Tag Archives: leak

Root Cause Analysis - Incident Investigation

Interim Recommendations After Fatal Chemical Release

By ThinkReliability Staff

After a fatal chemical release on November 15, 2014 (see our previous blog for an initial analysis), the Chemical Safety Board (CSB) immediately sent an investigative team. The team spent seven months on-site. Prior to the release of the final report, the CSB has approved and released interim recommendations that will be addressed by the site as part of its restart.

Additional detail related to the causes of the incident was also released. As more information is obtained, the root cause analysis can be updated. The Cause Map, or visual root cause analysis, begins with the impacts to the organization’s goals. While multiple goals were impacted, in this update we’ll focus on the safety goal, which was impacted due to four fatalities.

Four workers died due to chemical asphyxiation. This occurred when methyl mercaptan was released and concentrated within a building. Two workers were in the building and were unable to get out. One of these workers made a distress call, to which four other workers responded. Two of the responding workers were also killed. (Details on the attempted rescue process, including personal protective equipment used, have not yet been released.) Although multiple gas detectors alarmed in the days prior to the incident, the building was not evacuated. The investigation found that the alarms were set above permissible exposure limits and did not provide effective warning to workers.

Methyl mercaptan was used at the facility to manufacture pesticide. Prior to the incident, water accessed the piping system. In the cold weather, the water and methyl mercaptan formed a solid, blocking the pipes. Just prior to the release, the blockage had been cleared. However, different workers, who were unaware the blockage had been cleared, opened valves in the system as previously instructed to deal with a pressure problem. Investigators found that the pressure relief system did not vent to a “safe” location but rather into the enclosed building. The CSB has recommended performing a site-wide pressure relief study to ensure compliance with codes and standards.

The building, which contained the methyl mercaptan piping, was enclosed and inadequately ventilated. The building had two ventilation fans, which were not operating.   Even though these fans were designed PSM critical equipment (meaning their failure could result in high consequence event), an urgent work order written the month prior had not been fulfilled. Even with both fans operating, preliminary calculations performed as part of the investigation determined the ventilation would still not have been adequate. The CSB has recommended an evaluation of the building design and ventilation system.

Although the designs for processes involving methyl isocyanate were updated after the Bhopal incident, the processes involving methyl mercaptan were not. The investigation has found that there was a general issue with control of hazards, specifically because non-routine operations were not considered as part of hazard analyses. The CSB has recommended conducting and implementing a “comprehensive, inherently safer design review” as well as developing an expedited schedule for other “robust, more detailed” process hazard analyses (PHAs).

Other recommendations may follow in the CSB’s final report, but these interim recommendations are expected to be implemented prior to the site’s restart, in order to ensure that workers are protected from future similar events.

To view an updated Cause Map of the event, including the CSB’s interim recommendations, click “Download PDF” above. Click here to view information on the CSB’s ongoing investigation.

Root Cause Analysis - Incident Investigation

Chemical Release Kills Four Workers at Texas Pesticide Plant

By ThinkReliability Staff

In the early morning hours of November 15, 2014, a release of methyl mercaptan resulted in the deaths of four employees at a plant in Texas that manufactures pesticides. The investigation into the source of the leak is still ongoing, though persistent maintenance problems had been reported in the plant, which was shut down five days prior to the incident.

Even though the investigation has not been completed, there are some lessons learned that can be applied to this facility, and other facilities that handle chemicals, immediately.

Even “safer” chemicals are dangerous when not treated properly. The chemical released – methyl mercaptan – is stored as a safer alternative to methyl isocyanate (which was the chemical released in the Bhopal disaster). Although it’s “safer” than its alternatives, it is still lethal at concentrations above 150 parts per million. The company has stated that 23,000 pounds were released – in a room where complaints were made about insufficient ventilation. The workers were unable to escape – likely because they were quickly incapacitated by the levels of methyl mercaptan and did not have the necessary equipment to get out. (Only two air masks and oxygen tanks were found in the area where the employees were.)

A fast response is necessary for employee safety. Records show that 911 was not called for an hour after the employees were trapped. (One of the victims called his wife an hour prior to indicate there was an issue and he was attempting rescue.) The emergency industrial response group, which is trained to provide response in these sort of situations, was never called by the plant. Medical personnel could not access the employees because they were not trained in protective gear. Firefighters who responded did not have enough air to travel through the entire facility and did not have enough information on the layout to know where to go. It’s unclear whether a quicker response could have saved lives.

Providing timely, accurate information is necessary for public safety. The best way to determine the impact on the public is to measure the concentration of released chemicals at the fenceline (known as fenceline monitoring). Air monitoring was not performed for more than four hours after the release. Companies are not required to provide fenceline monitoring, although an Environmental Protection Agency (EPA) rule requiring monitoring systems for refineries is under review. (This rule would not have impacted this plant as it produced pesticides.) Until that monitoring, the only information available to the public was information provided by the company (which did not release until days later the amount of chemical released.) In Texas, companies are required to disclose the presence of chemicals, but not the amount. A reverse 911 system was used to inform residents that an odor would be present, but did not discuss the risks.

What can you do? Ensure that all chemicals at your facility are known and stored carefully. Develop a response plan that ensures that your employees can get out safely, that responders can get in safely (and are apprised of risks they may face), and that the public has the necessary information to keep them safe. Make sure these plans are trained on and posted readily. Depending on the risk of public impact from your business, involving emergency responders and the public in your drills may be desired.

To see a high level Cause Map of this incident, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

Kitty Litter Cause of Radiological Leak?

By ThinkReliability Staff

The rupture of a container filled with nuclear waste from Department of Energy (DOE) sites that resulted in the  radiological contamination of 21 workers appears to have resulted from a heat-producing reaction, possibly between the nuclear waste and the kitty litter used to stabilize the waste.

DOE photo of damaged container

Yes, you read that correctly. The same stuff you use for Fluffy’s “business” is also used to stabilize nuclear waste.  However, the kitty litter typically used is clay.  One of the sites that provides waste to the Waste Isolation Pilot Plant, where the release occurred, changed from clay kitty litter to organic kitty litter, which is made of plant material.  Although the reaction that resulted in the container’s rupture has not yet been determined, it is possible that it was due to the change in litter.

We can look at this incident in a Cause Map, or visual root cause analysis, to lay out both the effects and causes.  In this case, the effects were significant.  Twenty-one workers were found to have internal radiological contamination, impacting the safety goal.  A radiological release off-site impacted the environmental goal.  The waste repository has been shut down and is not accepting shipments, impacting both the customer service and production goals.  The release requires the investigation of a formal Accident Investigation Board, impacting the regulatory and labor goal.  Lastly, the damage to the container is an impact to the property goal.

The release was caused by the rupture of a container that stored radiological waste, including americium and plutonium.  The release was able to leave the underground storage facility due to a leak path in the ventilation system, which was by design because the ventilation system was not designed for containment because the safety analysis assumed that a release within the storage facility would result from a roof panel fall and was adequately prevented.

The rupture appears to have resulted from a heat-producing reaction. The constituents of that reaction have not yet been determined, but the change from clay to organic kitty litter has been identified as a possible cause.  (A possible cause indicates a cause for which evidence is not yet available.)  More research is being done to determine the actual reaction.  This will also allow a determination of which other waste containers may be at risk for rupture.

A solution that has already been implemented is to seal the leaks in the ventilation system with foam to reduce the risk of leak-by.  Other solutions that have been suggested are to add an additional heavy-duty containment around the affected casks, reclassify the ventilation system as containment, and perform an independent review of the safety analysis of the site.  Once appropriate solutions are determined and implemented, it’s hope the site will be able to reopen.

To view the Outline and Cause Map, please click “Download PDF” above.

Root Cause Analysis - Incident Investigation

Sea life Devastated by Molasses Spill

By Kim Smiley

On September 9, 2013, a reported 1,400 tons of molasses was inadvertently spilled into Honolulu Harbor in Hawaii, devastating the sea life.   When I think of ocean spills, pictures of oil-covered animals jump into my mind, but the molasses spill is proving to be potentially just as damaging to the environment.

This incident can be analyzed by building a Cause Map, an intuitive format for performing a root cause analysis.  A Cause Map visually lays out the causes that contribute to an accident to show the cause-and-effect relationships between them so that it’s easier to understand the factors that led to the issue.  Understanding all the causes and not just focusing on a single “root cause” helps broaden the potential solutions that are considered and can lead to a better long term solution. The first step in the Cause Mapping process is to define how the problem impacted the goals and then these impacts are used as the starting point for the Cause Map.

The most obvious impact from the molasses spill is that thousands of fish and other marine life were killed.  They suffocated because the molasses sank and displaced the oxygen- containing seawater in the harbor.  The density of molasses is what makes this spill so different from an oil spill.  Oil is lighter than water and floats on top of the ocean while molasses sinks to the bottom, with devastating effects at all levels in the ocean.  Divers investigating the molasses spill reported that there were no signs of life in the ocean near the spill; all bottom dwellers had been killed.

The fact that molasses sinks also means that there is no practical way to clean it up.  One positive about molasses is that molasses, unlike oil, will mix with water. It sits on the bottom until it is diluted and ocean movements disperse it.  Since the spill occurred in a protected harbor, the ocean movements are weaker and the time frame to move the molasses is longer than it would be in the open ocean, but nature will eventually return oxygen levels in the harbor to life-supporting levels.

The cause of the spill has been reported to be a leaking pipe.  Molasses produced on Hawaii was being pumped into a ship for transportation to the mainland where it was planned for use in animal feed.  During the transfer, the molasses was accidently pumped through a pipe with a leak and nobody noticed before the majority of the molasses had been released into the harbor.  Details about what specifically caused the leak haven’t been released.

There are also other impacts from the spill that are worth considering.  With any environment issue, the cost of the investigation and any clean up that needs to be done is always substantial. Many businesses in the area were also impacted by a drop in tourism because the harbor was closed for about two weeks after the accident and normal tourism levels will probably not return until marine life in the area begins to recover.  There was also a potential safety risk to any swimmers for a time after the accident because the presence of thousands of dead fish could attract predators.

To view an Outline and high level Cause Map of this accident, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

Combination of Gas Leak and Flare Could be Disastrous

By ThinkReliability Staff

A leak from the Elgin platform in the north sea near Aberdeen has the potential to cause an explosion due to the proximity of the leak to the still-lit flare on the platform.  However, the wind is currently blowing gas away from the flare.  The potential for environmental damage is not as great as that of Deepwater Horizon because it is a surface, rather than underwater, leak.

Workers on the now-evacuated Elgin rig noticed the leak on March 25, 2012.  The rig was partially, then later fully, evacuated.  We can examine the causes of the environmental leak, as well as the potential for further damage, in a visual root cause analysis in the form of a Cause Map.  The Cause Map lays out the cause-and-effect relationships in a clear, intuitive way.

We begin with the impacts to the goals.  The safety goal is impacted because of the potential for an explosion.  The environmental goal is impacted due to the gas leak, estimated to be approximately 200 cubic metres per day.  The customer service goal is impacted due to the loss of value of the owner corporation stock shares.  Production is currently shut down on the rig, leading  to an impact to the production goal.  The potential for an explosion could also cause catastrophic damage to the platform, which is an impact to the property goal.  Lastly, the evacuation of the platform is an impact to the labor goal.

In order for an explosion to occur, there must be fuel, oxygen, heat and confinement.  In this case, the oxygen is provided by the atmosphere, and the confinement is provided by the well itself.  The fuel is provided by the gas leak, believed to be entering from another non-producing well through a crack in the outer casing of the well, which was in the process of being plugged and abandoned.    The heat likely to cause the explosion is a flare on the platform.  The flare burns off excess gas from the platform and was not extinguished during the evacuation, as the priority was to remove the workers.

The flare is unable to be turned off remotely, but options for extinguishing the flare are being evaluated.  Other options being evaluated to stop the leak and reduce the potential for explosion include digging a relief well or killing the well that is currently leaking.  All options have the potential to be very expensive.

To view the Outline and Cause Map, please click “Download PDF” above.

Root Cause Analysis - Incident Investigation

Tragedy in Bhopal

By ThinkReliability Staff

While researching the tragedy in Bhopal, India, I discovered that there are two theories about what occurred on December 3, 1984 that resulted in a tremendous loss of life. One theory is from a report done by an Engineering Consulting firm hired by Union Carbide (the company that owned the plant in question) that determines that the release was caused by sabotage. Theory #2 is that a combination of inexperienced, ineffective workers and a badly maintained plant with inadequate safety standards that was being ready for dismantling experienced a horribly catastrophic chain of events that ensured that anything that could go wrong, did. For completeness, I have included both in my final Cause Map (which you can see by clicking “Download PDF” above). But for now, I’d just like to focus on the second.

In the wee morning hours of December 3, 1984, over 40 tons (this amount is also debated, but 40 tons appears to be the most popular, purely based on number of references that mention it) of methyl isocyanate (MIC) were released over the community of Bhopal, India, with a population of 900,000. Partially because of the transient nature of the population, and partially due to the general obfuscation of data from all sources involved, the number killed ranges from 2,000 to 15,000. The 2003 annual report of the Madhya Pradesh Gas Relief and Rehabilitation Department stated that a total of 15,248 people had died as a result of the gas leak. Based on claims accepted by the Indian government, there were at least 500,000 injured. This led to what has been called “The World’s Largest Lawsuit”, which I assume refers to the number of people represented, and certainly not the monetary amount of the settlement, which is a paltry $470 million. After the accident, the plant, after a series of legal maneuvers, was abandoned. Extensive cleanup was required, and still has not been completed. The impact to the goals are shown in the outline on the downloadable PDF.

The deaths and environmental impact were caused by the release of over 40 tons of methyl isocyanate (from here on out, we’ll refer to it as MIC). The release occurred when a large volume of MIC was put through an ineffective protection system. The release lasted several hours, because workers were unable to stop it, and because of an ineffective warning system. The release occurred when a disk and valve that led to the protection system burst due to an increase in pressure. The increase in pressure was caused by an increase in temperature resulting from a reaction between MIC and water when the refrigeration system was shut down. There were 41 metric tons of MIC in the tank, stored for use in the plant. How the water was introduced is the debate in the two theories I mentioned above. But regardless, water got in to the tank, either by sabotage or by leaking through a vent line. We will probably never know exactly what happened. But we do know that ineffective safety systems can result in a massive loss of life, as happened here.