CSB investigators examined the upper portions ofC-501 and found that the metal had thinned to only 30 percent of itsoriginal thicknessmost likely due to external corrosion under theinsulation. This finding raised the possibility that vessel integrity was afactor in the incident.

The design drawing17 and nameplate for C-501 show the designpressure as 15 pounds per square inch (psi).18 When thermalstability testing was performed, the pressure in the test chamberreached approximately 240 psi before the testing equipment shutdown, indicating that the pressure in the vessel likely exceeded thisvalue.

The thermal stability testing contractor calculated that the ultimatepressure generated inside C-501 due to decomposition could havebeen as high as 3,800 psi. Even if the vessel wall was not thinned,the column could not have withstood this pressure. CSB concludedthat the vessel would eventually have ruptured even if there was nodegradation of wall thickness.

17MNT Tower (AS-501) Aniline Plant, First Chemical Corporation, Pascagoula,Mississippi, Dwg. No. E1552-305A.18The design pressure for vessels generally includes a safety factor. A vessel is expectedto withstand a somewhat higher pressure than design before failing.

The thermal stability testing contractorcalculated that the ultimate pressure

generated inside C-501 due todecomposition could have been

as high as 3,800 psi.

CSB concluded that the vesselwould eventually have rupturedeven if there was no degradation

of wall thickness.

34

35

Among the factors contributing to the incident at FCC are thefollowing: Inadequate understanding of the potential hazard of thermal

decomposition in continuous processing equipment.

Insufficient instrumentation to allow monitoring and control ofthe process to prevent a catastrophic release.

Lack of a system to ensure isolation of heat sources.

Inadequate preventive maintenance, which allowed leaks inisolation valves.

The consequences of this incident were also exacerbated byinadequate evaluation of the location and structure of the controlroom, and poor community notification.

3.1 Reactive Chemical

3.1.1 Background onMononitrotoluenes

The distillation column involved in the October 13 incident (C-501)separated three different isomers of MNT. Bretherick (1999) notesthat explosions have occurred during fractional distillation to separatemixed nitrotoluene isomers when they were excessively heated orwhen materials were held at more moderate temperatures for anextended time. MNT may decompose explosively if heated above190C (374F; Lewis, 1996).

3.1.2 Hazard Evaluation forBatch Distillation Project

The isomers of MNT can be separated by either batch or continu-ous distillation. C-501 was part of a continuous process (i.e., MNTfeedstock was continuously sent to it, and it was continually heated toseparate the lower boiling material from the other isomers).

3.0 Analysis of Incident

Hazard Management

The isomers of MNT can beseparated by either batch or

continuous distillation. C-501 waspart of a continuous process.

36

FCC personnel considered MNT to be stable when it was separatedin the continuously operating stills. They could not recall any previ-ous incidents in which the temperature or pressure had rapidlyincreased in the MNT stills.

In 1996, the Pascagoula facility decided to perform additional MNTisomer separation using a column that was already onsite (AS-310).The separation took place using batch technology, where a specificvolume of material is pumped into the column in batches and thenheated to the desired temperature until the appropriate amount ofortho-MNT is distilled. This batch distillation process involved alarger inventory of material than the continuous process and had notbeen performed previously at the site.

FCC performed a process hazard analysis (PHA) of the equipment inthe batch process in March 1996. The PHA included literaturesearches on the thermal stability of MNT, as well as data fromprevious incidents involving the material. As a result of this effort,operating limits were added to the procedures, and recommenda-tions were implemented that resulted in additional safeguards beingadded to the batch vessel.

According to at least one data source documented in e-mails andinteroffice memoranda, a safe distillation temperature was no morethan 374F (190C). It was noted that this value agreed withaccelerating rate calorimeter (ARC)19 work performed on behalf ofFCC, where an onset of an exotherm20 was detected around 365Ffor the material that would be charged to the batch still. The safeconditions under which to operate the still were set at

37

100F. However, one of the laboratories presented the followingcaution in its report:

. . . Lengthy exposure to high temperature, even below theexotherm detection point, can influence the behavior. Thesechemicals may therefore undergo decomposition at lowertemperatures than those found in this study depending on theirprevious exposure history. (Italics added for emphasis.)

3.1.3 Instrumentationfor Batch Process

In April 1996, a list was developed to ensure that the PHA recommen-dations were addressed prior to startup of the batch distillation. One ofthe recommendations was the addition of an interlock to stop the flowof the heating medium (i.e., hot oil) to the reboiler if the temperature inthe column was too high. The column also contained an interlock thatstopped hot oil flow to the reboiler if the pressure in the vessel was toohigh (i.e., represented by a loss of vacuum).

3.1.4 Proceduresfor Batch Process

The procedures for performing distillation on the batch column(AS-310) contained notes under a section called Safety Items.Among these notes were the following:

Any time the still pot bottoms temperature exceeds 400degrees F shut down the hot oil flow and closely monitor thebottoms temperature.

For operations personnel:

Do not allow the temperature in the still pot to exceed395F for more than 1 hour due to product breakdown.

Do not allow the heat to stay on the still pot if the desiredvacuum is not available!

One of the recommendations wasthe addition of an interlock to stop

the flow of the heating medium(i.e., hot oil) to the reboiler

if the temperature in the columnwas too high.

38

3.1.5 Good Management Practices

Managing chemical reactivity is a core competency of the chemicalindustry. The Center for Chemical Process Safety recently publishedEssential Practices for Managing Chemical Reactivity Hazards (CCPS,2003). Although the design and operation of the MNT batch andcontinuous units at FCC predate this publication, many of the stepstaken in the batch distillation of MNT were consistent with CCPSguidance and demonstrate the degree of diligence in place duringprocess development.

However, there was no system to apply evaluation results from thebatch process to continuous processing equipment. No hazardanalysis system was in place for the continuous MNT distillationcolumns becausein this older, ongoing production processthepotential hazards were not fully recognized.

Good management practices recommended by CCPS includecollecting, identifying, and testing for chemical reactivity hazards;assessing reactivity risks; identifying controls and management options;and reviewing and auditing the program. The FCC literature searchfocused on thermal stability; additional testing to confirm stability;conducting a PHA to evaluate risks; addressing recommendations,including adding interlocks to stop heat input based on high tempera-ture; and having explicit warnings in operating proceduresallcritical items in an effective program.

At the time of the incident, there was no high temperature interlockin place to shut off the heat source to the continuous MNT column(C-501), similar to the one that had been added to the AS-310column. Also, the operating procedures for C-501 did not empha-size the cautions that were listed in the AS-310 procedures.

C-501 processed a lesser volume of material than the batch columnand had a successful operating history. Because of these factors,FCC took a different approach in hazard evaluation of the twoprocesses and did not do a formal hazard evaluation of C-501.However, the operating practices associated with C-501includingleaving material in the column when the unit was shut down and notverifying positive isolation of the heat sourcemade the conditions inthe vessel at the time of the incident similar to those in the batchcolumn.

. . . Many of the steps takenin the batch distillation of MNTwere consistent with CCPS guidance. . . However, there was no systemto apply evaluation results fromthe batch process to continuousprocessing equipment.

At the time of the incident, there wasno high temperature interlock in placeto shut off the heat source to thecontinuous MNT column (C-501),similar to the one that had been addedto the AS-310 column.

The operating practices associatedwith C-501including leavingmaterial in the column when the unitwas shut down and not verifyingpositive isolation of the heat sourcemade the conditions in the vesselat the time of the incident similar tothose in the batch column.

39

3.1.6 Applying Lessons Learned

CCPS (2003) notes that:

Multiple facilities in an organization may have similar chemicalreactivity hazards . . . or use similar technology to control theassociated hazards. If so, it may be more efficient for a corpo-rate office or personnel to assume responsibility for someimprovement activities . . . This can also facilitate communica-tion of incidents and best practices between facilities.

Although this comment focuses on sharing best practices amongdifferent facilities, it also applies to different units or processes at thesame facility.

The MNT continuous unit processed the same material as the batchunit. If FCC had a program in place to proactively identify hazards inthe continuous unit, or broadly applied knowledge acquired duringhazard review of the batch unit, it is likely that additional hardwareand administrative safeguards would have been implemented. Thisproactive approach of conducting evaluations when new information isacquired is preferable to conducting them only when existing equip-ment or procedures are changed.

3.2 MonitoringThe #1 MNT column (C-501) processed material that could undergodecomposition. An important aspect of safely processing such materialis to have appropriate instrumentation in the form of indicators, alarms,and active controls. Indicators and alarms warn operators of upsets.As another layer of protection, active controlssuch as safety interlocksand emergency shutdown (ESD) systemsuse the output from indica-tors to automatically correct problems. This instrumentation should befunctional at all times, even when equipment is in abnormal operatingconditions, such as extended shutdown.

In Guidelines for Engineering Design for Process Safety, CCPS(1993a) notes that the concept of layers of protection applies to thedesign of control systems: Facilities which process hazardousmaterials should be designed with multiple safety layers of

and Instrumentation

If FCC had a program in placeto proactively identify hazards in thecontinuous unit, or broadly appliedknowledge acquired during hazardreview of the batch unit, it is likely

that additional hardware andadministrative safeguards would

have been implemented.

C-501 processed material that couldundergo decomposition. An important

aspect of safely processingsuch material is to have appropriate

instrumentation in the formof indicators, alarms,

and active controls.

40

protection. CCPS reiterates that multiple layers are often necessaryto achieve high levels of certainty that protection will be availablewhen needed. Automatic action safety interlock systems (SIS) or ESDsystems provide a layer of protection if primary barriers to failuresuch as critical alarms, operator supervision, and manual interven-tiondo not correct a deviation. In some processes, it may benecessary to have a quench system to remove heat if the temperaturerapidly increases. The interlock installed on the batch MNT distilla-tion column (A-310) in 1996 to stop hot oil flow to the reboiler inthe event of high temperature is an example of an active control(Section 3.1).

As discussed previously, FCC did not evaluate or fully understandthe potential hazards of handling MNT throughout the continuousprocess, as reflected in the lack of instrumentation on C-501. Sevenof the eight temperature indicators, positioned from the bottom to thetop of the column, were functioning at the time of the incident. Theindicators sent a DCS signal to the operators computer screens.However, unlike the batch distillation process, there were no alarmson the indicatorsand there were no interlocks on the column,which would stop the heat input if the temperature was too high.

Essential Practices for Managing Chemical Reactivity Hazardsemphasizes that the basic process control system and protectivesafeguards must be designed, operated, and maintained to a highstandard (CCPS, 2003). Analysis techniques to evaluate both thebasic process control system and SIS are not only an issue in newconstruction, but also throughout active operation (CCPS, 1993b).

ANSI/ISA-84.0121 notes that the following steps are necessary todetermine the appropriate safety system level for instrumentation(including sensors, alarms, and shutdowns):

Conduct a PHA

Assess risks

Apply protective layers

Determine if further safeguards are required.

21This joint publication by the American National Standards Institute (ANSI) and theInstrument Society of America (ISA), Application of Safety Instrumented Systems forthe Process Industries, provides guidelines on how to design, operate, and maintainsafety-instrumented systems, such as high-temperature interlocks. Other industrystandards include those of the International Electrotechnical Commission (IEC, 2003).

Automatic action safety interlocksystems or ESD systems provide alayer of protection if primary barriersto failuresuch as critical alarms,operator supervision, and manualinterventiondo not correcta deviation.

FCC did not evaluate or fullyunderstand the potential hazards ofhandling MNT throughout thecontinuous process, as reflected inthe lack of instrumentation on C-501.

Unlike the batch distillation process,there were no alarms on theindicatorsand there were nointerlocks on the column, whichwould stop the heat input if thetemperature was too high.

Facilities which process hazardousmaterials should be designed withmultiple safety layers of protection.

41

ANSI/ISA-84.01 provides no specific guidance on these steps, notingthat each company selects preferred tools for risk evaluation.

When the batch column (AS-310) was brought online in 1996,FCC conducted a PHA and determined that an additional interlockwas necessary to stop the flow of heating medium to the reboiler ifthe temperature in the vessel was too high. There was no evidencethat a PHA was performed on C-501 or that consideration wasgiven to the appropriate level of instrumentation. The last line ofdefense in protecting a column is often the relief device (Section 3.5).

Having an evaluation system to determine the necessary level ofinstrumentation and control, similar to the one outlined in ANSI/ISP-84.01, would have provided FCC with the opportunity to review itsinstrumentation for process monitoring and process control. Such areview would have helped to ensure that critical equipment wasconsistently instrumented throughout the facilityand may have ledto the addition of safeguards on C-501, which would have de-creased the likelihood of the October 13 incident.

3.3 Safe Work PracticesEffective training, standardized procedures for safe practices, andcommunication are essential to ensure that work practices are completeand consistent throughout a facility. As discussed in Section 3.1, FCCdid not evaluate or fully understand the potential hazards of handlingMNT throughout the continuous process, which was further demon-strated by the lack of an effective system to ensure safe work practices.

Effective operating procedures should:

Address all modes of operation, including abnormal situationssuch as extended shutdowns for all foreseeable causes andstartup after shutdown.

Specify the critical parameters to monitor (such as temperature),even when the column is shut down.

Provide information about the hazards of materials beingprocessed, operating limits, and actions to take if limits areexceeded.

Specify how to accomplish critical tasks such as isolation.

There was no evidence that a PHAwas performed on C-501 or that

consideration was given to theappropriate level of instrumentation.

42

The FCC procedure that guided operation of C-501 was entitled#1 MNT Still/#2 MNT Still and Toluene Stripper.22 It providedno cautions about the nature of MNT, potential instabilities of thematerial, or safe operating limits and the consequences of deviations.

In contrast, the operating procedure for the MNT batch process23

included cautions and required operators to shut down the heatsource if the temperature exceeded 400F. The procedure for thebatch process also included actions to take in the event of self-heating.

The procedural section on emergency shutdown of C-501 appliedto steam failure (presumably to the overhead eductors) or coolingwater failure. No other situationssuch as isolating the column dueto upsets in other processing units, as happened on September 22were discussed. In the case of steam failure, the instruction directedoperators to place the steam to the reboiler control valves in manualand closed position, and block in condensate return off eachreboiler.

The flow valves were not designed to be tight shutoff valves. Theinstructions did not specify that the steam line to the reboilers shouldbe double blocked and bled,24 even though operations personnelnoted that they knew those were the steps necessary to isolate theline. In addition, the practice at the time of the incident did notinclude placing blinds in the steam line, which would have providedan additional degree of isolation.

Although the normal practice was to leave material in the columnduring shutdown (unless it was to be entered for maintenance), theprocedures did not provide any guidance on monitoring conditions inthe column (including temperature) while it was shut down. FromOctober 5when the boiler was restarteduntil the day of the

22#1 MNT Still/#2 MNT Still and Toluene Stripper, Document No. 1201.003-1003,Revision 11, FCC.23AS-310 MNT Distillation, Document No. 1201.003-1702, Revision 6, FCC.24Double-block and bleed (DBB) and blinding are two methods of isolatingmaterial. For DBB, two valves are closed and a drain is opened betweenthem so that any accumulated material flows through the drain and notthrough the valve. A blind is a solid plate installed in piping to preventmaterial flow.

The procedural section on emergencyshutdown of C-501 applied to steamfailure (presumably to the overheadeductors) or cooling water failure.No other situations . . . werediscussed.

The flow valves were not designed tobe tight shutoff valves.

From October 5when the boilerwas restarteduntil the day of theincident, the temperature steadily roseand was well in excess of the 400Flimit specified in the batch distillationprocedure.

43

incident, the temperature steadily rose and was well in excess of the400F limit specified in the batch distillation procedure developed in1996.

Along with procedures, communication about current conditionsand training are vital to the safe and efficient operation of a processfacility. Effective training teaches employees how to safely performtheir jobs under normal and abnormal situations. CCPS (2003)notes that communication and training cannot be overlooked whendeveloping programs to control chemical reactivity hazards: Alloperating personnel should have a good idea of what will happen if. . . a process is operated in the wrong range.

Although level accumulation on the top tray of C-501 was not thecause of the decomposition reaction, a high-level alarm was receivedwhile the process was believed to be nonoperational. The alarmwas acknowledged on the computer screen, but no further actionwas taken. Good practice includes evaluating alarms and determin-ing the reason for their activation.

As noted in Section 3.1, the lack of a system to identify the hazardsassociated with MNT in the continuous process resulted in an inad-equate understanding of the sensitivity of the material to heat. Whenequipment is not operatingand heat is not being removedMNTmust be positively isolated from heat sources to keep the temperaturefrom increasing. A comprehensive training program would haveprovided another opportunity to assess the hazards and communicatethem to operations personnel.

An effective system of safe work practices would have ensured that:

All necessary steps were followed for the isolation of equipment

The hazards of the material were communicated

The procedures codified relevant information.

If the steam supply was effectively isolated from the column, the chainof events that led to this incident would not have occurredeventhough C-501 was inventoried with material. In addition, if thetemperature in the column had been monitored during the time thematerial inside was heating, operators may have been prompted totake corrective action.

Although level accumulationon the top tray of C-501 was not

the cause of the decompositionreaction, a high-level alarm wasreceived while the process wasbelieved to be nonoperational.The alarm was acknowledged

on the computer screen, butno further action was taken.

The lack of a system to identify thehazards associated with MNT in

the continuous process resultedin an inadequate understanding of

the sensitivity of the material to heat.

If the steam supply was effectivelyisolated from the column, the chain of

events that led to this incident wouldnot have occurredeven though

C-501 was inventoried with material.

44

3.4 MaintenanceMaintenance activities complement operations and contribute toprocess safety by ensuring the mechanical integrity of equipment.Maintenance planning and implementation are integral to the safeand efficient operation of process systems. Corrosion, erosion, andfatigue can cause failures in equipment and result in process fluidsinadvertently entering equipment or being released.

The importance of preventive maintenance to process safety man-agement cannot be overemphasized. (CCPS, 1995c). An effectivepreventive maintenance program establishes inspection frequencies forprocess equipment that is vulnerable to such conditions as corrosion,erosion, and fatigue.

3.4.1 Steam Valves

The MNT system maintenance practices at FCC were less thanadequate. There was no evidence that the reboiler steam supplyvalves had ever been evaluated to determine what maintenanceactivities were necessary to ensure proper function. Post-incidenttesting of critical steam isolation valves determined that the valve seatsleaked a significant amount of steam, even when the valves were inthe closed position. This uncontrolled and unrecognized steam flowcontributed to the failure of the #1 MNT column (C-501).

3.4.2 Distillation Column

Interviews with FCC facility personnel revealed that they thought theoperating temperature of C-501 was sufficiently high to prevent theaccumulation of moisture under external insulation and corrosion ofthe carbon steel surface. Because of this assumption, FCC did notmonitor the condition of the steel. However, the C-501 operatingprocedure25 stated that the mid-bed operating temperature is about300F and the top of the column is about 140F.26

25#1 MNT Still/#2 MNT Still and Toluene Stripper, Document No.1201.003-1003,Revision 11, FCC.26Below 140F, the moisture is expected to vaporize.

Program andEquipment Integrity

Post-incident testing of critical steamisolation valves determined that thevalve seats leaked a significant amountof steam, even when the valveswere in the closed position. Thisuncontrolled and unrecognizedsteam flow contributedto the failure of C-501.

CSB found significant externalsurface corrosion under the upperareas of C-501, including one areawhere the wall was degraded to30 percent of its original thickness,with a corresponding reductionin pressure capacity.

45

CSB found significant external surface corrosion under the upperareas of C-501, including one area where the wall was degraded to30 percent of its original thickness, with a corresponding reduction inpressure capacity. Although the thinned wall did not cause theincident, it is evidence of inadequacy in the FCC inspection andmaintenance program at that time.

3.5 OverpressureThe #1 MNT column (C-501) was designed, fabricated, and testedin accordance with the American Society of Mechanical Engineers(ASME) pressure vessel code; it had a nameplate rating of 15 psig. A3-inch nominal pressure safety valve (PSV-502) attached to the over-head vapor line, with a set pressure of 15 psig, provided overpressureprotection.

Industry literature and test data show that MNTif exposed to hightemperaturesmay violently decompose and generate large volumesof vapor. The PSV must have adequate flow capacity to limit themaximum pressure in a column caused by a runaway reaction.

Determining the relief valve size on a reactive chemical system iscomplex and requires physical test data on reaction kinetics and flowcharacteristics. Laboratory test results of MNT are required to deter-mine if the vented contents are a pure gas, a pure liquid, or a combina-tion of bothcommonly known as two-phase flow.

In the absence of effective safeguards to prevent a runaway reaction,such as safety interlocks and safety work practices (discussed previ-ously), FCC relied on the PSV for C-501 to provide protection inthe event of a thermal decomposition. CSB determined that thecapacity of the PSV was inadequate to prevent overpressurizationand catastrophic failure of the column.

Protection

Industry literature and test data showthat MNTif exposed to high

temperaturesmay violentlydecompose and generate large

volumes of vapor.

FCC relied on the [pressuresafety valve] for C-501 to provide

protection in the event of a thermaldecomposition. CSB determined that

the capacity of the PSV wasinadequate to prevent over-

pressurization and catastrophicfailure of the column.

46

As part of thermal stability testing, the CSB contractor estimated that avessel the size of C-501, with a design pressure of 15 psi, wouldifplaced on the overhead vapor linerequire a 58-inch-diameter reliefvalve. This excessively large size would call for alternate methods ofoverpressure protection, including increasing the number or alteringthe location of relief devices.27

Because FCC had no documentation on the design basis for theinstalled PSV on C-501, CSB was unable to determine the scenarioused. The American Petroleum Institute (API) RecommendedPractice (RP)-521, Guide for Pressure-Relieving and DepressuringSystems, notes that several scenarios must be considered in determin-ing the required capacity of a safety relief valve, including chemicalreaction. API states that pressure relief considerations should includeestimated vapor generation from both normal and uncontrolledconditions. When a pressure relief device cannot feasibly controlpressure, other design strategies may be employed to prevent equip-ment damage, including automatic shutdown systems.

If FCC had an effective system in place to evaluate the overpressureprotection for C-501, it would likely have determined that the reliefvalve was inadequate. This determination could have led to a com-prehensive review of the overpressure protection scheme (i.e., loca-tion, size, and number of relief valves) and the addition of safeguards toprevent a decomposition reaction.

3.6 Control RoomShattering glass from the control room door injured three people inthe control room at the time of the incident (5:25 am; Figure 9).The time of day was likely a factor in limiting the number of injuries.

The control room for the aniline unit (including the MNT columns)was constructed of masonry block, with sheet metal on the roof and

27The location of relief devices, as well as their sizing, must be considered whenevaluating overpressure protection for vessels. Kister (1990) notes that the vapor spaceat the bottom of a column, just below the packing supports, may be considered as alocation for pressure relief devices. In one case, a low-positioned relief preventedoverpressure when a device at the top of the column would have been ineffective.

Construction andLocation

If FCC had an effective system inplace to evaluate the overpressureprotection for C-501, it would likelyhave determined that the relief valvewas inadequate.

47

Figure 9. Damage to control room roof and door.

sides. The building was located approximately 50 feet from the #1MNT column (C-501). The explosion resulted in structural damageto the walls of the building and the roof (Figure 9). Several otherbuildings onsite were damaged, including the administration building,which was located approximately 450 feet from C-501.

Facility siting guidelinesparticularly those published by CCPS andAPIcover the location and construction of control rooms in thechemical and petrochemical industries. API RP-752 (1995) wasdeveloped for facilities covered by the Process Safety Code of theChemical Manufacturers Association (now the American ChemistryCouncil [ACC]). FCC was previously a member of CMA and was amember of SOCMA (which adopted the Process Safety Code) at thetime of the incident.

API RP-752 includes a step-by-step analysis, beginning with occu-pancy screening and proceeding to hazard identification, buildingevaluation, and risk management. It is applicable to both new andexisting buildings. The guideline notes that some companies use arange of 200 to 400 personnel hours per week to determine whencontrol room occupancy requires a higher level of analysis.

The control room for the FCC aniline unit would typically have hadoccupancy well in excess of this range. The peak occupancyor

The control room for the aniline unit(including the MNT columns) wasconstructed of masonry block, with

sheet metal on the roof and sides.The building was located ap-

proximately 50 feet from C-501.

Facility siting guidelinesparticularlythose published by CCPS and API

cover the location and constructionof control rooms in the chemical and

petrochemical industries.

48

number of personnel that may be exposed in a given period(e.g., such as at a production or safety meeting)should also beconsidered.

Another consideration for occupancy is the ability to evacuate abuilding, though API RP-752 notes that:

Process materials that have the potential for runaway reac-tions or chemically or thermally induced decomposition mayproduce toxic, fire, or explosion effects with little or nowarning . . . and . . . building evacuation may not be a viableoption.

API RP-752 lists components that may explode due to chemicaldecomposition as materials of concern. CCPS (1996) notes thatprocesses of concern include those that have the potential for uncon-trolled chemical reactions. Methods of calculating the potentialconsequences of releases include TNT-equivalency, Multi-Energy,and Baker-Strehlow.

Hazard evaluation tools, such as the Dow Fire and Explosion Indexand the Mond Index, can be used to assist in prioritizing buildings.

The last step in the guidance is to assess risk and determine thenecessity for preventive or mitigative measures. Preventive measuresinclude adding redundant instrumentation and emergency shutdowns,or altering process conditions or materials to reduce the potential forrunaway reactions. Mitigative measures include eliminating ormodifying windows in buildings, or reinforcing or otherwise modifyingstructures to withstand pressure.

If FCC had performed such an analysis, it would have likely deter-mined that the location and structure of the control room presented arisk to occupants. This conclusion could have led to:

Preventive measures, such as adding instrumentation to columnsprocessing highly energetic material.

Mitigative measures, such as removing windows and puttingsolid doors on the control room, reinforcing walls, or relocatingthe control room.

. . . Processes of concern includethose that have the potential foruncontrolled chemical reactions.

Preventive measures include addingredundant instrumentation andemergency shutdowns, oraltering process conditions ormaterials to reduce the potentialfor runaway reactions.

Mitigative measures includeeliminating or modifying windowsin buildings, or reinforcingor otherwise modifying structuresto withstand pressure.

49

3.7 ProcessThroughout the investigation, CSB reviewed procedures, testingdata, and equipment files. However, some of the informationprovided by FCC was incomplete or in error. For example, norecords were provided for the scenarios considered in sizing therelief valve on the #1 MNT column (C-501). Therefore, CSBwas unable to draw conclusions as to failures in the design phase,except to note that subsequent testing of MNT demonstrated thatthe valve was not sized for a thermal decomposition, which was avalid consideration for this material.

CSB also inquired about previous studies regarding the location andstructure of the control room. FCC personnel stated that theybelieve a study was performed, but there was no documentation.

CSB sought documentation to support exclusion of the MNTdistillation area from requirements of the Occupational Safety andHealth Administration (OSHA) Process Safety Management (PSM)Standard, 29 CFR 1910.119. Again, FCC personnel noted that theevaluation occurred, but there was no documentation. (See Section3.10 for a discussion of regulatory analysis.)

Upon request, FCC provided two material safety data sheets(MSDS) for MNT. The 1992 MSDS noted that MNT: Decom-poses slowly at 392F. The 1998 MSDS did not include thiswarning, though it was produced after the MNT batch project,when testing and literature searches showed that MNT wassusceptible to thermal decomposition (Section 3.1.2).

The MNT continuous process was commissioned in the late 1960s,prior to the electronic storage of information. FCC personnel notedthat much of the information was lost when people left the company(due to downsizing, resignations, or retirements) and during the sale ofa portion of the facility to Albermarle, in which documents were takenoffsite for review and in some cases not returned. Personnel also notedthat a hurricane destroyed some files.

A comprehensive information management system is essential tomaintaining safe operations. Operations personnel must have accessto reliable information on the safety of process material and equip-ment. Neither the MSDSs nor FCC operating procedures containedappropriate cautions about MNT. As noted in Section 3.1.6, therewas no system in place to evaluate the hazards and apply lessons

Information andRetention of Records

Neither the MSDSs nor FCCoperating procedures contained

appropriate cautions about MNT.

There was no systemin place to evaluate the hazards

and apply lessons learnedfrom other processes.

50

learned from other processes. The lack of a comprehensive system tomanage and distribute information, however, meant that even if thehazards had been evaluated and the potential results known, thatinformation may not have been effectively communicated.

3.8 CommunityAn effective community notification system alerts people to the factthat an incident occurred and informs them when the situation isover. As part of the notification system or educational campaign,people are instructed on the appropriate steps to take to protectthemselves.

CSB evaluated the emergency response and community notificationsystem. This effort included a meeting with the local emergencyplanning committee (LEPC) and a community meeting with localresidents. It also included surveying several industrial areas withresidential neighbors to determine good practices in communitynotification and emergency response. The survey revealed multiplemethods of communicating information about chemical incidents,including sirens and reverse 9-1-1 systems. Local residents in thoseareas had been trained on shelter-in-place procedures.

CSB determined that the Jackson County public communicationsystem was ineffective. A shelter-in-place was called, but it was noteffectively communicated to local residents by the mediawhich isessential to ensure that appropriate actions are taken by residents andneighboring companies. There is also a need for improved commu-nity education and training on what steps to take in the event of ashelter-in-place. Although post-incident monitoring and analysis ofwind direction indicated that the smoke moved away from residentialareas, timely communication with residents would have decreasedtheir anxiety.

Numerous County, State, and Federal agencies and corporateneighbors responded to this incident, including local fire and police,the Chevron refinery fire department, the U.S. Coast Guard, andthe County Sheriff. Police and fire personnel quickly closed BayouCassotte Industrial Road. The sheriff issued the order to shelter-in-place. The Federal Aviation Administration established a no fly

Notification System

CSB determined that the JacksonCounty public communication systemwas ineffective. A shelter-in-placewas called, but it was not effectivelycommunicated to local residents . . .

51

zone over the facility and surrounding area to safeguard aircraft.State and Federal EPA arrived onsite and established environmentalmonitoring stations outside the perimeter of the facility.

The FCC night-shift supervisor assumed the role of onsite incidentcommander. He coordinated facility firefighting, accounted foremployees, and directed ambulances to the three injured employees.

FCC operators quickly shut down and isolated all process and plantutility units. Based on site interviews of first responders and unitoperators, the response to the initial explosion and fire was rapid.

3.9 Review of

3.9.1 Pascagoula Facility

FCC experienced an explosion and fire in a batch process underdevelopment for a third party in 1986. A runaway self-heatingreaction in a process used to distill meta-chloroaniline overwhelmedequipment relief devices. The incident involved a runaway reactionand overpressurization of equipment in a column that had no provi-sions to mitigate a thermal runaway. The column was destroyed,and debris was propelled offsite.

One of the recommendations was to perform hazard analyses ofexisting processes. FCC did not apply lessons learned from this eventto the MNT distillation system. If a thorough review of the safetysystems and overpressure protection for distillation columns had beenconducted at that time, the inadequacies in column design and opera-tion may have been identified and actions taken to lessen the likelihoodof the October 13 incident.

3.9.2 Other Incidents

CSB reviewed incidents involving similar materials or similar causalcircumstances. Each of the following incidents involved material thatwas held at temperatures thought to be safe, but which proved to bethermally unstable.

Previous/SimilarIncidents

One of the recommendations[from a 1986 incident] was to performhazard analyses of existing processes.

FCC did not apply lessons learnedfrom this event to the

MNT distillation system.

52

Hickson & Welch Ltd, 1992

A September 21, 1992, incident at Hickson & Welch Ltd,Castleford, United Kingdom, killed five workers (Health and SafetyExecutive [HSE], 1994). It involved similar materials and alsoresulted in an explosive thermal decomposition. Workers attemptingto clean a still used in an MNT distillation process applied steam tothe still for 3 hours to soften accumulated sludge, which was rich indinitrotoluenes and nitro cresols.

HSE determined that the residue initiated a runaway reaction, whichcaused a deflagration and intense fire. Among the findings of HSEwas that the sludge contained organic nitro compounds; it wasknown that exposing such compounds to high temperatures or tomoderately elevated temperatures over an extended time could causea thermal decomposition. HSE further found that upper manage-ment knew of these hazards from previous incidents at the plant.The company had in place a system of thermal stability testing thatwas intended to supply managers with the information necessary tosafely operate the distillation plant. However, there was no attempton the part of Hickson & Welch management to characterize thesludge material or the hazards related to its removal, specificallypotential thermal instability.

Union Carbide, 1972

On August 7, 1972, at a Union Carbide facility located in Institute,West Virginia, a transfer line containing dinitrotoluene (DNT)28

exploded (Bateman, Small, and Snyder, 1974). This event wasfollowed by numerous other explosions and small secondary fires,resulting i