They Called It a Startup Mistake

The story everyone settled on was that the operators rushed the startup. They got off the written procedure, they bypassed safety devices, and two of them died. While factually that is true, it doesn't accurately represent what happened. To see why, especially after reading the CSB report, you have to know what the unit was actually doing that night.

The Methomyl-Larvin unit at Institute made methomyl, a carbamate insecticide. The chemistry is easy to write down and unforgiving to run. The unit reacted an oxime called MSAO with methyl isocyanate (MIC), dissolved in a solvent called MIBK, to make methomyl in solution. From there it had to pull the product back out of that liquid: strip off the leftover MIC, send the solution to crystallizers where an anti-solvent dropped the methomyl out as crystals, spin those crystals dry in centrifuges, then dry and drum the finished product.

What came off the centrifuges, a liquid called mother liquor, still carried solvent and dissolved methomyl, up to about 22 percent by the time it reached the solvent recovery flashers. You cannot burn or dump that, because methomyl is toxic. So the unit had one last vessel whose entire job was to clean up that waste stream before it went to the boilers as fuel. That vessel was the residue treater.

The residue treater was a 4,500 gallon heated pressure vessel, and it ran on a narrow principle. Methomyl decomposes when you heat it, and that decomposition gives off heat. It is exothermic. Done right, you feed the methomyl-bearing waste into a treater that is already partly filled with hot solvent and already up to temperature, so the methomyl arrives diluted and decomposes slowly and steadily down to less than half a percent. The solvent is the brake. It soaks up the heat and holds the reaction controlled. Take the brake away, run concentrated methomyl into a vessel that is not pre-filled and not up to temperature, and the same reaction that is useful becomes the one that bursts the vessel. Hold onto the residue treater and the word solvent. The night of the explosion is a story about both.

On the night of August 28, 2008, the residue treater ran away and exploded inside the methomyl unit at the Bayer CropScience plant in Institute, West Virginia. The blast threw the vessel across the unit, sprayed burning solvent, and started a fire that ran for more than four hours. Two operators who had been sent out to find why the treater's pressure was climbing were standing near it when it let go. One died that night from blunt trauma and burns. The other died 41 days later in a burn center. Eight more people, volunteer firefighters and contractors, were treated for possible chemical exposure.

More than 40,000 people, including the students at the university next door, were told to shelter in place for over three hours. Institute was the only site in the country that stored methyl isocyanate in quantity, the same chemical that killed thousands in Bhopal in 1984. The exploding vessel did not breach the MIC tank. But the CSB found the incident could have caused an MIC release, and spent part of the report on how close the call was.

If you complete this drilldown the way a hurried investigation completes it, human error is almost automatic.

Start at the vessel. The residue treater over-pressured and burst. Why. Because a far too concentrated methomyl stream went into it before it was pre-filled with solvent and brought up to temperature, which is a direct violation of the written startup procedure. Who fed it that way. The operators. Were safeguards in place to stop it. Yes, and critical safety devices were bypassed. Were the operators trained and qualified. Yes. So the chain reads clean. Trained operators broke a written procedure, defeated safeguards, and people died. Procedure violation, human error, retrain the crew, close the file.

Every box a standard investigation checks is checked, and that is exactly what makes it dangerous. The easy story is not wrong about what the operators did. It is wrong about stopping there, about treating what they did as the cause instead of asking the only question that matters next. Why did a trained crew, off procedure and out of safeguards, end up in that spot at all.

The CSB asked that question, and answering it meant following the data instead of the blame. Here is the drill-down, in the order the evidence takes you.

Start upstream, not at the operators. The unit had been down for months while Bayer did two heavy things at once, replacing the residue treater and installing a brand new distributed control system, the DCS. The board operators ran the startup on screens they had not been properly trained on. That is not a side note, it is the hinge, because of what the process data later showed. The crystallizers and solvent recovery never reached correct operating conditions. The methomyl was not crystallizing and coming out as product. It was staying in the liquid. So the over-concentrated stream that destroyed the treater was not an operator pouring in the wrong thing. It was the predictable output of an upstream process that was quietly failing, on an interface the crew could not read.

Now the data trail, and this is the part that stays with me. It is also where the investigation earns its conclusion. The CSB pulled the residue treater's own recorded process variables from the hours before the explosion, its temperature, pressure, and level. The trend tells the story by itself. The temperature climbed steadily for hours, and in the final stretch it was rising more than two degrees a minute. The pressure sat almost flat the whole time, then went vertical at the very end. The relief valve opened at 44 psig at 22:27, and it was not enough. Six minutes later, at 22:33, the vessel failed at about 150 degrees C and 51 psig. They also pulled the steam flow to the treater heater and recovered the hardware, including the steam block valve that fed the heater, which was found closed. The treater was taking an abnormally concentrated feed, the runaway was already building in the numbers, and the relief system never had a chance against it.

Then the skipped safeguard. The formal check that exists precisely to catch every condition above is the pre-startup safety review, the PSSR. It is the gate you run before a changed unit goes back into service. Is the equipment tested and calibrated. Are the operators trained on the new system. Do the procedures match the configuration in front of them. Bayer did not apply its own PSSR and turnover practice to the control system project. The unit went hot without the one review designed to find the untested equipment, the untrained operators, and the unverified valve lineups. The safeguard was not missing. It was skipped.

And the people. The crews running all of this were working 60 to 70 hour weeks heading into the startup, with some pulling 18 hour shifts and 6 hours off, doing the least routine and most demanding work a plant ever asks for.

Stack it and the operators' deviations stop reading as the cause and start reading as the last visible symptom of a unit that was never made ready to run. That is not my opinion or the CSB's opinion. This is what the evidence forced. The temperature and pressure trends, the steam flow, the closed valve, the off-spec chemistry, the missing PSSR, the training gap. Each is a separate piece of physical or recorded evidence, and they line up one way only. The two operators who walked out to a vessel with climbing pressure were reading the last page of a story that had been written weeks before they got there.

None of the tools that got the CSB there are exotic, and I would bet you already have every one of them.

Read the hardware, the as-found valves and the burst vessel, instead of the witness story, because metal does not misremember. Pull the recorded process data and let the trends tell you what the equipment was actually doing, not what the panel said. Work the chemistry until you can name the exact condition that ran away, here concentrated methomyl with the solvent brake removed. Audit whether the pre-startup safety review was actually performed and closed, or just signed. Put a real human factors lens on the interface, the training, and the fatigue. Then chart the causes and check the unit's own history.

Run that drill and human error stops being an answer and goes back to being the first question. That is the whole difference between a report that prevents the next one and a memo that just assigns a name.

Every plant runs startups, and a startup is when your defenses are thinnest and your people are most stretched. New equipment, unfamiliar controls, long hours, and pressure to get back to making product. It is the exact mix that was in the room at Institute.

The comfortable question is whether your operators will follow the procedure. The real one is whether your organization sets them up to. If the pre-startup review is a signature instead of a check, if training slips when the schedule tightens, if overtime runs hot to hit a date, then you have not prevented the next deviation. You have scheduled it.

One question before you go: pull your last post-turnaround startup. Did the pre-startup safety review get performed or just signed? Reply and tell me which; I read every one. Save the 3-point checklist above, it runs in a 10-minute toolbox talk.

Before Human Error is a teardown of industrial incidents for EHS and operations leaders. Every issue is built from public investigation findings. New here? Subscribe to Before Human Error, a teardown like this every week.

Sources: U.S. Chemical Safety and Hazard Investigation Board, Investigation Report 2008-08-I-WV, Pesticide Chemical Runaway Reaction Pressure Vessel Explosion, Bayer CropScience LP, Institute, West Virginia (January 2011); U.S. House Committee on Energy and Commerce hearing, "Secrecy in the Response to Bayer's Chemical Plant Explosion" (April 2009); Chemical & Engineering News, "Bayer Accused of Skirting Safety."