CASE STUDY 

Uncontrolled Oleum Release 

Petrolia, Pennsylvania 2009-01-I-PA

(Three towns evacuated) September 2009 

This case study examines an oleum release 

that occurred on the afternoon of Saturday, 

October 11, 2008, in Petrolia, Pennsylvania. 

During a transfer operation, an oleum (fuming 

sulfuric acid) process tank overflowed, filled an 

exhaust ventilation system, and released the 

oleum into a storage building. The oleum 

release created a cloud of sulfuric acid mist 

that filled the building. The sulfuric acid cloud 

flowed out to the facility grounds and beyond 

the fence line into the surrounding community. 

Plant personnel evacuated the facility and 

community emergency responders ordered the 

evacuation or shelter-in-place of about 2,500 

residents from the towns of Petrolia, Bruin, and 

Fairview. 

Key Issues: 

• Temporary Change Evaluation 

• Safeguard Evaluation 

• Process Hazard Analysis 

Inside... 

Facility Description 

Incident Description 

Incident Analysis 

Lessons Learned 
INDSPEC Oleum Release Case Study September 2009 

2

1.0 Introduction 

Just after 3:00 pm on Saturday, October 11, 2008, a 

tank located in a storage building at the INDSPEC 

Chemical Corporation (INDSPEC) resorcinol facility 

in Petrolia, Pennsylvania, overflowed during an oleum 

transfer. Oleum, a mixture of sulfuric acid and sulfur 

trioxide, filled the exhaust ventilation system (vent 

system)1

 connected to the tank and eventually released 

into the storage building. The release of oleum created 

a cloud of sulfuric acid mist that filled the building 

and flowed out of the facility into the community. 

As the oleum storage tank overflowed, the storage 

building filled with a dense mist, and liquid oleum 

spilled from the vent system. Faced with an 

uncontrolled release, the INDSPEC incident 

commander declared a plant-wide emergency, notified 

local fire departments, and requested mutual aid 

services. Facility personnel evacuated. 

While INDSPEC emergency responders managed the 

onsite incident, at 5:14 pm community emergency 

responders ordered the evacuation or shelter-in-place2

of about 2,500 nearby residents from the towns of 

Petrolia, Bruin, and Fairview.3

 The evacuation order 

continued until about 2:00 am. 

1.1 INDSPEC Chemical Corporation 

Koppers Company, Inc. owned and operated the 

Petrolia facility until 1988. In late 1988, after the 

Beazer organization4

 acquired Koppers Company, 

Inc., the Petrolia facility and a nearby research center 

formed INDSPEC in a management buyout. In 1996, 

Occidental Petroleum Corporation acquired an interest 

in INDSPEC. Finally, in 1999, the Occidental Petroleum Corporation acquired all remaining INDSPEC 

stock. INDSPEC is an indirect, wholly owned subsidiary of Occidental Petroleum Corporation. 

The facility produces resorcinol, a chemical used in 

the rubber industry as an automobile tire adhesive. 

 

1

 The exhaust ventilation system comprises ducts connected 

to each of the oleum tanks and an air pollution control 

device to remove sulfuric acid and sulfur trioxide. 

2

 Shelter-in-place can protect people in emergencies by 

reducing their exposure to toxic substances. People should 

take refuge in a small interior room, close windows, seal 

openings, and shut off heating and air conditioning systems. 

3

 The evacuation zone included populated areas north, 

south, and west of the facility. 

4

 Beazer is a British construction and building materials 

firm. 

Resorcinol is also used as a chemical intermediate in 

the manufacture of pharmaceuticals and other organic 

chemicals. Oleum is a raw material used in resorcinol 

production.

1.2 The Petrolia Facility 

The facility is located in Petrolia, Pennsylvania, a 

borough of about 200 people roughly 40 miles 

northeast of Pittsburgh. Residences and commercial 

buildings surround much of the facility, which is at 

the base of an industrialized valley (Figure 1).5

 

Aerial photo courtesy Pennsylvania Spatial Data Access, The Pennsylvania 

State University 

Figure 1. Aerial view of Petrolia Valley 

The resorcinol process (the process) normally operates 

24 hours a day, seven days a week. Operators work in 

the oleum storage building on weekdays between 

about 7:00 am and 3:00 pm and on weekends as 

necessary. 

The oleum storage building, containing three 

horizontal pressure vessels and two vertical process 

tanks (Figure 2), is located near the center of the 

facility. Operators use air pressure to transfer oleum 

from railcars into the pressure vessels, each of which 

can hold the contents of two full railcars. Operators 

 

5

 Two other large chemical facilities occupy the valley in 

Petrolia and Karns City. 
INDSPEC Oleum Release Case Study September 2009 

3

then pump oleum from the pressure vessels to either 

of the process tanks. While the manufacturing process 

operates, oleum flows continuously from the process 

tanks to the resorcinol production unit. 

Figure 2. Oleum storage and control room 

buildings 

1.3 Oleum 

Oleum, also known as fuming sulfuric acid, is a mixture of sulfuric acid (H2SO4) and sulfur trioxide (SO3). 

Oleum, when released or spilled, gives off sulfur trioxide gas. The gas reacts with moisture in air and 

forms a cloud of sulfuric acid mist composed of easily 

inhaled droplets, some less than 1 micrometer in 

diameter. A sulfuric acid cloud is dense, visible, and 

slow moving. Inhaling sulfuric acid droplets can irritate the respiratory system, causing airway constriction and spasms.6

 Severe exposure can result in fluid 

in the lungs, internal bleeding, and even death. 

The Occupational Safety and Health Administration 

(OSHA), in 29 CFR 1910.1000, and National Institute 

for Occupational Safety and Health have set an eighthour exposure limit for sulfuric acid, and the 

American Industrial Hygiene Association has set a 

one-hour maximum exposure limit.7

 The U.S. 

Environmental Protection Agency (EPA) requires 

planning for potential oleum releases under its 

Chemical Accident Prevention regulations for 

facilities that store or process greater than 10,000 

pounds.8

 

 

6

 A detectable odor and irritation due to exposure generally 

occur at sulfuric acid concentrations above 1 mg/m3

. 7

 The eight-hour exposure limit for sulfuric acid is 1 mg/m3. 

The one-hour exposure limit without life-threatening health 

effects for sulfuric acid is 30 mg/m3

. 8

 The EPA set 0.01 mg/L (1 mg/m3) as the defined toxic 

endpoint for planning purposes under 40 CFR 68. 
INDSPEC Oleum Release Case Study September 2009 

4

2.0 Oleum Storage Building Operations 

Three INDSPEC operators perform bulk liquid 

loading and unloading jobs, one in the oleum storage 

building and two throughout the rest of the facility. 

The three operators work Monday through Friday on 

day shift and rotate among the three jobs weekly. 

The oleum storage building operator unloads oleum, 

benzene, and soda ash from railcars and prepares a 

soda ash solution. He also pumps oleum from the 

pressure vessels to the process tanks (Figure 2) and 

monitors the oleum storage system from the distributed control system (DCS).9

 The operator’s DCS 

console is in a separate building (control room) 

adjacent to the oleum storage building. 

The oleum storage-building operator is often required 

to perform work on weekends, which may include 

mixing soda ash solution or unloading benzene. The 

facility may schedule this work prior to the weekend 

or call an operator to the plant as necessary. Operators 

transfer oleum to the process tanks as part of their 

weekend duties to ensure that the pressure vessels are 

empty or nearly empty on Monday mornings. 

 

9

 DCS is a digital basic process control system that 

monitors and controls multiple process inputs and outputs. 

2.1 Transferring Oleum 

Operators transfer oleum from railcars to the pressure 

vessels and then to the process tanks. To transfer from 

a railcar, an operator connects a transfer hose to the 

railcar and pressurizes the railcar with plant air, 

forcing oleum to the selected pressure vessel. 

To pump oleum from a pressure vessel to a process 

tank, an operator plugs a pump power cord into a 

power supply (Figure 3). Each of the three pressure 

vessels has a dedicated transfer pump with a power 

cord and plug. While there are three power cords and 

plugs, there is only one (normal) power supply receptacle. The operator plugs the power cord into the 

normal receptacle in the oleum storage building and 

starts the pump using the DCS console in the adjacent 

control room. When transfer is complete, the operator 

stops the pump on the DCS console and returns to the 

oleum storage building to unplug the power cord. 

Figure 4 shows the power supply arrangement on the 

day of the incident. 

Figure 3. Normal power configuration 
INDSPEC Oleum Release Case Study September 2009 

5

Figure 4. Power supply arrangement 

2.2 Emergency Power Supply 

Prior to 1980, equipment failures in the oleum storage 

building affecting the normal power supply interrupted facility operations. Former and current employees stated that power-supply repair parts were 

difficult to obtain; thus, to minimize production 

interruptions, the facility10 temporarily wired an 

emergency power supply with a separate switch and 

receptacle. A former operator told the CSB that at the 

time of this installation, a former supervisor verbally 

instructed operators to use the emergency power 

supply to transfer oleum from the pressure vessels to 

the process tanks. However, the emergency power 

supply did not incorporate the safety features of the 

normal power supply. The automatic shutoff that was 

tied to a high-high level switch11 in the process tanks 

would not stop a pump powered by the emergency 

power supply. Therefore, the former supervisor 

cautioned operators to monitor these transfers closely 

to prevent overfilling. 

 

10 At that time, Koppers owned the facility. 

11 A high-high level in a storage tank is a point at which the 

liquid in the tank has reached a dangerously high level and 

may spill. A high-high level is normally associated with an 

alarm and an automatic means of shutting down liquid 

transfer, as opposed to the high level point at which only an 

alarm is initiated. 

Over the nearly 28 years since its installation, the 

emergency power supply arrangement remained 

functionally unchanged. The facility did not document 

the original intent of the emergency power supply in 

plant drawings12 or procedures. Post-incident, the 

current managers, supervisors, and engineers told the 

CSB that they did not know of the original intent of 

the emergency power supply or its use in oleum 

transfer to the process tanks.13 At the time of the 

incident, operators routinely used the emergency 

power supply on weekends—when supervisors, 

managers, and engineers were generally not in the 

facility—to transfer oleum from the pressure vessels 

to the process tanks. 

 

12 The piping and instrumentation drawing shows a single 

power supply for the oleum transfer pumps. 

13 Many years later, the facility added to the emergency 

power supply to allow operators to pump from trucks if 

railcars of oleum were unavailable. However, operators and 

supervisors from the 1980s and 1990s all stated that trucks 

were always pressurized with air in the same manner as 

railcars and were never pumped. 
INDSPEC Oleum Release Case Study September 2009 

6

3.0 The Incident 

At about 9:45 am on Saturday, October 11, 2008, an 

INDSPEC shift supervisor called the oleum storagebuilding operator to the facility to prepare soda ash for 

the process. The operator arrived at about 11:45 am 

and began transferring oleum from the pressure 

vessels to the process tanks, as was customary, before 

preparing the soda ash. 

The operator began pumping oleum to a process tank 

from vessel 611 using the normal power supply and 

from vessel 610 simultaneously using the emergency 

power supply. When vessel 610 ran empty, the 

operator began pumping from vessel 612 (Figure 2) 

using the emergency power supply. 

At about 2:00 pm, the operator completed soda ash 

preparation and shut down the soda ash process. He 

returned to the control room and, using the DCS 

console, stopped the vessel 611 oleum transfer pump. 

The transfer pump connected to the emergency power 

supply remained on, and the transfer of oleum to the 

process tank from vessel 612 continued. The operator 

told the CSB that he believed he had shut down the 

transfer pump connected to the emergency power 

supply. 

The DCS did not display the status of a transfer pump 

connected to the emergency power supply; only the 

local start/stop switch could stop a pump powered by 

the emergency supply. 

At 2:13 pm,14 an alarm beacon indicated a high level 

in process tank 1502. However, by 2:13 pm, the 

operator had exited the oleum storage building and the 

control room; he left the facility at 2:15 pm. 

At 2:18 pm, process tank 1502 reached the high-high 

level setpoint, activating another alarm beacon. By 

3:12 pm, sulfuric acid mist began escaping in the area 

of the tank 1502 conservation vent.15 

Around 4:15 pm, employees saw a white mist 

escaping the oleum storage building doors and 

notified the shift supervisor. The shift supervisor, 

suspecting an oleum leak in the transfer line from the 

process tank to the process, ordered the transfer line 

 

14 Times in this section were obtained from INDSPEC 

security camera 3, located inside the oleum storage building 

above run tank 1502, and security camera 6, located outside 

of the oleum storage building to the south. 

15 A conservation vent allows airflow (breathing) in a tank 

while reducing product vapor emissions. 

blown clean. Operators blew the line with pressurized 

air; however, the release continued and appeared to 

increase in intensity. Security video from inside the 

building showed an increase in intensity at 4:21 pm; 

by 4:29 pm, white sulfuric acid mist was visible 

outside of the oleum storage building. 

Realizing that the release was not from the transfer 

line, the shift supervisor (acting as incident 

commander) declared an emergency and ordered a 

facility evacuation. At 4:55 pm, the facility security 

guard began notifying the INDSPEC hazardous 

materials response team. Facility evacuation began 

concurrent with notification of local residents to 

evacuate their homes or shelter-in-place.16 Emergency 

responders from Petrolia and neighboring towns 

closed roads leading to the Petrolia valley and walked 

door-to-door notifying residents. 

At 4:58 pm, the shift supervisor instructed INDSPEC 

responders to spray the oleum building with water 

from two fire monitors17 in an attempt to absorb and 

dilute the sulfuric acid mist. However, the water spray 

did not lessen the severity of the acid cloud. 

To determine the source of the release, an INDSPEC 

reconnaissance team in Level A personal protective 

equipment18 entered the oleum storage building to 

investigate. The sulfuric acid mist in the building was 

so dense that the team could only enter a few feet. 

However, prior to the team’s retreat, liquid oleum 

spilled on them from the top of one of the process 

tanks.19 The team concluded that a transfer pump was 

running and that oleum transferring from one of the 

pressure vessels had overfilled the process tanks. 

The team decided to stop the transfer pump to secure 

the release but could not reach the local electrical 

switch room safely because it was flooded with fire 

 

16 Petrolia volunteer firefighters and police officers notified 

local residents. Residents in Petrolia and to the south 

evacuated to the Karns City High School; residents to the 

north evacuated to the Bruin Community Center. 

17 A fire monitor is a stationary nozzle that directs a spray 

of water to a specific location. 

18 Level A protection is a fully encapsulated suit with a selfcontained breathing apparatus to protect the wearer from 

chemical exposure. 

19 Oleum spilled from the conservation vent and collected 

on top of the process tank, eventually spilling over to the 

floor below. 
INDSPEC Oleum Release Case Study September 2009 

7

water. At about 7:00 pm, electricians used a remote 

disconnect switch to de-energize the oleum storage 

building and stop the pump. Post-incident data shows 

that vessel 612 emptied by about 5:50 pm. 

Cleanup began after the spilled oleum released the 

dissolved sulfur trioxide and the sulfuric acid mist 

dissipated. At about 2:00 am on Sunday, October 12, 

air monitoring by the EPA found no trace of vapors 

from the release. The offsite incident commander 

declared the emergency over and allowed residents to 

return home. One emergency responder suffered a 

minor injury due to sulfuric acid inhalation. No other 

injuries occurred. 
INDSPEC Oleum Release Case Study September 2009 

8

4.0 Analysis

4.1 Control and Alarm System 

Each of the five oleum tanks (three pressure vessels 

and two process tanks) is equipped with two levelsensing devices. The first device continually monitors 

the oleum level and displays it on the DCS console. 

The second device20 is a fixed high-high level probe. 

Each device activates one alarm in the oleum storage 

building and another on the DCS console. In addition, 

each high-high level probe on the process tanks 

activates a switch that shuts off the normal transfer 

pump power supply.21

Although process tank levels are monitored and 

displayed regardless of which power supply is used, 

the high-high level probes on the process tanks do not 

shut off the transfer pump when the emergency power 

supply is used. Additionally, even though INDSPEC 

installed the DCS about two years prior to the 

incident, many years after the installation of the tanks 

and the level devices, the emergency power supply 

was not connected to the DCS. 

The level sensing devices also activate visual warning 

beacons above each tank: amber for high level and red 

for high-high level. In normal practice and in 

accordance with written operating procedures, 

operators fill the tanks to the high-level alarm set 

point, at which they receive visual and audible signals.

At the time of the incident, the audible alarm in the 

oleum storage building was out of service. However, 

the operator had left the facility and would have been 

unable to hear the audible signal had it functioned.22

The DCS console provides operators control and level 

monitoring capability for a pump connected to the 

normal supply on the DCS console; it does not 

provide control or direct indication for a pump 

powered by the emergency supply. 

 

20 The high-high level device is a capacitance probe-type. 

Any liquid contact with the probe results in activation of the 

switch. 

21 The switch activates independently of the DCS; this is a 

hard-wired interlock. 

22 The CSB found the alarm was out of service for many 

months and INDSPEC had no process to regularly test the 

alarm’s function. 

4.2 Emergency Power Supply 

Installation 

When installed prior to 1980, the emergency power 

supply enabled the facility to continue operating by 

transferring oleum to the process tanks when the 

normal power supply was out of service. At the time 

of the incident, the label on the power supply read 

“65% Oleum Pump Emergency 480V Receptacle.”23

Former facility management considered service 

outages to the normal power supply emergencies due 

to their potential to halt production. 

By installing the emergency power supply without the 

same safety devices as the normal power supply, the 

facility traded safety for efficiency. Although a highhigh level shutoff, such as the one connected to the 

normal power supply, could have been added to the 

emergency power supply, the facility relied on human 

intervention as a safety measure. Within the hierarchy 

of controls concept,24 human intervention is less 

robust than engineering controls such as automatic 

shutoffs. 

4.3 Training and Procedures 

According to current and former employees, the 

normal power supply for oleum transfer malfunctioned about five times between 1980 and the mid1990s. Operators were required to use the emergency 

power supply to transfer oleum during these periods. 

Operators received only verbal instructions on using 

the emergency power supply. These verbal instructions were passed down from experienced operators to 

new operators in on-the-job training. The facility 

never included the use of the emergency power supply 

in its written operating procedures for transferring 

oleum to the process tanks. 

Prior to the incident, the facility began the process of 

updating the written operating procedures. A shift 

supervisor was responsible for updating the oleum 

storage building procedures, a process that involved at 

least one experienced operator. The supervisor instructed the operator to remove out-of date information from the procedures and add new procedures. At 

 

23 Operators told the CSB that the labels had never been 

changed. 

24 In the hierarchy of controls, engineering measures are 

superior to administrative and procedural measures, which 

are superior to personal protective equipment. 
INDSPEC Oleum Release Case Study September 2009 

9

the time of this update, the use of the emergency 

power supply was neither new nor out-of-date and 

was not addressed. 

4.4 Normalizing the Hazard 

When the emergency power supply was originally 

installed, the facility employed two operators for 

liquid unloading and storage duties. Often, the operator assigned to the oleum storage building was unable 

to attend to duties in the building until late in the day 

because of other responsibilities. The operators developed a work practice in which they used two transfer 

pumps concurrently (one connected to the normal 

power supply and one to the emergency power supply) to transfer more oleum to the process tanks in less 

time. To get their work done in the time allotted, operators used this work practice almost daily, normalizing it. According to a former employee, the former 

building supervisor was aware of the practice of using 

two pumps concurrently. 

Although the alternate power supply was likely intended to be temporary, the facility replaced flexible 

electrical cord with wiring in conduit following a 

safety audit in the 1980s, making the alternate power 

supply effectively permanent. 

In the late 1980s, the facility added a third operator to 

the area. The presence of a third operator meant that 

the operator for the oleum storage building would not 

have to leave the area and could transfer oleum using 

one pump (with the normal power supply) without 

falling behind schedule. However, experienced operators continued to train new operators on the use of the 

emergency power supply. 

4.5 Weekend Practice 

Shift supervisors typically call operators to the plant 

on weekends to mix the soda ash solution, which takes 

about 2.5 hours. While operators prepare soda ash, 

they also transfer oleum from the pressure vessels to 

the process tanks. Up to and including the day of the 

incident, operators used two transfer pumps (one connected to the normal power supply and the second to 

the emergency power supply) on weekends to transfer 

as much oleum as possible during the 2.5 hours 

(Figure 5). 

Operators transferred oleum on the weekends to 

improve the efficiency of oleum unloading operations 

on Monday. Operators stated that having at least one 

pressure vessel empty on Monday morning allowed 

the incoming oleum storage operator to begin immediately filling the pressure vessel from rail cars. Without room in the pressure vessels on Monday morning, 

the operator would first need to transfer oleum to the 

process tanks, delaying the railcar unloading. 

The emergency power supply eventually came to be 

used only on weekends, when additional oleum transfer could be accomplished in advance of the normal 

workweek. This proactive transfer and emptying of 

the pressure vessels maximized the efficiency of 

operators’ weekend work. Operators used the emergency power supply for nearly 28 years; however, the 

practice was never identified as a potential hazard. 
INDSPEC Oleum Release Case Study September 2009 

10

Figure 5. Weekend power configuration 
INDSPEC Oleum Release Case Study September 2009 

11

4.6 Process Hazard Analysis 

A process hazard analysis (PHA) is a system facilities 

use to evaluate potential hazards within processes and 

operations. In general, teams comprising managers, 

supervisors, engineers, and operators perform PHAs 

for each functional area of a facility. INDSPEC performed two recent PHAs of oleum storage-building 

operations.25 In 2005, a PHA team evaluated oleum 

unloading operations, including storage in the pressure 

vessels; in 2008, a team evaluated operation of the 

process tanks. Both PHAs addressed vessel and tank 

operations including high level, overfill, low level, 

and overflow into the vent system. 

Each oleum storage building PHA team included at 

least one experienced operator. The CSB interviewed 

many of the PHA team members and concluded that at 

the time the PHAs were conducted, only operators 

were aware of the emergency power supply and its use 

on weekends. In addition, piping and instrumentation 

drawings26 and operating procedures did not identify 

it as an alternate method of transferring oleum to the 

process tanks. 

When INDSPEC conducted these PHAs, operators 

had used the emergency power supply to transfer 

oleum for more than 25 years. Operators were aware 

that the emergency power supply was not controlled 

by the DCS and that the high-high level switch would 

not shut down a pump. However, they had been 

trained by experienced operators on the use of the 

emergency power supply and believed that using it 

was safe as long as they closely monitored tank levels. 

 

25 Both were revalidations of existing PHAs. 

26 A single power supply is depicted on the piping and 

instrumentation diagram. 

The safeguards listed in the PHAs for the deviation, 

“Liquid oleum introduced into vent system by 

overfilling oleum tanks” are 

• Level indication on oleum tanks 

• High level alarm 

• Operator in attendance 

These safeguards, however, all require operator 

attention and action. 

In addition, the PHA discussion of human error 

safeguards gives equal importance to the high-high 

level switch, high-level alarm, operating procedures, 

and operator training. However, only the high-high 

level switch can reliably perform a transfer pump 

shutdown regardless of potential human errors. 

When an operator inadvertently omits a planned 

action, it is referred to as a lapse. On the day of the 

incident, the operator intended to—and thought he 

had—shut off the pump plugged into the emergency 

power supply prior to leaving the facility. The PHA 

teams did not recognize or understand that an operator 

could potentially suffer a lapse during oleum transfer 

and not be in attendance to correct it. Details on the 

emergency power supply had never been captured in 

standard process safety information such as 

procedures and drawings. Therefore, the PHA teams 

did not identify the emergency power supply as a 

separate means of creating hazardous situations.
INDSPEC Oleum Release Case Study September 2009 

12

5.0 Lessons Learned 

5.1 Change Management 

In the 1980s, the facility changed the structure of the 

emergency power supply from temporary wiring to 

permanent conduit. The facility did not evaluate the 

significance of this change. 

Evaluate all changes—even those considered 

temporary—as permanent, including hazard analysis, 

procedures, training, and drawings. Establish and 

enforce time limits for temporary changes. 

5.2 Safeguard Evaluation 

The facility installed the emergency power supply 

without the engineering controls that already existed 

on the normal power supply and without improving 

alarms and shutdown systems. Although operator 

action was the sole protection against tank overfill, the 

facility gave operators only verbal instruction on the 

use of the emergency power supply. 

In the hierarchy of controls, administrative and 

procedural control ranks below engineering control 

as a safeguard. Ensure that all modes of operation are 

equipped with equally robust safeguards for similar 

hazards. 

5.3 Operating Procedures 

The facility’s storage system design required operators to transfer oleum on the weekend to ensure 

operations were unaffected during the week. Operators used a work practice developed years earlier to 

transfer oleum using two pumps concurrently. This 

work practice was never recorded in written operating 

procedures. 

Work practices can develop that do not reflect written 

operating procedures. Workers may use alternate 

practices to streamline tasks. Such alternate practices 

can introduce potential hazards that have not been 

formally evaluated. Management must engage 

operators in every step of procedure development and 

remain vigilant in evaluating how work is actually 

performed. 

5.4 Process Hazard Analysis 

The facility never included information on the 

emergency power supply in piping and instrumentation diagrams and written operating procedures. 

PHA teams were therefore unable to evaluate the 

consequences of emergency power supply use. 

The quality of PHAs suffers when piping and 

instrumentation drawings and procedures are not 

accurate. Facilities must develop protocols requiring 

drawings and procedures be updated as soon as 

changes occur. 
INDSPEC Oleum Release Case Study September 2009 

13

6.0 References 

American Industrial Hygiene Association (AIHA). Emergency Response Planning Guidelines. AIHA 

Publication No. AEAR05-561. 2005. 

National Institute for Occupational Safety and Health (NIOSH). Pocket Guide to Chemical Hazards. 

DHHS Publication No. 2005-149. September 2007. 

U.S. Environmental Protection Agency (EPA). Chemical Accident Prevention Provisions, 40 CFR 68 

Subpart F, Regulated Substances for Accidental Release Prevention. 
INDSPEC Oleum Release Case Study September 2009 

14

The U.S. Chemical Safety and Hazard Investigation Board (CSB) is an independent Federal agency 

whose mission is to ensure the safety of workers, the public, and the environment by investigating and 

preventing chemical incidents. The CSB is a scientific investigative organization; it is not an enforcement 

or regulatory body. Established by the Clean Air Act Amendments of 1990, the CSB is responsible for 

determining the root and contributing causes of accidents, issuing safety recommendations, studying 

chemical safety issues, and evaluating the effectiveness of other government agencies involved in 

chemical safety. 

No part of the conclusions, findings, or recommendations of the CSB relating to any chemical accident 

may be admitted as evidence or used in any action or suit for damages. See 42 U.S.C. § 7412(r)(6)(G). 

The CSB makes public its actions and decisions through investigation reports, summary reports, safety 

bulletins, safety recommendations, case studies, incident digests, special technical publications, and 

statistical reviews. More information about the CSB is available at www.csb.gov.

CSB publications can be downloaded at 

www.csb.gov or obtained by contacting:

U.S. Chemical Safety and Hazard 

Investigation Board 

Office of Congressional, Public, and Board Affairs 

2175 K Street NW, Suite 400 

Washington, DC 20037-1848 

(202) 261-7600

CSB Investigation Reports are formal, 

detailed reports on significant chemical 

accidents and include key findings, root 

causes, and safety recommendations. CSB 

Hazard Investigations are broader studies 

of significant chemical hazards. CSB Safety 

Bulletins are short, general-interest 

publications that provide new or noteworthy 

information on preventing chemical 

accidents. CSB Case Studies are short 

reports on specific accidents and include a 

discussion of relevant prevention practices. 

All reports may contain include safety 

recommendations when appropriate. CSB 

Investigation Digests are plain-language 

summaries of Investigation Reports.