ROLE OF PROCESS MONITORING IN A CHEMICAL PLANT EXPLOSION

摘要

Shortly after 6:00 am on December 13, 1994, two massive detonations leveled portions of the Sioux City ammonium nitrate plant owned and operated by Terra Industries. Four plant workers were killed, eighteen others suffered serious injury, and damage to the plant and surrounding community was estimated in the hundreds of millions of dollars. The first detonation originated in a neutralizer vessel, where ammonium nitrate was produced from the exothermic reaction of nitric acid with gaseous ammonia. The resultant ammonium nitrate solution flowed from the neutralizer into a rundown tank, the origin of the second detonation. Exponent Failure Analysis Associates (FaAA) was retained to conduct an engineering analysis of the accident. The investigation revealed that unsafe plant operations resulted in the detonations. In particular, insufficient real time monitoring of temporary shutdown processes allowed the ammonium nitrate inside the vessel to undergo a runaway chemical reaction. On the afternoon of December 12, 1994, plant operators shut down the neutralizer but allowed the ammonium nitrate solution to remain in the vessel in anticipation of restarting the neutralizer as soon as repairs were completed elsewhere. The solution was in a highly acidic state as indicated by a pH probe located in the overflow line between the neutralizer and rundown tank. However, the pH indications rose to "normal" levels about two hours after the shutdown and remained at this level for 14 hours until the explosion. The neutralizer thermocouple indicated that the temperature of the solution was slowly falling in the final 9 hours leading up to the explosion even though a continuous flow of steam was injected directly into the insulated vessel. Because of the well-known risk of thermal runaway of ammonium nitrate, careful monitoring of the solution condition is important, particularly when no circulation exists within its containing vessel. Analysis of the data recorded by the distributed control system (DCS) and thermodynamic analysis and testing of the shutdown process sequence revealed that the actual condition of the ammonium nitrate solution in the neutralizer was substantially unknown to the plant operators. Because no solution was flowing past the pH probe, the pH indications had no meaning. Steam injected into the solution collapsed quickly, locally heated the ammonium nitrate solution, and provided little or no circulation. Thus, the thermocouple indication was not representative of the maximum solution temperature in the neutralizer. Therefore, the board operator was receiving and relying on data that did not represent the pH and maximum temperature of the solution in the neutralizer, parameters which must be monitored to avoid a thermal runaway. The outside operators were busy performing other tasks throughout the plant and, as a result, grab samples, which would have provided more reliable pH indications, were not collected. The existing neutralizer instrumentation was designed to monitor the ammonium nitrate manufacturing process during normal operating conditions. A proper risk assessment of the temporary shutdown process would have revealed the limitations of the DCS control system and the need for additional monitoring during shutdown conditions and may have prevented this incident.