Confidential

Deer Park Chemical February 28, 2007 Propane Release Incident Cause and Incident Response Review

AGENDA

The incident - what happened

Why did it happen

What did we learn

Recovery measures review

Investigation Approach Bow-Tie

HAZARD

CONSEQUENCE

TopEventLoss of

ContainmentTHREAT

THREAT

THREAT

CONTROLS RECOVERYMEASURES

HazardPotential Consequences

DPCP chose to charter two investigations to understand both sides of the Bow Tie:

– Causes of the Release: What caused or allowed the release to occur?

– Recovery Measures: What gaps in recovery measures occurred?

Incident Description

V1384

February 28th 2007, a 2” carbon steel vertical spool (the “pup”) on the level bridle system below one of the IPA LPG bullets ruptured, releasing ~200,000 lbs of propane to the atmosphere.

V1385 V1384 V1383

TO FLARE

LPG Storage

LGLG

LPG Supply

from IPA

LPG to Refinery & IPA Reactor

Why did this happen?

Pup thinned below pressure retaining

capability

Water wasIn the pup

Fat acid wasin the pup

The pup remained in service until it was below the

pressure retaining capability

The corrosion rate in the pup increased significantly

(accelerated corrosion)

The pup was a dead leg

•The incident was caused by accelerated corrosion due to the presence of weak sulfuric acid in a carbon steel dead leg.•The weak acid was formed by mixing water and fat acid in the pup

Why was water in the pup?

During an IPA LPG Unit shutdown, which occurred in December 2006, water was sent from the IPA LPG unit to the LPG storage bullets (V1383/4/5).

LPG Storage

Fat Acid

T41/42C49 C50 C3086 C3087

De-

Pro

pani

zer

caus

tic/w

ater

was

h co

lum

n

resi

dual

col

umn

V1385 V1384 V1383

To IPA Reactor

LG

To Refinery

Dry Gas

De-

Eth

aniz

er

LG

LPG to storage

Why?•C50 water washed during unplanned LPG Unit shutdown and the LPG unit remained lined up to LPG storage•Water accumulated (inlet valve open & outlet closed) for 3 shifts•Upon detection LPG unit & storage drained•Unable to fully drain pup or check for water, due to configuration •Thus water remained undetected in pup

Why was acid in the pup?

Acid back flowed in to LPG Storage via the C49 Feed Pump Seal flush system due to a combination of a failed check valve and sufficient differential pressure.

Fat Acid

LPG Storage

T41/42C49 C50 C3086 C3087

De-

Eth

aniz

er

De-

Pro

pani

zer

caus

tic/w

ater

was

h co

lum

n

resi

dual

col

umn

V1385 V1384 V1383

To IPA Reactor

LG LG

To Refinery

Dry Gas

T41/42

LG LG

Why?•Fat acid is always in the LPG Unit feed tank (T42)•A seal flush connected T42 to C3087 and the check valve in the seal flush line failed•At times (operating and during partial shutdowns) the pressure at the seal was greater than the C3087 pressure•Seal flush isolation was not called for during shutdowns

Seal Flush

C49 Feed Pump

Failed Check Valve

Why did the pup remain in service?

The pup remained in service until it was below the pressure retaining capability

Why? The accelerated corrosion rate in the pup was unknown, as the presence of weak acid in the

pup was unknown.

Why? Operations believed that all water had been removed from the pup The Production team were unaware of the consequence of having the wrong material in

the wrong location, in this instance fat acid and water at C3087Why?

• Carbon steel is used in fat acid service throughout the unit• PEI were not made aware of the situation

The Production team were unaware of the magnitude of the seal flush backflow issueWhy?

• Individual members of the production team had critical pieces of information, the the problem was not recognized in its entirety.

• All back flow incidents were not recognized

Some Failed Barriers

Mechanical Integrity and Design

Seal flush – connected acid to propane system. Backflow scenario and consequences not pre-identified. Inability to drain LPG bullets of water.

Procedures

Shutdown isolation philosophy. No work instruction for C50 water wash.

People

Unclear ESP Monitoring requirements during shutdown. Inter and Intra department communication. Wrong fluid in the wrong place protocol.

Th

reat

s

Which Barriers Failed?Which Barriers Failed?PeopleProcedures

Mechanical Integrity & Design

Prevention

Propane Release

Mechanical Integrity & Design

Procedures

People

• GAME ESP

• GAME IPF

• GAME EI

• CUI program

• Manage for Reliability

• Advanced process control

• Containment Upgrade USA

• HEMP

• RHA

• Procedure Compliance

• Permit to work

• Contractor HSSE oversight

• HSSE Blitz

• Global Process Standards

• Management of Change

• SWAT

• Focused craft and operator training

• Front line leader development

• Simulators

• Technical & HSSE competencies

• Causal learning

• Seal Flush - connected acid to propane system

• Backflow scenario and consequence not pre-identified

• Inability to drain LPG bullets of water

• Shutdown Isolation philosophy

• No work instruction for C50 water wash

• Unclear ESP Monitoring requirements during shutdown

• Inter and Intra department communication

• Wrong fluid n the wrong place protocol

Specific Learnings

Risk Recognition and Assessment

Potential for process backflow into a finished process system through a seal flush line was not recognized during installation and subsequent risk assessments.

Situations that occurred during shutdowns were key to causing this incident, but risk assessment activities focused on steady state operations.

Multiple conditions had to co-exist for the process backflow to occur, and risk assessment processes included only single jeopardy.

Isolation approach for shutdown allowed valve configuration flexibility that increased risk of unintended material flow.

Specific Learnings

Communications and Abnormal Situation Management

A generally sequential process of communications limited the intra- and inter-departmental interaction, limiting the interpretation and assessment of abnormal situations.

Adaptation to some initially abnormal situations and changes supported deferral of action (such as repair during pit stop).

Unit Monitoring and Response

The approach to high level surveillance, alarm interpretation and response is different during shutdowns than for normal operations.

Training, Procedures, and Work Instructions

Relying on knowledge and experience for execution of what is viewed as routine activities did not support consistent and reliable decisions, especially for newer operators.

Recovery Investigation

High-Level Timeline of Events

0500 – Approximate start time of leak 0510 – OXY identifies leak 0520 – OXY notifies Shell Operations of leak 0530 – Shell Operations calls Security to report site-wide 0600 – ER requests FW Pump #13 to be turned on 0630 – OXY vehicle observed driving into area 0700 – PTRA train travels through plant 0800 – ER isolates leak to 1 vessel (from 3 interconnected) 0830 – ER close leaking vessel isolation valve 0900 – Leak converts from liquid to gas 1000 – Leaking pipe breaks off completely... air-gapped 1300 – Leak isolated and stopped... all clear on site-wide

LPG Bowtie

Security Notification

LOCLeak

Detection

LPG Deluge ER Team & Equipment

ER Notification

Leak Isolation

Material Storage

Ignition Control

De-inventory

Undesired C

onsequences(A

ctual & P

otential)

Operator Response

Recovery Measures – Key Discoveries & Actions

Leak Detection: Observation: Leak detected by Oxy during operator shift change Action: Fixed leak detection is being considered across the site

Security Notification: Observation: Oxy reported leak to Shell operations Action: Re-communicate Shell’s incident notification protocols

LPG Deluge: Observation: Oxy activated deluge for their 3 spheres and firewater

pressure was low for LPG area Action: Validate firewater system is designed appropriately and re-establish

operator firefighting and equipment training

Observation: Deluge testing and emergency activation procedures did not align with dual-valve system

Action: Update deluge testing and emergency activation procedures to:– Validate dual valve systems are tested independently AND– Ensure all deluge valves are opened during an emergency

Recovery Measures - Discoveries

ER Team & Equipment: Observation: Process for site evacuation, or entry in this incident, was unclear Action: Conduct additional training on site evacuation process

NOTE: There were various observations and actions related to ER and Security that came from critiques of this incident, but are not in this report-out

Leak Isolation: Observation: Hazardous accessibility and leaking isolation valve contributed

to time and quantity of material released Action: Remote isolation for certain valves is being considered across the site

Material Storage: Observation: Three propane vessels were interconnected and twelve bullets

were in close proximity Action: Evaluate pressurized C3 and C4 storage vessels for potential

reduction of inventory and connectivity

Recovery Measures - Actions

Ignition Control: Observation: Vehicle drove into affected area Action: Re-communicate vehicle control policy to all employees

Observation: PTRA train proceeded through the affected area Action: Work with PTRA to understand the root causes of the incident

and develop/enhance controls to prevent future occurrences

Observation: Diesel firewater pump in the affected area was activated Action: Initiate project to ensure firewater pump in that area is

intrinsically safe

Backup information

Process Overview

T41/42Feed

C49 C50 C3086 C3087

M

CP3012CP304

Feed pumps

V3086

M

REFLUX

C3 C3

DPS, PHSIPE, C3H2SO4 IPE

C3H20

C3DPSPHS

H2SO4

V3088

Dry Gas

FV3001

FI

SEAL FLUSH

To LPG storage

V1385 V1384 V1383

M

M

To REFINERY

To IPA Reactor

min flow

TO FLARE

CP1391/92

From IPARX 3rd StagePhase Sep

E3

09

0

300 to250psi

250psi

De-

Eth

aniz

er

De-

Pro

pani

zer

caus

tic/w

ater

was

h co

lum

n

resi

dual

col

umn

LPG Storage

Fat Acid

C3

PC PC

LG LG

Water Cause Tree Overview

Water was in the pup

LPG unit was lined up to LPG storage

During an IPA LPG Unit shutdown, which occurred in December 2006, water was sent from the IPA LPG unit to the LPG storage bullets (V1383/4/5).

Water was left in the LPG bullets and the

pup

Water accumulation – inlet valves open-outlet valve closed

Unable to fully drain due to configuration. Unable to check for

water

Accumulation continued over 3

shifts.

C50 filled C3086 and C3087 with water

•Inlet flow control valve in automatic – drove valve open.

•Board operator assumed water makeup valve blocked in field

•Field operator left water inlet valve open in field.

•No written work instruction.

•Delayed restart.

•Accumulation not recognized – sent material to refinery

•No alarm on chimney tray

•Unit surveillance reduced during outages.

•Drain point is higher than lowest level – left water in pup.

•Normal protocol while shutdown

Acid Cause Tree Overview

Acid was in the pup

Acid back flowed in C3087 via the C49 Feed Pump seal flush

Latent Acidity – Possible Minor Contributor discussed separately

Acid is in the feed tank

(T42) to C49

Seal Flush line connects T42 to

C3087

Seal Flush Check Valve

Failed

Pressure at seal greater than

C3087

No positive isolation on seal flush

Potential shutdown & operating condition

•Process always contains fat acid

•Fat acid phase level high enough to flow into pump.

•Valves open or leaking by.

•Seal flush valves left open while pump out of service – common practice.•Occurred several times

during shutdowns in Jan and Feb.

•Occurred during operation in 06 and 07

•Plug corroded

•Potential obstruction due to particulates

•Seal flush line added before March 1996.

.

Time Cause Tree OverviewThe pup remained in service

until it was below the pressure retaining capability

Belief all water removed

PT unaware of magnitude of seal

flush backflow PEI not aware

All acid backflow incidents not recognized.

Scenario not pre-identified. CS

used in Fat Acid

Accelerated corrosion rate unknown

In 2004 predicted half life was 2020

PT unaware of consequence of fat

acid in C3087

•Drained bullets and pup until thought dry.

•Unable to confirm whether dry.

•Fat acid found at bottom of C3087, potential consequence not understood.

•Not alerted by PT.

•PEI unaware of abnormal situation

•Awareness and response to foreign material in reboiler

•Critical pieces of info held individually.

•Root cause determination of control valve failures