On Oct. 26, 2019, a lone employee responded to a pump oil level alarm at an unmanned waterflood station in Odessa, TX. A waterflood station pumps water that is separated from crude oil back into the underground oil formation to improve extraction. The employee isolated the pump by closing valves but did not perform lockout/tagout. While the employee was still onsite, the pump automatically started, releasing water known to contain toxic hydrogen sulfide (H2S) gas. The employee died from exposure to the gas. The tragedy was compounded when the employee’s wife went into the waterflood station to search for her husband, and was also killed by H2S exposure.
Many failures of process safety management (PSM) elements contributed to this incident. This Beacon focuses on one of the contributing causes: the failure of the H2S alarm system. The waterflood station was equipped with an H2S detection and alarm system. However, the alarm panel did not receive a signal from the indoor or outdoor detectors (Figure 1). Therefore, the H2S alarm warning light was not activated. Some of the detectors were set to test mode, which prevented them from sending an alarm signal. Other detectors were correctly set up, but the alarm panel did not receive the signals. Investigators could not find any maintenance, testing, or calibration records for the H2S detection and alarm system. Read the U.S. Chemical Safety and Hazard Investigation Board (CSB) Report No. 2020-01-I-TX for more information on this incident.
▲Figure 1. A waterflood station in Texas had a hydrogen sulfide (H2S) gas detection and alarm system with eight H2S gas detectors. However, the system failed, and two people were fatally exposed to toxic H2S gas. Image courtesy of the U.S. Chemical Safety and Hazard Investigation Board.
Did You Know?
- Active safety devices such as alarms, interlocks, or shutdown systems must be tested on a schedule, or their reliability will deteriorate over time. This is particularly true of gas detectors, which are sensitive instruments that require regular calibration.
- Some safety devices are not used during normal operation. It may not be apparent that a safety device has failed or has an operational error (e.g., a worker disabled the device) if it is not used regularly.
- A robust reliability program tests all components as a system to confirm that the entire system will work when needed. Plant engineers establish inspection, testing, and maintenance frequencies and procedures based on reliability calculations and failure data.
- Results of inspection, testing, and maintenance activities for safety devices must be documented.
- Safety device test results should be reviewed to identify chronic failure issues and to confirm that component failure rates are as expected.
What Can You Do?
- If you are involved in inspecting and testing safety alarms, interlocks, and other safety devices, follow procedures rigorously and document the results.
- Use written checklists and procedures to ensure that tests are performed correctly.
- Be sure to put the safety device back online when inspection and testing are complete.
- Know where to find the results of safety device tests. If you find that the required tests have not been completed or documented, report your observations to management.
- Report any safety devices that do not have inspection and testing programs to management.
Inspect and test your safety systems to ensure that they work!
©AIChE 2021. All rights reserved. Reproduction for non-commercial, educational purposes is encouraged. However, reproduction for any commercial purpose without express written consent of AIChE is strictly prohibited. Contact us at ccps_beacon@aiche.org or 646-495-1371.
Copyright Permissions
Would you like to reuse content from CEP Magazine? It’s easy to request permission to reuse content. Simply click here to connect instantly to licensing services, where you can choose from a list of options regarding how you would like to reuse the desired content and complete the transaction.