INVESTIGATION REPORT

8 CHEMICAL INVESTICATION BOARD · 111

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT

CATASTROPHIC VESSEL OVERPRESSURIZATION

(4 DEATHS)

〔图〕插图

Sonat Exploration Company

Temple 22-1 Common Point Separation Facility Pitkin, Louisiana March 4, 1998

KEY ISSUES:

● DESIGN & HAZARD REVIEWS

● PRESSURE-RELIEF DEVICES

● OPERATING PROCEDURES

ABSTRACT

This report examines the catastrophic vessel failure and fire that occurred on March 4, 1998, near Pitkin, Louisiana, at an oil and gas production facility owned by Sonat Exploration Company. Four workers were killed in the incident. The root causes of the incident are identified, and recommendations are made concerning engineering and design management systems and the development of good-practice guidelines.

The Chemical Safety and Hazard Investigation Board (CSB) is an independent federal agency whose mission is to ensure the safety of workers and the public by preventing or minimizing the effects of chemical incidents. The CSB is a scientific investigative organization; it is not an enforcement or regulatory body. Established by the Clean Air Act Amendments of 1990, the CSB is responsible for determining the root and contributing causes of accidents, issuing safety recommendations, studying chemical safety issues, and evaluating the effectiveness of other government agencies involved with chemical safety. No part of the conclusions, findings, or recommendations of the CSB relating to any chemical incident may be admitted as evidence or used in any action or suit for damages arising out of any matter mentioned in an investigation report. See 42 U.S.C. § 7412(r)(6)(G). The CSB makes public its actions and decisions through investigation reports, summary reports, safety studies, safety recommendations, special technical publications, and statistical reviews. More information about the CSB may be found on the World Wide Web at http://www.chemsafety.gov.

Information about available publications may be obtained by contacting:

Chemical Safety and Hazard Investigation Board

Office of External Relations

2175 K Street, NW, Suite 400

Washington, DC 20037

(202) 261-7600

Chemical Safety Board publications may be purchased from:

National Technical Information Service

5285 Port Royal Road

Springfield, VA 22161

(800) 553-NTIS or (703) 487-4600

Email: info@NTIS.fedworld.gov

For international orders see http://www.ntis.gov/support/cooperat.htm.

For this report, refer to NTIS number PB-2000-108254.

Salus Populi Est Lex Suprema

Public Safety Is the Highest Law

THIS PAGE INTENTIONALLY LEFT BLANK

TABLE OF CONTENTS

EXECUTIVE SUMMARY 1

ES.1 INTRODUCTION $\ldots$ 1

ES.2 INCIDENT $\ldots$ 2

ES.3 KEY FINDINGS 2

ES.4 RECOMMENDATIONS $\ldots$ 5

1.0 INTRODUCTION $\ldots$ 7

1. 1 BACKGROUND $\ldots$ 7

1. 2 INVESTIGATIVE PROCESS $\ldots$ 8

1. 3 FACILITY OPERATIONS $\ldots$ 9

1. 4 FACILITY PERSONNEL $\ldots$ 13

2.0 DESCRIPTION OF THE INCIDENT $\ldots$ 14

1. 1 PRE-INCIDENT EVENTS $\ldots$ 14

1. 2 THE INCIDENT $\ldots$ 15

3.0 ANALYSIS OF THE INCIDENT $\ldots$ 21

1. 1 INITIATING EVENT $\ldots$ 21

1. 2 EQUIPMENT DESIGN, INSTALLATION, AND OPERATION $\ldots$ 24

1. 3 ENGINEERING DESIGN REVIEW $\ldots$ 27

1. 4 OPERATING PROCEDURES $\ldots$ 28

1. 5 EMPLOYEE TRAINING $\ldots$ 28

1. 6 CONTRACTOR TRAINING $\ldots$ 30

1. 7 REGULATORY ISSUES $\ldots$ 30

4.0 ROOT AND CONTRIBUTING CAUSES $\ldots$ 33

1. 1 ROOT CAUSES $\ldots$ 33

1. 2 CONTRIBUTING CAUSE $\ldots$ 34

5.0 RECOMMENDATIONS $\ldots$ 35

6.0 REFERENCES $\ldots$ 37

APPENDIX A: CAUSAL TREE ANALYSIS DIAGRAM $\ldots$ 38

TABLE OF FIGURES

FIGURE 1. AERIAL VIEW OF THE TEMPLE 22-1 COMMON POINT SEPARATION FACILITY AFTER THE INCIDENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

FIGURE 2. BLOCK FLOW DIAGRAM OF THE SEPARATION PROCESS $\ldots$ 10

FIGURE 3. PLOT PLAN OF THE TEMPLE 22-1 COMMON POINT SEPARATION FACILITY $\ldots$ 11

FIGURE 4. THIRD-STAGE SEPARATOR SCHEMATIC $\ldots$ 12

FIGURE 5. INTENDED VALVE POSITIONS AFTER THE FINAL AIGNMENT $\ldots$ 16

FIGURE 6. LOCATIONS OF THE FOUR VICTIMS FOUND AFTER THE INCIDENT $\ldots$ 18

FIGURE 7. DAMAGED VEHICLES AND STORAGE TANKS $\ldots$ 20

FIGURE 8. DAMAGED WATER STORAGE TANK WITH FRAGMENT OF THIRD-STAGE SEPARATOR $\ldots$ 20

FIGURE 9. COMPARISON OF VALVE Alignments as planned and as found after the incident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

EXECUTIVE SUMMARY

ES.1 INTRODUCTION

At approximately 6:15 p.m. on March 4, 1998, a catastrophic vessel failure and fire occurred near Pitkin, Louisiana, at the Temple 22-1 Common Point Separation Facility (the “facility”), owned by Sonat Exploration Co.$^{1}$ Four workers who were near the vessel were killed, and the facility sustained significant damage.

The facility housed two petroleum separation trains$^{2}$ and consisted of separation equipment, piping, storage vessels, and a gas distribution system. The separation trains were designed to produce crude oil and natural gas from well fluid,$^{3}$ derived from two nearby wells. The vessel ruptured due to overpressurization, releasing flammable material which then ignited.

Because of the serious nature of the incident the Chemical Safety and Hazard Investigation Board (CSB) initiated an incident investigation. The purpose of this investigation was to identify the root causes of the incident and make safety recommendations as appropriate.

ES.2 INCIDENT

On the day of the incident, one of the two separation trains was to be put in operation and production was to be initiated from a new well, known as the Temple 24-1 well. This well was located approximately two miles from the facility and was connected to the facility by a pipeline. Facility supervisors intended to purge the pipeline by opening the 24-1 well and using well fluid to displace air out of the pipeline and through a storage tank roof hatch, located at the end of the production train. Purging is a common practice in petroleum production and processing and entails the removal of air from systems that will subsequently contain flammable hydrocarbons.

This purging process was initiated and then conducted for approximately 60 minutes, until 6:15 p.m., at which point a separation vessel failed catastrophically, releasing flammable gas that ignited.

Gas from the ruptured vessel produced a large fireball, which damaged nearby piping and released and ignited additional flammable materials. Four workers, who were in the vicinity of the vessel when it failed, died instantly due to massive trauma. The separator, four personal vehicles, and a backhoe were destroyed, and there was damage to oil and water storage tanks. Two other workers who were present at the facility at the time of the incident both survived without injury.

ES.3 KEY FINDINGS

1. The separation vessel that failed, a third-stage separator,$^{4}$ lacked an inlet valve and therefore could not be isolated from an adjacent bypass line, which at the time of the incident contained high-pressure purge gases.

1. At the time of the incident, two outlet block valves on the separator were closed, as were two block valves on the bypass line downstream of the separator. Accordingly the high-pressure purge gases could not be vented and the separator was overpressurized.

1. The third-stage separator was only rated for atmospheric pressure service (0 $psig^{5}$). The purge gas stream to which the separator was exposed had a pressure potentially as high as 800 psig.

1. The separator was not equipped with any pressure-relief devices, and overpressurization caused the separator to fail catastrophically.

1. The CSB could not conclusively determine the timing of the closure of the two bypass line block valves or establish any reason for this action.

1. The facility was designed and built without effective engineering design reviews or hazard analyses.

1. Workers at the facility were not provided with written operating procedures addressing the alignment of valves during purging operations.

1. Sonat operated third-stage separators that lacked adequate pressure-relief systems at other oil and gas production facilities for over a year prior to the incident.

1. ANSI/API Specification 12J-1992$^{6}$, issued by the American Petroleum Institute, describes recommended practices for the installation of pressure-relief devices on oil and gas separators. The specification states that “all separators, regardless of size or pressure, shall be provided with pressure protective devices . . .”

1. The Occupational Safety and Health Administration's (OSHA) Process Safety Management (PSM) Standard (29 CFR 1910.119) contains elements that are relevant to this incident, such as process hazard analyses and the use of written operating procedures. However, the PSM standard does not currently apply to oil and gas production facilities.

Root Causes

1. Sonat management did not use a formal engineering design review process or require effective hazard analyses in the course of designing and building the facility.

In the incident, a third-stage separator was exposed to a pressure significantly in excess of its maximum allowable working pressure, resulting in catastrophic vessel failure. A formal engineering design review process should have been in place during the design of the facility.$^{7}$ Sonat constructed the facility without producing engineering drawings of the process equipment. Neither design review nor hazard analysis can be effectively conducted in the absence of accurate engineering drawings.

A formal design review and hazard analysis process would have provided a better opportunity to analyze the consequences of foreseeable deviations from normal operating procedures, such as valve misalignments. This process would likely have identified the danger of catastrophic overpressurization of the third-stage separator and indicated the need for a pressure-relief system.

1. Sonat engineering specifications did not ensure that equipment that could potentially be exposed to high-pressure hazards was adequately protected by pressure-relief devices.

The vessel that failed met the definition of a two-phase gas-oil separator and should have been designed to meet relevant industry consensus standards for pressure relief. For example, ANSI/API Specification 12J-1992, “Specification for Oil and Gas Separators,” requires that separators be equipped with pressure-relief devices.

Contributing Cause

1. Sonat management did not provide workers with written operating procedures for the start-up and operation of the facility.

Written operating procedures governing each phase of facility operations, including purging operations, would have reduced the likelihood of a manual valve misalignment of the kind that triggered the incident. Procedures should have included written checklists and diagrams to verify proper valve positions for purging.

ES.4 RECOMMENDATIONS

El Paso Production Company (formerly Sonat Exploration Company)⁸

1. Institute a formal engineering design review process for all oil and gas production facilities, following good engineering practices and including analyses of process hazards.

1. Implement a program to ensure that all oil and gas production equipment that is potentially subject to overpressurization is equipped with adequate pressure-relief systems, and audit compliance with the program.

1. Develop written operating procedures for oil and gas production facilities and implement programs to ensure that all workers, including contract employees, are trained in the use of the procedures. Ensure that the procedures address, at a minimum, purging and start-up operations and provide information on process-related hazards.

American Petroleum Institute

1. Develop and issue recommended practice guidelines governing the safe start-up and operation of oil and gas production facilities. Ensure that the guidelines address, at a minimum, the following: project design review processes, including hazard analyses; written operating procedures; employee and contractor training; and pressure-relief requirements for all equipment exposed to pressure hazards.

1. Communicate the findings of this report to your membership.

1. 0 INTRODUCTION

1.1 BACKGROUND

Sonat Inc. was an integrated energy company engaged in oil exploration, oil and gas production, interstate gas transmission, and energy services. Sonat Exploration Company ("Sonat"), was the exploration and production division of Sonat Inc.$^{9}$ Sonat operated wells in the West Masters Creek field, located in a rural area of west-central Louisiana, producing petroleum from the Austin Chalk formation.$^{10}$ Fluid from these wells $^{11}$ was directed to separation facilities, where crude oil and natural gas were separated out for commercial sale. Brine or "produced water" was also separated from the well fluid and eventually re-injected into the ground. Among the separation facilities was the Temple 22-1 Common Point Separation Facility (the "facility"), located in Vernon Parish about ten miles from Pitkin, Louisiana.

The facility was designed to process well fluid from several nearby oil and gas wells. At the time of the incident, the facility was configured to process the output from two wells known as Temple 22-1 and Temple 24-1. During the start-up of production from the Temple 24-1 well on Wednesday, March 4, 1998, at approximately 6:15 p.m., a catastrophic vessel failure and fire occurred in the facility, killing four workers.

〔图〕Oil and Water Storage TanksThird Stage Separator(Test TrainThird StageSeparator LocationLocation ofbefore the IncidenByp

Figure 1. Aerial View of the Temple 22-1 Common Point Separation Facility after the Incident

1.2 INVESTIGATIVE PROCESS

CSB personnel arrived at the scene on March 6, 1998. Other organizations that sent investigators to the scene included the Louisiana State Police Hazmat Division, the Louisiana Department of Environmental Quality, the Vernon Parish Coroner, the U.S. Occupational Safety and Health Administration (OSHA), and Sonat itself. After a preliminary assessment, CSB determined that it would conduct a full investigation of the incident. CSB conducted interviews with Sonat personnel, contractors, and emergency responders. CSB investigators also examined physical evidence and reviewed documents obtained from Sonat and other organizations. The

CSB was assisted in its initial field investigation work and technical analysis by contractors from the Department of Energy's Oak Ridge National Laboratory and Argonne National Laboratory. Support facilities were provided by the U.S. Army, Fort Polk, Louisiana. Technical assistance was provided by Berwanger, Inc.

1.3 FACILITY OPERATIONS

The facility was designed to produce oil and natural gas by a continuous separation process, using well fluid from the two nearby wells as the feedstock (see Figure 2 for process diagram). The facility consisted of separators, pipelines, storage tanks, and ancillary equipment.$^{12}$ To effect the separation of well fluid into its constituent phases, Sonat constructed two independent separation trains, identified as the Bulk Train and the Test Train.$^{13}$ The separation trains were connected via manifold to pipelines leading to the Temple 22-1 and 24-1 wells, which were located at distances of approximately 270 feet and two miles, respectively. The Test Train began production on January 16, 1998, processing fluid from the Temple 22-1 well. The Bulk Train was to be put into production for the first time on March 4, 1998, processing fluid from the more distant Temple 24-1 well.

Each separation train comprised three separators connected in series. Multiple separators were used in order to maximize the recovery of natural gas.$^{14}$ The maximum allowable working pressures (MAWP) for the first- and second-stage separators were 1440 psig and 500 psig, respectively;$^{15}$ pressures in excess of these values would activate pressure-relief valves located

〔图〕插图

Figure 2. Block Flow Diagram of the Separation Process

on each separator. Actual operating pressures were considerably lower, around 900 psig for the first-stage separator and 225 psig for the second-stage separator. The third-stage separator$^{16}$ had an MAWP of 0 psig (atmospheric pressure) and would have operated around this pressure during normal operation. As the pressure of the well fluid was decreased through the series of separators, the solubility of natural gas in the fluid decreased and an increasing fraction of the gas would distill off for collection.

Figure 3. Plot Plan of the Temple 22-1 Common Point Separation Facility

The first two separators were designed for three-phase (gas/oil/water) separation, while the third-stage separator was designed for two-phase (gas/oil) separation. Residence time of the fluid in the first two separators was sufficient for the gravity-based separation of the oil and water phases. Natural gas from the separators was directed to the gas sales pipeline, while separated brine was either directly injected into the ground or impounded in storage tanks. The oil phase was transferred from one separator to the next, and eventually to the storage tanks for shipment by truck to a refinery. Natural gas was compressed and transported by pipeline to a gas processing plant. Figure 3 shows the overall layout of the facility.

Each third-stage separator (Bulk and Test) was a 45-foot-tall vessel with a diameter of four feet (see Figure 4 for details). In operation, the vessel would be approximately 80% full with fluid. Well fluid was introduced into the separator at a height of approximately 35 feet, and separated

〔图〕插图

Figure 4. Third-Stage Separator Schematic

oil was withdrawn at a height of approximately three feet. Residual natural gas would evolve from the oil phase and be collected from the top of the separator. From there, the gas would be pressurized by a compressor and combined with the gas derived from the second-stage separator.

1.4 FACILITY PERSONNEL

There were three categories of workers employed at the facility around the time of the incident. A Sonat production supervisor was responsible for coordinating all production activities at several wells and separation facilities. A Sonat construction supervisor was responsible for final construction activities on the Bulk Train and ongoing construction activities at another separation facility nearby. The construction supervisor also assisted with specific tasks such as purging equipment and pipelines. In addition, the facility employed operators who were either Sonat employees or contractors. Operators worked under the direction of Sonat supervisors and were engaged in such activities as monitoring operating temperatures, pressures, and flow rates; setting valves; gauging storage tank levels; and recording production data for management. Employees generally worked in two 12-hour shifts.

The facility was designed for automated operation with periodic monitoring by operators. However, at the time of the incident, six personnel were present at the facility.$^{17}$ The Sonat construction supervisor and a day-shift contract operator were involved with the equipment and pipeline purging activity on the Bulk Train. They were joined during the afternoon by a Sonat operator and then around 5:40 p.m. by two night-shift contract operators. One other day-shift contract operator was attending to the operation of the Test Train.

2.0 DESCRIPTION OF THE INCIDENT

2.1 PRE-INCIDENT EVENTS

On March 4, 1998, Sonat planned to initiate production from the Temple 24-1 well utilizing the newly constructed Bulk separation train. Prior to actual production, the Bulk Train equipment and the two-mile pipeline joining the well to the facility needed to be purged to remove air. Purging is a routine operation in oil and gas production and is undertaken to reduce the explosion hazard from flammable petroleum that is undergoing processing. In this case, purging was conducted by releasing pressurized well fluid from one of the two nearby wells and allowing it to displace the air from the equipment being purged. Displaced air would be released through an open storage tank hatch; when the concentration of air in the system was sufficiently low, the equipment would be closed and production could commence.

Sonat supervisors decided to conduct the purging process in two stages: (1) to purge the Bulk Train equipment using well fluid from the nearby 22-1 well; (2) to purge the two-mile pipeline joining the 24-1 well to the facility, using fluid from the 24-1 well.$^{18,19}$ Each purging operation would require a specific alignment of valves.

The first purging operation, of the Bulk Train equipment, was completed uneventfully on the afternoon of the incident.

2.2 THE INCIDENT

With the purging of the Bulk Train separation equipment completed, preparations were made for the purging of the two-mile pipeline leading from the 24-1 well. The Sonat construction supervisor and the assigned operator realigned the valves as shown in Figure 5.$^{20}$ According to their plan, they would direct well fluid as follows:

● from the 24-1 well through to the Bulk Train header (open: valve 1; closed: valves 23, 24, 26);

· from the Bulk Train header through to the storage tanks, bypassing the separators and oil cooler (open: valves 8, 9, 10, 11, 12, 13, 16; closed: valves 2, 3, 4, 5, 6, 7, 14, 15);

· through the storage tanks and out an open roof hatch (open: valve 17, hatch 21; closed: valves 18 and 19,$^{21}$ hatch 20).

Executing the plan required at least 11 valves to be manually repositioned, an activity that was performed without written procedures or valve position checklists. While most valves were manually operated ball valves,$^{22}$ valve 12 was a pneumatic valve actuated by a liquid level probe located inside the third-stage separator. A high liquid level within this vessel would automatically cause valve 12 to open, allowing fluid to bypass the separator provided that the adjacent manual ball valves 11 and 13 were open. On the morning of March 4, workers had disconnected the supply of control gas to valve 12, causing the valve to remain open thereafter.

Fluid from the 24-1 well thus would flow through the two-mile pipeline, displacing air, and ultimately exiting via the bypass line and through the open storage tank roof hatch.

〔图〕插图

Figure 5. Intended Valve Positions after the Final Alignment

Once the construction supervisor and the operator had realigned the valves, the pipeline purging went forward. The Sonat production supervisor, who was in radio communication with the construction supervisor, was positioned with an operator near the 24-1 well. At 5:10 p.m. the production supervisor directed the operator to open valve 22, the choke valve $^{23}$ downstream of the well, initiating flow through the two-mile pipeline. It was expected that the initial well fluid would be composed primarily of natural gas, followed by a multiphase mixture of gas, oil, and brine. The Sonat construction supervisor was stationed at the facility by valve 23. He opened

this small valve and used a portable oxygen monitor to measure the concentration of oxygen in the vented gases; a decrease in oxygen concentration was a measure of the progress of the purging operation.

Between 5:10 and 5:35 p.m., the construction supervisor requested by radio several increases in well flow rate, which were agreed to by the production supervisor at the upstream choke valve 22. As the purging process progressed, the oxygen concentration measured at valve 23 began to decrease, and the construction supervisor closed this valve. He continued to check the oxygen concentration periodically, opening valve 23 every several minutes. At around 6:00 p.m., the pressure immediately downstream of valve 22, the 24-1 choke, was approximately 800 psig as indicated by the pressure gauge 27.$^{24}$ At about 6:10 p.m., the construction supervisor obtained a final oxygen reading of less than 3% (compared to 20.9% oxygen in ambient air), indicating that the purging process was nearing completion. He then left by truck to check the position of a pipeline valve located approximately 300 feet away. Around this time the production supervisor, who had been present at the 24-1 well earlier, began driving toward the facility to direct the start-up of production from the Bulk Train.

Meanwhile, one Sonat operator and two contractors had remained in the vicinity of the pipeline header. At around 5:40 p.m. two night-shift contract operators arrived at the facility and joined the group near the header. After 6:00 p.m. and just minutes prior to the incident, for reasons which could not be ascertained, four of the operators who were near the header departed and walked into the immediate vicinity of the third-stage separator. Two operators crossed over the containment berm that surrounded the separator and the storage tanks.$^{25}$ The distance between the header and the third-stage separator was approximately 200 feet. One of the four operators (the Sonat employee) was heard to say as he left the header that he was going to “check the tanks,” an activity that may have taken him near the third-stage separator. One contract operator remained behind at the header to listen for the flow of liquid through the pipeline.

At approximately 6:15 p.m., the Bulk Train third-stage separator experienced a catastrophic failure. Gas from the ruptured separator immediately ignited, producing a large fireball centered over the location of the separator. Additional fires were ignited, fueled by natural gas leaking from the damaged storage tanks and piping.

All four operators who were near the separator at the time of the failure were killed at once; in each case the cause of death was severe blast injuries. Figure 6 shows the approximate locations of the four victims, as found after the incident. The operator stationed near the header, about 190 feet from the separator, was thrown about five feet by the blast, and the construction supervisor was severely jolted as he exited his truck over 300 feet away at the pipeline valve. Both survived without serious injury.

The surviving contract operator activated an emergency shutdown device, which automatically shut down ("shut in") the 22-1 well, which at the time was supplying fluid to the Test Train.

〔图〕Not to scale8Ground Level Pipe RackSpill Containment Berm11192020212112StairsElevatedPlatformGround Level Pipe Rack20202

Figure 6. Locations of the Four Victims Found after the Incident

Using his radio, the Sonat construction supervisor immediately instructed the well operator to shut in the 24-1 well and reported the incident to the Sonat production supervisor, who was en route to the facility. The construction supervisor then drove to the gas sales pipeline valve and closed it.

Meanwhile, the Sonat production supervisor placed an emergency (911) telephone call to local authorities. Agencies responding to the call included the Pitkin and Community Volunteer Fire Departments, the Fort Polk Fire Department, the Vernon Parish Sheriff's Department, and the Louisiana State Police.

Although the 24-1 well was quickly shut in following the vessel failure, the two-mile stretch of pipeline contained a significant volume of pressurized natural gas.$^{26}$ This gas continued to leak from the damaged Bulk Train piping, severely complicating efforts to control the fires. Emergency personnel eventually extinguished all fires by 9:47 p.m.

In addition to the fatalities, the incident resulted in about $200,000 worth of damage, including the destruction of the third-stage separator, four private vehicles, and a backhoe and damage to the facility storage tanks. Figures 1, 7, and 8 document the condition of the facility after the incident.

〔图〕插图

Figure 7. Damaged Vehicles and Storage Tanks

〔图〕插图

Figure 8. Damaged Water Storage Tank with Fragment of Third-Stage Separator

3.0 ANALYSIS OF THE INCIDENT

The event was analyzed using standard investigative techniques, including causal tree analysis (see Appendix A). The CSB identified two root causes and one contributing cause for the incident.

3.1 INITIATING EVENT

Soon after the fires stemming from the incident had been brought under control, Louisiana State Police inspected the area around the failed separator. They were accompanied by the Sonat production and construction supervisors. It was then discovered that, in contrast to the planned valve alignment, valves 11 and 13 were actually in the closed position.

With these two valves closed, purge gases could not vent to the atmosphere as planned (see Figure 9). The third-stage separator lacked an inlet valve and became overpressurized by these gases. Pressure at the 24-1 well downstream of the choke valve measured 800 psig prior to the incident.

The third-stage separator was only rated for atmospheric pressure service (14.7 psia). Vessel failure was the result of overpressurization by purge gases and was both sudden and catastrophic. Four personnel were within 40 feet of the third-stage separator at the time it ruptured.$^{27}$

〔图〕ClosedOpenOpenClosedOpenRoof HatchBall ValveBall ValvePneumatic ValveRoof Hatch1414GasGasGasGasOutletOutleCompressorComp

Figure 9. Comparison of Valve Alignments as Planned and as Found after the Incident

The exact pressure at which vessel failure occurred could not be determined. The separator had been tested by the manufacturer at a pressure of 21 psig. While the separator could likely withstand a substantially higher pressure, there were no test data from similar vessels to indicate the expected pressure at failure. CSB commissioned a theoretical study of the separator vessel by the Oak Ridge National Laboratory (ORNL). This study, known as a finite element stress analysis, concluded that “failure occurred at an internal pressure of 135 psig or greater.” Another engineering estimate generated by ORNL placed the failure pressure at approximately 208 psig, while an estimate obtained by Sonat after the incident put the failure pressure at

375 to 400 psig. However, all of these estimates are of limited value since they are based only on the vessel design drawings and did not take into account actual variations in materials, dimensions, quality of welds, etc. The flow rate and well fluid composition of the 24-1 well during the hour or so before the incident were also difficult to estimate with certainty.

Similarly, the timing of the closure of valves 11 and 13, which triggered the vessel failure, could not be absolutely determined.$^{28}$ These two valves were opened in the morning but then closed early in the afternoon prior to the purging of the Bulk Train separators. The valves were not continuously monitored during most of the day. It is possible that the valves were not reopened as intended prior to the final purging process, and remained closed until vessel failure finally occurred. Alternatively, the valves may have been correctly opened during the final valve alignment, only to be manually closed later. However, no surviving personnel reported seeing the valves closed during any part of the final purging process, and there was no operational reason to close the valves once the purging was under way. The surviving supervisors did not report giving any such instruction, nor were any Bulk Train valve realignments whatsoever planned during the final purging process. Valves 11 and 13 were not intended to be closed once the Bulk Train entered routine production.$^{29}$

In depositions taken many months after the incident, two witnesses said they had seen fumes venting from the facility storage tanks during the final purging process. This observation could indicate that there was an open path from the 24-1 well through the bypass line during at least

part of the purging process (i.e., valves 11 and 13 were open). CSB did not uncover corroborating evidence for this contention, and it could not be verified whether the fumes originated from the Bulk or the Test Train.

Uncertainty concerning the timing of the valve closure that triggered the incident did not impact CSB's determination of the root and contributing causes of the incident.

3.2 EQUIPMENT DESIGN, INSTALLATION, AND OPERATION

The facility was designed jointly by the engineering and operations departments of Sonat. The construction of the facility was directed by the operations department, with on-site supervision from Sonat production and construction supervisors. The engineering department provided technical support during the construction process, through both site visits and telephone contacts.

Deficiencies in the design and installation of the third-stage separator were important to the causality of the incident. Equipment that may potentially be exposed to pressure hazards, either through human error or mechanical failure, should either (a) be designed to withstand those hazards, or (b) be equipped with appropriate pressure-relief systems. An appropriately sized and designed pressure-relief system would likely have prevented the incident.$^{30}$

The American Petroleum Institute (API) issues recommended practice guidelines covering various aspects of oil production and refining. The third-stage separator falls under ANSI/API Specification 12J-1992, “Specification for Oil and Gas Separators.” This specification “covers the minimum requirements for the design, fabrication, and shop testing of oilfield type oil and

gas separators and/or oil-gas-water separators used in the production of oil and/or gas . . . . " The specification states that "all separators, regardless of size or pressure, shall be provided with pressure protective devices and set in accordance with ASME [American Society of Mechanical Engineers] Code requirements . . . over-pressure protection shall be provided prior to placing the separator in service."

More general guidance is provided by API Recommended Practice 521, “Guide for Pressure-Relieving and Depressuring Systems.” API 521 provides a list of overpressure scenarios that can be compiled and reviewed for each piece of equipment. The first of 16 overpressure scenarios listed in this guidance document is entitled “Closed Outlets on Vessels.” The document states: “The inadvertent closure of a block valve on the outlet of a pressure vessel while the plant is on stream may expose the vessel to a pressure that exceeds the maximum allowable working pressure . . . Every control valve should be considered as being subject to inadvertent operation.”

Sonat had its own Pressure Relief Valve Standard “to establish uniform guidelines for the specification, installation, maintenance, and testing of pressure relief valves and associated piping.” The standard stated that “relief valves shall be used . . . as determined by good engineering practice, considering both the probability of failure and the results of such failure” and that “API 520 may be used as a guide for proper installation of relief valves and associated piping.”$^{31}$

Sonat has stated that the failed vessel was a “vapor recovery tower” (VRT) and as such not subject to API standards for separators. Sonat classified the VRT as a storage tank “located within the berm like the other storage tanks.”$^{32}$ CSB has reviewed this issue and concluded that the vessel was in fact a separator because:

● the vessel had a single inlet line for a natural gas and oil mixture but two separate outlet lines for natural gas and oil and was therefore effecting a separation of two phases;

· the vessel was not designed to permanently store oil until shipment off site; rather, the oil was temporarily held in the vessel and flowed continuously to the actual storage tanks, of which there were 12 at the facility, each much larger in volume than the separator itself;

· the position of the vessel within the Bulk Train (between the second-stage separator and the storage tanks) was consistent with its role as a low-pressure, two-phase separator;

· ANSI/API Specification 12J-1992 defines a separator as “a vessel used in the field to remove wellstream liquid(s) from gas components. A separator may be either two-phase or three-phase.” The specification states that a separator is “usually located but not limited to some point on the producing flowline between the wellhead and the pipeline.”

Prior to operating the Bulk Train, the third-stage separator should thus have been equipped with a pressure-relief system, as recommended by API consensus guidance.$^{33}$

Another design deficiency was the absence of an inlet block valve upstream from the third-stage separator. Such a valve could have been used to isolate the separator from the high-pressure purge gases that caused the vessel failure. An inlet block valve would be an adjunct, not a substitute, for a pressure-relief system on the separator. Similarly, the inclusion of a block valve (valve 15) on the oil outlet line of the third-stage separator allowed the separator to be isolated from the storage tanks, whose roof hatches offered a potential means of venting. At the time of the incident, valve 15 was closed. The third-stage separator also had an outlet line to a gas compressor; excess flow into the compressor would be vented via the gas flare. However, the gas

outlet line also was equipped with a block valve (valve 14). At the time of the incident, the compressor was out of service and valve 14 was closed.$^{34}$

3.3 ENGINEERING DESIGN REVIEW

Sonat utilized the services of its own engineers, as well as consultants, in the design and construction of the facility. Sonat has stated that its engineers “both went to the Temple 22-1 site. Unfortunately, these men failed to catch the valving errors on the VRTs at the Pitkin facility.”$^{35}$ Prior to the incident, Sonat did not have a documented piping and instrumentation diagram (P&ID) for the facility; only after the incident were process diagrams and P&IDs generated and process hazard analyses conducted.

The various activities conducted by Sonat prior to facility start-up did not constitute an effective engineering design review process. An effective process should have included one or more documented hazard analyses during the design of the facility.$^{36}$ Identification of hazards should have triggered either design modifications or written responses indicating why the noted hazards did not need to be addressed. The process would have required input from various disciplines, including design engineering, process engineering, and facility operations. The review process would have provided an early venue for identifying and correcting design hazards, including lack of adequate pressure relief, improper valving, and lack of adherence to consensus guidelines for separator design and installation. Hazard analyses should have included an examination of the consequences of plausible deviations in operating conditions,

including the misalignment of valves, during each stage of operations. Such a review could not have been conducted properly in this case due to the lack of accurate engineering drawings.

3.4 OPERATING PROCEDURES

Sonat had written safety procedures covering generic subjects such as confined space entry, excavating and trenching, and lock-out/tag-out of equipment. However, there were no written operating procedures for oil and gas production facilities. Sonat has stated that it preferred to use oral instructions to train and direct facility operations.$^{37}$ Thus, operators were not provided with any written procedures covering specific production activities such as well testing, start-up and purging of components, and separator operation. Procedures for facility operations were passed on by experienced operators, who provided oral guidance to newer personnel.

Written operating procedures promote safe and efficient operations and can reduce the occurrence of human errors that may lead to accidents. According to the AIChE Center for Chemical Process Safety, written operating procedures “provide consistent information to all users . . . remove guesswork . . . [and] provide the tools for an effective training program.”$^{38}$ There were dozens of manually operated valves at the facility; proper alignment of these valves was clearly essential for the facility to be started up in a safe manner. It is particularly important to have written procedures for nonroutine operations, such as facility start-up or purging. Written procedures, including signed checklists, diagrams, and feedback between multiple operators, reduce the likelihood of an error, omission, or oversight that can have catastrophic consequences.

3.5 EMPLOYEE TRAINING

Sonat's personnel training program had three components: on-the-job instruction, monthly internal safety meetings, and external coursework. On-the-job training was the primary means for employees to learn the knowledge and skills to operate Sonat production facilities; senior Sonat personnel provided this training to new employees.

Sonat employees also attended monthly safety meetings, which included safety training. Attendance at each meeting was recorded, and each meeting generated minutes. Any recent incidents or near-misses were reviewed, and attendees were provided with introductory and refresher courses on topics such as hazard communication, pressure-relief valves, and equipment lock-out/tag-out. Sonat maintained a Safety and Environmental Manual and a Safety Handbook, in which company procedures in these areas were documented. Job Safety Analyses were also reviewed at the meetings.$^{39}$ Meetings were generally two hours in length, including classes of up to one hour duration.

Finally, at least some employees completed external training courses on topics such as pressure vessel operation, Hazardous Waste Operations and Emergency Response (HAZWOPER), and emergency first-aid procedures.

Sonat did not have an evaluation program for on-the-job training, to ensure that the oral information provided to new workers was thorough and consistent. Without an evaluation program, there was a possibility that erroneous, unsafe, or incomplete operating procedures would be propagated among workers, or that workers would not understand the information that was transmitted to them.

Formal, process-specific training was not a component of Sonat's safety program. Sonat workers routinely worked at several facilities, each of which would likely have variations in

equipment design, valve configurations, or process piping. Lack of site-specific knowledge among facility personnel could pose a hazard. Sonat did not provide personnel with specific training for each site and each process within that site.

3.6 CONTRACTOR TRAINING

Contractors were used widely by Sonat for facility construction, start-up, and maintenance, and other functions. Contractors were also used as process operators. Contract operators worked under the supervision of a Sonat employee (a production supervisor, construction supervisor, or operator), and Sonat procedures required the contract operators to defer to Sonat personnel on operational matters such as valve positioning.

Sonat had a contractor safety program consisting of a performance standard, a contractual agreement, and an assurance system. The elements of the program were documented in the Sonat Safety and Environmental Manual. The goal of the program was that “contractors adhere to the same safety and environmental standards as Sonat Exploration Company . . .” Sonat’s “Contractor Safety and Environmental Standard” mandated a “Jobsite Performance Tracking System” for contract firms to ensure compliance with Sonat safety standards. Annual evaluations of performance were required. Contract firms were responsible for instructing their employees on Sonat standards and practices and for ensuring that the contract workers operated safely.

CSB concluded that contract workers at the facility could not have been properly trained because Sonat lacked adequate written, process-specific operating procedures and process hazard information. However, in this case the lack of adequate training was not necessarily causal to the incident.

3.7 REGULATORY ISSUES

The incident would likely have been prevented if process safety management principles or good engineering practice had been followed more effectively at the facility. Oil and gas production facilities handle flammable and toxic materials in significant quantities. Facilities that handle similar hazardous materials, such as oil refineries, are regulated under the OSHA Process Safety Management (PSM) standard (29 CFR 1910.119), promulgated in 1992. Two elements of the PSM standard, process hazard analyses and written operating procedures, are particularly relevant to the Sonat incident.

In addition to the PSM standard, there are a number of other sources of information on good process-safety practices. Sources include the publications of the Center for Chemical Process $Safety^{40}$ and the recommended practice documents of the American Petroleum Institute. For example, API Recommended Practice 750 covers important aspects of process safety, including process hazard analyses, process safety information (including process diagrams and P&IDs), written operating procedures, operator training, and compliance audits.$^{41}$

Oil and gas production facilities have generally been viewed as exempt from the OSHA PSM standard. However, on August 26, 1998, OSHA headquarters issued a letter to its Region 6 office stating that the PSM standard did apply to Sonat's Pitkin facility; five days later OSHA cited Sonat for violations of PSM requirements in connection with the incident. On March 8, 1999, OSHA dropped the PSM citations and issued a citation under the “general duty” requirements of the Occupation Safety and Health Act of 1970.

Subsequently on December 20, 1999, OSHA issued a memorandum rescinding earlier OSHA interpretations of the PSM standard and stating that the standard did apply to oil and gas production facilities. The American Petroleum Institute (API) objected to the OSHA

memorandum, stating that the new interpretation amounted to a substantive change in the standard and in the opinion of API required a rulemaking process and an analysis of compliance cost for the affected sector.$^{42}$

In its reply to API, dated March 7, 2000, OSHA stated it would withdraw the December 20 memorandum but reiterated that oil and gas production facilities were intended to be covered by the PSM standard. However, OSHA conceded that the original analysis of economic and technological feasibility for the PSM standard had not included oil and gas production facilities (SIC Code 1311), and OSHA would therefore perform a feasibility analysis before enforcing the PSM standard at these facilities. On April 11, 2000, OSHA withdrew the December 20th memorandum, asserting however that the statements in the memorandum remained “legally correct.”

The CSB's investigation has been limited in scope to the causes of the Sonat incident. The CSB has not examined the merits of regulating oil and gas production facilities under the PSM standard. The CSB did not investigate, for example, the frequency of serious process incidents in this sector or their causes. Therefore, the CSB is not issuing a recommendation to OSHA regarding the coverage of oil and gas production facilities by the PSM standard.

4.0 ROOT AND CONTRIBUTING CAUSES

4.1 ROOT CAUSES

1. Sonat management did not use a formal engineering design review process or require effective hazard analyses in the course of designing and building the facility.

In the incident, a third-stage separator was exposed to a pressure significantly in excess of its maximum allowable working pressure, resulting in catastrophic vessel failure. A formal engineering design review process should have been in place during the design of the facility.$^{43}$ Sonat constructed the facility without producing engineering drawings of the process equipment. Neither design review nor hazard analysis can be effectively conducted in the absence of accurate engineering drawings.

A formal design review and hazard analysis process would have provided a better opportunity to analyze the consequences of foreseeable deviations from normal operating procedures, such as valve misalignments. This process would likely have identified the danger of catastrophic overpressurization of the third-stage separator and indicated the need for a pressure-relief system.

1. Sonat engineering specifications did not ensure that equipment that could potentially be exposed to high-pressure hazards was adequately protected by pressure-relief devices.

The vessel that failed met the definition of a two-phase gas-oil separator and should have been designed to meet relevant industry consensus standards for pressure relief. For

example, ANSI/API Specification 12J-1992, “Specification for Oil and Gas Separators,” requires that separators be equipped with pressure-relief devices.

4.2 CONTRIBUTING CAUSE

1. Sonat management did not provide workers with written operating procedures for the start-up and operation of the facility.

Written operating procedures governing each phase of facility operations, including purging operations, would have reduced the likelihood of a manual valve misalignment of the kind that triggered the incident. Procedures should have included written checklists and diagrams to verify proper valve positions for purging.

5.0 RECOMMENDATIONS

El Paso Production Company(formerly Sonat Exploration Company)44

1. Institute a formal engineering design review process for all oil and gas production facilities, following good engineering practices and including analyses of process hazards. (1998-002-I-LA-R1)

1. Implement a program to ensure that all oil and gas production equipment that is potentially subject to overpressurization is equipped with adequate pressure-relief systems, and audit compliance with the program. (1998-002-I-LA-R2)

1. Develop written operating procedures for oil and gas production facilities and implement programs to ensure that all workers, including contract employees, are trained in the use of the procedures. Ensure the procedures address, at a minimum, purging and start-up operations and provide information on process-related hazards. (1998-002-I-LA-R3)

American Petroleum Institute

1. Develop and issue recommended practice guidelines governing the safe start-up and operation of oil and gas production facilities. Ensure that the guidelines address, at a minimum, the following: project design review processes, including hazard analyses; written operating procedures; employee and contractor training; and pressure-relief requirements for all equipment exposed to pressure hazards. (1998-002-I-LA-R4)

1. Communicate the findings of this report to your membership. (1998-02-I-LA-R5)

By the

U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

Gerald V. Poje, Ph.D.

Member

Andrea Kidd Taylor, Dr. P.H.

Member

Isadore Rosenthal, Ph.D.

Member

September 21, 2000

6.0 REFERENCES

ANSI/API Specification 12J-1992, “Specification for Oil and Gas Separators,” 7th ed. (Washington, DC: American Petroleum Institute, 1989, reaffirmed 1999).

API Recommended Practice 520/1, “Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries – I – Sizing and Selection,” 6th ed. (Washington, DC: American Petroleum Institute, 1993).

API Recommended Practice 520/2, “Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries – II – Installation,” 4th ed. (Washington, DC: American Petroleum Institute, 1994).

API Recommended Practice 521, "Guide for Pressure-Relieving and Depressuring Systems," 4th ed. (Washington, DC: American Petroleum Institute, 1997).

API Recommended Practice 750, "Management of Process Hazards" (Washington, DC: American Petroleum Institute, 1990, reaffirmed 1995).

API Standard 2000, "Venting Atmospheric and Low-Pressure Storage Tanks," 4th ed. (Washington, DC: American Petroleum Institute, 1992).

API Standard 2000, "Venting Atmospheric and Low-Pressure Storage Tanks," 5th ed. (Washington, DC: American Petroleum Institute, 1998).

American Petroleum Institute, Introduction to Oil and Gas Production, 5th ed. (Washington, DC: American Petroleum Institute, 1996).

Center for Chemical Process Safety, Guidelines for Technical Management of Chemical Process Safety (New York: American Institute of Chemical Engineers, 1989).

Center for Chemical Process Safety, Guidelines for Hazard Evaluation Procedures, 2nd ed. (New York: American Institute of Chemical Engineers, 1992).

Center for Chemical Process Safety, Guidelines for Writing Effective Operating and Maintenance Procedures (New York: American Institute of Chemical Engineers, 1996).

Center for Chemical Process Safety, Guidelines for Process Safety Documentation (New York: American Institute of Chemical Engineers, 1995).

U.S. Environmental Protection Agency, "Profile of the Oil and Gas Extraction Industry" (Washington, DC: EPA Office of Enforcement and Compliance, 1999).

8

〔图〕插图