Skip to content

Management of Change

Overview

This CSB Safety Bulletin examines two 1998 incidents to highlight the need for a systematic management of change (MOC) approach for both preplanned changes and operational deviations. The bulletin emphasizes that MOC should cover changes in technology, processes, equipment, procedures, and abnormal operating conditions.

Incident Snapshot

Field Value
Facility / Company Equilon Enterprises; CONDEA Vista Company
Location Anacortes, Washington; Baltimore, Maryland
Incident Date 11/25/1998
Investigation Status The CSB issued this Safety Bulletin on August 28, 2001. The bulletin discusses two incidents that occurred in the United States in 1998 and focuses attention on the need for systematically managing the safety effects of process changes in the chemical industry.
Accident Type Safety Bulletin / Management of Change (MOC) incidents
Final Report Release Date 08/28/2001

What Happened

On November 25, 1998, a fire at the Equilon Enterprises oil refinery delayed coking unit in Anacortes, Washington, caused six fatalities. A loss of electric power and steam supply approximately 37 hours prior to the fire had resulted in abnormal process conditions. A severe storm on November 24 caused an electric power outage in the refinery and stopped the production of steam. At the delayed coking unit, the on-line drum had been filling for about an hour and was approximately 7 percent full; the other drum was full and was being cooled. Electric power was restored after 2 hours, but an additional 10 hours passed before steam production was re-established. During the interim, the tarry oil in the piping between the furnace and the partially filled drum cooled and started to solidify. Once steam was restored, the operators were unsuccessful in attempting to inject it into the drum through the normal route because of the plugged piping. A process interruption in 1996 had also resulted in a partially filled drum; water was injected into the drum to cool the material inside, and when the drum was opened, a torrent of water, heavy oil, and coke spewed out. An internal investigation team recommended that procedures be written for cooling/emptying partially filled drums, but this task was not completed. On the day of the fire, neither the process supervisor nor the operators had any written procedures for handling partially filled drums. The process supervisor left instructions directing the night shift not to add any water and instead to allow the drum and its contents to simply stand and cool overnight. On the following morning, he met with the operators to determine how to empty the partially filled drum; no engineers were present at this meeting. The supervisor and operators observed that the exposed part of the bottom flange of the drum felt cool to the touch and that temperature-sensing devices indicated approximately 230 degrees Fahrenheit (°F), as compared to the 800°F of a typically full drum. One operator suggested adding 100 barrels of water to the drum. They decided it was not very hot inside and it was safe to open the vessel as long as they first injected some steam. An operator connected a steam hose to the oil inlet piping at the bottom of the drum. Several witnesses said that the steam warmed the top of the piping, but the bottom remained cool. The top head was unbolted and lifted from the drum. The bottom head was also unbolted and held in place by a hydraulic dolly. The operator activated a release mechanism to lower the dolly. Witnesses reported hearing a whooshing sound and seeing a white cloud of vapor emanate from the bottom of the drum. The hot petroleum vapor burst into flames. The process supervisor, an operator, and the four contract personnel assisting were caught in the fire and did not survive. After the incident, Equilon relocated the controls for the hydraulic dolly to allow workers to position themselves farther from a drum when opening it.

On October 13, 1998, a reaction vessel explosion and fire at the CONDEA Vista Company detergent alkylate plant in Baltimore, Maryland, injured four people. About 3 months prior to the incident, the Baltimore facility changed its process technology and discontinued the direct addition of aluminum chloride to the reactor. Instead, powdered aluminum was added to the reactor, where it combined with hydrogen chloride to form the necessary aluminum chloride. Shortly after the plant switched to the new process, the reactor became fouled with a sludge-like catalyst residue. When the process was shut down for maintenance, the operators were unable to empty the liquid that remained in the reactor. Sludge had settled in the vessel, plugging the bottom outlet nozzle. Unsuccessful attempts were made to clear the nozzle by injecting high-pressure nitrogen into the piping. The reactor was also flushed with a high flow of oil for several hours, but this failed to clear the plugging. The following day, excess liquid was removed from the reactor through a side nozzle, and a sample of the remaining sludge was extracted. The next morning, the sample was given to a plant chemist, who was asked for advice on dissolving the remaining sludge. The chemist conducted a laboratory experiment to check whether fresh powdered aluminum catalyst reacted with water and concluded that it did not. When the sludge sample was tested, it reacted with water, yielding a white gas (hydrochloric acid) and generating heat. The chemist concluded that water was an appropriate solvent for clearing the sludge from the reactor. Later that morning, the technology manager assigned an engineer to work with the chemist in solving the plugging problem. The engineer estimated the volume of solid in the reactor and performed calculations for potential energy release and for the ability of water to absorb the heat generated. Together, the chemist and the engineer recommended that water be added to the reactor to dissolve the solids. They suggested an 8:1 ratio, with the water added at as fast a rate as possible. Water was added to the reactor while the vessel agitator was running. A temperature indicator in the control room recorded a 5 to 10 degree Celsius (°C) temperature rise. After observing the reactor temperature stabilize, the chemist and the engineer went home for the night. Because the process supervisor had not been in the plant that day, the shift supervisor spoke to him by telephone and suggested injecting a short burst of steam at the bottom nozzle of the reactor. The process supervisor agreed. The shift supervisor wrote a one-line instruction for the night shift to use steam to clear the plugging. The night shift supervisor understood that he was to use steam to break up the plug. The procedure intended by the day shift supervisor and the process supervisor was to inject a short burst of steam, not to apply it continuously. The night shift supervisor instructed an operator to add steam to the reactor. Minutes after the operator started to continuously inject the steam, it reacted with the metallic aluminum and the aluminum chloride residue in the sludge. The reactor vessel exploded. No one was present in the immediate vicinity of the reactor when it exploded, and there were no fatalities in the CONDEA Vista incident. Two employees and one contractor received first- and second-degree burns. Another contractor injured his back when he fell. Property damage was estimated at $13 million.

Facility and Process Context

  • Equilon Enterprises oil refinery delayed coking unit in Anacortes, Washington.
  • A delayed coker converts heavy tar-like oil to lighter petroleum products, such as gasoline and fuel oil.
  • Petroleum coke is a byproduct of the process.
  • Drums of coke are actually produced in batches, though the operation is conducted continuously.
  • CONDEA Vista Company detergent alkylate plant in Baltimore, Maryland.
  • Linear alkyl benzene is used to produce biodegradable detergents, which are widely used in industrial, commercial, and residential cleaners.

Consequences

  • Six fatalities in the Equilon Enterprises oil refinery fire; no fatalities in the CONDEA Vista incident.
  • Four people were injured in the CONDEA Vista incident: two employees and one contractor received first- and second-degree burns, and another contractor injured his back when he fell.
  • Property damage in the CONDEA Vista incident was estimated at $13 million.
  • The Equilon fire delayed the delayed coking unit; the storm interrupted process operations and stopped the production of steam.

Key Findings

Immediate Causes

  • The hot petroleum vapor burst into flames at the Equilon Enterprises oil refinery fire.
  • Minutes after the operator started to continuously inject the steam, it reacted with the metallic aluminum and the aluminum chloride residue in the sludge, and the reactor vessel exploded.

Contributing Factors

  • A loss of electric power and steam supply approximately 37 hours prior to the Equilon fire had resulted in abnormal process conditions.
  • The tarry oil in the piping between the furnace and the partially filled drum cooled and started to solidify.
  • Operators were unsuccessful in attempting to inject steam through the normal route because of the plugged piping.
  • The supervisor and operators relied on the coolness of the bottom flange and temperature-sensing devices indicating approximately 230°F.
  • No engineers, who could have provided technical support, were present at the meeting.
  • The limited flow of steam might not sufficiently strip all the toxic compounds from the tar inside the vessel.
  • The relative coolness of the bottom flange erroneously suggested that the temperature inside the drum was also cool.
  • Only the material adjacent to the inside walls had cooled; the core of the mass remained insulated from heat loss.
  • Residual heat continued to break down the petroleum, creating a pocket of hot pressurized volatile oil.
  • Heat transfer calculations would have indicated that weeks would be required for the drum contents to cool sufficiently via heat losses to the ambient environment.
  • The higher density material combined with problems related to initial overfeeding of the aluminum overtaxed the mixing capability of the agitator and allowed aluminum to settle in the bottom of the reactor, where it plugged the lower nozzle and accumulated as sludge.
  • The chemist and the engineer relied on misleading temperature indications when they noted the stabilization of the reactor temperature before leaving for the day.
  • The temperature-sensing device did not accurately indicate the process temperature because it was located in a stagnant pipeline between the reactor and another vessel.
  • The concept of absorbing the energy of reaction by means of quickly adding a surplus of a reactive substance (water) was potentially hazardous.
  • The water would have to be added quickly and without interruption to avoid a significant heat release.
  • The absence of written instructions increased the likelihood of miscommunication between the two shift supervisors, which led to the unsafe application of steam in the reactor vessel.

Organizational and Systemic Factors

  • The internal investigation team recommended that procedures be written for cooling/emptying partially filled drums, but this task was not completed.
  • The process supervisor and operators had no written procedures for handling partially filled drums.
  • The process supervisor left instructions directing the night shift not to add any water.
  • No engineers were present at the meeting to determine how to empty the partially filled drum.
  • The shift supervisor wrote a one-line instruction for the night shift to use steam to clear the plugging.
  • The procedure intended by the day shift supervisor and the process supervisor was not detailed.
  • The technology manager assigned an engineer to work with the chemist in solving the plugging problem.
  • The chemist and the engineer recommended that water be added to the reactor to dissolve the solids.
  • The night shift supervisor understood that he was to use steam to break up the plug.
  • The bulletin states that management’s responsibility is to gather the right people and resources to review the situation once a deviation is identified that triggers the MOC system.
  • The bulletin states that the skills of a multidisciplinary team may be required to thoroughly identify potential hazards, develop protective measures, and propose a course of action.
  • The bulletin states that an authorization or approval step as part of an MOC system for abnormal situations would have allowed a technical manager to review the proposed procedure and may have detected its deficiencies.

Failed Safeguards or Barrier Breakdowns

  • Written procedures for cooling and emptying partially filled drums were not completed.
  • No written procedures for handling partially filled drums were available on the day of the Equilon fire.
  • The limitations of temperature-sensing devices were not better understood.
  • The temperature-sensing device did not accurately indicate the process temperature because it was located in a stagnant pipeline between the reactor and another vessel.
  • The proposed procedure for dissolving the sludge was not reviewed by a formal hazard analysis.
  • The absence of written instructions increased the likelihood of miscommunication between the two shift supervisors.
  • The MOC system did not include abnormal situations, changes to procedures, and deviations from standard operating conditions in the Equilon incident.
  • The MOC policy did not cover operational variances in addition to physical alterations.
  • The process supervisor and operators did not have written procedures for handling partially filled drums.
  • The reactor vent piping and relief system did not prevent the explosion in the CONDEA Vista incident.
  • The controls for the hydraulic dolly were later relocated to allow workers to position themselves farther from a drum when opening it.

Recommendations

  1. Recommendation ID: Not specified
    Recipient: Chemical processing enterprises
    Status: Not specified
    Summary: Chemical processing enterprises should establish policies to manage deviations from normal operations.

  2. Recommendation ID: Not specified
    Recipient: Not specified
    Status: Not specified
    Summary: Systematic methods for managing change are sometimes applied to physical alterations, such as those that occur when an interlock is bypassed, new equipment is added, or a replacement is “not in kind.”

  3. Recommendation ID: Not specified
    Recipient: Not specified
    Status: Not specified
    Summary: The Equilon incident underscores the need to have MOC policies that include abnormal situations, changes to procedures, and deviations from standard operating conditions.

  4. Recommendation ID: Not specified
    Recipient: Management
    Status: Not specified
    Summary: Once a deviation is identified that triggers the MOC system, it is management’s responsibility to gather the right people and resources to review the situation.

  5. Recommendation ID: Not specified
    Recipient: Management and technical personnel
    Status: Not specified
    Summary: The skills of a multidisciplinary team may be required to thoroughly identify potential hazards, develop protective measures, and propose a course of action.

  6. Recommendation ID: Not specified
    Recipient: Equilon Enterprises
    Status: Not specified
    Summary: Written procedures for cooling and emptying partially filled drums, as recommended by an Equilon investigation team in 1996, might also have reduced the likelihood of this incident.

  7. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: To assure that deviations from normal practice do not create unacceptable risks, it is important to have a variance procedure, or to have incorporated the same means of control into other management systems.

  8. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: The variance procedure will require review of the planned deviation, and acceptance of the risks it poses.

  9. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: The variance procedure should require the explanation of the deviation planned; the reasons it is necessary; the safety, health, and environmental considerations; control measures to be taken; and duration of the variance.

  10. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: Variances should require the approval by a suitable level of management, based on the process risks involved.

  11. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: They should be documented to assure consistent understanding by all affected individuals and departments of what specific departure from normal practice is to be allowed.

  12. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: A formal hazard analysis may be appropriate depending on the complexity of the change or variance.

  13. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: If your organization has an MOC policy, review it to be sure that it covers operational variances in addition to physical alterations.

  14. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: Define safe limits for process conditions, variables, and activities—and train personnel to recognize significant changes.

  15. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: Apply multidisciplinary and specialized expertise when analyzing deviations.

  16. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: Use appropriate hazard analysis techniques.

  17. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: Authorize changes at a level commensurate with risks and hazards.

  18. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: Communicate the essential elements of new operating procedures in writing.

  19. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: Communicate potential hazards and safe operating limits in writing.

  20. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: Provide training in new procedures commensurate with their complexity.

  21. Recommendation ID: Not specified
    Recipient: Organizations with MOC policies
    Status: Not specified
    Summary: Conduct periodic audits to determine if the program is effective.

Key Engineering Lessons

  • Management of change must cover operational deviations and variances, not only preplanned physical changes.
  • Written procedures are necessary for abnormal operations such as cooling and emptying partially filled drums.
  • Temperature indications from a single sensor or a cool external surface may not represent the true internal process condition.
  • A formal review by appropriate technical personnel and a multidisciplinary team is needed before selecting a corrective action for an abnormal condition.
  • Procedural changes and emergency workarounds should be documented clearly to prevent miscommunication between shifts.
  • When a deviation is identified, approval and hazard review should be commensurate with the risk of the proposed action.

Source Notes

  • Consolidated from the CSB Safety Bulletin 'Management of Change' and the structured extract provided.
  • Priority 4 supporting document was the only structured source provided; no higher-priority conflicting source data were available.
  • All facts were taken only from the supplied text; no external information was added.

Similar Incidents

Incidents sharing the same equipment, root causes, or hazard types.

Same Equipment

Same Root Cause

Same Hazard

← View in Knowledge Graph