U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT

REFINERY INCIDENT

(1 Killed, 8 Injured, Offsite Environmental Impact)

REPORT NO. 2001-05-I-DE

ISSUE DATE: OCTOBER 2002

MOTIVA ENTERPRISES LLC

DELAWARE CITY REFINERY

DELAWARE CITY, DELAWARE

JULY 17, 2001

KEY ISSUES:

 MECHANICAL INTEGRITY

 ENGINEERING MANAGEMENT

 MANAGEMENT OF CHANGE

 HOT WORK SYSTEMS
U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT

REPORT NO. 2001-05-I-DE

ISSUE DATE: OCTOBER 2002

MOTIVA ENTERPRISES LLC

DELAWARE CITY REFINERY

DELAWARE CITY, DELAWARE

JULY 17, 2001

KEY ISSUES

 MECHANICAL INTEGRITY

ENGINEERING MANAGEMENT

 MANAGEMENT OF CHANGE

HOT WORK SYSTEMS

REFINERY INCIDENT

(1 Killed, 8 Injured, Offsite Environmental Impact)
2
3

Abstract

Information about available

publications may be obtained by

contacting:

U.S. Chemical Safety and Hazard

Investigation Board

Office of Prevention, Outreach,

and Policy

2175 K Street NW, Suite 400

Washington, DC 20037

(202) 261-7600

CSB publications may be

purchased from:

National Technical Information

Service

5285 Port Royal Road

Springfield, VA 22161

(800) 553-NTIS or

(703) 487-4600

Email: info@ntis.fedworld.gov

For international orders, see:

http://www.ntis.gov/support/

cooperat.htm.

For this report, refer to NTIS

number PB2002-108210.

Salus Populi Est Lex Suprema

People’s Safety is the Highest Law

T

his investigation report examines a refinery incident that

occurred on July 17, 2001, at the Motiva Enterprises LLC

Delaware City Refinery in Delaware City, Delaware. One worker

was killed, eight were injured, and there was significant offsite

environmental impact. This report identifies the root and

contributing causes of the incident and makes recommendations

on mechanical integrity, engineering management, management

of change, and hot work systems.

The U.S. Chemical Safety and Hazard Investigation Board (CSB)

is an independent Federal agency whose mission is to ensure

the safety of workers and the public by preventing or minimizing

the effects of chemical incidents. CSB is a scientific investigative

organization; it is not an enforcement or regulatory body.

Established by the Clean Air Act Amendments of 1990, CSB is

responsible for determining the root and contributing causes of

accidents, issuing safety recommendations, studying chemical

safety issues, and evaluating the effectiveness of other government

agencies involved in chemical safety. No part of the conclusions,

findings, or recommendations of CSB relating to any chemical

incident may be admitted as evidence or used in any action or suit

for damages arising out of any matter mentioned in an investigation

report (see 42 U.S.C. § 7412(r)(6)(G)). CSB makes public its

actions and decisions through investigation reports, summary

reports, safety bulletins, safety recommendations, special technical

publications, and statistical reviews. More information about

CSB may be found at http://www.chemsafety.gov.
4
5

Contents

EXECUTIVE SUMMARY ............................................................. 11

1.0 INTRODUCTION .............................................................. 25

1.1 Background ........................................................................... 25

1.2 Investigative Process .............................................................. 25

1.3 Delaware City Refinery ......................................................... 26

1.4 Sulfuric Acid Processes .......................................................... 26

1.5 Sulfuric Acid Storage Tanks ................................................... 27

2.0 DESCRIPTION OF INCIDENT ......................................... 29

2.1 Pre-Incident Events ............................................................... 29

2.2 The Incident ......................................................................... 31

2.3 Incident Aftermath and Emergency Response ....................... 34

3.0 ANALYSIS............................................................................. 37

3.1 Corrosion and Tank Inspections ............................................ 37

3.1.1 Indications of Corrosion ............................................ 37

3.1.2 Potential Mechanisms for Accelerated Corrosion ...... 45

3.1.3 Generation of Flammable Atmosphere ...................... 48

3.1.4 Finite Element Analysis of Tank Failure ...................... 48

3.2 Engineering of Conversion From Fresh to Spent Acid .......... 50

3.2.1 Process Engineering ................................................... 50

3.2.2 Tank Inerting Design .................................................. 52

3.2.3 Secondary Containment Systems............................... 54

3.3 Management of Change for Tank Conversion ...................... 55

3.4 Management Practices–Tank 393 ......................................... 58

3.4.1 Lack of Recognition of Imminent Hazard Potential .... 58

3.4.2 Deferral of Inspections ............................................... 59

3.5 Hot Work ............................................................................. 62

3.6 Unsafe Condition Report ...................................................... 64

3.7 Spent Sulfuric Acid Classification .......................................... 65

3.8 Review of Similar Incidents ................................................... 66

3.8.1 Pennzoil, Rouseville ................................................... 66

3.8.2 ARCO, Channelview ................................................ 67

3.9 Regulatory Issues ................................................................... 67

3.9.1 Process Safety Management Coverage ...................... 67

3.9.2 Jeffrey Davis Aboveground Storage Tank Act ............ 70

4.0 ROOT AND CONTRIBUTING CAUSES.......................... 73

4.1 Root Causes .......................................................................... 73

4.2 Contributing Causes ............................................................. 74
6

Contents (cont’d)

5.0 RECOMMENDATIONS ..................................................... 75

6.0 REFERENCES ..................................................................... 81

APPENDIX A: Tank 393 History .................................................. 83

A.1 1992–Thickness Readings..................................................... 83

A.2 1994–Internal Inspection ...................................................... 83

A.3 1998–Shell Leak ................................................................... 84

A.4 1999–Shell Leaks .................................................................. 85

A.5 2000–Shell Leaks .................................................................. 86

A.6 2001–Shell Leak ................................................................... 86

APPENDIX B: Logic Diagram ....................................................... 89
7

Figures and Tables

Figures

1 Layout of Acid Storage Tanks and Catwalk ............................ 29

2 Tank 393, Collapsed at Northeast Corner of Storage

Tank Dike ............................................................................... 33

3 Tank 394 in Foreground and Remains of Catwalk,

From the North ..................................................................... 34

4 Side of Tank 393 Showing Series of Patches.......................... 39

5 Elongated Hole on Roof of Tank 393 .................................... 40

6 Hole in Roof of Tank 393 Through Which Temporary

Hose Was Inserted ................................................................ 40

7 Modeled Pressure Rise in Tank 393 During Internal

Deflagration............................................................................ 49

8 Floor of Tank 393 Showing Uplift Due to Internal

Deflagration (Before Separation of Shell) ............................... 49

9 Inerting System Schematic ...................................................... 52

Tables

1 Tank 393 Deterioration and Repair History ........................... 38

2 History of Motiva API 653 Tank Inspector Findings

and Recommendations........................................................... 44
8

ACC American Chemistry Council (formerly CMA)

AFL-CIO American Federation of Labor-Congress of Industrial

Organizations

AIChE American Institute of Chemical Engineers

API American Petroleum Institute

ASTM American Society for Testing and Materials

AWS American Welding Society

CCPS Center for Chemical Process Safety

CERCLA Comprehensive Environmental Response, Compensation, and Liability Act

cfh Cubic feet per hour

CFR Code of Federal Regulations

CMA Chemical Manufacturers Association (now ACC)

CO2 Carbon dioxide

CS Carbon steel

CSB U.S. Chemical Safety and Hazard Investigation Board

DCR Delaware City Refinery

DNREC Delaware Department of Natural Resources and

Environmental Control

EPA U.S. Environmental Protection Agency

ESI Engineering Systems Inc.

°F Degrees Fahrenheit

Fe Iron

FEA Finite element analysis

FeSO4Ferrous sulfate

HAZOP Hazard and operability

H2 Hydrogen

H2S Hydrogen sulfide

H2SO3Sulfurous acid

H2SO4Sulfuric acid

in./yr Inches per year

Acronyms and Abbreviations
9

LEL Lower explosivity limit

LLC Limited liability company

MOC Management of change

MSDS Material safety data sheet

NACE National Association of Corrosion Engineers

NDT Nondestructive testing

NFPA National Fire Protection Association

NPRA National Petrochemical and Refiners Association

OSHA Occupational Safety and Health Administration

PACE Paper, Allied-Industrial, Chemical & Energy Workers

International Union

PEI Petroleum Equipment Institute

PHA Process hazard analysis

ppm Parts per million

psi Pounds per square inch

psig Pounds per square inch gage

PSM Process safety management

PSV Pressure safety valve

RBI Risk-based inspection

RMP Risk management program

RP Recommended practice

scfh Standard cubic feet per hour

SO2Sulfur dioxide

SO3Sulfur trioxide

SPCC Spill Prevention, Control, and Countermeasures

STI Steel Tank Institute

UL Underwriters Laboratories

UT Ultrasonic thickness

UTM Ultrasonic thickness measurement

USC United States Code

WGI The Washington Group International, Inc.
10
11

Executive Summary

ES.1 Introduction

n July 17, 2001, an explosion occurred at the Motiva

 Enterprises LLC Delaware City Refinery (DCR) in Delaware

City, Delaware. Jeffrey Davis, a boilermaker with The Washington

Group International, Inc. (WGI), the primary maintenance contractor at DCR, was killed; eight others were injured.

A crew of WGI contractors was repairing grating on a catwalk in a

sulfuric acid (H2SO4) storage tank farm when a spark from their hot

work ignited flammable vapors in one of the storage tanks. The tank

separated from its floor, instantaneously releasing its contents. Other

tanks in the tank farm also released their contents. A fire burned for

approximately one-half hour; and H2SO4 reached the Delaware

River, resulting in significant damage to aquatic life.

Because of the serious nature of this incident, the U.S. Chemical

Safety and Hazard Investigation Board (CSB) launched an investigation to determine the root and contributing causes and to issue

recommendations to help prevent similar occurrences.

ES.2 Incident

Tank 393 was one of six 415,000-gallon carbon steel (CS) tanks

originally built in 1979 and located in a common diked area. The

tanks stored fresh1 and spent2 H2SO4 used in the refinery’s sulfuric

acid alkylation process. Over the years, the tanks had experienced

significant localized corrosion. Leaks were found on the shell of tank

393 annually from 1998 through May 2001; all of the reported leaks

were repaired, except for one discovered in May 2001. However,

at the time of the incident, several additional holes in the roof and

shell of tank 393 were unreported.

As leaks occurred and were repaired, the Motiva tank inspectors

repeatedly recommended an internal inspection of tank 393. However, despite the imminent hazard presented by this particular tank,

Motiva repeatedly postponed its inspection, originally scheduled for

1996. Between 1996 and 2000, even though tank 393 was emptied

————————–

1

 Fresh H2SO4 typically contains 99 percent acid and 1 percent water.

2

 Spent H2SO4 typically contains 88 to 95 percent acid and up to 5 percent water, with

the balance being hydrocarbons, including some light hydrocarbons that can vaporize.

O

As leaks occurred and were

repaired, the Motiva tank inspectors

repeatedly recommended an internal

inspection of tank 393. However,

despite the imminent hazard presented

by this particular tank, Motiva

repeatedly postponed its inspection,

originally scheduled for 1996.
12

three times to change its service between fresh and spent acid,

Motiva maintained that inventory constraints prevented taking the

tank out of service. In 2000, after the U.S. Environmental Protection

Agency (EPA) identified 18 tanks that required internal inspection and

after Motiva reduced its maintenance budget, the tank inspection

program was reprioritized–which further deferred the inspection of

tank 393 until January 2002.

Tank 393 was one of four tanks originally designed for fresh H2SO4

that had been converted to store spent acid. Spent H2SO4 normally

contains small amounts of flammable materials. Light hydrocarbons in

the acid can vaporize and create a flammable atmosphere above the

liquid surface if sufficient oxygen is present. To guard against this

hazard, Motiva installed a carbon dioxide (CO2) inerting system3 and

a conservation vent4 with flame arrestor.

5

 However, the system was

poorly designed and did not provide enough CO2 flow to prevent

the formation of a flammable atmosphere in the vapor space of tank

393.

In June and July 2001, Motiva directed WGI to repair the catwalk

that provided access to instrumentation on the roofs of the acid

storage tanks. The catwalk had deteriorated due to acid vapors in

the atmosphere around the tanks. The contractor employees worked

this job on several days, cutting out damaged sections of the grating

and welding down new sections.

On July 17, as the contractors were working, a spark from the hot

work most likely either entered the vapor space of tank 393 or

contacted flammable vapors escaping from one of the holes in the

tank and flashed back into it. An explosion in the vapor space of the

tank caused the tank shell to separate from its floor, lift up and come

down across the dike wall, and instantaneously release its contents of

264,000 gallons of spent H2SO4. The adjacent tank 396 also lost its

contents; acid continued to leak from several of the remaining storage

tanks for several weeks.

————————–

3

 Inerting refers to the use of a nonflammable, nonreactive gas to render the combustible

material in a system incapable of supporting combustion.

4

 A conservation vent (also referred to as a PV valve) is a weight-loaded, pilot-operated,

or spring-loaded valve used to relieve excess pressure or vacuum in a tank.

5

 A flame arrester is a device intended to prevent a flame from propagating through an

open vent into a vessel.

Spent H2SO4 normally contains small

amounts of flammable materials.

Light hydrocarbons in the acid can

vaporize and create a flammable

atmosphere above the liquid surface

if sufficient oxygen is present.

On July 17, . . . a spark from the hot

work most likely either entered the

vapor space of tank 393 or contacted

flammable vapors escaping from one

of the holes in the tank and flashed

back into it.
13

Flammable and combustible material in the spent acid ignited, and

a fire burned for one-half hour. The total mass of spent H2SO4

released–estimated by EPA at 1.1 million gallons–overwhelmed

the area diking and plant containment and wastewater systems.

Approximately 99,000 gallons of acid reached the Delaware River,

killing fish and other aquatic life.

Mr. Davis, who had been working on the catwalk, was fatally injured. Eight other workers suffered acid burns, burning eyes and

lungs, and nausea.

ES.3 Key Findings

————————–

6

 The explosion was modeled by CSB as a weak deflagration that generated a maximum

pressure of approximately 5.0 pounds per square inch gage (psig).

The total mass of spent H2SO4

released–estimated by EPA at

1.1 million gallons–overwhelmed

the area diking and plant containment

and wastewater systems.

1. An explosion6 in the vapor space of tank 393 generated sufficient pressure to separate the tank’s floor-to-shell joint. The

explosion most likely occurred when a spark from the maintenance work either fell through one of the holes into the tank–or

contacted the flammable vapors near one of the holes in the tank

roof and shell, and flashed back into the tank.

2. Motiva did not consider the acid tank farm to be covered by

requirements of the Occupational Safety and Health Administration (OSHA) Process Safety Management (PSM) Standard (29

CFR 1910.119). The incident would likely not have occurred if

good process safety management practices had been adequately

implemented, such as mechanical integrity, management of

change (MOC), and prestartup safety review.

The OSHA PSM Standard is a systematic approach to safety

and the prevention of catastrophic incidents. Enacted in 1992,

the standard details 14 elements of good safety management.

Processes containing any of a specific list of hazardous substances, including flammables, must adhere to these elements.

However:

n The PSM Standard does not cover H2SO4.

An explosion in the vapor space of

tank 393 generated sufficient

pressure to separate the tank’s

floor-to-shell joint.

The [OSHA] PSM Standard

does not cover H2SO4.
14

n Although flammables above a threshold quantity are covered,

the Meer decision7 determined that coverage does not

extend to stored flammables in atmospheric tanks even if

connected to a process. OSHA has not challenged this

decision.8

n OSHA did not cite Motiva for violations of the PSM

Standard following the July 17 incident.

3. Tank 393 and other acid tanks had a history of leaks. Major

repairs were made to tank 393 in 1994, and the tank had at least

one leak in each of the years 1998, 1999, 2000, and 2001.

The leak reported in May 2001 was not repaired. Significant

leaks also occurred in other H2SO4 tanks at Motiva, two of

which were condemned and replaced due to corrosion.

4. In 1994, Motiva tank inspectors recommended that thickness

measurements of tank 393 be conducted in 1996. In inspection

reports written in 1999, 2000, and 2001, they recommended an

internal inspection “as soon as possible.” Motiva took no action

on these recommendations.

5. Tank 393 was emptied three times (April and October 2000,

and April 2001) as service was alternated between fresh and

spent acid. Each of these occasions presented an opportunity to

prepare tank 393 and conduct an internal inspection.

6. The design and implementation of the Motiva H2SO4 tank

inspection program was inadequate. Motiva’s plan was to

inspect its tanks at intervals prescribed by American Petroleum

Institute (API) Standard 6539 (i.e., every 5 years for external

inspections and 10 years for internal inspections). However, API

653 notes that inspection frequencies must be modified based on

the corrosivity of the stored material. Motiva inspectors recommended revised frequencies, but the inspections did not occur.

————————–

7

 U.S. Secretary of Labor v. Meer Corporation, OSHRC Docket No. 95-0341, 1995.

8

 Memorandum from John B. Miles, Jr., Director, Directorate of Compliance Programs,

OSHA, to Regional Administrators, “Standard Interpretations, Coverage of Stored

Flammables Under the Process Safety Management Standard,” May 12, 1997.

9

 API Standard 653, Tank Inspection, Repair, Alteration, and Reconstruction, December

1995.

The design and implementation of the

Motiva H2SO4 tank inspection

program was inadequate.
15

After an internal inspection in 1994, Motiva inspectors recommended thickness measurements for tank 393 in 1996; this did

not occur. In addition, after 1994, no complete external inspections were conducted (i.e., inspectors only spot-checked shell

thickness in the vicinity of leaks).

It is likely that an external inspection would have identified the

holes in the roof of the tank and the need for a thorough internal

inspection. API 653 requires the evaluation of flaws, deterioration, or other conditions that might affect the performance of a

tank and the determination of its suitability for the intended

service.

7. NACE International (National Association of Corrosion Engineers) RP 0294-9410 recommends an internal inspection every

5 years and an external in-service inspection every 2 years for

tanks in concentrated H2SO4 service. H2SO4 regeneration

contractors11 contacted by CSB follow these NACE guidelines.

8. Management did not consider the leaks in tank 393 to constitute

an imminent hazard to safety or the environment. They stated in

interviews their belief that patching the leaks allowed the tank to

operate safely, even though inspectors noted that the repairs

were temporary and required an internal inspection to ensure

vessel integrity. They also believed that lowering the liquid level

in the tank below the leak point addressed the hazard.

9. Tank 393 was converted from fresh to spent acid service in

March 2000 with minimal engineering support. Conversion

involved the addition of CO2 inerting and a conservation vent/

vacuum breaker with a flame arrestor.

n In its work order for the conversion, Motiva did no engineering and did not request engineering support from WGI.

————————–

10 NACE Recommended Practice (RP) 0294-94, Design, Fabrication, and Inspection of

Tanks for the Storage of Concentrated Sulfuric Acid and Oleum at Ambient Temperatures, 1994.

11 H2

SO4 regeneration contractors take spent acid from refiners, convert it back to fresh

acid, and return it for reuse.

It is likely that an external inspection

would have identified the holes in the

roof of the tank and the need for a

thorough internal inspection.

Management did not consider the

leaks in tank 393 to constitute an

imminent hazard to safety or the

environment. . . . They also believed

that lowering the liquid level in the

tank below the leak point

addressed the hazard.
16

n Sizing of inerting flow requirements for normal and upset

conditions was inadequate, and the CO2 gas flow was

insufficient to maintain a nonflammable atmosphere in the

tank.

n The tank lacked a weak seam roof or other emergency

venting provisions, which would likely have prevented it

from separating at the floor and catastrophically releasing its

contents.

10. Motiva did not use its MOC system for the conversion of tank

393 from fresh to spent acid service. As a result, the conversion did not benefit from the following good practices:

n Review and sign-off on the proposed changes by subject

area experts (e.g., corrosion, tank design) and higher level

management.

n Process hazard review.

n Prestartup safety review.

11. The vapor space of tank 393 was not adequately inerted.

Design deficiencies provided an insufficient flow of CO2 to

keep the internal atmosphere below the flammable range.

n CO2 was not hard-piped into tank 393, but rather was

supplied via a temporary rubber hose running off the

inerting system of an adjacent tank (396). Because of the

long length and small diameter of the hose, an insufficient

amount of CO2 reached tank 393.

n The hose supplying CO2 was not attached to tank 393. It

was dropped into a hole in the roof, where a nozzle had

been located before it corroded. The temporary hose

setup was in use for over a year; it was not converted to

conventional hard piping, as on the other acid tanks.

n A common overflow line connected the vapor space of

tank 393 to two tanks open to the atmosphere.

12. The vapor space above the liquid surface in tank 393 contained flammable vapor. Spent H2

SO4 from alkylation units

normally contains sufficient flammable hydrocarbons to generate a flammable atmosphere given the presence of oxygen.

Sizing of inerting flow requirements

for normal and upset conditions was

inadequate, and the CO2 gas flow

was insufficient to maintain a

nonflammable atmosphere in the tank.

Motiva did not use its MOC system

for the conversion of tank 393 from

fresh to spent acid service.

CO2 was not hard-piped into tank

393, but rather was supplied via a

temporary rubber hose running off

the inerting system

of an adjacent tank (396).
17

As the tank contents settle, some of the hydrocarbons

evaporate into the vapor space and may reach flammable

concentrations.

13. Because of the holes in the tank and an ineffective inerting

system, tank 393 exhibited severe localized corrosion beyond

that considered normal in concentrated H2SO4 service. Both

rainwater and water moisture in the ambient air entered the tank

through holes caused by the corrosion. H2SO4 becomes more

corrosive as its concentration decreases with the addition of

water.

14. An operator submitted an Unsafe Condition Report12 on

June 27, 2001, after rejecting a hot work permit on the acid

tank catwalk because of high flammable vapor readings. This

report cited the holes in tanks 393 and 396, and noted that a

hose inserted into an open hole in the tank roof supplied the

inerting gas for tank 393.

In the 3 weeks between submission of the Unsafe Condition

Report and the day of the incident, Motiva investigated but did

not correct the deficiencies noted or implement temporary

safeguards, such as banning hot work in the vicinity of the holes.

15. Motiva allowed hot work to be performed in the vicinity of a

tank with holes in its roof and shell. Hot work should not have

been authorized; Motiva was aware of the condition of the

tanks and that they contained flammables. In addition, once the

work was authorized, inadequate precautions were taken to

prevent an ignition of flammable vapors. On July 17, and on

several occasions in the days prior to the incident, contract

workers used burning and welding equipment to cut out and

replace sections of the catwalk above the acid storage tanks.

n Contractors, permit writers, and approvers were unaware of

the hazards posed by conducting hot work in the vicinity of

the holes on the tops of tanks 393 and 396.

————————–

12 Unsafe Condition Reports can be written by plant workers to bring management and

union attention to safety and health issues that are not adequately addressed by the

immediate supervisor.

Because of the holes in the tank and

an ineffective inerting system, tank 393

exhibited severe localized corrosion

beyond that considered normal in

concentrated H2SO4 service.

In the 3 weeks between submission

of the Unsafe Condition Report and

the day of the incident, Motiva

investigated but did not correct the

deficiencies noted or implement

temporary safeguards . . .

Hot work should not have been

authorized; Motiva was aware of the

condition of the tanks and that they

contained flammables.
18

n On at least two previous occasions in the weeks prior to the

incident, hot work permits to work on the catwalk grating

had been denied–once because of excessive amounts of

sulfur dioxide (SO2) gas, and a second time because of a high

reading for flammable vapors. However, despite this history,

the July 17 hot work permit did not specify the need for

periodic retesting or continuous monitoring of the atmosphere around the work area for flammables.

ES.4 Root Causes

1. Motiva did not have an adequate mechanical integrity management system to prevent and address safety and environmental

hazards from the deterioration of H2SO4 storage tanks.

n The repeated recommendations of the tank inspectors that

tank 393 be taken out of service “as soon as possible” for an

internal inspection were unheeded.

n A leak in the shell of tank 393, observed in May 2001, was

not repaired. Instead, the tank liquid level was lowered

below the leak point, and the tank remained in service.

n Management failed to recognize the imminent hazard posed

by the holes in tank 393 and did not promptly initiate repairs

or take the tank out of service.

2. Motiva engineering management and MOC systems inadequately addressed conversion of the tanks from fresh to spent

acid service.

n The CO2 inerting supply to tank 393, installed in 2000, was

incapable of maintaining a nonflammable atmosphere.

n CO2 was supplied to tank 393 via a temporary hose run off

the inerting system of an adjacent tank. The hose was

dropped into a hole in the roof of tank 393.

n No engineering calculations were made to determine proper

sizing for the inerting system.

n The tank conversion was completed without review of changes

by technical experts, process hazard analyses, or prestartup

safety reviews–all elements of a proper MOC program.

On at least two previous occasions in

the weeks prior to the incident, hot

work permits to work on the catwalk

grating had been denied–once because

of excessive amounts of sulfur dioxide

gas, and a second time because of a

high reading for flammable vapors.

The repeated recommendations of the

tank inspectors that tank 393 be taken

out of service “as soon as possible” for

an internal inspection were unheeded.

The CO2 inerting supply to tank 393,

installed in 2000, was incapable of

maintaining a nonflammable

atmosphere.
19

3. The Motiva hot work program was inadequate.

n Motiva scheduled and permitted hot work to be conducted

above and around tanks that contained flammable vapors

and had known holes; tank 393 had a leak in its shell and

open holes in its roof, and tank 396 also had an open hole in

its roof.

n After authorizing the hot work, Motiva management did not

institute adequate precautions to ensure worker safety, such

as continuous monitoring.

ES.5 Contributing

Causes 1. The Motiva refinery system for investigating Unsafe Condition

Reports, informing workers about such reports, and tracking the

satisfactory resolution of issues was inadequate.

n In the 3 weeks between submittal of the Unsafe Condition

Report on June 27 and the day of the incident, management

did not correct the reported deficiencies or implement

temporary safeguards.

n Motiva operators would likely not have authorized hot work

in the vicinity of the tank if they had understood the hazards,

nor would contract employees have conducted the work.

2. The Motiva Enterprises LLC management oversight system

failed to detect and hold Motiva refinery management accountable for deficiencies in the refinery’s mechanical integrity,

engineering management, and MOC systems.

Motiva scheduled and permitted hot

work to be conducted above and

around tanks that contained flammable

vapors and had known holes . . .
20

ES.6 Recommendations

Occupational Safety and

Health Administration

Ensure coverage under the Process Safety Management Standard

(29 CFR 1910.119) of atmospheric storage tanks that could be

involved in a potential catastrophic release as a result of being

interconnected to a covered process with 10,000 pounds of a

flammable substance.

Delaware Department of

Natural Resources

and Environmental Control

Ensure that regulations developed for the recently enacted Jeffrey

Davis Aboveground Storage Tank Act require that facility management take prompt action in response to evidence of tank corrosion

that presents hazards to people or the environment.

Motiva Enterprises–

Delaware City Refinery

1. Implement a system to ensure accountability for mechanical

integrity decision making. Include the following specific items:

n Review of inspection reports by subject area experts, such as

metallurgists or equipment design engineers, to ensure

adequate analysis of failure trends and suitability for intended

service.

n Establishment of a planning system to ensure the timely repair

of equipment.
21

The Center for Chemical Process Safety (CCPS) publication,

Plant Guidelines for Technical Management of Chemical Process

Safety, Chapter 3, “Accountability Objectives and Goals,”

presents a model for such a system.

2. Review the design of existing tankage that contains or has the

potential to contain flammables to ensure that, at a minimum:

n Inerting systems are installed where appropriate and are

adequately sized and constructed.

n Emergency venting is provided.

3. Ensure that management of change reviews are conducted for

changes to tank equipment and operating conditions, such as:

n Tank service and contents.

n Tank peripherals, such as inerting and venting systems.

4. Revise the refinery hot work program to address the circumstances that require use of continuous or periodic monitoring for

flammables.

5. Upgrade the refinery Unsafe Condition Report system to include

the following:

n Designation of a manager with decision-making authority to

resolve issues.

n Establishment of a mechanism to elevate attention to higher

levels of management if issues are not resolved in a timely

manner.

n Identification of a means to ensure communication of hazards

to all potentially affected personnel.

Work with the Paper, Allied-Industrial, Chemical & Energy

Workers International Union (PACE) Local 2-898 to design and

implement the improved system.
22

Motiva Enterprises LLC

1. In light of the findings of this report, conduct periodic audits of

storage tank mechanical integrity and design, Unsafe Condition

Reports, hot work, management of change, and accountability

systems at Motiva oil refineries. Ensure that the audit recommendations are tracked and implemented. Share the findings

with the workforce.

2. Communicate the findings and recommendations of this report

to the workforce and contractors at all Motiva refineries.

American Petroleum Institute (API)

1. Work with NACE International (National Association of

Corrosion Engineers) to develop API guidelines to inspect

storage tanks containing fresh or spent H2SO4 at frequencies

at least as often as those recommended in the latest edition

of NACE Standard RP 0294-94, Design, Fabrication, and

Inspection of Tanks for the Storage of Concentrated Sulfuric

Acid and Oleum at Ambient Temperatures.

2. Revise API tank inspection standards to emphasize that storage

tanks with wall or roof holes or thinning beyond minimum

acceptable thickness that may contain a flammable vapor are an

imminent hazard and require immediate repair or removal from

service.

3. Ensure that API recommended practices address the inerting of

flammable storage tanks, such as spent H2SO4 tanks. Include the

following:

n Circumstances when inerting is recommended.

n Design of inerting systems, such as proper sizing of inerting

equipment, appropriate inerting medium, and instrumentation, including alarms.

4. Communicate the findings and recommendations of this report

to your membership.
23

NACE International

(National Association

of Corrosion Engineers)

1. Work with the American Petroleum Institute to develop API

guidelines to ensure that storage tanks containing fresh or spent

H2SO4 are inspected at frequencies at least as often as those

recommended in the latest edition of NACE Standard RP 0294-

94, Design, Fabrication, and Inspection of Tanks for the Storage

of Concentrated Sulfuric Acid and Oleum at Ambient Temperatures.

2. Communicate the findings and recommendations of this report

to your membership.

Paper, Allied-Industrial, Chemical &

Energy Workers International Union (PACE)

Local 2-898

Work with Motiva management on the design and implementation of

an improved Unsafe Condition Report program.

Paper, Allied-Industrial, Chemical &

Energy Workers International Union (PACE)

National Petrochemical and

Refiners Association (NPRA)

Building and Construction

Trades Department–AFL-CIO

Communicate the findings and recommendations of this report to

your membership.
24
25

1.0 Introduction

1.1 Background

 n July 17, 2001, an explosion and fire occurred at the Motiva

 Enterprises LLC Delaware City Refinery (DCR), in Delaware

City, Delaware. One contract employee died and eight workers

were injured when a spent sulfuric acid (H2SO4) storage tank failed

and released its contents, which ignited. Approximately 1.1 million

gallons of spent H2SO4 was released; 99,000 gallons reached the

Delaware River.

1.2 Investigative

Process

O

Investigators from the U.S. Chemical Safety and Hazard Investigation

Board (CSB) arrived at the facility on July 20. Because of the presence of large quantities of H2

SO4 and an ongoing search and rescue

operation, the area was an active emergency response site for many

weeks. As a result, investigators initially had limited access to examine

physical evidence. The Delaware Fire Marshal controlled site access

during this period. CSB examined physical evidence from the incident as it became available, conducted interviews with Motiva and

contractor personnel, and reviewed relevant documents.

CSB coordinated its work with a number of other organizations

conducting investigations, including:

n Occupational Safety and Health Administration (OSHA).

n U.S. Environmental Protection Agency (EPA).

n Delaware Department of Natural Resources and

Environmental Control (DNREC).

n U.S. Coast Guard.

n Delaware Fire Marshal’s Office.

n Delaware Attorney General’s Office.

n Delaware State Police.
26

1.3 Delaware City

Refinery The Motiva Enterprises Delaware City Refinery began operation in

1956 as the Tidewater Oil Company. In 1967, Tidewater merged

with Getty Oil, which was in turn acquired by Texaco in 1984.

From 1989 to 1998, the refinery was known as Star Enterprise; it

was part of a joint venture between Texaco and Saudi Aramco. In

1998, the refinery became part of Motiva, which was a joint venture

between Texaco, Saudi Refining Company, and Shell. In 2001,

Texaco terminated its participation in the Motiva partnership as a

condition of its merger with Chevron.

At the time of the incident, the refinery had approximately 650

employees and 300 contractors onsite. It is located close to the

Delaware River, in New Castle County, Delaware.

1.4 Sulfuric Acid

Processes H2

SO4 is used as the catalyst in the refinery’s alkylation process. In

this process, smaller molecules–such as isobutane and butylene–are

combined in the presence of H2SO4 to form compounds called

alkylates, which are high-octane components of gasoline.

After being used in the alkylation process, the H2SO4–now referred

to as spent acid–typically contains 88 to 95 percent H2SO4 and up to

5 percent water. The balance is hydrocarbons, including some light

hydrocarbons that can vaporize.

To recycle the acid, Motiva sent it through a regeneration process in

which it was heated and decomposed to sulfur dioxide (SO2) and

water. The SO2 was then reacted with air and converted to sulfur

trioxide (SO3), which was subsequently converted to H2SO4 through

contact with water in an absorber. The fresh H2SO4 has a composition of approximately 99 percent acid.
27

1.5 Sulfuric Acid

Storage Tanks

————————–

1

 Inerting refers to the use of a nonflammable, nonreactive gas that renders the combustible material in a system incapable of supporting combustion (NFPA 69).

2 A conservation vent (also referred to as a PV valve) is a weight-loaded, pilot-operated,

or spring-loaded valve used to relieve excess pressure or vacuum in a tank (API, 2000).

3 A flame arrester is a device intended to prevent a flame from propagating through an

open vent into a vessel.

Six storage tanks, numbered 391 through 396, were originally built in

1979 for the storage of fresh H2SO4. As operations changed, the

tanks were converted to serve as storage for spent H2SO4 by the

addition of carbon dioxide (CO2) inerting1 and the installation of

conservation pressure/vacuum vents2 with a flame arrestor.

3

 Tanks

391 and 396 were converted in 1997, and tanks 392 and 393 were

converted in 2000.

At the time of the incident, and for some time previously, the Motiva

H2SO4 regeneration system could not handle the entire load of spent

acid generated in the alkylation unit. DCR supplemented its regeneration capacity by using an offsite contractor.
28
29

2.0 Description of Incident

2.1 Pre-Incident Events

 eginning in late June 2000, boilermakers from The Washington

 Group International, Inc. (WGI), the primary maintenance

contractor at DCR, were repairing the weakened and corroded

catwalk at the acid tank farm (Figure 1). SO2 vapors from the

storage tanks combined with moisture in the air to form sulfurous acid

(H2SO3), which was causing the deterioration of the catwalk.

B

396

Spent

391

Spent

392

Spent

395

Fresh

394

Fresh

393

Spent

North

Figure 1. Layout of acid storage tanks and catwalk.

Sulfur dioxide vapors from the storage

tanks combined with moisture

in the air to form sulfurous acid,

which was causing the deterioration

of the catwalk.
30

The catwalk was located at the roof level of the storage tanks. It

provided access to the gauge hatch used to physically measure the

tank level and to various nozzles and instruments, including inerting

system controls. At tank 393, the catwalk was located above the

southwest section of the tank–an area that had several holes due to

corrosion in both the tank roof and shell.

The boilermakers had worked the catwalk repair job at least four

times prior to July 17. On at least two other occasions, however,

they had arrived at the job site but could not work because unit

operators were unable to approve a hot work permit:

n The hot work permit was denied once because the outside

operator considered SO2 levels in the work area to be too high.

The operator stated that an SO2 reading of 10 parts per million

(ppm) was obtained at the bottom of the stairs leading to the

catwalk and the fumes were too strong to continue up the stairs.

n The hot work permit was also denied on June 27. The operator obtained a 1 percent reading on a hand-held combustible

gas monitor4in the area where the work was to be performed

and also noted a hole in the roof of tank 396.

The operator who denied the hot work permit on June 27 submitted

an Unsafe Condition Report5 on that day. The report stated:

393 TK is still being fed a blanket (CO2) by a nitrogen hose

[a rubber hose typically used for nitrogen] from the regulator on 396 TK. This hose is shoved in a hole in the top of

the 393. The hole came from a nozzle that fell off because

it was corroded so bad. 396 TK also has a (11⁄2) nozzle

that fell off because it was corroded so bad. Now it’s open

to atmosphere. Note: The one regulator is working for

both tanks.

The report was initially distributed to the area supervisor, the safety

department, and the joint (union/management) health and safety

committee, and a copy was kept in the control room for other

operators to read.

————————–

4

 Combustible gas monitors measure the percentage of the lower explosivity limit (LEL)

present in the atmosphere. The LEL is the lowest concentration of a gas or vapor that

must be present to support combustion in the presence of oxygen.

5 Unsafe Condition Reports can be written by plant workers to bring management and

union attention to safety and health issues that are not adequately addressed by the

immediate supervisor.

The boilermakers had worked the

catwalk repair job at least four times

prior to July 17. On at least two other

occasions, however, they had arrived

at the job site but could not work

because unit operators were unable to

approve a hot work permit . . .
31

2.2 The Incident

————————–

6 An outside operator typically works outside of a unit control room–taking readings on

local gauges, and manipulating valves and other equipment under the direction of an

inside operator, who monitors the control room instrumentation.

On July 17, 2001, four WGI boilermakers and their foreman

received their assignment for the day, via a work order, to continue

the job of replacing the grating on the catwalks in the acid tank farm.

At approximately 7:45 am, the five boilermakers went to the acid area

control room to obtain a hot work permit.

The permit allowed them to burn/weld and grind “on tank 396”

(which was understood to mean the catwalk grating at tank 396) and

gave instructions to stop hot work immediately if hydrocarbons were

detected. The instructions on the permit called for a fire watch, acid

gas respirators, warning signs, impervious gloves, face shields, and

coordination with Operations. There was no requirement for the

containment of sparks from the hot work.

To complete the hot work permit, the outside operator6 went to the

work area and conducted air monitoring for oxygen and the presence of flammable vapors (LEL), hydrogen sulfide (H2

S), and SO2.

The results of these tests, conducted with portable meters, were

noted on the permit as “0.” The outside operator filled out the gas

test section of the permit and signed it.

The unit supervisor signed the permit as the cosigner; the WGI

foreman signed in the acknowledgement section and left to check on

other jobs. The permit for July 17 was good from 8:00 am until

4:30 pm.

Corrosion-damaged sections of grating were to be cut out and

replaced by welding down new sections. The work plan was for

two of the boilermakers to remove small sections, while the other two

measured and prepared new pieces to replace what was cut out.

Two of the boilermakers started out on the ground setting up equipment and then turned on the welding machine and came up onto

the catwalk. After trying the oxy-acetylene cutting torch, they decided to use air carbon arc gouging because the torch was not hot

enough to cut through rust on the corroded grating.

The permit allowed them to burn/

weld and grind . . . the catwalk grating

at tank 396 and gave instructions

to stop hot work immediately if

hydrocarbons were detected. . . .

There was no requirement for

the containment of sparks . . .

Corrosion-damaged sections of grating

were to be cut out and replaced by

welding down new sections.

After trying the oxy-acetylene cutting

torch, they decided to use air carbon

arc gouging because the torch was not

hot enough to cut through rust

on the corroded grating.
32

Air carbon arc gouging works by generating an electric arc between

the tip of a carbon electrode and the work piece. As the work piece

becomes molten, high velocity air streams down the electrode and

blows away the molten metal. This process–which uses air at 80 to

100 pounds per square inch gage (psig)–ejects large amounts of

molten metal over a wide area.

There was no communication between WGI and Motiva when

WGI switched from oxy-acetylene to air carbon arc gouging, and a

Motiva hot work requirement for “absolute spark control” was not

observed.

During the morning of July 17, portions of the grating around tank

396 were removed and replaced. The workers were ready to start

working from tank 393 back toward tank 396 when they broke for

lunch at noon.7

Upon returning at 12:30 pm, two boilermakers went onto the

catwalk, while two remained on the ground to receive the sections

removed earlier. The men on the catwalk stated that they had to lift

a hose that was draped across the handrail between tanks 396 and

393 so that it would not get caught on the grating being lowered to

the ground. This was likely the temporary rubber hose that supplied

CO2 inerting gas to tank 393.

At approximately 1:30 pm, one boilermaker was on the ground at the

south end of the dike as the contract foreman drove up to the area

between the tanks and the control room. The second boilermaker

on the ground started up the stairs at tank 392 to the catwalk area.

The two men already on the catwalk decided to start at tank 393 and

work back toward the grating they had replaced in the morning,

adjacent to tank 396.

At this time, the boilermaker working the air gouging equipment was

kneeling and cutting out the first piece of grating above tank 393.

The second boilermaker on the platform was standing south of 393

and had his back turned. He reported that he felt a high pressure

burst of air and turned to see his coworker stand up as tank 393

began to lift off its foundation pad and collapse toward the north,

pulling down the catwalk (Figure 2).

————————–

7 The catwalk between tanks 396 and 393 is approximately 25 feet long.

There was no communication

between WGI and Motiva when

WGI switched from oxy-acetylene to

air carbon arc gouging, and a Motiva

hot work requirement for “absolute

spark control” was not observed.

The second boilermaker on the

platform . . . reported that he felt a

high pressure burst of air and turned

to see his coworker stand up

as tank 393 began to lift off

its foundation pad and collapse

toward the north,

pulling down the catwalk.
33

Figure 2. Tank 393, collapsed at northeast corner of storage tank dike.

 (Note floor of tank 393 to the right of tank shell.)

The second boilermaker turned and ran to the south; he was starting

down the steps at tank 392 when the explosion occurred and he met

another coworker, who was coming up the stairs. Together they fell

down the stairs and then helped each other exit the dike (Figure 3).

At the same time, acid crashed against the dike wall to the south and

to the north and splashed onto the ground outside the dike. As the

acid flowed inside the dike, flammable material was burning on top of

it. The acid overwhelmed the dike diversion system and flowed up

through the grating on the streets outside the dike.

One of the boilermakers was overcome by acid fumes and was

helped into the control room to get air. The acid surrounded the

foreman’s pickup truck, which ignited and burned. The acid

continued to flow through the streets toward the control room and

to the southwest.

As the acid flowed inside the dike,

flammable material was burning on

top of it. The acid overwhelmed

the dike diversion system

and flowed up through the grating

on the streets outside the dike. . . .

The acid continued to flow

through the streets . . .
34

Figure 3. Tank 394 in foreground and

remains of catwalk, from the north.

2.3 Incident Aftermath

and Emergency

Response

One contract employee was killed, and eight contract employees

were injured. Most of the injuries included burning eyes and lungs

and nausea due to exposure to fumes. One truck driver received

acid burns to his face, hands, and legs. Three contractors were

injured during the initial response effort to contain the acid.

The first Motiva fire brigade truck arrived on scene within 5 minutes

of the explosion and sprayed a large amount of water into the tank

farm area. The tank farm was equipped with spill collection boxes

inside the dike that ran to a common header. The header ran to a

valve box south of the tank farm, where it entered an internal sump

system that directed flow to an acid neutralization system. However,

on July 17, the large amounts of acid and firewater overwhelmed

the system, and acid flowed up through the sewer gratings onto the

streets outside the diked area.

One contract employee was killed,

and eight contract employees were

injured. Most of the injuries included

burning eyes and lungs and nausea

due to exposure to fumes.
35

The spill eventually reached both the oily water and stormwater

sewers. The material in the oily water sewer flowed to the plant’s

wastewater treatment facility, which may have contained or treated

some of the acid before it was discharged to the Delaware River.

The material in the stormwater sewer flowed untreated through a

Delmarva Power & Light channel and then into the river. Acid also

flowed northwest from the tank farm area into a tributary of Red

Lion Creek. Motiva was able to pump a portion of the acid into fly

ash settling ponds.

Motiva estimated that 99,000 gallons of H2SO4 was released into the

Delaware River. The spill resulted in approximate fish and crab kills

of 2,500 and 250, respectively.

Immediately following the incident, there was concern that the

remaining acid tanks could catastrophically fail due to damage from

the fire and the spill of acid. Because of acid contamination and the

amount of acid remaining in the undamaged tanks, workers were

unable to enter the diked area until August 17, when the tanks were

emptied–32 days after the incident. The search for Mr. Davis

continued until September 18.

Motiva estimated that 99,000 gallons

of H 2

SO4 was released into the

Delaware River.

Because of acid contamination

and the amount of acid remaining

in the undamaged tanks, workers

were unable to enter the diked

area until August 17,

when the tanks were emptied–

32 days after the incident.

The search for Mr. Davis continued

until September 18.
36
37

3.0 Analysis

3.1 Corrosion and

Tank Inspections

————————–

8 API Standard 650, Welded Steel Tanks for Oil Storage, 1998.

S

 ections 3.1.1 to 3.1.4 discuss the most likely scenario for the

 failure of tank 393, as summarized below:

n Flammable vapors and gases were normally present in the vapor

space of the spent H2SO4 storage tanks.

n The tank 393 inerting system was fundamentally incapable of

maintaining the oxygen concentration in the vapor space below

the level necessary for combustion.

n The inerting system was further compromised by holes in the

tank roof and shell.

n Hot work on the catwalk near the top of tank 393 generated

sparks that either entered the tank and ignited the flammable

mixture inside–or contacted flammable vapors outside the tank,

near one of the holes, and flashed back inside.

n A deflagration inside the tank generated enough pressure (estimated by CSB to be 5 pounds per square inch gage [psi]) to

cause the shell of the tank to separate from the floor.

3.1.1 Indications of Corrosion

The six carbon steel (CS) tanks in the DCR acid tank farm (391

through 396) were originally built in 1979 per API 6508 and were

identical except for the orientation of nozzles. The tanks each had a

diameter of 47 feet, a height of 32 feet, and a nominal capacity of

415,000 gallons. Each tank was composed of four rows or courses

of metal plates, each course 8 feet high. The initial thickness of the

bottom course was 9/16 inch, the next course up was 7/16 inch, and

the top two courses and the roof were 5/16 inch.

Hot work on the catwalk near the top

of tank 393 generated sparks that

either entered the tank and

ignited the flammable mixture inside–

or contacted flammable vapors

outside the tank, near one of the

holes, and flashed back inside.

Flammable vapors and gases were

normally present in the vapor space of

the spent H2SO4 storage tanks.
38

3.1.1.1 Tank 393

Tank 393 had a history of localized corrosion and leaks throughout

the last 8 years of its life. Using data from inspection reports, Table 1

summarizes the history of leaks and repairs on tank 393. Figure 4

shows several of the patches on the shell of the tank. (See Appendix

A for additional details.)

Table 1

Tank 393 Deterioration and Repair History

Date Inspection Findings

1992 Thickness readings: approximately half of the corrosion allowance is

used up in large sections of the entire exposed area

1994 Internal inspection: corrosion groove 3⁄4 inch wide and extending 270

degrees around shell, 4 inches above floor plate; repaired with a buildup

of weld metal

June 1998 Shell leak: leak 3⁄4 inch long and 3/32 inch wide, 18 feet above tank floor;

repaired with 6-inch-diameter steel plate

April 1999 Shell leak: 1/8-inch-diameter hole, 18 inches above repair made in

1998; repaired with 8-inch-diameter patch

September 1999 Shell leak: 1-inch-long by 3/16-inch-wide hole, directly above previous

leaks; repaired with 35- by 11-inch-wide patch to cover areas of reduced

thickness

April 2000 Shell leak: horizontal leaks due to grooving extending through shell wall

in same area as previous leaks; 12- by 29-inch-long CS patch recommended

July 2000 Shell leak: leaks from April 2000 were covered with an epoxy patch

instead of the recommended CS patch; the patch leaked and was

replaced with a CS patch

May 2001 Shell leak: 3- by 1/8-inch-wide leak directly above a previously installed

patch; recommended 22- by 22-inch repair patch was not installed
39

Figure 4. Side of tank 393 showing series of patches.

Post-incident analysis revealed three additional openings in the

roof and shell of tank 393 that were believed to have been

present prior to the incident:

n A 5.5-inch-long mushroom-shaped perforation just under

the roof-to-shell joint, near the overflow line.

n A 14-inch elongated hole in the area of the bubbler system

nozzles on the roof of the tank. This hole, which originally

housed a 2.5-inch-diameter nozzle on the roof, was under

insulation (see Figure 5).

n A 1.5-inch hole in the roof, created when a nozzle–

originally used for a level indication system–fell off due to

corrosion. The temporary CO2 inerting hose was inserted

into this hole (Figure 6).

Post-incident analysis revealed three

additional openings in the roof

and shell of tank 393 that

were believed to have been present

prior to the incident . . .
40

Figure 5. Elongated hole on roof of tank 393 (covered by insulation at time of incident).

Figure 6. Hole in roof of tank 393 through which temporary hose was inserted.
41

3.1.1.2 Corrosion in Other Acid Tanks

In addition to tank 393, other DCR acid tanks experienced significant

corrosion over the years.

n Tank 391–An internal inspection in 1993 found severe horizontal corrosion rings approximately 8 feet above the floor of the

tank. One band was 6.5 inches wide and extended 270

degrees around the circumference of the tank. A second band

was 1⁄4 inch wide and extended a full 360 degrees around the

tank. The corroded areas were removed and replaced with

fresh metal.

n Tank 394–Ultrasonic thickness measurements (UTM) in 1992

revealed corrosion in a vertical pattern in the area of the level

bubbler instrument. Three- to 6-foot-wide patches were

installed 24 feet up the side of the tank.

n Tank 395–In 1992, UTM readings indicated that the corrosion

allowance was almost completely used up, and a maximum

liquid height restriction of 25 feet was imposed. In 1995, an

internal inspection found significant corrosion on the shell and

roof. The tank was condemned, and a replacement tank that

used the existing tank floor and the bottom 6 inches of the shell

was installed.

n Tank 320–This tank was one of four acid tanks (320, 321, 322,

and 398) located at the H2SO4 alkylation unit. Accelerated

corrosion was observed in an internal inspection in 1996; the

shell had deteriorated to a thickness that warranted retirement

per API 653.9 The tank was demolished and replaced.

n Tank 398–An internal inspection in 1998 revealed that the roof

and shell were holed through in “numerous locations.” The

holes were in a vertical band extending from the roof down

through the shell toward the ground. This pattern of corrosion

was similar to that on tank 393. Eight- by 8-foot replacement

plates were installed in both the shell and the roof of the tank,

and severely corroded roof nozzles were replaced.

————————–

9

 API Standard 653, Tank Inspection, Repair, Alteration, and Reconstruction, December

1995.
42

3.1.1.3 Tank Inspections

As discussed in Section 3.4, the inspection of tank 393 was repeatedly delayed. Motiva employees told CSB investigators that its tank

inspection program followed the requirements of API 653; however,

several inspections required by the standard were not conducted, as

noted below:

n An internal inspection scheduled for 1999.

n Full external inspections and UTM inspections, which could

have provided key information on the deteriorating condition of

tank 393. Inspections were limited to the areas around leaks.

API 653 requires that “flaws, deterioration, or other conditions” (e.g.,

change of service, relocation, corrosion greater than the original

corrosion allowance) that might adversely affect the performance or

structural integrity of the shell of a tank be evaluated to determine

suitability for intended service. It further recommends that the

interval between inspection of tanks be determined by service history,

unless “special reasons indicate that an earlier inspection must be

made.”

Service history includes corrosion rates measured during previous

inspections or anticipated based on tanks in similar service. API 653

states that the inspection interval shall be set to ensure that the

thickness of the bottom plate is sufficient, and that in no case shall the

internal inspection interval exceed 20 years.

Risk-based inspection (RBI) is an alternative to inspecting by service

intervals. API notes that RBI can have the effect of increasing or

decreasing the 20-year interval. Historic tank leakage and failure data

are integral to an RBI assessment.

Trade organization publications and open literature provide guidelines on the frequency of tank inspections. NACE International

recommends “minimum” inspection frequencies for tanks in concentrated H2

SO4 service. In RP 0294-94,10 NACE recommends that all

tanks receive three forms of regular inspection:

————————–

10 NACE Standard RP 0294-94, Design, Fabrication, and Inspection of Tanks for the

Storage of Concentrated Sulfuric Acid and Oleum at Ambient Temperatures, 1994.

API 653 requires that “flaws,

deterioration, or other conditions” . . .

that might adversely affect the

performance or structural integrity

of the shell of a tank be evaluated

to determine suitability for

intended service.
43

n Routine external visual examination

n External in-service examination every 2 years

n Internal inspection every 5 years.

NACE RP 0294-94 also states that, if any storage tank is likely to have

suffered significant damage–regardless of inspection schedule–“it shall

be taken out of service and subjected to a detailed inspection.”

Inspection frequencies may be decided on the basis of “operating

conditions, experience, inspection results, fitness-for-service evaluations and risk analysis.” It is likely that adherence to this NACE

guideline would have resulted in even shorter inspection intervals for

tank 393.

In Materials Selector for Hazardous Chemicals, Dillon (1977) advises

that an internal inspection is necessary to detect and evaluate most

types of corrosion in concentrated H2SO4 tanks. He notes that

external inspection is effective only in monitoring uniform corrosion

rates.

One factor in determining inspection frequency is maintenance

history. The guidance on inspection frequency, which is based on

published technical articles, recommends that tanks in excess of

1,000-ton capacity be internally inspected every 5 years.

Motiva conducted an internal inspection of tank 393 in 1994. The

inspection report noted that the corrosion allowance would be used

up for the bottom sections of the tank shell in approximately 4 years

and recommended thickness measurements or “sonoray”11 in 1996.

This inspection was not conducted.

Leaks developed in the shell of tank 393 in each year from 1998

through 2001. Starting in 1999, the inspection department recommended that the tank be inspected internally “as soon as possible.”

However, other than spot testing for thickness in the vicinity of

specific leaks, no internal or external inspections were conducted on

the tank after 1994. Table 2 details the history of inspection recommendations.

————————–

11 Sonoray is a synonym for ultrasonic thickness (UT) testing of tank walls and roofs using

high frequency sound waves.

NACE RP 0294-94 also states that, if

any storage tank is likely to have

suffered significant damage–regardless

of inspection schedule–“it shall be

taken out of service and subjected

to a detailed inspection.”

Starting in 1999, the inspection

department recommended that the

tank be inspected internally “as soon

as possible.” However, other than

spot testing for thickness in the vicinity

of specific leaks, no internal or

external inspections were conducted

on the tank after 1994.
44

Inspection reports were distributed to a wide range of DCR managers

and staff, including the hierarchy of line managers responsible for the

acid tanks, Motiva and WGI maintenance departments, the engineering department, and the safety department. The trend of leaks in

tank 393 and the other acid tanks was not identified. There was no

system by which engineering staff or metallurgical experts were tasked

with identifying failure trends or assessing suitability for service.

Motiva should also have conducted a full external inspection of tank

393. API 653 recommends full external inspections at least every 5

years, while NACE International recommends a 2-year frequency.

An external inspection requires the removal of insulation “to the

Table 2

History of Motiva API 653 Tank Inspector Findings and Recommendations

Date Comments From Inspection Reports

1992 Approximately half of the corrosion allowance is used up in large sections of the entire exposed area.

1994 At the present rate of corrosion, this tank will have used up all of the

corrosion allowance for the bottom two shell courses in approximately 4

years. Inspection department to sonoray in 2 years to monitor corrosion

and calculate for continued service.

June 1998 This tank is overdue for an external sonoray survey as recommended in

[1995].

July 1998 Remove this insulation again in 2 years for inspection department to

sonoray shell.

September 1999 Due to recent tank failure, it is recommended that this tank be taken out of

service as soon as possible for an internal inspection and sonoray

survey.

April 2000 Due to the recent leaks on this tank, it is recommended to remove it from

service for an internal inspection as soon as possible.

July 2000 This tank to be taken out of service as soon as possible for an internal

inspection due to corrosion on the shell.

May 2001 This tank has a history of leaks and internal corrosion. It should be taken

out of service as soon as possible for an internal inspection and permanent repair.

There was no system by which

engineering staff or metallurgical

experts were tasked with identifying

failure trends or assessing suitability

for service.
45

extent necessary to determine the condition of the exterior wall of

the tank or the roof.” A thorough inspection of the tank with the

insulation removed would likely have uncovered the extensive

corrosion and penetrations due to corrosion in the upper shell and

roof.

Motiva failed to follow good practice guidelines and recognize that the

pattern of leaks on the outside of the tank was an indication of accelerated corrosion inside. Also, the history of leaks and replacements of

other tanks in H2SO4 service was a further indication of the pattern of

accelerated corrosion. The inspection recommended by the Motiva

tank inspectors would likely have identified the severe corrosion in tank

393. It is likely that the holes in the tank would have been detected and

repaired if the company had conducted an external inspection.

3.1.2 Potential Mechanisms

for Accelerated Corrosion

The inspections of tank 393 between 1992 and 1998 showed that

the general rate of corrosion was in line with expected values for

tanks in concentrated H2SO4 service (approximately 5 to 20 mils per

year [0.005 to 0.020 inch per year (in./yr)]). However, the prevalence

of leaks in the tank in the 3 years prior to the incident, along with the

indications of horizontal grooving, demonstrated the acceleration in

localized corrosion. The breaches in the tank shell discovered postincident indicate that the problem was even more widespread than

known. Published literature details the major corrosion mechanisms that

should be considered for H2SO4 tanks.

3.1.2.1 Diluted Sulfuric Acid

Within the Tank

H2SO4 in CS tanks reacts with iron in the shell to form a ferrous

sulfate product and hydrogen according to the reaction:

Fe (iron) + H2SO4 (sulfuric acid)

⇒ FeSO4 (ferrous sulfate) + H2 (hydrogen) [Eq 1]

The inspection recommended by

the Motiva tank inspectors would

likely have identified the severe

corrosion in tank 393.

. . . the prevalence of leaks in the tank

in the 3 years prior to the incident,

along with the indications of horizontal

grooving, demonstrated the

acceleration in localized corrosion.
46

The FeSO4 forms a protective layer between the wall of the tank and

the acid. Any condition that deteriorates this protective film–such as

diluting the acid with additional water, high temperature, or agitation–leads to accelerated localized corrosion. In the presence of low

concentration H2SO4 (i.e., containing a high amount of water), the

FeSO4 layer

 

is absorbed into the acid solution, which compromises

the protective layer and can lead to accelerated corrosion. Because

of this potential, carbon steel is not recommended for H2SO4 service

if the acid concentration is below 70 percent.

Accelerated corrosion occurs in concentrated H2SO4 tanks when

water dilutes the acid, either generally or–as was the likely mechanism

in tank 393–in localized areas where water accumulates. In tanks

with an ingress of water, the localized concentration of the acid

mixture may be lower (e.g., at the surface of the liquid).

A number of routes were available for additional water to enter tank

393:

n The holes in the upper portion of the tank and the roof provided a pathway for rainwater to enter and run down the sides,

contacting the surface of the acid solution.

n Additionally, the holes in the tank compromised the already

inadequate CO2 inerting system (Section 3.3.2), which allowed

moisture-laden ambient air to enter the tank and subsequently

condense on the inside surfaces of the roof and shell.

n The acid dilution from rainwater and atmospheric moisture

increased corrosion and exacerbated the shell and roof holes,

which in turn allowed more moisture to enter the tank.

The extensive series of horizontal grooves observed in the shell of the

tank after the incident indicate corrosion at the liquid level surface as

water mixed with the acid.

The tank level measurement device, referred to as the “bubbler

system,” used instrument air as a medium. A small flow of instrument

air (i.e., bubbles) entered the tank near its floor through the level

probe. This air introduced some turbulence into the acid, near the

wall of the tank, which likely made a small contribution to the corrosion rate by disturbing the protective FeSO4

 layer. Instrument air

In the presence of low concentration

H2SO4 . . . the [protective] ferrous

sulfate layer

 

is absorbed into the acid

solution . . .

Accelerated corrosion occurs in

concentrated H2SO4 tanks when

water dilutes the acid, either generally

or–as was the likely mechanism

in tank 393–in localized areas

where water accumulates.

The holes in the upper portion of the

tank and the roof provided a pathway

for rainwater to enter and run down

the sides, contacting the surface

of the acid solution.

The extensive series of horizontal

grooves observed in the shell of the

tank after the incident indicate

corrosion at the liquid level surface

as water mixed with the acid.
47

also contains moisture, much of which would likely be absorbed soon

after coming in contact with the acid solution; however, the moisture

would have some effect on the dilution of H2SO4 because of the

proximity of the bubbler tap to the wall. The bubbler system also

introduced a small amount of oxygen directly into the tank.

The corrosion of carbon steel by H2SO4 proceeds at a faster rate as

the temperature of the acid increases. Most of the holes in tank 393

were in the west and southwest quadrant. Because of the history of

leaks and repairs in this area of the tank, insulation had been removed

from a wide section of the shell, which then exposed it to direct

heating from sunlight.

3.1.2.2 Carbonic Acid

Tank 393 was inerted with CO2. When this gas is used as an

inerting agent, there is a possibility that it will react with water to form

carbonic acid. Although carbonic acid has a much lower corrosion

rate than diluted H2SO4, it would still have contributed to accelerated corrosion, especially in the vapor space of the tank.

3.1.2.3 Generation of

Hydrogen Gas

The corrosion of steel produces hydrogen bubbles (see Equation 1),

which can disrupt the protective FeSO4 film locally, resulting in

higher rates of corrosion. Hydrogen gas is also extremely flammable

and would have contributed to the likelihood of flammable vapor

being present in the vapor space of tank 393. However, H2 is a very

light gas and would tend to escape through the holes in the tank roof.

The corrosion of carbon steel by

H2SO4 proceeds at a faster rate as the

temperature of the acid increases . . .

insulation had been removed from a

wide section of the shell, which

then exposed it to direct

heating from sunlight.
48

3.1.3 Generation of

Flammable Atmosphere

The Encyclopedia of Chemical Processing and Design states that

because of the possible formation of a hydrocarbon layer in the spent

acid, “a [spent sulfuric acid] storage tank should be designed and

operated as if it contained volatile hydrocarbons” (McKetta, 1995).

Typically, spent acid leaving the H2SO4 alkylation area contains less

than 1 percent hydrocarbons; however, the hydrocarbons produce a

flammable atmosphere because they are lighter than the acid and

float to the top of the liquid in the tank. This layer includes isobutane

and alkylates (C5–C16 isoparaffins with high octane numbers, a

composition similar to that in the alkylation process reactor).

Volatilization of the isobutane moves flammable vapors into the space

above the liquid in the tank (Albright, 2002).

As discussed in Section 3.2.2, inadequate inerting allowed sufficient

ambient air to enter tank 393 to produce a flammable mixture.

3.1.4 Finite Element Analysis

of Tank Failure

CSB contracted with Engineering Systems Inc. (ESI), of Aurora,

Illinois, to examine the mechanical failure of tank 393. ESI conducted a finite element analysis (FEA) using a modeling tool

developed by Kansas State University. The model predicted that the

peak pressure within the tank–5.0 psig–would have been reached

approximately 1 second after ignition of the vapors.

Yielding at the shell-to-floor weld was predicted to have begun at

approximately 4.0 psig. Furthermore, by the time the peak pressure

of 5.0 psig was reached, the stresses at the corner welds exceeded

the tensile strength of the tank (ESI, 2002; Figure 7).

Figure 8 shows the floor of tank 393. The curved edges clearly

indicate the uplift that occurred prior to separation of the shell from

the floor.

. . . hydrocarbons produce a

flammable atmosphere because they

are lighter than the acid and float to

the top of the liquid in the tank.

. . . the peak pressure within the tank–

5.0 psig–would have been reached

approximately 1 second after ignition

of the vapors.
49

Figure 7. Modeled pressure rise in tank 393 during internal deflagration.

Figure 8. Floor of tank 393 showing uplift due to internal deflagration

(before separation of shell).
50

3.2 Engineering of

Conversion From

Fresh to Spent Acid

————————–

12 Inert gas refers to a nonflammable, nonreactive gas that renders the combustible

material in a system incapable of supporting combustion (NFPA 69).

13 A conservation vent (also referred to as a PV valve) is a weight-loaded, pilot-operated,

or spring-loaded valve used to relieve excess pressure or vacuum in a tank (API, 2000).

14 A flame arrester is a device intended to prevent a flame from propagating through an

open vent into a vessel.

In March 2000, tank 393 was converted from fresh to spent H2SO4

service. This change involved the installation of an inert gas12

system, a conservation vent,13 and a flame arrester.14 These modifications were necessary because spent acid–unlike fresh acid–

normally contains a small amount of light hydrocarbons that vaporize

and form a flammable mixture above the liquid level. The intent of

the modifications was to protect against a fuel/air explosion in the

tank vapor space.

3.2.1 Process Engineering

Investigators discovered only minimal evidence of process engineering in support of conversion of the storage tanks from fresh to spent

acid service. There was no documentation of engineering work on

the inerting systems. An engineering analysis would have determined

that the proposed system–connecting the CO2 supply from tank 396

to tank 393–could not supply an adequate flow of CO2 to maintain

an atmosphere in the tank capable of preventing the ignition of

flammable vapors (Section 3.2.2).

Motiva issued a work order to WGI to initiate the conversion of tank

393 to spent service. The work order stated: “Purchase and install

flame arrestor and vacuum breaker. Also need CO2 hose connected

to tank.” To conduct engineering for a project, Motiva supervision

typically wrote a request for engineering support; however, no engineering was requested for tank 393. WGI installed a vent and flame

arrestor, sized the same as those on tanks 391 and 396, and connected

the temporary hose for CO2 per the directions in the work order.

During the initial conversion of two other tanks in the acid tank farm

(391 and 396) in 1997, engineers verified that the proposed conservation vent size was sufficient to provide adequate ventilation for

An engineering analysis would have

determined that the proposed system–

connecting the CO2 supply from tank

396 to tank 393–could not supply

an adequate flow of CO2 to maintain

an atmosphere in the tank capable

of preventing the ignition

of flammable vapors.
51

normal flow of liquid into and out of the tank.15 However, no

documentation was available for determining the adequacy of the

vent for thermal breathing.16

When tank 393 was converted in 2000, no calculations were

documented. The contractors replicated the sizing of the vents used

in the 1997 tank conversions.

There is no evidence that Motiva conducted engineering analyses of

other scenarios that could result in abnormal or emergency tank

venting, such as failures of the inerting system (allowing excessive

flow of inert gas to enter the tank) or an external fire that volatilizes

hydrocarbon liquids in the tank. API 2000 discusses the need for an

adequate engineering design for these specific scenarios.17

The original design of tank 393, as a fresh H2SO4 tank, did not

necessitate an emergency pressure relief system, such as a frangible

roof.18 However, the conversion to spent acid service invalidated

the original premise.19

————————–

15 One of the sizing criteria for conservation vents is to ensure that sufficient air or inert

gas enters the tank when liquid is pumped out, or leaves the tank when liquid is pumped

in, to displace the volume of liquid leaving or entering the tank. If insufficient vapor is

added to replace the volume of liquid leaving the tank, the pressure drops and the

resulting vacuum may damage the tank. Conversely, if insufficient venting occurs when

pumping liquid into the tank, it may be subject to damaging overpressure.

16 Thermal breathing refers to the movement of gas into or out of a tank when the vapors

in the tank expand or contract due to weather changes (i.e., an increase or decrease in

atmospheric temperature).

17 API Standard 2000, Venting Atmospheric and Low-Pressure Storage Tanks, 1998.

18 A frangible roof is a weak roof-to-shell attachment that preferentially fails over other

welded joints when subject to overpressure. Failure of the roof-to-shell joint provides a

means to relieve overpressure and to avoid catastrophic failure of the tank and loss of

contents.

19 No emergency venting was provided in the original design because the emergency

vent loading for fresh H2SO4 is relatively low given the extremely low volatility of acid,

even when subject to an external fire scenario; in addition, tank 393 initially had no

pressure control. Spent H2SO4 contains some hydrocarbons with a much higher

volatility, which necessitates an emergency venting capability per API 2000. Also, with

the addition of an inerting system, API 2000 recommends that emergency pressure relief

be designed for the scenario in which the pressure regulator valve fails in the open

position, causing excessive flow of inert gas into the tank.
52

3.2.2 Tank Inerting Design

When tanks 391 and 396 were converted to spent acid service in

1997, each tank was equipped with a pressure regulator valve to

control CO2 flow and two local pressure gauges. However, when

the inerting system on tank 393 was installed in March 2000, it was

set up in a different manner (Figure 9).

CO2 inlet

Drain

PRV

Overflow

line

3/4-inch hose

Conservation vent

To grade

P 1 P 2

396

Open vent

Open vent

394

395

393

Instead of having a dedicated pressure regulator valve, tank 393 was

supplied with CO2 from a 3⁄4-inch flexible rubber hose connected to

the piping on tank 396. The hose ran along the catwalk between the

two tanks and entered tank 393 through a hole in the roof (see

Figure 8), which was created when a corroded nozzle fell off. The

hose arrangement was considered temporary, but it remained in

place for over a year and was never replaced with hard piping, as

was done for the other spent acid tanks.

Figure 9. Inerting system schematic (CO2 flow to tank 393 and overflow connection to 394/395).

Instead of having a dedicated pressure

regulator valve, tank 393 was supplied

with CO2 from a 3⁄4-inch flexible

rubber hose connected to the piping

on tank 396.
53

Motiva had no documentation of an engineering analysis to justify

that piggybacking a small-diameter hose off an existing CO2 piping

system was sufficient to supply CO2 to tank 393. In fact, there was

no documentation showing the gas supply required to adequately

inert any of the tanks.

Tank 393 received only a fraction of the inert gas that it required

because the length and small diameter of the hose significantly

restricted flow.20 Furthermore, the control valve was not designed to

regulate CO2 flow to two tanks simultaneously, which placed an

additional demand on the system.

Inert gas preferentially flowed to tank 396 because it presented the

path of least resistance. The pressure signal to the regulator valve did

not actually sense the pressure in either tank 393 or 396, but rather

measured the CO2 pressure in the pipe immediately downstream of

the regulator valve–which had the effect of further reducing the flow

of CO2 to tank 393.

A WGI instrument technician was responsible for maintaining

equipment in the inerting system. This person set the pressure

regulators to a positive pressure of 2 inches water column.21 The

local pressure gauges on three of the four spent acid tanks were the

only indication that the CO2 inerting system was performing properly.

However, operators rarely went on the catwalk and were not

required to monitor the pressure gauges as part of their daily rounds.

With no pressure gauge on the CO2 flow to tank 393, there was

no way to determine if the tank was receiving CO2 through the

temporary hose.

The National Fire Protection Association (NFPA) states that

purge gas22 must be introduced and exhausted to ensure effective

————————–

20 The valve itself, a 1-inch Fisher Rosemount Type 1190 gas-blanketing regulator, is

rated for 57,700 standard cubic feet per hour (scfh) nitrogen at an inlet pressure of 80

psig, or 45,300 scfh CO2. This does not account for restrictions due to downstream

piping, valves, bends, or expansion. CSB calculations show that the CO2 flow to tank

393 was in the range of 110 cubic feet per hour (cfh), significantly below that necessary

to maintain an inert atmosphere. CSB calculations indicate that–at this flow rate–the tank

would likely have contained about 16 percent oxygen, which is more than enough to

sustain the combustion of flammable gas.

21 This pressure is equivalent to the downward pressure exerted by a column of water 2

inches high.

22 Purge gas refers to a gas that is continuously or intermittently added to a system to

render the atmosphere nonignitable (NFPA 69).

Tank 393 received only a fraction of

the inert gas that it required because

the length and small diameter of the

hose significantly restricted flow.

With no pressure gauge on the

CO2 flow to tank 393, there

was no way to determine if the tank

was receiving CO2 through

the temporary hose.
54

distribution and to maintain the desired oxidant concentration

reduction23 throughout the system being protected.24 Because tank

393 was continuously open to the atmosphere through holes in the

roof and shell (Section 3.1), there was no way to ensure effective

distribution of the inerting medium throughout the tank vapor space.

Furthermore, an overflow pipe on tank 393 connected its vapor

space to nearby tanks 394 and 395–both in fresh acid service–which

had vents open to the atmosphere and no inerting system.

If an adequate inerting system had been installed with proper tank

integrity, it is likely that there would have been no combustible fuel/air

mixture in tank 393.

3.2.3 Secondary

Containment Systems

The DCR acid tank farm contained six atmospheric storage tanks,

each with a capacity of 415,000 gallons. Prior to the incident, these

tanks contained an estimated combined total of 1.7 million gallons of

fresh and spent H2SO4. The tanks were not individually diked; a

single secondary-containment dike (180 feet long by 130 feet wide by

5 feet tall) surrounded the tank farm. A set of drains within the dike

was designed to collect spills and route them to the acid plant neutralization system.

The July 17 incident resulted in the near-instantaneous release of the

entire 264,000-gallon contents of tank 393. The forces created by

this catastrophic failure caused the product withdrawal line on tank

396 to break, thereby also releasing its 352,000-gallon contents. The

resulting fire engulfed the remaining tanks. After the fire was extinguished, acid continued to leak from tank 394 for several weeks.

The initial release of material was described as a large wave of black

liquid that crashed over the dike wall. The acid overwhelmed the

spill collection system inside the secondary containment dike and

————————–

23 Oxidant concentration reduction refers to the technique of maintaining the concentration of the oxidant in a closed space below that required for ignition to occur. Oxygen in

air is the most common oxidant (NFPA 69).

24 NFPA 69, Standard on Explosion Prevention Systems, 1997.

The July 17 incident resulted in the

near-instantaneous release of the

entire 264,000-gallon contents of

tank 393. The forces created by this

catastrophic failure caused the

product withdrawal line on tank 396

to break, thereby also releasing

its 352,000-gallon contents.
55

flowed into the oily water and stormwater sewers. A total of 1.1

million gallons of acid was released during and subsequent to the

incident.

The material in the oily water sewer flowed to the wastewater

treatment plant, which may have contained or treated some of the

acid before it was discharged to the Delaware River. From the

stormwater sewer, the acid flowed untreated through a Delmarva

Power & Light channel and then to the river. Acid that moved

northwest from the tank farm flowed to a tributary of Red Lion

Creek. A portion of the spilled acid was pumped into fly ash settling

ponds. Motiva estimated that 99,000 gallons of acid reached the

Delaware River, killing fish and other aquatic life.

The secondary containment dike was not designed to contain the

instantaneous release of the contents of a storage tank. Although the

dike had a hydrostatic design capacity of about 480,000 gallons,25 it

was not constructed to resist the dynamic tidal wave effect of such a

rapid release. Noted process safety expert Frank Lees (1996) states:

“It has been common to design bunds [i.e., dikes] for the hydrostatic

load of the liquid in the tank, but not for the dynamic load.”

Although some advanced engineering techniques are available to

address the issue of dynamic loading, no American Petroleum Institute

(API), NFPA, or Center for Chemical Process Safety (CCPS) good

practice guidelines recommend that such a sophisticated containment

system be designed to contain a “tidal wave” of liquid flow.

3.3 Management of

Change for

Tank Conversion

————————–

25 This capacity is equivalent to the contents of any single tank plus an additional safety

margin.

When tank 393 was converted from fresh to spent acid service in

2000, several changes took place, including:

n Composition of the stored material

n Addition of tank ventilation control and flame arrester equipment

n Addition of an inert gas blanketing system.
56

Tanks 391 and 396 were the first two fresh acid tanks to be converted to spent acid service (in November 1997), and each had

received a documented management of change (MOC) review for

the flame arrester addition. However, no MOC documentation was

produced for other work involved in the conversions, such as the

addition of inerting systems.

API 750 states that changes in technology or facilities can introduce

new hazards or compromise safeguards built into the original

design.26 It recommends that refiners review hazards that may be

introduced as a result of changes in equipment and operating conditions. This procedure is known as “management of change.”27

The Motiva MOC system was part of its process safety management

program.28 Although Motiva did not consider the acid tank farm to

be covered by requirements of the OSHA Process Safety Management (PSM) Standard, MOC reviews were conducted when

changes were made to some tank farm equipment (e.g., those

detailed above on tanks 391 and 396); however, there was no

documented MOC review for any of the changes associated with the

tank 393 conversion.

An important step in the MOC process is management authorization

and approval. This is an integral part of the OSHA PSM Standard,

API 750, and the Chemical Manufacturers Association (CMA; now

the American Chemistry Council [ACC]) guidelines. ACC states that

the authorization review “should ensure that the actions required

prior to the change, based on the hazard review step(s), are complete and properly documented” (CMA, 1993). The MOC associated with the tank 391 and 396 conversions was not reviewed and

signed-off by other refinery departments, such as project engineering,

maintenance, and inspection.

The MOC procedure used at Motiva included a checklist with 20

questions to identify potential hazards associated with the change.

————————–

26 API RP 750, Management of Process Hazards, January 1990.

27 MOC is a systematic method of reviewing the safety implications of modifications to

process facilities, process material, organizations, and standard operating practices.

Although API 750 applies to a limited range of potentially catastrophic hazards, it details

the good practices and benefits of an MOC system.

28 MOC is also a requirement under the OSHA PSM Standard, 29 CFR 1910.119, and

the EPA Risk Management Program (RMP) regulation, 40 CFR 168.

. . . there was no documented

MOC review for any of the changes

associated with the tank 393

conversion.
57

However, CSB investigators determined that the checklist did not

adequately address the hazards of changing atmospheric storage tanks

from fresh to spent acid service, thus introducing flammable material

into the tanks.

The checklist included several questions on the hazards of tank

overpressure and failure of control systems, such as an inert gas

blanketing system. For the tank 391 and 396 MOC checklist:

n The reviewer wrote “outside temperature” in response to:

“What can cause much higher or lower than design pressure?”

n The reviewer indicated that there was no pressure relief valve to

protect the equipment.

n There was no response to: “Is PSV capability adequate to

relieve system?”29

n The reviewer answered “nothing” to: “What can happen if the

control instrumentation fails?”

No concerns were documented about the possibility of tank overpressure due to nonroutine scenarios, such as an external fire. The

checklist did not address the hazards of insufficient inerting of a tank

containing hydrocarbons.

In 1993, CMA provided the following good practice guidance in

Managing Process Changes: “For certain types of changes, plant

management may determine that formal hazard evaluations are

necessary. The MOC system should have formal criteria for initiating

these analyses” (CMA, 1993).

The Motiva MOC procedure allowed the change initiator to request

a process hazard analysis (PHA) from the site PSM coordinator.

However, it provided no guidance on when to request a more

comprehensive hazard analysis, such as a hazard and operability

(HAZOP) study. The MOC for the tank conversion did not request

a more thorough PHA.

Another aspect of MOC is the requirement for a prestartup safety

review after the physical change is made, but before the revised

equipment is used. Such a safety review would likely have identified

————————–

29 PSV is an abbreviation for pressure safety valve; it is synonymous with pressure relief

valve.

The Motiva MOC procedure allowed

the change initiator to request a

process hazard analysis . . . However,

it provided no guidance on when to

request a more comprehensive hazard

analysis, such as a HAZOP study.

. . . CSB investigators determined

that the [MOC] checklist did not

adequately address the hazards of

changing atmospheric storage tanks

from fresh to spent acid service . . .
58

the temporary hose inserted into a hole on top of tank 393 as an

unacceptable means of delivering inerting gas.

With a more comprehensive application of its MOC system prior to

initiating the tank 393 conversion–including a review by a multidisciplinary team of refinery personnel–Motiva would likely have

identified the inadequacy of the proposed inerting system, the lack of

emergency pressure relief capability, and the need for engineering.

3.4 Management

Practices–Tank 393 3.4.1 Lack of Recognition

of Imminent Hazard Potential

Motiva management personnel did not recognize the imminent

danger that tank 393 presented to people and the environment. This

lack of recognition occurred despite:

n The history of leaks on tank 393.

n The pattern of corrosion reflected in the failure of other acid

tanks.

n The repeated calls of Motiva inspectors for an internal inspection.

n The Unsafe Condition Report submitted by a unit operator on

June 27, 2000, which noted holes in tanks 393 and 396.

n The supply of inerting gas to tank 393 via a temporary rubber

hose dropped into a hole in the roof.

Unit managers believed that the repair of specific leaks would bring

the tank back to a condition as good as or better than original. In

interviews, Motiva managers consistently told CSB that they did not

perceive an imminent safety threat. At worst, managers believed

there was a risk to the environment due to tank leaks. Supervision

lowered the tank liquid level below the leak point; management

believed that this action, in combination with the inerting system,

would eliminate hazards.

. . . a prestartup safety review . . .

would likely have identified the

temporary hose inserted into a hole on

top of tank 393 as an unacceptable

means of delivering inerting gas.

Unit managers believed that the repair

of specific leaks would bring the tank

back to a condition as good as or

better than original.
59

It was believed that the tank inerting system was working properly

and would prevent the accumulation of a flammable atmosphere in

the tank vapor space. Managers maintained this assumption without

any information to back it up:

n No adequate engineering resources were expended to properly

design the system.

n No MOC procedures were followed when tank 393 was

converted in 2000.

n No engineering or administrative controls were implemented

(e.g., pressure or oxygen alarms, or flow or pressure readings) to

ensure that the inerting system was functioning properly.

3.4.2 Deferral of Inspections

3.4.2.1 Operational and

Inventory Constraints

Motiva missed several opportunities to inspect tank 393 when it was

emptied in 2000 and 2001. Management stated that it was necessary to keep tank 393 in service to help handle high acid plant

inventories because of operating problems in the acid regeneration

unit that prevented it from operating at design rates. Excess spent

acid was shipped to a contractor, who was also experiencing operating problems.

In any case, in spite of the high inventory situation, Motiva switched

the service of tank 393 between fresh and spent acid several times:

n In April 2000, from fresh to spent acid.

n In October 2000, from spent to fresh acid.

n In April 2001, from fresh to spent acid (until July 17, the day of

the incident).

The tank was emptied to switch services. The switchover did not

require a cleaning or draining, simply the removal of as much material

as possible by pump. Each switchover represented an opportunity

Motiva missed several opportunities

to inspect tank 393 when it was

emptied in 2000 and 2001.

It was believed that the tank inerting

system was working properly and

would prevent the accumulation

of a flammable atmosphere

in the tank vapor space.
60

around which Motiva could have planned its inventory and acid

regeneration schedules to allow for inspection of tank 393.

Motiva estimated that a full internal inspection of one of the spent

acid tanks required 3 months, including draining and cleaning; any

necessary repairs lengthened the out-of-service time. To accommodate this time span, Motiva management could have considered:

n Converting another fresh acid tank to spent acid.

n Slowly reducing the inventory in tank 393 by increasing shipments of acid to the regeneration contractor.

n Emptying and inspecting the tank in winter, when the usage of

spent acid was greatly reduced.

Motiva management did not pursue any of these alternatives.

3.4.2.2 EPA Inspection and

Perceived Budget Constraints

In May 2000, EPA performed a Spill Prevention, Control, and

Countermeasures (SPCC) inspection of DCR under the Federal

Water Pollution Control Act, as amended by the Oil Pollution Act of

1990. The inspection findings and EPA response are outlined below

and detailed in a Unilateral Administrative Order for Abatement of

Endangerment, dated June 22, 2000:

n EPA identified three oil storage tanks that it believed presented

“an imminent and substantial threat to the environment.” These

tanks, which showed significant corrosion, had not received an

internal inspection since they were built in the late 1950s.

Motiva was ordered to take the tanks out of service within 10

days.

n EPA identified 15 additional oil storage tanks either due for

inspection or whose external condition suggested the need for

an inspection.

EPA ordered Motiva to develop a tank inspection plan for these 18

tanks.

Motiva replied to the order with a response action plan on July 18,

2000, detailing a program to inspect all 18 tanks by September 2003.

Each switchover represented an

opportunity around which Motiva

could have planned its inventory and

acid regeneration schedules to allow

for inspection of tank 393.
61

While developing the response plan, Motiva took the opportunity to

include the inspection of 26 other tanks. This effort resulted in a plan

that would bring all Motiva tanks into inspection compliance by the

end of 2005. Under this initial plan, tank 393 was scheduled for

inspection in 2001.

In mid-2000, as the tank inspection schedules were being prepared, a

team of representatives from all Motiva and Equilon refineries (jointly

managed as the Equiva “Alliance”) was investigating tank maintenance practices. The team identified potential savings through better

management of tanks and the tank cleaning cycle. As Motiva entered

the preparation period for its year 2001 budget, these potential

savings were meted out to the individual refineries and resulted in

reduction of the DCR tank maintenance budget.

In January 2001, as a result of this budget reduction, DCR managers

re-examined the tank inspection program:

n Top priority went to two tanks that were considered imminent

environmental dangers–one had a leak at the floor-to-shell

weld, or “chime” area; and the second was a floating roof tank

whose seal area was larger than allowed by air pollution regulations.

n Second priority went to the tanks identified by EPA in its unilateral order.

Additional tanks would be scheduled for inspection as the budget

allowed.

To accommodate this budget reduction, it was decided to defer the

inspection of nine tanks–including tank 393–which were not perceived by management to present safety or environmental concerns.

Tank 393 was rescheduled for inspection from February 2001 to

January 2002. Motiva corporate management was informed of the

inspection deferral for the nine tanks at a DCR meeting in April 2001.

To accommodate [a] budget

reduction, it was decided to defer the

inspection of nine tanks–including tank

393–which were not perceived by

management to present safety or

environmental concerns. Tank 393

was rescheduled for inspection from

February 2001 to January 2002.
62

3.5 Hot Work

————————–

30 API RP 2009, Safe Welding, Cutting and Hot Work Practices in the Petroleum and

Petrochemical Industries, February 2002.

Motiva allowed hot work to proceed in the vicinity of tanks known to

have holes, which provided a pathway for sparks or slag to contact

and ignite flammable vapors inside the tank.

The contract employees had worked the catwalk repair job four

times during June and July 2001, prior to July 17. On at least two

other occasions, they arrived at the job site but did not work because

unit operators were unable to approve a hot work permit:

n Once because of high SO2 levels in the work area.

n On a second occasion (June 27) because the operator obtained

a 1 percent reading on a hand-held explosivity monitor in the

area where the work was to be performed.

After rejecting the hot work permit on June 27, the operator submitted the Unsafe Condition Report, noted earlier, which described the

holes in tanks 393 and 396.

On the day of the incident, neither the operators nor the supervisor

who approved the hot work permit–nor the contract employees

performing the work–were aware of the hazards posed by the holes

in the roofs of the acid tanks. Additionally, the contract employees

told CSB that they were not aware that spent H2SO4 contained

flammable hydrocarbons or that there could be a flammable atmosphere in the vapor space of the spent acid storage tanks.

It is generally accepted good practice to retest the area around hot

work after workers are away from the job for an extended period,

such as a lunch break, or if conditions change. API 2009 states:

For situations where the work is delayed or suspended in

an area that has previously been pronounced gas-free, the

permit system shall specify the length of time beyond

which oxygen and flammability detector tests must be

repeated or the permit reissued. . . . Periodic combustible

gas and oxygen retests (or continuous monitoring) may be

required while hot work is proceeding. . . . The permit

should specify the monitoring frequency.30

Motiva allowed hot work to proceed

in the vicinity of tanks known to have

holes, which provided a pathway for

sparks or slag to contact and ignite

flammable vapors inside the tank.

Additionally, the contract employees

told CSB that they were not aware

that spent H2SO4 contained

flammable hydrocarbons or that there

could be a flammable atmosphere in

the vapor space of the spent acid

storage tanks.

It is generally accepted good practice

to retest the area around hot work

after workers are away from the job

for an extended period, such as a

lunch break, or if conditions change.
63

Several changes occurred on the day of the incident that should have

triggered retesting or continuous monitoring:

n The ambient temperature rose from 71 degrees Fahrenheit (°F)

at 8:00 am, when the initial testing was conducted, to 85°F at

1:00 pm, near the time of the incident. As the temperature

increased, more hydrocarbons evaporated from the liquid in the

tank and entered the vapor space. As the volume of vapors

expanded, the temperature rise also increased the likelihood of

flammable vapors being released from the tank and contacted by

sparks from the hot work.

n The contract employees switched from acetylene torch cutting

to air carbon arc gouging because acetylene was not hot

enough to cut through the rusted sections of the catwalk. Air

carbon arc gouging generates significantly more sparks than oxyacetylene cutting. Motiva Form R-241H, Instructions for Issuing

Hot Work Permits, discusses air arc operations:

Air arcing involves the use of copper electrode for

heating, and approximately 80 psi air pressure.

Temperatures generated along with the air will

gouge, cut or flush metal such as stainless steel and

other hard metals. Since the air is used to blow

away the melted metal, sparks and large pieces of

molten metal are spread over a vast area which

requires strict confinement of sparks. . . . All work

requiring this type of hot work outside of vessels will

be boxed in with suitable materials to assure absolute

spark control.

n The repair work did not occur in one location, but moved from

the catwalk area near tank 396 toward tank 393.

Motiva’s “General Instructions for Issuing Safework, Hot Work, and

Entry Permits” states: “Gas tests shall be for the time duration of the

permit. If conditions may change, operations shall recommend use of

a fixed gas monitor or a personal monitor for protection.” Motiva

employees stated that they would not typically retest an area unless

requested by personnel doing the work.

There was no communication between WGI and Motiva when the

contract employees switched from oxy-acetylene to air carbon arc

gouging, and the Motiva requirement for spark control was not

The ambient temperature rose

from 71°F at 8:00 am,

when the initial testing was

conducted, to 85°F at 1:00 pm, near

the time of the incident. . . . the

temperature rise also increased the

likelihood of flammable vapors being

released from the tank . . .

There was no communication

between WGI and Motiva when the

contract employees switched from

oxy-acetylene to air carbon arc

gouging, and the Motiva requirement

for spark control was not followed.

Nonetheless, given the presence

of a flammable atmosphere

in tank 393 and the holes in the tank,

any form of hot work could have

resulted in the incident.
64

followed. Nonetheless, given the presence of a flammable atmosphere in tank 393 and the holes in the tank, any form of hot work

could have resulted in the incident.

3.6 Unsafe Condition

Report The operator who denied the hot work permit on June 27, 2001,

due to high flammable vapor readings wrote an Unsafe Condition

Report. This report was a means by which a worker could bring to

management and union attention safety and health issues that were

not adequately addressed by the worker’s immediate supervision.

Unsafe Condition Reports were rarely written and were considered

to indicate an urgent problem. The operator reported:

393 TK is still being fed a blanket (CO2) by a nitrogen

hose from the regulator on 396 TK. This hose is shoved

in a hole in the top of the 393. The hole came from a

nozzle that fell off because it was corroded so bad. 396

TK also has a (11⁄2) nozzle that fell off because it was

corroded so bad. Now it’s open to atmosphere. Note:

The one regulator is working for both tanks.

This report was distributed to acid plant department supervision, the

refinery safety department, and the joint [union/management] health

and safety committee. A copy was placed in a book in the acid plant

control room.

A safety department representative visited the area after receiving the

report and noted: “Top platform walkway is a hazard, SO2 and acid

fumes. Don’t allow access to area without air mask.” The findings of

the operator and the safety department were referred by unit supervision to a team that was formed to address safety and health issues in

the acid plant area. However, in the 3 weeks between submission of

the Unsafe Condition Report and the day of the incident, Motiva did

not correct the deficiencies noted or implement temporary safeguards.

Unsafe Condition Reports were reviewed at monthly joint safety

committee meetings. However, the June 27 report was received

after the June meeting and had not yet been discussed at the time of

the incident.
65

Although Unsafe Condition Reports were placed in the acid unit

control room, there were no requirements to ensure that operators

read the reports or were familiar with the issues. On the day of the

incident, the operators and supervisor were not aware of the holes

on the top of tanks 393 and 396.

The Unsafe Condition Report was one more factor indicating to

Motiva management the imminent hazard posed by tank 393. With

prompt attention to the report, it is likely that no work would have

been authorized near the acid storage tanks, thus preventing the

July 17 incident.

3.7 Spent Sulfuric

Acid Classification The characterization of spent H2

SO4 in oil industry material safety

data sheets (MSDS) varies widely; for example, the NFPA flammability

rating of spent acid varies from 0 to 3. However, several MSDSs from

refiners contain the following flammability data:

n “Hydrocarbons in the acid may burn and flammable hydrocarbon

gases may accumulate in the headspaces of tanks, truck trailers,

and railcars.”

n “OSHA Flammability Class–Flammable Liquid.”

The Motiva MSDS for spent H2SO4 in effect at the time of the

incident showed an NFPA fire rating of “0.” Under “firefighting

measures,” the MSDS stated: “The product is not combustible.”

There were sufficient hydrocarbons in the spent acid, in addition to

those that vaporized to form the flammable atmosphere, to burn for

one-half hour. Eyewitnesses stated that the surface of the liquid was

burning as the spent acid flowed across and out of the diked area.

The fact that Motiva installed inerting systems and flame arrestors on

the H2SO4 tanks as they were converted from fresh to spent acid

indicates that it was aware of the potential generation of flammable

vapors and the need for protection.

The contract employees who had been working on the catwalk repair

job were aware of the characteristic acid fumes from the storage tanks,

for which they wore respirators with acid-gas cartridges. However,

The Unsafe Condition Report was

one more factor indicating to Motiva

management the imminent hazard

posed by tank 393. With prompt

attention to the report, it is likely that

no work would have been authorized

near the acid storage tanks, thus

preventing the July 17 incident.

The Motiva MSDS for spent H2SO4

. . . showed an NFPA fire rating

of “0.” Under “firefighting

measures,” the MSDS stated:

“The product is not combustible.”

The contract employees . . . were

aware of the characteristic acid fumes

from the storage tanks, for which they

wore respirators with acid-gas

cartridges. However, they were

unaware of the potential flammability

of the material in the tanks.
66

they were unaware of the potential flammability of the material in the

tanks.

Based on CSB interviews with contractor personnel, it is likely that–

had they known of the hazards–they would have taken additional

precautions, such as using fire blankets to contain sparks from the hot

work. However, given the fact that there were several openings in

tank 393 and that fire blankets do not provide a barrier to flammable

vapors exiting a tank, it is not certain that any precautions–short of

banning hot work near the tanks–would have prevented the July 17

incident.

3.8 Review of

Similar Incidents 3.8.1 Pennzoil, Rouseville

An October 16, 1995, incident at a Pennzoil refinery in Rouseville,

Pennsylvania, is strikingly similar to the Motiva incident (USEPA,

1998). Welding was being conducted near a wastewater tank that

contained a layer of flammable liquid. Sparks from the welding

operation contacted flammable vapors at openings in the tank. An

internal deflagration caused the tank to fail at the bottom seam and

shoot into the air, releasing its contents, which subsequently caught

fire. Five workers were killed.

In its investigation of this incident, EPA determined that:

n After initial flammability checks in the morning, hot work was

allowed to continue as ambient temperatures rose. There were

no rechecks for flammability after a morning work break and no

use of continuous monitoring equipment.

n The tank that failed was not adequately protected from hot

work. Openings in the tank allowed ignition sources to come

into contact with flammable vapors.

n The tank did not have a frangible roof or other emergency

venting.
67

3.8.2 ARCO, Channelview

Seventeen workers were killed on July 5, 1990, at the ARCO Chemical Company in Channelview, Texas, when a 900,000-gallon tank

storing wastewater and hydrocarbons exploded. Although the tank

had a nitrogen purge system and oxygen analyzers, the investigation

determined that the nitrogen purge flow was insufficient to ensure a

nonflammable atmosphere in the tank.

On the day of the incident, the oxygen analyzer–which would have

provided warning of a flammable mixture–was malfunctioning. In

addition, the tank contained significantly more hydrocarbons than

specified in design documents. A number of possible ignition sources

were identified.

3.9 Regulatory Issues

3.9.1 Process Safety

Management Coverage

The DCR H2SO4 storage tanks were not covered under OSHA

PSM, EPA RMP, or the Delaware Accidental Release Prevention

Regulation.

3.9.1.1 OSHA Process Safety

Management

The OSHA PSM Standard (29 CFR 1910.119) is a systematic

approach to safety and the prevention of catastrophic incidents. It

requires adherence to 14 elements of good safety management for

processes containing specific chemicals or flammables if they are

present in quantities of greater than 10,000 pounds. The PSM

Standard does not cover H2SO4.

Although the amount of flammables in the spent acid storage tanks

could not be conclusively determined, Motiva believed that the tanks

were also exempt from PSM coverage under an exemption for

Although the amount of flammables

in the spent acid storage tanks could

not be conclusively determined,

Motiva believed that the tanks were

also exempt from PSM coverage

under an exemption for “flammable

liquids stored in atmospheric storage

tanks . . . which are kept below their

normal boiling point without benefit

of chilling or refrigeration” . . .
68

“flammable liquids stored in atmospheric storage tanks . . . which are

kept below their normal boiling point without benefit of chilling or

refrigeration” (29 CFR 1910.119[a][1][b]). Based on these facts,

Motiva did not cover its spent acid storage tanks under the PSM

Standard.

In 1995, an administrative law judge ruled that PSM coverage does

not extend to stored flammables in atmospheric tanks even if connected to a process.31 OSHA has not challenged this decision and

did not cite Motiva for violations of the PSM Standard in its citations

following the incident.

However, the DCR acid storage tanks were interconnected with the

alkylation process, which was covered by the PSM Standard. The

standard defines “process” as:

. . . any activity involving a highly hazardous chemical

including any use, storage, manufacturing, handling, or

on-site movement of such chemicals, or combination of

these activities. For the purposes of this definition, any

group of vessels which are interconnected and separate

vessels which are located such that a highly hazardous

chemical could be involved in a potential release shall be

considered a single process (29 CFR 1910.110[b]).

In addition, because the spent acid contained some light, flammable

hydrocarbons–which are covered by the standard–there was a

potential for a release involving a highly hazardous chemical.

3.9.1.2 EPA Risk Management

Program

The EPA RMP contains process safety management requirements that

are similar to those in the OSHA PSM Standard; however, the RMP

list of covered chemicals is more restricted. Certain toxic substances

are covered, as in PSM, but RMP covers only a specific list of extremely flammable materials. It does not cover the hydrocarbons in

the spent acid storage tanks.

————————–

31 U.S. Secretary of Labor v. Meer Corporation, OSHRC Docket No. 95-0341, 1995.

. . . the DCR acid storage tanks were

interconnected with the alkylation

process, which was covered by the

PSM Standard.
69

3.9.1.3 Delaware Accidental Release

Prevention Regulation

Delaware has had a State regulation for the management of extremely

hazardous substances since 1990–2 years before promulgation of the

OSHA PSM Standard. Delaware adopted the EPA RMP program in

1999. However, the State regulation includes some chemicals not

listed in RMP; and, for some substances, it specifes a lower threshold

quantity above which companies must comply. Nonetheless, the

Delaware regulation did not cover the DCR spent acid storage tanks.

3.9.1.4 Motiva Acid Tank Farm

PSM Activities

Motiva implemented some good process safety management practices

based on elements of the OSHA PSM Standard, including a PHA for

the tank farm and hot work permitting sitewide. However, Motiva

did not implement, or inadequately implemented, other practices,

such as:

n Ensuring the mechanical integrity of equipment–The OSHA

PSM Standard requires facilities to correct deficiencies in

equipment that are outside acceptable limits in a safe and timely

manner. Motiva management did not respond to its inspectors’

repeated calls for an internal inspection, nor did they repair the

leak that occurred in May 2001.

n Consistently applying MOC procedures–Motiva’s use of the

MOC procedure when tanks 391 and 396 were converted

from fresh to spent acid service (see Section 3.3) was inadequate, and no MOC was done when tank 393 was converted

in 2000.

If Motiva had adequately applied good process safety management

practices, as codified in the OSHA PSM Standard, it is likely that the

July 17 incident would not have occurred.

If Motiva had adequately applied good

process safety management practices,

as codified in the OSHA PSM

Standard, it is likely that the July 17

incident would not have occurred.

[Although] Delaware has had a State

regulation for the management of

extremely hazardous substances since

1990–2 years before promulgation of

the OSHA PSM Standard, . . .

[it] did not cover the DCR spent

acid storage tanks.
70

3.9.2 Jeffrey Davis Aboveground

Storage Tank Act

As a result of the Motiva incident and other incidents that were not

covered by State or Federal process safety regulations, the State of

Delaware enacted legislation in July 2002 to control the installation,

operation, maintenance, and repair of aboveground storage tanks.

The purpose of the Jeffrey Davis Aboveground Storage Tank Act–

named in memory of the WGI worker killed in the Motiva incident–is

to provide for the safe containment of petroleum and other regulated

substances in aboveground storage tanks exceeding 12,499 gallons in

capacity. The act mandates DNREC to develop regulations to

address the maintenance, inspection, upgrade, and closure of such

vessels, along with regulations for the cleanup of spills or releases to

the environment.

The legislation applies to substances covered under the Comprehensive Environmental Response, Compensation, and Liability Act

(CERCLA, 42 USC 103), liquid petroleum products, and carcinogens, as well as any other substances that DNREC may add during its

rulemaking. H2SO4 is a CERCLA hazardous substance subject to 40

CFR 302. Tanks subject to the Delaware Extremely Hazardous

Substances Risk Management Act requirements are exempt from this

legislation.

The Jeffrey Davis Aboveground Storage Tank Act directs DNREC to

enact regulatory requirements for spill prevention and control, as

summarized below:

n Product inventory or similar control system to adequately identify

tank releases.

n Procedures to follow when systems indicate abnormal loss or

gain of a substance that is not explainable by spillage, temperature variations, or other known causes.

n Corrective action in response to a tank release.

n Record of actions taken in accordance with the above items.

n Enforcement program.

n Standards to ensure against any future release from a tank being

taken out of service or reintroduced into service.

The purpose of the Jeffrey Davis

Aboveground Storage Tank Act . . .

is to provide for the safe containment

of petroleum and other regulated

substances in aboveground storage

tanks exceeding 12,499 gallons

in capacity.
71

There is also a requirement for regulations to be developed for

“appropriate inspection, maintenance, monitoring, and repair of

aboveground storage tanks . . .” The legislation further specifies

that, at a minimum, an inspection report be developed whenever a

tank is emptied for maintenance or repair or removed from service.

Inspection reports must describe the thickness of tanks and the

repairs needed; a followup completion report is required. Newly

constructed tanks require a report on welding certification, and

nondestructive testing (NDT) prior to placing the tank in-service.

In addition to submitting a copy to DNREC, all reports are to be

kept on file for the life of the tank.

DNREC was given the authority to promulgate additional regulatory

requirements consistent with the directives of the legislation. The

legislature directed DNREC to “consider” the standards and recommended practices of NFPA, API, the National Association of Corrosion Engineers (NACE) International, American Society for Testing

and Materials (ASTM), Underwriters Laboratories (UL), Petroleum

Equipment Institute (PEI), and Steel Tank Institute (STI). Current

Delaware State regulations for underground storage tanks establish

inspection and maintenance requirements through “incorporation by

reference” from several of these organizations.

With regard to tank inspection, maintenance, and repair, the legislation provides only the general requirements noted above. It does not

directly impose new requirements for periodic internal and external

tank inspections at defined intervals, such as contained in API 653,32

nor does it specify the timeframe for repairs to be completed. For

existing tanks, it requires inspection only when tanks are removed

from service or emptied for maintenance or repair. However, the

legislation does enable DNREC to promulgate more detailed requirements, including those from API and NACE International.

The legislation provides DNREC with the authority to inspect and

monitor tanks at all reasonable times as well as to obtain copies of all

records related to a regulated tank. As of July 2002, DNREC is in

the initial stages of assembling a technical advisory workgroup to

provide input on the specific regulatory requirements. It has a goal of

completing the regulation within 24 months.

————————–

32 API Standard 653, Tank Inspection, Repair, Alteration, and Reconstruction, December

1995.
72
73

4.0 Root and Contributing Causes

4.1 Root Causes

1. Motiva did not have an adequate mechanical integrity management system to prevent and address safety and environmental

hazards from the deterioration of H2SO4 storage tanks.

n The repeated recommendations of the tank inspectors that

tank 393 be taken out of service “as soon as possible” for an

internal inspection were unheeded.

n A leak in the shell of tank 393, observed in May 2001, was

not repaired. Instead, the tank liquid level was lowered

below the leak point and the tank remained in service.

n Management failed to recognize the imminent hazard posed

by the holes in tank 393 and did not promptly initiate repairs

or take the tank out of service

2. Motiva engineering management and MOC systems inadequately addressed conversion of the tanks from fresh to spent

acid service.

n The CO2 inerting supply to tank 393, installed in 2000, was

incapable of maintaining a nonflammable atmosphere.

n CO2 was supplied to tank 393 via a temporary hose run off

the inerting system of an adjacent tank. The hose was

dropped into a hole in the roof of tank 393.

n No engineering calculations were made to determine proper

sizing for the inerting system.

n The tank conversion was completed without review of

changes by technical experts, process hazard analyses, or

prestartup safety reviews–all elements of a proper MOC

program.

3. The Motiva hot work program was inadequate.

n Motiva scheduled and permitted hot work to be conducted

above and around tanks that contained flammable vapors

and had known holes; tank 393 had a leak in its shell and

open holes in its roof, and tank 396 also had an open hole in

its roof.
74

n After authorizing the hot work, Motiva management did not

institute adequate precautions to ensure worker safety, such

as continuous monitoring.

4.2 Contributing

Causes 1. The Motiva refinery system for investigating Unsafe Condition

Reports, informing workers about such reports, and tracking the

satisfactory resolution of issues was inadequate.

n In the 3 weeks between submittal of the Unsafe Condition

Report on June 27 and the day of the incident, management

did not correct the reported deficiencies or implement temporary safeguards.

n Motiva operators would likely not have authorized hot work

in the vicinity of the tank if they had understood the hazards,

nor would contract employees have conducted the work.

2. The Motiva Enterprises LLC management oversight system

failed to detect and hold Motiva refinery management accountable for deficiencies in the refinery’s mechanical integrity,

engineering management, and MOC systems.
75

5.0 Recommendations

Occupational Safety and

Ensure coverage under the Process Safety Management Standard (29 Health Administration

CFR 1910.119) of atmospheric storage tanks that could be involved

in a potential catastrophic release as a result of being interconnected

to a covered process with 10,000 pounds of a flammable substance.

(2001-05-I-DE-R1)

Delaware Department of

Natural Resources and

Environmental Control

Ensure that regulations developed for the recently enacted Jeffrey

Davis Aboveground Storage Tank Act require that facility management take prompt action in response to evidence of tank corrosion

that presents hazards to people or the environment.

(2001-05-I-DE-R2)

Motiva Enterprises–

1. Implement a system to ensure accountability for mechanical Delaware City Refinery

integrity decision making. (2001-05-I-DE-R3) Include the

following specific items:

n Review of inspection reports by subject area experts, such as

metallurgists or equipment design engineers, to ensure

adequate analysis of failure trends and suitability for intended

service.

n Establishment of a planning system to ensure the timely repair

of equipment.

The Center for Chemical Process Safety (CCPS) publication,

Plant Guidelines for Technical Management of Chemical Process

Safety, Chapter 3, “Accountability Objectives and Goals,”

presents a model for such a system.

2. Review the design of existing tankage that contains or has the

potential to contain flammables to ensure that, at a minimum

(2001-05-I-DE-R4):

n Inerting systems are installed where appropriate and are

adequately sized and constructed.

n Emergency venting is provided.
76

3. Ensure that management of change reviews are conducted for

changes to tank equipment and operating conditions, such as

(2001-05-I-DE-R5):

n Tank service and contents

n Tank peripherals, such as inerting and venting systems.

4 Revise the refinery hot work program to address the circumstances that require use of continuous or periodic monitoring for

flammables. (2001-05-I-DE-R6)

5. Upgrade the refinery Unsafe Condition Report system to include

the following (2001-05-I-DE-R7):

n Designation of a specific manager with decision-making

authority to resolve issues.

n Establishment of a mechanism to elevate attention to higher

levels of management if issues are not resolved in a timely

manner.

n Identification of a means to ensure communication of hazards

to all potentially affected personnel.

Work with the Paper, Allied-Industrial, Chemical & Energy

Workers International Union (PACE) Local 2-898 to design and

implement the improved system.

Motiva Enterprises LLC

1. In light of the findings of this report, conduct periodic audits of

storage tank mechanical integrity and design, Unsafe Condition

Reports, hot work, management of change, and accountability

systems at Motiva oil refineries. Ensure that the audit recommendations are tracked and implemented. Share the findings

with the workforce. (2001-05-I-DE-R8)

2. Communicate the findings and recommendations of this report

to the workforce and contractors at all Motiva refineries.

(2001-05-I-DE-R9)
77

American Petroleum

1. Work with NACE International (National Association of Institute (API)

Corrosion Engineers) to develop API guidelines to inspect

storage tanks containing fresh or spent H2SO4 at frequencies at

least as often as those recommended in the latest edition of

NACE Standard RP 0294-94, Design, Fabrication, and Inspection of Tanks for the Storage of Concentrated Sulfuric Acid and

Oleum at Ambient Temperatures. (2001-05-I-DE-R10)

2. Revise API tank inspection standards to emphasize that storage

tanks with wall or roof holes or thinning beyond minimum

acceptable thickness that may contain a flammable vapor are an

imminent hazard and require immediate repair or removal from

service. (2001-05-I-DE-R11)

3. Ensure that API recommended practices address the inerting of

flammable storage tanks, such as spent H2SO4 tanks. Include

the following (2001-05-I-DE-R12):

n Circumstances when inerting is recommended.

n Design of inerting systems, such as proper sizing of inerting

equipment, appropriate inerting medium, and instrumentation, including alarms.

4. Communicate the findings and recommendations of this report

to your membership. (2001-05-I-DE-R13)

NACE International

(National Association of

Corrosion Engineers)

1. Work with the American Petroleum Institute to develop API

guidelines to ensure that storage tanks containing fresh or spent

H2SO4 are inspected at frequencies at least as often as those

recommended in the latest edition of NACE Standard RP 0294-

94, Design, Fabrication, and Inspection of Tanks for the Storage

of Concentrated Sulfuric Acid and Oleum at Ambient Temperatures. (2001-05-I-DE-R14)

2. Communicate the findings and recommendations of this report

to your membership. (2001-05-I-DE-R15)
78

Paper, Allied-Industrial,

Chemical & Energy Workers

International Union (PACE)

Local 2-898

Work with Motiva management on the design and implementation of

an improved Unsafe Condition Report program.

(2001-05-I-DE-R16)

Communicate the findings and recommendations of this report to

your membership. (2001-05-I-DE-R17)

Paper, Allied-Industrial,

Chemical & Energy Workers

International Union (PACE)

National Petrochemical and

Refiners Association (NPRA)

Building and Construction

Trades Department–

AFL-CIO

Communicate the findings and recommendations of this report to

your membership. (2001-05-I-DE-R18)

Communicate the findings and recommendations of this report to

your membership. (2001-05-I-DE-R19)
79

By the

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Carolyn W. Merritt

Chair

John S. Bresland

Member

Gerald V. Poje, Ph.D.

Member

Isadore Rosenthal, Ph.D.

Member

Andrea Kidd Taylor, Dr. P.H.

Member

August 28, 2002
80
81

6.0 References

Albright, Lyle F., 2002. Report to U.S. Chemical Safety and Hazard

Investigation Board.

American Petroleum Institute (API), 2002. Safe Welding, Cutting, and

Hot Work Practices in the Petroleum and Petrochemical Industries, API Publication 2009, Seventh Edition, February 2002.

API, 1998. Venting Atmospheric and Low-Pressure Storage Tanks, API

Standard 2000, Fifth Edition, April 1998.

API, 1998. Welded Steel Tanks for Oil Storage, API Standard 650,

Tenth Edition.

API, 1995. Tank Inspection, Repair, Alteration, and Reconstruction,

API Standard 653, Second Edition, December 1995.

API, 1990. Management of Process Hazards, API RP 750, January

1990.

American Welding Society (AWS), 2000. Recommended Practices for

Air Carbon Arc Gouging and Cutting, AWS C5.3:2000.

Center for Chemical Process Safety (CCPS), 1995. Plant Guidelines

for Technical Management of Chemical Process Safety, American Institute of Chemical Engineers (AIChE).

Chemical Manufacturers Association (CMA), 1993. Managing

Process Changes: A Manager’s Guide to Implementing and

Improving Management of Change Systems.

Dean, S., and G. Grab, 1986. “Corrosion of Carbon Steel Tanks in

Concentrated Sulfuric Acid Service,” Materials Performance,

July 1986, pp. 48-52.

Dillon, C.P., 1977. Materials Selector for Hazardous Chemicals, Vol.

1: Concentrated Sulfuric Acid and Oleum, Materials Technology

Institute of Chemical Process Industries, Inc.

Engineering Systems Inc., 2002. Motiva Refinery Sulfuric Acid Tank

Collapse Consulting, prepared for U.S. Chemical Safety and

Hazard Investigation Board.

Fyfe, D., R. Vanderland, and J. Rodda, 1977. “Corrosion in Sulfuric

Acid Storage Tanks,” Chemical Engineering Progress, March

1977, pp. 65-69.
82

Lees, Frank P., 1966. Loss Prevention in the Process Industries,

Oxford: Butterworth-Heinemann, pp. 22-63.

McKetta, John J., ed., 1995. Encyclopedia of Chemical Processing

and Design, Marcel Dekker, Inc., p. 459.

NACE International (National Association of Corrosion Engineers),

1994. Design, Fabrication, and Inspection of Tanks for the

Storage of Concentrated Sulfuric Acid and Oleum at Ambient

Temperatures, NACE Standard RP 0294-94.

NACE International, 1991. Materials for the Handling and Storage

of Commercial Concentrated (90 to 100%) Sulfuric Acid at

Ambient Temperatures, NACE Standard RP 0391-01.

National Fire Protection Association, (NFPA), 1997. Standard on

Explosion Prevention Systems, NFPA 69.

U.S. Environmental Protection Agency (USEPA), 1998. EPA Chemical Accident Investigation Report, Pennzoil Product Company

Refinery, Rouseville, Pennsylvania.
83

APPENDIX A: Tank 393 History

A.1 1992–

Thickness Readings

————————–

1

 Star Enterprise Inspection Dept., Delaware City Plant, No. 92-662, 393-TC-9 (99%

Acid Storage), September 23, 1992.

2

 Star Enterprise Inspection Dept., Delaware City Plant, No. 94-485, 393-TC-9, Internal/

External Inspection, July 21, 1994.

3

 Sonoray refers to ultrasonic thickness testing of tank walls and roofs using high frequency sound waves.

 n 1992, in response to inspections of tanks 394 and 395 that

 noted corrosion, thickness measurements were taken on a section

of the tank 393 shell. This inspection noted: “Approximately half of

the corrosion allowance is used up in large sections of the entire

exposed area.” The inspectors’ recommendation at this time was to

conduct an internal inspection of tank 393 within 2 years.1

A.2 1994–

Internal Inspection

I

In 1994, the Star Enterprise inspection department conducted a

complete internal/external inspection of tank 393. There were two

key findings:

n Thickness readings of the shell indicated that general corrosion

was ongoing; however, thickness readings of the roof did not

show significant metal loss.

n The inspectors detailed:

. . . a severe corrosion groove inside the bottom shell

course approx. 4 [inches] above floor plate. Groove

is approx. 3⁄4 [inch] wide and up to 7/16 [inch] deep

and approx. 270 degrees around tank diameter.2

The corrosion groove was repaired using a buildup of weld metal. It

should be noted that this repaired area was observed to be intact after

the July 17, 2001, incident and did not contribute to the tank failure.

In 1995, in a final report on the repairs made as a result of the 1994

inspection, the inspection department noted: “At the present rate of

corrosion this tank will have used up all of the corrosion allowance for

the bottom two (2) shell courses in approx. four (4) years.” It was

recommended that the inspection department sonoray3 in 2 years to
84

monitor corrosion and calculate for continued service.4 However,

no thickness measurements were taken until 4 years later (see Section

A.3).

A.3 1998–

Shell Leak

————————–

4 Star Enterprise Inspection Dept., Delaware City Plant, No. 95-031, 393-TC-9 Sulfuric

Acid Storage, Final Report, January 16, 1995.

5

 Star Enterprise Inspection Dept., Delaware City Plant, No. 98-416, 393-TC-9 Sulfuric

Acid Storage, Shell Leak, June 23, 1998.

6

 Star Enterprise Inspection Dept., Delaware City Plant, No. 98-454, 393-TC-9, Sulfuric

Acid Storage, Follow Up to IR 98-416, Final Shell Repair and Additional Sonoray,

July 2, 1998.

In June 1998, a leak was reported in tank 393. The leak was 3⁄4 inch

long and 3/32 inch wide, located 24 inches above the course 2-tocourse 3 weld seam, or 18 feet above the bottom of the tank. The

inspection report noted:5

n Ultrasonic thickness measurements (UTM) indicate a continuing

general metal loss as compared to 1992 readings.

n The exposed sections of courses 2 and 3 are still within the 1/8-

inch corrosion allowance and above the API 653 minimum

thickness as calculated by the updated 1997 formula.

n The tank is overdue for an external sonoray survey as recommended in IR 95-031.

One month later, the inspection department did a followup inspection of the repairs. The inspection report noted:6

n Tank shell was power wire brushed per IR 98-416 [see above]

in the repair area. Low UTMs were found. Therefore, the

final repair was a 6-inch-diameter by 3/8-inch-thick carbon steel

(CS) plate welded to the shell with a 2-inch 6000# CS halfcoupling welded to the plate to cover the temporary plug repair.

A screwed plug was installed in the coupling as final closure.

n A 5-foot-wide section of courses 1 and 2 [was] stripped of

insulation for additional sonoray. This is the same area on the

west side of the tank that was stripped in 1992 per IR 92-662
85

[see above]. Comparison to 1992 readings indicates a

continued metal loss averaging 0.02 to 0.03 inch in this area.

n Remove this insulation again in 2 years to sonoray shell.

A.4 1999–

Shell Leaks

————————–

7 Motiva Enterprises LLC, 393-TC-9, Sulfuric Acid Storage Tank, Leak at West Side,

No. 99-352, April 29, 1999.

8 Motiva Enterprises LLC, Delaware City Refinery Inspection Department, 393-TC-9,

Sulfuric Acid Storage Tank, Shell Leak, No. 99-819, September 14, 1999.

In April 1999, another leak occurred on tank 393. This leak was

a 1/8-inch-diameter hole, located 18 inches above the repair made in

1998. The hole was plugged and a 12-inch-diameter CS plate was

welded over the leak area. Thickness readings were taken in the

vicinity of the leak. One reading of 0.13 inch was noted; this point

was close enough to the leak to be covered by the plate. Another

area of low thickness readings was observed directly above the area

with the hole, and an 8-inch-diameter patch was welded to the shell

to cover this thin area. The readings in the second area ranged from

0.24 to 0.15 inch. The nominal thickness for this, the third course,

was 0.312 inch.7

Another leak occurred in September 1999. This leak, a hole 1 inch

long by 3/16 inch wide, was located 12 inches below the course 3-

to-course 4 weld seam and directly above the previous leaks. Thickness readings around the hole indicated a 30-inch-long horizontal

groove inside the tank. The repair for this leak and the groove

finding was to install a 35-inch-long by 11-inch-wide by 5/16-inchthick CS patch.

A further recommendation in this inspection report stated: “Due to

recent tank failures it is recommended that this tank be taken out of

service as soon as possible for an internal inspection and sonoray

survey.”8
86

A.5 2000–

Shell Leaks

————————–

9

 Motiva Enterprises LLC, 393-TC-9, Sulfuric Acid Storage Tank, Refer to IR#99-819,

No. 00-326, April 6, 2000.

10 Motiva Enterprises LLC, 393-TC-9, Sulfuric Acid Storage Tank, Refer to IR#99-818 &

IR#00-325, No. 00-508, July 3, 2000.

In April 2000, horizontal leaks were observed in tank 393. These

leaks appeared to be the result of horizontal grooves extending

through the shell wall. The inspection report noted:

UT [ultrasonic thickness] readings revealed there is a thin

horizontal groove on the ID of the shell approximately 1/8

[inch] wide by 20 [inches] long. Readings on the grooved

area were between [0].10–[0].16 [inch] thick. The areas

adjacent to the grooved area were between [0].23–[0].27

[inch thick]. Nominal thickness of this shell course is

[0].312 [inch].

The recommended repair was to install a 12-inch-wide by 29-inchlong CS patch. This inspection report also repeated the previous

recommendation for a tank inspection: “Due to the recent leaks on

this tank it is recommended to remove this tank from service for an

internal inspection as soon as possible.”9

In July 2000, an epoxy patch–which was installed on tank 393

instead of the CS patch recommended in April–was found to be

leaking. On this occasion, the CS patch originally recommended was

finally installed. The inspection report again recommended: “This

tank to be taken out of service as soon as possible for an internal

inspection due to the corrosion on the shell.”10

A.6 2001–

Shell Leak The final leak prior to the incident was first noted in the operators’

logbook on May 5, 2001. In response to this leak, the area supervisor

advised the operators to maintain the tank level at 21 feet, or approximately 1 foot below the leak point, to prevent the release of acid.
87

The inspection report for this leak was dated June 26, 200111; the

inspectors noted:

n A visual and UT inspection revealed a 3-inch-long by 1/8-inchwide horizontal hole in the tank. The hole is approximately 1

inch above a previously installed lap patch.

n This tank has a history of leaks and internal corrosion.

The recommended 22- by 22-inch repair patch was not installed.

The inspectors also wrote: “This tank should be taken out of service

asap [as soon as possible] for an internal inspection and permanent

repair.”

————————–

11 Motiva Enterprises LLC, 393-TC-9, Sulfuric Acid Storage, No. 01-450, June 26,

2001.
88
89

APPENDIX B: Logic Diagram

Tank 393

inerting

system

inadequate

Fatality, injuries, and

environmental damage

Hot work

conducted

in vicinity of tank

with holes

Tank 393 holes allowed

contact between

flammable vapors and

sparks from hot work

A B C
90

A

Hot work conducted in

vicinity of tank with holes

Contract maintenance

workers not aware of

flammables or holes in

tanks

Operators not aware

of holes in 393

Hot work permitting

inadequate

No

continuous

monitoring

for

flammables

or retesting

after work

breaks

Change

from oxyacetylene

to air

carbon arc

gouging did

not contain

sparks

No fire

blankets

to contain

sparks

Lack of

communication

from area mgmt

about holes in

tank

Operators

moved from unit

to unit in acid

area and did not

know all that

was going on

Inadequate

Unsafe

Condition

Report system

Management

did not promptly

address report

Operators

not properly

informed
91

B

Tank 393 holes allowed

contact between flammable

vapors and sparks

from hot work

Inspectors’ calls for

internal inspection and

repairs not heeded

Accelerated localized

corrosion of carbon steel

by H2SO4

Water from

rain and

humidity

entered

tank due to

holes and

inadequate

inerting

system

Carbonic

acid

corrosion

from CO2

inerting

Water

ingress led

to reduced

acid

strength/

higher

corrosion

rates than

from acid

alone

Mgmt did

not recognize

imminent risk

External

inspection

option not

considered

Maintenance

budget cut

Inadequate

mechanical

integrity

program

No mgmt

accountability

for decisionmaking or

identification

of trends

Tank inspection

deferred from

2001 to 2002

Inadequate

mechanical

integrity

program

EPA Order

required 18

tanks to be

inspected ASAP

Operations let

inventory and

operating

issues dictate

tank inspection

timing
92

Tank 393 inerting system

inadequate

Inadequate MOC

program

Inadequate engineering

design of inerting system

No

engineering

to size

inerting

flow or

emergency

venting

393 inerting

ran off hose

from 396

system

393 vapor space

connected to

394/395,

both open to

atmosphere

MOC not

approved per

DCR procedure

- Flammable liquids

- Emergency venting

- Fire protection

- Diking

MOC review did

not adequately

evaluate hazards

No prestartup

safety review

Holes in tank

due to

corrosion

allowed air

in and

flammable

vapors out

C