Sterigenics Ethylene Oxide Explosion¶
Overview¶
At approximately 3:00 p.m. on August 19, 2004, an explosion occurred inside an ethylene oxide sterilization chamber and an associated thermal oxidizer at the Sterigenics facility in Ontario, California. Four employees suffered minor injuries. The facility was rendered unusable.
Incident Snapshot¶
| Field | Value |
|---|---|
| Facility / Company | Sterigenics International, Inc. |
| Location | Ontario, California |
| Incident Date | 08/19/2004 |
| Investigation Status | On March 30, 2006, the CSB issued its final report on the accident. |
| Accident Type | Chemical Manufacturing - Fire and Explosion Investigation |
| Final Report Release Date | 03/30/2006 |
What Happened¶
- On Thursday, August 19, 2004, at approximately 1:30 AM, the Antares control system alerted operators of an EO injection failure during a cycle in Chamber 7.
- The operator ran several routine system checks in the control room, called in the lead operator, and they decided to abort the cycle.
- Operators used the cycle abort button on the control room console.
- Upon completion of the abort cycle, operators removed the chamber contents to an aeration room, and the chamber was left open awaiting maintenance personnel.
- The maintenance supervisor arrived at the plant at approximately 7:30 AM and assigned two technicians to work on the gas injection problem.
- The technicians ran an abbreviated test cycle that injected approximately 4 pounds of EO.
- The technicians then ran a final calibration cycle that utilized 125 pounds of EO.
- The technicians asked the maintenance supervisor for permission to skip the final gas washes and advance the cycle to completion.
- The maintenance supervisor agreed to advance the cycle to completion.
- The maintenance supervisor verbally gave the required password to a maintenance technician.
- The technician typed the command into the Antares system thereby skipping the gas wash phase.
- Minutes later, the technician cracked the sterilizer door to the pre-determined ventilation level, which automatically opened the backvent and caused approximately 50 pounds of EO remaining in the chamber to move into the ventilation system.
- EO immediately began to leak out of the chamber door into the building, causing nearby LEL monitors to alarm.
- The EO-laden air reached the oxidizer and ignited.
- The flame flashed back through the duct to the chamber and ignited the remaining EO, resulting in a powerful explosion.
- The explosion occurred shortly after 2 PM on August 19, 2004.
Facility and Process Context¶
- Sterigenics is a contract medical sterilization services provider that specializes in various types of sterilization in the U.S. and around the world.
- Its EO facility in Ontario performs services for manufacturers of a variety of medical products such as disposable syringes, urinary tract catheters, and cardiovascular stints and valves.
- Griffith began construction on the Ontario facility in 1993, and commenced sterilization operations in 1994.
- The facility has eight sterilization chambers and operates 24 hours a day, seven days a week, with approximately 30 employees.
- The control room used to monitor and control the sterilization process is located approximately 75 feet from Chamber 7.
- The oxidizer was installed to comply with EPA and California Air Resources Board emissions standards for EO.
- The facility continued to use the oxidizer to treat the lower concentration emissions from backvents and aeration rooms because the scrubber was unable to meet CARB emissions standards.
- The Ontario facility stores more than 5,000 lbs of EO and is covered by the OSHA PSM Standard (29 CFR § 1910.119).
- The facility had more than 5,000 lbs of ethylene oxide on site.
- This facility was subject to the OSHA Process Safety Management (PSM) standard, which is enforced in California by the California Occupational Safety and Health Administration (Cal/OSHA).
Consequences¶
- Fatalities: None were stated in the provided extracts.
- Injuries: Four employees in the facility’s control room sustained minor cuts and lacerations from the shattered control room glass. Three of these employees were transported to the hospital where they received minor medical treatment and were released the same day. Emergency responders treated and released one employee at the incident scene.
- Environmental release: EO flowed through the ventilation system from a sterilizer to an open-flame catalytic oxidizer where it ignited; approximately 50 pounds of EO remaining in the chamber moved into the ventilation system, and approximately fifty pounds of EO ignited in the chamber.
- Facility damage: Extensive damage to the 66,000 square-foot facility; both the facility structure and equipment sustained severe damage; all control room windows were shattered; the loading (south) door came to rest approximately 15 feet away; the unloading (north) door came to rest approximately 75 feet from the chamber; the chamber structure was permanently disfigured.
- Operational impact: Plant operations were disrupted for 9 months; neighboring businesses were evacuated for several hours; access to the building remained restricted until the structure was shored and a structural engineer approved the work; the structural support work was completed and access to the building was granted approximately two weeks after the incident.
Key Findings¶
Immediate Causes¶
- maintenance personnel overrode safety devices
- EO flowed through the ventilation system from a sterilizer to an open-flame catalytic oxidizer (oxidizer) where it ignited
- The flame traveled back to the sterilizer chamber through the ventilation system ducting and ignited a large volume of EO in the chamber
Contributing Factors¶
- The maintenance supervisor entrusted with the password for bypassing gas washes did not fully understand the hazards associated with the process.
- A maintenance employee, unaware of the explosion hazard inside the chamber, opened the chamber door and activated the backvent, sending an explosive mixture of EO to the oxidizer, which ignited it.
- Sterigenics management did not implement company-wide engineering control recommendations that could have prevented this explosion.
- Despite recommendations directed to the sterilization industry by NIOSH and NFPA, Sterigenics management did not monitor sterilization chamber concentrations for explosivity.
- The initial and subsequent revalidation Process Hazard Analyses (PHAs) did not thoroughly evaluate the explosion hazard presented by the oxidizer.
- The design of the control room did not include blast or shatter resistant window glass.
- Federal EPA permanently suspended its requirement to treat backvent EO emissions in 2001, although California and at least four other states continue to require some form of treatment.
- Catalytic oxidizers are commonly used to treat backvent emissions by sterilization plants located in states that continue to require it.
Organizational and Systemic Factors¶
- The majority of the formalized employee training at the Ontario facility targets operations employees.
- There is no job-specific maintenance-training program for maintenance personnel.
- Maintenance technicians at the Ontario facility are routinely promoted from operations, where they gain a working knowledge of the process through initial and refresher operator training and on the job experience.
- Interviews with senior management and engineering staff at Sterigenics revealed that they assumed the maintenance supervisor possessed the requisite knowledge and experience to make appropriate decisions without additional supervision.
- Of the ten employees interviewed in conjunction with this incident, only management and senior engineering staff personnel understood that the first evacuation after the dwell phase only removes 55-60% of the EO, and that gas washing is an essential safety measure, even if a chamber is operating without products in it.
- The initial PHA did not identify or evaluate other engineering controls or layers of protection.
- The 1996 revalidation focused specifically on the oxidizer, but also did not identify any explosion hazard scenarios.
- The 2001 revalidation identified a catastrophic explosion scenario involving the oxidizer, but recommended only that the facility investigate the prospect of equipping the oxidizer with explosion relief equipment.
- The written report of this evaluation of potential explosion scenarios failed to identify or address the recent history of sterilization industry EO/oxidizer explosions, including an explosion in 1997 at a nearby Griffith plant (Vernon) that resulted in specific recommendations for additional engineering controls at “…other Griffith Micro Science facilities.”
- Company officials told CSB that these incidents were reviewed, but did not result in written action items.
Failed Safeguards or Barrier Breakdowns¶
- The process design features that helped ensure this at the time of the incident were Antares-controlled chamber pressure monitoring, evacuation and gas washing, and a system of interlocks.
- The only backup was the ventilation system, designed to dilute chamber gas mixture produced from minor system upsets before it reached the oxidizer.
- The facility did not monitor the chamber concentrations for explosivity.
- Employees, using a password supplied by managers, can override both interlocks.
- There were no backup engineering controls to detect, prevent or mitigate an explosion at the Ontario facility.
- The control room windows were tempered window glass without any shatter-resistant treatments, and the walls were not designed to resist pressure from an explosion.
- The pressure sensor system does not measure EO concentration; it measures pressure inside the chamber at various phases of the cycle.
- The Ontario facility used no other devices to measure explosive concentrations inside the chambers.
- The engineering staff designed the ventilation system to dilute backvent exhausts to less than 25% of the LEL before reaching the oxidizer, but they did not foresee a scenario that would leave a large volume of undetected EO in a chamber at the end of a cycle.
- The 1996 revalidation recommended the installation of a “LFL [Lower Flammability Level] monitor and alarm”, but Sterigenics did not act upon the recommendation.
- The 2001 revalidation recommended that the facility investigate the prospect of equipping the oxidizer with explosion relief equipment, and at the time of the incident, the facility had not installed this equipment.
Recommendations¶
- 2004-11-I-CA-R1 — Recipient: Sterigenics International — Status: Not specified — Summary: Audit all Sterigenics ethylene oxide sterilization facilities using oxidizing emissions control devices. Ensure that audits assess the issues detailed below, under “Sterigenics International– Ontario Facility,” and that necessary corrective measures are promptly implemented. Communicate results of these audits to your workforce.
- 2004-11-I-CA-R2 — Recipient: Sterigenics International - Ontario Facility — Status: Not specified — Summary: Review and revise the Process Hazard Analysis (PHA) program to ensure that hazardous scenarios are identified, evaluated, and documented, and that lessons learned from past incidents are applied, where appropriate.
- 2004-11-I-CA-R3 — Recipient: Sterigenics International - Ontario Facility — Status: Not specified — Summary: Evaluate current process controls and install appropriate safeguards.
- 2004-11-I-CA-R4 — Recipient: Sterigenics International - Ontario Facility — Status: Not specified — Summary: Ensure that all employees with passwords capable of modifying the sterilization cycle sequence have process experience and training that enables them to make safe process decisions. Training should emphasize flammability hazards and the need for gas washes when the chamber is empty of products to be sterilized.
- 2004-11-I-CA-R5 — Recipient: Sterigenics International - Ontario Facility — Status: Not specified — Summary: Ensure that the control room, and any other room where employees congregate in dangerous proximity to the sterilization area, is located and/or designed to protect workers from an explosion.
- 2004-11-I-CA-R6 — Recipient: Sterigenics International - Ontario Facility — Status: Not specified — Summary: Communicate the findings and recommendations of this report to all employees, including operators and maintenance staff.
- 2004-11-I-CA-R7 — Recipient: California Air Resources Board (CARB) — Status: Not specified — Summary: In collaboration with other state/regional agencies as necessary, such as California Occupational Safety and Health Administration, recommend to facilities that treat ethylene oxide backvent emissions with oxidizing emissions control devices to evaluate current process controls and install appropriate safeguards.
- 2004-11-I-CA-R8 — Recipient: California Occupational Safety and Health Administration (Cal/OSHA) — Status: Closed- Acceptable Action — Summary: In collaboration with other state/regional agencies as necessary, such as California Environmental Protection Agency, identify the ethylene oxide sterilization facilities in California that utilize oxidizing emissions control devices and conduct inspections of those facilities (including the Sterigenics Ontario facility) in terms of the findings of this report. Ensure prompt correction of all violations identified during these inspections.
- 2004-11-I-CA-R9 — Recipient: National Fire Protection Association (NFPA) — Status: Not specified — Summary: Review and revise NFPA 560, Standard for the Storage, Handling, and Use of Ethylene Oxide for Sterilization and Fumigation in terms of the findings of this report. Specifically include references to NFPA 69, Standard on Explosion Prevention Systems; NFPA 86, Ovens and Furnaces; and NIOSH Alert: Preventing Worker Injuries and Deaths from Explosions in Industrial Ethylene Oxide Sterilization Facilities.
- 2004-11-I-CA-R10 — Recipient: National Fire Protection Association (NFPA) — Status: Not specified — Summary: Review and revise NFPA 560, Standard for the Storage, Handling, and Use of Ethylene Oxide for Sterilization and Fumigation in terms of the findings of this report. Specifically include requirements for appropriate safeguards, such as real-time chamber and/or effluent concentration monitoring connected to alarms, interlocks, and/or fast acting control devices, and post-ignition deflagration detection and damage control devices.
- 2004-11-I-CA-R11 — Recipient: National Institute for Occupational Safety and Health (NIOSH) — Status: Not specified — Summary: Revise and reissue the NIOSH Alert: Preventing Worker Injuries and Deaths from Explosions at Industrial Ethylene Oxide Facilities (Publication No. 2002-119) in terms of the findings of this report. Specifically include industry guidance materials on Process Hazard Analysis (PHA), such as those published by the Center for Chemical Process Safety (CCPS).
- 2004-11-I-CA-R12 — Recipient: National Institute for Occupational Safety and Health (NIOSH) — Status: Not specified — Summary: Revise and reissue the NIOSH Alert: Preventing Worker Injuries and Deaths from Explosions at Industrial Ethylene Oxide Facilities (Publication No. 2002-119) in terms of the findings of this report. Specifically add references to NFPA 68 Guide for Venting of Deflagrations; NFPA 69 Standard on Explosion Prevention Systems; NFPA 86 Ovens and Furnaces; and NFPA 560 Standard for the Storage, Handling, and Use of Ethylene Oxide for Sterilization and Fumigation.
- 2004-11-I-CA-R13 — Recipient: National Institute for Occupational Safety and Health (NIOSH) — Status: Not specified — Summary: Revise and reissue the NIOSH Alert: Preventing Worker Injuries and Deaths from Explosions at Industrial Ethylene Oxide Facilities (Publication No. 2002-119) in terms of the findings of this report. Specifically coordinate with the Ethylene Oxide Sterilization Association (EOSA) to remove the portion of paragraph D of Appendix C that states, “[t]he accuracy, reliability, resolution, and availability of current ethylene oxide measurement devices is questionable.”
- 2004-11-I-CA-R14 — Recipient: Ethylene Oxide Sterilization Association (EOSA) — Status: Not specified — Summary: Coordinate with NIOSH to revise and reissue Appendix C of the NIOSH Alert: Preventing Worker Injuries and Deaths from Explosions at Industrial Ethylene Oxide Facilities (Publication No. 2002-119) in terms of the findings of this report. Specifically, remove the portion of paragraph D that states, “[t]he accuracy, reliability, resolution, and availability of current ethylene oxide measurement devices is questionable.”
- 2004-11-I-CA-R15 — Recipient: Ethylene Oxide Sterilization Association (EOSA) — Status: Not specified — Summary: Conduct outreach to communicate the findings and recommendations of this report, and the contents of the NIOSH Alert: Preventing Worker Injuries and Deaths from Explosions at Industrial Ethylene Oxide Facilities, to your membership.
- 2004-11-I-CA-R16 — Recipient: U.S. Environmental Protection Agency — Status: Not specified — Summary: Communicate the findings and recommendations of this report to the states that require EO backvent emissions treatment. Emphasize the need for facilities to evaluate current process controls and install appropriate safeguards.
- 2004-11-I-CA-R17 — Recipient: Institute of Clean Air Companies (ICAC) — Status: Not specified — Summary: Communicate the findings and recommendations of this report to your membership.
Key Engineering Lessons¶
- Do not rely on a single backup ventilation path to protect against a large volume of undetected EO remaining in a chamber at the end of a cycle.
- Real-time chamber and/or effluent concentration monitoring connected to alarms, interlocks, and/or fast acting control devices was identified as an appropriate safeguard in the report recommendations.
- Explosion prevention and damage control should be considered for oxidizer-related scenarios, including post-ignition deflagration detection and damage control devices.
- Control rooms or other occupied spaces located in dangerous proximity to the sterilization area should be located and/or designed to protect workers from an explosion.
- PHA reviews must identify and evaluate hazardous scenarios, including oxidizer-related explosion scenarios, and incorporate lessons learned from past incidents.
- Gas wash bypass authority should be limited to personnel with process experience and training sufficient to make safe process decisions, with emphasis on flammability hazards and the need for gas washes when the chamber is empty.
Source Notes¶
- Priority 1 source text was not provided in the extracts; the final report extract was used as the highest available authority for incident details.
- The recommendation status summary extract (priority 3) explicitly states that recommendation 2004-11-I-CA-R8 was closed with acceptable action.
- The final report extract uses the term 'oxidizer' and also describes it as a 'catalytic oxidizer'; both terms are preserved where used in the source text.
- The incident date and location are preserved from the metadata and supported by the report text.
- No fatalities were stated in the provided extracts.
Reference Links¶
Similar Incidents¶
Incidents sharing the same equipment, root causes, or hazard types.
Same Equipment¶
- Yenkin-Majestic Resin Plant Vapor Cloud Explosion and Fire — Shared equipment: Gas Detector · Interlock · Pressure Vessel
- DuPont La Porte Facility Toxic Chemical Release — Shared equipment: Gas Detector · Interlock · Vent Stack
- Carbide Industries Fire and Explosion — Shared equipment: Scrubber · Vent Stack
- Bayer CropScience Pesticide Waste Tank Explosion — Shared equipment: Gas Detector · Interlock · Pressure Vessel · Scrubber
- Praxair Flammable Gas Cylinder Fire — Shared equipment: Gas Detector · Pressure Vessel
Same Root Cause¶
- Delaware City Refining Company — Shared failure mode: Design Deficiency · Maintenance Error · Management Of Change Failure · Operator Error · Procedural Failure
- AirGas Facility Fatal Explosion — Shared failure mode: Design Deficiency · Maintenance Error · Management Of Change Failure · Operator Error · Procedural Failure
- Giant Industries Refinery Explosions and Fire — Shared failure mode: Design Deficiency · Maintenance Error · Management Of Change Failure · Operator Error · Procedural Failure
- BP Amoco Thermal Decomposition Incident — Shared failure mode: Design Deficiency · Management Of Change Failure · Operator Error · Procedural Failure · Training Deficiency
- ExxonMobil Torrance Refinery Explosion — Shared failure mode: Design Deficiency · Maintenance Error · Management Of Change Failure · Operator Error · Procedural Failure
Same Hazard¶
- Enterprise Pascagoula Gas Plant Explosion and Fire — Shared hazard: Chemical Release · Explosion · Fire · Structural Failure
- Tesoro Anacortes Refinery Fatal Explosion and Fire — Shared hazard: Chemical Release · Explosion · Fire · Structural Failure
- Bethune Point Wastewater Plant Explosion — Shared hazard: Chemical Release · Explosion · Fire · Structural Failure
- Silver Eagle Refinery Flash Fire and Explosion and Catastrophic Pipe Explosion — Shared hazard: Chemical Release · Explosion · Fire · Structural Failure
- Carbide Industries Fire and Explosion — Shared hazard: Chemical Release · Explosion · Fire · Structural Failure