U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

# INVESTIGATION REPORT

Report No. 2008

- 08 -I- WV January 2011 

# Pesticide Chemical Runaway Reaction Pressure Vessel Explosion (Two Killed, Eight Injured)



## B AYER 

## C ROP 

## S CIENCE 

## , LP INSTITUTE WEST VIRGINIA AUGUST 28, 2008 KEY ISSUES:

**•** P ROCESS H AZARDS A NALYSIS

**•** P RE -S TARTUP S AFETY R EVIEW

**•** P ROCESS S AFETY I NFORMATION AND T RAINING

**•** E MERGENCY P LANNING AND R ESPONSEi 

## Contents

EXECUTIVE SUMMARY .......................................................................................................................... 1 1.0 INTRODUCTION ........................................................................................................................... 7 1.1 Background ......................................................................................................................... 7 1.2 Investigative Process ......................................................................................................... 11 1.2.1 Agency Access to Security Related Documents .................................................. 11 1.2.2 CSB Interim Public Meeting ................................................................................ 13 1.3 Facility Description ........................................................................................................... 13 1.3.1 Institute Manufacturing Industrial Park ............................................................... 13 1.3.2 Facility Ownership History .................................................................................. 14 1.4 Bayer CropScience, LP ..................................................................................................... 15 1.4.1 Institute Operations .............................................................................................. 16 1.5 Ba yer Operating Organization .......................................................................................... 16 1.6 Process Chemicals ............................................................................................................ 18 1.6.1 Methomyl ............................................................................................................. 18 1.6.2 Phosgene .............................................................................................................. 19 1.6.3 Methyl Isocyanate ................................................................................................ 21 1.7 Meth omyl -Larvin Unit ...................................................................................................... 23 1.7.1 Methomyl Synthesis ............................................................................................ 24 1.7.2 Control System Upgrade ...................................................................................... 26 1.7.3 Residue Treater .................................................................................................... 28 2.0 INCIDENT DESCRIPTION .......................................................................................................... 33 2.1 Pre

- Startup Activities ........................................................................................................ 33 2.1.1 Solvent Flush and Equipment Conditioning ........................................................ 34 2.2 Unit Restart ....................................................................................................................... 34 2.2.1 Equipment Malfunctions ...................................................................................... 35 2.2.2 Methomyl Synthesis and Crystallization ............................................................. 36 2.2.3 Solvent Recovery ................................................................................................. 37 2.2.4 R esi due Treater Startup ....................................................................................... 38 2.3 Explosion and Fire ............................................................................................................ 40ii 2.4 Emergency Notification and Response ............................................................................. 43 2.4.1 Bayer CropScience Response .............................................................................. 43 2.4.2 Local and State Emergency Response Agencies ................................................. 44 2.4.3 Emergency Operations Center Activations .......................................................... 48 2.5 Air Monitoring .................................................................................................................. 49 3.0 INCIDENT ANALYSIS ................................................................................................................ 51 3.1 Residue Treater Replacement ........................................................................................... 51 3.2 Internal Compliance Auditing........................................................................................... 51 3.2.1 Corporate Process Safety Management Audits .................................................... 51 3.2.2 Audit Action Tracking System Upgrade.............................................................. 52 3.2.3 Process Safety Management Self Assessments ................................................... 52 3.3 Process Hazards Analysis ................................................................................................. 53 3.3.1 PHA Duration and Staffing Deficiencies ............................................................. 53 3.3.2 PHA Assumptions Deficiencies ........................................................................... 53 3.3.3 Inadequate Process Safety Information Reviews ................................................. 55 3.3.4 Analysis Deficiencies .......................................................................................... 56 3.4 Pre

- Startup Safety Review ................................................................................................ 57 3.5 Human Factors Deficiencies ............................................................................................. 58 3.5.1 Control System Upgrade ...................................................................................... 58 3.5.2 Operator Training ................................................................................................ 60 3.5.3 Operator Fatigue .................................................................................................. 63 3.6 Shift Change Communications ......................................................................................... 63 3.7 Procedure Deficiencies ..................................................................................................... 64 3.8 Process Chemistry Problems ............................................................................................ 65 3.9 Unit Restart Equipment Problems .................................................................................... 69 3.9.1 Residue Treater Heater Performance ................................................................... 69 3.9.2 Broken, Missing, and Misaligned Valves ............................................................ 70 3.9.3 Other Process Equipment Problems..................................................................... 73 3.10 A ir Monitoring Systems Deficiencies ............................................................................... 74 3.10.1 Fenceline Air Monitors ........................................................................................ 74 3.10.2 Unit Air Monitors ................................................................................................ 75 3.11 Organizational Deficiencies .............................................................................................. 76iii 3.12 Previous Methomyl

- Larvin Unit Incident ......................................................................... 78 3.13 Emergency Planning and Response .................................................................................. 79 3.13.1 National Incident Management System ............................................................... 79 3.13.2 Kanawha Putnam Emergency Planning Committee ............................................ 81 3.13.3 Kanawha Putnam Emergency Management Plan ................................................ 81 3.13.4 Chemical Release Notification Law .................................................................... 82 3.14 Incident Response and Communication Deficiencies ....................................................... 83 3.14.1 Bayer CropScience Facility ................................................................................. 83 3.14.2 Facility and Emergency Responders’ Communications ...................................... 84 3.14.3 Kanawha Valley Emergency Com munications Process Improvement Initiatives ............................................................................................................. 85 3.15 Environmental Impact ....................................................................................................... 87 3.16 MIC Day Tank Blast Shield Analysis ............................................................................... 88 4.0 METHYL ISOCYANATE RISK REDUCTION AT THE INSTITUTE FACILITY ................... 90 4.1 Congressional Action ........................................................................................................ 90 4.2 Alte rnative MIC Technology Analysis History ................................................................ 91 4.2.1 Union Carbide Corporation Studies ..................................................................... 91 4.2.2 Rhone-Poulenc Studies ........................................................................................ 92 4.2.3 Bayer CropScience Studies .................................................................................. 93 4.3 Bayer CropScience MIC Storage Reduction .................................................................... 93 5.0 REGULATORY ANALYSIS ........................................................................................................ 95 5.1 Occupational Safety and Health Admin istration .............................................................. 95 5.1.1 Process Safety Management Program ................................................................. 95 5.1.2 PSM Inspections at the Bayer Facility ................................................................. 95 5.1.3 PSM Program Deficiency Findings in Other CSB Investigations ....................... 96 5.1.4 OSHA PSM Chemical National Emphasis Program ........................................... 98 5.1.5 OSHA PSM Citations Follow

- up Deficiencies .................................................... 98 5.2 Environmental Protection Agency Risk Management Program ....................................... 99 5.2.1 Application of the Bayer CropScience Risk Management Program .................... 99 5.2.2 E P A Inspections at the Bayer Institute Facility ................................................. 101 5.2.3 EPA Office of Inspector General Risk Management Program Review ............. 102iv 5.3 State and Local Government Programs .......................................................................... 103 5.3.1 Contra Costa County California Hazardous Materials Safety Ordinance .......... 103 5.3.2 New Jersey Toxic Catastrophe Prevention Act ................................................. 105 5.3.3 Hazardous Materials Regulatory Oversight in West Virginia ........................... 107 6.0 KEY FINDINGS .......................................................................................................................... 109 6.1 Process Hazard Analysis ................................................................................................. 109 6.2 Pre

- Startup Safety Review .............................................................................................. 109 6.3 Methomyl Unit Startup ................................................................................................... 110 6.4 MIC Day Tank Shield Structure Design ......................................................................... 111 6.5 Emergency Planning, Response, and Communication ................................................... 111 6.5.1 Bayer CropScience ............................................................................................ 111 6.5.2 Outside Responding Agencies ........................................................................... 112 6.5.3 Kanawha County Commission .......................................................................... 112 6.6 Environmental Impact ..................................................................................................... 112 6.7 Regulatory Oversight ...................................................................................................... 112 7.0 INCIDENT CAUSES .................................................................................................................. 113 8.0 RECOMMENDATIONS ............................................................................................................. 114 8.1 Bayer CropScience – Research Triangle Park, NC ......................................................... 114 8.2 Ba yer CropScience - Institute, West Virginia ................................................................. 114 8.3 Director of the Kanawha -Charleston Health Department ............................................... 116 8.4 Secretary of West Virginia Department of Health and Human Services and the West Virginia Department of Environmental Protection ................................................ 118 8.5 Kanawha -Putnam Emergency Planning Committee ....................................................... 118 8.6 West Virginia State Fire Commission ............................................................................ 119 8.7 Occupational Safety and Health Administration ............................................................ 119 8.8 Environmental Protection Agency .................................................................................. 120 9.0 REFERENCES ............................................................................................................................ 121 APPENDIX A – CAUSAL ANALYSIS CHARTS ................................................................................. 123 APPEN DIX B – EMERGENCY RESPONSE T IMELINE ...................................................................... 134 APPENDIX C – METHYL ISOCYANATE DA Y TANK BLAST SHIELD ANALYSIS .................... 139 APPENDIX D – BAYER CROPSCIENCE PR ESS RELEASE ANNOUNCI NG INSTITUTE FACILITY MIC STORAGE REDUCTION ................................................................. 159v 

## Figures Figure 1. Residue treater came to rest inside the Methomyl -Larvin unit ...................................................... 8 Figure 2. MIC day tank shield blanket structure ........................................................................................... 9 Figure 3. Institute Manufacturing Industrial Park ....................................................................................... 14 Figure 4. Seven tenants own or operate processes at the Institute Industrial park ...................................... 15 Figure 5. Institute site org anization structure. ............................................................................................. 18 Figure 6. Aerial view of Bay er Institute Manufacturing Park .................................................................... 23 Figure 7. Overhead view of the Methomyl-Larvin production unit ............................................................ 24 Figure 8. Methomyl synthesis process flow ................................................................................................ 25 Figure 9. Methomyl centrifuge and solvent recovery proce ss flow ............................................................ 26 Figure 10. Residue treater piping system layout ......................................................................................... 29 Figure 11. Residue treater process variables before the explosion. ............................................................ 39 Figure 12. Re sidue treater bottom head ; v essel shell and top head ............................................................ 41 Figure 13. Residue treater shell and top head recovered from inside the Methomyl- Larvin unit ............... 41 Fi gu re 14. Structural column ripped from the steel baseplate .................................................................... 42 Figure 15. Aerial view of locations of reported offsite property damage ................................................... 43 Figure 16. Methomyl unit explosion emergency communications diagram ............................................... 46 Figure 17. Areas and population affected by the shelter- in

- place .............................................................. 47 Figure 18. Typical Siemens work station screen display ............................................................................ 59 Figure 19. Indicated steam flow through th e residue treater heater. ........................................................... 72 Figure 20. Closed steam block valve recovered from residue treater heater steam supply valve ............... 72 Figure 21. NIMS incident command structure ............................................................................................ 80



## Tables Table 1. Characteristics of the toxic chemicals used to manufacture methomyl ........................................ 20 Table 2. New Metro 9 -1- 1 questionnaire for fixed chemical facilities (Courtesy Metro 9 -1-1) ................ 86 Table 3. Common PSM program deficiencies identified in CSB investigations ........................................ 97 Table 4. RMP covered chemicals in the Methomyl/Larvin unit ............................................................... 100vi 

## Acronyms and Abbreviations

ATF U.S. Bureau of Alcohol, Tobacco, and Firearms, and Explosives CAD (Emergency Operations Center) Computer aided dispatch CCPS Center for Chemical Process Safety CFR Code of Federal Regulations CPQRA Chemical process quantitative risk assessment CSB U.S. Chemical Safety and Hazard Investigation Board DCS Distributed control syst em DEP Department of Environmental Protection DMDS Dimethyl disulfide ECC East Carbamoylation Center EHA Extraordinarily hazardous substance EMS Emergency Medical Services EOC Emergency Operations Center EPA U.S. Environmental Protection Agency FDA U.S. Food and Drug Administration FIFRA Federal Insecticide, Fungicide and Rodenticide Act fps feet per second GUI Graphical user interface HAZOP Hazard and operability study HSE U.K. Health and Safety Executive IC Incident Commander ICS Incident Command System IDLH Immediately dangerous to life or health IR Infrared radiation KCEAA Kanawha County Emergency Ambulance Authority KCSD Kanawha County Sheriff’s Department KPEPC Kanawha -Putnam County Emergency Planning Committee LOPA Layer of Protection Analysis

m 3 cubic meter MAWP Maximum allowable working pressure mg milligram MIBK Methyl isobutyl ketonevii MIC Methyl isocyanate MOCR Management of change review MSAO Methylthioacetaldoxime (also called Oxime) MSDS Material Safety Data Sheet MSS MIC stripping still NAS National Academy of Sciences NIMS National Incident Management System NIOSH The National Institute for Occupational Safety and Health OES West Virginia State Office of Emergency Services OIG Office of Inspector General OSHA U.S. Department of Labor, Occupational Safety and Health Administration PEL Permissible exposure limit PFD Probability of failure on demand PHA Process hazard analysis PIO Public Information Officer ppm parts per million PSSR Pre

- startup safety review PSM Process Safety Management (29 CFR 1910.119) REL Recommended exposure limit RHS Reactive Hazard Substance RMP Risk Management Program (40 CFR 68) RRT Regional Response Team SOP Standard operating procedure TCPA (New Jersey) Toxic Catastrophe Prevention Act TLV Threshold limit value TQ Threshold quantity (OSHA PSM or EPA Risk Management Program) UCC Union Carbide Corporation UCS Unified Command System VOC Volatile organic compound WCC West Carbamoylation Complex1 

## Executive Summary
On August 28, 2008, at about 10:35 p.m., a runaway chemical reaction occurred inside a 4 ,500 gallon pressure vessel known as a residue treater, causing the vessel to explode violently in the methomyl unit at the Bayer CropScience facility in Institute, West Virginia. Highly flammable solvent spray ed from the vessel and immediately ignited, causing an intense fire that burned for more than 4 hours. The fire was contained inside the Methomyl

- Larvin insecticide unit by the Bayer CropScience fire brigade with mutual aid assistance from local volunteer and municipal fire departments. The incident occurred during the restart of the methomyl unit after an extended outage to upgrade the control system and replace the original residue treater vessel. Two company employees who had been dispatched by the control room personnel to investigate why the residue treater pressure was increasing were near the residue treater when it ruptured. One died from blunt force trauma and burn injuries sustained at the scene ; the second died 41 days later at the Western Pennsyl vania Burn Center in Pittsburgh, Pennsylvania. Six volunteer firefighters who assisted in the unit fire suppression activities and two contractors working at the facility were treated for possible toxic chemical
exposure. The Kanawha-Putnam County Emergency Management Director advised more than 40,000 residents, including the resident students at the West Virginia State University adjacent to the facility, to shelter

- in -place for more than three hours as a precaution. The fire and drifting smoke forced the state police and local law enforcement authorities to close roads near the facility and the interstate highway, which disrupted traffic for hours. The Chemical Safety Board (CSB) investigation team determined that the runaway chemical reaction and loss of containment of the flammable and toxic chemicals resulted from deviation from the written start -up procedures, including bypassing critical safety devices intended to prevent such a condition. Other contributing factors included an inadequate pre -startup safety review; inadequate2 operator training on the newly installed control system; unevaluated temporary changes, malfunctioning or missing equipment, misaligned valves, and bypassed critical safety devices; and insufficient technical expertise available i n the control room during the restart. Poor communications during the emergency between the Bayer CropScience incident command and the local emergency response agency confused emergency response organizations and delayed public announcements on actions that should be taken to minimize exposure risk. Although Bayer CropScience reported that “no toxic chemicals were released because they were consumed in the intense fires,” the CSB later confirmed that the only air monitors suitably placed near the unit to d etect toxic chemicals were, in fact, not operational at the time of the incident. No reliable data or analytical methods were available to determine what chemicals were released, or predict any exposure concentrations. The methomyl unit used the highly to xic chemical, methyl isocyanate (MIC), in a series of complex chemical reactions to produce methomyl, a dry chemical used to make the pesticide, Larvin. MIC is manufactured in a separate production unit at the facility and stored in large underground press ure vessels. Liquid MIC was pumped to a “day tank” pressure vessel near the Methomyl -Larvin unit, which provided the daily production quantity of MIC for the methomyl unit and the carbofuran unit, which is about 200 feet west of the methomyl unit. The MIC storage tank adjacent to the methomyl unit and the MIC transfer piping between the production unit and the manufacturing units were not damaged, nor did the MIC storage tank overheat or pressurize above the operating limits during the fire.3 The CSB invest igation identified the following incident causes:

1. Bayer did not apply standard Pre

- startup Safety Review ( PSSR ) and turnover practices to the

m ethomyl control system redesign project . T he equipment was not tested and calibrated before the unit was restarte d. 2. Operations personnel were inadequately trained to operate the methomyl unit with the new distributed control system (DCS). 3. Malfunctioning equipment and the inadequate DCS checkout prevented the operators from achieving correct operating conditions in th e crystallizers and solvent recovery equipment

. 4. The out-of- specification methomyl

- solvent mixture was fed to the residue treater before the residue treater was pre -filled with solvent and heated to the minimum safe operating temperature. 5. The incoming proce ss stream normally generated an exothermic decomposition reaction, but methomyl that had not crystallized due to equipment problems greatly increased the methomyl concentration in the residue treater, which led to a runaway reaction that overwhelmed the re lief system and over - pressurized the residue treater.

Many industrial facilities in the Kanawha river valley that surrounds Charleston, West Virginia, the state capital, handle thousands of pounds of toxic and flammable materials. Local community involvement in safe handling of hazardous chemicals and emergency planning and the Kanawha Valley Industrial Emergency Planning Council date back to the 1950s. In 1995, the planning council was renamed the Kanawha Putnam Emergency Planning Committee, which functions as the local emergency planning committee (LEPC) as required by the Superfund Amendments and Reauthorization Act, Emergency Planning and Community Right- to

- Know Act (SARA Title III). Although federal law requires the owner or operator of the facility to promptly provide information to the LEPC necessary for developing and implementing the emergency plan [EPCRA 303(d)(3)], it does not provide LEPCs or other local agencies with the authority to conduct reviews of facility process safety programs or directly participate in hazard reviews or incident investigations. A few4 state governments have passed laws that authorize local governments to become directly involved with industry process safety programs. For example, the New Jersey Toxic Catastrophe Prevention Act, 1 created in 1986, significantly expands the requirements contained in the U.S. Environmental Protection Agency Risk Management Program (40 CFR68). In 1999, the Contra Costa County, California Board of Supervisors approved an industrial safety o rdinance 2

Like Contra Costa County, the Kanawha valley has many facilities that handle large quantities of hazardous materials, some of which are acutely toxic. Furthermore, the valley contains environmentally sensitive areas such as the Kanawha River, w hich is an important transportation corridor. Yet, the local government does not have the authority to directly participate in facility safety planning and oversight even though many community stakeholders have long campaigned for such authority and involvement. The local government could adopt regulations and implement a program similar to Contra Costa County that would likely improve stakeholder awareness and improve emergency planning and accident prevention. that established broad authority to the county health services department to oversee local refining and chemical industries. The ordinance includes mandatory safety plan submission by regulated industries, and audit and facility inspections by t he county.

The Bayer CropScience investigation was the agency’s first case involving company assertions of Sensitive Security Information (SSI) under the Maritime Transportation Security Act of 2002. Federal law requires a company to mark all SSI containing documents and notify the recipient that the documents must be controlled in accordance with Department of Homeland Security regulations. Early in the investigation, Bayer CropScience management asserted that most of their records contained SSI information, and therefore the CSB was prohibited from releasing it to the public. The

1 New Jersey Administrative Code Title 7 Chapter 31. 2 Contra Costa County, California, Ordinance Code Title 4 – Health and Safety, Division 450 – Hazardous

Materials and Wastes, Chapter 450

- 8 – Risk Management.5 CSB consulted with the U.S. Coast Guard and determined that the Bayer claim was without basis. The president of Bayer CropScience, LP later admitted in testimony to the U.S. House of Representatives Committee on Energy and Commerce “[ W] e concede that our pursuit of SSI coverage was motivated, in part, by a desire to prevent that public debate [concerning the use of MIC] from occurring in the first place.” 3
The controversy created by the SSI issue and the Bayer CropScience admission pr ompted the U.S. Congress to enact legislation to amend Section 70103(d) of Title 46, United States Code. The new law, titled ‘‘American Communities’ Right to Public Information Act,’’ prohibits designating information to be SSI to “prevent or delay the release of information that does not require protection in the interest of transportation security, including basic scientific research information not clearly related to transportation security.” Ever since the 1984 tragic accident in Bhopal, India, which released highly toxic MIC into the community and killed thousands of nearby residents, many in the Kanawha valley community have tried to convince the owners of the Institute facility to drastically reduce or eliminate MIC. In fact, the Institute facility is the only facility in the United States that stores and uses large quantities of the highly toxic chemical. The August 2008 incident, which could have caused an MIC release into the nearby community, reinvigorated community pressure to reduce the MIC risk to the public. In 2009, the U.S. House of Representatives Committee on Energy and Commerce asked the CSB to provide recommendations to Bayer CropScience, and federal and state regulators to “reduce the dangers posed by on- site storage of MIC.” Many of the recommendations contained in this report address that request. Also in 2009, the U.S. Congress appropriated $600,000 to the CSB to directly

3 S tatement of W illiam B. Buckner, president and chief executive officer of B ayer C rop S cience, LP before the

U.S. House of Representatives Committee on Energy and Commerce Subcommittee on Oversight and Investigations, April 21, 2009.6 fund a study “by the National Academy of Sciences to examine use and storage of MIC...and feasibility of implement ing alternative chemicals or processes at the facility.” Bayer CropScience has taken specific action to reduce the risk of an incident involving MIC. Thecompany did not rebuild the damaged methomyl unit and discontinued production of two of the MICbased pesticides. The company also made an investment of more than $25 million to redesign and modify the MIC production unit to significantly reduce the on- site inventory of MIC and make other process upgrades to reduce the risk associated with handling large quantities of MIC. The improvements including eliminating the aboveground MIC storage vessels and replacing the underground storage vessels were scheduled to be completed by late 2010. In January 2011, Bayer announced it would eliminate the production of the two remaining carbamate pesticides, aldicarb and carbaryl, during 2012 and end all production, use, and storage of MIC. Based on the findings of this report recommendations are made to Bayer CropScience located in Research Triangle Park, North Carolina, and in Institute, West Virginia. The Board also makes recommendations to the Secretary of the West Virginia Department of Health and Human Resources Commissioner of the Kanawha

- Charleston Health Department , the West Virginia State Fire Commission, Kanawha Putnam Emergency Planning Committee, the Environmental Protection Agency, and the Occupational Safety and Health Administration. Implementation of the recommendations will improve hazardous chemicals management, and improve local government and community involvement with companies that use large quantities of hazardous chemicals.7 

## 1.0 Introduction
1.1 Background On August 28, 2008, at about 10:25 p.m., two Bayer CropScience employees at the Institute, West Virginia, manufacturing fac ility were asked to investigate why pressure was unexpectedly increasing in the residue treater, a pressure vessel located on the s outh side of the Methomyl

- Larvin unit about midpoint along an adjacent road. About 10 minutes later, as they approached the n ewly installed residue treater, it suddenly and violently ruptured. Approximately 2,200 gallons of flammable solvents and toxic insecticide residues sprayed onto the road and into the unit and immediately erupted in flames as severed electrical cables or s parks from steel debris striking the concrete ignited the solvent vapor. Debris was thrown in all directions, some hundreds of feet. The 5,700-pound residue treater ripped out piping, electrical conduit, and a structural steel support column as it split apart and careened northeast into the Methomyl-Larvin production unit structure ( Figure 1 ). The blast overpressure moderately damaged the unit control building and other nearby structures. Flying debris struck the protective steel shield blanket surrounding a 6,700- gallon methyl isocyanate (MIC) “day tank” located about 70 feet southwest of the residue treater ( Figure 2 ), but did not damage the day tank. The steel blanket also protected the MIC day tank from the radiant heat generated by the nearby fires that burned for more than 4 hours. One employee died at the scene from blunt fo rce trauma and thermal burn injuries. Responding unit personnel helped the second employee out of the unit. He was transported to the Western Pennsylvania Burn Center in Pittsburgh, Pennsylvania, and died 41days later. Five Tyler Mountain firefighters and one Institute firefighter who assisted the Bayer CropScience fire brigade at the unit reported possible chemical exposure symptoms. Two Norfolk Southern railroad employees working8 at the facility the night of the incident also reported chemical exposure symptoms. None reported acute or long

- term effects. Doctors identified heat exhaustion in at least two of the cases.

Figure 1 . Residue treater came to rest inside the Methomyl

- Larvin unit

The in

- house fire brigade immediately responded to the incident. The Tyler Mountain and Institute Volunteer Fire Departments also arrived at the front gate of the facility to assist the fire brigade as planned in the mutual aid emergency response protocol. However, poor communications with the
Metro 9 -1- 1 call center delayed the community shelter

- in

- place notification and interfered with effective off

- site response activities. The St. Albans, West Virginia, fire chief, unable to obtain specific information about the chemicals involved or the ex tent of the incident, prepared to issue a shelter

- in

- place for his community after he assumed that the smoke drifting across the river might contain toxic chemicals. After many unsuccessful attempts to communicate directly with the Bayer incident commander (IC) during the first hour of the incident, the Kanawha/Putnam County Emergency Management director declared a9 shelter

- in -place, which affected approximately 40,000 residents. Approximately 3 hours later county authorities lifted the shelter

- in

- place abou t 3 hours later.

Figure 2 . MIC day tank shield blanket structure
As far as 7 miles from the explosion epicenter, residences, businesses, and vehicles sustained overpressure damage that included minor structural and minor exterior damage and broken windows. Acrid, dense smoke billowed from the fire into the calm night air for many hours. Smoke drifted over Interstate 64 and nearby roads to the north of the facility, forcing many road closures and disrupting highway traffic.10 Methomyl and solvents were released from the residue treater, and solvents and other toxic chemicals were released from ruptured unit piping including flammable and toxic MIC. The released chemicals rapidly ignited, producing undetermined combustion products. MIC air monitoring devices in and near the Methomyl

- Larvin unit were not operational the night of the incident. Only two fenceline air monitors were operational, but they were more than 800 feet away and not located downwind of the smoke; in addition these fe nceline monitors were only designed to detect carbon monoxide, hydrogen sulfide, flammable gas and oxygen. The four-gas air monitors 4

The incident occurred during the first methomyl restart after an extended outage to install a new process control system and replace the old carbon steel residue treater with a stainless steel pressure vessel with equivalent pressure and temperature operating limits. The residue treater was designed to decompose methomyl in a heated methyl isobutyl ketone (MIBK) solvent . During normal operations, dissolved methomyl and other waste chemicals were fed into the preheated residue treater partially filled with solvent. The methomyl safely decomposed inside the residue treater to a concentration of less than 0.5 percent by weight. worn by emergency responders did not detect hazardous chemicals in the air near the unit. There were no reports of river water contamination from fire suppression water runoff.

5

On the night of the incident, methomyl-containing solvent was pumped into the residue treater before the vessel was pre

- filled with clean solvent and heated to th e required minimum operating temperature specified in the operating procedure. The emergency vent system was overwhelmed by the evolving gas from the runaway decomposition reaction of methomyl, and the residue treater The liquid was then transferred to an auxiliary fuel tank where it was mixed wi th other flammable liquid waste materials and used as a fuel in one of the facility boilers.

4 Fire department and other emergency responder personnel typical ly wear a “four

- gas air monitor” to measure

concentrations of carbon monoxide and hydrogen sulfide, flammable gas, and oxygen concentration. An alarm sounds if any of the measured gases exceed the setpoint programmed in the detector. 5 All percent values used in the report are weight percent unless noted.11 violently exploded. The estimated energy of the explosion was equivalent to about 17 pounds of TNT (See Appendix C).


## 1.2 Investigative Process The CSB investigation team arrived at the Bayer CropScience facility the morning of August 30, 2008, and met with the Bureau of Alcohol, Tobacco, and Firearms and Explosives (ATF), Occupational Safety and Health Administration (OSHA) investigators, and Bayer management personnel to explain the CSB purpose and authority for conducting an investigation independently of other agencies and organizations. On September 2, 2008, the ATF concluded that the incident was not a criminal act and ceased its on

- scene investigative activities. Over the following 6 weeks, the CSB investigators examined and photographed the residue treater and associated process equipment; MIC day tank, blast blankets, and support structure; surveyed the control building damage; mapped the debris field; interviewed employees working at the facility on the night of the incident; and interviewed outside emergency personnel who participated in the response. The team examined methomyl unit operating procedures, control system data, process chemistry documents, worker training records, and maintenance records. Finally, the CSB commissioned computer modeling to evaluate the blast shield used to prot ect the MIC day tank.



### 1.2.1 Agency Access to Security Related Documents The Bayer CropScience investigation is the first incident investigated by the CSB that involves the Maritime Transportation Safety Act 6 and Sensitive Security Information (SSI). SSI is information that, if publicly released, would be detrimental to transportation security. 7

6 46 U.S.C. § 70102 Federal law requires a company to mark all documents containing SSI and to notify the recipient that the documents m ust be controlled in accordance with Department of Homeland Security regulations. Bayer’s attempts to use

7 49 CFR 1520.12 the SSI designation to suppress public disclosure of information related to the investigation forced the CSB to delay the planned interim public meeti ng and ultimately led to congressional action to prevent future misuse of the regulation. In January 2009, the Head of the Health, Safety, and Environment Expertise Center at the Bayer CropScience Institute facility contacted the U.S. Coast Guard Commandi ng Officer, Marine Safety Unit in Huntington, West Virginia and suggested “to discuss this [SSI] further with your headquarters so that we can better communicate to the CSB and possibly discourage them from even seeking this information.” 8

The controversy created by raising the SSI issue to restrict CSB investigative activities resulted in the U.S. Congress enacting legislation on October 8, 2009, to amend Section 70103(d) of title 46, United States Code. The new law, titled the “Amer ican Communities’ Right to Public Information Act” Then, in March 2009, Bayer CropScience sent a letter to the CSB asserting that many of the documents already delivered to the CSB contained SSI and requested the documents be returned to them so each page could be marked as required by the regulation. The company also cl aimed photos, interview records, and other CSB produced investigatory documents might contain SSI. The CSB declined the request to return the documents and a later request to examine the documents at the CSB office and directed Bayer CropScience to properl y label and resubmit all SSI containing documents. Bayer CropScience officials later admitted they had attempted to use the Maritime Transportation Safety Act to block public disclosure of information related to methyl isocyanate and possible negative publ icity.

9

8 E- mail from the Head, Health, Safety, and Environment Expertise Center, Bayer CropScience, to the

Commanding Officer, Marine Safety Unit Huntington, U.S. Coast Guard (Jan. 29, 2009). added the following restriction on SSI claims:

9 Public Law 111

- 83.13 ‘‘(d) N ondisclosure of i nformation, 2) L imitations .—Nothing in paragraph (1) shall be construed to authorize the designation of information as sensitive

sec urity information (as defined in section 1520.5 of title 49,Code of Federal Regulations ; (A) to conceal a violation of law, inefficiency, or administrative error; (B) to prevent embarrassment to a person, organization, or agency; (C) to restrain competiti on; or (D) to prevent or delay the release of information that does not require protection in the interest of transportation security, including basic scientific research information not clearly related to transportation security.



### 1.2.2 CSB Interim Public Meetin g On April 28, 2009, the CSB held a public meeting in Institute, West Virginia, which was attended by more than 250 people. The investigation staff presented the incident timeline, described the processes and equipment involved, described the county emerge ncy response activities, and summarized the preliminary findings of the investigation. The meeting included presentations from Bayer CropScience, the West Virginia State Fire Marshal, the Kanawha Putnam County Emergency Management Director, a representative from the International Association of Machinists, a chemical industry expert, and a representative from the community advocacy group People Concerned about Methyl Isocyanate. The Board also heard testimony from 16 people in attendance including residents who live near the facility, the president of West Virginia State University, workers from Bayer CropScience, and other interested individuals.


## 1.3 Facility Description 1.3.1 Institute Manufacturing Industrial Park The Institute facility is located 9 miles west of Charleston, West Virginia, and is bordered on the north by Route 25 and Interstate 64, on the east by the West Virginia State University, and along the14 south by the Kanawha River. St. Albans, West Virginia, is across the river 3 miles west ( Figure 3 ). Raw materials and products used or manufactured at the facility are transported by truck, rail, and barge.

Figure 3 . Institute Manufacturing Industrial Park



### 1.3.2 Facility Ownership HistoryThe site was originally Wertz Field Airport and closed in 1942 to become a large, governmentsponsored synthetic rubber production plant for the World War II effort managed by the Carbide and Carbon Chemicals Corp oration and the United States Rubber Company. In 1947, the Union Carbide Corporation (UCC) purchased the plant to produce carbamate insecticides. In 1986, Rhone-Poulenc, a French -owned chemical company, purchased the agricultural division of UCC and operat ed the Institute facility until 2000. Aventis, formed by a merger of Rhone-Poulenc and AgrEvo, took over the facility until Bayer CropScience acquired it in 2002.15 In August 2008, the 460- acre, multi -tenant Institute Manufacturing Industrial Park employed approximately 645 workers. The seven tenants on the facility included Bayer CropScience, Adisseo, FMC Corporation, Dow Chemical, Catalyst Refiners, Reagent Chemical, and Praxair ( Figure 4 ). The site contains 16 production units and five utility and support units. Some of the tenants produce chemicals that are used as feedstocks in units owned or operated by other tenants.

Figure 4 . Seven tena nts own or operate processes at the Institute Industrial park
Bayer owns and operates nine production and utility units. Two additional process units are operated by Bayer employees under contractual agreements with the unit owners, Adisseo, and FMC. Bayer employs approximately 545 at the Institute facility.


## 1.4 Bayer CropScience, LP Bayer CropScience is an independently operated company within Bayer, AG, (Bayer Group) which is the chemical and pharmaceutical parent company headquartered in Leverkusen, Germany. Bayer CropScience, Bayer HealthCare, and Bayer Material Science make up the three business areas of the Bayer Group.16 The Bayer CropScience business, headquartered in Monheim, Germany, employs more than 18,000 personnel in more than 120 countries. A 12- member global executive committee, including the Bayer Board of Management chairperson, manages Bayer CropScience. Executive committee members oversee research, operations, planning, and administrative functions, as well as regional business

areas. A 12 -member supervisory board composed of Bayer Group executives, independent experts, and trade union representatives comprise a supervisory board to oversee company operations. The Bayer CropScience U.S. headquarters is in Research Triangle Park, North Carolina. Bayer CropScience (Bayer) is a global provider of crop protection agents, such as insecticides, herbicides, and fungicides for commercial and private consumer use. The Crop Protection division serves the agriculture sector and the BioScience divi sion uses gene technology to produce genetically modified crops as an alternative to conventional pesticide applications. The Environmental Science division provides services for professional weed and pest control customers.



### 1.4.1 Institute Operations Bayer has three insecticide manufacturing complexes on the Institute site supported by two powerhouses and a wastewater treatment unit. The East Carbamoylation Complex (ECC) includes the MIC and Phosgene production unit and the Aldicarb and Carbaryl units. The MIC and phosgene production unit supplies feedstock to the Aldicarb and Carbaryl unit for the production of insecticides. The Methomyl

- Larvin ® unit occupied the West Carbamoylation Complex (WCC), along with the FMC -owned carbosulfan and carbofuran unit, which was operated by Bayer. The Adisseoowned Rhodimet ® unit makes up the third complex that Bayer also operates.


## 1.5 Bayer Operating Organization For many years the methomyl unit operated in a traditional organizational structure for chemical plant operating units; that is, with a first -line supervisor who directed the work of a team of operators. Four operating crews typically covered rotating shifts, and each team included a supervisor and a crew of17 operators. The supervisor’s responsibilities included monitoring the operators’ work to ensure that they were successful ly running the process and included completing administrative tasks for those operators, such as scheduling, payroll, sick- time call -out, safety and health, and other supervisor duties. T he supervi sor and the operators worked the same rotating shift, and except when filling in as substitutes on other shifts or units for worker vacations and sick days, the operators reported directly

to the same supervisor when they worked their normal schedule. The operators worked with the supervisor an average of 40 hours per week. If the operators had questions about their job or administrative procedures, they generally asked the supervisor who was in the unit with them at that time. From 2004 to 2007, Bayer management analyzed and restructured the unit supervisory and technical oversight staffing. First -line supervisor positions in each operating unit were eliminated and selfdirected, or self- empo wered work teams were implemented. Four teams of operators worked rotating shifts, supported by a Technical Advisor and Run Plant Engineer, both day- shift workers. Instead of a first

- line supervisor, all operators including the Technical Advisor report to the Production Leader ( Figure 5 ). A single Industrial Park Site Shift Leader, which management describes as a “first among equals,” is responsible for all facility op erations, rotates on shift with the shift operators, and oversees site operations. Some personnel in the Shift Leader role have prior experience as first- line supervisors on various operating units. However, the Shift Leader is not a first

- line supervisor, as none of the operators report to him/ her. Instead, the Shift Leader oversees the entire facility and can advise in any area of the plant as necessary. The Shift Leader also serves as the Incident Commander if an incident requires emergency response. Bayer management describes Shift Leaders as “very good operators who have worked their way through the technical advisor role.” Bayer intended the Technical Advisor, who is not a first-line supervisor, to be an experienced operator who works the day shift, helps schedule production to meet demand, and advises the on

- shift18 operators. The operators can call the Technical Advisor and ask questions any time of the day or night. The other operators do not report to him/her, and the Technical Advisor does not have the strong work -checking or “looking over the shoulder” function of a historical first- line supervisor or foreman.

Figure 5 . Institute site organization structure.


## 1.6 Process Chemicals 1.6.1 Methomyl Bayer produced methomyl for internat ional customers and as an intermediate feedstock used to make Larvin ® (Thiodicarb ), an insecticide and ovicide. 10

10 An ovicide is a chemical used to control insect larvae. Larvin is used worldwide on crops such as c orn,

cotton, fruits, grapes, sorghum, soybeans , and vegetables

. Methomyl is a white, crystalline solid with a slight sulfurous odor. Methomyl dust is combustible and can form explosive mixtures when disperse d in air. It was introduced in 1966 as a carbamate insecticide and registered by the U.S. Environmental19 Protection Agency (EPA) in 1968 as a restricted use pesticide 11

Methomyl is a cholinesterase inhibitor that disrupts central and peripheral nervous system functions. Routes of exposure include inhalation, ingestion, and s kin and eye absorption. Reversible and irreversible effects can result depending on the concentration and duration of the exposure. The National Institute for Occupational Safety and Health ( NIOSH ) recommended exposure l imit (REL) for methomyl is 2.5 mg/m3. When burned, methomyl decomposes to form toxic gases and vapors such as nitrogen oxides, sulfur oxides, acetonitrile, hydrogen cyanide, and methyl isocyanate ( Sittig, 2008). due to its high human toxicity. It is a broad- spectrum insecticide used on vegetable, fru it, and cotton crops worldwide and targets insects though direct contact and systemic absorption.

Table 1 lists the exposure limits, characteristics, and OSHA Process Safety Management (PSM) and EPA Risk Management Program (RMP) threshold quantities for the principal chemicals used to make methomyl. Phosgene is used to make MIC and MIC is us ed to make methomyl; both phosgene and MIC are highly toxic.



### 1.6.2 Phosgene Phosgene is a colorless, dense gas that smells like freshly cut hay or grass. Although highly toxic, phosgene is an important industrial chemical used to make thermoplastics such as eyeg lass lenses, and isocyanates, intermediate chemicals used to make polyurethanes and pesticides.

11 Restricted use pesticides are limited to commercial applicators certified by the EPA and the Food and Drug

Administration (FDA) state programs for pesticide safety education under the Federal Insecticide, Fungicide and Rodenticide Act (FIFRA).20 Table 1 . Characteristics of the toxic chemicals used to manufacture methomyl

Chemical NIOSH IDLH 12 NIOSH REL (ppm) (ppm) OSHA PEL (ppm) ACGIH TLV (ppm) Odor Threshold 13 Odor (ppm) RMP Threshold (lbs) PSM Threshold (lbs)

Chlorine 10 0.5 1 0.5 0.002 characteristic odor 2500 1500 Methyl Isocyanate 3 0.02 0.02 0.02 2 sharp, strong odor 10,000 250
Methyl Mercaptan 150 0.5 10 0.5 0.002 garlic or rotten cabbage 10,000 5000

Phosgene 2 0.1 0.1 0.1 0.4 hay or grass 500 100

The NIOSH -recommended time-weighted average concentration limit is 0.1 ppm. 14

Bayer produces phosgene at the Institute facility by reacting carbon monoxide and chlorine gas in the presence of a carbon catalyst. The phosgene is stored in the ECC until it is used in three nearby Phosgene reacts with proteins in the pulmonary alveoli , disrupting the blood-air barrier in the lungs. The onset of symptoms may be delayed and, based on available information, there appears to be no specific proven antidote against phosgene -induced lung injury. However, clinical experience indicates that ear ly treatment of suspected phosgene expos ure may be more effective than trea ting clinically overt pulmonary edema. Early treatment options include steroid s and p ositive airway pressure ventilation, Patients are expected to fully recover from low -dose exposu re.

12 The NIOSH definition for an ID LH exposure is a condition that poses a threat of exposure to airborne

contaminants when that exposure is likely to cause death or immediate or delayed permanent adverse health effects or prevent escape from such an environment. 13 An odor threshold is the lowest airborne concentration that can be detected by a population of individuals. 14 Time

- weighted average concentration is based on up to a 10

- hour workday during a 40

- hour work week.21 process units and to make methyl isocyanate, an intermediate chemical used to make four additional products.



### 1.6.3 Methyl Isocyanate Methyl isocyanate, or MIC, is one of the key chemicals used to make methomyl and two other products at the Institute site. MIC is a clear, colorless liquid with a strong, pungent odor, is highly reactive with water, and must be stored in stainless steel or glass containers at temperatures below 40 °C (104 °F) to prevent a highly exothermic 15

The NIOSH -recommended time- weighted average concentration lim it is 0.02 ppm. MIC can damage human organs by inhalation, ingestion, and skin contact in quantities as low as 0.4 ppm. Exposure symptoms include coughing, chest pain, dyspnea, asthma, irritation of the eyes, nose, and throat, and skin damage. Exposure levels above about 21 ppm can result in pulmonary or lung edema, emphysema and hemorrhages, bronchial pneumonia, and death. self

- polymerization reaction.

Bayer is the only facility in the U.S. that manufactures, stores, and consumes large quantities of MIC. It stores the liquid in underground pressure vessels in the MIC production unit located in the ECC, about 2,500 feet east of the Methomyl -Larvin unit. Each pressure vessel is insulated and double- wall construction, with leak detection in the annulus between the inner and outer wall. Th e MIC is refrigerated to between -10 °C and 0 °C (14 and 32 °F). Prior to the incident, liquid MIC was transferred through an insulated piping system to an aboveground pressure vessel called a “day tank” located on the southwest corner of the Methomyl-

15 An exothermic reaction is a chemical reaction that generates heat.22 Larv in production unit near the control room. 16

The maximum MIC inventory in the 6,700- gallon capacity, stainless steel day tank was approximately 37,000 pounds (about 75 percent full). The pressure vessel was rated at 100 psig, but it was normally operated at 10 psig using a dedicated nitrogen supply system. The MIC was circulated through a chiller, and cooling coils were attached to the outside of the insulated day tank to maintain the MIC between -10 °C and 0 °C (14 and 32 °F). The chiller used a non- MIC reactive solvent, MIBK, rather than a water

- ethylene glycol mixture to prevent a possible MIC

- water reaction should the chiller leak. The MIBK system pressure was maintained greater than the MIC system pressure and the refrigerated ethylene glycol

- water mixture system pressure in the MIBK chiller to ensure that water would not enter the MIC system in the event of a leak in both heat exchangers. After refilling the day tank, operators drained the transfer line and purged it with nitrogen.

The control syste m contained redundant pressure, temperature, and flow instruments including highpressure and high

- temperature alarms and refrigeration system failure alarms. The area around the tank was equipped with air monitors to detect MIC. Firewater monitors (stationary spray nozzles) were located nearby to mitigate an MIC leak and suppress a fire that might threaten the tank. A wire rope blast blanket surrounded the entire tank and top piping connections ( Figure 2 ) to stop debris from striking the day tank and to provide a thermal shield from radiant heat from a nearby fire. Finally, an emergency dump tank adjacent to the day tank was available to receive the contents of the MIC day tank and cross plant transfer line.

The MIC recirculation system, carbofuran unit transfer line, and the cross plant transfer line were equipped with emergency block valves that were operated from the control room. Emergency

16 The day tank at the Methomyl

- Larvin unit also supplied MIC to the FMC

- owned carbosulfan - carbofuran

unit through a double wall piping system. Bayer stopped using the day tank, cross

- unit transfer piping and FMC unit in August 2010 as part of the MIC stor age reduction effort.23 generators provided power to the refrigeration system in the event of a loss of normal plant electricity. MIC system vents were connected to the process and emergency vent systems.


## 1.7 Methomyl - Larvin Unit
The Methomyl- Larvin unit is located in the West Carbamoylation Complex ( Figure 6 ). Methomyl was produced, packaged, and stored in a unit warehouse for later use in manufacturing Larvin or sold directly to commercial customers. C ontrol room and outside operators were trained to work on both the methomyl and Larvin units. Although independent, both units were operated from the same control room (Figure 7).

Figure 6 . Aerial view of Bayer Institute Manufacturing Park. Methomyl

- Larvin unit (circled) is in the West Carbamoylation Complex24 Figure 7 . Overhead view of the Methomyl

- Larvin production unit



### 1.7.1 Methomyl Synthesis Methomyl production involved a series of complex chemical reactio ns. The process began by reacting aldoxime and chlorine to make chloroacetaldoxime, which was reacted with sodium methyl mercaptide in MIBK solvent to produce methylthioacetaldoxime (MSAO). Finally, MSAO was reacted with methyl isocyanate in MIBK to produc e methomyl ( Figure 8 ). Excess MIC was removed from the methomyl-solvent solution and then the solution was pumped to the crystallizers where an anti

- solvent was added to cause the methomyl to crystallize. Finally, the crystallized methomyl was separated from the solvents in the centrifuges and the methomyl cake was removed from the centrifuges, dried, cooled, packaged in drums, and moved to the warehouse. The liquid ex iting the centrifuges, known as mother liquor, contained MIBK and hexane, very small quantities of methomyl, and other impurities.25 Figure 8 . Methomyl synthesis process flow (dashed lines are unit

- to
- unit transfer pipes)

Distillat ion separated the solvents in solvent recovery flashers and recycled the solvents back to the beginning of the process ( Figure 9 ). The unvaporized solvents and impuri ties including up to about 22 percent methomyl, accumulated in the bottom of the flasher. The flammable liquids could be used as fuel in the facility steam boilers. However, before this flammable waste liquid, called “flasher bottoms,” could be pumped to a n auxiliary fuel tank, the methomyl concentration had to be reduced to not more than about 0.5 percent for environmental and processing considerations. 17

17 The maximum methomyl concentration limit in the auxiliary fuel was based on environmental effluent

criteria and the prevention of an uncontrolled methomyl decomposition reaction in the auxiliary fuel storage tank.26 Figure 9 . Methomyl centrifuge and solvent recovery process flow The residue treater was used to dilute the incoming flasher bottoms in MIBK solvent and was designed to operate at a high enough temperature, and with sufficient residence time, to decompose the methomyl in the flasher bottoms stream to below 0.5 percent. The solvent and residual waste material were transferred to the auxiliary fuel tank for use as a fuel in the facility steam boiler. Vapor generated in the methomyl decomposition reaction exited through the vent condenser to the process vent system where toxic and flammable vapor were removed.



### 1.7.2 Control System Upgrade Operators were qualified to operate the methomyl and the Larvin units, each from a separate work station in the control room. In 2007 Bayer upgraded the Larvin unit control system to a Siemens27 distributed control system (DCS) 18 and upgraded the methomyl control system during the 2008 methomyl outage. 19

The DCS contains three control system interlock matrices: Safety, Operating, and Control. The safety matrix consists of pre -defined process deviations and computer- controlled process actions that determine how and when fail

- safe automatic control functions are activated. The status of all safety matrix interlocks is displayed on a color

- coded spreadsheet on the display console. Process mimic

screens Bayer, with assistance from Siemens, conducted formal operator training on the Larvin control system upgrade in 2007 and by spring 2008, the operators were proficient in using the Larvin DCS.

20 also displayed safety matrix component cause/effect 21

Like the Larvin system upgrade, board operators and unit engineers directly partic ipated in configuring the design of the methomyl DCS. New display screens des igned to mimic the process flow incorporated automated icons for critical equipment to show operating status and other parameters, included a mouse user interface, and featured im proved human-machine interfaces. status next to the component icon. A password, which board operators did not have access to, was required to bypass (override) or change a safety matrix cause/effect fail

- safe control.

18 D CS are dedicate d systems used to control manufacturing processes that are continuous or batch

- oriented.

The DCS is connected to sensors and actuators and use s setpoint control s to control process variables

. 19 The methomyl process was not run year

- round, as demand for me thomyl was such that the methomyl unit

was operated for a few months at a time with extended outages between runs. The optimal time to perform major repairs and system upgrades was during these outages. 20 A mimic screen is a simplified graphical representa tion of a process that uses icons to display piping and

equipment with color

- coded operating status, instrumentation with output values and setpoint data, and other key equipment and information maintain situation awareness and to control the process. 21 A safety matrix cause element is a pre

- defined process deviation value that triggers the specified process

component action or effect. For example, if the tank level exceeds the high

- high setpoint (the cause), the fill line process valve is commanded to close (the effect).28 

### 1.7.3 Residue Treater The residue treater was a 4,500

- gallon pressure vessel with a maximum allowable operating pressure of 50 psig. The relief system on the residue treater was designed to handle a maximum methomyl concentrati on not to exceed 1.0 percent. The vessel mechanical integrity program inspection results found that the 25- year - old vessel had sustained significant wall thinning due to generalized corrosion. Using the management of change (MOC) program, Bayer replaced the vessel during the summer 2008 outage with a new stainless steel pressure vessel to improve corrosion resistance. The existing recirculation piping, controls, and instruments were not modified. The vent condenser piping at the top of the residue treater was prone to blockages during unit operation. Gases that evolved from the methomyl decomposition reaction passed through the vent condenser to the flare system. The gas flow carried trace amounts of solid material into the vent system where they were deposited on the surface of the pipe. Over time, the accumulating deposits would choke the flow and cause the residue treater pressure to climb. The board operator directed outside operators to attach a temporary steam line to the vent pipe and flush the depos its from the vent pipe whenever the deposits blocked the vent and caused the residue treater pressure to approach the upper operating limit. Because the original design did not consider the need to periodically clear blockages, the valves and connection ports were hard to reach, so Bayer repositioned them during the unit outage to improve

access.



### 1.7.3.1 Residue Treater Operation The residue treater ( Figure 10 ) had an automatic level control system to control the liquid level at about 50 percent. The residue treater recirculation system was used to heat the solvent at the beginning of a new production run, mix the incoming flasher bottoms into the partially filled vessel,29 and re move excess heat generated from the exothermic decomposition of the methomyl inside the vessel. An automatic temperature control system on the residue treater monitored both the bulk liquid temperature in the residue treater and the liquid in the recircula tion loop. During startup, the control system modulated the recirculation and steam flows through the heater. When the liquid temperature increased to the setpoint limit, the control system closed the steam flow valve, and changed the position of the circu lation valves to redirect the recirculation flow from the heater to the cooler. The cooler was provided with constantly circulated 80 °C (176 °F) water, which was sufficient to remove excess heat from the decomposing methomyl and to maintain the liquid tem perature within the operating limits, provided that the bulk methomyl average concentration inside the residue treater remained below about 0.5 percent.

Figure 10 . Residue treater piping system layout30 At normal operating conditions, the temperature of the flasher bottoms liquid was kept at about 80 °C (176 °F) to prevent an uncontrolled auto-decomposition of the higher concentration methomyl. The contents of the residue treater were maintained at approximately 135 °C (275 °F), t he temperature that assured the incoming methomyl quickly decomposed so as not to accumulate to an unsafe concentration inside the residue treater. As the flasher bottoms liquid entered the hot solution in the residue treater, the methomyl began to decompo se. The exothermic heat of decomposition was controlled by vaporization, and condensing of the solvent in the vent cooler, supplemented as needed by the recirculation loop cooler.



### 1.7.3.2 Operating Limit Control Interlocks The residue treater control system was e quipped with operating limit controllers integrated into the automatic feed control valve operation. A minimum temperature interlock and a maximum pressure interlock prevented the feed control valve from opening until the minimum temperature of the residue treater contents were at or above the setpoint and the residue treater pressure was below the setpoint, respectively. Both were designated as safety interlocks; thus, bypass control was password -protected. A third interlock, designated “operating,” also prevented the feed control valve from opening until residue treater recirculation flow was established. The standard operating procedure (SOP) specifically discussed the importance of these interlocks: Mother liquor flasher tails [flasher bottoms] can not be introduced into the residue treater until the pressure is not high -high, the tank temperature is not high -high or low-low and the circulation flow is not low- low.

The SOP contained an administrative control 22

22 An administrative control is an action or activity that is described and managed through a specific operating

or maintenance procedure. that the operator had to perform before putting the residue treater methomyl feed in automatic operation: “If the tank is allowed to cool below 130 °C [266 °F], for any reason, it must be sampled before being heated up again.” Furthermore, the SOP31 cautioned, “[I]f the methomyl concentration is above 1.3 %, a run away [sic] reaction could result upon heating the tank.” Furthermore, the process hazards analysis stated: [R]egular samples of residues [flasher bottoms] from the flasher would assure proper operation and safety... Take regular samples of resi dues from the flasher and residue treatment tank. This will assure proper operation and safety since safety relief sizing is based on a certain ma ximum methomyl concentration in each item. However, the SOP did not require analyzing the flasher bottoms, nor was the system configured such that operators could collect a liquid sample for analysis. As discussed in the incident analysis, one key factor contributing to the incident was that the op erators were unaware the flasher bottoms contained an excessively high concentration of dissolved methomyl.



### 1.7.3.3 Startup and Operation The SOP contained specific steps for starting the residue treater. During these startup steps, the flasher bottoms flow contro l valve was to be set in the manual, closed position. The safety interlocks on the flasher bottoms flow control valve were designed to prevent feeding methomyl into the residue treater until the limit conditions were satisfied. The startup sequence also re quire d the operator to sample the liquid remaining in the residue treater from the previous run and send it to the lab to confirm that it contained less than 0.5 percent methomyl. The startup sequence required the board operator, with the assistance from an outside operator, to manually pre- fill the residue treater with solvent to the minimum level of about 30 percent and to start the pump and achieve steady state recirculation. After reviewing the residue treater sample lab results to confirm the methomyl concentration was below 0.5 percent, the board operator started the solvent heating cycle, which was typically controlled automatically by the computer system. Finally, the SOP required the outside operator to collect another sample of the residue treater contents and send it to32 the lab for analysis to re -verify that the liquid contained not more than 0.5 percent methomyl. 23

As long as the flasher and residue treater level controllers and temperature controllers were set to automatic, no further operator action was required to control the system. The SOP required the outside operator to collect a liquid sample from the residue treater o nly once every 24 hours and send it to the lab to confirm that the methomyl concentration in the liquid being transferred to the alternate fuel tank remained below 0.5 percent. Once confirmed, the board operator set the flasher bottoms flow control valve in the automatic position, and flasher bottoms would beg in entering the residue treater. These steps ensured that when the flasher bottoms began flowing into the residue treater, the flasher bottoms were diluted and heated so that the methomyl would decompose rather than accumulate above safe limits.

The residue treater liquid level control was designed to operate in the automa tic, continuous flow mode. However, in this operating mode, the flow rate was very low; thus, the alternate fuels outgoing transfer pipe frequently became plugged with viscous material . Therefore, the board operators kept the level controller in the manual operating mode and allowed the residue treater level to increase to the upper fill limit, and periodically transferred the liquid at a much higher flow rate to prevent the line from becoming plugged. The SOP was not revised to incorporate this change.

23 Since the residue treater was new and not previously operated, this step was not needed for the August restart.

However, the SOP did not allow this deviation.33 

## 2.0 In cident Description
The incident is described in chronological order, beginning with pre- startup activities that contributed to the conditions leading up to the explosion. It continues with equipment preparation, then through the startup of the principal me thomyl unit subsystems. This section next discusses the specific conditions that led to the runaway reaction in the residue treater and ends with the emergency response discussion.


## 2.1 Pre- Startup Activities Unlike the normal methomyl restart after a routine s hutdown, the August restart involved operations personnel, engineering staff, and contractors working around the clock to complete the control system upgrade and residue treater replacement. Work included finalizing the software upgrades, modifying the wor k station, calibrating instruments, and checking critical components. Board operators were provided time at the methomyl work station so that they could familiarize themselves with the new control functions, equipment and instrument displays, alarms, and o ther system features. Other personnel were completing the residue treater replacement, reinstalling piping and components, and reconnecting the control and instrument wiring. These activities progressed in parallel with the ongoing Larvin unit operation. The methomyl control system upgrade required a revision to the SOP to incorporate the changes needed to operate the methomyl unit with the new Siemens system, and to reformat the SOP to a computerized document. However, at the time of the incident the SOP r evision remained incomplete; the operators were using an unapproved SOP 24

24 The review and approval record of the working copy in use at the time of the incident was unsi gned. A

watermark on each page read “draft in review 11/13/07.” that did not contain the new control system operating details.34 

### 2.1.1 Solvent Flush and Equipment Conditioning Many of the subsystems in the methomyl unit required a solvent flush and nit rogen gas purge to clean and dry the systems before startup. These activities were critical to safely start the residue treater system as the feed, recirculation, and vent piping had been disconnected and a new pressure vessel had been installed. The solve nt-only run was also needed to verify instrument calibrations, proper equipment operating sequences, and other operating parameters in the new DCS. The staff flushed the process equipment with solvent to remove contaminants and water that might have gotte n into the system during the outage. However, contrary to the SOP 25 the staff did not perform the residue treater solvent run. 26 Operators reported that solvent flow restrictions upstream impeded completion of instrument calibrations because the proper adjustments could not be made at low flow rates. Even had the staff not needed to verify the control system function and operability, the solvent run was required to pre

- fill the residue treater to the minimum operating level and to heat the liquid to the minimum operating temperature before adding the methomyl containing flasher bottoms feed. 27
1.7.3.2 This was essential for safe, controlled methomyl decomposition. As discussed in Section , the control system design prevented adding methomyl until the solvent was at minimum volume and temperature, but the operators bypassed the safety devices during the startup.


## 2.2 Unit Restart Although the operations staff acknowledged that management had not prescribed a specific deadline for resuming methomyl production, onsite stockpiles of methomyl necessary to make Larvin were dwindling. Unit personnel recognized the important role of methomyl in the business performance of

25 Although the SOP had not been reviewed and approved, as with the prior approved SOP, it required the

solvent run. 26 The staff acknowledged that the solvent

- only run was not performed on t he residue treater, but were unable to

explain who decided to proceed with feeding methomyl to the empty, unheated residue treater. 27 The SOP warned that a runaway reaction would result if methomyl were allowed to accumulate in the residue

treater before the treater is properly heated.35 the facility, and a recent increase in worldwide demand for Larvin created a significant, sustained production schedule. Methomyl -Larvin operating staff told CSB investigators that they looked forward to resuming methomyl production and a return to the normal daily wor k routine after the long unit shutdown. Operator logs documented the plan to start the MSAO (a.k.a. Oxime) unit Monday morning, August 25. Methomyl synthesis needed to begin shortly thereafter. However, critical startup activities were not completed, and the staff struggled with many problems as they attempted to bring each subsystem on line. To complicate the startup problems, p rocess computer system engineers had not verified the functionality of all process controls and instruments in the new control system.



### 2.2.1 Equipment Malfunctions Although the methomyl unit outage and new DCS implementation were incomplete, the staff proceeded with the unit restart. Some of the equipment was not yet operational and some equipment malfunctioned. For example, a few days before the incident, operators discovered that a valve had not been installed on a solvent feed line, which resulted in excessiv e solvent consumption. During one shift, operators discovered that heat tracing on a process line was not operating, which allowed the contents in the pipe to cool and solidify. Another problem was traced to a broken stem on a water cooling system valve o n a vapor condenser. The closed valve prevented adequate condenser cooling, which led to an imbalance in the crystallizer solvent ratios and excess MSAO in the flasher bottoms. Operators also encountered many problems tuning control loops and calibrating i nstruments for the newly installed computer control system. These issues were compounded because the operators had not become familiar with all of the methomyl work station functions and changes made to some process variables.36 

### 2.2.2 Methomyl Synthesis and Cryst allization The board operator startup log reported many continuing adjustments and corrections to the computer system. By mid

- week, methomyl was being synthesized in the methomyl reactor and the crystallizers were put in service. The next step was to start the centrifuges to separate the crystallized methomyl from the solvents. The SOP was written such that two centrifuges operated in parallel. While one was progressing through the crystal- liquid separation cycles, the other was emptied of the crystallized methomyl “cake” and then refilled with a new batch of slurry. From there the methomyl cake went to the drying and packaging stages. This operating sequence assured that the upstream methomyl synthesis processes could run continuously. At the beginning of this startup, only one centrifuge was operational; the other had continuing problems with electrical connections. Regardless, the operators proceeded with the restart, using only one centrifuge to separate the crystallized methomyl from the liquid solvents. An operator told CSB investigators that maintaining the proper solvent ratios was much more difficult during the startup, and that he needed to closely focus on the operating conditions and frequently adjust control variables in the DCS. After feeding wh at they presumed to be normal methomyl- solvent slurry into the centrifuge, the outside operators opened the centrifuge to remove the methomyl crystal cake but discovered there were no methomyl crystals in the centrifuge basket. The absence of methomyl crystals could have been due to two causes: either a malfunction prevented methomyl from being synthesized in the methomyl reactor, or the crystallizer solvent/anti -solvent ratio was incorrect and the methomyl remained in solution rather than being crystallize d. If the former was the cause, methomyl would not be present in the flasher bottoms feed to the residue treater —there would be no methomyl to decompose in the residue treater. If the latter was the cause, the methomyl concentration in the residue treater feed would likely be significantly greater than expected —uncrystallized methomyl would remain in solution and eventually accumulate in the flasher bottoms.37 

### 2.2.3 Solvent Recovery As the operators worked through the ongoing myriad problems during the methomyl st artup, they were depleting the fresh solvent inventory faster than expected. Therefore, they needed to get the solvent recovery system on line as quickly as possible to replenish the solvents. The residue treater was the last processing step in the solvent recovery system. The liquid exiting the centrifuge normally contained only about 0.5 percent methomyl, some MSAO, trace impurities, and solvents. Routine collection and testing during startup indicated that the methomyl concentration was more than double the maximum operating limit value and as high as 4.0 percent, eight times greater than the specified operating limit for the four collected samples. These samples confirmed that methomyl was being synthesized in the reactor and that the solvent ratio was off specification in the crystallizer so the methomyl did not crystallize. Again, ongoing equipment issues and improperly calibrated and tuned instruments distracted the staff. They did not review the lab results so were unaware of the over -concentration problem and continued solvent recovery startup activities. The solvent flasher separated and extracted the solvents for reuse. Trace impurities and MSAO accumulated in the bottom of the flasher along with the non- recoverable solvents and methomyl. These so

- called flasher bottoms typically contained about 22 percent methomyl when all upstream process equipment was operating within the specified parameters. However, unknown to the startup team, the gross solvent imbalance in the crystallizer caused the methomy l concentration to climb to as high as 40 percent, nearly twice the design basis amount. 28

28 The process hazards analysis (PHA) discussed the importance of sampling the residue treater feed (flasher

bottoms) to verify that the methomyl concentration did not exceed the residue treater design limits. However, the SOP did not require such a sample, and no sample collection point was available in the system. The designers presumed that the flasher feed sample and in

- specification flasher column operation would assure methomyl concentration in the flasher bottoms would n ot exceed the design limit.38 

### 2.2.4 Residue Treater Startup The residue treater was the last equipment to be started. The critical startup safety prerequisites, pre

startup solvent fill and heat-up were omitted from the restart activities. Furthermore, the board operators bypassed the minimum operating temperature interlock that prevented adding methomyl into the residue treater, as some operators were accustomed to doing. The minimum recirculation loop flow interlock on the feed valve was also left bypassed by the computer programmers. Without recirculation flow, the concentrated methomyl feed was not adequately mixed with what should have been preheated solvent already in the residue treater. Operators told CSB investigators that, based on operating experience, there would be little methomyl in the system “this early in the startup.” That is most likely the reason the operators skipped the sample collection and analysis steps. On August 28, at approximately 4 a.m., the board operator manually opened the residue treater feed control valve and began feeding flasher bottoms into the nearly empty vessel. With a low flow rate of about 1.5 gallons per minute, more than 24 hours would be required to fill the residue treater to 50 percent, the normal operating level. The operations staff did not discuss the residue treater operating status at the 6 a.m. shift change, as they were preoccupied with other startup issues. Samples from the second sample point, the r esidue treater outlet, were not collected and tested as required by the startup procedure or at the normally scheduled time, the beginning of the day shift. Operators offered two explanations for not sampling the residue treater contents during the restart activities. First, since the centrifuges contained no methomyl cake, the staff incorrectly concluded that methomyl had not been synthesized. Second, the outside operator on the day shift was unaware that the residue treater had been put into operation

— the night shift crew did not tell the day shift crew that the feed to the residue treater had been started. The outside operator started the recirculation pump at 6:14 p.m. as directed by the board operator. The residue treater liquid level was approximately 30 percent (1,300 gallons) and the temperature39 ranged between 60 and 65 °C (140-149 °F), still significantly below 135 °C (275 °F), the critical decomposition temperature. The pressure remained constant at 22 psig. At 6:38 p.m., the temperature began stead ily rising about 0.6 degrees per minute ( Figure 11 ). At 10:21 p.m., the level was 51 percent when the recirculation flow suddenly dropped to zero. 29 In less than 3 minutes, the temperature was at 141 °C (286 °F), rapidly approaching 155 °C (311 °F), the safe operating limit, and climbing at the rate of more than two degrees per minute.

Figure 11 . Residue treater process variables before the explosion. Failure occurred at 22:33, as shown at vertical dotted line

29 A Bayer review after the incident determined that the split

- range temperature control was incorrectly

programmed in the DCS. In the process of changing from heating to cooling, the residue treater recirculation flow valves to both the heater and cooler closed, blocking all recirculation flow. However, the CSB concluded that this was not causal to the runaway reaction and vessel rupture.40 At app roximately 10:25 p.m., the residue treater high pressure alarm sounded at the work station. The board operator immediately observed that the residue treater pressure was above the maximum operating pressure and climbing rapidly. Not understanding what was wrong, but suspecting a blockage in the vent line, he contacted the outside operator and directed him to go to the residue treater to check the vent system. 30



## 2.3 Explosion and Fire He also asked a second outside operator to assist. He then manually switched the residue treater r ecirculation system to full cooling, hoping that that might slow or stop the climbing pressure.

At 10:33 p.m., a few minutes after the board operator talked to the outside operators, a violent explosion rocked the control room. A huge fireball erupted on the south side of the unit as alarms sounded on the methomyl and Larvin work stations. Operators scrambled to shut the systems down. The onsite fire station located nearby shook from the explosion as the emergency alarm sounded. Outside operators rushed to close valves, de

- energize equipment, and activate stationary water cannons to begin fire suppression efforts. Water cannons were also directed at the MIC day tank blast blanket structure to help keep the day tank cool and prevent the fire from spreading to the tank. Shortly after the explosion one of the two outside operators who had gone to investigate the residu e treater problem was seen walking toward the control room. Coworkers quickly came to his aid and took him to a safe area until help arrived. He was badly burned. The body of the other outside operator was located about 4 hours later. The bolts holding the residue treater support legs to the concrete foundation sheared off as the shell and top head of the 5,700-pound residue treater careened into the methomyl unit. The bottom head separated from the shell ( Figure 12 and Figure 13 ) and came to rest about 20 feet from the residue

30 The CSB was later told that, in hindsight, plugging in the newly installed vent system could not have been the

cause of the pressure excursion. The residue treater had not operated long enough to cause deposits to accumulate inside the vent pipe.41 treater foundation. The explosion destroyed nearby pum ps, heat exchangers, and electrical switchgear. The fire was fueled primarily by the solvent inside the residue treater and other flammable liquids that spilled from the ruptured piping systems.

Figure 12 . Residue treater bottom head (left); vessel shell and top head (right)

Figure 13 . Residue treater shell and top head recovered from inside the Methomyl

- Larvin unit42 The residue treater struck a large support column on the four-story process unit structure and sheared it off the baseplate on the concrete foundation ( Figure 14 ). Small debris, including conduit, valves, small diameter pipe segments, and insulati on, was thrown in all directions, some of which struck, but did not penetrate the MIC day tank blast blanket. The blast blanket also functioned as a heat shield to protect the tank and attached piping from the intense solvent- fueled fire.

Figure 14 . Structural column (arrow) ripped from the steel baseplate (left)
The overpressure produced by the rupturing residue treater damaged properties in the surrounding community. Mobile homes, houses, businesses, and vehicles sustained primarily window breakage and minor structural damage. The majority of the property damage reports were within 1.5 miles of the explosion epicenter; however, some damage was reported as far away as 7 miles (Figure 15). Bayer received 57 property damage c laims from residences and businesses totaling about $37,000.43 Figure 15 . Aerial view of locations of reported offsite property damage


## 2.4 Emergency Notification and Response 2.4.1 Bayer CropScience Response The Bayer fire brigade was at the scene within minutes of the explosion and set up a command post northeast of the methomyl unit, where the incident commander began coordinating the response as fire equipment and personnel arrived. Plant responders established and directed a water stream to the fire zone from the north. About 5 minutes after the explosion, Metro 9 -1- 1 contacted the Kanawha County Emergency Ambulance Authority (KCEAA) and advised the agency of a large explosion at the Bayer plant. Emergency Medical Services (EMS) personnel began staging at the main gate about 2 minutes later. Within 6 minutes of the explosion, fire alarms sounded at the Institute and Tyler Mountain volunteer fire departments in accordance with the established mutual aid protocol. Institute fire department responders staged at the main gate with backup equipment and supplies. Tyler Mountain firefighters44 joined the Bayer fire brigade at the methomyl unit to battle the blaze. A Metro 9 -1-1 operator contacted the security guard at the Bayer main gate 9 minutes after the explosion. 31



### 2.4.2 Local and State Emergency Response Agencies Bayer activated its Emergency Operations Center (EOC) at 10:45 p.m. Twelve minutes into the incident, the Bayer security guard asked the Metro 9 -1-1 operator to dispatch an ambulance for a worker burned in the fire. The emergency resp onse timeline is shown in Appendix B.

As provided in the Kanawha Putnam Emergency Management Plan, the Kanawha Emergency Management Director ordered the Kanawha Putnam Emergency Operations Center (EOC) to be activated. County personnel staffed the EOC, which served as the centralized communications hub for all emergency response dispatch of police, fire, and EMS for Kanawha and Putnam counties. The Kanawha County Sheriff heard a loud explosion at about 10:30 p.m. After hearing state and county radio traffic indicating that an explosion had occurred near the Bayer plant, he radioed Metro 9-1-1 while en route to the facility. He then requested that Metro Communications contact the Nitro and Dunbar Police Departments to arrange for roadblocks of Route 25 at the city limits to restrict traffic flow into the Institute area. The county EOC also routed information to and from the various responding municipal, state, and county agencies. Responding agencies included South Charleston, Nitro, and Dunbar Police Departments; the Jefferson and St. Albans Fire Departments; the Kanawha County Sheriff’s Department; the State Fire Marshal’s Office; the U.S. Bureau of Alcohol, Tobacco, and Firearms and Explosives, (ATF); and the KCEAA . All of these agencies routed their communications through the EOC during the emergency ( Figure 16 ). As the night progressed, the
Metro 9 -1- 1 call center receiv ed more than 2,700 phone calls, which overwhelmed the system.

31 The Bayer security guard told investigators that he tried many times to get through to Metro 9 -1- 1 but the line

rang busy. The Metro 9 -1- 1 operator also had trouble getting through to the Bayer guard shack.45 Upon arrival at the main gate about 10 minutes after the incident occurred, the Institute Volunteer Fire Department chief set up a command post and assumed the role of resource commander. In this role, he coordinated with the Bayer IC to provide outside mutual aid resources of personnel and equipment as needed. After the Institute fire department chief made the initial contact, the Bayer IC advised him that based on air monitoring information , “e verything [was] being consumed in the fire” and that a shelter

- in

- place was not necessary. However, w hen the Kanawha County S heriff arrived , he noticed an acrid smell in the air and not knowing the source, felt that he and his deputies might be at risk ; thus, he ordered his deputies and state police to relocate to the Shawnee Park EOC, the location so designated in pre- planning exercises. Immediately after the incident began, the Director of Regional Response Teams (RRT) for West Virginia, who works in th e State Office of Emergency Services (OES) and was unsatisfied with the information being provided by Bayer, called the State Fire Marshal to assess the incident. 32 Bayer EOC personnel directed the Fire Marshal to the onsite EOC, where he tried, unsuccessfu lly, to get information that would allow an accurate assessment of the conditions and status of the incident response. Based on his observations of fire suppression operations, the Fire Marshal ordered the RRT unit, a trailer with supplies and other resources stationed in Nitro, be brought to the site for use if needed

. He then went to the EOC at Shawnee Park

.

32 The State Fire Marshal is responsible for hazardous material incidents, incidents involving weapons of mass

destruction, and mass casualty operations. The State Fire Marshal also provides guidance to 447 departments; more than 11,000 firefighters; and is responsible for code enforcement, fire safety, and investigations.46 Figure 16 . Methomyl unit explosion emergency communications diagram47 At about 11:00 p.m., the St. Albans fire chief, after seeing a smoke cloud advancing towards St. Albans, requested information from Metro 9-1-1 about the composition of the cloud. As it approached, the chief advised Metro 9-1-1 dispatchers that if he did not get clear information
reg arding the make-up of the cloud, he would initiate a shelter

- in

- place advisory for the St. Albans community. At 11:19 p.m., Metro 9-1-1 announced a shelter- in

- place for the immediate area surrounding the Bayer facility, and initiated a reverse ring -down n otification 33

Figure 17 to the residents in the affected community. Five minutes later, Bayer recommended that Metro dispatchers issue a shelter

- in

- place for the St. Albans area. At about 11:34 p.m., the KPEPC activated the County Emergency Alert System, which in tur n initiated a shelter

- in

- place for the areas west of Charleston to Putnam County line. The shelter

- in -place affected about 40,000 residents ( ).

Figure 17 . Areas and population affected by the shelter

- in

- place

33 A reverse ring

- down notification system is an automatic calling system that automatically calls residents and

businesses in pre

- defined areas. It delivers a pre

- recorded message advising action to be taken in response to a community emergency.48 At 12:34 a.m., a little more than two hours after the incident occurred, Bayer notified the National Response Center. At 2:05 a.m., about 3 hours and 30 minutes after the incide nt began, Kanawha Putnam EOC declared the area west of Charleston, which included St. Albans, Nitro, Jefferson, Dunbar and Institute safe to re- enter and canceled the shelter

- in

- place action

.


### 2.4.3 Emergency Operations Center Activations As the response to the e mergency progressed, three EOC s were activated , which contributed to confusion and communication difficulties. The first, the Bayer EOC, was located along the northern boundary of the plant adjacent to Route 25, and was staffed by Bayer personnel including the WCC unit manager; Health, Safety, and Environmental Manager; and operations manager. This site was less than one- half mile from the incident and was part of the Bayer emergency planning process. One function of the Bayer EOC was to coordinate communication with Bayer corporate staff in Raleigh, North Carolina, and provide updates to the media. It was also responsible for communicating incident status and mutual aid assistance with the outside emergency response agencies.

The Kanawha Putnam EOC was activated at the Metro 9 -1- 1 call center in South Charleston. The center was staffed by county personnel and served as the centralized communications hub for all emergency response dispatch of police, fire, and EMS for Kanawha County. As part of the Bayer emer gency notification ring- down system, the plant’s environmental specialist was notified of the incident and advised to report to the Kanawha Putnam EOC in response to its request for a Bayer representative to relay information directly to the county authori ties. The environmental specialist arrived at the Kanawha Putnam EOC between 11:40 p.m. and 12:00 a.m. Shortly after arriving, he phoned the Bayer EOC to obtain information regarding the location of the fire and the substances thought to be involved. He spoke to the Health, Safety, and Environmental Manager and his supervisor and was able to provide the dispatchers with information regarding three substances thought to be involved in the incident: dimethyl disulfide (DMDS), methyl isobutyl ketone (MIBK), an d acetonitrile. However, Bayer was slow to provide additional details.49 The Kanawha Emergency Management Director also activated a mobile EOC at Shawnee Park, which was located on Route 25 less than a mile to the southeast of Bayer. T wo Bayer environmental specialists reported there to act as liaisons with non

- Bayer responders. Representatives from the Department of Highways, State Police, and the Sheriff’s office also reported to the Shawnee Park
EOC.


## 2.5 Air Monitoring At the time of the incident, the two AreaRae ® fence line air monitors 34

Continuous air monitors were located in and around the production units to detect fugitive leaks in process equipment were positioned on the east end of the plant and on the west riverbank to detect concentrations of airborne chemical contaminants and alert facility occupants if air concentrations exceeded safe levels and had traveled bey ond plant boundaries. The CSB investigators examined the monitor data and determined that the fence line monitors did not detect hazardous concentrations of the chemicals sampled. Another AreaRae system monitor recorded atmospheric winds, temperature, and barometric pressure.

35

However, in May 2008, the analyzer malfunctioned, causing spurious alarms. Although technicians investigated, they had not resolved the problem before the August methomyl unit startup. The CSB learned that the system had n ot been repaired and restarted even though the MIC storage tank had or leaks resulting from process upsets. The Methomyl -Larvin unit had 16 localized MIC sample points connected to an analyzer, which Bayer installed in March 2006 to continuously sample and record MIC concentrations at 2 -minute intervals. If concentrations exceeded 1.0 ppm, the system was designed to activate a visual alarm display in a room on the second floor of the M ethomyl-Larvin control building.

34 An AreaRae instrument is a direct

- reading device that continuously samples for a wi de range of chemicals

including oxygen, carbon monoxide, chlorine, volatile organic compounds (VOC), and methane. 35 A fugitive leak is a small leak in process equipment. Such leaks are commonly called “fugitive emissions,”

which must be identified and corr ected.50 remained in service. On the night of the incident, the personnel in the Bayer EOC were unaware that the monitoring system was not active, therefore they assumed it would alarm if it detect ed airborne MIC or other detectable chemicals during the incident response. They had no way of knowing if toxic vapors from chemicals used in the methomyl unit were escaping into the air.

The MIC production unit, located about 1,800 feet from the M ethomyl -Larvin unit, had a similar MIC air monitoring system with 16 stationary sample points. The analyzer recorded the results at 2 -minute intervals. This analyzer was operational on the night of the incident but did not detect any chemicals including MIC during or after the incident.51 

## 3.0 Incident Analysis
3.1 Residue Treater Replacement
The Mechanical Integrity program on the original, 25 year old carbon steel residue treater identified significant service degradation . Bayer , through the MOC program, replace d it with a corrosionresistant stainless steel vessel in anticipation of the planned increase in methomyl production. With the exception of substituting stainless steel for the carbon steel and associated material thickness changes required by the American Society of Mechanical Engineers Boiler and Pressure Vessel Code (ASME Code), Section VIII design rules, the new ASME Code- stamped vessel was identical to the original. The CSB concluded that this process modification did not contribute to the incident cause o r
consequences . 

## 3.2 Internal Compliance Auditing 3.2.1 Corporate Process Safety Management Audits The Bayer North America corporate assessment team conducted an audit of the Methomyl

- Larvin unit in July 2005. The team, composed of four auditors from other Bayer facilities and business units, specialized in process safety, mechanical integrity, and pressure vessel engineering. The team audited against 7 of the 14 elements in the OSHA Process Safety Management standard 36

The final report, issued in 2006, identified 17 PSM compliance issues in the audit focus areas. Several findings included deficiencies with tracking the status of recommendations and corrective actions from PHAs, equipment inspections, and compliance audits. As required by Bayer corporate standards, the Institute site developed a list of recommendations and corrective actions to resolve the findings and the emergency response requirements in the EPA Risk Management Program.

36 The 2005 corporate PSM audit focused on process safety information, process hazards analysis, operating

procedures, mechanical integrity, management of change, incident investigation, and compliance audits.52 and entered them into a new action tracking system with an assigned responsible p erson for completion.



### 3.2.2 Audit Action Tracking System Upgrade In 2006, Bayer implemented a new action tracking system in response to OSHA citations issued in a 2005 Institute facility inspection, which faulted Bayer for not having a tracking system to assure PHA recommendations were resolved, documented, and communicated. In 2006, Bayer program developers in Research Triangle Park, North Carolina developed the system for the Bayer facilities. A new tracking system feature contained a workflow integration funct ion that automatically sent notifications to responsible parties and required electronic approval by managers to close completed actions. However, even with this new system , problems with action item tracking and closure continued.



### 3.2.3 Process Safety Managemen t Self Assessments Institute site personnel audited the Methomyl -Larvin unit against the PSM standard in 2004 and in 2007. The PSM “facilitated self assessment” was conducted every three years as required by the PSM standard. The 2007 facilitated self assessment found that action tracking deficiencies identified in previous corporate PSM audits and facilitated self assessments remained unaddressed. The audit also found that even after the OSHA citation 2 years earlier, action items generated in PHAs on the Methomyl -Larvin unit still were not being tracked and closed. CSB investigators reviewed the corrective action plans identified in the corporate PSM audits and the PSM facilitated self assessments and identified similar shortcomings. For the 2005 corporat e PSM audit, some listed corrective action items were still open. Some of the items listed on the 2007 facilitated self -assessment action plan were overdue by more than 9 months at the time of the August 2008 incident including one requiring the revision o f Methomyl -Larvin unit SOPs.53 

## 3.3 Process Hazards Analysis A Bayer team that included an experienced facilitator, process engineer, and experienced unit operations personnel conducted the methomyl system process hazards analysis (PHA) in 2005 using a hazard and operability study (HAZOP) technique. The team also used Bayer’s semi

- quantitative risk matrix to analyze whether additional protections were required for the various scenarios identified in the HAZOP. Properly applied, these tools can identify improvements that could have prevented the residue treater incident. However, the relatively short duration of the PHA, and the team’s poor application of the tools during the process, produced results that failed to identify significant unmitigated scenarios that n eeded recommendations.



### 3.3.1 PHA Duration and Staffing Deficiencies Poor execution of the PHA was due in part to the way Bayer had structured it and the total hours the PHA team worked. Bayer assigned methomyl unit operators to the PHA team, but most were only present for a few hours each. Most revealing is that in just 12 meeting days, for an average of 6 hours per day, the team analyzed 37 HAZOP nodes, including analyzing risks to determine if additional protections were needed. Considering the complexity of t he unit the time spent on the HAZOP was insufficient to address all the critical process safety information, draw logical conclusions, and determine appropriate recommendations.



### 3.3.2 PHA Assumptions Deficiencies The 2005 PHA team failed to validate critical assumptions used in their analyses. For example, the team accepted defined procedure steps without confirming that the operators rigorously followed the procedures. They also incorrectly assumed that the automatic safeguard controls listed in the safety

mat rix remained operational during all operating modes. Through staff interviews, CSB investigators learned that some board operators bypassed the two safety interlocks on the residue treater feed control valve during startups based on their experience with the residue treater heater not heating the54 solvent to the minimum temperature interlock setpoint. With the interlocks in bypass, they manually opened the flasher bottoms feed valve when the residue treater temperature was about five degrees below the requir ed operating temperature. The heat generated by the decomposing MSAO and methomyl would finally increase the residue treater temperature to the minimum operating value. Because the PHA team was apparently unaware of any problem with the residue treater heater, and assumed the safeguards were active, it did not recommend that management resolve the residue treater startup issues. However, with the interlocks in bypass, the residue treater had insufficient protections to prevent accumulating a large quanti ty of cold, highly concentrated methomyl and MSAO in the residue treater. The CSB investigators noted another significant PHA performance deficiency, namely that the PHA team identified an issue with the old control system that persisted in the new system: The control system for methomyl is antiquated and there is no Safety Instrumented System (SIS) for a process with an above average level of hazards and risks. The operators have access to the control system that allows them to make unauthorized program ch anges and to alter alarm settings...

ANSI/ISA standard 84.00.01

– 2004 ( Functional Safety: Safety Instrumented Systems for the Process Industry Sector ) – which is a recognized good engineering practice required for compliance with the OSHA Process Safety Management standard – recommends a Safety Instrumented System that is separate and independent from the basic process control functions. Among other requirements, the standard provides that “Bypass switches shall be protected by key locks or passwords to pre vent unauthorized use.” Despite knowing that interlock settings could be accessed and changed by the operating staff without proper safety reviews as required by the management of change program, the PHA team did not make any recommendations to improve com puter access control. In the August 2008 incident, lack of55 password access control to the new DCS allowed the staff to bypass the safety interlocks, which directly resulted in the runaway reaction and catastrophic residue treater failure.



### 3.3.3 Inadequate Process Safety Information Reviews The PHA did not adequately incorporate the process safety information used as a basis for the assumptions and conclusions. The process safety information package from the original construction project discussed the importance o f controlling the methomyl concentration in the flasher bottoms feed to the residue treater to preclude a runaway reaction. The Methomyl Process Description in the SOP discussed the importance of controlling methomyl concentration in the residue treater at least five times. For example, it cautioned, “Even with normal flow rates, care must be taken to prevent over concentrating residues in the mother liquor flasher tails.” Again, it warned, “The interlocks should prevent feeding the tank when it is cold, but if the methomyl concentration is above 1.3%, a run away [sic] reaction could result upon heating the tank.” In contrast, the PHA team concluded that a high residue concentration in the f lasher feed was an operations issue having “no consequence.”Another PHA item concluded, without substantiation, that the residue treater feed valve lowtemperature safety interlock would “function as intended” and prevent a high methomyl concentration runaway reaction. A September 1994 PHA considered high methomyl concentration caused by off- specification solvent in the crystallizer. However, that PHA team concluded that the solvent recovery system and the residue treater system could handle the excess methomyl because they considered the existing safety interlocks to be adequate protections. The team did not consider any operational errors or startup and shutdown scenarios that could lead to a large quantity of under- temperature methomyl and MSAO in the residue treater.

The 2005 PHA team used the “ Bayer Crop S cience PHA Quick Reference Guide ” to qualitatively evaluate the unmitigated and mitigated risk for various scenarios and determine whether the system needed more protections. It concluded that high methomyl concentration downstream of the56 crystallizer was only a prod uct quality problem, which the operations staff would resolve. In analyzing a possible residue treater rupture caused by a runaway reaction scenario, the team assumed that the low temperature interlock and the operating sequence described in the SOP provided adequate controls to prevent feeding methomyl until the system was at the minimum safe operating conditions. Based on these protections, the team determined that the outcome was in a range that the guide listed as not requiring additional protections. H owever, the original design basis concluded that a relief system could not be designed to prevent a catastrophic failure of the residue treater if the methomyl concentration exceeded the design limit.



### 3.3.4 Analysis Deficiencies In addition to analyzing the h azards of a process based on the equipment information , the PHA should examine the human interactions with the equipment. In particular, for operational tasks that depend heavily on task performance and operator decisions , the team should analyze the proce dures step -by- step to identify potential incident scenarios and their consequences, and to determine if the protections in place are sufficient. According to “Guidelines for Hazard Evaluation Procedures” (CCPS, 2008), Personnel may have less operating e xperience with procedure-based operations that are heavily dependent on task performance and operator decision- making. In addition, safeguards may be bypassed or not fully functional during some modes of operation such as at start-up of a continuous process. Performing a hazard evaluation of procedures can identify steps where the operator is most vulnerable and point to means of reducing the risk of an incident, such as by adding engineered safeguards and improving administrative controls. The publication further recommends that procedures expected to involve major hazards should be subjected to a detailed procedure-based HAZOP study using guide words similar to those us ed for57 batch chemical processes. CCPS also gives guidance for hazard analyses for proces ses that include programmable control systems, chemical reactivity hazards, facility siting, and the combination of tools such as Hazard and Operability Studies with Layer of Protection Analysis. The PHA team could have addressed all these topics in analyz ing the methomyl process.


## 3.4 Pre- Startup Safety Review The CSB concluded that Bayer did not conduct an adequate Pre- Startup Safety Review (PSSR) for the control system upgrade and the residue treater replacement. Furthermore, staff interviews indicated that t he limited PSSR work did not directly involve operators or other subject matter specialists. An eight

- page checklist recorded the PSSR for the residue treater and required a “yes,” “no,” or “not applicable” checkbox mark for a series of questions and key s ubjects; a field at the bottom of the page was available for comments. The PSSR team incorrectly identified some items as being completed when they clearly had not been. For example, the team did not identify the SOP inadequacies that should have been addr essed in the PSSR checklist item, “Do operating procedures exist that adequately cover the MOCR (management of change review)?” The existing operating procedures were not revised to address information specific to the new control system. However, the
PSSR question was incorrectly answered “yes.” The PSSR for the control system change had errors involving equipment checkouts that were marked as complete. A thorough PSSR should include verification that all equipment has been installed and configured for star tup before any chemical is introduced into the system. As discussed in Section
2.2.1 , while starting the unit, staff discovered that a valve had not been installed on a solvent drip line and that another valve was broken. The PSSR missed these two equipment installation problems that directly contributed to the overconcentration of methomyl in the flasher bottoms and ultimately led to the residue treater explosion. The control system PSSR also had errors involving incomplete items. Although the PSSR marked the items as incomplete, the team did not record due dates for follow -up items. For example, the PSSR58 asked whether adequate technical coverage had been specified f or the startup, and the PSSR team marked the item “no.” They listed two people as responsible for this follow -up, but did not specify a due date for completion. Section 0 discusses the lack of sufficient technical coverage during the startup.


## 3.5 Human Factors Deficiencies 3.5.1 Control System Upgrade The introduction of the Siemens PCS7 control system significantly changed the interactions between the board operators and the DCS interface. The Siemens control system contained features intended to minimize human error such as graphical display screens that simulated process flow and automated icons to display process variables. But the increased complexities of the new operating system challenged operators as they worked to familiarize themselves with the system and units of measurement for process variables differed from those in the previously used Honeywell system. 37

Human interactions with computers are physical, visual, and cognitive. New visual displays and modified command entry methods, such as changing from a keyboard to a mouse, can influence the usability of the human- computer interface and impair human performance when training is inadequate. Operators told CSB in vestigators they were concerned with the slower command response times in the Siemens system and they talked about the methomyl process control issues they would face during the restart, which was much more difficult to control than the Larvin process.
Boa rd operators also told CSB investigators that the detailed process equipment displays in the DCS were difficult to navigate. Routine activities like starting a reaction or troubleshooting alarms would require operators to move between multiple screens to c omplete a task , which degraded operator awareness and response times.

37 For example, one variable in the old computer system was displayed as “percent full” whereas the new

system recorded total “pounds” in the vessel.59 The old system display and command entry was basically a spreadsheet, or line

- item display. The new system used a graphical user interface (GUI) that displayed an illustrative likeness of the process and its various components ( Figure 18 ). The board operator selected the device that needed to be changed. This made data entry clearer, but much slower . In the old system, board operators could change multiple process variables simultaneously, but they could select and change only one variable at a time in the Siemens system.

Figure 18 . Typical Siemens work station screen disp lay60 The new control system also changed how board operators monitored multiple pieces of equipment. The methomyl board operators’ station had five display screens available to monitor the methomyl processes and one display screen dedicated to process alar ms. However, operating some methomyl equipment required the operators to use at least three of the five display screens. To simplify the operation, they asked the Siemens project engineers to add equipment overview screens to display multiple pieces of equipment. The board operators believed that the overview screens would provide more effective control of the unit; however, the screens were not available for the August 2008 startup.



### 3.5.2 Operator Training The Siemens system switchover configuration for the Larv in unit began in early 2006, and the Larvin unit startup with that new DCS occurred in early 2007. The Larvin board operators attended four sessions of formal training during their shifts prior to the actual Larvin start-up. A Bayer process engineer and a contractor from the engineering company that configured the DCS conducted comprehensive training on the Larvin system before the Larvin unit was restarted. Board operators also used a Siemens operating station simulator to learn the Larvin system DCS funct ions and familiarize themselves with controlling different devices such as block valves, control valves, and pumps. Informal, on- shift training also took place and resources were available during the Larvin startup to assist operators, and support continue d to be provided as needed.

For the Larvin system, board operators received a document labeled the “Siemens training manual” that included a system architecture description; glossary of tag names for controllers, alarms, and indicators; and an overview of the screen layouts. The manual also included a description of the application of operational and safety interlock matrices. Well -designed training manuals typically contain precise descriptions of computer control steps, icon definitions, menu hierarchy, and equipment- specific control examples. However, the Siemens training manual was not a well -designed61 computer system training tool. The information in the manual did not correspond with the procedural steps the operators would take to run the control system. According to the Center for Chemical Process Safety (CCPS, 1994) control system providers should develop training tools and procedures based on how the user perceives the task. Using those tools in conjunction with classroom sessions and simulator training on normal and abnormal conditions fully prepares operators for transitioning to a new control system.

M anagement concluded that comprehensive formal training and practice using the new DCS on the

m ethomyl process was unnecessary. They incorrectly assu med the methomyl and oxime board operators had become proficient from the many operating hours using the DCS on the Larvin unit. Methomyl and oxime board operators had minimal training on a few specific processes, but general training took place during the operators’ shift as time allowed, and was self- directed and self -paced. Informal, on-the- job training intended to develop the necessary skills to run the system can lead to inappropriate or incorrect practices that became the norm in the absence of proper training tools and instruction (CCPS, 1994). The CSB concluded the training was inadequate.

Prior to the methomyl startup, management provided operators time on the console during the DCS upgrade to practice using the new system. However, management did n ot require any methomyl operator to use this time to learn and practice operating the methomyl unit, and operators could decide for themselves how much time they needed to become familiar with the new DCS. Management also assumed that operators directly in volved in designing the mimic displays, such as the one in Figure
18 , and other customizable features would have had adequate exposure to the new system.

Although operators had become proficient using the system on the Larvin unit, they acknowledged that the new methomyl control system created new challenges with operating the methomyl process unit, some of which were driven by the highly complex process chemistries in volved in synthesizing methomyl. Substituting previous control system experience for training on a new process can be62 problematic. Even minor differences in operation challenge an unfamiliar operator unless the operator has had process- specific training on the new equipment (CCPS, 1994 ).

Operators also told CSB investigators that the mouse interface command entry sequence responded slower than the Honeywell keyboard command entry process. They also reported that they were not familiar with some of the revis ed units of measure used to display equipment status and operating conditions that had been changed with the new DCS system installation. For example, one operator reported that the old control system used “percent full” to indicate the level in a vessel, but the new control system listed the level in total gallons inside the vessel. The methomyl operators had to improvise solutions to resolve the confusion by attaching paper conversion sheets on the work console for quick reference. However, at the time of the incident, some conversion charts had not yet been made. One operator told investigators:

There was an issue with the solvent ratio, because when we went to the Siemens system the ratio was a different number...We were not sure if we were feeding the wro ng amounts...When we first started this process we were pretty much guessing...No one came in and told us what amounts to put in for the new system. As with any new control system, the Siemens system required process tuning before it was placed in service. Spe cifically, an issue arose in the MIBK -hexane separation column: high MIBK concentration prevented the automatic control system from effectively operating the separation column. The board operators observed that the column temperature was fluctuating undesirably and that the automated valves were operating sluggishly. The unstable MIBK

- hexane separation column caused excess methomyl to pass downstream as there was too little hexane in the system to achieve proper methomyl crystallization. Had the board operators received comprehensive DCS training, they might have recognized the problem much sooner.63 

### 3.5.3 Operator Fatigue Unit startups and shutdowns typically involve significant increases in staff workload, which may result in longer work hours and extended back- to

- back workdays. Many operators and other key staff were working 60 to 70 hours per week prior to the August 2008 methomyl startup, and some reported working 18-hour shifts with only 6 hours of downtime. Overtime and shift work demands disrupt sleep cycles and cause fatigue, which can adversely affect performance and safety (Stanton, 2010). The rigors of shift work, rotating between day and night shifts, and working large amounts of overtime can impair decision -making, reaction times, and degrade communications. Performing infrequently used startup and shutdown procedures while fatigued increases the chance of errors. Fatigue also degrades competencies and alertness necessary to successfully operate an unfamiliar control system. Personnel are more likely to make mistakes as fatigue increases. Labor- intensive,

non- routine activities including integrating utilities such as steam and other ancillary systems into the startup sequence complicate operator startup duties. The staff was confronted with many startup problems and equipment malfunctions. The startup was further complicated because of the new, unfamiliar process control system. However, the CSB was unable to determine if fatigue specifically contributed to any of the staff actions during the startup, or the decisions to continue the startup in spite of the ongoing problems.


## 3.6 Shift Change Communications Operators maintained an electronic notepad (eLog) on the computer system to summarize daily progress and identify ongoing activities for the incoming shift. They also held a verbal turnover meeting in the control room when shifts were changing. However, a number of key items were inadequately addressed in the shift change during the morning and evening shift changes the day of the incident. Had the written and verbal shift turnover activities been properly performed, the incident most likely would not have occurred.64 As discussed, the solvent run and residue treater prefill and heatup were not performed on the residue treater, yet these deficiencies were never entered in the eLog nor were they discussed in the shift change meetings by either the board or the outside operators. Second, the night shift staff did not inform the day shift crew that they had started filling the residue treater with flasher bottoms. Third, the methomyl unit day shift operator, distracted while assisting another board operator with an operational problem at the end of his shift, neglected to inform the incoming night shift operator that the lab results from the scheduled flasher bottoms sample identified excessively high methomyl concentration. Believing that the operators had not ye t started the residue treater system and it remained empty, the day shift outside operator did not collect the residue treater liquid sample as the residue treater SOP required.


## 3.7 Procedure Deficiencies The CSB identified significant problems with the methom yl unit SOP. As noted, the operators were using an unreviewed, unapproved draft SOP. Regardless, the draft SOP was essentially the same as the previously approved SOP; the deficiencies discussed below existed in the earlier version. The SOP was so complex that the table of contents spanned more than 12 pages. The SOP contained more than 1000 pages organized in 16 major sections that included much more than procedures typically used by unit operations staff to operate the process equipment. Subjects unrelate d to process operations such as Change Procedure, Vendor Information, and History of Major Incidents were in the SOP. The methomyl unit SOP was last updated and approved in May 2006. Only about 400 pages of the SOP contained detailed startup, normal operation, and emergency shutdown procedures for operating the unit with the Honeywell computer operating system. It was65 available only from the computerized document control system. Operators could print specific pages for information only purposes. 38
Many operators reported that they did not rely on the SOP: they felt that they understood how to run the unit correctly without instructions. The SOP complexity may have also discouraged its use. This may be acceptable for frequently performed tasks but, t o prevent errors, directly using the written procedure is critical especially when performing infrequent or uncommon tasks such as start-up after a major turnaround.


## 3.8 Process Chemistry Problems Safe and correct operation of the methomyl unit involved closely controlling many complex chemical reactions. However, during the August startup the staff was confronted with equipment malfunctions and process chemistry problems in key equipment including:

**•** The methomyl reactor,

**•** The MIC stripping still (MSS) side -draw condenser,

**•** The crystallizers,

**•** The MIBK -hexane column, and

**•** The residue treater.

During steady- state conditions in the methomyl reactor, MIC and MSAO react to form methomyl. Bayer ran the reactor with enough excess MIC to consume as much MSAO as poss ible, which minimized the MSAO content in the methomyl product. On the day of the incident, the MIC to MSAO ratio was lower than normal, which left more MSAO unconverted and formed less methomyl. Adding hexane to the dissolved methomyl and solvent caused the methomyl to crystallize. The crystallized methomyl could then be separated from the liquid solvents in the centrifuges. However,

38 Printed pages contained a note at the bottom of each page that said “Uncontrolled when printed.”66 excess MIBK caused the MIBK -hexane ratio to be out of specification so that the methomyl remained in solution and passed directly through the centrifuge. Not understanding the chemistry imbalance, the staff concluded that methomyl was not being synthesized in the reactor. Had they reviewed the lab results from routine flasher feed liquid samples downstream of the crystallizer they would have quickly recognized that the reactor was producing methomyl and the problem was related to the solvent ratios. Four flasher feed samples that had been collected over 2 days contained methomyl significantly above the acceptance criteria. Duri ng the solvent recovery step, uncrystallized methomyl accumulated in the flasher bottoms significantly above the concentration normally fed to the residue

treater. The residue treater cooler had enough capacity to remove the heat of reaction from the deco mposing methomyl if the average concentration in the residue treater did not exceed about 0.5 percent. As the methomyl concentration in the residue treater climbed, the decomposition reaction rate increased exponentially 39

The methomyl decomposition reaction had important characteristics: until the heat and evolving gases generated enough pressure to overcome the relief system capacity and rupture the residue treater.

**•** It was an exothermic, or heat

- releasing, reaction;

**•** It was a self reaction, as methomyl needed no other chemicals to begin decomposing;

**•** The reaction rate was faster at a higher temperature and higher methomyl concentration; and

**•** It rapidly produced non- condensable gases and solvent vapors.

39 As the temperature increases, the rate of a chemical reaction generally increases exponentially.67 The original design of the residue treater included features to control the reaction rate. First, the residue treater was intended to operate between 30 and 70 percent full of MIBK to ensure the feed to the residue treater flowed into a large volume of hot solvent. The hot solvent provided four functions:

**•** It diluted the incoming feed, which reduced the concentration of methomyl;

**•** It heated the incoming methomyl so that the methomyl would decompose quickly and not accumulate to a high concentration in the residue treater; and

**•** It absorbed the heat from the methomyl decomposition.

The second important safe operating condition involved the startup sequence, which was intended to ensure a safe decomposition rate at the beginning of the run. The control system contained interlocks to prevent opening the residue treater feed valve if the temperature, level, and pressure were not within the specified operating ranges. First, the operators had to fill the residue treater with solvent and start the recirculation pumps. Next, the circulation loop had to heat the solvent to the minimum operating temperature. Only then would the automatic feed control system open the flasher bottoms feed valve to begin feeding the methomyl -solvent into the preheated and circulating MIBK. This sequence assured that enough solvent was pre sent to absorb the heat generated from the MSAO and methomyl decomposition reactions, and that the solvent was hot enough to ensure rapid decomposition to prevent the methomyl from accumulating in the residue treater. The purpose of the residue treater was to eliminate the methomyl from the solvent before the solvent was used as a fuel in the boiler. The feed also contained unconverted MSAO. Like methomyl, MSAO decomposes exothermically, but will begin decomposing at a lower temperature than methomyl. As MSAO content in the auxiliary fuel was not a concern, the staff likely was not aware that MSAO decomposition played a role in residue treater performance and temperature control. Although the temperature in the residue treater was lower than normal operation , the MSAO and methomyl began decomposing. Because they were both present in abnormally high concentrations,68 the decomposition generated a significant amount of heat. The operators filled the residue treater to about 35 percent with flasher bottoms and the n pumped hot MIBK into the residue treater to bring the level up to 50 percent. After starting the recirculation pump, the board operator set the recirculation temperature control to the automatic mode to begin the normal heating cycle. As discussed earlie r, the closed steam valve prevented the heater from heating the liquid. The board operator was unaware that the temperature was climbing because large quantities of MSAO and methomyl were decomposing in an uncontrolled fashion. The rapidly forming gases o verwhelmed the vent system and the residue treater pressure started climbing. The rate of reaction continued increasing until the evolving gases caused the relief system to activate and then overwhelm the relief system. The pressure rapidly rose until the residue treater suddenly ruptured. The relief device was sized to handle an external fire around the residue treater, but only if the residue treater contained less than 2 weight percent methomyl equivalent (280 pounds). Post- incident analysis estimated that the residue treater contained at least 40 weight percent methomyl and 7 weight percent MSAO just before the runaway reaction initiated, which could not be safely vented by the existing relief system. The most important layer of protection against ove r- concentrating methomyl in the residue treater was the minimum temperature and minimum flow interlocks on the flasher bottoms feed valve, which were bypassed the night of the incident. The administrative controls requiring laboratory sampling were not robust. The most important variable, the chemical composition of the flasher bottoms going to the residue treater, was not required to be analyzed before or during residue treater operation. Although analysis results for samples would likely have alerted the operators to the high risk situation of concentrated methomyl accumulating in the residue treater, these lab results took more than an hour to process, too long to be an effective input to the operators to prevent overcharging the residue69 treater with conc entrated methomyl. The existing layers of protection were inadequate to prevent a runaway reaction.


## 3.9 Unit Restart Equipment Problems Unit staff encountered many problems with equipment during the restart activities. One involved a longstanding issue with the residue treater heater operation. Others were directly related to the new control system installation, and some involved equipment malfunctions or misaligned valves.



### 3.9.1 Residue Treater Heater Performance The original design basis specified the minimum residue treater operating temperature to be 85 °C (185 °F), but early system runs did not adequately decompose the methomyl at that temperature. Subsequent kinetic studies determined that the ideal safe operating temperature to achieve the required methomyl decomposition was 135 °C (275 °F). Engineers added a heater in the residue treater recirculation system to preheat the MIBK solvent to the higher minimum temperature. However, more than one board operator told CSB investigators the heater could increase the temperature to only about 130 °C (266 °F). To resolve the issue during start -ups, some board operators bypassed the minimum temperature safety interlock and manually opened the flasher bottoms feed valve when the residue treater solvent temperature was wi thin about 5-10 degrees of the operating temperature. After feeding methomyl and MSAO into the solvent, the exothermic decomposition reactions generated enough energy to heat the contents the remaining few degrees needed to satisfy the minimum temperature interlock setpoint, but not enough energy to cause an explosion. Thus, operators became accustomed to bypassing the interlocks and manually opening the feed valve before the residue treater contents were at the minimum operating temperature.

On the night of the incident, the residue treater was not pre -filled with solvent, and based on experience with the heater, the minimum temperature safety interlock was bypassed. The flasher bottoms were hot enough for the concentrated MSAO and methomyl to begin decomposing. The70 temperature continued climbing until the reaction reached a runaway condition that led to the explosion.



### 3.9.2 Broken, Missing, and Misaligned Valves Other equipment problems continued to disrupt the operators and cause chemical imbalances in the
sys tem.



### 3.9.2.1 Instrument Drip System Valve The instrument drip system provided MIBK solvent to various components and instruments to prevent solids from depositing and accumulating inside pipe and equipment. As “drip system” implies, MIBK was intended to be added using a minute, drip- wise flow rate into the process stream. During the methomyl unit outage, a valve on the instrument drip system was inadvertently left out of a line, so that MIBK flowed continuously into the system. This oversight was not discovered and fixed until the day before the incident, which allowed off- specification material to proceed through the process. This “hydraulic load” made maintaining balanced operating conditions in the methomyl crystallizers more difficult, which contributed to the high methomyl content in the flasher bottoms feed to the residue treater.



### 3.9.2.2 Cooling Water ValveA broken cooling water valve on an upstream distillation column side-draw condenser further overconcentrated the MIBK. Without the cooling water, MIBK was not con densing out of the vapor stream, worsening the solvent ratio imbalance.



### 3.9.2.3 Residue Treater Recirculation System Block Valves While examining the damaged unit, CSB investigators discovered, and Bayer later confirmed, that a valve on the residue treater recirc ulation heater steam supply was closed, instead of fully opened as intended. This incorrect valve position should have been identified either during a formal valve alignment checkout before the unit restart began, or during a residue treater system solvent run.71 However, the staff did not perform either activity before they began the unit restart so the misaligned valve was not detected during the startup. The board operator told investigators that he believed that the heater was working correctly because

t he residue treater temperature was increasing in a similar way to what he had expected during a residue treater startup. The CSB concluded that the residue treater liquid temperature was climbing because highly concentrated methomyl and MSAO were already decomposing and the self -sustaining decomposition reactions were rapidly increasing and would soon go out of control.

Post -incident examination of the computer data suggested that steam was flowing into the heater ( Figure 19 ). However, the CSB concluded that with the steam supply block valve confirmed to have been in the closed position, 40

Another equipment malfunction that should have been identified before the restart involved the residue treater heating/cooling control configuration in the DCS. About 15 minutes before the residue treater explosion, the data indicated that recirculation fl ow suddenly dropped to zero ( the only possible explanation for indicated steam flow was an improperly calibrat ed instrument, misaligned vent valve, or malfunctioning flow instrument. This was yet another example of the inadequate system checkout.

Figure 11 , bottom trace).

40 The valve was removed from the pipe and visually examined. Water placed in the valve body did not leak

past the seat in any measurable amount.72 Figure 19 . Indicated steam flow through the residue treater heater. Vertical dashed line shows point of vessel failure. Actual flow was zero because valve was closed

Figure 20 . Closed steam block valve recovered from residue treater heater steam supply valve73 It was determined that the automatic temperature control system closed both the heater and cooler flow control valves (see Figure 10 ) at the same time when the recirc ulation temperature control transitioned from heating to cooling. Bayer examined the temperature controller and its investigation team concluded that [An] undocumented change in the heating/cooling control scheme was made during the control system upgrade that resulted in a flow restriction when changing from heating to cooling. Regardless of this control system error, both the CSB and Bayer concluded that even if full flow had been established, the cooler could not remove enough heat to stop the runaway reaction and prevent the explosion.



### 3.9.3 Other Process Equipment Problems At the Institute facility, supervisors commonly left their passwords logged in to allow operators to bypass safety systems considered troublesome during startup. Without supervisors’ direc t involvement, best practices were ignored to get the process underway quickly. The excessively high concentration of MIBK caused by the equipment malfunctions upstream prevented the methomyl from crystallizing in the crystallizers: the methomyl remained d issolved in the solvent. Dissolved methomyl remaining in the solution caused the liquid level in the centrifuges to trip a high -level alarm and abort the centrifuge cycle. Operators, unaware that the problem involved a solvent ratio imbalance in the crystallizers, used the unsecured control system supervisory access 41

41 Safety matrix and operating matrix function changes were administratively controlled using a secure

password to prevent inadvertent or unauthorized changes or bypassing without engineering approval. However, during startup, a supervisor logon to the operator matrix edit scre en was left active so that anyone could defeat the control functions. screen to bypass the centrifuge high -level trip interlock and operated the centrifuges manually.74 Improper or incomplete checkout and calibration of the Siemens control system caused more centri fuge problems. A malfunctioning relay in the new system caused the centrifuges to trip off when the operators attempted to run both at the same time, which was the normal condition. That problem combined with many recurring high- level alarms in the centrifuges led operators to believe that the two issues were linked. They did not recognize the real issue: the malfunctioning equipment upstream of the crystallizer prevented proper methomyl crystallization. Uncrystallized methomyl increased the liquid level in the centrifuges, which triggered the high level alarms.


## 3.10 Air Monitoring Systems Deficiencies 3.10.1 Fenceline Air Monitors Fenceline air monitors are often relied on to determine if chemicals released from a plant enter the community. The locations of the monito rs, as well as their limited chemical sensitivity , often make release determinations difficult . On the night of the incident, two property fenceline monitoring devices were operati ng, one on the east side and one on the west side of the facility. The closest monitor was more than 800 feet from the methomyl unit and would be effective only if it were downwind of a release. The monitors were configured to detect chlorine, carbon monoxide, methane, and oxygen. Each monitor contained a 10.6 eV (electron volt) l amp and a VOC sensor capable of picking up chemical compounds only within a certain range of ionization energies . Because the VOC sensor can detect several different chemical compounds, it is useful only in estimating a concentration if the released materi al is suspected and possesses an ionization energy in the detectable range. The AreaRae monitor, which was used the night of the incident, could not detect specific compounds such as methomyl or some of its intermediates . Laboratory analyses of air or swip e samples were the only sampling methods available to determine if methomyl was released, but those tests were performed days later. The fence line monitors were also unreliable because they could not detect buoyant gas releases unless strong wind currents drove the gas back down to the detector locations. Weather conditions the75 night of the explosion, including wind direction and velocity, were unfavorable for proper detection of any toxic or flammable gas by either fence line monitor. 42



### 3.10.2 Unit Air Monitors
T he air sample analyzer collected and analyzed samples at 16 locations in the Methomyl -Larvin unit and near the MIC day tank at 2

- minute intervals. The analytical results were recorded in a data historian and any concentrations exceeding 1.0 ppm triggered a visual alarm notification on a display panel on the second floor of the Methomyl/Larvin control building and at the board operator’s console. The analyzer used a fixed filter photometer consisting of an infrared radiation (IR) source to absorb and detect the concentration of MIC within a range of 0 to 10 ppm. In May 2008, the analyzer malfunctioned and reported erroneous concentrations in excess of 1 ppm and failed to activate control building alarms. Two weeks before the August incident, the monitor data logging system stopped recording for an unknown reason. The analyzer manufacturer worked with Bayer to resolve the problem, but the analyzer was n ot repaired and returned to service before the incident. Unknown to EOC personnel the monitor was not operating the night of the incident. Assuming it was working, they concluded that the explosion did not cause an MIC release, or if MIC had been released , it was being consumed in the fires. The PSSR for the residue treater, completed prior to the methomyl restart, did not specifically list MIC analyzer operation as a requirement for startup or operation.

42 Weather conditions the night of the incident were 66° F (19° C) and calm wind conditions.76 

## 3.11 Organizational Deficiencies One experienced methomyl unit operator described how the organizational structure changes degraded the technical support available during unit operations: When we started getting rid of people

-- not getting rid of people

-- “thinning”

-- less technical assistance , if you will. There were some guys, they were in char ge -- we had a guy in charge of m ethomyl, a guy in charge of oxime, and a guy in charge of the warehouse. And that was their baby. And now we have like one guy doing it all. No shift supervisor.

This and o ther interviews led the CSB investigation team to conclude that the multiple shortcomings in the technical support available to the operators made recognizing and addressing problems with the system more difficult. The reorganization resulted in only one Technical Advisor assigned to the entire Methomyl

- Larvin unit who worked the day shift. The Shift Leader was also available to assist but did not work with the operators on a daily basis, operators relied primarily on the Technical Advisor. However, the ni ght shift did not have a Technical Advisor on duty. If the board operators had a process question during their shift, they could call the Shift Leader or Technical Advisor who was on- call on nights and weekends. The Technical Advisor also served as a liais on to the capital project team. For the system upgrade capital project, Bayer assigned a second Technical Advisor to assist with the increased workload. The first Technical Advisor focused on Larvin production, and the new Technical Advisor, who had no methomyl unit operating experience, focused on methomyl production. The second Technical Advisor had experience as a technical advisor and had DCS control system training. That experience, however, was in a different unit and the training was on a different b rand of control system. A highly experienced methomyl unit operator helped the T echnical Advisor77 with limited project work such as the functional acceptance testing, but the T echnical A dvisor was the primary contact. In the days leading up to the incident, the only assigned Technical Advisor had worked as many as 15 to 17 hours a day, and 10 hours on the day shift preceding the incident. Throughout the evening preceding the incident, operators struggled with stabilizing the operating conditions in the meth omyl unit, and yet the Technical Advisor had already left for the day. During this critical first startup using a new control system, management should have ensured that a highly experienced Technical Advisor was assigned to the control room staff during b oth shifts

. A Run Plant Engineer was another person operators could consult for technical assistance

. The role of the Run Plant Engineer varied depending on the needs in the particular unit and mainly involved working on improvement and repair projects, and turnarounds. The Run Plant Engineer had little involvement on day- to

- day operational support. The Methomyl

- Larvin unit Run Plant Engineer had less than one year of experience before the incident. In his previous assignment, he had primarily defined and installed improvement and repair projects and did not typically deal with unit startup and operating issues. This engineer told CSB investigators that he knew very little about the details of the DCS upgrade project and was not even sure who had been desig nated as the project manager. More importantly, he said he lacked knowledge of the methomyl u nit equipment and chemistry. H e had hoped to learn more about the process by having greater involvement in the unit startup, but was unable because operational difficulties on the Larvin unit demanded his attention. The Production Leader was another resource available to the operators. However, the reorganization also changed the relationship between the operators and the Production Leader. In the tr aditional
structure, only one team of board operators reported to asupervisor, but in the self -directed work structure, the Production Leader was responsible for four self

- directed work teams . The methomyl Production Leader worked the day shift and was re sponsible primarily for administrative activities and had little interaction with the operators related to unit startup and operation.78 The organizational changes directly contributed to the incident causes. With the self- directed team organization in place, management did not directly advise or control the unit restart schedule. The self -directed work team ultimately decided to start the methomyl unit even though the control system and some equipment were not ready and the SOP was not up- to -date. Furthermo re, management was so far removed from the process operation that they were unaware that the operators seldom used the SOP and some bypassed the critical safety interlocks, which directly led to the residue treater explosion.


## 3.12 Previous Methomyl - Larvin Unit Incident On August 18, 1993, at approximately 10:15 a.m. , an explosion occurred in the chloracetaldoxime (CAO) reactor loop of the methomyl unit. At the time of the incident the facility was owned and operated by Rhone-Poulenc. The explosion caused one d eath and injuries to two workers who were in the u nit at the time of the incident . Investigators concluded that a flow indicator malfunction led to

over -chlorination of acetaldoxime, which led to a violent decomposition. They further concluded that the wor kers’ activities were not causally related to the incident. T he explosion ignited a massive fire, which was fueled by flammable liquids being released by ruptured pipes. The investigation team made the following recommendations:

**•** Identify, and treat as cri tical, a ll ESD interlock alarms . Examine and rigorously apply the Inst itute Plant Alarm Management procedure with regard to nuisance alarms; and

**•** Review and revise the u nit procedures for “Disablin g Al arms” and “By

- passing Interlocks” to address a temporary bypass of a safeguard for operational purposes, such as during a unit startup. Contrary to the 1993 recommendation to improve administrative controls involving critical process interlocks, the residue treater incident more than 15 years later directly involved similar improper control system interlock changes.79 

## 3.13 Emergency Planning and Response 3.13.1 National Incident Management System The National Incident Management System (NIMS) is an organized system of roles, responsibilities, and procedures for the command and control of emergency operations. OSHA 1910.120(q) requires that both public safety and industrial emergency response organizations use a nationally recognized Incident Command System (ICS) for emergencies involving hazardous materials. ICS is an organ ized system of roles, responsibilities, and standard operating procedures used to manage and direct emergency operations ( Figure 21 ). Another important component of this network is the Unified Command System (UCS). UCS is a process of determining overall incident strategies and tactical objectives by having all agencies, organizations or individuals who have jurisdictional responsibility participate in the decision- mak ing
process. As part of a comprehensive national incident management system, most state, local, and volunteer organizations are familiar with the NIMS process and use it for even routine incidents. Interviews with the St. Albans fire chief, the Kanawha County Sheriff, and Metro 9 -1- 1 staff revealed knowledge of the NIMS system and their use of the process in routine incidents such as traffic accidents and residential emergencies. On the night of the incident, all of the responding outside agencies communicated via the Kanawha Putnam EOC. However, the Bayer EOC did not use a shared network to communicate with all responding agencies; thus, the responding agencies did not receive timely status updates. Important information updates about the continually changing condition s at the fire scene were not communicated to the other responding agencies (Knoll, 2005).80 Figure 21 . NIMS incident command structure INCID ENT COMMAND STRUCTU RE**~** 

# '""" --1**~** 

# .I

_


# -**~-~**



# -- r 

# ........ 

# - --



# - - -**~-**



# -1 I 

# -1 , - I 

# &- rl 

# - 1 

# rl "- 1 

# , - 

# - - rl- I 

# -**H~ I**  

# H 

# - 1 

# rl 

# - -1 

# - I 

# - -1**~~** 

# I 

# -- H 

# - 1 

## H 

# ,-
- ..... , ----1 Ht,I S:l!1lf\' 

## I 

# H- rl 1 

# Y 

# "'" 1 

# H 

# - 1**~,** 

# - Ili>isroB 

## ----1

- - I 

# , - .-**~,** 

# -I**~** 1 

# "'" -j

- 

# I ----1 I*'IMa2 

## I



# - 181 

### 3.13.2 Kanawha Putnam Emergency Planning Committee
The Kanawha Putnam Emergency Planning Committee ( KPEPC ) history dates back to the 1950s when it began as the Kanawha Valley Industrial Emergency Planning Council to serve as a mutual aid group doing business in Kanawha County. In 1995, the KPEPC began functioning as the L ocal
E mergen cy Planning C ommittees (LEPC) 43

KPEPC activities include conducting emergency dri lls ( e.g., fire or hazardous materials spills) with member companies; holding monthly meetings ; and interfacing with other LEPCs in W est V irginia

. The committee also serves as a resource and supports training of various emergency response agencies

. in Kanawha and Putnam counties. The federally mandated committee includes volunteers from the community, industrial businesses, and representatives from the emergency response organizations in the area. KPEPC has 12 board members, 10 annex committees, and about 125 members that oversee emergency response planning

. It is funded by its membership, the U.S. Department of Transportation, and W est V irginia state grants

.



### 3.13.3 Kanawha Putnam Emergency Management Plan The Kanawha Putnam Emergency Management Plan provides “general guidelines for planning, managing and coordinating the response and recovery activities of local government” in the event of a major emergency or disaster. 44

43 An LEPC is a committee appointed by the state emergency response commission, as required by SARA Title

III, to formulate a comprehensive emergency plan for its jurisdiction. Th e president of the County Commission is responsible for executing the plan when the emergency involves the county. The plan is divided into a “basic plan” and two annexes. The “Functional” annex contains guidelines for participating agencies to use in deve loping
agency -specific operating documents. The “Hazards” annex contains non- routine emergency

44 West Virginia Emergency Act Chapter 15, Article 5, “Emergency Services.”82 scenarios. The Emergency Management Director is responsible for the operational aspects of the plan and plan revisions. The Basic Plan addresses only government al organizations— it fails to address roles and responsibilities of facility personnel in the event of a chemical incident at a facility. The Basic Plan requires that only one EOC be in place for an emergency and all staffing functions be provided by emergency response agencies. Furthermore, the plan states, correctly, that an Incident Commander (IC) is responsible for tactical operations in the field and assigns “absolute control over all on

- scene operations” and requires all emergency activities to conform to the ICS and NIMS.
However, the Basic Plan does not address the facility owner’s roles and responsibilities to establish an internal incident command structure in accordance with the NIMS process. It does not provide any information or direction when t he facility owner assigns the IC and establishes an EOC, as was the case during the August 2008 Bayer incident.

The CSB also found that at least two functional annexes contradict the Basic Plan. Chemical HazMat Response, Annex A16, states that “the manufacturing facility (plant) Incident Commander will be part of the Unified Command structure.” Additionally, Mining Accidents, Annex 26, states that “Initially, the coal company is in charge of the incident.” The annex defines the criteria for official transfer of the incident command to state and federal government agencies when they arrive on

- scene. The omissions and contradictions in the Basic Plan are likely to confuse critical emergency response activities in the event of a fire or chemical release at a f acility.



### 3.13.4 Chemical Release Notification Law In 2009, the State of West Virginia revised the Mine and Industrial Accident Rapid Response System regulation (West Virginia Code Chapter 15 Article 5B), to require prompt reporting of chemical releases. The new law applies to all facilities regulated by the EPA Risk Management Program regulation (40 CFR 68). It does not apply to facilities regulated only by the Occupational Safety and83 Health Administration (OSHA) Process Safety Management standard (29 CFR 1910.119 ). The law requires the facility to notify the Mine and Industrial Accident Emergency Operations Center by telephone within 15 minutes of the industrial facility ascertaining the occurrence of an emergency

event . The regulation also requires the reporting facility to:

**•** Implement a communications system designed to provide timely information to approp riate state and local officials;

**•** Upon request, provide appropriate state and local officials with timely authorized access to the person or persons charged with managing the event on behalf of the facility and the area(s) where the emergency event is being managed or the industrial facility's response to the emergency event is being coordinated; and

**•** Provide appropriate state and local officials with timely authori zed access to any areas affected by the emergency event

. T he law also requires that within 30 minutes of obtaining information that affects the public health, safety and welfare , state and local officials shall notify the public of any hazardous materials or events which may affect the area.


## 3.14 Incident Response and Communication Deficiencies 3.14.1 Bayer CropScience Facility The Bayer IC led the plant’s internal emergency response team but did not have direct contact with the Kanawha Putnam EOC. Because the information to and from the Bayer EOC was not part of a UCS, responding municipal, county, and state agencies were not provided updated and reliable information regarding the status of the incident throughout the response. Concerns expressed post -incident cited a number of troubling issues, including police and fire responders’ potential exposure to toxic substances while performing their duties. Responding agencies also cited the threat to the surrounding communities due to the lack of timely information that would have made for better coordination of the shelter

- in

- place decision

- making process. The CSB could find no evidence of an effort by Bayer to align operations with other responders in a UCS.84 The Bayer IC established radio communication with the Institute VFD fire chief, who was also a Bayer employee; Bayer fire brigade members; and the Bayer EOC. Information relayed to municipal, county, and state agencies that responded to the incident was not first

- hand in most cases and so was prone to errors as information was relayed from one source to another.



### 3.14.2 Facility and Emergency Responders’ Communications Timely and accurate information updates from the Bayer EOC to the outside emergency responders were an issue throughout the incident. The quality and lack of timely information regarding the status of the incident and information necessary to make decisions advising shelter

- in

- place emerged as recurring concerns post

- incident from participating agencies. The agencies also felt that communities were placed at greater risk and that better information would have helped in providing useful advisories to police and fire units.

M ore than 10 minutes elapsed before Bayer was able to alert Metro 9 -1-1 and even then, the information was inadequate. The guard at Bayer’s main guard shack told investigators that he tried several times to call them but was unable to get through. 45 Finally, at 10:42 p.m. contact was made when the guard was calling for an ambulance to transport a burn victim to the hospital. When the
Metro 9 -1-1 operator questioned him about the explosion, the caller indicated that he could not provide any information. 46

Another control and communication deficiency involved possible toxic exposure to on- scene emergency responders. The decontamination area l ocated outside the fire zone was shut down shortly after the all -clear was sounded, but before all the emergency responders involved in the fire Simil ar exchanges continued throughout the night until the all- clear was sounded at about 5:50 a.m. the following morning.

45 The Metro 9 -1- 1 operator made a similar observation as he attempted to call the Bayer site. 46 Ba yer management instructed the guard, who was the official point of contact with Metro 9 -1- 1 for such

communications, not to provide any information other than what the IC directed.85 suppression activities had decontaminated their clothing and equipment. The responders from the Tyler Mountain Fire Department returned to their fire station with contaminated gear. The CSB learned that the next day they complained of symptoms indicative of toxic exposure.



### 3.14.3 Kanawha Valley Emergency Communications Process Improvement Initiatives
The Kanawha Putnam E mergency Plan requires that p olice, fire , and EMS dispatch be coordinated and directed from the Metro 9-1-1 call center. Located in Charleston, W est V irginia , the facility employs about 100 dispatchers, administrative support, and supervisors . All calls fo r emergency assistance requiring municipal or county resources are consolidated through the call center. Metro 9

- 1-1 is also a member of the KPEPC and participates in the committee meetings. To address the communication issues that occurred during the Bay er incident response, Metro 9 -1-1 and KPEPC developed new tools and processes for use by the agencies charged with emergency response in the Kanawha Valley. Post

- incident, Metro 9 -1-1 participated in a drill with the Institute site and local emergency resp onse organizations and implemented the following emergency response improvements:

**•** Developed a list of questions to use when any fixed facility calls the center and trained all telecommunications personnel;

**•** To improve response times when receiving calls for assistance, Metro 9 -1-1 no longer serves as the conduit for KPEPC reporting requirements. 47

**•** Established one -mile zones around fixed facilities for ra pid, automatic reverse ringdown phone calls in the event of a release; Plants complete and submit chemical release information forms to the KPEPC within 14 days of an incident;

47 Releases of Extremely Hazardous Substances as listed in 40 CFR 355, Appendix A, or chemicals that require

release reporting as defined in section 103(a) of the Comprehensive Environmental Response, Compensation and Liability Act (CERCLA), Must be reported to LEPCs within 14 days of a chemical release.86 Table 2. New Metro 9 -1- 1 questionnaire for fixed chemical facilities (Courtesy Metro 9 -1-1) 

### Fixed Facility Chemical Questions
1 What is your name?
2 What is your title?
3 What is the address/Location of the actual alarm?
4 What phone number do we use to call back about the alarm?
5 Is any outside assistance requested? On initial call only: If the nature of the alarm or chemical is not known at this point , cease questions until plant personnel call back

6 What is the Chemical involved?

- How is it spelled? and/or

- What is the CAS number?
7 Is the chemical involved on the "extremely hazardous" list?

8 Has the chemical been released into the air, water, or ground? If there has been a release, is it a "reportable quantity"?
9 Are there any recommended protective actions for the public?

**•** Established a 15

- minute rule (starting when the call is first received) for the Metro 9 -1-1 Emergency Management Director to call for an advisory shelter

- in

- place if the call center has knowledge of an event, but the company has not provided timely or qual ity information about the material involved in the release. (Section 3.13.4 discusses the new state law that requires facility owners to report certain chemical releases to the Mine and Industrial Accident Emergency Operations Center );

**•** Developed a process for emailing residents in the affected zone when a release occurs;

**•** Developed a protocol for notification when a release is reported to Metro 9 -1-1 that uses email, reverse ringdown phone calls, and emergency sirens ;

**•** Increased call center phone capacity by 50 percent to address increased telephone traffic during emergencies;87 **•** Identified mid -level personnel contact information for Bayer, DuPont, and Dow who are authori zed to talk directly with Metro 9 -1- 1 staff during an emergency; and

**•** Developed a matrix that identifies the information that should be provided to the public as soon as it becomes available.

To address the communication problem between the Bayer EOC and M ETRO 9 -1-1, Bayer installed a dedicated telephone line that directly connects the Bayer EOC to Metro 9 -1-1. This is intended to ensure that overloaded phone lines do not block calls between the two parties, which typically occur in such incidents.


## 3.15 Environmental Impact More than 2,000 gallons of toxic and flammable liquid was expelled from the residue treater, ruptured piping, and other equipment, most of which burned in the ensuing fire. Although the residue treater feed contained significant quanti ties of methomyl and MSAO, those chemicals were rapidly decomposing in the residue treater. Post-incident, trace amounts of methomyl were found in swipesamples from equipment in the vicinity of the explosion; however, the specific quantities of undecomposed or unburned methomyl or other toxic chemicals that might have escaped into the atmosphere were indeterminate. The MIC day tank and cross-unit transfer piping were not damaged in the incident. However, the liquid in the residue treater contained signifi cant quantities of methomyl and MSAO products of decomposition and possibly some quantity of methyl isocyanate. 48

48 The flasher bottoms like ly contained small amounts of MIC, and MIC could have been one of the products of

the methomyl decomposition reaction. MIC might have also been released from ruptured process piping and vent piping. MIC is flammable and highly reactive with water; at least some of any released MIC likely burned in the fire or reacted with the water used to88 fight the fires. There were no reports of river water contamination or other offsite ground contamination.


## 3.16 MIC Day Tank Blast Shield Analysis The MIC day tank was adjacent to t he methomyl- Larvin unit. A steel rope mesh ballistic shield (blast blanket), mounted on the sides of and on top of a structural frame, protected the tank in the event of an explosion in the unit or nearby equipment (see Figure 2 ). Flying debris from the residue treater explosion struck the blast blanket. The fires radiated intense heat on the blast blankets. After the incident, Bayer removed the blast blanket and the MIC day tank insulation and associated piping. They visually examined the day tank for impact or heat damage. They also pressure tested the day tank. The day tank showed no evidence of heat damage — the blast mat provided highly effective protection agains t radiant heat from the external fires. The examination and testing confirmed the day tank and associated piping were not damaged by the explosion. As reported by the blast mat manufacturer and confirmed by independent studies, the blast mat provided effec tive protection against penetration by small projectiles traveling at near sonic velocity, as well as penetration by a large fragment travelling more than 100 miles per hour. 49

To fully protect the day tank, the blast blanket and frame assembly had to absorb the dynamic energy from any debris strike. The original structural frame design only con sidered the blast mat weight and wind loading, it did not examine dynamic loading. The CSB analyzed the structural frame to determine if it provided adequate protection against overpressure blast energy and a large projectile An analysis commissioned by Bayer after the August 2008 incident also concluded the blast mat provided effective protection against small, high

- velocity projectiles.

49 The manufacturer worked with the Israeli Defense Force and the Southwest Research Institute to evaluate the

ballistic shield design. Testing demonstrated that it is capable of withstand ing detonation pressures resulting from thousands of pounds of TNT more than 30 feet from the source of the detonation

.89 impact into the blast mat (App endix C). The analysis examined both maximum theoretical deflection and structural component failure. It concluded that the structural frame was adequate to prevent damage to the MIC day tank and attached vent pipe from the overpressure energy. The analysis concluded that the structure provided only marginal impact energy absorption protection from a large fragment strike at velocities predicted to result from the residue treater explosion. Therefore, had the residue treater traveled unimpeded in the direct ion of the day tank, and struck the shield structure just above the top of the MIC day tank, the shield structure might have impacted the relief valve vent pipe. A puncture or tear in the vent pipe or MIC day tank head would have released MIC vapor into th e atmosphere above the day tank.90 

## 4.0 Methyl Isocyanate Risk Reduction at the Institute Facility
4.1 Congressional Action In May 2009, the U.S. House of Representatives Committee on Energy and Commerce sent a letter to the U.S. Chemical Safety Board Chairman requesting that the Board:

1. “Conduct an investigation to determine options for Bayer to reduce or eliminate the use or storage of MIC by switching to alternative chemicals or processes.” 2. “Determine whether Bayer has adequately examined the feasibility of s witching to alternative chemicals or processes.” 3. “Provide specific recommendations for Bayer and its state and federal regulators on how to reduce the dangers posed by on- site storage of MIC.” 4. “Brief our staff on the Board’s findings and recommendations a t the end of its investigation.”
In the fall 2009, the Congress appropriated $600,000 to the CSB fiscal 2010 budget and directed that
the funds [S]hall be for a study by the National Academy of Sciences [NAS] to examine the use and storage of methyl isocyanate including the feasibility of implementing alternative chemicals or process and an examination of the cost of alternatives at Bayer CropScience facility in Institute, WV. The NAS study was designed to address item 1 in the May 2009 committee request. Historical studies addressing MIC alternatives conducted by Bayer and the prior owners of the Institute facility are discussed in Section 4.2

.91 The CSB published a draft scope of work for the NAS study in The Federal Register 50



## 4.2 Alternative MIC Technology Analysis History on April 23, 2010, to solicit public comment. The CSB reviewed all submitted comments and revised the NAS scope of work. The CSB awarded the contract to the NAS in September 2010. The CSB i s currently considering the impact of Bayer’s announcement concerning the planned total elimination of MIC on the NAS study.



### 4.2.1 Union Carbide Corporation Studies UCC began alternative MIC technology research in Nove mber 1976. The initial research focused in the area of “adducts,” which are chemical structures that can be easily added and removed from the desired chemical. The intention of an adduct is to change undesired characteristics of the chemical to which the a dduct is attached. In the case of MIC, the adduct made it water soluble and ultimately less hazardous should it escape containment. However, the MIC adduct was not easily removed, so it contaminated the insecticide products. In July 1984, UCC researched a palladium catalyzed reaction that had the potential to completely eliminate both MIC and phosgene use. However, the cost of the catalyst greatly outweighed any potential feasibility for this process. At the time, it would have cost more than $14 per pound of insecticide, merely to cover the cost of the palladium catalyst, which was cost prohibitive. During its ownership, UCC reviewed 97 patents dealing with alternative technologies to MIC production but concluded that none could perform as well as the existing process. In the last year of the facility ownership, UCC found three different pyrolysis 51

50 The Federal Register

. Chemical Safety and Hazard Investigation Board, National Academy of Sciences

Study, Vol. 75, No. 78 / Friday, April 23, 2010, pg. 21223. techniques that showed promise to

51 Pyrolysis is a term for chemically decomposing organic materials through heating

-- a form of thermal

decomposition.92 eliminate phosgene and/or reduce the MIC stockpile, but sold the facility before completing the studies.



### 4.2.2 Rhone

- Poulenc Studies Rhone-Poulenc continued research into pyrolysis through March 1989, but determined that the pyrolysis approach to manufacturing pesticide products was not cost-effective. Rhone-Poulenc also researched different approaches to operating the processes that us e MIC and phosgene, intending to reduce the stockpiles of both. In all five new techniques studied, Rhone-Poulenc concluded that either the stress placed on the process equipment was too great or the new process would be unacceptably difficult to control. Following the deadly MIC release from the Union Carbide facility in Bhopal, India, in 1984, DuPont implemented a new technology for producing the carbamate pesticide methomyl at its plant in La Porte, Texas, which did not require a large inventory of MIC. The technology also eliminated phosgene from the production process. In DuPont’s technology, the less acutely toxic chemical methylformamide is converted into MIC on an as-needed basis and immediately consumed in a subsequent reaction, avoiding the need to store MIC. In the 1980s, Bayer itself used a similar approach to producing the carbamate pesticide propoxur in Europe; according to a published account, Bayer used an alternative chemistry where MIC was produced and consumed in tandem (Worthy, 1985).

Rhone- Poulenc also researched various in -situ processes for MIC, which would allow MIC to be synthesized and almost instantly consumed in the process line. This form of production eliminates the MIC stockpile and often removes the need for phosgene. In February 1989, Rhone-Poulenc analyzed the in -situ process DuPont used but did not adopt the technology, possibly due to patent restrictions. In December 1989, Rhone-Poulenc reviewed what was thought to be a promising in- situ process proposed by Enichem. The Enichem process was going to be used at a facility in Brazil, and the93 suggestion was that it could also be used at the Institute facility. The available historical records did not explain why Rhone-Poulenc did not implement the Enichem technology.



### 4.2.3 Bayer CropScience Studies Bayer CropScience continued to research the Enichem in -situ process that would eliminate phosgene and the MIC stockpile. However, the company reported that a byproduct of this reaction degrades the effectiveness of pesticide products by n early 50 percent. As of August 2010, Bayer claimed that it has had not found an alternative to MIC suitable for its products manufactured in Institute, West Virginia. Bayer however committed to cooperate with the NAS and consider the recommendations that r esult from the NAS study.


## 4.3 Bayer CropScience MIC Storage Reduction Concern expressed by many in the community, local regulators, and Congress ultimately prompted Bayer CropScience to reevaluate MIC use at the Institute facility. In August 2009, the company reported that the use of MIC would not be eliminated at the facility and that in -situ production of MIC at the operating units where MIC is used was not a viable alternative. However, Bayer committed to significantly reduce the on -site inventory of MIC, make process unit upgrades, and continue to study alternate chemistries that could eliminate the need for MIC for pesticide production. The full text of the Bayer CropScience announcement is contained in Appendix D. Bayer management announced the following p lanned changes at the Institute facility:

1. Reduce the MIC storage at the Institute facility by 80 percent; 2. Eliminate all aboveground MIC storage; 3. Eliminate all transfer, storage, and use of MIC in the West Carbamoylation Center; and 4. Eliminate manufacturing methomyl and carbofuran. Bayer did not repair the damaged Methomyl unit and abandoned methomyl production at the Institute facility. Bayer negotiated a carbofuran unit shutdown schedule with FMC, the owner of the unit,94 which ended carbofuran production in August 2010. 52

Bayer also committed to replacing the MIC production unit underground storage system with new, smaller storage vessels and a new underground contain ment vault. Bayer further committed to decommissioning the remaining aboveground storage vessels at the facility. Bayer CropScience management also stated to the CSB it would revise the MIC system Process Hazard Analysis and commission an independent revie w of the PHA. The facility upgrade work is scheduled to be complete by February 2011. Bayer then stopped storing MIC in the Methomyl -Larvin unit day tank.

Subsequent to Bayer’s announcement of its MIC inventory reduction plans, in August 2010 the Environmental Protection Agency and Bayer reached an agreement to phase out th e production of aldicarb, one of two remaining MIC-derived pesticides made in Institute, by the end of 2014. OnJanuary 11, 2011, Bayer announced plans to end the production of both aldicarb and carbaryl by mid2012 and thereby eliminate the production, s torage, and use of all MIC and phosgene. Bayer stated it would continue to produce Larvin at the plant by the conversion of methomyl purchased from commercial sources; however, this process does not require MIC or phosgene to operate.

52 On May 15, 2009, the Environmental Protection Agency revoked all food tolerances for carbofuran and

effectively prohibited the use of the pesticide. The EPA stated that “dietary, worker, and ecological risks are unacceptable for all uses of carbofuran.” See http://www.epa.gov/opp00001/reregistration/carbofuran/carbofuran_noic.htm , January 9, 2011.95 

## 5.0 Regulatory Analysi s 5.1 Occupational Safety and Health Administration 5.1.1 Process Safety Management Program The PSM standard requires employers to prevent or minimize the consequences of catastrophic releases of highly hazardous chemicals. PSM applies to processes that involve any of 137 listed toxic chemicals at, or above, threshold quantities and processes with flammable liquids or gases onsite in one location in quantities of 10,000 pounds or more. The Methomyl-Larvin unit was covered by the PSM standard because it contained list ed toxic chemicals including methyl isocyanate (threshold quantity [TQ] = 250 pounds); methyl mercaptan (TQ = 5,000 pounds); and various flammable liquids including hexane and methyl isobutyl ketone, each in quantities significantly above the 10,000 pound flammable liquid/gas TQ. Chlorine (TQ = 1,500 pounds) is also used in the methomyl unit. The PSM standard requires the owner to perform an initial PHA [1910.119(e) ], and to revalidate the PHA at least every five years thereafter. Furthermore, the standard requires the employer to [A]ssure that recommendations are resolved in a timely manner and that the resolution is documented; document what actions are to be taken; complete actions as soon as possible; develop a written schedule of when these actions

are to be completed.



### 5.1.2 PSM Inspections at the Bayer Facility OSHA conducted a planned inspection of the Bayer Institute facility in 2005. The inspection identified deficiencies in PSM program elements including conduct of PHAs and compliance audits. After the A ugust 2008 incident, OSHA conducted a compliance audit that focused on the MethomylLarvin unit.

In addition to the PHA deficiencies discussed in Section 3.3 , both the CSB and OSHA investigations found that many PHA recommendations had not been resolved, including operating procedure96 deficiencies and deficient hazard analyses. Delays in addressing these issues persisted even after the methomyl system PHA conducted i n 2005 identified the problem. 53

The CSB investigation team also identified other significant PSM program deficiencies associated with Operating Procedures [1910.119(f)]; Training [1910.119(g)]; and P re - startup R eview [1910.119(i)], which are discussed in Section The Bayer PSM

- facilitated self

assessment, dated Oct 30 -Nov 9, 2007, again identified that many action items, called “risk sheets,” from the 2005 PHA remained incomplete and unassigned. An internal Bayer memo dated August 7, 2008, three weeks before the incident, noted 48 open risk sheets.

3.0 . The OSHA inspection conducted after the incident identified 12 items that violated the PSM program requirements, two of which OSHA classified as “repeat” violations.



### 5.1.3 PSM Program Deficiency Findings in Other CSB Investigations
The PSM program deficiencies identified in the Bayer incident investigation parallel findings in many other CSB investigations ( Table 3 ). N otably, the BP Texas City refinery investigation identified PSM deficiencies in MOC, PHA, PSSR , and operating procedures practices. At the BP Texas City re finery CSB investigators found that, “deviations from the procedure were made without performing MOC hazard analyses.” The same situation occurred during the methomyl unit startup at Bayer. The CSB identified organizational change control deficiencies exis ted at both BP and Bayer . In the case of the BP incident, the company did not apply the PSM MOC process to evaluate the organization changes in the Isom unit operation. Although Bayer applied the MOC process to the organization redesign implemented in 2007 , the MOC failed to adequately address the impact the changes had on technical support during special operating situations, such as the methomyl unit startup with a completely new control system.

53 The recommendations and corrective action list ed in the 200 5 PHA repo rt to Bayer management contain the

finding that “s ome areas of concern were identified... Many of the risk sheets identified in previous PHAs have not been mitigated.”97 Table 3. Common PSM program deficien cies identified in CSB investigations

PHA MOC PSSR Standard Operating Procedures Bayer (2008) X X X X BP (2005) X X X X Formosa (2004) X X X DPC (2002) X X Honeywell (2003) X X INDSPEC (2008) X X Motiva ( 2001) X X X

Sierra ( 1998) X X X Tosco (1999) X Valero (2007) X X

The CSB determined that PHAs and PSSRs performed at both BP Texas City and Bayer were not sufficient. In both cases, the PHAs failed to address operating conditions involving bypassed or inoperative safety devices. At BP Texas City, the CSB determined that, “none of the PSSR procedural steps were undertaken for the ISOM startup.” This is echoed in the Bayer case, as personnel improperly identified the PSSR as complete , and thus they proceeded with the methomyl unit startup even though equipment was not properly installed or calibrated. At Bayer, longstanding operating procedure deficiencies played a significant role in the accident. As was the case in the BP incident, the CSB found that, “management did not effectively review the available computer records of [SOP] deviations and intervene to prevent future deviations.” The staff should have corrected the operational problems before they proceeded with the unit restart. Furthermore, management did not enforce procedural compliance or proper application of MOC to
ensure SOP errors were cor rected. In all six CSB investigations that identified SOP problems, each98 incident involved SOP deviations that became “necessary violations” to get the job done (Hopkins, 2000).



### 5.1.4 OSHA PSM Chemical National Emphasis Program Since the Process Safety Manageme nt of Highly Hazardous Chemicals standard was promulgated in 1992, OSHA has found that even employers with extensive written PSM programs may not effectively implement the programs on their covered processes. On July 27, 2009, OSHA issued a directive to im plement a pilot national emphasis program (NEP) for chemical facilities covered by the PSM standard. The NEP directs certain OSHA regional offices to verify that the activities actually performed by employers are consistent with the employer’s written prog ram and with the requirements of the standard. This NEP requires auditors to use investigative questions focused on a limited number of specific PSM program activities, rather than the traditional PSM program inspections that involved comprehensive, but br oad, open- ended, and resource

- intensive compliance evaluations. The NEP is intended to “allow for a greater number of inspections by better allocation of OSHA resources” [OSHA Directive 09 -06 (CPL 02)]. It applies to planned inspections in the pilot region s, and unplanned inspections OSHA -wide. On July 8, 2010, OSHA superseded Directive 09-06 with Directive 10 -05. The revision extended the NEP through September 2010 and encouraged State Plan adoption of the program. In October 2010, OSHA extended the direct ive in Regions 1, 7, and 10. OSHA continues evaluating the results of the pilot chemical industry NEP, and plans to make appropriate modifications to improve its effectiveness, and extend t he NEP to all ten regional offices.



### 5.1.5 OSHA PSM Citations Follow

- up Deficiencies OSHA has issued many citations to companies for failure to comply with the PSM standard. Generally, the companies are required to submit written certifications to OSHA that assert the corrective actions have been implemented, as Bayer submitt ed in response to the citations that resulted from the 2005 planned inspection. Furthermore, OSHA can levy significant penalties when99 they determine that a company has a repeat violation, or has failed to abate workplace hazards cited in a previous inspect ion. The CSB found, as did OSHA, that contrary to t he certifications made by Bayer, some corrective actions were not implemented adequately. The CSB further found that OSHA does not always conduct follow-up field inspections to verify that companies have, in fact fully implemented agreed

upon corrective actions. OSHA field inspections that occur through planned inspections, complaints, referrals, or accident investigations do not necessarily examine the adequacy of corrective actions from previous inspectio ns that a company has certified to be complete. Follow-up inspections specifically intended to confirm corrective action status are utilized only occasionally.


## 5.2 Environmental Protection Agency Risk Management Program The EPA Risk Management Program (RMP) regulation (40 CFR 68), mandated by Section 112(r) of the Clean Air Act Amendments of 1990, regulates the use of highly hazardous chemicals at facilities (stationary sources). The purpose of the RMP is to prevent accidental offsite releases of these substa nces and ensure that the company and community are able to respond effectively in case of a release. The regulation applies to facilities that use or store regulated substances that exceed threshold quantities specified in the EPA regulations

.


### 5.2.1 Application of the Bayer CropScience Risk Management Program The Methomyl-Larvin unit and other units in the facility are subject to the RMP rule. The unit contained two listed toxic chemicals , methyl isocyanate (TQ = 10,000 pounds) and methyl mercaptan (TQ = 5,000 pounds). Bayer also reports six additional RMP regulated chemicals are used at the facility ( Table 4 ).100 Table 4 . RMP covered chemicals in Bayer process units

Chemical Threshold Quantity (pounds)

ammonia 10,000

chlorine 2,500

trichloromethane 20,000 methylamine 10,000 methyl mercaptan 5,000 phosgene 500 trimethylamine 10,000

The EPA requires the facility owner to assign to each covered process one of three “prevention program” levels based on offsite consequence analyses, incident history, and PSM program applicability. Program 1 is the lowest, simplest management program. Program 2 is an intermediate management level program with added program elements and basic documentation requirements.
PSM

- covered processes cannot be designated Program 2. Program 3 is the highest level management program. All PSM program activities and records are directly applicable to the Program 3 regulatory activities. Most PSM

- covered processes fall into Program 3, as do the Bayer Institute facility
process es that involve the seven RMP listed chemicals. Each covered process must undergo a hazard assessment (40 CFR 68, Subpart B) in which the owner is required to prepare a “worst case release scenario” and an “alternative release scenario” for each covered process. Different analysis criteria apply based on whether the covered chemical is a toxic or101 flammable material. The hazard assessment also requires inclusion of the “five year accident history.” The results of the hazard assessment, along with other pertinent information for each covered process, must be submitted to the EPA. This Risk Management Plan (40 CFR 68, Subpart G) is prepared and submitted electronically and must be periodically updated by the facility owner. The most recent Bayer CropScience Institute facility Risk Management Plan submittal preceding the August 2008 incident was dated July 2007. It states: The phosgene and MIC units [sic] on- site inventories have been minimized as far as practicable in order to minimize the potential impact in t he event of a release. In 1992 and 1993, the phosgene process was rebuilt and the MIC process was modified to achieve these improvements following a thorough study of potential release scenarios.
The Risk Management Plan also discusses air emissions controls: “All of the processes covered by RMP utilize scrubbers and flares to destroy emissions from the process to minimize releases to the atmosphere.”

The five

- year accident history for the RMP

- regulated chemicals reports an accident that released approximately 15 pounds of phosgene (October 1999), another that released less than 1 pound of chlorine (May 2000), and a third that released approximately 3,000 pounds of liquid chloroform (August 2001). Each resulted in one or more worker exposures, and the phosge ne release prompted a shelter -in place-alert. However, the company reports none of the releases involved offsite
consequences.



### 5.2.2 EPA Inspections at the Bayer Institute Facility The CSB searched the EPA Enforcement and Compliance History Online database for a record of EPA program audits or inspections at the Bayer facility. The database identified three evaluations of the Clean Air Act, Section 112(r), the first in 2005 and the second in 2006, which involved the MIC102 production unit. A third evaluation occurr ed in 2007. 54



### 5.2.3 EPA Office of Inspector General Risk Management Program Review None of the evaluations resulted in any enforcement action by the EPA.

In 2008, the 

### Office of Inspector General (OIG) of the U.S. Environmental Protection Agency conducted a revie w of the EPA implementation and oversight of the Risk Management Program (40 CFR 68). The OIG issued the final report, EPA Can Improve Implementation of the Risk Management Program for Airborne Chemical Releases , Report No. 09-P-0092 on February 10, 2009

. The OIG review found that EPA had not inspected or audited more than half (296 of 493) of the high

risk facilities . EPA 

### Region 3, which includes West Virginia, had the highest RMP inspection rate of high

- risk facilities (96 percent). The report contained two significant recommendations to the EPA:

**•** Strengthen its inspection process to provide greater assurance that facilities comply with Risk Management Program requirements, and

**•** Develop inspection requirements to target higher- priority facilities for inspe ction and track its progress in completing inspections of these facilities.

The CSB also found during other incident investigations involving RMP covered processes that the EPA has seldom performed comprehensive audits or inspections of RMP programs at the facilities where the incident occurred. In a May 2009 memorandum to the Office of Inspector General, EPA Office of Enforcement and Compliance Assurance agreed with the OIG recommendations. It revised the definition of a high

- risk facility and reported that it would “work with the regions to develop an approach for targeting high risk facilities to make the best use of our limited inspection resources.” EPA also revised the fiscal

54 The EPA Enforcement and Compliance History Online database lists Bayer as the owner for t he 2006

evaluation and Union Carbide Corporation as the owner for the 2005 and 2007 evaluation.103 year 2010 National Program Managers Guidance to require the regions to ”re quire at least 10 percent of the total number of 112(r) inspections at defined high risk facilities.” Finally, EPA agreed to improve compliance inspection tracking of high- risk facilities.


## 5.3 State and Local Government Programs 5.3.1 Contra Costa County California Hazardous Materials Safety Ordinance In 1999, the Contra Costa County, California Board of Supervisors approved an industrial safety ordinance 55

**•** The owner shall prepare a Facility Safety Plan and submit it to the department. The Plan shall include: that established broad authority to the county health services department to oversee stationary sources in the refining and chemical industries in unincorporated areas in the county. The ordinance contains the following key elements:

- Human factors and safety cult ure assessments

- Consideration of inherently safer technologies in the PHA.

**•** The county health services department shall :

- Conduct tri-annual audits of all submitted Safety Plans,

- H old public meeti ngs on the facility safety plan,

- C ollect and maintain certa in documents in a public information bank, and

- Conduct an annual program performance review and issue a written report.

**•** The facility owner shall:

- A llow the department to investigate an accident site and directly related facilities and submit an annual report of all accidents,

- Document the decision made to implement or not implement all process hazard analysis recommended action items and the results of recommendations for additional studies, and

- P eriodically conduct a safety culture assessment

.

55 Contra Costa County, California, Ordinance Code Title 4 – Health and Safety, Division 450 – Hazardous

Materials and Wastes, Chapter 450

- 8 – Risk Management.104 The State also authorized the county to collect fees from each covered facility to fund the program. The department maintains a full- time staff of technical specialists who administer the program, perform the required audits, and conduct incident investigations. The City of Richmond adopted a similar ordinance in 2002 that mirrors the Contra Costa County ordinance. The ordinance requires the Health Services department to conduct annual program reviews to evaluate the effectiveness of the program, discuss th e results of audits completed by the department, and present various program metrics. The November 2009 annual audit 56
The number and severity of the Major Chemical Accidents or Releases have been decreasing since the implementation of Industrial Safety Ordinance. The implementation of the Industrial Safety Ordinance has improved and, in most cases, is being done as required by the ordinance. It is believed that by continuing implementation of the Industrial Safety Ordinance and strengthening the requirements of the Ordinance that the possibility of accidents that could impact the community has decreased. concluded:

The ordinance applies to three refineries and four chemical facilities in the county as reported in the audit. The audit report also includes the results of the City of Richmond ordinance, which includes one refinery and one chemical facility. The total fees assessed to the covered facilities in 2008 were less than $440,000. For the same period, the county reported that 4400 hours were charged in support of the ordinance. The report notes a significant decrease in the number of “major chemical accidents and releases” at covered facilities, from 11 incidents in 2001 to zero incidents in 2009.

As the CSB previously noted in its BP Texas City refine ry investigation, the Contra Costa program has the benefit that covered facilities are regularly inspected for process

56 http://cchealth.org/groups/hazmat/industrial_safety_ordinance.php , October 2010.105 safety compliance every three years by a team of trained engineers employed by the county and funded through fee collection. By contrast, as the CSB and others noted, comprehensive OSHA and EPA safety inspections of high

- hazard chemical facilities have historically been infrequent. OSHA and EPA process safety inspections do not occur on a regular schedule and often result only from a serious accident or complaint. 57



### 5.3.2 New Jersey Toxic Catastrophe Prevention Act The New Jersey state legislature enacted the Toxic Catastrophe Prevention Act ( TCPA ) in 1985 in response to the release of MIC in 1984 from the Union Carbide India Limited plant in Bhopal. The TCPA was one of the first regulatory programs in the nation to impose more stringent requirements on chemical facilities to reduce the risk of accidental releases. The TCPA is part of the New Jersey Department of Environmental Protection (DEP) Bureau of Release Prevention and has been accepted by the U.S. EPA for implementing the Risk Management Program regulation (40 CFR 68).

The TCPA is intended to protect the public from catastrophes caused by the release of Extraordinary Hazardou s Substances (EHS) 58 and Reactive Hazard Substances (RHS). 59

57 In 2007, the CSB recommended in its BP Texas City investigation that OSHA “ strengthen the planned

comprehensive enforcement of the OSHA Process Safety Management (PSM) standard” and “ establish the capacity to conduct more comprehensive PSM inspections by hiring or developing a sufficient cadre of highly trained and experienced inspectors.” Facilities covered under

58 An EHS is any substance or chemical compound used, manufactured, stored, or capable of being produced

from on

- site components in this State in sufficient quantities at a single site such that its release into the environment would produce a significant li kelihood that persons exposed will suffer acute health effects resulting in death or permanent disability. 59 An RHS is an EHS that is a substance, or combination of substances, which is capable of producing toxic or

flammable EHSs or undergoing unintentional chemical transformations producing energy and causing an extraordinarily hazardous accident risk.106 the act must submit a Risk Management Plan for all covered processes. Additionally, the DEP may require owners or operators to do the following under the TCPA:

**•** Immediate ly submit a risk management program for the DEP to review ,

**•** Perform a safety review, hazard analysis, or risk assessment ,

**•** Immediately tak e risk reduction actions or implement a risk reduction plan, and

**•** Cease operating until the identified risk s have been ab ated

.
The TCPA incorporates the EPA RMP list of toxic chemicals and threshold quantities; however, the
TCPA EHS list contains several chemicals with lower thresholds than the RMP

. The TCPA list also contains some chemicals for which the RMP does not apply . Facilities in New Jersey that process listed EHSs or RHSs in excess of the threshold quantities must submit a TCPA- specific Risk Management Plan to the DEP. The facility must also submit an EPA

- specific Risk Management Plan as required by 40 CFR 68 Subpa rt G if the chemical is listed in the EPA RMP and the quantity exceeds the EPA threshold quantity. Facilities with substances or mixtures containing substances on the RHS list must conduct a hazard assessment under the TCPA. The RHS list contains 30 specific reactive chemicals and 43 functional groups that exhibit reactive hazards such as water reactivity and pyrophoric or self- reacting properties. Operators must determine applicability of substances and mixtures to the RHS requirements by conducting calori metry tests, literature reviews, or engineering calculations to determine the heat of reaction. The RHS threshold quantity ranges from 13,100 pounds for the lowest heat of reaction value (100 calories per gram) to 2400 pounds for a heat of reaction at, or above 1000 calories per gram. In June 2008, the state amended the act to require facilities to conduct inherently safer technology (IST) reviews, to provide improved risk reduction. A team of qualified experts are required to conduct the IST reviews, as we ll as operations and union representatives. Each covered facility must107 determine whether IST is feasible and take into account environmental, health and safety, legal, technological, and economic factors into the analysis. The IST review must be submitted to the TCPA and updated on a 5-year basis, or with major process modifications. As of March 2010, the TCPA has eliminated the less rigorous RMP Program 1 and Program 2 criteria [40 CFR 68.10(b) and (c)]; it now requires all covered processes to be classified and managed in accordance with Program 3. It is the most rigorous toxic chemical environmental regulatory program in the United States.



### 5.3.3 Hazardous Materials Regulatory Oversight in West Virginia Like Contra Costa County, the Kanawha valley has many facilities that handle large quantities of hazardous materials, some of which are acutely toxic. The EPA RMP database contains 15 facilities that report EPA Risk Management Program covered chemicals assigned as Program level 3 in Kanawha County. Statewide, the RMP database contains 54 facilities with Program level 3 plans. The region contains environmentally sensitive areas such as the Kanawha River, which is also an important transportation corridor. In addition to the serious incident at Bayer’s Institute pl ant in 2008, the CSB is currently investigating a series of incidents that occurred in 2010 at the DuPont chemical plant in nearby Belle, West Virginia, including a fatal release of phosgene gas on January 23. Although the CSBs final report on the DuPont incidents remains to be completed, the incidents at DuPont also reveal process safety deficiencies that were not detected or corrected through existing regulatory enforcement mechanisms. In the Kanawha valley where both Bayer and DuPont are located, neithe r the state nor the local government has a program or regulation in place that requires or authorizes direct participation with facility safety planning and oversight even though many community stakeholders have long campaigned for such involvement.

The W est Virginia Code Chapter 16, Public Health, charges the state public health agency with providing “ Essential public health services ” i.e., activities necessary to promote health and prevent disease, injury and disability for the citizens of the state .” The code authorizes the commissioner of108 the bureau for public health “ To make inspections, conduct hearings, and to enforce the legislative rules concerning occupational and industrial health hazards .” The Secretary of the state department of health and h uman resources may also propose “Fees for services provided by the Bureau for Public Health.” If the West Virginia Department of Health and Human Services were to implement a program similar to the California safety ordinance, it would likely improve stakeholder participation and awareness, and improve emergency planning and accident prevention.109 

## 6.0 Key Findings
6.1 Process Hazard Analysis
1. The PHA team did not validate the assumptions in the PHA including accuracy of the SOP, conformance to the SOP, and control of process safeguards.
2. The residue treater layers of protection to prevent a runaway reaction were inadequate. 3. Previous PHA action items were not closed in a timely manner, including operator training and control of process safeguards. 4. The methomyl unit SOP was overly complex and not reviewed and approved prior to the methomyl unit startup. 5. The SOP did not include flasher tails methomyl concentration testing as required by the original construction process safety information package. 

## 6.2 Pre- Startup Safety Review
1. The PSSR did not include a formal process involving multiple disciplines.
2. The PSSR did not verify the completion of modifications in the field, including:

a. Methomyl

- Larvin unit toxic gas monitoring system was not in service. b. Project engineers did not verify the functionality of critical DCS control and indication circuits.

c. Operating equipment and instruments were not installed before the restart, some of which were discovered to be missing after the startup began. 3. Equipment checkouts as required by the pre

- startup safety review were incomplete:

a. Methomyl -Larvin unit toxic gas monitoring system was not in service. b. Project engineers did not verify the functionality of critical DCS control and indication circuits.

c. Valve lineups were incomplete or incorrect.

4. Control system training was inadequate. The operators were not formally trained on the metho myl DCS and were not familiar with some of the changed units of measure used on the DCS displays.110 

## 6.3 Methomyl Unit Startup
1. Methomyl unit board operators were not provided with computer screen displays to effectively operate all assigned process and utility systems. 2. Multiple operational problems diverted the staff’s attention:

a. Only one of the two centrifuges was operating properly. b. The new Siemens operating system was not calibrated; consequently, the staff struggled with balancing the MIBK - hexane ratio in t he crystallizers.

c. Operators were pressured to start the MIBK solvent recovery system because the MIBK stockpile levels were getting low. 3. Operations personnel incorrectly assumed that methomyl was not being produced in the reactor even though the flasher feed sample lab results were available, which reported excessively high methomyl content in the process downstream from the reactor. 4. Operators and technical staff did not troubleshoot why the centrifuges did not contain methomyl cake. 5. Several required SOP steps were not completed during the methomyl unit startup :

a. The residue treater was not pre-filled with solvent. b. The solvent was not circulated and heated to the minimum operating temperature.

c. The 7 a.m. daily residue treater liquid sample was not collected and analyzed for methomyl concentration.
6. Management did not strictly enforce the safety matrix control policies. Bypassing the safety interlocks on the residue treater flasher bottoms feed valve allowed the empty residue treater to be filled with concent rated methomyl.
7. Oxime system startup problems diverted operators’ attention, resulting in poor communication between methomyl board operators at shift change.111 8. The residue treater relief system design basis was invalidated during the methomyl unit startup:

a. The design basis assumed that the safety interlocks were active, but the interlocks were bypassed. b. The resident treater relief system design basis relied on administrative controls such as sample collection and analysis to prevent overcharging methomyl, but these controls were either incomplete or not implemented before startup.
9. A runaway methomyl decomposition reaction inside the residue treater overwhelmed the vent system and caused the vessel to violently explode. 

## 6.4 MIC Day Tank Shield Structure Design
1. The blast blanket design basis did not consider an impact of a large object moving at high velocity. Had the residue treater traveled in the direction of the day tank and struck the shield structure near the top of the frame it might have resulted in an MIC release into the atmosphere (see Appendix C) 

## 6.5 Emergency Planning, Response, and Communication 6.5.1 Bayer CropScience
1. The Bayer onsite emergency response did not conform to the unified command structure contained in the National Incident Management System (NIMS) protocols. 2. Bayer did not assign a Public Information Officer (PIO) to directly communicate with the Kanawha Pu tnam EOC and Metro 9-1-1. 3. Unknown to Bayer emergency personnel, the Methomyl-Larvin unit air monitor system that they relied on to determine and report airborne concentrations of possible toxic chemicals was not in service the night of the incident. 4. Bayer had only two distant fenceline air monitors to determine the extent of chemical contaminants traveling off site. 5. Although the Bayer IC recommended a shelter

- in -place, the Bayer EOC did not notify Metro 9 -1-1.
6. Bayer discontinued hot zone decontamination act ivities before all emergency responders were able to clean their safety gear.112 

### 6.5.2 Outside Responding Agencies
1. The overloaded telephone system prevented Bayer from promptly notifying the Metro 9- 1- 1 center of the incident. 2. County emergency responders established three separate EOCs in response to the incident, which resulted in duplication of effort, poor communication, and conflicting control. 3. First -responders working near the explosion and fire did not wear adequate respiratory protection and were not decontaminated.


### 6.5.3 Kanawha County Commission
1. The Kanawha Putnam Emergency Management Plan does not adequately address emergency response personnel responsibilities and communications between the facility IC and outside emergency response organizations when a facility owner is responsible for incident command during an on- site emergency involving hazardous chemicals. 

## 6.6 Environmental Impact
1. MIC air monitoring devices in the Methomyl- Larvin unit were not functioning at the time of the incident, preventing the accurate measurement of any MIC release from piping or equipment that might have resulted from the explosion and fires.
2. Two fenceline monitors located hundreds of feet from the incident location were ineffective for detecting toxic chemicals that might be released in to the atmosphere either from process equipment leaks or spills, or combustion products from a major fire. 

## 6.7 Regulatory Oversight
1. Both the Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA) had conducted process safety related audits and inspections at the Bayer facility prior to the incident in August 2008. However, the inspections did not detect or correct all the serious, longstanding process safety problems that were revealed by investigations conducted after the incident.
2. OSHA cited Bayer for deficient process hazard analyses in 2005; however OSHA did not subsequently verify that corrective actions were fully implemented by Bayer. Deficient PHAs were a causal factor in the August 2008 incident.113 

## 7.0 Incid ent Causes

1. Bayer did not apply standard PSSR and turnover practices to the methomyl control system redesign project . Bayer restarted the unit before the equipment was properly tested and calibrated. 2. Operations personnel were inadequately trained to operate the methomyl unit with the new DCS control system. 3. Malfunctioning equipment and the inadequate DCS checkout prevented the operators from achieving correct operating conditions in the crystallizers and solvent recovery equipment. 4. The methomyl- solvent mixtu re was fed to the residue treater before the residue treater was pre -filled with solvent and heated to the minimum safe operating temperature. 5. The incoming process stream normally generated an exothermic decomposition reaction, but methomyl that had not crystallized due to equipment problems greatly increased the methomyl concentration in the residue treater, which led to a runaway reaction that overwhelmed the relief system and over - pressurized the residue treater.114 

## 8.0 Recommendations
The CSB makes recommendations based on the findings and conclusions of its investigations. Recommendations are made to parties that can effect change to prevent future incidents, which may include the companies involved; industry organizations responsible for developing good practice guidelines; regulatory bodies; and/or organizations that have the ability to broadly communicate lessons learned from the incident, such as trade associations and labor unions.


## 8.1 Bayer CropScience – Research Triangle Park, NC
2008-08-I- WV

- R1 Re vise the corporate PHA policies and procedures to require:

a. Validation of all PHA assumptions to ensure that risk analysis of each PHA scenario specifically examines the risk(s) of intentional bypassing or other nullifications of safeguards,

b. Addressing all phases of operation and special topics including those cited in chapter 9 of “Guidelines for Hazard Evaluation Procedures” (CCPS, 2008), and

c. Training all PHA facilitators on the revised policies and procedures prior to assigning the facilitator to a PHA team.

Ensure all PHAs are updated to conform to the revised procedures.


## 8.2 Bayer CropScience - Institute, West Virginia
2008-08-I- WV

- R2 Review and revise, as necessary, all Bayer production unit standard operating procedures to ensure they address all operating modes (start up, normal operation, temporary operations, emergency shutdown, emergency operations, normal shutdown, and startup following a turnaround or emergency shutdown), are accurate, and approved.115 2008-08-I- WV

- R3 Ensure that all facility fire brigade members are trained in the N ational Incident Management System, consistent with municipal and state emergency response agencies.

2008-08-I- WV

- R4 Evaluate the fenceline air monitor program against federal, state, and local regulations, and Bayer corporate policies, and upgrade and install air monitor ing devices as necessary to ensure effective monitoring of potential releases of high

- hazard chemicals at the perimeter of the facility.

2008-08-I- WV

- R5 Commission an independent human factors and ergonomics study of all Institute site PSM/RMP covered process control rooms to evaluate the human-control system interface, operator fatigue, and control system familiarity and training. Develop and implement a plan to resolve all recommendations identified in the study that includes assigned responsibilities, required correcti ve actions, and completion dates.116 

## 8.3 Director of the Kanawha - Charleston Health Department
2008-08-I- WV

- R6 Establish a Hazardous Chemical Release Prevention Program to enhance the prevention of accidental releases of highly hazardous chemicals, and optimize responses in th e event of their occurrence. In establishing the program, study and evaluate the possible applicability of the experience of similar programs in the country, such as those summarized in Section 5.3 of this report. As a minimum:

a. Ensure that the new program:

1. Implements an effective system of independent oversight and other services to enhance the prevention of accidental releases of highly hazardous chemicals 2. Facil itates the collaboration of multiple stakeholders in achieving common goals of chemical safety; and, 3. Increases the confidence of the community, the workforce, and the local authorities in the ability of the facility owners to prevent and respond to accidental releases of highly hazardous chemicals b. Define the characteristics of chemical facilities that would be covered by the new Program, such as the hazards and potential risks of their chemicals and processes, their quantities, and similar relevant f actors;117 c. Ensure that covered facilities develop, implement, and submit for review and approval:

1. Applicable hazard and process information and evaluations.
2. Written safety plans with appropriate descriptions of hazard controls, safety culture and human fact ors programs with employee participation, and consideration of the adoption of inherently safer systems to reduce risks 3. Emergency response plans; and, 4. Performance indicators addressing the prevention of chemical incidents. d. Ensure that the program has the r ight to evaluate the documents submitted by the covered facilities, and to require modifications, as necessary

e. Ensure that the program has right-of- entry to covered facilities, and access to requisite information to conduct periodic audits of safety systems and investigations of chemical releases;

f. Establish a system of fees assessed on covered facilities sufficient to cover the oversight and related services to be provided to the facilities including necessary technical and administrative personnel; and,

g. Consistent with applicable law, ensure that the program provides reasonable public participation with the program staff in review of facility programs and access to:

1. The materials submitted by covered facilities (e.g., hazard evaluations, safety plans, emergency response plans);

2. The reviews conducted by program staff and the modifications triggered by those reviews;118 3. Records of audits and incident investigations conducted by the
program;
4. Performance indicator reports and data submitted by the facilities, and;

5. Other relevant information concerning the hazards and the control methods overseen by the program.

h. Ensure that the program will require a periodic review of the designated agency activities and issue a periodic public report of its activities and recommended action items.


## 8.4 Secretary of West Virginia Department of Health and Human Services and the West Virginia Department of Environmental Protection
2008-08-I- WV

- R7 Work with the Director of the Kanawha-Charleston Health Department to ensure the successful planning, fee collection, and implementation of the Hazardous Chemical Release Prevention Program as described in Recommendation 2008 -08- WV -R6, above, including the provision of services to all eligible facilities in the State.


## 8.5 Kanawha - Putnam Emergency Planning Committe e
2008-08-I- WV

- R8 Work with the Kanawha and Putnam counties Emergency Response Directors to prepare and issue a revision to the Kanawha Putnam County Emergency Response Plan and Annexes to address facility emergency response and Incident Command when such functions are pr ovided by the facility owner.119 

## 8.6 West Virginia State Fire Commission
2008-08-I- WV

- R9 Revise the Fire Department Evaluation Administrative Section Matrix addressing the periodic inspection of local fire departments to include a requirement for inspectors to examine and ident ify the status of National Incident Management System fire department personnel training.


## 8.7 Occupational Safety and Health Administration
2008-08-I- WV

- R10 In light of the findings of this report and the serious potential hazards to workers and the public from chemicals used and stored at the Bayer Institute site (such as phosgene, MIC, and methomyl), conduct a comprehensive Process Safety Management (PSM) inspection of the complex. Coordinate with the Environmental Protection Agency, as appropriate.

2008-08-I- WV

- R11 Revise the Chemical National Emphasis Program and the targeting criteria

to:

a. Expand the coverage to all 10 OSHA regions,

b. Include in the targeting criteria from which potential inspections are selected all establishments that have submitted certifications of completions of actions in response to previous PSM citations;

c. Require NEP inspections to examine the status of compliance of all previously cited PSM program items for which the company has submitted certifications of completion to OSHA.120 

## 8.8 Environmental Protection Agency
2008-08-I- WV

- R12 In ligh t of the findings of this report and the serious potential hazards to workers and the public from chemicals used and stored at the Bayer Institute site (such as phosgene, MIC, and methomyl), conduct a comprehensive Risk Management Program (RMP) inspection of the complex. Coordinate with the Occupational Safety and Health Administration, as appropriate.121 

## 9.0 REFERENCES
Baum, M.R., “Disruptive Failure of Pressure Vessels: Preliminary Design Guidelines for Fragment Velocity and the Extent of the Hazard Zone,” ASME Journal of Pressure Vessel Technology, vol. 110 pp168, May 1988. Cain, Maurice R., Pressure Vessel Assessment Workbook, General Physics Corporation, Titusville, Florida, 1995. Center for Chemical Process Safety (CCPS)

. Guidelines For Hazard Evaluation Procedures, American Institute of Chemical Engineers , Center for Chemical Process Safety, New York , 2008. CCPS. Guidelines for Preventing Human Error in Process Safety, American Institute of Chemical Engineers, Center for Chemical Process Safety, New York , 1994. CCPS. “Human Factors Methods for Improving Performance in the Process Industries ,” American Institute of Chemical Engineers , Center for Chemical Process Safety , 2007. CCPS. Layer of Protection Analysis; Simplified Process Risk Assessment , American Institute of Chemical Engineers , Center for Chemical Process Safety, New York, 2001. Contra Costa County, California, Ordinance Code Title 4 – Health and Safety, Division 450 – Hazardous Materials and Wastes, Chapter 450 -8 – Risk Management

. Faupel, J.H., “Yield and Bursting Characteristics of Heavy

- Wall Cylinders,” Transactions of the ASME, vol. 78 pp 1031- 1064, July 1956

. Hopkins, A., Lessons from Longford, the Esso Gas Plant Explosion. Sydney, New South Wales: CCH Australia Limited , 2000. Health and Safety Executive (HSE), Reducing Error and Influencing Behavior, 2nd ed. U.K. : HSE Books, 1999. HSE, Safety Culture: A Review of the Literature. HSL/2002/25, 2002. Knoll, G. G., Hildebrand, M.S., Yvorra, J. Eds. Hazardous Materials - Managing th e Incident , 3rd edition, Red Hat Publishing: Chester, Maryland, 2005. New Jersey Department of Environmental Protection, Toxic Catastrophe Protection Act, New Jersey Administrative Code Title 7, Chapter 31. Sittig, M., Handbook of Toxic and Hazardous Chemicals and Carcinogens, 5 th edition, William Andrew Norwich, New York, 2008.122 Stanton, N., Salmon, S., Jenkins D., Walker, G., Human Factors in the Design and Evaluation of Central Control Room Operations , CRC Press, Boca Raton, Florida, 2010. U.S. Chemical Safety and Hazard Investigation Board (CSB). Investigation Report, Explosive Manufacturing Incident, Sierra Chemical Company, January 7, 1998, No. 98-001-I-NV, 1998. CSB. Investigation Report, Refinery Fire Incident, Tosco Avon Refinery, Feb ruary 23, 1999 , No. 99- 014-I-CA, 2001. CSB. Investigation Report, Refinery Incident, Motiva Enterprises LLC, July 17 2001 , No. 2001-05-IDE, 2002. CSB. Investigation Report, Chlorine Release, DPC Enterprises, L.P. , August 14, 2002, No. 2002-04- I-MO, 2003. CSB. Investigation Report, Chlorine Release, July 20, 2003, Contaminated Antimony Pentachloride Exposure, July 29, 2003, Hydrogen Fluoride Release, August 13, 2003, Honeywell International, Inc. , No. 2003-13-I-LA, 2005. CSB. Investigation Report, Vinyl Chloride Monomer Explosion, Formosa Plastics Corp., April 23, 2004 , No. 2004-10-I-IL, 2007. CSB. Investigation Report, Refinery Explosion and Fire, BP, March 23, 2005 , No. 2005-04-I-TX, 2007. CSB. Investigation Report, LPG Fire at Valero – McKee Refiner y, Valero Energy Corporation, February 16, 2007, , No. 2007 -05-I-TX, 2008. CSB. Investigation Report,Uncontrolled Oleum Release Petrolia Pennsylvania, INDSPEC , No. 2009- 01-I-PA, 2009. U.S. Environmental Protection Agency (EPA), EPA Can Imp rove Implementat ion of the Risk Management Program for Airborne Chemical Releases , Office of Inspector General Report No. 09-P-0092, February 10, 2009

. Worthy, W., “Methyl Isocyanate: The Chemistry of a Hazard,” Chemical & Engineering News , pp 27-33, February 11, 1985. World Health Organization, International Program on Chemical Safety, Health and Safety Guide No. 106 , Phosgene Health and Safety Guide, Geneva, SZ, 1998.Appendix A.

123 

## Appendix A – Causal Analysis Charts

Appendix A is a "Why Tree" diagram showing the events that led to the incident and its consequences. Each box in the Why T ree is from information discovered in the investigation, and is a statement of something that happened in the chain of events. To construct a Why T ree, the investigation team starts with a concise description of the on-site and off-site human health, environmental, and business impacts, and asks why each impact occurred. The team continues asking why each preceding event occurred until they determine that they have reached a root cau se. The arrows show the direction of flow from the root causes to the final impacts. When the evidence shows that a particular hypothetical event did not happen, the box in the Why T ree has a diagonal line crossed through it and a statement next to the box describing the evidence that the event did not happen.Appendix A.

124 SIX FIREFIGHTERS AND TWO RAILWAY WORKERS REPORTED SYMPTOMS OF CHEMICAL EXPOSURE RELEASED CHEMICALS FROM THE RESIDUE TREATER TO THE ENVIRONMENT ONE BAYER EMPLOYEE DIED FROM SEVERE

THERMAL BURNS SECOND BAYER EMPLOYEE DIED FROM BLUNT FORCE TRAUMA AND SEVERE THERMAL BURNS DAMAGED PROPERTY ON SITE AND OFFSITE

RESIDUE TREATER LOSS OF CONTAINMENT AND EXPLOSION EXPOSED PEOPLE AND ENVIRONMENT TO RESIDUE TREATER CONTENTS AND FIRE

EMPLOYEES WERE IN THE VICINITY OF THE EXPLOSION SEE SHEET 4

METHOMYL UNIT CONTROL PANEL OPERATOR ASKED TWO FIELD OPERATORS TO CHECK THE RESIDUE TREATER VENT LINE FOR PLUGGAGE

SEE SHEET 3 

## SHEET 1

B C A SEE SHEET 2Appendix A.

125 SEE SHEET 1

BAYER REPORTED THAT THEY HAD DETECTORS

THAT WERE NOT DETECTING ANY CHEMICALS LEAVING THE SITE EMERGENCY RESPONDERS REPORTED CHEMICAL ODORS THROUGH THE NIGHT EMERGENCY RESPONDERS DID NOT WEAR RESPIRATORY PROTECTION FIREFIGHTERS RESPONDED TO THE EXPLOSION AND FIRE RAILWAY WORKERS WERE TRANSPORTING RAILCARS IN AND OUT

FROM THE PLANT RAILWAY WORKERS DID NOT WEAR RESPIRATORY PROTECTION AND WERE

TOLD TO SHELTER IN PLACE RATHER THAN EVACUATE

CHEMICAL MONITORS IN THE METHOMYL AREA WERE NOT FUNCTIONING, AND THE TWO WORKING FENCELINE MONITORS WERE NOT CAPABLE OF DETECTING CHEMICALS SUCH AS METHOMYL AND MIBK ALL CHEMICALS WERE NOT BEING CONSUMED IN THE FIRE TYLER MOUNTAIN VOLUNTEER FIRE DEPARTMENT HEARD THE INFORMATION THAT

ALL THE CHEMICALS WERE BEING CONSUMED BY THE FIRE. RAILWAY WORKERS WERE NOT IN A ROLE THAT WOULD HAVE BEEN TRAINED TO WEAR RESPIRATORY PROTECTION RAILWAY WORKERS CALLED METRO 9-1-1 AND RECEIVED COMMUNICATIONS TO STOP OPERATIONS AND SHELTER IN PLACE, BUT DID NOT RECEIVE ANY COMMUNICATIONS ABOUT

POTENTIAL CHEMICAL EXPOSURE

THE BAYER INCIDENT COMMANDER COMMUNICATED TO THE

BAYER EMERGENCY OPERATIONS CENTER AND THE INSTITUTE FIRE DEPARTMENT THAT THE CHEMICALS WERE BEING CONSUMED IN THE FIRE BAYER DID NOT SHARE RELEVANT INFORMATION WITH METRO 9-1-1 

### SHEET 2

AAppendix A.

126 SEE SHEET 1

METHOMYL UNIT CONTROL PANEL

OPERATOR INCORRECTLY ASSUMED RESIDUE TREATER VENT

LINE WAS PLUGGED UNPLUGGING THE VENT LINE WAS A MANUAL TASK

METHOMYL UNIT CONTROL PANEL OPERATOR ATTENTION WAS PARTIALLY DIVERTED TO THE LARVIN UNIT SHIFT CHANGE AT 6:00 AM DID NOT DISCUSS THE STATUS OF THE RESIDUE TREATER AND THAT THEY HAD STARTED FEEDING THE RESIDUE TREATER AT 4:24 AM WITH FLASHER

BOTTOMS (RATHER THAN SOLVENT). SHIFT CHANGE AT 6:00 PM DID NOT DISCUSS THE STATUS OF THE RESIDUE TREATER. METHOMYL UNIT CONTROL PANEL OPERATOR WAS LIKELY FATIGUED (OPERATOR HAD A ONE DAY BREAK AND WORKED 84 HOURS

THAT WEEK.) PLUGGING IN THE RESIDUE TREATER VENT

LINE WAS A KNOWN

COMMON ISSUE METHOMYL UNIT CONTROL PANEL OPERATOR RECEIVED RESIDUE TREATER HIGH

PRESSURE ALARM AT 22:19

METHOMYL UNIT CONTROL PANEL OPERATOR WAS ASKED TO HELP TROUBLESHOOT THE LARVIN UNIT THIS WAS THE FIRST TIME THAT OPERATIONS TRIED TO RUN LARVIN AND METHOMYL AT THE

SAME TIME (SINCE INSTALLING THE NEW DCS IN METHOMYL) THE RESIDUE TREATER PROCESS CREATED ENTRAINED LIQUID OR CONDENSIBLE VAPORS VENT DESIGN ALLOWED PLUGGING METHOMYL AND MSAO DECOMPOSITION FORMED GASES AND

INCREASED THE PRESSURE IN THE RESIDUE TREATER

OPERATIONS AND TECHNICAL DID NOT RESOLVE THE ISSUE VAPOR STREAM CONDENSED IN VENT LINE

FAILED TO MANAGE THE HAZARD; TREATED AS A

MINOR OPERATING ISSUE RATHER THAN A SAFETY ISSUE SEE SHEET 5 

### SHEET 3

B

DAppendix A.

127 SEE SHEET 1

RATE OF PRESSURE INCREASE EXCEEDED THE DESIGN BASIS FOR THE PRESSURE RELIEF SYSTEM

UNCONTROLLED DECOMPOSITION REACTION ACCELERATED PRESSURE SAFETY VALVE DESIGN BASIS

CONSIDERED A RUNAWAY CASE WITH A MAXIMUM OF 280 LBS METHOMYL VERSUS THOUSANDS OF POUNDS DURING THE INCIDENT 2005 PHA ASSUMED THAT THE AUTOMATED CONTROLS WOULD PREVENT THE EVENT,

BUT OPERATIONS FREQUENTLY BYPASSED

THE INTERLOCKS MOC PROCESS FOR THE 2008 DCS PROJECT

DID NOT PERFORM A PHA THAT CONSIDERED

THE POTENTIAL TO BYPASS INTERLOCKS

DECOMPOSITIONREACTION BECAME SELFSUSTAINING (RUNAWAY) BAYER CONCLUDED THAT THERE WERE OTHER PROTECTIONS TO PREVENT OVERLOADING THE RESIDUE TREATER 1994 PHA TEAM IDENTIFIED THE LOSS OF CONTAINMENT EVENT BUT DID NOT RECOMMEND CHANGES TO PREVENT THE EVENT THE 2005 PHA DEPENDED TOO HEAVILY ON THE EXISTING PHA RATHER THAN PROVIDING IN DEPTH ANALYSIS THE PHA TEAM GAVE TOO MUCH CREDIT TO

THE AUTOMATIC

CONTROLS (INTERLOCKS) BEING IN PLACE

HIGHER TEMPERATURE INCREASED THE RATE OF

REACTION AND THE RATE OF SOLVENT

EVAPORATION DCS PROGRAMMING ERROR INACTIVATED THE

COOLING SYSTEM. COOLING SYSTEM WAS NOT DESIGNED TO PREVENT RUNAWAY

CONDITIONS PHA TRAINING AND EXECUTION WERE

INADEQUATE

HEAT GENERATION INCREASED THE TEMPERATURE IN THE

RESIDUE TREATER COOLING SYSTEM WAS ADAPTED FROM OLD HEATING SYSTEM TO COOL FOR CONTROL TO SETPOINT

SEE SHEET 5 SHEET 4

C

EAppendix A.

128 SEE SHEET 3 SEE SHEET 4

DECOMPOSITION

REACTIONS GENERATED HEAT

RESIDUE TREATER

LIQUID BEGAN DECOMPOSING

PUMPING HOT MIBK INTO THE RESIDUE TREATER HEATED THE LIQUID AT HIGH CONCENTRATION. DECOMPOSITION IS A FUNCTION OF BOTH TEMPERATURE AND CONCENTRATION MSAO DECOMPOSES AT A LOWER TEMPERATURE THAN METHOMYL

SEE SHEET 6

METHOMYL CONCENTRATION IN RESIDUE TREATER LIQUID WAS MANY TIMES

MORE THAN THE SOP LIMIT.

RESIDUE TREATER LIQUID WAS MOSTLY

MOTHER LIQUOR FLASHER TAILS INSTEAD OF HOT MIBK

SEE SHEET 7 

### SHEET 5

E D

G FAppendix A.

129 SEE SHEET 5 THERE WERE SOURCES OF HEAT IN THE SYSTEM

MOTHER LIQUOR FLASHER TAILS TEMPERATURE WAS 80 °C WHILE RESIDUE TREATER WAS BEING FILLED HEAT EXCHANGER E-2575 (TEMPERED WATER COOLER) HEATED THE LIQUID OPERATOR SWITCHED THE TEMPERATURE

CONTROLLER TO AUTOMATIC AT 18:15 TO HEAT THE RESIDUE TREATER CONTENTS CIRCULATION PUMP HEATED THE LIQUID (NEGLIGIBLE CONTRIBUTION) OPERATOR ADDED 80 °C MIBK TO THE RESIDUE TREATER SYSTEM AT 6:30 PM

THE MOTHER LIQUOR FLASHER

SYSTEM WAS OPERATING HEAT EXCHANGER E-2576R (STEAM HEATER) HEATED THE LIQUID OPERATOR TURNED ON CIRCULATION PUMP (MANUAL) 

### SHEET 6

THE MANUAL BLOCK VALVE ON THE STEAM SUPPLY LINE WAS CLOSED THE AUTOMATIC VALVE TO HEAT EXCHANGER E-2575 WAS CLOSED. 

### FAppendix A.

130 SEE SHEET 8 SEE SHEET 5

WITHOUT COMPLETING THE SOLVENT RUN, THE OPERATOR SET RESIDUE TREATER FEED VALVE TO MANUAL AND OPEN TO INCREASE LEVEL IN RESIDUE TREATER

SEE SHEET 8 OPERATIONS TRAINING ON PROCESS HAZARDS DID NOT TRAIN THE OPERATORS THAT

UNREACTED MSAO ALSO DECOMPOSED AND COULD LEAD

TO A RUNAWAY REACTION OPERATORS ASSUMED THAT THERE WAS ONLY SOLVENT IN THE MOTHER LIQUOR FLASHER (NO METHOMYL) OPERATORS WERE ACCUSTOMED TO NORMAL START-UP (WITH MATERIAL LEFT IN THE RESIDUE TREATER FROM

THE END OF THE PREVIOUS RUN) OPERATORS SOMETIMES DEVIATED FROM SOP

DURING RESIDUE TREATER START-UP

OPERATOR PERCEPTION THAT THE SAMPLING WAS TO VERIFY QUALITY OF MATERIAL GOING TO FUEL USE RATHER THAN FOR SAFE OPERATING LIMITS UPSTREAM PROCESS NEEDED TO MOVE MATERIAL OUT OF THE

MOTHER LIQUOR FLASHER

OPERATORS WERE USED TO

RUNNING THE RESIDUE TREATER IN BATCH MODE RATHER THAN CONTINUOUS (PROCEDURES ARE WRITTEN TO RUN IN CONTINUOUS MODE) MANAGEMENT DID NOT ENFORCE COMPLIANCE WITH SOP MOTHER LIQUOR FLASHER OVERHEAD STREAM FED THE MIBK / HEXANE COLUMN, AND THEY NEEDED TO PRODUCE HEXANE HEATER WAS NOT ABLE TO REACH MINIMUM TEMPERATURE (ACCORDING TO OPERATIONS PERSONNEL) MANAGEMENT DID NOT ENFORCE COMPLIANCE WITH SOP

SEE SHEET 8 RUNNING LOW ON HEXANE FOR CENTRIFUGES HEAT EXCHANGER PERFORMANCE DEGRADED

ALREADY CONSUMED THE FRESH HEXANE WHILE TRYING

TO GET THE METHOMYL TO

PRECIPITATE AT THE

CRYSTALLIZERS OPERATIONS, TECHNICAL, AND MAINTENANCE DID NOT RESOLVE THE PROBLEM MECHANICAL INTEGRITY PROGRAM DID NOT

IDENTIFY THE

PROBLEM 

## SHEET 7

J I H GAppendix A.

131 SEE SHEET 9 SEE SHEET 7

METHOMYL UNIT CONTROL PANELOPERATOR THOUGHT THERE WAS NO METHOMYL IN THE MOTHER LIQUOR FLASHER TAILS (FEED TO THE RESIDUE TREATER)

METHOMYL UNIT CONTROL PANEL

OPERATOR ATTENTION WAS PARTIALLY DIVERTED TO THE OXIME PROCESS OPERATIONS DID NOT FOLLOW SOP TO SAMPLE RESIDUE TREATER BEFORE

STARTING FEED (FROM MOTHER

LIQUOR FLASHER) IF RESIDUE TREATER TEMPERATURE WAS BELOW 130 DEGC OPERATIONS DID NOT FOLLOW SOP TO SAMPLE RESIDUE TREATER AT 7AM SEE SHEET 7

THIS WAS THE FIRST TIME THAT OPERATIONS TRIED TO RUN LARVIN AND METHOMYL AT THE SAME TIME (SINCE INSTALLING THE NEW DCS IN METHOMYL) OUTSIDE OPERATOR THOUGHT THAT THE RESIDUE TREATER WAS NOT IN SERVICE OPERATIONS THOUGHT THAT THE REACTOR WAS NOT PRODUCING METHOMYL

CONTROL ROOM OPERATOR DID NOT HAVE A NEED TO COMMUNICATE TO THE OUTSIDE OPERATOR YET, AND THE COMMUNICATION DID NOT OCCUR AT SHIFT CHANGE CENTRIFUGES WERE NOT PRODUCING WET CAKE (RAN ONE AT A TIME)

INADEQUATE ENFORCEMENT OF SHIFT

CHANGE POLICY OR INADEQUATE SHIFT CHANGE POLICY CRYSTALLIZERS WERE NOT CRYSTALLIZING METHOMYL

SEE SHEET 10 SOLVENT / ANTISOLVENT RATIO WAS WRONG SEE SHEET 7 

## SHEET 8

J I H

L KAppendix A.

132 OPERATIONS BYPASSED INTERLOCKS THAT SHOULD HAVE KEPT THE RESIDUE TREATER FEED VALVE CLOSED UNTIL REACHING MINIMUM TEMPERATURE SEE SHEET 8

OPERATORS SOMETIMES

BY-PASSED RESIDUE

TREATER LOW TEMPERATURE INTERLOCK ON START-UP OPERATORS SOMETIMES BYPASSED RESIDUE TREATER HIGH PRESSURE INTERLOCK ON START-UP THE DCS CHANGEOVER PROJECT LEFT RESIDUE TREATER LOW CIRCULATIONFLOW INTERLOCK BYPASSED

SOME OPERATORS WERE USED TO STARTING THE FEED TO THE RESIDUE TREATER BEFORE IT

REACHED 135 °C (DEVIATION FROM SOP) OPERATIONS SOMETIMES BYPASSED THESE INTERLOCKS (USED TO DEVIATING FROM SOP) OPERATOR DID NOT NOTICE OR DID NOT REMOVE THE BYPASS BEFORE START-UP CONTRACTOR BYPASSED THE RESIDUE

TREATER MINIMUM CIRCULATION FLOW INTERLOCK DURING THE

DCS CHANGEOVER PSSR DID NOT ENSURE THAT THE SAFETY SYSTEMS WERE READY FOR

OPERATION

NO COMMUNICATION FROM THE PHA OR OTHER SOURCES THAT OPERATIONS SHOULD NOT START THIS WAY. MORE THAN ONE BOARD OPERATOR TOLD CSB INVESTIGATORS THE HEATER COULD INCREASE

THE TEMPERATURE TO ONLY ABOUT 130 °C (266 °F). MANAGEMENT DID NOT ENFORCE POLICY FOR CONTROL OF BYPASSING SAFETY

INTERLOCKS PROJECT PROCESS DID NOT CHECK ALL CRITICAL INSTRUMENT

SETTINGS BEFORE HANDOVER

1994 PHA TEAM IDENTIFIED THE LOSS OF CONTAINMENT EVENT BUT DID NOT ACCOUNT ACTUAL

PRACTICE OF BYPASING INTERLOCKS THE 2005 PHA DEPENDED ON THE

EXISTING PHA RATHER THAN PROVIDING IN-DEPTH ANALYSIS THE 2005 PHA TEAM GAVE TOO MUCH CREDIT TO THE CONTROLS BEING IN PLACE MANAGEMENT DID NOT RESOLVE THE DIFFERENCE

BETWEEN OPERATING PRACTICE AND THE STANDARD OPERATING PROCEDURES

PHA TRAINING AND EXECUTION LED TO THESE DEFICIENCIES 

### SHEET 9

KAppendix A.

133 SEE SHEET 8

DATA ENTRY, RESPONSE, AND FEEDBACK WERE ALL DIFFERENT FROM PREVIOUS CONTROL SYSTEM. INADEQUATE TRAINING TECHNIQUES ON THE NEW CONTROL SYSTEM, AND INADEQUATE TRAINING TIME ON THE NEW CONTROL SYSTEM. ABILITY TO FOCUS ON SPECIFIC PIECES OF EQUIPMENT WAS LOST

IN THE CONVERSION UNITS OF MEASURE WERE DIFFERENT FROM PREVIOUS CONTROL SYSTEM, AND NO CONVERSION TABLE WAS SUPPLIED

TO OPERATIONS. THERE WAS MIBK IN THE RECYCLE HEXANE

PSSR DID NOT IDENTIFY

THESE DEFICIENCIES CAPITAL PROJECT DID NOT PERFORM HUMAN

FACTORS ANALYSIS MIBK / HEXANE COLUMN WAS NOT OPERATING PROPERLY

HIGH FLOW AT MIBK DRIP TO INSTRUMENT TAP

WRONG SIZE VALVE FOR DRIP CONTROL

MANAGEMENT DID NOT ENFORCE MANAGEMENT OF CHANGE PROCESS PSSR DID NOT VERIFY EQUIPMENT IN FIELD

WAS READY FOR START-UP 

### SHEET 10

LAppendix B

134 

## Appendix B – Emergency Response Timeline

The following is a key for the abbreviations used to denote the organizations agencies in the table below:

CAD Computer Aided Dispatch EOC Emergency Operations Center KCEAA Kanawha County Ambulance Authority KCSD Kanawha County Sheriff’s DepartmentAppendix B

135 Date Time Information Source 8/28 22:34 Explosion and Fire on Methomyl Unit
8/28 22:34 Metro to Jefferson fire department (FD): unknown source of explosion, receiving numerous calls KCSD -1
8/28 22:35 EMS to Metro 911: wants address for explosion; Metro states it might be at Bayer CropScience, not sure KCEAA
8/28 22:36 First report of explosion

-- caller to Metro CAD Operations Report 8/28 22:36 Alarm

-- Tyler Mountain FD Tyler Mountain FD 8/28 22:37 Metro to Dunbar and Institute FD

-- Explosion at Bayer plant, fireball 100 ft in air, numerous calls; no telephone or radio contact with plant at this time KCSD -1
8/28 22:38 Dispatch to 1600 1 st Ave South (Bayer); scene of incident confirmed to be at the center of the plant. KCSD -1
8/28 22:38 Emergency alarm at Larvin unit EOC Log
8/28 22:39 Metro calls Main Gate: gate guard says he has been instructed not to give out information; emergency alarm in progress 911 call Transcript 8/28 22:41 Haze coming towards Cross Lanes KCEAA
8/28 22:41 EMS to Metro 911: ambulance staging outside Bayer KCEAA
8/28 22:42 Metro contacts Bayer: gate guard requests ambulance immediately for a burn patient; will not provide additional information 911 call Transcript
8/28 22:42 Call from Metro to Dunbar FD to stand by for Institute Station 24. Large explosion reported at the Bayer plant. No contact with plant at this time; multiple calls to plant have been made Dunbar Fire

8/28 22:43 Metro to EMS: a burn patient is at main gate KCEAA
8/28 22:44 Need medics at gate for burn patient CAD Operations Report 8/28 22:44 Bayer has not called Metro KCEAA
8/28 22:44 Metro advises that burn patient is at the main gate KCSD -1
8/28 22:44 "They’re not giving us anything, I don’t know if they’ve even called in from Bayer." KCSD -1
8/28 22:45 Unit 245 on

- scene command established KCSD -1
8/28 22:45 EOC activated, Shift A and B ring

- down EOC LogAppendix B

136 Date Time Information Source 8/28 22:46 Metro calls Bayer, no answer; gate guard not giving information. KCEAA
8/28 22:47 EMS enters plant KCEAA
8/28 22:48 Talks to someone at the gate, he doesn't know what is going on but they need an ambulance at the front gate KCEAA
8/28 22:49 Tyler FD arrives on scene Tyler Mountain FD 8/28 22:51 ATF on way to scene CAD Operations Report 8/28 22:51 Route 25 closed Dunbar Police
8/28 22:53 Station 31, power line down at1014 Ellis Street. Pole and line in front of residence still smoking and leaning against a tree. Power still on to residence St. Albans FD and Nitro FD 8/28 22:53 "Spoke to a gentleman in the plant and informed that the event is located in the Larvin unit. Told that the material involved is poisonous." KCSD -1

8/28 22:54 Metro to Dunbar: No contact from plant, getting info from many diffe rent sources. Keep roads closed unless you hear otherwise from Metro 9 -1- 1 EOC only. Dunbar Police

8/28 22:57 Cloud observed moving towards metro; seeks guidance on what cloud consists of. St. Albans FD and Nitro FD 8/28 23:00 Notification to shut down river traffic CAD Operations Report 8/28 23:00 St

. Albans FD order s SIP unless hears otherwise about the cloud over explosion CAD Operations Report 8/28 23:04 Still no contact from plant to Metro 911; Dunbar FD gathers a copy of evacuation plan just in case Dunbar FD
8/28 22:52 "The explosion is in the Larvin unit; someone talked to a mechanic they know in the plant [and] it’s poisonous." KCEAA
8/28 23:04 Metro advises command that the unit involved is the Larvin KCSD -1
8/28 23:06 No SIP per Chief 24 (Institute) Dunbar Police
8/28 23:06 Burn victim in ambulance EOC Log
8/28 23:13 KC

- 1 directed to Shawnee Park (designated as EOC) KCSD -1

8/28 23:15 Bayer contacts Metro: a Bayer representative informs Metro that they "might want to alert the community that there is an emergency at the plant right now." The rep. does not confirm Larvin unit as source 911 call transcript
8/28 23:18 Secondary explosion noted St. Albans FD and Nitro FD 8/28 23:24 SIP recommended for St. Albans and Nitro EOC LogAppendix B

137 Date Time Information Source 8/28 23:33 NWAS issues SIP; informs media CAD Operations Report 8/28 23:34 Bayer contacts Metro with update; Bayer representative tells Metro that Bayer CropScience still having emergency and is responding to it. 911 call transcript 8/28 23:34 Bayer informed that Metro Emergency Service director putting community SIP order for South Charleston, Dunbar, Nitro, St. Albans 911 call transcript 8/28 23:34 SIP declared for western portion of the county St. Albans FD and Nitro FD
8/28 23:43 By order of the Kanawha County Office of Emergency Services, SIP ordered for all cities west of the City of Charleston (South Charleston, Dunbar, Nitro & St. Albans, specifically.) KCSD -1

8/28 23:48 Individual transported to hospital EOC Log

8/28 23:58 Status update: I

- 64 shut from Nitro to Dunbar; Rt. 25 from Dunbar to Putnam County line; Rt. 60 from South Charleston to Putnam County line; SIP for all areas west of South Charleston KCSD -1

8/28 TV/radio announcement acknowledges SIP SCPD
8/29 0:01 Praxair is SIP location EOC Log
8/29 0:06 Bayer contacts Metro with update: still having emergency and is responding to it. Bayer rep. on way to Metro 911 center 911 call transcript 8/29 0:13 West of Larvin unit under toxic cloud; SIP in west end of plant EOC Log
8/29 0:15 Norfolk Southern railroad personnel onsite with rash and itching goes to medical EOC Log
8/29 0:21 One employee in medical with heat

- related problems EOC Log
8/29 0:25 Shawnee Park requests MSDS EOC Log
8/29 0:35 Chemical in the explosion is highly toxic and flammable methomyl Dunbar Police
8/29 0:37 MIC tank warming EOC Log
8/29 0:40 Bayer contacts Metro with update: still having emergency and is responding to it 911 call transcript 8/29 0:55 EE sent to hospital is not decontaminated (HCN, Sulfide, Hexane, MIBK, methomyl residue) EOC Log
8/29 1:10 Another emergency responder being transferred to medical (firefighter) EOC Log
8/29 1:12 Bayer contacts Metro with update: still having an emergency and is responding to it 911 call transcript 8/29 1:12 Another emergency responder sent to medical for heat stress (firefighter) EOC LogAppendix B

138 Date Time Information Source 8/29 1:20 SIP lifted in St. Albans EOC Log
8/29 1:25 Another BCS employee to medical department with heat fatigue EOC Log
8/29 1:27 Third BCS emergency responder sent to medical (heat stress) EOC Log
8/29 1:32 Bayer makes official statement to media EOC Log
8/29 1:40 SIP all clear accept Larvin unit EOC Log
8/29 1:42 All community SIPs lifted; Metro notified EOC Log
8/29 1:43 Bayer contacts Metro with update: still having emergency and is responding to it. 911 call transcript 8/29 1:47 Two heat stress and one injured knee in medical EOC Log
8/29 1:55 Metro wants written request from BCS to lift SIP EOC Log
8/29 2:04 Roadways re

- opened, SIP lifted Dunbar PD
8/29 2:08 Metro 911 to all units: be advised SIP has been lifted. Dunbar Fire
8/29 2:08 SIP lifted; roadways being re

- opened St. Albans FD and Nitro FD 8/29 2:08 Department of Environmental Protection notified incident over EOC Log
8/29 2:14 Firefighting operations to be released, and begin to return to quarters. The fire is out KCEAA
8/29 3:01 Bayer contacts Metro with update: response team has situation under control, plant still in alarm state 911 call transcript 8/29 3:33 Bayer contacts Metro with update: response team has situation under control, plant still in alarm state 911 call transcript 8/29 4:07 Tyler FD leaves scene Tyler Mountain FD 8/29 5:31 "Governor is now on scene" EOC Log
8/29 5:50 Bayer contacts Metro with update: all clear except Larvin unit 911 call transcriptAppendix C

139 

## Appendix C – Methyl Isocyanate Day Tank Blast Shield AnalysisAppendix C

140 APPENDIX C CONTENTS 1.0 INTRODUCTION ........................................................................................................................ 141 2.0 METHOMYL AND CARBOFU RAN MIC SUPPLY SYSTE M ................................................ 142 2.1 MIC Manufacturing .........................................................................................................142 2.2 Produc tion Storage ..........................................................................................................142 2.3 Impact From the Explosion and Fire ...............................................................................144 2.4 Day Tank Inspection and Return to Service ....................................................................145 3.0 MIC DAY TANK BLAST SHIELD ANALYSIS ....................................................................... 146 3.1 Postulated Worst

- Case Event Analysis ...........................................................................147 3.2 Residue Treater Rupture Pressure and TNT Energy .......................................................148 3.3 Fragment Kinetic Energy Estimates ................................................................................151 3.3.1 Fragment Velocity Estimates .............................................................................151 3.3.2 Fragment Range and Strike Velocities ...............................................................153 3.3.3 Shield Structure Dynamic Analysis ...................................................................154 3.3.4 Blast Mat Design ................................................................................................155 3.3.5 Structural Frame Assembly Design ....................................................................155 3.3.6 Limitations of the Model ....................................................................................157 3.4 Blast Shield Analysis Conclu sions ..................................................................................158Appendix C

141 

## 1.0 Introduction
Methyl isocyanate (MIC) has been manufactured and used at the Institute site since at least the 1970s. Union Carbide Corporation (UCC) owned the facility when the equipment was designed and installed. Recognizing the acute toxic hazard associated with MIC, UCC specified a more rigorous design than what is often applied in chemical processes: redundant and backup instrument systems,
augmen ted fire suppression systems, and an ammonia

- steam emergency vapor suppression system. In addition, the bulk storage systems were more robust than a typical aboveground storage vessel. In particular, Union Carbide installed specialized blast

- resistant stru ctures around the aboveground MIC storage vessels to protect the vessels from projectiles in the event of an explosion in nearby equipment. The blast blankets also provided a thermal heat shield in the event of a nearby fire.
In 1994, the owner of the Inst itute facility, Rhone -Poulenc, increased the height of the blast shield on the MIC day tank in the Methomyl-Larvin unit. The added height protected the relief valve piping and the vent line that is attached to the top head of the vessel. The August 2008 i ncident and Bayer’s subsequent effort to restrict public information about the proximity of the MIC day tank to the explosion resulted in renewed concern about MIC use and storage at the plant. This appendix presents a CSB analysis that evaluates whether t he exploded residue treater could have damaged the MIC day tank and piping, if it had followed a hypothetical trajectory in that direction.Appendix C

142 

## 2.0 Methomyl and Carbofuran MIC Supply System
2.1 MIC Manufacturing Bayer, the only user of large quantities of MIC in the U.S., manufactures MIC and at the time of the incident stored up to 200,000 pounds in large underground pressure vessels and smaller aboveground vessels. Liquid MIC was transferred from the MIC production unit about 2500 feet through an insulated piping sy stem to an aboveground pressure vessel called a “day tank” located adjacent to the Methomyl -Larvin production unit. After refilling the day tank, operators removed all MIC from the transfer pipe and purged the pipe with nitrogen gas. The transfer piping a nd storage vessel incorporated multiple layers of protection, both active and passive:

**•** The MIC recirculation system, carbofuran unit transfer line, and the cross

- plant transfer line were equipped with emergency block valves that were operated from the con trol room;

**•** An emergency dump tank adjacent to the day tank was available to receive the contents of the MIC day tank and cross

- plant transfer line; and

**•** The day tank and dump tank were installed on a concrete foundation and surrounded by a concrete dike wall with the capacity to contain the maximum MIC inventory in the day tank and transfer piping.



## 2.2 Production Storage The MIC day tank was a 6,700- gallon

- capacity stainless steel pressure vessel. Maximum inventory was approximately 37,000 pounds (4,400 gall ons). The tank was designed, fabricated, and tested in accordance with the American Society of Mechanical Engineers Boiler and Pressure Vessel CodeAppendix C

143 Section VIII and was rated for lethal 60

The day tank was equipped with additional layers of protection. The refrigeration system chilled the MIC to about 0 °C (32 °F). A multiple stage chiller system first used ethylene glycol to cool methyl isobutyl ketone (MIBK). The MIBK was then used to cool MIC in a separate heat exchanger. This

two

- step cooling process prevented a possible MIC -water reaction should the ethylene glycol chiller system leak. service. Union Carbide specified the vessel to be designed with

a max imum allowable working pressure of 100 psig, even though the MIC system would operate at only 1- 2 psig; the rupture disk and relief valve were set at 20 psig. UCC also installed a dedicated nitrogen supply system to maintain an inert atmosphere in the tank and piping system.

61

The day tank control system contained redundant pressure, temperature, and flow instruments including high- pressure, high

- temperature, and refrigeration system failure alarms. The MIC system vents discharged into the process and emergency vent scrubber system. The MIBK system pressure was also maintained greater than the MIC system pressure , and the MIBK pressure in the MIBK

- ethylene glycol heat exchanger was greater than the ethylene glycol pressure. This ensured that water could not enter the MIC system. Finally, emergency generators provided power to the refrigeration system in the case o f normal plant electricity loss.

The area around the tank was equipped with air monitors to detect MIC. Firewater monitors were located nearby to mitigate an MIC leak and suppress a fire that could threaten the tank. Surveillance cameras provided full

- time visual display on video display panels inside the Methomyl -Larvin control room. A blast shield structure fully enclosed the day tank to protect it from flying debris and thermal radiation in the event of an explosion and fire.

60 ASME defines lethal substance as a poisonous gas or liquid of such a nature that a very small amount of the

gas or of the vapor of the liquid mixed or unmixed with air is dangerous to life when inhaled (ASME 2001). Lethal service rated vessels are designed and fabricated to a higher quality standard than non

- lethal rated vessels. 61 The coolant is a mixture of ethylene glycol and water.Appendix C

144 

## 2.3 Impact From the Explosion and Fire The day tank contained approximately 13,700 pounds of MIC on the night of the residue treater explosion and fire. Neither the empty cross- plant transfer line nor the carbofuran unit transfer system, which was operating at the time of the incident, was damaged. Debris from the explosion struck the blast blanket surrounding the day tank (Figure C-1), and the blast blanket was exposed to radiant heat from the fires. However, the MIC day tank was not damaged.

Figure C- 1. MIC tank blast shield pos t- incident
Power to the MIC refrigeration system was interrupted, so an emergency generator was put in service. The MIC temperature rose to 8.9 °C (48 °F) and the pressure rose to 12.7 psig, which were both less than the maximum allowed values of 30 °C (86 °F) and 20 psig, respectively. The day tank temperature was below 2 °C late the next day. The day tank was then depressurized and drained.Appendix C

145 

## 2.4 Day Tank Inspection and Return to Service Bayer removed the blast blankets and removed the tank insulation, then i nspected the tank, piping, and refrigeration system to verify that the explosion and fire did not damage the equipment. Bayer reinsulated the tank and piping systems and purchased and installed new blast blankets to replace those that were exposed to the fire. The blankets not directly exposed to the fire were reused. Finally, the MIC tank was returned to service to provide MIC to the carbofuran unit until the unit was shut down in August, 2010.Appendix C

146 

## 3.0 MIC Day Tank Blast Shield Analysis
When the day tank was installed in 1983, a wire rope blast blanket system was installed to protect it from flying debris. The blast blankets also provide a radiant heat shield from nearby fires. In 1994, the structure was extended up to completely surround the entire tank and top piping connections (Figure C -2). The original frame design considered static (blast blanket weight) and wind loads only, and did not analyze the structure for dynamic side loading, one of the functional purposes of the assembly.

Figure C

- 2. MIC day tank shield structureAppendix C

147 

## 3.1 Postulated Worst - Case Event Analysis The shell and one head careened into the methomyl unit when the residue treater violently exploded. The other 800-pound head (Figure C- 3) sheared off and came to rest near the installed location of the residue treater. A small piece of the vessel cylindrical shell separated and lodged between a catwalk and the shell of a distillation column (Figure C-4) some 15 to 20 feet from the residue treater installed location.

Figure C

- 3. 800

- pound residue treater bottom head

Figure C

- 4. Residue treater shell fragment lodged in catwalk of adjacent distillation columnAppendix C

148 The blast shield showed no evidence of an impact by any significant projectile. However, because of the proximity of the residue treater to the s tructure, the CSB conducted a dynamic analysis of the shield structure and compared the results to a postulated residue treater impact with the structure. The analysis consisted of the following steps:

**•** Calculate the residue treater theoretical rupture pressure, 62

**•** Calculate the TNT equivalent energy at the rupture pressure and temperature,

**•** Calculate the initial velocity of various size residue treater fragments,

**•** Calculate impact forces from residue treater fragment impacts with the shield structure,

**•** Calculat e the forces required to deflect the shield structure into the MIC day tank or attached piping, and

**•** Compare the results of the fragment energies to the shield structure frame analysis. 

## 3.2 Residue Treater Rupture Pressure and TNT Energy
The newly installed 4,500- gallon residue treater was an ASME Code-stamped, SA -240 316L stainless steel pressure vessel manufactured in 2008. It had a maximum allowable working pressure (MAWP) of 50 psi at 400 °F and the vessel hydrostatic test pressure was 68 psi g. The following calculations estimate the burst pressure and TNT equivalency of the energy released in the August 2008 explosion

. The Faupel method (Faupel, 1956) is a theoretical method used to predict vessel burst pressures
+/ - 15 percent based on vessel geometry and yield and ultimate tensile strengths of the stainless steel. The formulas were developed from nearly 100 static cylinder tests. According to Faupel, if a cylinder

62 The ma ximum pressure range of the control system residue treater pressure instruments was 0

- 50 psig.

Therefore, the actual vessel pressure near the failure point was not recorded.Appendix C

149 wall yields at a constant stress, it will burst at a pressure required to overstrain the wall 63

** **  ** **  ** ** 

**− =** 

u y y b R P **σ σ**  **σ** 2 ln 3 2 . The residue

treater burst pressure, P b, is estimated using the following equation.

where

σ u , ultimate tensile strength = 70,000 psi

σ y = yield strength = 25,000 psi Cylinder wall ratio, R = b/a a = inner radius (47.6875 in) b = outer radius (48 in) R = 1.0066

P b = 310 psig
When the residue treater ruptured, the stored energy was released nearly instantaneously, creating a blast wave that spread over a distance from the vessel. The energy of the blast wave can be compared to a high explosive detonation through a TNT equivalency calculation using the conversion factor of
1.545 x 10 6 ft lbs/lb of TNT.

63 Though the Faupel method is intended for thick

- walled vessels, it can be applied to thin

- walled vessels as

well. All thin - and thick - walled equations derived in the Faupel method yield the same result as the cylinder wall ratio, R, approaches the value 1.0 (Faupel, 1034).Appendix C

150 Using the calculated burst pressure, the blast energy and TNT equivalence (Cain, 1995) are:



###  ** **  ** **  ** **  ** **  ** **  ** **  ** **  ** **  ****

**−**

**− =**  **− γ**  **γ**


### γ 1

1 2 11 

### 1 1 P PVP W

where W = total explosion energy P 1 = 310 psia = 46,760 psfa P 2 = 14.7 psia = 2117 psfa V 1 = 295 ft 3 (volume above liquid level: 4500- gallon vessel @ 51% full) γ = specific heat ratio of CO 2 = 1.23 (because CO 2 is a principal byproduct of methomyl decomposition)

W = 26.3 e 6 ft -lbs
Using the TNT equivalency factor of 1.545 e 6 ft

- lbs/lb, the mass of TNT required to generate the calculated explosion energy is:

TNT = 

### 26.3 ft - lbs 1.545 ft - lbs/lb

TNT = 17 lbs
The American Institute of Chemical Engineers, Center for Chemical Process Safety (CCPS) Guidelines for Chemical Process Quantitative Risk Analysis (AIChE, 2000) contains other methods for estimating the TNT equivalent energy from a pressure vessel explosio n. The CSB compared the result from the Cain method with the methods contained in the CCPS publication. Table C-1 contains the summary of the results.Appendix C

151 Table C

- 1. TNT equivalency values

Method TNT (lbs) Energy (ft- lbs) Baum 13 20,690,000 Brode 36 57,000,000 Brown 44 69,900,000 Crowl 19 29,500,000

Cain 17 26,300,000



## 3.3 Fragment Kinetic Energy Estimates The explosion caused the vessel to separate into three pieces: the bottom head, a small segment that embedded in the catwalk, and the main vessel shell with the top head attached. Initial velocities were calculated and applied to various trajectory departure angles in the direction of the MIC day tank. Aerodynamic drag coefficients were then applied to predict the velocity and kinetic energy of each fragment at impact with the day tank shield structure at the same elevation as the top of the day tank. The analyses ignored the pipe rack and other large structures between the residue treater and the day tank that would likely deflect the object, or absorb some of the kinetic energy.



### 3.3.1 Fragment Velocity Estimates The energy released in an exploding pressure vessel is distributed among the energy consumed to fracture the steel vessel, shock wave , kinetic energy of the fragments, and heat energy . The energy distribution depend s on the vessel failure characteristics (e.g., ductile vs. brittle fracture) 64

64 Post

- explosion visual examination of the new residue treat er confirmed ductile failure of the shell and heads,

as expected for stainless steel. and can change throughout the explosion.Appendix C

152 Assuming a complex expansion process (e

. g. , gas/liquid mixtures are contained in the pressure vessel) , a simple kinetic energy calculation can be used to estimate the fragment upper limit velocity:

2 

### 2 1 mv KE **=**

so 

### m KE v 2

**=**

where KE = kinetic energy lbs (ft -lbs) v = initial velocity (ft/s) m = mass (lbs)
However, according to Baum (1988), less than 20 percent of the vessel expansion energy is transferred to projectiles. To improve the understanding of pressure vessel failure energies, the U.S. Air Force and U.S. Naval Surfac e Warfare Center commissioned the General Physics Corporation to develop a computer model to calculate fragment velocity and energy, called LIMIT -V, as part of the Pressure Vessel Burst Test Study (Cain, 1995). The study compared the Baum predicted values to actual fragment velocities measured from high

- pressure, gas - filled pressure vessel burst tests. Assuming a vessel axial split, which was similar to the residue treater failure, and assuming a burst pressure of 310 psig, the LIMIT-V program predicts tha t the fragment projectile energy and velocity for the main residue treater shell and top head are: Fragment energy = 14.3 e 6 ft -lbs Initial velocity = 81 ft/sec

The LIMIT -V method likely over- predicts the residue treater fragment velocity because the residue treater was approximately half -full of liquid rather than vapor filled, and the method does notAppendix C

153 consider a foamy gas

- liquid mixture inside the pressure vessel. However, the results are reasonable to use for evaluating the MIC blast shield structur e.



### 3.3.2 Fragment Range and Strike Velocities
TRAJ is a two

- dimensional fragment trajectory model developed for the U.S. Naval Surface Warfare safety program to estimate fragment velocity and range at various angles. The program uses velocity and shape characte ristics to plot fragment flight path height and range and accounts for aerodynamic drag and fragment ricochets off barriers or interferences in the fragment path. The program calculates the velocity and energy at the point of contact with a specified barrier or interference.

The residue treater vessel shell and top head scenario generated the greatest fragment kinetic energy that could impact the MIC day tank blast mat frame. Barriers representing the MIC day tank structure were input into TRAJ at a r ange of 70 feet and a height of 22 feet from the residue treater. Figure C-5 shows the path traveled by the vessel shell and top head having an initial velocity of 81 feet per second. If a large, high velocity fragment strikes the shield structure at the elevation where the MIC tank piping passes through the grating with enough energy to deflect the structure more than about 4 inches horizontally, the piping could be damaged. The model predicts that the residue treater main fragment will strike the structur e at this elevation (circled area on Figure C -5) when the departure trajectory angle from the explosion epicenter is about 30 degrees above horizontal. The fragment energy at impact is 1 37 ,000 foot-pounds.Appendix C

154 Figure C

- 5. TRAJ plot with fragment impact with the blast shield structure (vertical line at 75 feet range). The curves represent fragment departure angles of 0, 15, 30, and 45 degrees.



### 3.3.3 Shield Structure Dynamic Analysis
Union Carbide installed the blast shield structure in 1983. A 1994 modification added additional shielding above the MIC day tank. The assembly consisted of a structural frame bolted to the concrete foundation. Steel wire rope ballistic shield mats were suspended on all sides. The shield mats served multiple functions: prevent small projectile penetration or significantly reduce the projectile exit velocity, attenuate energy from an explosion generated pressure wave, and absorb heat from an explosion or fire. The structural frame supported the heavy steel mats. A steel grating floor deck was installed a few inches above the top of the MIC day tank. The vessel relief valve piping passed through a circular opening in the floor deck. The clearance between the floor opening and the pipe was approximately 4 inches. Therefore, contact betwe en the steel grating and the pipe will occur if the frame is deflected 4 inches horizontally. An MIC release was assumed to occur if the grating contacts the pipe— the analysis ignored the strength of the pipe and vesselAppendix C

155 nozzle. The analysis did not evaluat e the additional fragment energy (greater impact velocity) that would be necessary to puncture or break the pipe and release MIC.



### 3.3.4 Blast Mat Design The blast mat is a commercially available ballistic shield product that was originally intended to protect p ersonnel from high -energy explosive detonations. The manufacturer worked with the Israeli Defense Force and the Southwest Research Institute to determine the ability of the blast mat to absorb potential debris or pressure waves from an explosion. Testing c onducted using explosive devices showed that the shield is capable of containing very high energy explosions. The testing also demonstrated that the shield is capable of withstand ing detonation pressures resulting from thousands of pounds of TNT more than 30 feet from the source of the detonation. The CSB estimated that the residue treater exploded with the force of about 17 pounds of TNT equivalent, many orders of magnitude lower that the energy absorbing capacity of the ballistic shield. Therefore, the CSB concluded the shield mat would withstand any postulated explosion pressure wave from the residue treater.



### 3.3.5 Structural Frame Assembly Design Frame assembly design records address only the capacity of the frame to support the deadweight of the installed m ats, plus wind loads. The records do not include a frame dynamic analysis to demonstrate that the frame assembly was strong enough to protect the day tank from a large object strike at high velocity. The CSB commissioned a structural analysis of the frame assembly to evaluate it for resistance to two load cases:

1. Blast wave overpressure from approximately 40 pound TNT equivalent explosion at 75 feet.

2. Impact force from the residue treater vessel.Appendix C

156 The structural and civil drawings were used to analyze the as sembly using GTStrudul, ® a comprehensive structural analysis tool. Failure was assumed if the maximum calculated stresses exceeded the material strength of any primary component in the frame assembly, or if the frame structure deflected 4 inches horizontally at the elevation of the top floor grating, the space between the hole in the grating and the pipe. The results are shown in Table C -2.

Table C

- 2. Frame loading analysis results

Load condition Frame component stress limit Maximum Deflection

Blast overpressure Baseplate overstressed ~ 1.8 inches (no contact with pipe)

Residue treater vessel impact Baseplate, structural beams and braces overstressed ~ 4 inches (possible contact with MIC pipe)

The analyses are based on worst case conditions for the following reasons:

**•** They ignore any objects in the path between the residue treater and the MIC day tank including the pipe rack that might deflect or even stop the fragment before it strikes the shield structure (See Figure C-2);

**•** The blast mat is assumed to act as a rigid plate, which transmitted all forces directly into the frame (i.e., the calculation ignored attenuation of blast or impact energy by the blast mat);

**•** The frame is assumed to be oriented such that the east face was perpendicular to the pat h of the overpressure and vessel fragment trajectory; and

**•** The fragment analysis uses the absolute value of the velocity applied in the horizontal direction rather than the horizontal vector component of the calculated velocity at the incident angle.Appendix C

157 The b last overpressure analysis indicates that the calculated frame deflection was less than half the available space between the grating and the relief valve pipe. Although the overpressure analysis suggested that the frame baseplates would have shown evidence of permanent structural deformation, post- incident visual examination did not identify any structural damage, confirming that the analysis results were very conservative. The fragment impact analysis predicts that the frame might have sustained permanen t and observable structural damage if the residue treater vessel had impacted the structure at maximum theoretical velocity near the top of the structure. Furthermore, the results show that the frame could contact a pipe connected to the MIC day tank. However, the same highly conservative assumptions used in the analysis likely results in the model over -predicting the maximum frame deflection.



### 3.3.6 Limitations of the Model The CSB did not evaluate the likelihood that the residue treater would travel along any pa rticular trajectory when it ruptured The direction the vessel traveled was the result of the physical characteristics of the vessel and attached piping and other factors that are difficult to model. Factors that influenced the direction of the fragments in cluded:

**•** Piping connected to the residue treater, including the relief pipe attached to the top head;

**•** Orientation of the support legs and concrete anchor bolts; and

**•** The orientation of the head and shell welds, manway, and other significant attachments that strongly influenced where the vessel shell first was breeched.

Specific conditions would have been necessary for the largest residue treater fragment to strike the blast shield frame at the most vulnerable location. First, the trajectory angle would have had to approach 30 degrees above horizontal. A steep trajectory angle would also be necessary for the residue treater to pass over the elevated pipe rack that was directly in front of the day tank. The CSBAppendix C

158 did not attempt to quantify the likelihood of the se conditions occurring; in the actual incident, the residue treater followed an essentially horizontal trajectory.


## 3.4 Blast Shield Analysis Conclusions The blast mat provided highly effective protection to the MIC day tank against radiant heat from an

extern al fire and penetration from very small projectiles traveling at near sonic velocity. The blast mat would also prevent penetration of a large fragment, such as the residue treater shell or head travelling nearly 55 miles per hour. The original design of the structural frame used to support the blast mat considered only the weight of the blast mats and wind loading. The calculations did not consider dynamic loading from a high velocity large projectile impact. The CSB frame analysis concluded that the stru cture provided only marginal impact energy absorption protection from such a large fragment strike at velocities predicted to result from the residue treater rupture. Had the residue treater traveled unimpeded in the direction of the day tank, and struck the shield structure just above the top of the MIC day tank, the shield structure might have moved enough to come in contact with the relief valve vent pipe. A puncture, or tear in the vent pipe or MIC day tank head would have released MIC vapor into the a tmosphere above the day tank. The CSB notes that the scenario did not occur and remains hypothetical. The vessel might have traveled in one of many trajectories; even under conservative assumptions, only a specific narrow set of trajectories could have potentially led to an MIC release. However, the analysis does emphasize the risks of locating large vessels containing extremely toxic substances within hazardous process areas that have the potential for explosions. As noted previously, following the A ugust 2008 incident Bayer committed to eliminating all aboveground storage tanks of MIC.Appendix D

159 

## Appendix D – Bayer CropScience Press Release Announcing Institute Facility MIC Storage ReductionAppendix D

160Appendix D

161