Around 10:30 pm in the isocyanate unit at a chemical plant, a sensor detected a rapid conductivity rise in a heat exchanger, in which phosgene (COCl2) pressurised to tens of bar was being reheated with water vapour at 28 bar before reacting with an amine. Once the sensor alarm threshold was reached (50 µS), the safety controller isolated the drainage circuit for exchanger condensates by closing a motorised valve. A second conductivity meter, which had not been functioning properly and was scheduled for replacement by maintenance staff, displayed a value of 0 µS. Uninformed of this malfunction, technicians decided to shut off the amine intake at 10:40 pm and extract a sample to confirm their suspicions; they notified the on-call operator, who carried out an on-site assessment of the situation at 11 pm. The operator then proceeded to bypass the conductivity meter in restarting production without waiting for laboratory results to be released.

Around 11:30 that evening, external sensors detected a COCl2 concentration build-up. By 11:52, a pressure sensor on the vapour circuit was reading in the tens of bar, triggering shutdown of the unit by closing shutoff valves on both the enclosure confining the unit and the condensate drainage circuit. The quick sequence of these closure steps caused a water hammer that broke a drainage valve at the base of the exchanger; the remaining COCl2 spilled into the enclosure, lowering vacuum pressure and closing the exchanger bypass valves. COCl2 sensors inside the confinement detected a rise in COCl2 content, reaching saturation at 1:10 am (1,000 ppm). A tube opened inside the exchanger and a large quantity of COCl2 spread into the vapour circuit with pressure increasing rapidly. Before the circuit could be closed as a safety precaution, a small amount of gas escaped via the soda tank drainage circuit, whose buffer (lid) had not been sealed following an improper reassembly step. The COCl2 discharged into the atmosphere in the time it took to isolate the enclosure wound up saturating the outside detectors (2 ppm), with measured concentrations gradually declining until 12:25 am. Between 1 and 3 am, 4 technicians of the unit working outside experienced a malaise and were sent to the site’s infirmary.

The confined gases were neutralised on a scrubber column until the enclosure was free of all COCl2 during early afternoon. The environment was not affected by this incident; the operator issued a press release.

An expert appraisal of the leaky tube revealed the presence of acid corrosion accelerated by Cl- hydrolysis during shutdown periods. A break in the seal on an exchanger tube had caused a small COCl2 leak within the vapour circuit along with a rise in condensate conductivity due to COCl2 hydrolysis into HCl. Unit restart served to accelerate corrosion via HCl from the leaky tube until pressure burst it open: 700 kg of COCl2 spilled into the enclosure and 14 kg into the atmosphere while isolating the enclosure, as well as from the soda tank. Moreover, the sampling system on the 2nd conductivity meter had shown recurrent signs of malfunction subsequent to flow rate interruptions (this problem was known to the maintenance department yet not shared with operations personnel).

Only successful implementation of the 2nd safety barrier (pressure sensor and its safety chain, in addition to integrated enclosure confinement) avoided the discharge of a large quantity of toxic gas outside the site boundary (with dwellings as close as 260 m).

The 2nd conductivity meter was repaired and a flow alarm installed on the sampler; also, the condensate drainage circuit was inspected and all equipment damaged by the acidic atmosphere (caused by COCl2 hydrolysis) in the enclosure was replaced. The seal on the soda tank lid was checked and the tank pumping procedure modified to avoid the opening of the lid. Other procedures were formalised or consolidated, namely:

• instructions in case of activation of the unit’s technical safety barriers: conductivity meter, pressure sensor, etc.;
• Bypass of the unit’s technical barriers: awareness-building for both technical staff and managers, definition of each team member’s roles and responsibilities, clarification and restriction of authorised bypass conditions;
• Conditions applicable to unit technician certification regarding both process safety and equipment inspection;
• Frequency of conductivity meter calibration (shortened from 6 to 3 months);
• Formalisation of information/feedback loops among operations teams and the online analyser maintenance department.

The Classified Facilities Inspectorate asked the site operator to review the criteria adopted for activating the internal emergency plan and better inform staff of the role played by technical safety barriers, as even backup barriers did not justify bypassing a barrier without first analysing the compensatory measures that would eventually need to be implemented.

Download the detailed report in .pdf format (861 Kb)