Skip to content

Emergency Shutdown Systems for Chlorine Transfer

Overview

CSB Safety Bulletin comparing two chlorine railcar transfer incidents to emphasize the importance of installing, testing, and maintaining chlorine detection and emergency shutdown devices on chlorine railcar transfer systems. In the 2002 DPC Enterprises incident in Festus, Missouri, a chlorine railcar transfer hose ruptured, the emergency shutdown system failed to close, and 48,000 pounds of chlorine were released into the neighboring community. In the 2005 Honeywell Baton Rouge incident, a newly installed chlorine detector alerted operators and the emergency shutdown valves were closed remotely, stopping the release in less than one minute with no off-site impact.

Incident Snapshot

Field Value
Facility / Company DPC Enterprises; Honeywell International
Location Festus, Missouri; Baton Rouge chemical plant
Incident Date 08/14/2002
Investigation Status The CSB issued this safety bulletin on June 14, 2007. This bulletin compares two chlorine releases investigated by the CSB. In both, a railcar unloading hose failed and chlorine was released. In the first incident, an emergency shutdown system malfunctioned, resulting in a release of 48,000 pounds of chlorine and a significant community impact. In the second, the emergency shutdown system worked to minimize the release, and the community was not impacted.
Accident Type Release
Final Report Release Date 06/14/2007

What Happened

  • In 2002, the CSB investigated a chlorine release at DPC Enterprises (DPC) in Festus, Missouri, that resulted when a chlorine railcar transfer hose ruptured.
  • The CSB determined that although the supplier’s manufacturing records and identification tag indicated that the metal braid on the failed hose was made of Hastelloy C, as specified by DPC, it was actually made of stainless steel.
  • Neither the manufacturer nor DPC confirmed that the hose was constructed of the proper material before it was put into chlorine service.
  • Chlorine rapidly degraded the braid and the hose ruptured.
  • DPC had an emergency shutdown system to stop chlorine releases from the railcar, which included remotely activated emergency shutdown valves installed at each end of the chlorine transfer hose.
  • These valves were supposed to close automatically when detectors identified chlorine in the area or if operators pushed an emergency shutdown button.
  • On the day of the incident, even though the chlorine detectors detected the release and the operators pushed the shutdown button, the valves remained open.
  • Furthermore, the excess flow valve (internal to the railcar) did not close.
  • Consequently, 48,000 pounds of chlorine was released into the neighboring community.
  • On August 11, 2005, a chlorine transfer hose ruptured at Honeywell International’s (Honeywell) Baton Rouge chemical plant.
  • Chlorine began to escape from the railcar.
  • A newly installed chlorine detector alerted control room operators of the release; a shift supervisor who was outside saw the escaping chlorine and sounded the evacuation alarm.
  • A control room operator stopped the release by remotely closing the emergency shutdown valves on the chlorine transfer hose.
  • The release lasted less than one minute.
  • Immediately after the release, Honeywell tested for chlorine at the facility property line and found none.

Facility and Process Context

  • Facilities that use chlorine are located throughout the country, sometimes close to residential communities.
  • Many of these facilities receive chlorine in railcars.
  • Railcar unloading operations typically occur after transportation has ended, after the railcar has been delivered.
  • Railcar unloading operations are subject to OSHA and EPA regulations.

Consequences

  • Fatalities: None reported.
  • Injuries: Sixty-three local residents sought medical evaluation; three were admitted to the hospital. Some contractors working in the area heard the alarm and evacuated, some inhaled chlorine and were taken to the hospital where they were treated and released. All returned to work the next day.
  • Environmental release: 48,000 pounds of chlorine was released into the neighboring community. The chlorine caused tree leaves and vegetation around the facility to turn brown.
  • Facility damage: None reported.
  • Operational impact: Hundreds of residents being evacuated or sheltered-in-place. The release lasted less than one minute. Honeywell tested for chlorine at the facility property line and found none.

Key Findings

Immediate Causes

  • a chlorine railcar transfer hose ruptured
  • Chlorine rapidly degraded the braid and the hose ruptured
  • the valves remained open
  • the excess flow valve (internal to the railcar) did not close

Contributing Factors

  • the metal braid on the failed hose was made of stainless steel
  • Neither the manufacturer nor DPC confirmed that the hose was constructed of the proper material before it was put into chlorine service
  • the chlorine detectors detected the release and the operators pushed the shutdown button, but the valves remained open
  • The CSB determined that the valves were not adequately maintained or tested by DPC to ensure they would operate when needed.
  • DPC did not require employees to verify that the valves actually closed.
  • The U.S. Department of Transportation’s Hazardous Materials Regulations (HMR, at 49 CFR 171-180) do not require emergency shutdown equipment for railcar transfer systems.
  • DOT’s jurisdiction is limited to transportation-related activities.
  • Railcar unloading operations typically occur after transportation has ended.
  • OSHA’s Process Safety Management Standard and the EPA’s Risk Management Program regulation are performance-based regulations and do not have specific requirements for chlorine railcar unloading systems.

Organizational and Systemic Factors

  • The CSB recommended that DPC develop a quality assurance system for chlorine hoses, and implement procedures and practices to ensure that the emergency shutdown system operates reliably.
  • The CSB also recommended that the hose fabricator implement a materials’ verification procedure to improve quality and ensure that hastelloy chlorine hoses are readily identifiable.
  • approximately 30 percent of the bulk chlorine users contacted during this investigation continue to rely only on excess flow valves to stop chlorine flow in the event of a transfer hose rupture.
  • The emergency shutdown system should be regularly tested and maintained.
  • Chlorine transfer and emergency shutdown procedures should be in writing and employees should be trained on them.
  • The Department of Transportation receives its regulatory authority from the U.S. Congress.
  • Changing the DOT’s jurisdiction would require legislation to revise the scope of DOT’s authority.
  • OSHA has clarified that it considers Chlorine Institute guidance to be Recognized and Generally Achievable Good Engineering Practice (RAGAGEP).
  • DOT’s statutory authority does not extend to the unloading of railcars at a fixed facility (in the absence of a carrier), including the equipment used by a facility.

Failed Safeguards or Barrier Breakdowns

  • the emergency shutdown system malfunctioned
  • the valves remained open
  • the excess flow valve (internal to the railcar) did not close
  • Excess flow valves should not be relied upon as the sole means to stop chlorine releases during railcar unloading.
  • The HMR do not require emergency shutdown equipment for railcar transfer systems.
  • OSHA’s Process Safety Management Standard and the EPA’s Risk Management Program regulation do not have specific requirements for chlorine railcar unloading systems.

Recommendations

  1. 2005-06-I-LA-R1
    Recipient: U.S. Department of Transportation
    Status: Closed - No Longer Applicable
    Summary: Expand the scope of DOT regulatory coverage to include chlorine railcar unloading operations. Ensure the regulations specifically require remotely operated emergency isolation devices that will quickly isolate a leak in any of the flexible hoses (or piping components) used to unload a chlorine railcar. The shutdown system must be capable of stopping a chlorine release from both the railcar and the facility chlorine receiving equipment. Require the emergency isolation system be periodically maintained and operationally tested to ensure it will function in the event of an unloading system chlorine leak.

Key Engineering Lessons

  • Chlorine railcar transfer hoses must be verified to be constructed of the specified material before being placed into chlorine service.
  • Emergency shutdown valves and related isolation devices must be maintained and tested so they will close when chlorine detectors alarm or when operators activate the shutdown function.
  • Excess flow valves should not be relied upon as the sole means to stop chlorine releases during railcar unloading.
  • A remotely operated or automatically actuated emergency shutoff valve system should be able to safely isolate both ends of transfer hoses or flexible piping.

Source Notes

  • Priority 1 final report used as the authoritative source for incident facts and findings.
  • Priority 3 recommendation status summary used only for regulatory context and recommendation status.
  • The bulletin compares two incidents; the consolidated dataset centers on the 2002 DPC Enterprises chlorine release while retaining the Honeywell comparison as contextual information.

Similar Incidents

Incidents sharing the same equipment, root causes, or hazard types.

Same Equipment

Same Root Cause

Same Hazard

← View in Knowledge Graph