Lessons Learned from Recent Accidents in the Chemical Industry in Japan

Japanese chemical companies should extensively study the accidental fires and explosions that occurred in the industrial complexes of Japan in 2011 and 2012. We picked two major accidents and distributed questionnaires to large chemical companies in the Keihin Complex, Japan. Here, we report the results of our investigation of improvements in process safety.


Introduction
Chemical companies in Japan are currently facing major issues, as described below.
1) The lessons to be learned from the Tohoku Earthquake disaster, which occurred in March, 2011, are still being examined [1]- [3].2) Japanese chemical companies should study the accidental fires and explosions that occurred in industrial complexes in Japan in 2011 and 2012 [4] [5].
Here, we describe the safety improvements that should be implemented, based on the accidental fires and explosions in the two cases mentioned above.
The serious accidents that occurred in industrial complexes in Japan during 2011 and 2012 shocked the chemical industry.And also the Japanese chemical industry had a big subject that they should improve their level.
Accidents occurred at the Tosoh Corporation [4], Mitsui Chemicals [5], Nippon Shokubai [6], Cosmo Oil Chiba [7], Mitsubishi Chemical Kajima [8], and Showa Denko Oita.We should reflect on and reexamine these accidents, and improve our technological expertise to prevent such accidents.This should also apply to the development of new factories abroad from now on, and the results of investigations of these accidents and new security measures for disaster prevention should be applied globally.To investigate these accidents, a question-naire was sent to large chemical corporations with high-pressure gas installations, located in the Kawasaki area in the Keihin complex, Japan.The questionnaire dealt with the accidents at Tosoh in the Nanyo district and Mitsui Chemicals in the Iwakuni-Ootake factory area.The theme we focused on in the investigation was "the emergency shutdown of production facilities, such as industrial complexes", because both these accidents continued for several hours, ~10 h, after from the emergency shutdown of the production facilities.We also tried to clarify what has already been done and what has not yet been done by Japanese chemical companies.

Tosoh Accident
This accident occurred on November 13, 2011.The process from which the accident arose is VCM production facilities (Figure 1).And the process which explosion and fire generated is HCl tower in it (Figure 2).The timeline is shown in Table 1.The displayed times show the progress from the time at which the emergency block valve was closed [4] (refer the Table 1).

Presumed Cause of the Explosion
HCl reacted with VCM to produce 1,1-EDC, catalyzed by FeCl 3 , which was produced by HCl and iron rust inside the back-flow tank of the HCl tower.Was the partial stop appropriate?Was full examination of the partial stop made?min after Stopped lines A and B of the EDC decomposition process to regulate the production of EDC, which was only produced by line B of the oxidation process.So, the operating line for the EDC decomposition process changed to line A only.As a result, the operating load changed from 100% to 45%.
Was manual operation of line B oxidation process + line C EDC decomposition performed?Was the operator trained?min after Because the stoppage was partial, the temperature balance of the HCl tower changed and the middle tier temperature fell from 80˚C to 57˚C.In order to recover the temperature condition, the amount of heating steam was increased and the reflux volume was decreased.At that time, the operators did not realize that they should control the top and bottom temperatures of the HCl tower.
The operating standard of the chloride tower was insufficient.The operator training was inadequate.

h min after
Although the temperature at the top of the HCl tower is normally −24˚C, it rose to 38˚C.Then VCM was mixed in the upper part of the HCl tower and the back-flow tank of the HCl tower added HCl.The operators decided that the HCl tower condition had become stable because the temperature of the middle tower stage recovered to 80˚C.
The alarm for detecting abnormal temperature was not set at the top tier of the HCl tower.It was not the point being monitored.The standard value of the temperature of each part of the HCl tower was not decided.

h min after
After VCM mixed in the back-flow tank of HCl, VCM mixed with the oxidation line B. The entire production facility was then stopped.The general manager, production manager, and section manager realized that the temperature at the top of the HCl tower stage was not normal and they assumed that VCM had mixed in the back-flow tank of the HCl tower.However, they did not know that 1,1-EDC was being generated, so they did perform any special operation.
There was no knowledge of the abnormal reaction and side reaction that are assumed to have occurred.Important information was not available.Important information was not included in the training manual.

h min after
The back-flow pump of the HCl tower was stopped.The level of the HCl back-flow tank was nearly 100%, and the tank was sealed.
There was no operating standard that ensured safety.

h 1 min after
The HCl tower refrigerator was stopped.The back-flow tank of the HCl tower was disconnected from the HCl tower, so the back-flow tank of the HCl tower was sealed.
There was no operating standard that ensured safety.

h 0 min after
The transfer of liquid from the back-flow tank of the HCl tower to the liquid HCl temporary receiving tank started.Although the pressure of liquid HCl in the temporary receiving tank was increasing, the operators were unaware of this phenomenon.
There was no operating standard that ensured that the safety pressure of the HCl receiving tank was monitored.h min after Operators realized that the pressure of the liquid HCl temporary receiving tank was rising, and they started pressure relief action.
The drop-in-pressure measure was insufficient.

h min after
The allophone sounded and white smoke was discharged from the top of the liquid HCl temporary tank during the pressure relief action.

h 44 min
The pressure of the back-flow tank of the HCl tower rose to 2.0 MPaG (the designed pressure of this tank is 1.9 MPaG).
h 45 min The back-flow tank of the HCl tower ruptured, exploded, and burst into flames.HCl + VCM → 1,1-EDC + 62 kJ/mol (exothermic reaction) The temperature of the back-flow tank of the HCl tower increased, because this reaction is exothermic, and the reaction rate increased exponentially.After 6 h under these conditions, this reaction ruptured and destroyed the back-flow tank of the HCl tower.

Lessons to Be Learned from the Tosoh Accident
As mentioned above, we investigated the issues involved in this accident by sending questionnaires to large chemical corporations with high-pressure gas installations in the Kawasaki Keihin complex in Japan.
1) The main items in the questionnaire regarding the Tosoh accident were as follows.a) Monitoring during normal operation i) Does it clear the normal range of control for important equipment?ii) Are the important alarms located separately from the DCS alarm?iii) Can the slopes of important temperatures or pressures be easily identified?b) Prior examination, and monitoring of emergency i) Do you consider abnormal reactions or sub-reactions when operation is irregular?ii) Do you consider the possibility of iron mixing, which could cause an abnormal reaction?iii) Do you monitor the plant conditions after setting the appropriate control range for an abnormal reaction?c) Preparation for emergency shutdown i) Was the emergency shutdown manual prepared based on sufficient information?ii) Is the person who is to initiate the emergency shutdown and evacuation identified?iii) Is regular training regarding emergency shutdown provided?d) Action after emergency shutdown i) Are the plant safety conditions after an emergency shutdown clear?
ii) Are the procedures for reversing the emergency shutdown and returning to normal operation clear?Also, who is the person who approves this action?
2) The results from the main questionnaire are shown below.a) Monitoring during normal operation i) Does it cover the normal range of control for important equipment?Yes: 11 facilities; No: 1 facility Figure 3 shows a typical monitoring during normal operation in Japan.◆ Examples of reply With regard to the operating conditions, the range is defined as a job standard or a process control standard value.Because abnormal values are defined by the DCS system, this can be detected by the alarm.ii) Are the important alarms located separately from the DCS alarm?Yes: 10 facilities; No: 2 facilities Figure 4 shows that the important alarm located separately from DCS in Japan.iii) Can the slopes of important temperature or pressure be easily identified?Yes: 12 facilities; No: 0 facilities Figure 5 shows typical trend records of conditions in Japan.We make it a rule in our standard operation to explore the influence of corrosion or damage to the installation and lower equipment.Previous experience and the process licenser's opinion suggest that there is almost no possibility of an abnormal reaction being caused by mixing of rust, so this is not examined.

Monitoring during normal operation
Company B In response to this accident, we examined the possibility that corrosion products (iron rust, etc.) could trigger an abnormal reaction.
iii) Are the control points for normal and abnormal reactions identified and monitored continuously?Training on troubleshooting is carried out regularly.However, because of generational changes, traditional technical information is currently required.The plant has now been operating continuously for four years, so staff have less experience of plant shutdown and startup.Moreover, operation is now stable, and because there is little experience of scram operation of equipment, the necessity for training is increasing.Troubleshooting training is therefore periodically conducted using training facilities etc. d) Action after emergency shutdown i) Is the safe state after an emergency shutdown clear?Yes: 8 facilities; No: 4 facilities Figure 9 shows the example of the observation of plant conditions after emergency shutdown.
ii) Is the procedure for canceling an emergency shutdown clear?Is the decision maker clearly identified?Have a procedure: 4 facilities; Only decision maker specified: 3 facilities; No procedure and no decision maker specified: 5 facilities.Figure 10 shows the example of the procedure of canceling for emergency shutdown condition.◆ Examples of answer After discussion with the division manager, the plant manager and factory area manager decide conditions for canceling an emergency shutdown.

Mitsui Chemical Accident
The accident at the Mitsui Chemical Otake factory was examined as the second accident case study.The process from which the accident arose was RESORSINOL production facilities (Figure 11).And the equipment with which explosion and a fire broke out was an oxidational reactor of RS (Figure 12).The timeline in Table 2 shows how the accident progressed.The displayed times show the progress at different times from the start time, at which the order was given to stop operation of the plant [5].

Presumed Cause of the Explosion (Direct Cause)
Although the emergency shutdown was initiated at the oxidation reactor, which generates an organic peroxide, the subsequent interlock released this oxidation reactor.Then, the nitrogen being supplied to the oxidation reactor stopped, and churning of the liquid phase stopped.
As a result, decomposition of the organic peroxide occurred in the liquid phase upper part, and this heat could not be removed, so the temperature of the upper part of the reactor rose.After 36 h of this batch reaction, which needs 40 h, operation of the steam-using plant was stopped because of problems with the steam.

min after
The Emergency Stop lever was operated; interlock change was effective, and the plant was shut down.The air supply to the oxidation reactor was stopped by the interlock operation, and nitrogen supply began.Cooling water changed from circulating water to emergency-cooling water.Nitrogen supply to the oxidation reactor continued and the temperature fell slowly.

h 20 min after
Interlock was canceled to change cooling water from emergency-cooling water to circulating water, because it was judged that the temperature of the oxidation reactor was not falling.By canceling the interlock, the nitrogen supply was also suspended and churning of the oxidation reactor also stopped.
The emergency shutdown manual was inadequate.Lack of understanding of the purpose of the interlock and of the theory of cooling and agitation.Lack of understanding of the importance of interlock.The interlock release system was inadequate.Training material was inadequate.

h 24 min after
The temperature of the lower part of the liquid phase decreased, but at the upper part, the temperature began to increase gradually because the heat of decomposition of the organic peroxide could not be removed, because of lack of a cooling coil and agitation, as a result of stopping the nitrogen flow.
Monitoring of the upper part of the liquid phase was inadequate.The design of the cooling capacity and churning capability in the event of abnormalities was deficient.

h 13 min after
Although the HI alarm in the upper part of the liquid phase sounded.Operators were convinced that the problem was the temperature of the gaseous part.The decomposition reaction proceeded and the temperature of the upper part of the liquid phase increased.
The operator was unaware that the liquid level was higher than its design base.The change control system was inadequate.

h 51 min after
The decomposition reaction accelerated and the temperature and pressure increased abruptly.Although the pressure-regulating valve was fully opened manually, the pressure relief speed was insufficient.So, the pressure further increased abruptly.

h 55 min after
The oxidation reactor ruptured, exploded and caught fire.The decomposition of the organic peroxide accelerated the heat increase.As a result, the pressure of the oxidation reactor increased, resulting in rupture, explosion, a fire explosion, and a fire.

Lessons to Be Learned from Mitsui Chemical Accident
1) The main questionnaire items concerning the Mitsui Chemical Otake factory accident are follows.a) Cooling capacity i) Is the cooling capacity sufficient to maintain safety and a stable reaction when cooling is required?ii) Do the design and structure of the cooling system enable it to cool all the parts of the reaction vessel and a tank?b) Two or more important hardware-monitoring installations i) Are the operating conditions of important apparatus in the process always monitored and controlled at two or more places?c) Interlock release i) Even if the interlock is canceled, can important utilities, such as cooling water and nitrogen, be operated independently?
ii) Is the importance of interlock release fully understood by staff?
2) The questionnaire results are shown below.a) Cooling capacity i) Is the cooling capacity sufficient to maintain safety and a stable reaction when cooling is required?Have sufficient capacity: 8 facilities Do not need cooling or N 2 purge: 3 facilities Insufficient: 1 facility ◆ Examples of answer Required amount of water, resisting pressure performance, etc. are examined and designed.
In a scram, in order to stop the reaction but not cooling, the nitrogen or steam supply is set by interlock.ii) Do the design and structure of the cooling system enable it to cool all the parts of the reaction vessel and a tank?
Yes: 7 facilities Not applicable: 4 facilities (another safety method is used) No: 1 facility ◆ Examples of answer The exterior is cooled using a coil and a jacket.Moreover, reaction solution is circulated through the inner liquid with a stirrer, and attains equilibrium.
The facility design is inadequate, and all the portions generating reaction heat cannot be cooled.b) Two or more important hardware-monitoring installations i) Are the operating conditions of important apparatus in the process always monitored and controlled at two or more places?Yes: 10 facilities; No: 2 facilities ◆ Example of answer We monitor the top, middle, and bottom of the tower using several instruments, but we monitor a tank or heat exchanger using only one instrument.c) Interlock release i) Even if the interlock is canceled, can important utilities, such as cooling water and nitrogen, be operated independently?
Yes: 12 facilities; No: 0 facilities ◆ Examples of answer Whether the interlock is ON or OFF, the utility can be operated manually.We designed the important utility system as an independent system.ii) Is the importance of interlock release fully understood by staff?Yes: 12 facilities; No: 0 facilities Figure 13 shows the example of permit for the interlock setting change and by-pass operation.
◆ Example of answer It is a security system and its importance is recognized.When it is necessary to cancel the interlock and continue operation, we perform change management and implement the required countermeasure.

The Issues Highlighted by This Examination Should Be Improved in the Future
In this study, two major accidental fires and explosions that occurred in industrial complexes in Japan were investigated.Each of these accidents developed during several hours after carrying out a scram of the manufacturing equipment [4] [5].This poses the following questions. 1) Can we identify the deviation between stable operating conditions and abnormal conditions?Are there suitable sensing systems and methods for these condi- tions?2) Is examination for abnormal plant conditions sufficiently made, or has the measure to be specified?3) Is training in emergency shutdown performed daily?4) Are the safe and stable states, even under emergency shutdown conditions, firmly understood?Moreover, is monitoring continued even after emergency shutdown, with a defined monitoring point?5) Are the criteria and procedures for reversing an emergency shutdown clear?A subsequent reexamination was carried out after the accident at Mitsui Chemicals.6) At a reaction vessel or a tank, are there devices or systems which can be used to identify or monitor reactions, even if they occur locally?From this examination, it is clear that the actual conditions at the company located in an industrial complex in the Kawasaki area in Japan are as follows.
1) Usually, an operation-monitoring method is established.Moreover, the difference between normal and abnormal conditions is clear.A detection method is also established.2) In the case of inherent abnormal reactions in the plant, a general examination had already been made and inherited as a technical tradition from the past.However, because this cannot rule out new unexpected reactions in the future, the actual conditions must be reexamined using all resources.3) Education and training for emergency shutdown are performed by companies that are experiencing a crisis because they have reached a change-of-generation stage, and because operators do not have experience in the shutdown or restarting of plants, because stable continuous operation has been achieved for two or four years.However, this effect has now been fully demonstrated, and a state is being been reached with which companies feel comfortable; this is now underway, and actual conditions are being improved.
However, there are two further viewpoints.4) Is a safe state after an emergency shutdown ensured and is monitoring sufficient? 5) Were the criteria and procedure for restarting after a scram fully developed?Companies conclude that these have been inadequate.This is demonstrated by two questions and answers below.◆ Measures after emergency shutdown 1) Is a safe state after an emergency shutdown ensured, and is monitoring adequate?Yes: 8 facilities; No: 4 facilities 2) Were the criteria and procedures for restarting after an emergency shutdown fully developed?Have a procedure: 4 facilities Only acknowledger specified: 3 facilities No procedure and no acknowledge specified: 5 facilities The reason why this aspect is weak is because it is based on former beliefs.We believed that an emergency shutdown was a safe action.Because there was a shift to a safe state when carrying out the emergency shutdown, it was assumed that safety was achieved.These were blind spots.Furthermore, because operator skill has improved in Japan as a result of education and training in the operating sector, some problems can be solved by partial or transitory shutdowns, and there is a trend to avoid shutdowns of large plants.It is considered that part of the background to these accidents was the wish for partial continuation of operations and early resumption of operations, and confidence in doing this was too high.If abnormalities occur in part of a plant, after stopping all processes completely, the cause of the abnormality is analyzed; if it is removed, an accident will not happen.
It is also the case that the success of advanced technology was also insufficient, and the risks of performing continuous operation may have been added as a result of improvements in the skills of Japanese operators.I think that Japanese chemical companies need to choose one of the following two methods.The first method is to deal with plant accidents by partial shutdown or short-term plant idling, even if there is a risk of a major accident.The other method is to accept production or opportunity losses, in order to reduce the risk of a major accident.
Next, we consider the following questions.6) At a reaction vessel or a tank, are there devices or systems which can be used to identify or monitor reactions, even if they occur locally?
It cannot be said that this has been fully achieved.Therefore, for containers that hold polymerization monomers, including liberating tanks, middle tanks, and even those that are not frequently used, the following equipment is required.◆ Containers that hold polymerizable monomers (reservoirs, reaction vessels, separation towers, etc.) 1) The container should be designed to have thermometers and pressure gauges in the upper part, central part, and lower part of the container.The system should be continuously monitored for local heat increases.If a temperature distribution is detected by this system, an alarm should be triggered.
2) A churning function should cover the whole container and it should be designed so that it is not suspended in the event of a system scram.
3) A cooling device that covers the whole container should be designed so that it functions during a system scram.
We have learned many things from these two accidents.I want to improve the level of safety of the chemical industry globally, by using the lessons learned.
valve for disposal facilities of oxidation line A was broken.The valve suddenly opened during line A operation.min after Oxidation line A was stopped by the interlock function (oxidation line B was operational).

Figure 2 .
Figure 2. Flow chart around HCl tower of VCM process.

Figure 5 .
Figure 5. Trend records of conditions [questionnaire a)-iii)].b) Prior examination, and monitoring of emergency i) Do you consider abnormal reactions or sub-reactions when operation is abnormal?Yes: 11 facilities; No: 1 facility ◆ Example of examination The danger of material B polymerizing was examined by considering potential factors that could lead to temperature increases caused by heat of polymerization, leading to explosions.The factors that we considered are the material, operation, facility, and staff.Based on this analysis, we are now planning the necessary countermeasures.ii) Do you consider the possibility of iron mixing, which could cause an abnormal reaction?Yes: 11 facilities; No: 1 facility ◆ Examples of answer Company AWe make it a rule in our standard operation to explore the influence of corrosion or damage to the installation and lower equipment.Previous experience and the process licenser's opinion suggest that there is almost no possibility of an abnormal reaction being caused by mixing of rust, so this is not examined.Company B In response to this accident, we examined the possibility that corrosion products (iron rust, etc.) could trigger an abnormal reaction.iii)Are the control points for normal and abnormal reactions identified and monitored continuously?Yes: 11 facilities; No: 1 facility ◆ Examples of answer The controls are identified and are always supervised in DCS.(Trend monitoring at control points, alarms set up at these points) A range deviation alarm is set up in four steps; interlock is set up in two steps.c) Preparation for emergency shutdown i) Was the emergency shutdown manual prepared based on sufficient information?Yes: 12 facilities; No: 0 facilities Figure 6 shows the example of emergency procedure prepared card style.◆ Examples of answer We revised the emergency shutdown manual for the following situations: -gas, water, and electricity supply stoppages -abnormalities caused by a natural disaster -plant abnormalities ii) Is the person who makes the decision and the exemption-from-responsibility regulation for a scram defined?Yes: 12 facilities; No: 0 facilities Figure 7 shows the example of exemption from responsibility regulation in Japan.iii) Is regular training regarding emergency shutdown provided?Figure 8 shows the example of the training of emergency shutdown.Yes: 12 facilities; No: 0 facilities ◆ Examples of answer Yes: 11 facilities; No: 1 facility ◆ Examples of answer The controls are identified and are always supervised in DCS.(Trend monitoring at control points, alarms set up at these points) A range deviation alarm is set up in four steps; interlock is set up in two steps.c) Preparation for emergency shutdown i) Was the emergency shutdown manual prepared based on sufficient information?Yes: 12 facilities; No: 0 facilities Figure 6 shows the example of emergency procedure prepared card style.◆ Examples of answer We revised the emergency shutdown manual for the following situations: -gas, water, and electricity supply stoppages -abnormalities caused by a natural disaster -plant abnormalities ii) Is the person who makes the decision and the exemption-from-responsibility regulation for a scram defined?Yes: 12 facilities; No: 0 facilities Figure 7 shows the example of exemption from responsibility regulation in Japan.iii) Is regular training regarding emergency shutdown provided?Figure 8 shows the example of the training of emergency shutdown.Yes: 12 facilities; No: 0 facilities ◆ Examples of answer

Figure 13 .
Figure 13.Permit for the interlock setting change and by-pass operation [questionnaire c)-ii)].