CSB s E.I. DuPont de Nemours & Co Inc. Case Study 1

Case Study

U.S. Chemical Safety and Hazard Investigation Board

E.I. DuPont de Nemours & Co Inc.

Buffalo, New York

Flammable Vapor Explosion

Welding on Tank Containing Vinyl Fluoride (1 Killed, 1 injured)

November 9, 2010

2011-01-I-NY KEY ISSUES

• Flammable gas monitoring

• Tank Isolation

• Hot work permits, procedures, and sign-offs
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 2

1.0 INCIDENT SUMMARY

This case study examines a November 9, 2010, 

explosion at an E.I. duPont de Nemours and Co. 

Inc., Yerkes chemical plant in Buffalo, New York 

when a contract welder and foreman were repairing the agitator support atop an atmospheric storage tank containing flammable vinyl fluoride. The 

welder died instantly from blunt force trauma, 

and the foreman received first-degree burns and 

minor injuries. The explosion blew most of the 

top off the tank. The top and agitator assembly 

hung over the side of the tank supported only 

by a 2-foot section of the top (cover photo). The 

explosion caused minor overpressure damage in 

the tank farm area and the adjacent production 

building.

The U.S. Chemical Safety Board (CSB) determined that flammable vinyl fluoride (VF) vapor 

from interconnected, in-service process tanks flowed undetected into the tank and ignited 

when the welder was repairing the agitator support assembly. In February 2010, the CSB 

issued a “Hot Work Safety Bulletin” that summarized 11 similar fatal incidents. Like the 

incidents described in the bulletin, this was another example of improperly monitored hot 

work activities involving flammable conditions inside a container. 

2.0 DUPONT 

E.I. duPont de Nemours and Co., Inc (DuPont) is a Fortune 100 company which was founded 

in Wilmington, Delaware in 1802. The American chemical company operates in about 90 

countries and employs more than 60,000 people. The company offers a broad range of products for industry and consumer use, including pesticides, electronics, apparel, and biomedical 

supplies. The company offers services as a safety resource for other corporations to evaluate 

and improve workplace safety.

DuPont has owned and operated the 100 acre facility in Buffalo, New York since 1921. The 

facility employs over 600 workers and manufactures Tedlar,® a polymer used as a film in photovoltaic panels and Corian,® used to make countertops and other durable surface products. 

2.1 PROCESS DESCRIPTION

The Tedlar process converts VF into polyvinyl fluoride (PVF).VF is generated at another 

DuPont facility, shipped in on tanker trucks and stored at the Buffalo facility in high 

pressure storage tanks. VF is pumped from the storage tanks to a reactor and reacts to 

form PVF slurry in water and unreacted VF. After the reactor, the PVF water slurry passes 

through separators to remove the VF. The VF is pumped from the separators by compressors and recycles back to the reactor. After the separators, steam is injected into the PVF 

slurry to raise the temperature and vaporize any VF present in the slurry. The heated 

mixture passes through a small slurry flash tank where the residual VF is released to the 

atmosphere1

.

TABLE OF CONTENTS

1.0 Incident Summary 2

2.0 DuPont 2

 2.1 Process Description 2

3.0 Incident Description 5

4.0 Incident Analysis 8

5.0 OSHA Standards 14

6.0 Industry Standards 15

7.0 Other Hot Work Incidents 17

8.0 Findings 18

9.0 Lessons Learned 18

10.0 Recommendations 19

1 The Buffalo facility normally vents approximately 5 pounds per hour of VF to the atmosphere from the flash tank.
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 3

The non-combustible PVF slurry then passes to one of three insulated slurry holding tanks 

(numbered 1, 2, or 3) in the tank farm adjacent to the production building (Figure 1). 

Under normal operating conditions, slurry is pumped to slurry tank 3. Slurry tank 3 is 

newer than slurry tanks 2 and 1; it had been replaced in 2009 due to corrosion2

. Slurry 

tanks 2 and 1 were used as overflow storage space in the event slurry tank 3 was filled and 

slurry tank 1 was generally kept empty of slurry.

If the slurry flash tank level is too high, hot slurry passes through the flash tank overflow 

line directly into slurry tank 2. A liquid trap (seal loop) on the end of the overflow line 

inside slurry tank 2 was designed to prevent VF vapor and steam from passing directly from 

the flash tank into the slurry tank. The PVF slurry is then pumped from the slurry tanks to 

the Tedlar production area for further processing. PVF is used in a variety of applications as 

a film or a surface protector due to its resistance to weathering and flammability-lowering 

properties.

2.1 PHYSICAL, CHEMICAL, AND BIOLOGICAL PROPERTIES OF VINYL FLUORIDE

VF is a colorless, highly flammable gas at ambient conditions with an ether-like odor3. VF 

vapors are heavier than air and will accumulate in low areas. VF is classified as a reasonably anticipated human carcinogen4

. National Institute for Occupational Safety and Health 

recommends an exposure limit of 1 ppm as a time weighted average and a ceiling limit of 5 

ppm for workers.

FIGURE 1

PVF process flow 

diagram

2 Slurry tank 1 was removed after the 2010 incident.

3 The VF lower explosive limit is 2.6 percent and the upper explosive limit is 21.7 percent. The autoignition temperature 

is 725° °F (385 °C).

4 According to the National Toxicology Program from the National Institute of Environmental Health Sciences in its 

2011, 12th Edition of Report on Carcinogen
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 4

2.2 PVF SLURRY TANK FARM

The flash tank and three slurry tanks are located in a tank farm adjacent to the Tedlar 

manufacturing building. The slurry tanks are 11 feet in diameter, 19 feet tall, and have a 

capacity of 10,800 gallons (Figure 2). The tank shell and top are one-quarter inch thick 

stainless steel. Each tank top has a hinged, unsealed steel cover on a 24-inch diameter 

manway and a large agitator motor drive and gearbox5

. The agitator assembly is bolted to 

structural steel beams that are welded directly to the tank top. 

The slurry tank feed and drain lines are equipped with isolation valves. The slurry tanks 

have a common overflow line attached near the top of the tanks. Blind flanges are installed 

on the overflow line and isolate one tank from another if one or two tanks are operating 

while the third is undergoing maintenance. 

The 3-foot diameter flash tank vents small concentrations of flammable vapor directly into 

the ambient atmosphere, so the area is equipped with a flammable vapor air monitoring 

devices to notify personnel when explosion hazards are present. The continuous air monitors are located on the catwalk near slurry tank 3 and on the flash tank vent pipe (Figure 

3). An alarm in the Tedlar control room activates if either device detects flammable vapor 

above the instrument set point.6

2.3 MAINTENANCE CONTRACTOR

Mollenberg-Betz, founded in 1910, operates a large steel fabrication facility in Buffalo, 

New York, and provides piping system design, fabrication, field construction and maintenance services. It employs more than 75 professionals and skilled construction trade staff. 

FIGURE 2

PVF slurry holding tanks

5 The PVF slurry tank farm process area was classified as a general purpose electrical classification area at the time of 

the incident at ground level, on top of the tanks, and on the tank farm elevated catwalk.

6 The low alarm set point is 10 percent of the lower explosive limit (LEL) and the high alarm set point is 2 percent of the 

LEL.
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 5

Mollenberg-Betz had contractors working on site at the DuPont facility repairing a steam 

line. DuPont used Mollenberg-Betz to repair the heavily corroded steel on the agitator 

support structures atop tanks 1 and 2 due to their availability on site. At the time of the 

incident, the Mollenberg-Betz contractors had been working at the DuPont facility for two 

months. The welder and foreman assigned to the work had many years of piping system 

and tank welding experience. 

3.0 INCIDENT DESCRIPTION

3.1 EVENTS PRIOR TO INCIDENT

The Tedlar process area conducted a planned shutdown from October 22 to November 6, 

2010, ending 3 days before the fatal explosion. During this shutdown, the asbestos insulation on slurry tanks 1 and 2 was to be removed. New, non-asbestos insulation was to be 

installed and the slurry tanks would be externally inspected for corrosion similar to that 

previously found on slurry tank 3. The process was shut down on the evening of October 

21 and all slurry was pumped out of slurry tanks 2 and 1. 

On October 22, the slurry tanks were locked out7

 by DuPont maintenance personnel so the 

tanks could be cleaned and entered. On October 29, DuPont discovered damaged agitator 

FIGURE 3

Slurry flash tank (left). 

Agitator and open 

manway on tank. 

Second air monitor is 

located on catwalk near 

tank 3 (lower right).

7 OSHA defines lock out as “The placement of a lockout device on an energy isolating device, in accordance with an 

established procedure, ensuring that the energy isolating device and the equipment being controlled cannot be operated until the lockout device is removed.”
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 6

support after the insulation was removed from the slurry tanks 1 and 2. A DuPont engineer 

wrote up a work order for the repair of the agitator supports and had the construction field 

engineer in charge of contractors begin writing a work scope and gather contractors and 

materials. DuPont hired Mollenberg-Betz to repair the agitator support based on the fact 

that they were already engaged in hot work on site and could be quickly made available. 

The valves on the tank 1 fill and discharge lines were locked out November 1. Following 

the completion of DuPont site lockout and hot work safety procedures, the contractor 

performed the grinding and welding repairs atop tank 2 on November 1 (Figure 4), but 

had to delay the tank 1 work because repair materials were unavailable. DuPont personnel 

determined the slurry tank 1 job could be safely completed after the process restarted and 

scheduled the repairs for November 9, when the Mollenberg-Betz contractors would again 

be available.

During the tank 2 internal inspection on November 3, DuPont engineers discovered that the 

U-leg seal loop on the flash tank overflow line had a “fishmouth” split in the pipe (Figure 

5), likely the result of the PVF water slurry freezing in the line. The engineers concluded 

that the slurry tank could be returned to service without repairing the split. DuPont engineers who saw the broken seal loop concluded its likely purpose was to limit steam in 

the flash tank from flowing into the slurry tanks. They further concluded that the operation was safe and that the broken seal loop presented no hazards. No acknowledgement 

was given to the fact that flammable VF gas had a pathway into the slurry tanks, an area 

classified as “low hazard” and not expected to contain any flammable materials. DuPont 

engineers scheduled a repair on this seal loop during the next planned unit outage. No 

management of change (Section 4.7.2) was carried out for the process to continue with this 

compromised seal loop. 

A DuPont crew reconnected the tank 2 and 3 process piping and removed the valve locks to 

prepare for unit restart. Tank 1 remained out of service while awaiting the materials needed 

FIGURE 4. 

Repair weld on agitator 

support beam to the 

slurry tank 2 top plate
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 7

to repair the agitator support. The overflow line to all three tanks was never blinded8, 

which provided a direct flow path from the vapor space in tanks 2 and 3 to the out-ofservice tank 1. 

On November 6, DuPont restarted the Tedlar process with the valves aligned so that the 

PVF slurry flowed into slurry tank 3. The equalizer line remained connected to all three 

tanks, and was not isolated or disconnected from tank 1 before the hot work was authorized. On November 8, a compressor within the Tedlar unit malfunctioned; the unit was restarted without the compressor, more than doubling7

 the VF vapor present in the PVF slurry 

flowing into the slurry flash tank. The process operated in this mode until the incident. 

3.2 PERMITS IN PLACE ON DAY OF INCIDENT

On November 7, 2010, a lockout card9 completed for tank 1 work indicated that that 

all five valves leading to and from tank 1 and the agitator motor had been locked out. 

The card instructed workers to try to start the motor before beginning work, but did not 

reference the overflow line, which had no valves. On November 9, 2010, the contractors 

completed a hot work permit before starting work on slurry tank 1. The contractors did not 

FIGURE 5. 

Fishmouth split on seal 

loop pipe inside tank 2

8

 Blinding is the absolute closure of a pipe by fastening of a solid plate that completely isolates the interior of the pipe 

and is designed to withstand the maximum pressure generated within the pipe. 

9 A lockout card details what has been done to ensure an area has been effectively locked out for an area or a piece of 

equipment.
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 8

check the lock out valves on slurry tank 1 with any DuPont employees prior to starting the 

hot work.

3.3 INCIDENT DESCRIPTION

The morning of November 9, a DuPont lab technician tested the area around the top of the 

slurry tanks for flammable vapor concentration, including the region above tanks 2 and 3 

and the immediate area above tank 1 where the repair work would be performed. The testing indicated there were no flammables present around the top of slurry tanks. Continuous 

air monitoring was also present near the top of tank 1, but the lab technician never tested 

the atmosphere inside the tank. The lab technician was not required to test the air inside 

tank 1 for flammable chemicals even though the repair work involved significant grinding 

and welding directly on the tank top. Nor did the DuPont construction field engineer or 

contractor crew ask the lab technician to test the air inside the tank. 

Shortly after 9 am, the contractor crew went to the catwalk above tank 1 and started work. 

The contractor attached his safety harness lanyard to the agitator on tank 1, stepped out 

onto the tank top, and began the grinding and welding repair work. The foreman remained 

on the catwalk adjacent to the closed manway cover to supervise and act as fire watch. At 

the time of the incident the contractor was using an electric arc welder to weld metal support on to a C-channel beam on the top of slurry tank 1. The C-Channel beam was then to 

be welded to the agitator support. 

At 11:04 am the tank 1 level transmitter in the control room recorded a sudden increase as 

a fire erupted inside the tank. The overpressure blew the steel manway cover off the tank, 

hurling it more than 100 feet. 

Nearly the entire 25-feet-long tank top-to-shell circumferential weld tore apart; only a 

segment about 24 inches long remained connected. This segment acted like a hinge as the 

top, agitator motor and drive assembly, and agitator shaft violently swung over the side of 

the tank (see cover photo). The welder died instantly in the explosion. The flash fire burned 

the foreman’s arms and head, burst an eardrum, and scratched his eye. The fire quickly 

consumed the flammable vapor and self extinguished.

4.0 INCIDENT ANALYSIS

4.1 FUEL SOURCE

The fuel source for the hot work explosion was flammable vinyl fluoride in slurry tank 

1. DuPont technical engineers in process hazard analyses carried out before the incident 

assumed that any residual VF gas would vent safely to the atmosphere more than 10 feet 

above the work area through the flash tank vent. However, the defective seal loop provided 

a direct path for the flammable vapor and uncondensed steam to flow from the flash tank 

into tank 2. VF was also present in small amounts in the PVF slurry entering slurry tank 3. 

DuPont modeling published in July 2010 and based on data obtained from slurry samples 

on the Tedlar process calculated that 0.02 pounds per hour of VF would be present in the 

slurry going to the slurry tank. Prior to the incident, other DuPont models had stopped 

after the separators and made the assumption that any VF present would vent from the 

flash tank. DuPont did not see this as a hazard because this 0.02 pounds per hour is below 

the LEL for VF. DuPont did not consider that VF could accumulate in the large vapor space 

in the slurry tanks and reach flammable levels.

Prior to the incident DuPont calculated that the loss of the liquid ring compressor would 

more than double the amount of VF going to the flash tank and venting. The VF present in 
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 9

the flash tank had an open path to slurry tank 2 through the cracked seal loop. VF from the 

flash tank was the main source of flammables on the day of the incident.

The VF present in the slurry in tank 3 and from the defective seal loop in tank 2 had an 

unimpeded path to slurry tank 1 through the unblinded overflow line. VF, which is heavier 

than air accumulated to a flammable concentration in the bottom of the tank. As the steam 

and VF entered slurry tank 1, the steam condensed, due in part to the earlier removal of 

insulation from the slurry tank. The slurry tank insulation had been removed during the 

shutdown and not replaced and the condensing steam exacerbated the VF flow into slurry 

tank 1 at increased concentrations.

DuPont personnel sampled the air around the work area for flammable gas as required by the 

company hot work permit procedure; however, neither they nor the contractor crew recognized the possibility of VF vapor entering the tank. The sampling procedure did not require 

testing the atmosphere inside the tank even though the work required welding directly to the 

tank top. If air monitoring had been done inside slurry tank 1 prior to and during hot work, 

the flammable VF would have been detected and the incident would not have occurred.

4.2 IGNITION SOURCE

The ignition source came from the repair work activity of welding the agitator support on 

the tank top. The agitator shaft passed through an unsealed hole, approximately one-half 

inch, in the tank top, which provided a path for sparks to enter the tank or for flammable 

vapor to escape into the work area. 

Welding the C-channel on the tank top using the arc welding technique increased the metal 

temperature above the steel melting point of 2800 °F (1538 °C). The surface of the metal 

would quickly get “red hot” as welding progressed, a temperature in excess of 1200 °F (650 

°C), which was significantly above the VF vapor autoignition temperature of 725 °F (385 °C). 

The accumulated VF vapor inside the tank would ignite as soon as it contacted the extremely 

hot steel or if welding sparks entered the tank through the agitator shaft opening. 

4.3 HOT WORK PROCEDURE

Hot work is any flame or spark producing operation including welding, grinding, and 

riveting. The DuPont corporate Contractor Safety Handbook states that a “Welding, Open 

Flame, and Sparking Equipment Permit” is required for flame or spark-producing activity at 

DuPont facilities. The two contractors who performed the hot work on slurry tank 1 completed such a hot work permit, titled the “Yerkes Work & Flame Permit,” prior to starting 

work. The purpose of the permit was to ensure that, prior to any hot work, communication 

between the supervisor of the hot work and a proprietor of the area where the work was 

to be performed was appropriate, and to ensure the hot work was carried out safely. The 

permit indicated the scope of the work and listed needed safety precautions. 

DuPont operating procedure “Yerkes Work & Flame Permit” provided guidance on completing the hot work permit of the same name at the Buffalo plant. The permit was required prior 

to the initiation of any hot work. This document was designed primarily for contractor use. 

As part of the hot work permitting procedure, contractors were required to complete a safety 

task assignment (STA) to address potential hazards in the hot work area. All employees doing 

the hot work were required to read this STA and sign that they had read it.

After the contractor completed the paperwork, the area proprietor10 would sign the permit 

and notify the contractor of any process changes or safety information that might affect 

10An area proprietor is a DuPont employee who is knowledgeable about the area where any work would be done.
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 10

the job. This required the area proprietor to be knowledgeable about processes going on 

in the area. This procedure was in accordance with the guidelines set forth in the National 

Fire Protection standard NFPA 51B which states the individual authorizing the permit 

will, (Section 4.2.3) “ensure the protection of combustibles from ignition”, and (Section 

4.1.7) “advise all contractors about site-specific flammable materials, hazardous processes 

or conditions, or other potential fire hazards.” The contractors had completed this same 

permit before doing hot work on slurry tank 2 the previous week. 

In the hot work procedure, DuPont recognized that the contractor may be unfamiliar with 

process safety or activities in the area they would be working. DuPont determined that the 

construction field engineer11 and the area proprietor would be responsible for helping the 

contractor understand potential hazardous conditions. On the day of the incident however, 

neither the construction field engineer nor the employee signing off as the area proprietor 

had understanding of the area, the process, or potential hazardous conditions. 

4.4 DUPONT HOT WORK PERMITTING

On the morning of November 9, 2010, the contractor supervisor completed the required 

hot work permit for the repair work on slurry tank 1. The permit specified that the 

Mollenberg-Betz contractors would be burning, welding, and grinding work on the top of 

slurry tank 1. The requirement section of this permit asked if flammable material would 

be within 35 feet of the work. This section was not completed, even though the hot work 

was carried out within 35 feet of the slurry flash tank that was designed to vent VF to the 

atmosphere. The contractors were unfamiliar with the Tedlar process and the process equipment involved. The contractors did not know what the flash tank was or which chemicals 

were present inside it. 

The safety precautions section of the permit included an item for “Lock, Tag, Try, Think” 

that was not checked as necessary, even though slurry tank 1 had been cleaned and locked 

out for the hot work. In another part of the permit the contractor supervisor indicated that 

lockout had been completed for this work. 

The contractor supervisor also completed a safety task assignment with the construction 

field engineer as part of the permit. On this part of the permit the supervisor did not answer 

the questions “Are chemicals present? What chemicals?” and “Flammables/Combustibles 

present? Identify.” 

The “Yerkes Work & Flame Permit” requires signatures from two DuPont employees, an 

area proprietor and construction engineer, before contractors can begin work. DuPont’s 

intent in structuring hot work procedures, from the corporate to the plant level, was to 

ensure that these individuals would understand the work and potential hazards. 

In addition, the DuPont construction engineer for the slurry tank work had no working 

knowledge of the Tedlar process. He would not have known the effect of the loss of the 

compressor on increased VF in the system. On the morning of the incident he reviewed 

the work permit with the contractor supervisor. Since the contractor had performed hot 

work on slurry tank 2, the construction engineer expected the contractors to obtain the 

proprietor signature from someone in the area where they were working, as required in the 

DuPont policies, and that the area proprietor would provide the contractors any plantspecific, process safety information necessary for the hot work. 

After the construction engineer signed the permit, he obtained the proprietor signature from 

someone in the service department. The service department is responsible for mail, yard 

11 The construction field engineer is the DuPont employee responsible for coordinating the contractor’s work.
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 11

work, and related tasks. It was not located near nor was it related to the Tedlar process. 

DuPont policy states that the proprietor should be “knowledgeable” about the area they are 

signing off on and that the proprietor should “walk down” the area where the hot work is 

to be done. On the day of the incident, this was not done. 

The contractors would not have known about any of the chemicals present in the Tedlar 

area or if they were flammable or combustible; neither did they have knowledge of the 

Tedlar process nor if flammable vapors might be present around the slurry tanks. Despite 

this they were allowed to complete the hot work permit and begin hot work without getting 

approval from any DuPont employee knowledgeable about the process. 

Prior to this incident, the DuPont Buffalo facility allowed someone in the service department, rather than someone knowledgeable about the area, to sign off on contractor work 

permits. The individual in the service department who signed as area proprietor had no 

knowledge of the Tedlar area or any associated dangers and had been signing permits for 

the Mollenberg-Betz contractors for months while they did hot work in other parts of the 

Buffalo facility. Information gathered from CSB interviews indicated the DuPont service 

worker believed that he was simply releasing them to do their jobs and that the construction engineer had briefed them on the job and hazards. He was not aware that he needed 

to know about potential hazards or that he was not the appropriate DuPont employee to 

sign these permits. On the day of the incident the service department worker was still under 

the assumption that the Mollenberg-Betz contractors were working on the steam line and 

believed that was the purpose of the hot work permit. 

DuPont’s policies and procedures are structured to ensure that someone knowledgeable 

checks before hot work is performed. However, on the day of the incident, no individual 

with plant-specific knowledge of the Tedlar process reviewed the hot work permit. DuPont’s 

practices had fallen short of its policies.. 

4.5 LOCKOUT PROCEDURE

DuPont’s corporate Contractor Safety Handbook requires a lockout procedure to protect 

workers from injury caused by energized equipment, the opening of valves, or exposure 

to electrical sources. The DuPont Buffalo facility’s Yerkes Contractor Safety Handbook

states that any equipment locked for safety must be deactivated, tagged, cleared, and tried. 

Contractors working in a locked out area were responsible for verifying that the lockout 

procedure had been completed. The handbook also states that isolating piping systems in 

hazardous processes should include block valves or a blind flange. Piping systems were to 

be examined after lockout to ensure they were isolated.

DuPont Buffalo’s procedure “Lockout Procedure Lock, Tag, Try, and Think” describes the 

lockout/tagout procedures at the Buffalo facility. This document states that “all sources of 

hazardous energy shall be removed or controlled prior to potential exposure to the hazards.” The list of examples of hazardous energy sources does not include chemicals or fire 

hazards however the OSHA standard for lockout, Control of Hazardous Energy (29 CFR 

1910.147) includes chemicals as energy sources for which a lockout procedure must address 

(Section 5.0). DuPont designated the area job representative, usually a DuPont field engineer, as responsible for securing required lockouts for contractor work. In addition, the field 

engineer and the contractor foreman were required to verify that the lockout procedure 

was done. The lockout card for slurry tank 1 did not include a requirement for blinding 

the overflow line; that is, tank 1 was considered completely “locked out” with the overflow 

open to the tank.
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 12

4.6 OSHA CITATIONS

As a result of this incident, OSHA investigated and issued ten citations to DuPont, and 

eight to Mollenberg-Betz. All of the citations referenced either OSHA regulation 29 CFR 

1910.147 or 29 CFR 1910.252 which regulate lockout/tagout and hot work, respectively. 

OSHA found several deficiencies in DuPont’s lockout and hot work procedures. DuPont 

was fined for not including steps to isolate the slurry tank overflow line in their energy 

control procedure, and for not installing blinds in the overflow line. 

OSHA also found that DuPont had not provided the Mollenberg-Betz contractors with 

specific control procedures for de-energizing slurry tank 1. OSHA fined Mollenberg-Betz 

because the contractors did not ensure that the lockout procedure had been completed and 

that the tank was not properly isolated. OSHA fined DuPont and Mollenberg-Betz for not 

informing their employees about the potential explosion hazards related to hot work on 

slurry tank 1. 

4.7 PROCESS SAFETY MANAGEMENT (PSM)

4.7.1 PROCESS HAZARD ANALYSIS

In its process hazard analysis (PHA) for the Tedlar process, DuPont considered whether VF 

could ever enter the slurry tanks. In the PHA process description, DuPont stated that its 

separators would recover “all the VF in the slurry” and that the steam injected before the 

slurry flash tank “allows the remaining VF to be flashed off.” DuPont told the CSB that “no 

tests were conducted prior to the incident to determine whether vinyl fluoride (“VF”) was 

entering the slurry tanks.”

The PHA also considered what would happen if the liquid ring compressor failed. DuPont 

reached the conclusion that “additional VF will leave through the flash tank vent.” No 

consideration was given to VF making it past the flash tank to the slurry tanks. 

Despite the assumption in this PHA that VF was not present in the process after the flash tank 

during normal operating conditions, DuPont evaluated the consequence of “more VF in slurry 

going to Slurry Tanks” if the steam injection failed. DuPont found that in this theoretical 

situation “VF left in slurry would be max 300 ppm [parts per million]” and would not pose 

a safety risk. In a 2009 PHA carried out on the downstream portion of the Tedlar process, 

DuPont considered the potential of VF in the slurry past the flash tank. DuPont determined 

that small amounts of VF may be present in the slurry “at a concentration below the LEL” 

(lower explosive limit). No recognition was given that VF below the LEL in a slurry tank with 

a large vapor space could accumulate until it reached explosive levels. 

4.7.3 MANAGEMENT OF CHANGE

Management of change (MOC) is a written procedure for a company to safely regulate any 

changes in process chemicals, technology, equipment, and procedures. MOC requires considering impact of change on safety and health, modifications to operating procedures, and 

technical basis for the proposed change. MOC also requires that any employees involved 

in operating a process and maintenance and contract employees whose job will be affected 

by the change be informed of, and trained in, the change prior to start-up of the process or 

affected part of the process. MOC is mandated by OSHA’s PSM program. 

No MOC documentation or authorization was carried out for the damaged overflow 

line from the flash tank or for the failed liquid ring compressor. DuPont did not require a 

management of change if adverse safety impacts were not anticipated. DuPont engineers 

determined that any residual VF vapor would vent safely to the atmosphere from the flash 

tank above the slurry tanks. DuPont did not consider the possibility that flammable vapor 

could flow into, and accumulate in, the slurry tanks. 
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 13

4.7.3 MECHANICAL INTEGRITY

The OSHA PSM standard requires that the mechanical integrity of critical process equipment is maintained to ensure it is designed and installed correctly and operates properly. 

PSM mechanical integrity includes storage tanks, piping systems, and vent systems. The 

mechanical integrity section of PSM states:

The employer shall correct deficiencies in equipment that are outside acceptable limits... 

before further use or in a safe and timely manner when necessary means are taken to 

assure safe operations

After DuPont personnel noticed the cracked seal loop, DuPont technical engineers decided 

not to repair the loop until the next turn around. If DuPont had included the slurry tanks 

and slurry flash tank overflow line in their PSM program they would have been required 

to fix the cracked seal loop before restarting the unit or ensure that the cracked seal loop 

posed no safety hazard.

4.7.4 DUPONT PSM CLASSIFICATIONS

The DuPont Tedlar process unit uses flammable VF in quantities exceeding 10,000 pounds; 

thus, the unit is covered by OSHA Process Safety Management (PSM) standard 29 CFR 

1910.119. The PSM standard includes additional requirements to assess and reduce hazards associated with highly hazardous and flammable materials. DuPont included the VF 

storage vessels, reactors, separators, and flash tank in the PSM program but excluded the 

outdoor PVF slurry tank farm from the requirements of the PSM standard because DuPont 

concluded VF carryover into the flash tank and product storage tanks was unlikely and 

insignificant. DuPont further concluded that VF emissions from the flash tank would not 

accumulate in the tank farm area. 

Prior to the incident, DuPont classified the slurry tank as a lower hazard operations (LHO) 

area, which is an area containing “any activity that exclusively manufactures, handles, 

stores, or uses any substances with low potential for death or irreversible human health 

effects.” Post-incident, DuPont increased the slurry tank area rating to a higher hazard 

process (HHP), or an area containing “any activity manufacturing, handling, storing, or 

using hazardous substances that, when they are released, ignited, or intentionally combined, 

can result in death or irreversible human health effects.” DuPont changed this because it 

modified the HHP definition to include any area that could contain more than 1 percent VF 

by weight or 0.65 percent by volume. DuPont did not conclude that OSHA PSM coverage 

extended to the slurry tanks.

The OSHA PSM standard does not apply to “Flammable liquids stored in atmospheric 

tanks or transferred which are kept below their normal boiling point without benefit of 

chilling or refrigeration.” Although the slurry tanks were atmospheric vessels, they contained a flammable gas which was above its normal boiling point (-98°F, -72°C). The slurry 

tanks also served to agitate the slurry mixture, making them pieces of process equipment 

and not solely storage tanks. 

In 1997, an OSHA memo about the chemical company Akzo Nobel provided guidance 

and serves as a letter of interpretation on how a facility should set the boundaries of 

PSM for a process: 

Aspects of the process which contain an HHC [Highly Hazardous Chemical] would be 

covered by all PSM elements, such as information, process hazard analysis and mechanical integrity. Aspects which do not contain HHC, but are interconnected or located 

nearby are part of the process. Such aspects may or may not be covered by the PSM 

standard based on whether the particular aspects could cause a HHC release or interfere 

with mitigating the consequences if there was [sic] a HHC release.
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 14

According to OSHA definitions, VF is an HHC. This incident clearly demonstrated that 

VF can enter the slurry tanks; additionally, the tanks are interconnected to the process that 

uses VF and are physically close to the flash tanks that remove VF. Despite DuPont’s failure 

to correctly include the slurry tanks in the Tedlar PSM boundary limits, OSHA did not cite 

DuPont for failing to apply PSM to the slurry tanks. 

4.8 DUPONT BELLE INCIDENT

On September 20, 2011, the CSB released an investigation report12 which detailed three 

incidents which occurred at a DuPont facility in Belle, West Virginia on January 22 and 

23, 2010. The last of these incidents resulted in one fatality and one employee exposure to 

phosgene, a toxic gas. 

The DuPont Belle and DuPont Buffalo incidents had a number of similarities. In the Belle 

report, the CSB found that DuPont practices at the Belle facility had deviated from their 

own policies and standards. It was determined that DuPont did not follow its own standards for the change-out of phosgene transfer hoses. This similarity was seen at the Buffalo 

facility where DuPont practice deviated from the hot work permitting process. The Belle 

report discussed DuPont Belle’s PHA process and how some process hazards were not 

addressed. Similarly, the DuPont Buffalo PHA did not adequately consider the threat the 

potential threat that VF in the slurry tanks posed.

4.9 DUPONT CORPORATE AUDIT

In November 2006, DuPont corporate performed a PSM audit of the DuPont Buffalo 

facility. DuPont awarded DuPont Buffalo a score of 99% on this audit, the highest score the 

auditor team had ever awarded a facility. The audit commended the Buffalo facility on their 

operating procedures and safe work practices and made no recommendations to improve 

these programs. No recommendations were made for the Buffalo facility’s MOC procedure 

for subtle changes, stating that “all systems comply.” 

Another DuPont audit was carried out in October 2009. This document commended 

DuPont Buffalo’s PHA process. It stated that the PHA’s were “very well managed and 

executed” and are of “consistently high quality.” These latest audits carried out by DuPont 

at the DuPont Buffalo facility missed many deficiencies that became apparent as a result of 

the November 9, 2010, incident. 

5.0 OCCUPATIONAL SAFETY AND HEALTH

ADMINISTRATION STANDARDS

5.1 LOCKOUT/TAGOUT 

OSHA standards do not explicitly require testing the atmosphere inside a tank before 

performing hot work on the outside of a tank. 

The OSHA Control of Hazardous Energy (lockout/tagout) standard (29 CFR 1910.147) 

requires positive control of hazardous energy including:

Appropriate lockout devices or tagout devices to energy isolating devices, and to otherwise disable machines or equipment to prevent unexpected energization, start up or 

release of stored energy in order to prevent injury to employees.

12 Report available at www.csb.gov
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 15

This standard does not specifically address isolating tanks from hazards associated with 

flammable, combustible, or toxic material flow through pipes, but many elements of the 

lockout/tagout standard directly apply to assuring that tanks are properly isolated for safe 

confined space entry and hot work activities. 

The lockout standard defines energy source as

Any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other 

energy.

5.2 HOT WORK

The OSHA standard “Welding, Cutting and Brazing, General Requirements” (29 CFR 

1910.252) includes requirements directly applicable to tank repair work. Specifically, 

§1910.252(a)(2)(vi)(C) prohibits cutting or welding 

in the presence of explosive atmospheres (mixtures of flammable gases, vapors, liquids, 

or dusts with air), or explosive atmospheres that may develop inside uncleaned or improperly prepared tanks or equipment which have previously contained such materials, 

or that may develop in areas with an accumulation of combustible dusts.

Furthermore, §1910.252(a)(3)(i) requires that “[a]ny pipe lines or connections to the drum 

or vessel...be disconnected or blanked” before welding or cutting. The overflow line, which 

provided the direct path for the flammable vapor to enter tank 1, was left unblinded and 

was not included on the lock out card for slurry tank 1.

6.0 INDUSTRY STANDARDS

6.1 NATIONAL FIRE PROTECTION ASSOCIATION

The National Fire Protection Association (NFPA) publishes consensus standards and guides 

on fire prevention and related subjects. Many of the standards are incorporated by reference 

in OSHA and industry consensus standards. 

The standard “Fire Prevention During Welding, Cutting, and Other Hot Work” (NFPA 

51B) provides a guidance for contractors and property managers who manage, supervise, 

and perform hot work. The standard is not intended to contain all necessary safety precautions and work practices involved in job-specific work, such as hot work on atmospheric 

storage tanks. Job-specific hot work prerequisites and practices are contained in other 

NFPA standards.

NFPA 51B appendices address hot work on atmospheric tanks by providing general guidance for a hot work permit program. The sample “Hot Work Permit” in Appendix A of 

NFPA 51B contains a checklist that includes two precautions directly applicable to the tank 

repair work:

UÊEnclosed equipment cleaned of all combustibles

UÊContainers purged of all flammable liquids/vapors 

Appendix B summarizes more than 25 hot work fire and explosion incidents to “illustrate 

how such incidents occur and to emphasize the provisions of this standard.” Three summarized incidents are similar to the DuPont incident in that each involved welding and other hot 

work on tanks and attached piping without adequate testing or other safety precautions. 

Chapter 4 of the standard, “Safeguarding of Tanks and Containers for Entry, Cleaning, 

or Repair” (NFPA 326) contains basic precautions for performing hot work on storage 

tanks: “Extreme caution shall be used when work is performed on a tank or container that 
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 16

contains vapors related to the substances that are stored or were previously stored therein.” 

Paragraph 4.1.6 adds, “Work on tanks or containers shall be permitted only after the 

characteristics...of the atmosphere within the tank or container have been determined.” 

Isolating equipment prior to hot work is addressed in NFPA 326, paragraph 5.3.2: “The 

vents for the tank or container on which work is to be performed shall be isolated from the 

vents of other tanks or containers that might still be in service.” 

NFPA 326 6.1.1 states:

To determine that an atmosphere is safe for the designated entry, cleaning, or repair 

work, tests for oxygen and for flammable, combustible, or other hazardous substance 

vapors, fumes, or dusts shall be made with an appropriate instrument as follows.

1. Before entry or re-entry

2. Before start of alterations or repairs

3. Before and during any hot work, cutting, welding, or heating operations

4. Continuously or periodically during the course of the work to be as determined by a 

qualified person

5. After cleaning the interior of each tank or container to determine that the cleaning 

procedures have been effective

6. After any process or activity has occurred that might change the atmosphere within 

the tank or container

The standard specifies that testing is needed before the start of alterations or repairs and before and during any hot work, cutting, welding, or heating operations. The OSHA hot work 

standard [29 CFR 1910.252] does not require air testing prior to the initiation of hot work.

6.2 AMERICAN WELDING SOCIETY

The American Welding Society (AWS) publishes consensus standards for welding, brazing, and thermal-cutting practices. The standard “Safety in Welding, Cutting, and Allied 

Processes” (ANSI Z49.1)13 has the same purpose and scope as the NFPA 51B standard. It 

provides technique-specific safety criteria, detailed guidance on welder personal protective 

equipment such as arc-flash eye shield selection criteria, and welding fume hazard awareness. Explanatory information item E6.4, “Welding or Cutting Containers,” specifically 

includes tanks and other large vessels in the definition of a container and warns

All containers should be considered unsafe for welding or cutting unless they have been 

rendered safe...Even a water tank should be considered hazardous unless a qualified 

person has declared it safe to weld or cut.

“Recommended Safe Practices for the Preparation for Welding and Cutting of Containers 

and Piping” (AWS F4.1) discusses precautions for welding and thermal cutting on containers. The standard warns that “the container should be tested for hazardous gases, fumes, 

and vapors periodically to ensure that the container and work area are safe during welding.” The standard is not intended for welding on “containers and confined spaces that can 

be entered by workers” but the DuPont tank repair work involved welding work on a tank 

that contained hazardous vapors; thus, the safety principles in the standard were applicable.

13 ANSI Z49.1 is available as a free download at www.AWS.org (2011).
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 17

6.3 AMERICAN PETROLEUM INSTITUTE

The American Petroleum Institute (API) publishes consensus standards for the petroleum 

industry. API Recommended Practice 2009 “Safe welding and cutting practices in refineries, 

gas plants, and petrochemical plants” discusses hot work in plants that deal with flammable 

vapors. API RP 2009 states that to effectively use a combustible gas detector, consider the 

characteristics of the gas (lighter or heavier than air) as well as the appropriate locations 

and frequency of test. 

The lack of rigor and deviation from accepted practices in the permitting process and incorrect engineering assumptions resulted in VF vapor flowing into tank 1 and accumulating. 

When DuPont personnel discovered the damaged seal loop on the flash tank overflow line, 

they incorrectly concluded that it would still prevent VF vapor and steam from entering the 

slurry tank. In addition, they left tank 1 unblinded and still open to the overflow line when 

they restarted the Tedlar unit. Finally, DuPont authorized the hot work to begin without 

determining if the interior of tank 1 contained a hazardous atmosphere.

7.0 OTHER HOT WORK INCIDENTS

In February 2010, the CSB issued a hot work safety bulletin, “Seven Key Lessons to Prevent 

Worker Deaths During Hot Work In and Around Tanks”, which discusses 11 incidents 

involving hot work activities where flammable vapor accumulated and ignited while repair 

work or process modifications were performed in or near storage tanks. Three of the 

incidents, which involved welding on a tank that contained flammable materials, closely 

parallel the incident at DuPont.

In June 2006, three contract workers were killed and one was seriously injured when a 

welding torch ignited flammable hydrocarbon vapors at a Partridge-Raleigh Oilfield in 

Raleigh, Mississippi. The contractors had been installing piping between two oil tanks. Like 

the DuPont incident, all of the tanks were interconnected by piping and the interconnected 

tanks contained flammable vapors which ignited. 

In July 2008, three workers were killed and another seriously injured in an explosion at 

the Packaging Corporation of America fiberboard manufacturing facility in Tomahawk, 

Wisconsin. Workers were welding a temporary metal clamp on a damaged flange atop an 

80-foot tall atmospheric storage tank. Company hot work procedures did not require sampling the atmosphere inside the tank prior to welding directly to the attached piping. The 

tank contained recycled water and fiber waste, which the company assumed did not pose a 

fire or explosion hazard. The CSB concluded that bacteria likely produced highly flammable 

hydrogen gas inside the tank. Sparks from the welding or the heated metal ignited the 

hydrogen. Two workers fell to their death and the third died after being hit by debris when 

the explosion blew off part of the tank top. 

In February 2009, a welding contractor was killed while repairing a large crack in the 

bottom of a water clarifier tank at a ConAgra Foods facility in Boardman, Oregon. Water 

used to wash potatoes had leaked through the crack and accumulated inside the inaccessible 

space under the tank. Examination of a sample of the liquid indicated that bacterial decomposition of the organic matter likely produced flammable gas that accumulated inside the 

tank support skirt. The gas ignited when the contractor started welding the tank bottom.

This case study reiterates the key lessons of the CSB hot work bulletin to minimize fire and 

explosion hazards when performing hot work on atmospheric tanks, including the need to 

clearly understand and manage hot work activities, especially in terms of testing for a flammable atmosphere both outside and inside any tank or container where welding or grinding 

is done directly on the container surface. 
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 18

Hot work incidents across the country continue to cause death, injury, and property damage with alarming frequency. The CSB is currently conducting a more comprehensive 

evaluation of hot work regulations and standards and expects to issue related safety recommendations in the near future.

8.0 KEY FINDINGS

1. DuPont PHAs made the incorrect assumption that VF in the Tedlar process could not 

reach flammable levels in the slurry tanks.

2. DuPont restarted the unit after incorrectly concluding that the defective seal loop did 

not increase the risk of VF vapor transfer into tank 2. Flammable VF vapor flowed 

directly from the flash tank into tank 2.

3. DuPont did not properly isolate and lockout tank 1 from in-service tanks 2 and 3 prior 

to authorizing hot work on tank 1. Consequently, flammable VF vapor passed directly 

from tank 2 into tank 1 through the overflow line and accumulated to a concentration 

above the lower explosive limit.

4. The DuPont hot work permit procedure did not require testing the atmosphere inside 

tank 1 for flammable vapor even though the work required welding directly to the tank 

top. 

5. The individuals who signed off on the hot work permit were not knowledgeable in the 

operations and hazards of the Tedlar process. 

6. The repair work created multiple ignition sources. Welding directly to the tank top 

increased the metal temperature inside the tank significantly above the VF vapor autoignition temperature. Welding and grinding generated hot sparks, which likely ignited the 

flammable vapor.

7. OSHA’s hot work standard does not specifically require gas monitoring inside containers intended for hot work even though it is recommended by industry safe practice 

guidelines.14

9.0 LESSONS LEARNED

1. Welding to the outside surface of a tank or container generates heat and sparks near the 

weld area. The extreme temperatures and sparks will likely ignite flammable materials 

present inside the equipment.

2. Before starting hot work activities, all process connections on tanks and similar containers should be completely isolated by closing valves, installing blanks, and disconnecting pipes to ensure that all possible and known sources of flammable materials 

cannot enter the container at any time. 

3. The atmosphere inside any container previously containing flammables, regardless of 

size, should be tested before authorizing any hot work involving grinding, cutting, or 

welding on the outside surface and the atmosphere must be continuously monitored 

during the work.

14 NFPA 326 and ANSI Z49.1
CSB s E.I. DuPont de Nemours & Co Inc. Case Study 19

10.0 RECOMMENDATIONS

E.I. DUPONT DE NEMOURS AND CO., INC.

2011-01-I-NY R1

Develop and enforce corporate-directed policies and procedures which will require all 

DuPont facilities to audit their hot work permitting systems prior to initiating hot work to 

ensure that:

UÊAll potential explosion hazards associated with hot work activities are identified and 

mitigated 

UÊAll relevant forms required for permits are completed in accordance with corporate 

policies and industry standards (including NFPA 326 and NFPA 51B) 

UÊAppropriate DuPont personnel officially approve hot work permits, by signature or 

equivalent, consistent with DuPont policies

2011-01-I-NY R2

Revise corporate policies and procedures to require that all process piping, or similar 

connections to tanks or vessels be positively isolated, (using closed valves, blind flanges or 

pancake blanks) and the equipment appropriately vented before authorizing any hot work.

 2011-01-I-NY R3

Revise corporate policies and procedures to require that the atmosphere inside the container 

be monitored for flammable vapor prior to performing any welding, cutting, or grinding on 

the container surface.

2011-01-I-NY R4

Revise corporate policies and procedures to require air monitoring for flammable vapor 

inside the container for the duration of the hot work consistent with industry standards 

(NFPA 326, NFPA 51B). Create a policy for determining criteria for requiring continuous 

or periodic testing for the duration of hot work.