It should have been a day of routine maintenance on November 9, 2010 at the DuPont plant in North Tonawanda, New York. Tank 1, which normally contained 10,000-gallons of polyvinyl fluoride (PVF), a slurry used in manufactured countertops, had been cleaned and inspected in preparation for repairs. All relevant procedures had been followed and all paperwork completed. The team performing the work had climbed up to the top of the tank on the catwalk and began grinding and welding to repair the equipment.
However, just a few minutes after 11:00 am, an explosion blew the steel cover from the tank. A worker was killed, and nearby residents felt the blast from nearly a mile away. Concerned about toxic gases, authorities cautioned residents to immediately close their windows as the cleanup and investigation began.
What caused this disaster?
Incomplete Lockout Procedure. A routine inspection had found corrosion on the hatches of PVF slurry Tanks 1, 2, and 3, and the plant scheduled repairs. In preparation for the repair work, Tanks 1-3 were locked out. This included the fill lines, which prevented any PVF vapors from entering the tanks during the maintenance. The repairs were completed on Tanks 2 and 3, and they were restarted, but repairs on Tank 1 were delayed because certain required parts were unavailable. When the maintenance finally began on Tank 1, the fill lines remained locked out as prescribed by the normal Lockout Procedure. However, an overflow line servicing all three tanks remained open, which provided a path for flammable vapor to migrate from the in-use Tanks 2 and 3 into the locked-out Tank 1.
Lack of Air Monitoring. DuPont personnel had monitored the atmosphere in the tank before allowing the repairs to begin but did not continue to monitor the atmosphere as the work progressed. Air monitoring inside the tank may have alerted the repair team of the hazardous, flammable vapors accumulating in Tank 1.
Insufficient Training and Awareness. Prior to beginning the repairs, the facility issued a “hot work permit” for the work, certifying the area was safe for welding and permitting welding to occur. However, the DuPont personnel who signed it did not fully understand the chemical process around PVF use or the equipment schematics.
Context and effects of the disaster
E.I DuPont de Nemours, typically referred to as DuPont, is on the Fortune 100 list and is one of the world’s largest chemical companies. It provides a wide variety of products and services to consumers and other businesses, which range from electronics and construction to agriculture and apparel. DuPont’s plant in North Tonawanda produces Corian countertops and Tedlar films, which require PVF slurry as an ingredient.
An investigation by the Chemical Safety Board (CSB) found that the explosion was caused by the ignition of flammable vapors within Tank 1. The CSB could not determine the exact source of ignition, but suggested the following three potential sources:
- Excessive heating of the tank walls due to the hot work (welding)
- Sparks from the hot work falling into the tank,
- Flammable PVF vapors escaping the tank and entering the hot work area where they were exposed to sparks.
The explosion blasted a large portion of the cover off the tank, which included the large motorized agitator assembly (which normally stirred the slurry). The tank roof segments and wrecked agitator assembly came to rest hanging over the ragged edges of the tank walls by the agitator wiring. The welder died instantly from the blast, and the foreman supervising the repairs suffered first-degree burns but no other major injuries. The fire quickly consumed the flammable vapor and, after the explosion, self-extinguished.
The CSB investigation team made the following recommendations:
- That air-monitoring requirements for hot work include the interior of tanks and other containers, whenever tanks or other containers are part of the equipment on which hot work is being performed
- That DuPont redefine Tanks 1-3 as a single system in their Lockout procedure, requiring all three to be empty of PVF before maintenance is performed
- That DuPont requires all pipes connected to equipment under repair to be positively isolated prior to issuing a hot work permit
The lead investigator of the accident summed up the findings of the investigation as follows:
DuPont’s process hazard analysis incorrectly assumed that vinyl fluoride in the Tedlar process could not reach flammable levels in the slurry tanks. And, critically, DuPont personnel did not properly isolate and lockout Tank 1 from Tanks 2 and 3 prior to authorizing the hot work. The flammable vapor was able to pass through the overflow line into the tank the welder was working on, unknown to him or to the operators who signed off the hot work permit.
After the incident, DuPont improved its corporate hot work authorization procedure and its lockout procedures in accordance with the CSB recommendations. Additionally, DuPont invested $6.8 million in safety upgrades in the North Towanda plant.
On October 1, 2015, the Occupational Health and Safety Administration fined DuPont $724,000 for the explosion, noting that the fine amount was reduced significantly due to the safety improvements DuPont had already made. DuPont was also placed on the “Severe Violator Enforcement Program” and was subject to additional monitoring and auditing by OSHA in the years following the citation.
Very unusual since DuPont was well known for their safety culture prior to this event. They had a reputation for being meticulous in their safety procedures (I worked at a neighboring facility in Delaware for several years).
It’s one of those things where it is difficult to anticipate dangerous situation until it happens and you learn from your mistakes and make appropriate QA/QC procedural adjustments/improvements.
I am an engineer who has worked in chemical plants and refineries for 49 years. I freely admit that for about 20 years of that, I took safety for granted. The PSM regs from the early ’90s was a giant leap forward for safety. Due to the stipulations in the regs (e.g. requiring a detailed procedure for isolation of a vessel including written & signed permits), I started personally inspecting vessels AFTER all the paperwork was signed off by Operations and Safety personnel. Because of that practice, I discovered an unblinded flanged connection to a reactor that I was about to enter in preparation for catalyst loading. This happened in spite of all the check marks and signatures on the permit. The refinery people apologized for the oversight and immediately took care of it. The point of my story is to stress that safety is your own personal responsibility. People (including me) make mistakes…don’t ever take your safety (or the safety of others) for granted.
Good read . . Well done.
This was such a sad accident. After nearly 40 years involved with engineering and maintenance, I know what a challenge safety can be. Seemingly routine procedures can lull any of us into overlooking something that could lead to a serious tragedy (usually it’s a combination of oversights). This investigation is a good case study for anyone involved with engineering, maintenance or operations.
In aviation the concept is called, “KNOW YOUR SYSTEMS” A PHA is not valid unless the people performing it know the system. Also, the people USING the system need equivalent knowledge accompanied by fault tolerance evaluation. At NASA any system that can result in loss of life or really bad damage (think loss of a billion dollar payload) must be 2 fault tolerant. That is any two actions (whether human or computer, or one of each) should still leave ONE lock out system in place that can prevent the catastrophe. Old systems are tricky because they were built back in the day, modified, an undocumented.
I had workers working inside a tank (confined space) years ago. The power plant had been in an outage and they started to put systems back in service. While these guys were working inside water started coming in. A lock out tag out procedure was in place but, an overflow line from another system that had been put back in service started filling this tank. You can never be too careful. I raised holy cane over this in that the guys could have been killed or had a heart attack inside the tank. Procedures were put in place to insure that this never happened again.