Application of Fish Bone Diagram to identify

the root causes of any major occupational

hazard at process industry.

HSE COMPLEX ENGINEERING PROBLEM

MUNEEB IMRAN BHANIA

ME-16076
 Lessons learned from analyzing a VCE accident at a chemical plant
ABSTRACT
On June 5, 2017, there was a Vapor Cloud Explosion (VCE) at JinYu Petrochemical Co. Ltd.
During unloading of liquified natural gas, the gas leaked from the truck and formed a vapor
cloud, then the vapor cloud met with the electrical sparks in the plant laboratory, and an
explosion occurred. This incident caused significant casualties and property loss. The main
causes of the accident are demonstrated by a fishbone diagram. The major causes include (a)
defective design, (b) noncompliance with standard operation procedures (SOPs), (c) the
presence of ignition sources, (d) ineffective enforcement of safety rules, (e) inadequate design
of emergency facilities, and (f) delayed emergency response. The analysis reveals that process
safety management (PSM) is a crucial factor in the success of chemical plants, especially for
small and median-scale companies in developing countries. Dispersion phenomenon of
liquefied gas is simulated by commercial Computational Fluid Dynamic (CFD) software. The
simulation results approximately agree with the real incident. The simulation indicates that a
visual and quantitative consequence analysis can provide general guidance for PSM. Finally,
based on various PSM conditions (good, normal, weak, and bad), the probabilities of VCE
generated from leakage are obtained by an event sequence diagram (ESD) and Monte Carlo
methodology. By comparing the quantitative probability values in four different PSM situations,
the results show that emergency management associated with effective PSM is crucial to avoid
VCE incidents.

1. Introduction
A large number of catastrophic accidents have occurred in chemical process industries in the
past decades. The most common examples of these accidents are Vapor Cloud Explosions
(VCE). There were about 174 vapor cloud explosion (VCE) accidents worldwide that were
reported between 1940 and 2010 (Zhu et al., 2015). For example, the liquid petroleum gas
explosion in Mexico in 1984 and the explosion at British Petroleum's Texas City refinery in 2005
were noteworthy incidents. These incidents revealed that effective safety management of
hydrocarbons and reactive chemicals (e.g., hydrogen, methane, acetylene, ethylene, and liquid
petroleum gas) could substantially reduce the risks in chemical plants. Additionally, past cases
showed that VCE accidents could occur in any part of the operating processes for hazardous
chemicals including preparation, utilization, storage, transportation and disposition. Defective
design of facilities, imperfect equipment maintenance, human error in operations and lack of
safety rule enforcement by management are important factors that can cause accidents. Much
research has been done on the causes of VCE accidents (Chang and Lin, 2006; Konstandinidou
et al., 2011). Furthermore, qualitative risk analysis, consequence analysis and study of the
domino effect have been conducted (Cozzani et al., 2014; He et al., 2017; Hemmatian et al.,
2014; Vílchez et al., 2011; Villa et al., 2016). Because of these studies, process safety
management (PSM) is now recognized as essential for chemical plants. However, a few
companies still lack of an awareness of process safety, especially in some developing countries
(Khan et al., 2015; Knegtering and Pasman, 2009; Zhao et al., 2014; Atkinson et al., 2015;
Sharma et al., 2013; Li et al., 2014; Zhang and Zheng, 2012). The objective of this paper is to
analyze the potential causes of an incident occurred in Shangdong, China on 2017, as well as to
reveal the importance of PSM implementation and quantitative risk assessment.

2. Description of a VCE incident

On June 5, 2017, liquefied petroleum gas was released during the unloading process at JinYu
chemical plant in China's Shandong Province (Work Safety Committee of the State Council in
China, 2017). Since liquefied petroleum gas is a heavy gas, after it leaked, it settled near the
ground. When the gas cloud encountered an ignition source, the explosion occurred. Ten
people died, and 9 were injured in the incident. The plant was damaged. Facilities, including 15
carrier vehicles of hazardous chemicals, 1 spherical tank, 2 vault tanks, production equipment,
laboratory, control room, office buildings, surrounding enterprises and social vehicles were also
damaged. In addition, 6 spherical tanks caught fire, and several pipeline systems collapsed.

Figure 1

2.1. Layout of the chemical plant and the leak area

The 86,955-square-meter plant had nine 200 m3 liquefied gas tanks, which stored propane,
isobutane and pentane oil, six 1000 m3 and six 2000 m3 liquefied petroleum gas spherical
tanks, eighteen 150 m3 pentane oil tanks, six 3000 m3 liquefied petroleum spherical tanks, six
2000 m3 isooctane tanks and four 5000 m3 sulfuric acid storage tanks. On the east side of these
tanks, was the loading and unloading area for the tanker trucks. Fifty meters from the north
side of the loading/unloading area was the laboratory. The control room and the factory office
building were located at the east side of the loading/unloading. The layout of this plant is
demonstrated in Fig. 1. In the early morning of June 5, a tanker truck arrived at the unloading
zone. The driver got out of the truck and tried to connect the omnidirectional loading arm to
the tanker's discharge outlet. However, he failed to connect the arm to the outlet properly.
Suddenly, large amount of liquefied gases began to leak. And the gases quickly spread over the
unloading zone. The location of leakage is shown in Fig. 2.

Figure 2

2.2. The time sequence of the accident

More specifically, at about 1:00 a.m. on June 5, 2017, the driver began to unload liquefied gas
by connecting the omnidirectional loading arm to the tanker's discharge outlet. Because of the
complicated operating procedures and without supervision, the driver failed to connect them
properly. The worker on duty carelessly checked the spot and did not find out any problem. A
leakage of liquefied gas began. After a period of 130 s following the release, a cloud of liquefied
gas was ignited. A vapor cloud explosion occurred due to an ignition source in the laboratory to
the north. As a result, serious damage occurred through a domino effect. Table 1 summarizes
the timeline of this incident.

3. The fishbone diagram of the accident

The inadequate piping system was one of the reasons for this VCE accident. The piping system
was very complex. It was composed of several rotary joints, varying sizes of multi-section pipes,
spherical valves, flanges, quick connectors, and an anti-static device. Thus, any small defect in a
small component of the piping system could cause failure to the loading operation. In addition,
there were also several potential factors related to process safety: suitable supervision before
the loading operation, adequate connection procedures, effective emergency management,
frequent safety training for workers, etc. Considering PSM and all the factors mentioned in this
paper, the fishbone diagram for this accident is shown in Fig. 3.
Through analysis of the fishbone diagram, we conclude that there were four major reasons for
this severe incident. The first factor was a failure by workers to follow operation procedures
and unloading procedures. The second factor was a lack of equipment integrity management
and safety awareness. For example, there was no reliable leak detection procedure or alarm
instrument during unloading procedures so there was no immediate response. The third factor
was a failure in conducting consequence measurement of unexpected scenarios and PSM on
the operating processes. Therefore, no contingency plan and emergency response were
implemented when the liquefied gas leakage occurred. The last was the lack of an explosion-
proof plant design. The facilities could have prevented or reduced the consequences of the
incident if an explosion-proof electrical switch had been installed at the laboratory.
 4. Comparison of analysis results on accident consequences
4.1. Comparison of on-site leakage and dispersion with CFD software simulation

During the leakage at the piping connection, the video surveillance at the plant recorded the
event. The videos of leakage taken at different times are shown in Fig. 4. At the beginning of the
leakage, the liquefied gas was clustered between two tankers. After 2s, the gas cloud spread
distinctly from the bottom of the two tankers towards the east and west sides. After 6s, the
dispersion traveled distinctly towards the north and south areas. After 10s, the gas cloud
spread out and covered the surrounding areas. After 130s, the explosion occurred at the north
side of the tankers.
As shown in the video recording, the tanker trucks were 4 m in height and 8 m in length. The
front and rear wheels were all 1 m in diameter and 0.2 m thick. The tank diameters on the truck
were about 3 m. Two tanker trucks were 5 m apart. The leakage was in the loading arm joint
and at an angle of 0°along the horizontal direction. The leakage diameter was 30 mm. The
following assumptions are used in the simulation. The wind speed was assumed to be very low
(∼1 m/s) during leakage, and the atmospheric stability class was D. The simplified model was
established and simulated using commercial CFD software. Fig. 5 shows the simulation of
liquefied gas dispersion based on the above conditions. The simulation results were in
approximate agreement with the real incident. Thus, the CFD simulation results could provide a
good guideline for prediction and consequences analysis of gas leakage.
After 130s, the gas concentration on the ground was almost 10% at the north laboratory, which
was 50 m from the tanker trucks. The concentration was in the range of the liquefied gas
explosion limit scale (1.5～10%). Because there was no explosion-proof switch in the
laboratory, sufficient electrical spark ignition energy was generated and a detonation scenario
was inevitable. By comparing the simulation results with the real incident, it is revealed that the
consequence risk analysis using CFD modeling can be used for making important
recommendations for accident prevention and emergency response. Thus, it is necessary to
encourage managers to implement quantitative risk analysis as well as PSM.
4.2. Comparative analysis on probability from leakage to VCE

When the flammable liquefied gas leaked out, a shut off valve should have been activated. If
the response did not work, the effective measures of plugging should have been taken. If these
responses did not work, a mist water spray system should have been activated to reduce the
concentration of hazardous gas. If this had happened, the diluted gas would not have been
ignited by the static charge. The level (good, normal, weak and bad) of PSM directly determined
the probability of VCE. The probability values of VCE calculated here is more specific than the
data provided in other studies (Moosemiller, 2011; Zhu et al., 2012).
Four PSM cases were listed in Table 2. The first case is with a good PSM. The explosion occurred
after 130s of leakage. If the laboratory had been designed to prevent the buildup of a static
charge and other ignition sources, the vapor cloud would have spread out and become less
concentrated, though it could have been ignited by other ignition sources outside of the
chemical plant. In this first case, the allowable maximum time to react before the explosion
occurred (Tmax) is assumed to be twice as long as the above mentioned incident (130 s). Tmax
is set to 260 s. As shown in Fig. 6, the event for the leakage alert is denoted by de1. Then, the
leakage is detected by a device or an operator. The event of making the decision to control the
leakage is denoted by de2. The event of activating the mitigation system (e.g., water curtain) to
reduce the hazardous material concentration is denoted by de3. The event of the teams to
complete the plugging is denoted by de4. The time required for event de1, de2, de3, de4 is
designated by variables t1, t2, t3, t4, respectively. These variables are assumed to be a normal
distribution. The second case is with regular PSM. Tmax is 260s, and the time for de1, de2, de3,
de4 is set 20% longer than the first case. The third case is set to be with weak PSM. Tmax is
260s, and the decisionmaking time for de1, de2, de3, de4 is all 50% longer than the first case.
The fourth case is based on bad PSM. Because of inadequate compiance audits, Tmax is 130 s
(same as the above mentioned incident) and decision-making time de1, de2, de3, de4 is all
100% longer than the first case. The mean and variance of de1, de2, de3, de4 about the above
cases are shown in Table 2.
e shown in Table 2. In order to analyze the above cases in a consistent manner, a dynamic
event sequence diagram is used to establish the series process (Zhou et al., 2016; Luo and Hu,
2013), as shown in Fig. 6. The probabilities under four cases are calculated by the Monte Carlo
method. 1,000,000 simulations are performed to reduce sample bias and error. The
probabilities of occurrences from leakage to VCE are listed in Table 3.
The results show that a good PSM system could significantly reduce the probability of VCE by
more than 80%. Therefore, a series of emergency responses are important for preventing
incidents. The emergency management of every plant should be carefully considered.
Deficiencies in emergency management should be revised and improved. Emergency responses
such as emergency response plans, emergency infrastructure and emergency procedure
training should be considered in chemical processing plants. Additionally, it is paramount to
establish an effective safety culture in the organization.
 5. Lessons from the causes and consequences of the
incident
From the perspective of process safety management, the lessons learned in this case should
include at least the following aspects:
a. Operating Procedures: The operation procedures for staff and drivers should be clearly
defined. In this case, the unloading process of drivers wasn't supervised by a manager,
as it should have been. Also, the procedures for unloading should be modified so that
drivers can detect mechanical deficits. Detailed operating procedures can be
established. In this case, there was no confirmation procedure to make sure that the
connection was good. The risk of mistakes in operating procedures had been
underestimated.
b. Mechanical Integrity: The reliability of connection components decreased with time.
Similarly, the emergency facilities became ineffective with irregular maintenance and
time. This dynamic risk was not fully considered. Mechanical integrity management was
not effectively implemented.
c. Training: Staff lacked an awareness of the risk of combustion and explosion of liquefied
petroleum gas. Even when the leak was uncontrolled, the staff still wasted of time and
did not evacuate quickly. Staff trusted the reliability of the equipment and ignored the
possibility of accidental leakage, which also indicated a lack of risk consciousness.
d. Emergency Planning and Response: Initial emergency response was slow. There was
basically no emergency management procedure, and the emergency training was not
effectively organized. The ability to respond dynamically with emergency skills and
resilience in different situations was not sufficient.
e. Process Hazard Analysis: Human errors, lack of detail in procedures, the inability to
unload tanker trucks quickly, and 24/7 operation fatigue all together multiplied the risk
exponentially. These combined risks were not fully considered with qualitative and
quantitative methods. In addition, the unloading areas were too close to the tanks. The
domino effect risk was also underestimated.
f. Compliance Audits: The laboratory and control room near the unloading area was not
explosion-proof, nor were the electrical and laboratory equipment. The facilities were
not designed to prevent an explosion.
 6. Conclusions
VCE accidents often occur in chemical plants in developing countries. These lessons we learned
from this accident should be understood Fig. 6. The event sequence diagram from leakage to
VCE. Table 3 Probabilities from leakage to VCE under four cases. Cases case1 case2 case3 case4
Probability 0.1440–0.1450 0.3250–0.3260 0.4965–0.4975 0.9970–0.9980 C. Zhu et al. Journal of
Loss Prevention in the Process Industries 50 (2017) 397–402 401 by mangers. In this study, a
severe VCE incident that occurred in a chemical plant was described and analyzed. According to
the incident fishbone diagram, chemical plants should implement PSM to ensure process
safety. The comparison of real and simulation results show that CFD modeling can provide a
good baseline for quantitative consequence risk analysis. Also, the modeling results can provide
good guidance for PSM. Finally, based on the event sequence diagram and reasonable
assumptions, the probabilities of incident occurrence from gas leakage to VCE under distinctive
PSM conditions of good, regular, weak and bad were calculated by Monte Carlo methods. The
quantitative results showed that the good PSM, using well-functioning emergency management
can significantly reduce the likelihood of a VCE incident.