Process safety: Shutdown failures

Incidents are typically the result of multiple failures to address hazards effectively—represented by the holes in successive slices aligning.

By Greg Hale, ISSSource November 21, 2015

It was over 20 years ago when an ammonium nitrate explosion at Terra Industries in Iowa left four dead and 18 injured. The incident exposed major issues in the process safety management (PSM) regimen during a shutdown. While this tragic incident happened over two decades ago, it still resonates today.

When it comes to safety incidents, there are the huge incidents that live on forever like Bhopal, India, or BP Texas City to name a few. But then there are other incidents that go relatively unnoticed but prove to be learning experiences.

A massive explosion occurred in the ammonium nitrate (AN) portion of Terra Industries’ fertilizer plant in Port Neal, IA, Dec. 13, 1994. The explosion occurred after the process had been shut down and AN solution was left in several vessels. Multiple factors contributed to the explosion, including strong acidic conditions in the neutralizer, application of 200-psig steam to the neutralizer vessel, and lack of monitoring of the plant when the process was shut down with materials in the process vessels. Serious damage to other parts of the plant caused the release of nitric acid into the ground and anhydrous ammonia into the air.

Plant production

The plant produced nitric acid, ammonia, ammonium nitrate, urea, and urea-ammonium nitrate. Ammonia from the urea plant off-gas or from ammonia storage tanks ended up added to the neutralizer through a sparger in the bottom of the vessel, and 55% nitric acid was added through a sparger ring in the middle of the vessel. The product, 83% AN, went to a rundown tank via an overflow line for transfer to storage. A pH probe located in the overflow line controlled the nitric acid flow to the neutralizer to maintain the pH at 5.5-6.5. The temperature in the neutralizer was at 267 F. The neutralizer and rundown tank vented to a scrubber, where the vapors ended up absorbed by 55% to 65 % nitric acid and makeup water to produce 50% ammonium nitrate. A stream of 50% AN recycled back to the neutralizer.

About two weeks prior to the event, workers found the pH probe in the overflow line to be defective, at which time the plant switched to manual pH sampling. Two days prior to the event, the pH measured at 1.5 and did not make it back into the acceptable range until about 1 a.m. on Dec. 12.

The AN plant shut down at 3 p.m., Dec. 12 because the nitric acid plant was out of service. At 3:30 p.m., operators purged the nitric acid feed line to the neutralizer with air. At 7 p.m., operators pumped the scrubber solution to the neutralizer. Then 200-psig steam (which is around 387 F) went in through the nitric acid feed line to the nitric acid sparger to prevent backflow of AN into the nitric acid line. The explosion occurred at 6 a.m., Dec. 13.

What happened

AN can become more sensitive to decomposition, deflagration, and detonation at low pH levels, at high temperatures, in low-density areas (e.g., in areas containing gas bubbles), in confined spaces, and in the presence of contaminants, such as chlorides.

Calculations showed the nitric acid line clearing would have lowered the pH at the time of the shutdown to about 0.8. The steam sparge was left on for 9 hours, providing enough heat to raise the solution to its boiling point in about 2 hours. The air and steam sparge created gas bubbles in the solution. Chlorides, carried over from the nitric acid plant, were also present in the AN solution.

The Environmental Protection Agency (EPA) investigation concluded that the conditions that led to the explosion occurred due to the lack of safe operating procedures. There were no procedures for putting the vessels into a safe state at shutdown or for monitoring the process vessels during shutdown. The EPA found other producers either emptied the process vessels during a shutdown or maintained the pH above 6.0. Also, other producers either did not allow steam sparges, or, if steam sparges ended up used, there was no direct supervision by operators. The EPA also noted no hazard analysis had been done on the AN plant, and personnel interviewed "indicated they were not aware of many of the hazards of ammonium nitrate."

Lessons learned

Operating procedures need to cover all phases of operation. In this event, the lack of procedures for shutdown and monitoring the equipment during shutdown led operators to perform actions that sensitized the AN solution and provided energy to initiate the decomposition reaction. Because there had been no hazard identification study, personnel did not know about the conditions that sensitized AN to decomposition.

A hazard assessment of the shutdown step would have revealed the pH of the neutralizer could not end up measured if there were no solution flowing through the overflow line, and the temperature of the neutralizer could not be accurately measured without any circulation in the tank. A complete hazard identification study would have uncovered backflow of ammonium nitrate into the nitric acid line, and better design solutions could have been identified.

PSM failures

The Terra Industries incident is a good case in point to show where failures of PSM systems can be deadly and costly. Major accidents have emphasized the need for process safety within the chemical and petrochemical industries. For example, the founding of the Center for Chemical Process Safety (CCPS) was a response by industry to the methyl isocyanate release at Bhopal, India, in 1984 that killed over 2,000 people and injured tens of thousands. A fire and explosion at a PEMEX LPG terminal in Mexico City, also in 1984, killed more than 600 people and injured around 7,000.

Major environmental damage also occurred because of process safety incidents. The firefighting efforts during a fire in a Sandoz warehouse in Basel, Switzerland, in 1986 caused the release of different chemicals, including pesticides, because responders failed to contain the water runoff. The release caused massive destruction to aquatic life in the Rhine River as far as 250 miles away; fishing ended up banned for six months. The environmental consequences of the Exxon Valdez spill in 1989 and the Deepwater Horizon incident in 2010 have been well-documented.

Accidents almost always have more than one cause. For quite a few years, safety experts have used the Swiss cheese model to help managers and workers in the process industries understand the events, failures, and decisions that can lead to a catastrophic incident or near miss. According to this model, each layer of protection is depicted as a slice of Swiss cheese, and the holes in the cheese represent potential failures in the protection layers, such as:

  • Human errors
  • Management decisions
  • Single-point equipment failures or malfunctions
  • Knowledge deficiencies
  • Management system inadequacies, such as a failure to perform hazard analyses, failure to recognize and manage changes, or inadequate follow-up on previously experienced incident warning signs.

Incidents are typically the result of multiple failures to address hazards effectively—represented by the holes in successive slices aligning. A management system may include physical safety devices or planned activities that protect and guard against failure. An effective PSM system has the effect of reducing the number of holes and the sizes of the holes in each of the system’s layers, thereby reducing the likelihood that they will align.

This was an excerpt from a report written by Albert Ness from the Center for Chemical Process Safety. He has 39 years of experience with Rohm and Haas, GE Plastics, the Dow Chemical Co., and ABS Consulting as a research and development engineer in plastics, agricultural chemicals, and ion exchange resins, and then, starting in 1989, as a process safety specialist. This article originally appeared on ISSSource. ISSSource is a CFE Media content partner. Edited by Joy Chang, Digital Project Manager, CFE Media,

Control Engineering has a process safety page.

Original content can be found at