An emergency safety situation may never occur, but if one does, engineers, workers and operators need to be aware of what to do and what not to do.
Take the Formosa Plastics Corp. plant in Illiopolis, IL, as a perfect case in point.
On April 23,2004, an explosion and fire at the Formosa Plastics plant killed five workers and seriously injured two others. The blast destroyed most of the polyvinyl chloride (PVC) manufacturing facility and ignited PVC resins stored in an adjacent warehouse. Concerns about the ensuing smoke from the fire forced a two-day community evacuation.
When it comes to safety incidents, there are the huge incidents that live on forever like Bhopal, India or BP Texas City to name a few.
But then there are incidents that make headlines, but quickly fade away, but they still can end up used as a great learning experience. In an occasional series, ISSSource will edit reports on lessons learned about incidents that showed how a small mistake led to a big safety incident.
Vinyl chloride monomer (VCM) — a highly flammable chemical and known carcinogen — is the primary raw material in the PVC manufacturing process. The Formosa Plastics facility used VCM to manufacture PVC resins. VCM served as the fuel for the initial explosion and fire.
The facility produced PVC by heating VCM, water, suspending agents, and reactor initiators under pressure in a batch reactor. There were 24 reactors in a building, and the reactors were put in groups of 4, with a control station for every two reactors. When a reaction was complete, the PVC solution transferred through the bottom valve to a vessel for the next step in the process.
After the transfer, workers would purge the reactor of hazardous gases and clean them by power washing through an open manway. The wash water emptied to a drain through the reactor’s bottom valve and a drain valve. All of these steps took place manually.
On the day of the incident, the reaction and the power washing wrapped up in reactor D306 and the operator went downstairs to drain the reactor. At the bottom of the stairway, operator turned in the wrong direction, toward an identical set of four reactors in the reaction phase of the process.
By mistake, the operator likely attempted to empty reactor D310 by opening the bottom and drain valves. The bottom valve, however, remained interlocked to stay closed when the reactor pressure was above 10 psi. Because this tank was currently processing a batch of PVC at high pressure, the valve did not open.
In case of an emergency (such as reactor overpressure), operators could follow an emergency transfer procedure that required them to open the bottom valve and the transfer valve to connect the reactor to an empty reactor. However, during an emergency transfer, the reactor pressure is greater than 10 psi, and the safety interlock would prevent the opening of the bottom valve. Therefore, the company added a manual interlock bypass so operators could open the valve and reduce reactor pressure in an emergency. The bypass incorporated quick-connect fittings on air hoses so operators could disconnect the valve actuator from its controller and open the valve by connecting an emergency air hose directly to the actuator.
It is likely the operator thought he was at the correct reactor (D306) and its bottom valve was not functioning. When the bottom valve did not open, he switched to the backup air supply and overrode the interlock. He did not contact the upstairs reactor operator or shift foreman to check the status of the reactor before doing this.
Mitigate or Evacuate?
Once the bottom valve opened, all bets were off. VCM poured out of the reactor and the building rapidly filled with liquid and vapor. A deluge system in the building activated and a shift supervisor came to the area to investigate. The VCM detectors in the building were reading above their maximum measurable levels. The shift foreman and reactor operators took measures to slow the release, rather than evacuate. The VCM vapors found an ignition source and several explosions occurred. The ensuing fire spread to the PVC warehouse and burned for hours, sending a plume of acrid smoke into a nearby community.
Causes of Incident
The operator overrode an interlock, which led to a release of hot, pressurized VCM. Formosa Plastics did not have comprehensive written standards, such as requiring shift supervisor approval, for managing interlocks on the vessels. Employees were not ready for a major accident at the facility.
Several factors made this incident more likely to occur:
• The reactor groupings had similar layouts
• The operators on the lower levels were not given radios, which would have made communication with the reactor control operators on the upper level easier
• Formosa eliminated an operator group leader position and gave its responsibilities to the shift supervisors, who were not always as available as the group leaders used to be
Operators and engineers must follow operating procedures and protocols intelligently, and, when the process moves outside the operating envelope, stop work, get experienced advice as needed, and shut down as appropriate. The Formosa operator should have obtained supervisory approval to override the interlock.
Furthermore, in this event, the operators had to cope with an error-prone design. The reactor layout made it easier for a mix-up to occur. An emergency transfer procedure required bypassing the bottom valve interlock, so an easy means was provided to do this. Engineers who design and run plants should try to provide engineering controls and monitor shift notes and logs for instances of interlock bypassing. In this case, a reactor status indication on the operating floor could have been provided, and more rigorous enforcement of operating procedures and interlock management implemented.
Operators did not have tools (radios for communication between floors) to make it easier for them to follow their procedures. It is management’s responsibility to provide the tools and controls necessary for operators to do their jobs safely.
When Formosa Plastics took over the plant, it made staffing changes, such as reductions in staff and changes in responsibilities. It did not conduct a formal management of organizational change review to analyze the impact of these changes.
This explosion also illustrates the importance of emergency response planning. When the VCM release occurred, gas detectors in the building and a deluge system activated. Operators responded by trying to mitigate the release. The proper response would have been to evacuate.