In a part of a aniline production unit in a chemistry plant, during a planned shutdown of a nitrobenzene production unit, a level indicator had to be removed from a pipeline for inspection. The pipe connects two process vessels that are under negative pressure in normal process conditions. The level indicator was installed in the gas phase of the pipe.

In the initial planning of the shutdown, the installation was to be emptied. The permit-to-work for the removal of the level indicator was made up based on the assumption that the gas line and the connected vessels would be empty but not flushed and cleaned.

It was the only maintenance work to be done on this gas line. Due to time pressure, the need to empty the gas line was reassessed. It was decided that the removal of the sensor could be done without emptying the line and connected vessels based on the facts that the sensor was mounted in the gas phase and the connected vessels under vacuum. The permit-to-work was not adapted to this new condition. The level sensor was labelled the day preceding the work. However, the operator did not tag the level sensor but a temperature measuring device in a liquid line just beneath the gas line, also connecting the two process vessels. The contractor removed all bolts of the flange without any sign of leakage due to the under pressure. When the flange connection was broken, air was sucked in, the content of the two vessels and the pipe line released and could not be stopped. Removal of a level indicator on a gas pipeline connecting two process vessels (distillation column and vaporiser) under vacuum. Due to wrong labelling during work preparation, the contractor removed a temperature indicator on the underlying liquid line connecting the two vessels. When opening the flange, there was a sudden major release. The spill was contained by the company’s emergency intervention team. The spill was removed and the area cleaned up by a specialised company.

In total about 12 tonnes of a mixture of nitrobenzene and dinitrobenzene was released to the work floor.

Line breaking on a wrong and not emptied pipeline connected to two process vessels, due to an error in labelling of the sensor that had to be removed for inspection. The investigation showed that although required by the company’s permit-to-work system that there was no control of the installation and safety measures before permit authorisation. Also, since the installation was to be empty but not flushed, the first line breaking was supposed to be supervised by an operator, but wasn’t. These are two missed opportunities to detect the wrong labelling of the sensor. The underlying cause was a to high workload on permits-to-work during shutdown. Another underlying cause was that the prepared work permit was not changed after the descision not to empty the installation.

Measures to prevent :

• training of the permit-to-work procedures ;
• adapting the permit-to-work system to the situation of a shutdown, to ensure the applicability of lock out/tag out requirements and the necessary controls before authorising the work and to manage modifications to the initially planned shutdown condition ;
• adapting the procedure on minimum staffing, to ensure sufficient production staff during shutdown.