Inside a chemical plant, a sulphur dichloride (SCl2) leak on a pipeline supplying the boiler tube of a distillation column hydrolysed, thereby generating a strong emission of hydrogen chloride (HCl). This column was located in a building with a cladding that formed a sort of confinement. The internal emergency plan was triggered. Water curtains were activated and the external fire station was notified. 50 ppm of HCl were recorded inside the building (irreversible effect for 1 hr of exposure = 60 ppm), though readings remained below the detection threshold outside. Three in-house responders were assigned to hospital observation. Water from the activated curtain (100 m³) was collected in the fire water basin. Operating losses were valued at €270,000 (the downstream unit stayed idle for 18 days).
A pressure sensor was undergoing maintenance; it had been diagnosed as defective after indicating a reading of 108 mbar of pressure at the boiler tube output (upper alarm threshold = 100 mbar), thus triggering closure of the valves controlling SCl2 supply and regulating the vapour heating the boiler tube. Before replacing the sensor, the boiler tube contained 150 kg of SCl2 and could not be drained due to the presence of glass stemming from degradation of the distillation column. This clogging situation had been known for 3 weeks, yet no remedial measures had been taken. Moreover, the pressure sensor shutoff valve, whose bolts were permanently seized and fastened, could not be closed; the technician was forced to disassemble the entire set-up, allowing air to be exposed to the DN25 tap. Since the sensor was not designed with positive safety, its electrical disconnection caused the vapour regulation valve to open, thus heating the boiler tube, whose temperature rose from 24° to 120°C in 30 min, and causing the emission of SCl2.
Several measures were adopted as part of the feedback provided: monitoring and intervention procedures in a degraded operating mode, modification of the sectional valve / pressure sensor assembly, introduction of a positive safety loop independent of the regulation, thereby prohibiting any automatic restart once the high pressure threshold had been reached.
This accident demonstrates that a process regulation system can in no way be equated with a safety device. More specifically, the programmable production automata satisfy a rationale and criteria that are not all known by response teams and that do not necessarily incorporate degraded modes and lockouts situations.
Download the detailed report in .pdf format (631 Kb)
