Chemical Mixing Incident

Earlier this week the Chemical Safety Board (CSB) announced that it was sending an investigation team to the site of a major chemical release in Atchison, KS that occurred on October 21^st. The release was caused by the inadvertent mixing of two common industrial chemicals and resulted in a large chemical cloud sending hundreds to local hospitals with complaints of difficulty breathing.

The Incident

According to news reports (for example see here, here and here) the incident started at 8:00 am when a bulk chemical delivery was put into the wrong storage tank. The two chemicals involved were industrial strength bleach and sulfuric acid, both apparently being used in the facilities waste treatment plant. The chemical reaction between the two produced a large cloud of steam that also included chlorine gas, a byproduct of the reaction between the two chemicals.

There is no publicly available information about which chemical was being unloaded, but due to the odor of chlorine bleach being involved, I would guess that the delivery was sulfuric acid. Adding sulfuric acid to a bleach tank actually produces two separate reactions that would have contributed to the cloud.

First, since bleach is mainly water (only 6 to 12% sodium hypochlorite) the addition of sulfuric acid (which is typically shipped and stored at concentrations above 95% for safety reasons) produced a large amount of heat due to the ‘heat of dilution’. That heat and the lack of mixing would quickly raise the surface temperature of the bleach above the boiling point of water producing a large steam cloud. That steam cloud would be expected to contain trace amounts of unreacted bleach and sulfuric acid.

The chemical reaction between sodium hypochlorite and sulfuric acid produces chlorine gas and even more heat. The reaction is virtually instantaneous and consumes essentially all of which ever chemical is least available (typically the chemical being added to the tank because addition is usually stopped as soon as the steam cloud is observed). That is why I suspect that the sulfuric acid was being added to the bleach tank.

How Could This Happen?

This type of accident is way too common, especially at waste water treatment facilities. Such facilities typically rely on delivery drivers to unload bulk chemical shipments instead of facility personnel who would be more familiar with which tank contains which chemical. Hose connections are made from the delivery truck to piping that leads to the chemical storage tank. A single bulk truck unloading station typically has separate connections for each of the storage tanks at these facilities. Inadequate marking of the pipe connections, and/or inexperienced (for that facility) drivers results in the truck being hooked up to the wrong piping connection.

Larger chemical facilities avoid these types of incidents through a combination of personnel and design activities vetted through a chemical safety program under either the EPA’s Risk Management Program (RMP) and/or OSHA’s Process Safety Management (PSM) program. Typically, there are only a limited number of personnel on-site who are authorized to unload bulk deliveries of chemicals. They are specifically trained on the hazards associated with the bulk chemicals they will be handling, including the risks associated with mixing of chemicals in storage tanks, bulk unloading lines or hoses. Non-facility delivery drivers are never allowed to unload bulk chemicals without specific facility supervision.

Where there is a specific hazard from the mixing of chemicals being stored at that site (for example bleach and sulfuric acid) engineering measures are taken to prevent that mixing. The tanks may be located in separate tank farms, the bulk unloading lines may be physically separated at different unloading stations, or different types of hose connections are used with the unloading lines to make it more difficult to inadvertently mix those chemicals. Depending on the potential consequences involved (and this particular incident was nowhere near a worst-case incident) combinations of these and other engineering controls could be used.

The CSB Investigation

The CSB usually limits its investigations to larger more severe events that kill people or result in large scale damage. This is mainly due to their Congressional mandate, limited funds and limited personnel. Taking up this incident is almost certainly due to the amount of level of publicity related to the large cloud and how common this type of incident is.

Compared to other investigations this one should consume much less in the way of CSB resources. That does not mean that the report will be completed and published any sooner; the CSB will likely place a low priority on the completion of this investigation.

Follow-up on CSB DuPont Report

When I wrote my blog post earlier today on the CSB notice in the Federal Register the referenced draft investigation report had not yet been posted on the CSB web site. When I rechecked this evening that report was available as is a copy of comments members of the Board and their investigators made today at a press conference in Charleston, WV.

I haven’t had a chance to review the lengthy draft report, but it appears to be a typical example of the thorough type of investigation documentation that we have come to expect from the CSB. The shorter news conference comments document is full of important information that all chemical safety and security professionals ought to review.

Safety as Security

All three of the safety incidents covered in this investigation involved dangerous chemicals that are listed in Appendix A to the CFATS regulations. Both oleum (fuming sulfuric acid) and phosgene are listed as release – toxic chemicals of interest (COI), while methyl chloride (also toxic, but significantly less so) is listed as a release – flammable COI. As is common with most dangerous chemicals, many of the safety procedures and equipment mentioned in this report should be considered dual use systems since they also play an important part in providing security for these chemicals against a terrorist attack.

Chemical Detection Alarms

The initial incident at the Belle, WV plant involved a slow but prolonged release of methyl chloride through a damaged rupture disk that allowed the chemical to be released to the atmosphere. Methyl chloride detectors were deployed in the area around where the chemical was used and the detectors did properly detect the release and appropriately alarmed. Unfortunately, because the system had an extensive history of false positive alarms, the operations personnel at the DuPont plant ignored the repeated alarms for a number of days.

If this release had been a deliberate act instead of an accident, an effective attacker would have provided for an ignition source to turn the flammable cloud into a fuel-air explosive that could have caused considerable destruction at the facility; destruction that would include release of other chemicals on site.

Properly deployed and maintained chemical detectors provide a two fold purpose in both safety and security planning. First they provide an early warning about the existence of a small leak to allow for an emergency response to prevent a catastrophic situation from developing. Second they provide a means to monitor the size, location and concentration of a chemical cloud to provide emergency responders with the appropriate information needed for an effective response.

False positive alarms are a common problem in any emergency notification system. Safety and security managers need to be cognizant of the fact that any alarm system that has excessive false positive notifications will soon be ignored by both response and operations personnel. All alarm notifications must be investigated and documented. The root cause for false positives needs to be determined and corrected if the alarm system is to have any value to a safety or security program.

Secondary Containment

The use of secondary containment is a common chemical safety technique used to prevent the spread of a chemical release from its storage container (the primary containment). The most readily recognizable form of secondary containment at most chemical production facilities is the presence of a dike wall around storage tanks that would retain the contents of any tanks that fail.

The CSB noted that the phosgene tanks at the DuPont facility were not protected by a secondary containment structure. Now, secondary containment for a chemical like phosgene is complicated. A simple dike will not suffice as the liquid phosgene produces a large toxic cloud that goes right over a dike wall. In the news conference notes the CSB investigators described what a secondary containment structure might look like:

“For example, phosgene cylinders should have been kept in an enclosure equipped with a ventilation system and a scrubber. If the enclosure were designed for human entry, workers should have been required to wear fully encapsulated protective equipment.” (page 8)

These secondary containment structures can be an integral part of a facility security program as well. It acts as another layer in security protection of the facility, making it more difficult for an attacker to get at the target. Additionally, it acts as a mitigating factor in any deliberate release, making it more difficult for the toxic cloud to reach the real terrorist target, the neighborhood around the facility.

There is no theoretical limit to the size of a secondary containment structure like this. For example, every nuclear reactor in the United States is enclosed in a similar containment structure designed to contain release of radioactive materials. Some of those structures would be large enough to handle even the largest chemical storage tanks.

Security Lessons Learned

Again, security and safety at high-risk chemical facilities are closely intertwined. It goes without saying that safety managers need to look at the lessons learned from the Chemical Safety Board investigations. The smart security manager will also take a close look at these reports to find ways to better protect their facilities from terrorist attacks.

CSB to Hold Bayer CropScience Public Meeting

On Friday the Chemical Safety Board announced that they would hold a public meeting in Institute, WV to discus the August 2008 fatal accident at the Bayer CropScience facility. The meeting will be held on April 23, 2009 at West Virginia State University. According to the press release: “Pre-registration is not required, but to assure adequate seating attendees are encouraged to pre-register by emailing their names and affiliations to bayer@csb.gov by April 10. There is no mention in the current press release about the previous Bayer warning that the information to be covered in the meeting was protected from public release under provisions of the Maritime Transportation Security Act (MTSA). The meeting that was originally scheduled for March 19th, was canceled to allow the CSB to investigate the Bayer claim. I have not seen any public comment about the discussions between CSB and the Coast Guard, the agency that administers the MTSA. There have certainly been discussions, but no one is discussing what limitations (if any) the Coast Guard feels the MTSA information security requirements places on the public discussion of the CSB investigation of the incident. There is always the possibility that Bayer might try to get an injunction to stop the public meeting based on their earlier claim of information protection under the MTSA. Courts are usually reluctant to get involved in pre-emptive disclosure arguments. Alternatively, Bayer might appeal to Secretary Napolitano as the person ultimately responsible for actions taken under MTSA. Action would probably be unlikely if the Coast Guard and the CSB have come to an agreement on disclosure limits. That agreement would probably already have been vetted to the Secretary’s office. It will be interesting to see what questions, if any, the CSB refuses to answer at their meeting. Unless there are questions specifically about the security arrangements at the facility, I would not expect there to be any problems. Security arrangement questions would probably not have been answered by the CSB in any case. I do expect that there will be a Coast Guard representative present at the meeting, probably even the local Captain of the Port, the person responsible for port facility security under MTSA.