Phillips 66 Chemical Complex Explosion and Fire INSTRUCTIONS Read the descriptio
ID: 464591 • Letter: P
Question
Phillips 66 Chemical Complex Explosion and Fire
INSTRUCTIONS
Read the description of the Phillips explosion and fire. Do not become terrified and decide to change your major. Catastrophes like this don’t happen anymore in this country. I have included this as homework because all your previous chapters in the book have given you the knowledge to be aghast at blatant violations of safe practices and the careless attitude of both management and labor.
DESCRIPTION OF THE ACCIDENT
Early in the afternoon of October 23, 1989, a disastrous explosion and fire destroyed the Phillips 66 Houston Chemical Complex, a polyethylene production plant, on the Houston Ship Channel near Pasadena, TX. The accident, described by the Department of Labor as "one of the worst industrial workplace accidents in the United States in the past 20 years", resulted in the deaths of 23 employees, 130 injuries, and $750 million property damage. The accident was caused by an improperly performed maintenance action, resulting in a rapid, uncontrolled release of over 85,000 pounds of highly flammable hydrocarbon gases that exploded upon contacting an undetermined ignition source. Prior to October 23, the Phillips 66 Houston Chemical Complex was a vital link in the national production chain for polyethylene, manufacturing nearly 1.5 billion pounds yearly (15% to 20% of the nation's yearly output).
Within the context of this region's rich industrial history, the Phillips 66 Complex was not unusual, nor was it a newcomer. Engaged in the production of high density polyethyene it had a 33 year operating record, having been m production since 1956. Plant workers labored in two active polyethylene plants (IV and V) to react a mixture of isobutane, ethylene, hexene, and hydrogen in process equipment to form polyethylene, the end product. The reactor settling legs serve as conduits for removing plastic polyethylene particles. If a settling leg becomes clogged with particles (a common event), the leg must be isolated, the settling leg connection broken, and the clog cleared. To isolate the leg, an air-actuated DEMCO globe valve must first be closed and secured in the closed position. If this maintenance task is improperly performed and reactor containment is breached, a dangerous release of flammable gases is possible.
Piping isolation includes aligning valves and installing blinds to prevent fluid flow, locking and tagging at isolation points, disconnecting motive sources, and independently verifying that isolation is properly accomplished. Yet, at approximately 1:00 P.M. on October 23, the protective barriers in Plant V failed. During settling leg maintenance (removing the clog) the containment for chemical reactor V-6 was breached, releasing 85,000 pounds of flammable gases, culminating in a fuel-air mixture explosion less than two minutes later. The force of the explosion approached 2.4 tons of TNT equivalent. The Labor Department's report description of the accident follows.
At the time of the event, a settling leg was undergoing a regular maintenance procedure: the removal of a solidified polyethylene blockage. Under Phillips' written procedures for this maintenance function, which was usually performed by a contractor; Phillips' operations personnel were required to prepare the product settling leg for the maintenance procedure by isolating it from the main reactor loop before turning it over to the maintenance contractor to clear the blockage.
On Sunday, October 22, a Fish Engineering crew began work to unplug three of the six settling legs on Reactor 6. According to witnesses, all three legs were prepared by a Phillips operator and were ready for maintenance, with the DEMCO valve in the closed position and the air hoses, which are used to rotate the valve, disconnected. Number 1 leg was disassembled and unplugged without incident. Monday morning, work began on Number 4 leg, the second of the three plugged legs.
The contractor crew partially disassembled the leg and managed to extract a polyethylene plug from one section of the leg. Part of the plug, however; remained lodged in the pipe 12 to 18 inches below the DEMCO valve. At noon, the Fish employees went to lunch. Upon their return, they resumed work on Number 4 leg. Witnesses then report that a Fish employee was sent to the reactor control room to ask a Phillips operator for assistance. A short time later the initial release occurred. Five individuals reported actually observing the vapor release from the disassembled settling leg. Because of the high operating pressure, the reactor dumped approximately 99 percent of its contents (85,200 pounds of flammable gases) in a matter of seconds. A huge unconfined vapor cloud formed almost instantly and moved rapidly downwind through the plant. It found an ignition source.
Within two minutes, and possibly as soon as 90 seconds, the vapor cloud came into contact with an ignition source and ignited. Two other major explosions occurred subsequently, one about 10 to 15 minutes after the initial explosion when two 20,000-gallon isobutane storage tanks exploded, and another when another polyethylene plant reactor catastrophically failed about 25 to 45 minutes into the event.
Fuel-air mixture explosions frequently generate widespread devastation. Production plants IV and V; occupying an area of approximately 16 acres of the Phillips 66 complex, were both destroyed. The heat and concussive energy contorted steel support beams into eerily twisted shapes, and the explosion cast debris as far away as six miles. Following the 1:00 P.M. explosion, an immense fire engulfed the complex, resulting in a series of as many as nine other explosions. Within 15 minutes of the initial blast, two Plant V isobutane storage tanks exploded as heat from the fire intensified. Later, the Reactor V-3 and V-4 processes would also detonate, spreading the fire throughout the complex. Fire suppression was an immediate priority. Firefighting response, however, was impaired by explosion damage. Investigators concluded that:
The Phillips Complex did not have a dedicated water system for fighting fires. Water for that purpose came from the same water system that was used for the chemical process. Consequently, when the process water system was extensively compromised by the explosion, the plants water supply for fighting fires was also disrupted. Fire hydrants were sheared off in the blast, and because of ruptures in the system, water pressure was inadequate for firefighting needs.
Fire hoses had to be laid to remote sources including a cooling tower basin, a settling pond, a water treatment plant, and a water main from a nearby plant. Electrical power, of course, was disrupted, necessitating reliance upon emergency diesel pumps for hose pressure. Unfortunately, of three diesel fire pumps, one was out of service at the time, another ran out of fuel prematurely (because it hadn't been completely fueled), and the third failed during firefighting operations--a serious deficiency in the complex's emergency preparedness. Nevertheless, with the mutual aid of surrounding plants the fire was brought under control within 10 hours. Because of the intense residual heat and structural damage, search and rescue efforts were delayed until the following morning.
An investigation of the accident began. The most pressing concern for investigators was to determine how and why the gaseous release had occurred. Were there sufficient protective barriers to prevent this accident? If so, how had they been breached? Since the maintenance task in progress involved clearing the Number 4 reactor settling leg, the investigation focused on how the leg was isolated prior to disconnection. Suspecting an open DEMCO valve, the valve was recovered and examined. Inspection revealed that it had, indeed, been open at the time of release.
The DEMCO valves employed in the settling legs are air-actuated globe valves with control and indicating devices located in the reactor control room. Operation of a valve's remote positioning switch electrically realigns compressed air line valves which are hooked to the DEMCO valve's air-actuation mechanism. Compressed air subsequently causes the valve either to open or close. Prior to maintenance, proper isolation would normally require electrical disablement of the remote actuating switch and physical disconnection of the actuator air lines. If possible, the DEMCO itself should also be locked in the closed position. Further, for high pressure systems involving great risk in the event of a breached containment the installation of blinds is desirable. In this instance, the isolation barriers were either not in place or were negligently breached. It is unclear what action was accomplished by the control room operator who was summoned by the Fish Engineering contractor. But the investigative report states that:
According to witnesses, all three legs were prepared by a Phillips operator and were ready for maintenance, with the DEMCO valve in the closed position and the air hoses disconnected. If the witness accounts are correct, the Number 4 settling leg's isolation valve air supply was, at some point, reconnected but reversed. The Labor Department's investigative report cited four specific deficiencies in the isolation process that contributed substantially to the accident:
(1) the DEMCO valve actuator mechanism did not have its "lockout" device in place, (2) the hoses that supplied air to the valve actuator mechanism could be connected at any time even though Phillips' operating procedure stipulated that the hoses should never be connected during maintenance, (3) the air hose connectors for the "open" and "close" sides of the valve were identical, thus allowing the hoses to be cross-connected and permitting the valve to be opened when the operator might have intended to close it, and (4) the air supply valves for the actuator mechanism air hoses were in the open position so that air would flow and cause the actuator to rotate the DEMCO valve when the hoses were connected.
The accident investigation showed that the valve was, in fact, capable of being physically locked in the closed position, an action that would by itself probably have prevented the accident. The determination that Phillips' corporate operating policies did not allow connection of the actuating mechanism air hoses during maintenance is particularly disturbing. Failure to comply with established procedures is a frequent accident contributor. Unfortunately, in the Phillips 66 event, it seems that a local maintenance procedure which diverged significantly from corporate instructions had been substituted. Investigators reported that:
Established Phillips corporate safety procedures and standard industry practice require backup protection in the form of a double valve or blind flange insert whenever a process or chemical line in hydrocarbon service is opened. Phillips, however; at the local plant level, had implemented a special procedure for this maintenance operation which did not incorporate the required backup. Consequently none was used on October 23.
A part of the basis for OSHA citation of Phillips (ultimately settled for $4 million) states that: Phillips' existing safe operating procedures for opening lines in hydrocarbon service, which could have prevented the flammable gas release, were not required for maintenance of the polyethylene plant settling legs. The alternate procedure devised for opening settling legs was inadequate; there was no adequate lockout/tagout procedure, and improper design of the valve actuator mechanism and its air hose connections.
Whatever the cause, procedural compliance or the procedures themselves were inadequate; moreover, those charged with implementing the procedures ignored standard energy isolation practices.
When conducting work on hazardous systems, a standard industrial practice is to employ safe work permits. The checklist, when executed by knowledgeable team members, assists them in consciously considering hazards and protections prior to work performance. The permit, of course, provides an opportunity for the work team and its leaders to step back, look at what they are about to do, and consider the potential hazards. The critical question raised by the permit is simply this: "Is my team reasonably protected from the potential hazards of this activity?" Also, since it is a permit system, a cognizant team leader must review the checklist and authorize the proposed work before the activity can commence. In essence, the permit is a safety addendum to the work control document.
Sadly, the permit system at the Phillips complex was deficient, probably contributing to the accident. OSHA cited both Phillips and Fish Engineering for neglect:
Fish Engineering, in particular, was cited for "willful violations for failing to obtain the necessary vehicle (permit). The actions which led to the release (and subsequent explosion) clearly call into question the supervision of both the operations and maintenance work groups. Maintenance activities rely extensively on a competent operating team. Neither maintenance nor operations can conduct their activities excluding the other. Both bear responsibility for the success of maintenance. The operating staff must retain responsibility for plant activities, even when maintenance teams are at work. Obviously, in this event, the work control process failed. And, by implication, the operating staff failed. This does not suggest that the maintenance team is free of responsibility. They failed as well. The ultimate responsibility must reside with someone and that "someone" is the operating team.
Within the Phillips complex, the maintenance function seems to have been accomplished primarily by contract workers. Teamwork is critical to industrial operations. Even if a team chooses to use personnel who are not regular team members, team leaders cannot neglect to ensure that all team members are trained and following team procedures. But, team success is the responsibility of the host (operations). Therefore, appropriate checks and supervisory leadership are required. A host employer that implores after an accident, "But they weren't my people!" is not absolved of responsibility.
Most accidents are preceded by warning signs. As unsafe conditions develop over time, people become comfortable with them, often ignoring them to their detriment. Safety conditions at the Phillips complex were suspect. OSHAS investigation revealed that a number of company audits, which were done by Phillips' own safety personnel as well as by outside consultants, had identified unsafe conditions, but had been largely ignored. If safety was viewed by plant personnel as an impediment to production, "cutting comers" may have become an accepted practice.
In the Phillips 66 event, one of the critical questions is "Who died and why?" Curiously, only two of the six maintenance technicians working at the settling leg job site-the source of the explosion were fatally injured. Yet, twenty-one other workers in the vicinity lost their lives, apparently unaware of the impending hazard. (The production control rooms to the west and adjacent to the chemical reactors were particularly hard hit. In most explosions, loss of life is confined to a relatively small radius around the epicenter of the blast. Of this event's dead, all were within 250 feet of the seat of the initial explosion. Fifteen were within 150 feet. Running away from the leak was the safest and most expedient course.
Witnesses reported that workers who were near the gaseous release ran from the area immediately upon detecting the leak. They obviously understood the seriousness of the situation. Why hadn't more people escaped? Was there time? Fuel-air mixture explosions are peculiar in that the explosion cannot occur until the flammable gases have had time to mix with oxygen and find an ignition source. Usually, then, the conditions necessary to support a fuel-air explosion take time to develop. At the Phillips 66 complex, the time for the mixture to balance and reach an ignition source was between 90 and 120 seconds-a substantial amount of time for warned personnel to exit the danger area if they are well trained.
Perhaps the most important lesson to be drawn from the Phillips 66 accident involves thorough safety analysis examining (and compensating for) the potential dangers of operation in advance (and throughout the life) of a facility. When safety studies are not diligently performed and rigorously executed the likelihood of industrial calamity is magnified. Successful operations--both for routine and emergency situations--demand that team members understand the potential dangers and the steps necessary to combat them. We also learned that hazard analysis--the first phase of a serious safety study--is a process of determining the dangers of equipment operation and the consequences of failure. Our study demonstrated that, without thorough identification of hazards, effective protection can never be developed nor can a responsive emergency plan. At the Phillips complex, hazard analysis was incomplete. The investigative report states that:
A process hazard analysis or other equivalent method had not been utilized in the Phillips polyethylene plants to identify the process hazards and the potential for malfunction or human error and to reduce or eliminate such hazards.
One glaring design deficiency that may have been identified by better safety analysis involved site layout. Accident investigators wrote:
The site layout and the proximity of normally high occupancy structures, such as the control room and the finishing building; to large capacity reactors and hydrocarbon storage vessels also contributed to the severity of the event. The large number of fatally injured personnel was due in part to the inadequate separation between buildings in the complex. The distances between process equipment were in violation of accepted engineering practices and did not allow personnel to leave the polyethylene plants safely during the initial vapor release; nor was there sufficient separation between the reactors and the control room to carry out emergency shutdown procedures. The control room was destroyed by the initial explosion.
Other deficiencies included "the lack of permanent combustible gas detection and alarm systems to provide early warning of leaks or releases", "ignition sources located in proximity to large hydrocarbon inventories", "ventilation system intakes for buildings in close proximity to hydrocarbon processes not designed or configured to prevent the intake of gases in the event of a release", and, as we learned earlier, "the lack of a water system dedicated to firefighting".
Accident? Was it preventable? There is probably no more important question that can be asked in the wake of any accident; for if the answer is "Yes", the next question is "How?" One effective approach in determining preventability is to determine which of the eight essential elements of the strategy for operating success were missing.
Home work
Below is a list of the eight elements of a successful operating strategy. Below each element make a list of examples of violations of that strategy. If each element was rigorously followed by a processing site deaths and damage to equipment would be virtually non-existent. You should be able to find one or more examples for each element. A few, very examples, will fit in at least two elements.
1. Underlying philosophy of safety.
2. Reliable equipment and facilities.
3. Well-defined operating boundaries.
4. Valid procedures and policies.
Q5. Efficient operating structure (group interaction and team structure)
Q6. Alert, well trained operators.
Q7. Good leadership.
Q8. A team approach (good communication, talent, training)
Explanation / Answer
Violations of operating strategy elements:
1. Underlying philosophy of safety:
2. Reliable equipment and facilities:
3. Well-defined operating boundaries:
4. Valid procedures and policies:
5. Efficient operating structure:
6. Alert, well-trained operators:
7. Good leadership:
8. A team approach: