Skip to content

CSB Safety Study: Remote Isolation of Process Equipment

Overview

CSB Safety Study No. 2024-01-H reviewed multiple incidents in which consequences escalated after a loss of containment and the absence of effective remote isolation equipment. The study concluded that remote isolation requirements are needed in industry standards and federal regulations to help mitigate releases of highly flammable or toxic materials.

Incident Snapshot

Field Value
Facility / Company Multiple facilities/incidents reviewed by CSB, including TPC Group Port Neches Operations
Location Multiple locations; incident metadata location not specified
Incident Date 11/27/2019
Investigation Status The CSB's Safety Study was released in a public business meeting on July 25, 2024.
Accident Type Chemical Manufacturing - Fire and Explosion Investigation Status
Final Report Release Date 07/25/2024

What Happened

The CSB reviewed a series of incidents involving fires, explosions, and large releases of hazardous materials. The incidents included refinery, terminal, and chemical plant events. In each case, the study identified that the ability to isolate process equipment from a safe location was limited or absent. The study found that this limitation contributed to escalation, increased damage, and, in some cases, fatalities and injuries.

Facility and Process Context

  • Gulf Oil Company refinery in Philadelphia, Pennsylvania
  • Philadelphia Energy Solutions (PES) Refinery hydrofluoric acid (HF) alkylation unit in Philadelphia, Pennsylvania
  • Formosa Plastics Corporation, USA complex in Point Comfort, Texas
  • Valero McKee Refinery in Sunray, Texas
  • Intercontinental Terminals Company, LLC (ITC) bulk liquid storage terminal in Deer Park, Texas
  • KMCO, LLC facility in Crosby, Texas
  • TPC Group Port Neches Operations (PNO) facility in Port Neches, Texas
  • Associated Octel Company Limited plant in Ellesmere Port, Cheshire, England
  • BP Grangemouth Complex in Scotland
  • Pacific Gas and Electric Company (PG&E) Line 132 in San Bruno, California

Consequences

  • Fatalities:
  • Eight Gulf firefighters died in the 1975 Gulf Oil incident.
  • One worker died in the KMCO incident.
  • Eight people were killed in the San Bruno pipeline incident.
  • Injuries:
  • Seven Philadelphia firefighters and four Gulf firefighters were injured in the 1975 Gulf Oil incident.
  • Sixteen workers were injured in the Formosa incident.
  • Four workers were injured in the Valero McKee incident.
  • Five workers experienced minor injuries in the PES incident.
  • One operator was seriously burned and a nearby shift supervisor was seriously burned in the KMCO incident.
  • Two serious injuries occurred in the KMCO incident.
  • Two TPC employees and a contractor reported minor injuries, and at least five local residents reported injuries in the TPC incident.
  • Environmental release:
  • The ITC incident released an estimated 21 million gallons of hydrocarbon and petrochemical products, firefighting foam, and contaminated water into Tucker Bayou and adjacent water, sediments, and habitats.
  • The PES incident released roughly 676,000 pounds of hydrocarbons and over 5,200 pounds of highly toxic HF.
  • The TPC incident involved release of butadiene from the process unit.
  • The Gulf Oil incident involved release of between 500 and 600 gallons of liquid naphtha every minute.
  • The San Bruno incident released 47.6 million standard cubic feet of natural gas.
  • Facility damage:
  • More than $10 million in damage in the 1975 Gulf Oil incident.
  • The PES incident resulted in an estimated property damage loss of $750 million.
  • The ITC incident property damage exceeded $150 million.
  • The TPC incident caused $450 million in on-site property damage and $153 million in off-site property damage.
  • The KMCO explosion substantially damaged portions of the facility.
  • The Formosa process unit was heavily damaged.
  • The Valero McKee incident caused extensive damage to the PDA unit, the main pipe rack, and an adjacent process unit.
  • The Gulf Oil incident caused a massive fire and damage to the refinery.
  • The Octel incident required a complete rebuild.
  • Operational impact:
  • The PES incident ultimately led to the closing of the facility.
  • The ITC fire burned for three days until extinguished on March 20, 2019, and caused a seven-mile stretch of the Houston Ship Channel to be closed, several waterfront parks to close, shelter-in-place orders, and a portion of a major highway to close.
  • The TPC butadiene unit was destroyed, forcing the facility to cease butadiene production operations indefinitely.
  • The Valero McKee refinery experienced total shutdown and evacuation.
  • The KMCO company filed for bankruptcy and is no longer in business.
  • The Gulf Oil incident required firefighters to work all day to control the fire.

Key Findings

Immediate Causes

  • A pipe elbow ruptured in the PES hydrofluoric acid (HF) alkylation unit.
  • A fist-sized piece of metal broke away from the body of a three-inch cast iron y-strainer in the KMCO batch reactor’s liquid isobutylene supply piping.
  • A damaged naphtha storage tank was feeding the fire by releasing liquid naphtha every minute in the Gulf Oil incident.
  • A leak in the propane deasphalting (PDA) unit began the Valero McKee fire.
  • A release of reactor solution from a recirculating pump near the base of an ethyl chloride (EC) reactor vessel occurred at the Octel plant.
  • A significant leak of hydrocarbons from the FCCU created a vapor cloud that ignited at BP Grangemouth.
  • Popcorn polymer accumulated in a temporary dead leg in piping at the TPC facility and the piping ruptured, releasing butadiene from the process unit.

Contributing Factors

  • Lack of effective remote isolation equipment.
  • Operators were unable to reach manual valves due to an advancing vapor cloud at Formosa.
  • Operators were unable to reach the local control station to quickly turn off the pumps supplying propylene at Formosa.
  • The rapidly expanding fire prevented field operators from closing manual isolation valves or reaching local pump controls at Valero McKee.
  • Control room operators were unable to shut off the flow of propane because there were no remotely operable shut-off valves, or ROSOVs, in the PDA unit.
  • Tank 80-8 and the other aboveground storage tanks in the tank farm were not equipped with ROEIVs.
  • Tank 80-8 could not be remotely or automatically isolated.
  • KMCO workers lacked the ability to isolate the isobutylene release from a safe location, such as from within the blast-resistant control room.
  • There were no ROEIVs installed in the HF alkylation unit to remotely and automatically isolate the large hydrocarbon sources adjacent to the failed elbow.
  • The butadiene process unit was not equipped with ROEIVs.
  • API RP 553 does not detail conditions for which a Type D (remotely operated) EBV is required.
  • The PSM standard did not apply to the tanks in the ITC tank farm due to an exemption related to atmospheric storage tanks.
  • The EPA RMP rule did not apply due to ITC’s characterization of the flammability of the butane-enriched naphtha product.
  • Neither KMCO’s 2014 PHA nor its 2015 PHA included any discussion of remote isolation or recommendations to equip the isobutylene system with remote isolation valves.
  • Formosa’s written hazard analysis did not consider a catastrophic loss of containment within the unit.
  • The McKee Refinery’s process hazard analysis failed to identify and address the need for ROSOVs in the PDA unit to rapidly isolate LPG releases.
  • The facility was unable to stop the initial release at Octel because manually operated valves were very difficult to access during the emergency because of their location.
  • The failure of the tee-piece connection pipework at BP Grangemouth was likely caused by a combination of the incorrectly fitted tee-piece connection, the inadequately supported pipework, and the cyclic stresses caused by the increased start-up/shutdown activity on the plant.

Organizational and Systemic Factors

  • The CSB found that although good industry guidance has been available for many years, the guidance has not been consistently followed.
  • Reliance on existing industry guidance concerning remote isolation alone is not sufficient.
  • The CSB concluded that regulatory requirements associated with remote isolation of process equipment are necessary.
  • Companies have not fully recognized that the effective remote isolation of equipment is critical to quickly stopping releases of hazardous materials.
  • The CSB stated that companies should address isolation philosophy as part of the hazard review process.
  • The CSB believes that many more incidents could be mitigated by facilities applying the CCPS flow chart or a similar tool during hazard reviews to determine the need for effective remote isolation capabilities from a safe location.
  • The CSB concluded that the API standard has not yet achieved incident consequence mitigation.
  • The CSB concluded that additional action is needed.
  • The CSB further believes that companies have a responsibility to promptly adopt the use of the CCPS flow chart or an equivalent methodology during all future hazard reviews to evaluate whether and where remote isolation should be applied for all major process equipment – and then implement those findings.

Failed Safeguards or Barrier Breakdowns

  • No remotely operated emergency isolation valves installed in the HF alkylation unit at PES.
  • No remotely operable shut-off valves, or ROSOVs, in the Valero McKee PDA unit.
  • Tank 80-8 was not equipped with ROEIVs.
  • The aboveground storage tanks in the ITC tank farm were not equipped with shut-off valves that would fail closed.
  • KMCO had not addressed the recommendation to commit to the installation of fire-safe, remote-actuated automatic isolation valves in strategic process areas.
  • The Octel plant had manually operated valves that were very difficult to access during the emergency.
  • The San Bruno pipeline lacked either automatic shutoff valves or remote-control valves.
  • The TPC facility lacked Type D remotely operated emergency isolation valves.
  • The Formosa facility did not have a remotely operated valve installed upstream of the pumps supplying propylene.
  • The Formosa company’s hazard analysis did not consider whether local isolation valves would be accessible or whether remotely operated isolation devices would be necessary in the event of a loss of containment.

Recommendations

  1. 2024-01-H-R1 | Recipient: American Petroleum Institute (API) | Status: Open – Acceptable Response or Alternate Response | Summary: Develop a new publication or revise an existing publication or publications that should be applicable to various facility types such as refineries, chemical and petrochemical facilities, terminals, etc. with major process equipment and atmospheric storage tanks, that details conditions that necessitate the installation of remote isolation devices [use “shall” instead of “should” language] that may be automatically activated or remotely activated from a safe location, particularly during an emergency. When establishing these conditions refer to the guidance published by CCPS entitled Guidelines for Fire Protection in Chemical, Petrochemical, and Hydrocarbon Processing Facilities, Sections 8.1.10 and 8.1.11. At a minimum, the conditions should address major process equipment and atmospheric storage tanks, material volumes/weight as well as flammability, corrosivity, and toxicity.
  2. 2024-01-H-R2 | Recipient: U.S. Environmental Protection Agency (EPA) | Status: Open – Awaiting Response or Evaluation/Approval of Response | Summary: Update the Risk Management Program (RMP) rule by expanding the requirements of 40 CFR Part 68 to include an evaluation of the need for remote isolation devices for major process equipment that can be remotely activated from a safe location or automatically activated during a release. The evaluation should be included in hazard assessments, hazard reviews, and process hazard analyses.
  3. 2024-01-H-R3 | Recipient: Occupational Safety and Health Administration (OSHA) | Status: Open – Awaiting Response or Evaluation/Approval of Response | Summary: Update the Process Safety Management (PSM) standard by expanding the Process Hazard Analysis (PHA) requirements under 29 CFR 1910.119(e)(3) to include an evaluation of the need for remote isolation devices for major process equipment that can be remotely activated from a safe location or automatically activated during a release.

Key Engineering Lessons

  • Remote isolation capability is critical to quickly stopping releases of hazardous materials and limiting escalation after loss of containment.
  • Where a review establishes a need, remotely operated shutoff valves (ROSOV) should be considered during the PHA and FHA processes.
  • Manual valves should not be relied upon when the employee effecting isolation would be placed in danger.
  • Facilities handling large inventories of flammable or toxic material should assess whether those inventories can be remotely isolated from a safe location.
  • The most effective method for isolation is through the use of ROEIVs.
  • Hazard reviews should explicitly evaluate whether local isolation valves will be accessible during an emergency and whether remotely operated isolation devices are necessary.
  • Remote isolation requirements should address major process equipment and atmospheric storage tanks, including material volume/weight and hazards such as flammability, corrosivity, and toxicity.

Source Notes

  • Primary source priority 1 final report used for incident synthesis and recommendations.
  • Priority 3 recommendation status summaries used only to update recommendation status and confirm wording.
  • The source documents describe multiple incidents; the incident_date field reflects the crawler metadata date associated with the TPC Group Port Neches Operations event.
  • Location and facility_company are generalized because the source set is a safety study covering multiple facilities rather than a single incident report.

Similar Incidents

Incidents sharing the same equipment, root causes, or hazard types.

Same Equipment

Same Root Cause

Same Hazard

← View in Knowledge Graph