Bayer Crop Sciences Poses Equipment Problems Share the Blame
During the startup, malfunctioning equipment surfaced. But that sort of thing happens on every startup, right?
In spite of the fact that the new DCS implementation was still incomplete, restart of the methomyl proceeded anyway, but there were many more equipment problems lurking within the unit.
The residue treater vessel had been replaced during the outage. The 25-year-old carbon steel tank had endured much general corrosion over the years and measurements indicated the walls were now too thin to be safe. The new stainless steel vessel was expected to last much longer. For better or worse, the existing supporting piping and ancillary equipment was left in place. One element that had been a problem for some time was the vent condenser piping on top of the vessel. The decomposition reaction would generate flammable gas that would pass through the vent condenser to the flare system. The problem was solid material in the gas stream that tended to deposit in the piping. Operators had to add a steam line to the pipe to clear obstructions when gas flow restrictions caused pressure in the vessel to climb beyond acceptable levels. When the two operators who were killed went to the vessel, the expected to find this vent was simply blocked and were going to clear it.
These kinds of things happen all the time
There were other malfunctions within the unit which were identified before startup began, but the decision was to proceed anyway:
• A solvent feed line control valve had not been installed during the outage causing excessive solvent consumption.
• A broken stem on a vapor condenser cooling system led to an imbalance in the crystallizer.
• Many control loops in the new DCS were not tuned and supporting instrumentation not calibrated.
In the process, once methomyl crystals were synthesized, slurry containing the crystals was sent to a centrifuge for separation from the solvent. Methomyl that did not crystalize simply remained in the solvent. There were two centrifuges, but only one was operational during the startup due to electrical problems. During the accident investigation, operators reported that it was difficult to maintain proper solvent ratios and functions that should have run in automatic required frequent adjustments.
Any veteran of process unit startups might characterize these problems as typical of any real-world situation. No unit ever starts up without problems. That may be true, but in this case, the cumulative effect of the problems proved to be serious. Ultimately the solvent imbalance in the crystallizer, working with the other problems, caused the methomyl concentration in the liquid headed for the residue treater to go well beyond normal levels, as much as double the usual concentration.
Does something smell funny?
Once the explosion happened, first responders and safety officials were looking for air monitoring information to determine if any toxicity levels had become serious. Air monitoring devices mounted around the methomyl and Larvin unit designed to detect fugitive MIC were not operating the night of the incident. There were 16 sampling points around the units connected to an analyzer which Bayer had installed in 2006. The system had been turned off deliberately the previous May because it malfunctioned and sent spurious alarms. The problem had not been resolved in the intervening months, so it was still shut down when the methomyl unit started up again.
There was a similar MIC analyzer system, also with 16 sampling points, positioned around the MIC production unit, however this was 1800 feet from the explosion. It was operational the night of the explosion, and did not detect any release of MIC during or after the explosion.
The only air monitors operating at the time were mounted on the plant fence line, more than 800 feet from the fire and they were not downwind. Even if they had been in a more useful position, they were only able to measure carbon monoxide, hydrogen sulfide, flammable gasses and oxygen.
Sep 8th, 2015
Recognized And Generally Accepted Good Investigation Practice (RAGAGIP)
September 8, 2015
Set-up, Trigger, Exacerbation, Mitigation (STEM) Model/ Paradigm/Analogy
Measures shall be established to assure that whenever harm occurs the direct causation of the harm reflects that in order for an item to be harmed all of the following must have been true:
One: The situation was set-up for the harm to occur.
Two: There was a trigger for the actuation of the harm.
Three: The harm was made as bad as it was by later acting harmful conditions, behaviors, actions, and /or inactions.
Four: The harm was kept from being even worse than it was by beneficial conditions, behaviors, actions, and /or inactions.
At some point(s) in time the event resulting in the harm was an accident waiting to happen (AWTH). The situation lacked only a triggering/initiating/precipitating condition, behavior, action, or inaction. The stage had been set for the event. The prerequisites for the harmful event had been established. (Ironically, the prerequisites for safety had not been established.)
When the triggering/initiating condition, behavior, action, or inaction was supplied the event was put into action/progress. In the absence of additional conditions, behaviors, actions, and/or inactions it would have self-terminated in some particular harm.
But there are usually additional exacerbating/aggravating/worsening conditions, behaviors, actions, and/or inactions that compound the harm.
And there are usually additional beneficial/mitigating/limiting conditions, behaviors, actions, and/or inactions that bound the harm, keeping it from being worse than it was.
• Breakdown of Direct Causation
Every effect/ phenomenon/ result/ consequence/ outcome is the direct result of a set of conditions, behaviors, actions, and/or inactions that is broken down into subsets of the set-up/ predisposition, the trigger/ initiation/ activation, the exacerbation/ aggravation /worsening, and the mitigation/ limitation/ arresting/ termination.
• Accident Waiting to Happen
Every harmful event was an accident waiting to happen, which had all of the set-up/ predisposition in existence and was lacking only a triggering/ activating/ initiating condition, behavior, action, or inaction.
• Quality / Safety Shortfalls/ Failures
An inescapable fact is that quality/ safety shortfalls/ failures are the result of not meeting requirements and/or the requirements being inadequate to forestall the shortfall.
• Prerequisite Inadequacies
An inescapable fact is that when the initiation of an activity/ task/ job results in harm the specified prerequisites for the activity were not properly accomplished and/or they were not properly specified.
Bayer Crop Sciences Explosion
Apollo XIII was an accident waiting to happen from the 64 Volt application up until the oxygen tank activation.
Challenger was an accident waiting to happen from the time the ambient temperature was harmful to the O-ring until the launch.
Chernobyl was an accident waiting to happen from the power reduction until the stopping of the recirculation pumps.
Fukushima was an accident waiting to happen from the time there were enough fission products to support a meltdown.
Down Home Story:
A friend of mine used to put items on top of his car while he was fumbling for keys, etc. One day he bought himself an expensive bottle of scotch whiskey and, per his custom, he put it on top of his car while fumbling for keys. Just then an old friend walked up and stopped for a chat. My friend forgot about the scotch.
As he drove off he heard the bottle break against the parking lot black top!
He realized that the custom of putting items on top of his car was an accident waiting to happen and he had been doing it for years.
If a person puts oneself in an AWTH often enough or for long enough the occurrence of the accident is not left to chance.