Google

14 September 2007

Confined Space Entry Incident

Safety Incident Topic: Confined Space Entry
Location of Incident: Blaine, USA

Date of Incident: Unknown

Brief Account Of Incident
H2 Plant Caustic Scrubber was blinded and permitted for entry. After several hours of work in the tower by a contractor, an engineer came into the tower to take pictures. His personal LEL meter was set off. The tower entry permit was pulled. Safety checked the tower and found 100%+ of LEL at the top of the tower.

Potential Outcome
Potential for serious injury or fatality to individuals entering into the tower in an atmosphere which exceeded the LEL(lower explosive limit).

Likely Causes
Initial investigation indicates that the full thickness blind for the top of the tower, which was located near grade, had spreaders on the tower side to allow steam and condensate during tower cleanup. The spreaders were not removed for tower entry. A small hydrogen leak was seeping past a gasket on the process side of the blind. The hydrogen educted up the line to the top of the tower.

Action Taken
Entry permit pulled. Leaking plug valve upstream of blind pumped with grease. Speaders on blind pulled and gaskets replaced. Tower purged with blower air. A root cause investigation has been initiated.

12 September 2007

Electrical Shock Incident

Safety Incident Topic: Electrical Shock Incident
Location of Incident: Kuantan, Malaysia
Date of Incident: 5 December, 2005

Brief Account of Incident
On the 5th of December 2005 about 2 pm, an electrical technician felt a minor electrical shock by a 240 volts AC supply. During the incident, he was installing a small instrument roof and re-routing the pressure switch cable entrance and piping from top position to downward position. He stopped the job and noticed some water trapped inside the cable gland & terminal box. There is no injury to the technician. The incident was reported four days later.

Outcome
The technician could have been fatally electrocuted or seriously injury

Critical Factors
- Rain water trapped inside the switch terminal block
- Technician rotated the switch with bare hand while the switch was hooked up with 240 volts AC supply

Immediate Root Causes
- Ineffective protection from previous seal (old silicone sealant peeled off) to prevent water seepage into the switch
- Lack of knowledge of hazards present – not aware of trapped water hazard
- Routine activity without thought – normal practices that isolation was not required if work involves only the body of the switch
- Inadequate PPE – technician should protect both hand with glove before touching the switch casing
- Inadequate isolation of process or equipment – 240 volts was not isolated

System Root Cause
- 240 volts supply to the instrument is not favorable design for instrument supply
- Inadequate implementation of PSP, due to deficiencies – as per LOTO procedure, any electrical energy (24 – 240 volts) should be isolated but not in this case as work was carried out on the casing.

Lesson Learned
- No matter how small or insignificant an incident maybe, it should be reported timely so that appropriate measures can be taken.
- The proper power supply should be clearly identified/labeled at site.
- 240 volts AC supply should not be used for instrumentation (budgeted to be changed in 2006)
- All E/I technicians are reminded to be more vigilant about the hazard of any 240 volts AC supplied instrumentation.
- To review the existing LOTO procedure to address the hazards of working with 240 volts AC power supply and its isolation requirements.

Boiler Fuel Oil Leakage

Safety Incident Topic: Boiler Fuel Oil Leakage
Location of Incident: Capco, Taiwan
Date of Incident: 17 July, 2005

Brief Account of Incident
On July 17th 03:10, BU6 operator discovered oil from the Oil Separator was pumped to open ditch within the plant site. After checked the related pipeline, he found that one of boilers fuel oil pump, AG-602B, casing drain was not fully closed. It was estimated that a total of approximately 11 MT of fuel oil leaked since July 15th 17:30 when AG-602B was undergoing a testing run after repaired work by the maintenance team. The open ditch is a close system connected to the plant’s wastewater treatment system, and hence the oil did not flow outside of the plant site. Plant emergence response team was activated immediately and all oil was collected from the open ditch and Oil Separator and open ditch was cleaned on the same day. The collected oil was sent to Chinese Petroleum Corp. CPC for further treatment. There was no damage to the plant and the outside environment.

Potential Outcome
Overload wastewater treatment system and increase waste water effluent fee from Union wastewater treatment plant of Industrial Zone.

What Went Wrong
1. One of boiler fuel oil pump, casing drain leaked
2. Oil separator was accumulated a lot of fuel oil
3. Inadequate enforcement of safety procedure

SUMMARY OF IMMEDIATE CAUSES
1. Defective equipment - Fuel oil pump’s casing drain was connected with dark plastic hose, and then to a collection pipe. Operator can not easily check leak status.
2. Improper decision making or lack of judgment - Operator started air pump to remove bottom water from oil separator but didn’t make sure pump discharge fluid was water or oil.
3. Inadequate or excessive illumination - Oil separator area is poorly illuminated.

SUMMARY OF SYSTEM CAUSES
Inadequate enforcement of PSP - Field operators was not properly enforced to patrol and detect equipment leakage.

11 September 2007

Fall From Scaffolding

Safety Incident Topic: Fall From Scaffolding
Location of Incident: TExas, USA
Date of Incident: 29 august, 2007

Brief Account of Incident
On August 29 at approximately 14:00, a worker fell headfirst over a scaffold rail from a height of 30 feet. He was in the process of pulling plastic sheeting for a sandblasting barrier over a 42” pipe. He was tied-off with a double lanyard to a scaffolding top rail. When he lost his balance and fell backwards, one end of the anchor rail became disconnected. There was potential for the lanyards to become disconnected from the anchor rail which could have allowed the worker to fall to ground level. Two coworkers on the platform were able to quickly pull him back onto the deck. The worker was evaluated at the clinic, released and returned to work.

It is not known at this time if the scaffold rail pinning mechanism failed or if it was not installed properly.

Work planning did not consider alternate work positions which may have prevented the fall hazard. Hazard elimination and control was not discussed for working on top of the pipeline for this task. The worker did not inspect and verify the anchor rail connections before use.

An incident investigation has been initiated and the lessons learned document will be available by September 30, 2007.

09 September 2007

Explotion Incident

Safety Incident Topic: Explotion Incident
Location of Incident: Texas, USA
Date of Incident: Unknown

Brief Account Of Incident
A trailer being towed by a forklift snagged and pulled a small drain valve out of a strainer in a liquid propylene system. Escaping propylene rapidly vaporized, forming a large flammable vapor cloud. Two minutes after the released the vapor ignited creating an explosion. The explosion knocked down several and burned two (one seriously) operators exiting the unit. Flames from the fire reached more than 500 feet in the air .Because of the size of the fire, Formosa initiated a site-wide evacuation. Fourteen workers sustained minor injuries including
scrapes and smoke inhalation. The extensive damage shut down Olefins II unit for 5 months

Incident Analysis

1. Vehicle Impact Protection
The polypropylene involved in this incident protruded into an open space, yet had no impact protection. Formosa has administrative safeguards for vehicle operation in the unit but not specifically address the operating safe area. The plant design drawing are also not marked in the unit. Guidance about protecting control pipelines is stated that protective measure should be in place to prevent impact.

2. Structual Steel Fire Protection
During the fire , part of a stucture suppoting the relief valves and emergency piping to flare header collapsed. Passive fire protection was installed only on three of four support column rows and the column supported the pressure relief valves and emergency vent pipe had no firefroofing. The API “Fire froofing Practices In Petroleum And Petrochemical Processing Plants” publication was issued after Kellogs was contracted for the early design. If had the steel been firefroof as API recommend. The consequences of this incident would likely have been less severe.

3. Remote Equipment Isolation
A check valve and remote isolation valve located downstream of the leak prevented the backflow of propylene from storage product. Operator were unable to reach the manual valve to isolate the leak as well as local control station to turn off pump supplying propylene. Kellogg specified the remote operation of islotaion valves and equipment only at the local.

4. Flame Resistance Clothing
Neither of the two operators burned in this incident were wearing FRC. Had they been heir injury wolud likely have been less severe. Formosa point comfort evaluated requiring FRC following two incident where static electricity was suspected og igniting hydrocarbon releases but decided not require FRC for operator in the Olefin II Unit except for those involved in emergency response.

Lesson Learned

Hazard Reviews
While Formosa conducted a preliminary hazard analysis, a process hazard analysis, a siting analysis, and a PSSR prior to operating the Olefins II unit, these reviews did not fully address protection of specific process equipment from vehicle impact or the use of remotely actuated valves to control a catastrophic release.When performing a hazard analysis, facility siting analysis, or pre-startup safety review, vehicle impact and remote isolation of catastrophic releases should be investigated.

Flame resistant clothing
Formosa had prior incidents of flash fires from hydrocarbon leaks and evaluated the use of FRC. However, Formosa did not require FRC for operators working within the unit, even though the large flammable liquid and gas inventory may put operators at risk of injury from flash fires.In process plants with large flammable liquid and/or gas inventories, mechanical failures can result in flash fires that endanger workers. The use of FRC may limit the severity of injury to employees who work in plants with large inventories of flammable gases and liquids.

Use of Current Standards
The the plant design used at Formosa multiple times between the mid-1980s and 2000. However, the design was not updated to incorporate improved recommended practices with respect to fireproofing structural steel that supports critical safety systems.
Evaluate the applicability and use of current consensus safety standards when designing and constructing a chemical or petrochemical process plant. This should include reviewing and updating earlier designs used for new facilities.

07 September 2007

Gas Leak Out of Broken Drain Pipe

Safety Incident Topic: A Crack On the Weld of a Pump Drainage Pipe
Location of Incident: Lingen, Germany
Date of Incident: 10 May, 2005

Brief Account of Incident
May, 10 2005, while a contract worker performed assembly work on the Feed pump he accidentally damaged a drain pipe of the pump housing. This causes a strong gas leakage out of the broken drain pipe.

RESULT: Formation of light gasoline gas cloud at the downstream of the furnace reformer. The pump is stopped and changed over, while applying adequate PSA. The cloud is dispersed by steam with involvement of the fire brigade team.

What Went Well
· The contractor informed control room operators immediately.
· Quick identification of the problem on site
· Quick and safe change over the pump and using breathing mask as well as fire brigade support
· Fortunately the wind direction was turned away from the furnace.

What Went Wrong
As a general rule, it is prohibited to step onto piping regardless if assembly work is done or during operations. Unfortunately this cannot always be avoided due to the location of valves and piping. A weld failed at a location which was not fulfilling the required quality levels.

Direct Causes
1. Leakage due to stepping on the drain pipe.
2. Insufficient weld at the pump drainage.

Causes In The System
Reconsider of Integrity management for inspection and documentation of nozzles.

Direct Measurements
1. Immediate repair of the defect weld.
2. Inspection of neighbouring welds, also at the parallel feed pump GA-1804A via x-rays (without findings).
3. Clarifying discussion with the contractor, who can demonstrate long lasting experience in the Lingen refinery.

Lessons Learned
1. Leakages even on small pipes could have serious consequences for people and equipment
2. Nozzle inspection programs must be completed and well documented
3. For limitation of damages process units have to be divided up into smaller, containable sections.

Electrical Failure

Safety Incident Topic: Electrical Failure
Location of Incidetn: Coryton, UK
Date of Incident: 15 September, 2005

Brief Account of Incident
On 15th September at 08:45hrs local time, a fault developed on the external electrical distribution network that ultimately resulted in all Refinery Units apart from the crude unit and the Boiler House shutting down. The Refinery HV protection system sensed the fault and disconnected the Refinery from the external grid. This resulted in the automatic operation of the Refinery power load shedding system. Prior to the incident the refinery was operating normally.
As a result of the initial disturbance some electrical drives tripped, but either re-accelerated or auto-started. However, on the Continuous Catalytic Reformer (CCR) the Waste Heat Boiler Feed Water Pump (BFW) did not auto-start, resulting in a controlled shutdown of the CCR Unit. The CCR is the only hydrogen producing unit for the Refinery and the loss of a hydrogen supply resulted in a domino shutdown of other hydrogen dependent units.
At approx. 08:55hrs, critical control equipment on the Cracking Complex control console in the Central Control Building (CCB) started to fail due to a fluctuating supply voltage. In response to the lack of unit displays and with the knowledge that the majority of Refinery units were shutting down, the decision was made to shutdown the Cracking Complex whilst control was still available.

Outcome
There were no injuries or any significant environmental emissions during the Refinery shutdown. The lost opportunity cost of the shutdown has been estimated at $10.5MM.

Critical Factors
1. Incorrect co-ordination between the external power supply network and Refinery network protection systems.
2. Failure of the CCR BFW pump-motor drive to auto-start.
3. Voltage fluctuations on the Uninterruptible Power Supply (UPS) system distribution network supplying the CCB.

System Causes
1. Inadequate technical design,input obsolote – Refinery and the external power supply protection system settings are not properly coordinated.
2. Insufficient knowldege transfer – there was a lack of understanding around the full functionality of the auto-start facility when only the duty pump/motor was available.
3. Inadequate evaluation and/or documentation of change – the wiring mode were not adequately evaluated and technical query was not issued.

What Went Wrong
- Poor operation/reliability of Production radio communications system.
- Delays in start-up due to piping failures in Product Movement Area.

What Went Well
- There were no injuries or significant environmental incidents during the Refinery shutdown.
- The Refinery power load shedding system (SCADA) operated as per design.
- The Major Incident Team effectively managed the incident with tremendous team support from all Refinery Departments.
- Boiler House facilities including steam and power generation remained on-line.
- All units were made safe and abnormal start-up procedures instigated and followed.

Falling Motor During Lifting

Safety Incident Topic: Falling Motor During Lifting Work
Location of Incident: Geel, Belgium
Date of Incident: 10 April, 2002

Brief Account of Incident
· Cover plate of the electrical connecting box was removed to enable motor removal from equipment.
· Removal of cover plate created sharp edge that made contact with the lifting strap.
· During reinstallation, the workers experienced problems to position the motor and had to man oeuvre it to enable reconnection.
· The lifting strap was cut over sharp edge of the connecting box.
· The motor fell down on the leg of one of the workers.
A second worker jumped away and experienced a slight cut.
· The lifting chain caught the motor and kept it hanging in the air and prevented the motor from falling on the next platform 2 m down.

What Went Wrong
· The lifting works were not stopped to evaluate the situation at the moment the job was perceived to be more complex than initially anticipated.
· The sharp edge was not noticed (was covered with plastic bag) and so the risk was not seen.
· A lifting strap was used that was overdue on approval.
Potential Outcome: DAFW–case (more serious injury) or Fatality

What Went Well
· Medical treatment and follow -up.
· Quick response from mechanics involved to safely position motor.

Lessons Learned
· Lifting training is needed that covers how to deal with sharp edges.
· Evaluate who should be trained to do (manual) lifting works.
· Improve warehouse storage process to have sufficient approved safety material available.
· Evaluate what ideas can be copied from TAR’s during a smaller stop (eg container with safety material in unit).
· Evaluate need for a plant-wide procedure/checklist for doing (manual) lifting works.

06 September 2007

Check Valve Counterweight Failure

Safety Incident Topic: Check Valve Counterweight Failure
Location of Incident: Compressor Building Cooper River, America
Date of Incident: 20 July, 2007

Brief Account of Incident
While commissioning the gas expander, an operator was hit in the leg by a falling weighted lever from a check valve. The check valve was located approximately 20ft above the operator’s position at the time of failure. The weighted lever, weighing 15-20 pounds, hit the ground and then grazed the operator’s leg. There was no damage to equipment, no one was injured, and there was no harm to the environment.

What Went Wrong
1. The check valve counterweight assembly is held together with setscrews which can work loose over time and allow the weight to fall from the valve.
2. The check valve is installed high overhead in an area where there is operations activity.

Summary of Immediate Causes
Inadequate guards or protective devices – The swing check valve did not have a secondary means of securing the counterweight balance assembly from falling due to vibration or fatigue.

Summary of System Causes
Inadequate preventative Maintenance – This check valve does not have a PM in SAP to check for functionality or proper operation of the counterbalance assembly.

Summary of Local Actions
Upon investigation of this check valve, it was determined that the external counterweight assembly is an optional accessory that assists the operation of the valve. In this application, the counterweight was deemed not necessary and removed. The counterweight is primarily used in check valve applications where increased closing speed is necessary.

The following actions were taken:
1. All check valve installations were checked to identify any potential risk to personnel from falling object/counterweight.; Those check valves w/counterweights not in applications requiring increased closing speed will have the counterweights removed to prevent future incidents.
2. In areas where the counterweight assembly would not cause a danger; the assembly was left in place and verified to be secure (tack welded) and operating as designed.

Lesson Learned
All check valves that have external counter weights that upon failure or fatigue could cause a potential falling object hazard will need a PM frequency that will mitigate the hazard. These same check valves will need an additional means of securing the counter weight to prevent a future failure (tack welding is an option).

05 September 2007

Fall From Height

Safety Incident Topic: Fall From Height
Location of Incident: Construction Site, Taichang China
Date of Incident: 27 January, 2007

Brief Account of Incident
A contract worker fell from a permanent work deck located 6m above the ground. The investigation revealed that on the morning of the incident, a wooden temporary platform was constructed and then positioned 1.2m./4 ft. (horizontally) from the edge of the steel permanent deck and 1m./3.3ft.(vertically) above it. The worker was standing on the wooden temporary platform in order to grind on an over head pipe. While repositioning himself, he stepped off the wooden temporary platform. The 1m fall caused the worker to lose his balance. When he landed on the steel permanent work deck, he rolled toward the edge, fell through an incomplete guardrail (top rail only), and landed on the concrete floor below. Immediately following the incident, the worker was taken to the hospital and released to work without restrictions. The extent of his injuries was a bruised torso.

Immediate Causes
- Lack of knowledge of hazards present- Unprotected height
- Inadequate guards of protective measures

Root Causes
1. Inadequate identification of critical safe behaviour
Following the installation of the guard rail (top rail only) around the blend deck, the on-site contractor and BP personnel did not recognize the requirements for fall protection when a guardrail is missing a mid-rail and toe board. Once enhanced procedures are communicated to site personnel, extensive HSSE auditing would help to identify unsafe conditions or actions.
2. Inadequate identification of work hazards
During the Jan. 27th daily pre-job tool box safety meeting, the pipe work on the steel permanent work deck was not recognized as “working at heights”. Contract supervisors and workers did not identify the increased risk of falling from the temporary work platform and its close proximity to the unprotected edge. They did not understand or recognize that approved fall protection is required when working on an elevated platform with guardrails that are missing mid-rails and toe boards.
3. Inadequate work planning
For more than two weeks prior to the installation of mid-rails and toe boards on the guardrails, extensive construction activity was allowed to be performed on the steel permanent work deck without approved fall protection.
4. Inadequate implementation of 'Policies, Standard and Procedure'
Standards for Working at Heights were in place but the applicability when working on a flat permanent work deck with an incomplete guardrail had not been addressed. Prior to the incident, the standard had been misapplied due to inadequate detail and implementation.

Actions Taken
1- Revise/update written site safety procedures to enhance requirements for work on elevated walking and working surfaces. Procedures should include a requirement for guardrails to be constructed in full (top rail, middle rail, andtoe boards) at the time of initial installation. Communicate revisions to all site personnel.
2- Contractor and BP site personnel should attend additional formal instruction on Risk Assessments and Hazard Identification. The training will include the recognition of potential interactions of simultaneous activities.
3- Contract and BP site personnel should implement an enhanced HSSE audit process including HSSE audit checklists.
4- BP site construction coordinators should attend contractor planning meetings and ensure that work activities are strategically aligned with HSSE requirements.
5- BP site personnel should audit contactors to ensure that documented risk assessments for non-routine and routine permitted work activities are being completed and adequate for the work being performed.6- Communicate the following to all BP and contractor personnel on site. “Everyone must take personal accountability for themselves and for others. Any work viewed as being unsafe must be stopped.”

What Went Well
A Permit to Work for the welding operations and the Daily Risk Assessments had been completed and signed by all contractor employees involved in the task. HSSE Training records for the contract employee were complete and readily available for review.

Lesson Learned
1. Training on Hazard Identification, considering the interactions of location and tasks, needs to be further enhanced.
2. Personal accountability of others to stop work that they viewed as unsafe is critical to safe operations.

Carbon Dioxide Asphyxiation

Safety Incident Topic: Carbon Dioxide Asphyxiation Due To Exposure To Carbon Dioxide
Location of Incident: 33kV Switchgear Room, Malaysia
Date of Incident: 17 April, 2007


Brief Account of Incident
A contractor personnel was unconscious due to asphyxiation when a CO2 fire protection system activated inside an electrical switchgear room. The incident occurred during functional testing of a fixed CO2 fire protection system, which had earlier been relocated and isolated, when another CO2 system inside the same area activated. The victim was evacuated from the room by the plant’s emergency response team and regained consciousness after given first-aid treatment.

Outcome
1. One contractor personnel was asphyxiated due to CO2 exposure
2. The entire fixed CO2 fire protection system for the 33kV switchgear room was out of service due to loss of CO2 from the cylinders bank.

Active Failures
Unauthorized testing of the CO2 fire protection system by an incompetent personnel.

Lesson Learned
1- All work including functional testing of electrical/instrument system should be approved by authorized personnel of the OPUs. The work should be supervised and performed by competent personnel.
2- The effect of a stop-work-order should be made understood to all personnel and necessary actions e.g. cancellation/withdrawal of PTW, evacuation of personnel from the work area etc. should be taken as soon as possible.
3- Relevant parties such as Operation, Maintenance Project Team and HSE etc. should be involved in the review of method statements, Job Safety Analysis and other work procedures to ensure all hazards are identified and control measures e.g. isolation requirements are taken.
4- Method statement for each task should be documented in detail e.g. the steps to be taken, the specific switch(es) to be isolated etc. The method statement should be discussed with all relevant parties involved including the contractor and subcontractors prior to the job.
5- Access into rooms which are protected by fixed fire protection systems e.g. CO2, FM200 etc should be controlled especially during testing of the system.6- Updated drawings to be made available in the plant.

Warm Diesel Spill

Safety Incident Topic: Warm Diesel Spill When Loosening Plug
Location of Incident: Refinery, Australia
Date of Incident: 12 June, 2007

Brief Account of Incident
The Distillate Ultrafiner was being shut down for maintenance. Part of the procedure called for soda ash washing of a heat exchanger bank. Temporary fittings were required to enable the soda ash wash. Work to prepare for blinding was being conducted by fitters while operators progressed the draining and depressuring of the unit. A plug on a heat exchanger was loosened to check if the heat exchanger was empty and depressured in preparation to installing a soda ash wash fitting. Upon the initial loosening some diesel came out of the tapered plug, but this stopped. Upon further loosening, the plug came out of the socket and ~400L of warm diesel flowed out of the exchanger under pressure. The diesel stream hit a concrete pillar, forming fine droplets. The diesel pooled and ran towards the vacuum distillation charge furnace. The diesel did not ignite. With an operator directing, the fitters responded in running out and manning fire hoses. The supervising operator isolated the heat exchanger bank from the source of pressure. The control room was contacted and instructed to sound the active aid alarm. Emergency responders arrived at the incident scene, relieved the fitters and mitigated escalation. The supervising operator installed the soda ash wash fitting when the system was depressured to re-establish containment. After securing the site, the diesel spill was removed by vacum truck.

Investigation Findings
The work was being done following an operations procedure with a blind list under the supervision of an operator. The supervising operator asked the fitters to second bolt a number of heat exchanger flanges to prepare for blinding. The operator and the fitters talked about the step of pulling a plug to install the soda ash wash fitting. The operator thought that he clearly communicated that the step of pulling the plug was not to be done until the blind was in place, after completely draining the heat exchanger bank and isolating it from the stabiliser.The fitters’ understanding was that the operator had instructed them to pull the plug and install the soda ash wash fitting. It was believed that the heat exchanger bank was open to drain to the pump out system. After initially loosening the plug, the fitters checked and confirmed that the figure 8 blind had been swung to the open position and the valves were lined up to the pump out drum. Subsequent checks confirmed that the pump out line was not blocked. The level in the pump out drum remained constant while the heat exchanger was thought to be draining (this is the subject of ongoing investigation). The fitters had conducted a personal job safety analysis (PJSA). The hazard of breaking containment on live equipment was not raised on the PJSA. The procedure had not been progressed to the stage where breaking containment was called for.

What Went Wrong (critical factors)
1. Containment was broken when it was not safe to do so. The plug was loosened based on the fitter’s understanding of the operator’s verbal instruction. The operator and the fitter did not have a common understanding of how far the procedure had progressed and whether or not it was safe to break containment.
2. Containment was broken by loosening a plug. Once the plug came out of the socket, it was impossible to control the outflow of diesel until the system could be isolated from fuel gas pressure.
3. There was no valve or flange on the plug hole to allow a safer means of checking the pressure and liquid level. Verification that the system was drained and depressured was by loosening the plug. This method was not appropriate.

Immediate Causes
1. Servicing of energised equipment. The heat exchanger bank was at stabiliser pressure using fuel gas, let down to flare. The heat exchanger bank had not completely drained when the plug was loosened.
2. Inadequate isolation of process or equipment. The plug was not a suitable form of isolation from the process to break containment because once the plug was removed from the socket the plug could not be replaced until the system had depressurised.
3. Inadequate equipment. The heat exchanger bank did not have an adequate or obvious means of determining that the shell side of the heat exchanger was fully drained and depressurised

System Causes
1. Human factors consideration. Verbal communications in the plant are susceptible to misunderstanding.
2. Inadequate implementation of policy / standards / procedures. In the procedure the step for isolating the heat exchangers from the stabilizer appears after the step to install the temporary fittings.The operating procedure was ambiguous on when to install the isolating blind on the shell side inlet of the heat exchanger. The step to install the blind appeared twice in steps K11 and L21. Step L21 appeared after the step (L13) calling for the installation of the soda ash wash fitting.
3. Inadequate assessment of needs and risks the plug was loosened without positive confirmation that the shell side of the exchanger was drained of liquid and depressurised.
4. Inadequate technical design. The heat exchanger bank requires periodic repair and maintenance. To prepare for this maintenance, the heat exchanger must be drained, gas freed and opened. The lack of an appropriate facility for checking that the heat exchanger is empty and depressurized represents and inadequate design.
5. Inadequate correction of prior hazard /incident. The hazard of the plug without an isolation valve was recognised and had been raised at previous turnarounds, but had not been corrected.

Summary of The Local Actions
1. As an additional safeguard, fitters are requested to only loosen and remove plugs,which do not have an isolating valve, in the immediate presence of the supervising operator.
2. Implement site measures/procedures on verifying depressurization / isolation prior to breaking containment, checking that they are in line with the new group isolation standard.
3. Consider implementing a process for unit shutdown where the state of each section between isolations is shown as they progress (e.g. on the process flow diagram).
4. Revise the Ultrafiner shutdown procedures, including; nitrogen purging and closure of valve to stabiliser to occur prior to breaking containment and connections of the soda ash wash fitting; and remove ambiguity about when to install blinds on heat exchangers.
5. Revise the breaking of containment procedure to include the hazards of pressure (hydraulic / pneumatic) and how to verify that something is depressurized. Develop a breaking of containment training module.
6. Assess the need, develop a plan and implement the plan for fitting isolation valves to plugs in the older units. Alternatively, replace them with nozzles and blank flanges. Back weld plugs that do not need to be removed.
7. Address the training of fitters in the appropriate level of emergency response, considering the possibility of them being first responders.
8. Communicate the findings of this incident refinery wide to raise awareness.

What Went Well
1. The fitters assisted the operators with the first response.
2. The emergency responders reacted quickly, providing more than the required resources to avert escalation of the incident.
3. The fitters and operators openly contributed to the investigation.

03 September 2007

Crane Overturned

Safety Incident Topic: Crane Overtuned
Location of Incident: Road Between Tank And Cooling Tower Area
Date of Incident: 15 January, 2007

Brief Account of Incident
A 50 tonnes crane being employed to lift pipes from ground level to a pipe rack 8 meters high located at the west side of the cooling tower. Prior to setting the pipes in place, it was required to blow out (clean) the pipe pieces. There was not enough space on the road between the cooling tower and tank area to extend both sides of the stabilizer fully so one side of crane stabilizer was not fully extended. When the crane operator lifted the pipes and rotated the crane, it overturned in the direction of the shortly extended stabilizer. The crane fell towards the tank area. The crane hook hit the vent pipe on top of the naphtha tank (at a height of 14m) then came to rest on top of the tank. The crane boom was jackknifed and rested on an acetic acid product line which was bent slightly. Fortunately, as the crane overturned slowly, there were no injuries or environmental problems.

Potential Outcome
- Naptha leak / acid leak- single or multiple leakCritical Factors
- West side of stabilizers to the tank area was not fully extended due to narrow working space.
- Crane rotated in the direction of the not fully extended stabilizers.

Immediate Root Causes
1- Crane stabilizers not fully extended both sides.
2- Crane operator miscalculated weight load on un-extended stabilizer side.
3- Detailed work procedure was not prepared prior to crane operation specifically.

System Root Causes
1- The crane company supplied 50 ton crane where 25 ton crane was requested-Last minute plan change required the crane to reset and change location to blow out the pipes.
2- Crane operator’s decision to continue without change of location; but only adjusting boom angle while rotating the boom
3- Employee observed first movement; boom was raised to a high angle and then rotated to prevent overturn.- Crane operator began to lift and commenced his turn simultaneously on return of pipe.- At this position on return run; crane stabilizers on the west side could not support the load causing the crane to overturn.
4- In summary:
- Work procedures insufficient to task
- Proper precautions had not taken
- The work procedure did not address specific crane issues.
- Lack of employee experience regarding crane operation and safety.

Key Actions
1- Another company contracted to bring 25 ton crane to complete remaining job and new safety procedures utilized during setup and completion of task.
2- Spread the narrow working place to extend all stabilizers fully according to newly revised work procedure
3- Specific safety protocols and procedures drawn up for use of heavy equipment within SSBP
4- All outside contractors to be monitored closely and to follow SSBP safety procedures while working within SSBP
5- Safety training plan for outside contractors to address safety issues while performing tasks for SSBP Lesson Learned
6- This incident is directly related with lack of sufficient safety procedures in place compared with other major big project. Therefore it is required to increase safety standards even if small project.
7- In the event of difference or deviation against original plan, new safety analysis for the situation should be performed within all authorized people.