U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Investigation Report Published: June 2019 Investigation Report KEY ISSUES:   • Emergency Planning and Response  (Preparedness)  • Implementation of Process Safety  Management Systems  •  Assessment of Process Safety Culture  FINAL COPY    U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX The U.S. Chemical Safety and Hazard Investigation Board (CSB) is an independent federal agency whose mission is to drive chemical safety change through independent investigations to protect people and the environment. The CSB is a scientific investigative organization, not an enforcement or regulatory body. Established by the Clean Air Act Amendments of 1990, the CSB is responsible for determining accident causes, issuing safety recommendations, studying chemical safety issues, and evaluating the effectiveness of other government agencies involved in chemical safety. More information about the CSB is available at www.csb.gov. The CSB makes public its actions and decisions through investigative publications, all of which may include safety recommendations when appropriate. Types of publications include: Investigation Reports: Formal, detailed reports on significant chemical incidents that include key findings, root causes, and safety recommendations Investigation Digests: Plain-language summaries of Investigation Reports Case Studies: Reports that examine fewer issues than Investigation Reports Safety Bulletins: Short publications typically focused on a single safety topic Hazard Investigations: Broader studies of significant chemical hazards Safety Videos: Videos that animate aspects of an incident or amplify CSB safety messages CSB products can be freely accessed at www.csb.gov or obtained by contacting: U.S. Chemical Safety and Hazard Investigation Board Office of Congressional, Public, and Board Affairs 1750 Pennsylvania Ave NW, Suite 910 Washington, DC 20006 (202) 261-7600 No part of the conclusions, findings, or recommendations of the Board relating to any accidental release or the investigation thereof shall be admitted as evidence or used in any action or suit for damages arising out of any matter mentioned in such report. See 42 U.S.C. § 7412(r)(6)(G). Page 2 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX TABLE OF CONTENTS 1  EXECUTIVE SUMMARY .......................................................................................................................................... 7  2   INCIDENT DESCRIPTION ...................................................................................................................................... 13      METHYL MERCAPTAN RELEASE ..................................................................................................................................... 14  EMERGENCY RESPONSE ............................................................................................................................................... 21  3  DELAYED AWARENESS OF TOXIC CHEMICAL RELEASE BY OPERATIONS ................................................................. 28  4  EMERGENCY RESPONSE OPERATIONS .................................................................................................................. 31        ERT BACKGROUND .................................................................................................................................................... 33  PROCESS COORDINATOR WAS MISSING ......................................................................................................................... 34  DELAY IN ERT READINESS TO SEARCH FOR MISSING WORKERS ........................................................................................... 38  4.3.1  Call for ERT Response ....................................................................................................................................... 38  4.3.2  ERT Mini‐Pumper Truck Not Operational ......................................................................................................... 39    THE SEARCH FOR MISSING WORKERS WAS HIGH RISK ...................................................................................................... 40  4.4.1  Entry into Potentially Explosive Atmosphere .................................................................................................... 41  4.4.2  No Technology to Locate Missing Workers ...................................................................................................... 43  4.4.3  Unrecognized Manufacturing Building Collapse Hazard .................................................................................. 43    DIFFICULTIES NAVIGATING MANUFACTURING BUILDING .................................................................................................... 44    NO ANALYSIS OF PROCESS DATA TO IDENTIFY SOURCE OF LEAK .......................................................................................... 47    INADEQUATE CREATION AND CONTROL OF HOT ZONE ....................................................................................................... 50    DEFICIENCIES IN EVALUATING RISK TO THE PUBLIC ............................................................................................................ 52  4.8.1  Release Modeling ............................................................................................................................................. 53  4.8.2  Physical Properties of Methyl Mercaptan ......................................................................................................... 56  4.8.3  Chemical Sensor Data ....................................................................................................................................... 58  4.8.4  Air Monitoring .................................................................................................................................................. 59    EMERGENCY RESPONSE CONCLUSIONS ........................................................................................................................... 60  5  DUPONT’S PROCESS SAFETY MANAGEMENT SYSTEM .......................................................................................... 61    OSHA ..................................................................................................................................................................... 62  5.1.1  The Process Safety Management Standard ...................................................................................................... 62  5.1.2  DuPont La Porte’s Implementation of PSM ...................................................................................................... 63  5.1.3  Recent Developments Affecting the PSM Standard .......................................................................................... 65    ENVIRONMENTAL PROTECTION AGENCY ......................................................................................................................... 65  5.2.1  Risk Management Plan Rule ............................................................................................................................. 65  5.2.2  DuPont La Porte’s Implementation of RMP ...................................................................................................... 67  5.2.3  Recent Developments Affecting the RMP Rule ................................................................................................. 68    AMERICAN CHEMISTRY COUNCIL ................................................................................................................................... 69  5.3.1  History of Responsible Care .............................................................................................................................. 70  5.3.2  Responsible Care Requirements ....................................................................................................................... 71  5.3.3  Responsible Care Conformance Audits ............................................................................................................. 73  Page 3 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 5.3.4  Recent Developments in Responsible Care ....................................................................................................... 76  5.3.5  Responsible Care Improvement Opportunities ................................................................................................. 77    DUPONT’S DEVELOPMENT AND IMPLEMENTATION OF ITS PROCESS SAFETY MANAGEMENT SYSTEM .......................................... 80  5.4.1  Building a Safety Culture .................................................................................................................................. 82  5.4.2  Using the Process Safety Management and Risk Model .................................................................................. 92    DUPONT’S PROCESS SAFETY MANAGEMENT SYSTEM CONCLUSIONS .................................................................................... 94  6  PROCESS SAFETY MANAGEMENT DEFICIENCIES ................................................................................................... 94          PROCESS HAZARD ANALYSIS EVALUATION ....................................................................................................................... 95  IMPLEMENTATION OF CORRECTIVE ACTIONS.................................................................................................................... 98  PROCESS SAFETY PRACTICES DURING TROUBLESHOOTING OPERATIONS .............................................................................. 102  MOC PRACTICES ..................................................................................................................................................... 103  6.4.1  No MOC for Heating Piping or for New Piping Alignment .............................................................................. 104  6.4.2  No MOC for New Piping Alignment to Nitrogen Relief Valves ........................................................................ 108  6.4.3  No MOC or Procedure for Vent Header Draining Operation .......................................................................... 109    LINE‐BREAKING PRACTICES ........................................................................................................................................ 113    SHIFT COMMUNICATION PRACTICES ............................................................................................................................ 117  7  ADDITIONAL FACTS, CONDITIONS, AND CIRCUMSTANCES IDENTIFIED ................................................................ 118    EMPLOYEE INCENTIVE PROGRAM ................................................................................................................................ 119  8  KEY FINDINGS ................................................................................................................................................... 124  9  SAFETY GUIDANCE ............................................................................................................................................ 125  10  RECOMMENDATIONS ........................................................................................................................................ 129      DUPONT LA PORTE, TEXAS, CHEMICAL FACILITY ............................................................................................................ 129  LOCAL 900C OF THE INTERNATIONAL CHEMICAL WORKERS UNION COUNCIL (ICWUC) OF THE UNITED FOOD AND COMMERCIAL  WORKERS (UFCW) .............................................................................................................................................................. 131  REFERENCES .............................................................................................................................................................. 132  APPENDIX A: CAUSAL ANALYSIS................................................................................................................................. 149  APPENDIX B: INCIDENT TIMELINE .............................................................................................................................. 150  APPENDIX C: ODOR COMPLAINTS FROM NOVEMBER 15, 2014 ................................................................................... 155  APPENDIX D: EMERGENCY RESPONSE TABLES ............................................................................................................ 156  APPENDIX E: DUPONT SAFETY PERCEPTION SURVEYS ................................................................................................ 161  Page 4 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX ACRONYMS AND INITIALISMS AAO acetaldehyde oxime ACC American Chemistry Council AEGL acute exposure guideline level API American Petroleum Institute CCPS Center for Chemical Process Safety CCTV closed circuit television CSB U.S. Chemical Safety and Hazard Investigation Board DCS distributed control system DOT U.S. Department of Transportation EMT emergency medical technician EPA U.S. Environmental Protection Agency EOC Emergency Operations Center ERPGs Emergency Response Planning Guidelines ERT emergency response team FBU Fluoroproducts Business Unit FEMA U.S. Federal Emergency Management Agency HAZCOM Hazard Communication Standard HAZWOPER Hazardous Waste Operations and Emergency Response Standard IBU Insecticide Business Unit ICWUC International Chemical Workers Union Council IDLH Immediately Dangerous to Life or Health LEL lower explosive limit LFL lower flammability limit LPBC Local Performance Based Compensation program MeSH methyl mercaptan MIC methyl isocyanate MOC management of change MSDS material safety data sheet Page 5 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX NAICS North American Industrial Classification System mph miles per hour NEP National Emphasis Program NFPA National Fire Protection Association NIMS National Incident Management System NIOSH National Institute for Occupational Safety and Health NRS NOx (nitrogen oxides) reduced scrubbed OSHA U.S. Occupational Safety and Health Administration OSH Act U.S. Occupational Safety and Health Act of 1970 PEL permissible exposure limit PHA process hazard analysis ppb parts per billion PPE personal protective equipment ppm parts per million PSM Process Safety Management RCMS Responsible Care Management System® RCS Relative Culture Strength REL recommended exposure limit RMP Risk Management Plan SCBA self-contained breathing apparatus SDS safety data sheet SHI Substance Hazards Index TWA Time-Weighted Average UFCW United Food and Commercial Workers Page 6 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 1 EXECUTIVE SUMMARY  On November 15, 2014, approximately 24,000 poundsa of highly toxic methyl mercaptan was released from an insecticide productionb unit (Lannate® Unit) at the E. I. du Pont de Nemours and Company (DuPont) chemical manufacturing facility in La Porte, Texas.c The release killed three operators and a shift supervisor inside a manufacturing building.d They died from a combination of asphyxia and acute exposure (by inhalation) to methyl mercaptan. The CSB determined that the cause of the highly toxic methyl mercaptan release was the flawed engineering design and the lack of adequate safeguards.e Contributing to the severity of the incident were numerous safety management system deficiencies, including deficiencies in formal process safety culture assessments, auditing and corrective actions, troubleshooting operations, management of change, safe work practices, shift communications, building ventilation design, toxic gas detection, and emergency response. Weaknesses in the DuPont La Porte safety management systems resulted from a culture at the facility that did not effectively support strong process safety performance. The highly toxic methyl mercaptan release resulted from a long chain of process safety management system implementation failures stemming from ineffective implementation of the process safety management system at the DuPont La Porte facility. The CSB investigation viewed the chain of implementation failures as starting with the flawed engineering design of the $20 million nitrogen oxides (NOx) reduced scrubbed (NRS) incinerator, a capital project implemented in 2011. DuPont La Porte had long-standing issues with vent piping to this incinerator because the design did not address liquid accumulation in waste gas vent header vapor piping to the NRS, and DuPont La Porte did not fully resolve the liquid accumulation problem through hazard analyses or management of change reviews. Instead, to deal with these problems, daily instructions had been provided to operations personnel to drain liquid from these pipes to the atmosphere inside the Lannate® manufacturing building without specifically addressing the potential safety hazards this action could pose to the workers. DuPont La Porte’s instructions did not specify additional breathing protection for this task (Section 6.4.3 and Interim Recommendations) [1, p. 18]. a 29 C.F.R. § 1910.119 Appendix A (2013). The Insecticide Business Unit (IBU) was divided into two primary insecticide product lines: Lannate®, which is DuPont’s trade name for methomyl, and agricultural products intermediates, which were used to produce insecticides and nematicides known as Vydate®, the trade name for oxamyl [1, p. 11]. c Multiple business units were located at the DuPont La Porte site. The Lannate® Unit was part of the IBU. In addition to the IBU, the facility had an Herbicides Business Unit and a Fluoroproducts Business Unit (FBU). The FBU included an anhydrous hydrogen fluoride (HF) manufacturing unit. FBU assets were sold to Chemours on July 1, 2015. d One victim on the third floor was located near a methyl mercaptan leak source on the wet end (east) side. The other two victims on the third floor were on the dry end (west) side. The IBU was further subdivided into four functional areas: the wet end, the MIC (methyl isocyanate) area, the damp end, and the dry end. The wet end contained liquid reaction equipment. The MIC area contained equipment to generate and consume the MIC intermediate. The damp end isolated and dried insecticide crystals. The dry end processed the crystals and packaged them into various products [1, pp. 10-11]. e In September 2018, the CSB produced a Winterization Safety Digest that discussed DuPont La Porte’s lack of safeguards to prevent methyl mercaptan hydrate formation [173, p. 1]. b Page 7 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX On the night of the incident, not realizing the hydrate blockage in the methyl mercaptan feed piping was cleared, workers went to drain liquid from the waste gas vent piping. They did not know that high pressure in the waste gas vent piping was related to the fact that liquid methyl mercaptan was flowing through the methyl mercaptan feed piping and into the waste gas vent piping. The chain further developed when the ineffective building ventilation system failed to be addressed after DuPont auditors identified it as a safety concern about five years before the incident. DuPont La Porte’s management system did not resolve the process safety management recommendation (i.e., did not take corrective action) to address the building ventilation system (Section 6.1 and Interim Recommendations) [1, p. 34]. The ventilation design for the manufacturing building was based on flammability characteristics and did not take into consideration toxic chemical exposure hazards, even though the building contained two highly toxic materials, chlorine and methyl mercaptan. DuPont La Porte records indicated that the manufacturing building’s dilution air ventilation design was based on providing sufficient ventilation to ensure that the concentration of flammable gases did not exceed 25 percent of the lower explosion limit (LEL).a At the time of the incident, neither of the manufacturing building’s two rooftop ventilation fans was working, despite an “urgent” work order written nearly a month earlier. Even had the fans worked, they probably would not have prevented a lethal atmosphere inside the building due to the large amount of toxic gas released (Section 5.4.1.2 and Interim Recommendations) [1, pp. 3, 33-34]. DuPont La Porte’s installation of a methyl mercaptan detection system inside the manufacturing building added another link to the chain. Neither the workers nor the public was protected by DuPont’s toxic gas detection system on the night of the incident. The building where the workers died was not equipped with an adequate toxic gas detection system to alert personnel to the presence of dangerous chemicals. First, DuPont La Porte set the detector alarms well above safe exposure limits for workers. Second, DuPont La Porte relied on verbal communication of alarms that automatically displayed on a continuously manned control board. Finally, DuPont La Porte did not provide visual lights or audible alarms for the manufacturing building to warn workers of highly toxic gas concentrations inside it. When a release caused a detector to register a concentration above the alarm limit, the toxic gas detection system did not warn workers in the field about the potential leak and the need to evacuate. Among other factors, this detection system contributed to workers’ growing accustomed to smelling the methyl mercaptan odor in the unit. Additionally, when the toxic gas detectors triggered alarms, DuPont La Porte personnel investigated potential methyl mercaptan leaks without using respiratory protection. Personnel normalized unsafe methyl mercaptan detection practices by using odor to detect the gas, further a DuPont records indicate that the manufacturing building ventilation system design code is NFPA 497, Recommended Practice for the Classification of Flammable Liquids, Gases, or Vapors and of Hazardous (Classified) Locations for Electrical Installations in Chemical Process Areas. NFPA 497 defines adequate ventilation as that sufficient to ensure that the concentration of flammable gases does not exceed 25 percent of the lower flammability limit (also referred to as lower explosion limit (LEL)) [136, p. 9]. However, there were no LEL detectors to monitor the atmospheric conditions inside the manufacturing building and alert workers of potential fire or explosion conditions. Furthermore, a methyl mercaptan concentration of 25 percent of the LEL is equivalent to 65 times greater than the 150 parts per million concentration that is considered immediately dangerous to life or health (IDLH). Page 8 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX deteriorating the importance or effectiveness of utilizing instrumentation in response to alarms signaling potential toxic gas releases (Section 3 and Interim Recommendations) [1, pp. 38-39]. In the spring of 2014, the chain propagated when DuPont La Porte’s interlock program did not require verification that interlocks that had been bypassed for turnaround maintenance were returned to service before the plant resumed operating. Because of this ineffective program, a bypassed interlock caused acetaldehyde oxime (AAO), a critical raw material, to become diluted, leading to a shutdown of the Lannate® Unit days before the November 2014 incident.a During the shutdown, water entered the methyl mercaptan feed piping and, due to the cold weather, formed a hydrate (an ice-like material) that plugged the piping and prevented workers from restarting the unit. Furthermore, DuPont La Porte did not establish adequate safeguards after a 2011 DuPont La Porte process hazard analysis identified hydrate formation in this piping, revealing yet another link in the chain (Section 6.1 and Interim Recommendations) [1, p. 22]. When the hydrate formed, lacking safeguards to control the potential safety hazards associated with dissociating (breaking up) the hydrate (such as using heat tracing to prevent the hydrate from forming a solid inside the piping or developing a procedure to dissociate the hydrate safely), DuPont workers went into troubleshooting mode (Section 6.3). Ineffective hazard management while troubleshooting the plugged methyl mercaptan feed piping formed yet another link in the chain and allowed liquid methyl mercaptan to flow into the waste gas vent header piping toward the NRS incinerator—a location where it was never intended to go (Section 6.4.1 and Interim Recommendations) [1, pp. 25-26]. As discussed earlier, DuPont La Porte did not fully resolve liquid accumulation in the waste gas vent header by the NRS incinerator. Consequently, DuPont La Porte workers dealt with the common problem of liquid accumulation in the waste gas vent header on a routine basis by draining the liquid (line breaking) without an engineered solution or without ensuring the use of safety procedures or personal protective equipment (Section 6.4.3 and Interim Recommendations) [1, pp. 18, 28]. However, when the liquid drain valves were opened on November 15, 2014, flammable and highly toxic methyl mercaptan flowed onto the floor and filled the manufacturing building with toxic vapor. Once the methyl mercaptan release began, an ineffective emergency response program at La Porte contributed to the extent and duration of the chemical release, placed other workers in harm’s way, and did not effectively evaluate whether the chemical release posed a safety threat to the public (Section 3 and Section 4). a During the AAO truck unloading, a block valve downstream of what should have been an out-of-service water dilution control valve was inadvertently opened, allowing water to flow into the tank. The water dilution system had been installed in 2006 when container shipments of 100 percent AAO were judged to be more economical than diluted AAO. AAO is now typically purchased and stored as a 50 percent solution with water. A logistical problem resulted in an unusual delivery of 50 percent AAO by tank truck instead of by railcar. Two factors contributed to the tank overflow incident. First, DuPont did not have a procedure for unloading a 50 percent tank truck of AAO. Second, the AAO water dilution control valve was supposed to interlock closed when (1) the truck-unloading pump was off or (2) the AAO tank had a high liquid level. However, the interlock function had been bypassed in the field so that water could be used to decontaminate the tank during the turnaround in spring 2014. Instrument air supply tubing was connected directly to the interlock valve actuator, bypassing the interlock activation solenoid, and forcing the valve to remain fully open. The interlock could not function because the bypass was not removed at the completion of the turnaround [1, p. 33]. DuPont defines a safety interlock as a system or function that detects an out-of-limits (abnormal) condition or improper sequence and brings it to a safe condition [1, p. 38]. Page 9 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX This chain of events illustrates DuPont La Porte’s ineffective implementation of its process safety management system. The individual components of this process safety management system exhibited cross-cutting weaknesses, resulting in the deaths of four workers and leading to the ultimate decision to close the DuPont La Porte facility. The DuPont La Porte incident is the CSB’s third investigation of a fatal DuPont incident in five years.a On September 30, 2015, the CSB issued a presentation, a safety video, and an Interim Recommendations report [1], which detailed needed safety improvements at the DuPont La Porte facility and issued recommendations for implementation before resuming operations of the Lannate® Unit [2].b Due to the amount of methyl mercaptan stored at the DuPont La Porte site, the Lannate® process was covered by the Process Safety Management (PSM) standard of the U.S. Occupational Safety and Health Administration (OSHA) and the Risk Management Plan (RMP) rule of the U.S. Environmental Protection Agency (EPA) [3]. In the Interim Recommendations, the CSB identified significant process safety management deficiencies at the La Porte facility, including delayed maintenance of safety-critical equipment, lack of written procedures, poor hazard analysis practices, lack of implementation of important inherently safer design concepts, and a lack of hazard recognition [1]. In response to the CSB findings and recommendations, DuPont committed to making changes at the La Porte facility. DuPont La Porte, however, was not able to address all of these findings and recommendations, because in the spring of 2016 DuPont announced that it would not reopen the Lannate® Unit. The company had determined that “significant changes in market conditions during the period of the shutdown [would] persist over the long term” [4] and that the cost required for the restart was “not a long-term viable and cost-efficient option for the DuPont Crop Protection business” [5]. In 2017, DuPont dismantled and removed from the DuPont La Porte facility the buildings and equipment that had been associated with its insecticide and herbicide business units, including the Lannate® Unit.c Despite the closure of the insecticide and herbicide units, the CSB determined that the DuPont La Porte incident offers important lessons for the chemical industry relating to the following areas:  Emergency Response. The emergency response efforts at the DuPont La Porte facility during the toxic chemical release were disorganized and placed at risk operators, emergency responders, and a The CSB also investigated an incident at a DuPont plant in Belle, West Virginia (three incidents that occurred in a 33-hour period over January 22–23, 2010, resulting in one fatality) [121], and another in Buffalo, New York (a single incident that occurred on November 9, 2010, resulting in one fatality and one serious injury) [122]. b This report incorporates by reference the DuPont La Porte Interim Recommendations [1]. c Although DuPont dismantled the La Porte Crop Protection business, DuPont La Porte still operates as a landlord to other companies located at the La Porte site and provides wastewater treatment and utilities, as well as owning the emergency response program. Page 10 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX potentially the public. Chemical plants need a robust emergency response program to mitigate emergencies and to protect the health of workers, emergency responders, and the public.a  DuPont’s Process Safety Management System. DuPont created its own corporate process safety management system that integrated its internal safety requirements with those of the American Chemistry Council’s Responsible Care® programb and those required by regulations under the EPA RMP rule and the OSHA PSM standard. Over the course of five years, despite implementing its corporate process safety management system, DuPont experienced three major process safety incidents. In addition to developing an integrated process safety management system, DuPont established a program to implement it. According to DuPont, the implementation of the process safety management system can be broken down into two parts: (1) Building a Safety Culture and (2) Using the Process Safety Management and Risk Model. Although DuPont’s corporate standard recommended that its sites assess their process safety culture, DuPont La Porte had not formally evaluated process safety culture at its facility before the November 2014 incident. DuPont La Porte used a proprietary Safety Perception Survey that focused on personal or occupational safety but did not evaluate or assess the process safety culture. Because the Safety Perception Survey did not reasonably evaluate all safety aspects of culture, it could not help identify the significant process safety weaknesses at the DuPont La Porte facility, leaving the site vulnerable to potential process safety incidents. While measuring worker perceptions of personal safety is important, a safety culture assessment program should also provide an effective gauge of process safety. The second tool that DuPont used to implement its process safety management system was the Process Safety Management and Risk Model, the company’s visual representation of an effective process safety management system, showing the implementation and interaction of Management Leadership and Commitment, Comprehensive Process Safety Management Program, and Operational Discipline.  DuPont La Porte’s Process Safety Management Deficiencies. The CSB identified significant process safety deficiencies at the DuPont La Porte site that contributed to the incident. DuPont’s corporate process safety management system did not identify, prevent, or mitigate these deficiencies. A company must effectively implement a process safety management system and its corresponding programs to reap the accompanying process safety benefits. a Emergency response and planning is one of five key safety topics that the CSB found needed improvement across industry nationwide; as a result, the CSB included that topic in its Drivers of Critical Chemical Safety Change program. Inadequate or poor emergency planning or response is a recurring finding in CSB investigations. At least 17 CSB incident investigations, including this one, identified emergency response deficiencies, resulting in 46 emergency response recommendations [33]. b The American Chemistry Council (ACC) is a trade group that represents chemical companies. ACC’s Responsible Care Program is a voluntary industry program. Page 11 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board  Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX DuPont La Porte’s Employee Incentive Program. The DuPont La Porte bonus structure may have disincentivized workers from reporting injuries, incidents, and “near misses.” Ensuring that employees can report injuries or incidents in accordance with the Occupational Safety and Health (OSH)Act and OSHA regulations, without fear of discrimination, retaliation, or other adverse consequence is central to protecting worker safety and health, and aiding accident prevention. This report encourages legacy DuPonta sites to strengthen employee incentive programs. It additionally presents a set of recommendations to the DuPont La Porte facility and Local 900C of the International Chemical Workers Union Council (ICWUC) of the United Food and Commercial Workers (UFCW) to improve emergency preparedness and response at the La Porte facility. Based on the CSB’s investigative findings related to emergency response, process safety management systems, and incentive programs (see Appendix A: Causal Analysis), this report presents lessons for the chemical industry in Guidance to Industry sections and summarizes them at the end of the report in Section 9: Safety Guidance. a DuPont and Dow completed a merger of equals on August 31, 2017. The combined entity operated as a holding company called DowDuPont [105]. On April 1, 2019, DowDuPont successfully completed the spin-off of its Material Science division, Dow. DowDuPont intends to separate its Agriculture and Specialty Products divisions into independent, publicly traded companies by June 2019, subject to board approval [134]. Page 12 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 2  INCIDENT DESCRIPTION  The November 15, 2014 incident occurred in DuPont La Porte’s Lannate®a Unit, which produced insecticides. Part of the Lannate® process occurred inside a closed building (the manufacturing building) (Figure 1),b where most of the methyl mercaptan release occurred.c The Lannate® process used methyl mercaptan, a toxic and flammable chemical.d,e Figure 1.  The Lannate® Manufacturing Building.  The methyl  mercaptan release occurred in the manufacturing building.  Source:  CSB.  a Lannate® is the DuPont trade name for methomyl, an insecticide [94, p. 1]. For more detail on the incident, see public meeting presentation, DuPont La Porte animation, public meeting transcript, and Interim Recommendations report [2]. b Chlorine and methyl isocyanate (MIC) were also used in the manufacturing building. c Although the bulk of the release occurred inside the manufacturing building, methyl mercaptan was also released from the nitrogen relief valves located at the methyl mercaptan railcar spots. d Symptoms of methyl mercaptan toxicity include narcosis (a state of stupor, drowsiness, or unconsciousness) and cyanosis (blue or purple coloration of the skin or mucous membranes caused by inadequate oxygenation of the blood) [50]. Methyl mercaptan is also a chemical asphyxiant [95]. Chemical asphyxiants are toxic agents that prevent red blood cells from carrying oxygen [90, p. 58]. The OSHA ceiling exposure limit is 10 parts per million (ppm). OSHA recommends that employers consider using the alternative occupational exposure limits because the agency believes that exposures above some of these alternative occupational exposure limits may be hazardous to workers, even when the exposure level complies with the relevant permissible exposure limit (PEL) [162]. The Division of Occupational Safety and Health of California (Cal-OSHA) PEL is an 8-hour time-weighted average (TWA) of 0.5 ppm, and the National Institute of Occupational Safety and Health (NIOSH) recommends a recommended exposure limit (REL) of a 15-minute ceiling limit of 0.5 ppm [163]. Methyl mercaptan is immediately dangerous to life and health at 150 ppm [50]. For methyl mercaptan, the 10-minute acute exposure guideline level (AEGL)-2 (disabling) is 40 ppm and the 10-minute AEGL-3 (lethal) is 120 ppm. According to the National Center for Biotechnology Information, “AEGL-2 is the airborne concentration (expressed as ppm or mg/m3) of a substance above which it is predicted that the general population, including susceptible individuals, could experience irreversible or other serious, long-lasting adverse health effects or an impaired ability to escape. AEGL-3 is the airborne concentration (expressed as ppm or mg/m3) of a substance above which it is predicted that the general population, including susceptible individuals, could experience life-threatening health effects or death” [130]. e Methyl mercaptan is flammable at concentrations between 3.9 percent and 21.8 percent in air [50]. Page 13 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX The sections below discuss the eventsa leading to the methyl mercaptan release and the subsequent emergency response. METHYL MERCAPTAN RELEASE  On Monday, November 10, 2014, an inadvertent chemical dilution caused operating difficulties that forced a shutdown of DuPont’s Lannate® Unit.b In response, DuPont La Porte personnel adjusted the unit’s control system to resume operations. On Wednesday, November 12, 2014, operators tried to restart the Lannate® process. During the shutdown, the methyl mercaptan piping to the reaction section of the process had become plugged due to the formation of a clathrate hydrate (hydrate),c halting restart. At that time, operators did not know the source of the plugging and began troubleshooting the process to try to clear the piping, unaware that the solid hydrate had formed. Two days later, on Friday, November 14, 2014, the troubleshooting efforts to clear the plugging were still ongoing. That morning, the Lannate® Unit Technical Team (Technical Team), composed of engineers and other employees experienced in the process, met with operations personnel to discuss troubleshooting options to clear the plugging. This meeting identified the likely scenario that water had entered the methyl mercaptan system, forming a solid hydrate. DuPont’s methyl mercaptan technical standard identifies the potential to form a hydrate at low temperatures. The technical standard states that methyl mercaptan “will form a hydrate with water, which is a solid below 40 deg F [degrees Fahrenheit] per information provided by a [methyl mercaptan] supplier.” Based on this understanding, the Technical Team asked that operators put hot water on the outside of the methyl mercaptan piping, under the insulation, to warm the piping and its contents to break up (dissociated) the plugging. The Technical Team also realized that when heated, methyl mercaptan would expand, requiring a safe place to vent to avoid over-pressuring the piping. To address this concern, operations personnel opened valves between the methyl mercaptan piping and a waste gas vent header (vent header), not recognizing that this alignment created a The sequence of events is also presented in   Appendix B: Incident Timeline. b The chemical involved in this dilution was acetaldehyde oxime (AAO). Additional information about the AAO dilution portion of the incident is in the CSB DuPont La Porte Interim Recommendations [1, pp. 20-21]. c At low temperatures (≤ 52 degrees Fahrenheit (°F)), water and methyl mercaptan form a solid, ice-like material called methyl mercaptan clathrate hydrate [72]. Temperatures in the Houston area for the 24 hours preceding the incident averaged approximately 40°F and had been consistently below 55°F since Tuesday, November 11, 2014. Although the potential for methyl mercaptan hydrate formation had been identified in DuPont’s methyl mercaptan technical standard and in process hazard analyses years earlier, DuPont never implemented safeguards, such as heat tracing, or developed a procedure to dissociate the hydrate safely [1, p. 22]. d Methyl mercaptan clathrate hydrate dissociates back to the liquid phases of methyl mercaptan and water at approximately 52°F [72]. Page 14 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX a pathway for liquid methyl mercaptan to eventually release from the piping inside the manufacturing building when drain valves were opened. In addition, when operations personnel opened other valves while troubleshooting, such as drain valves, methyl mercaptan was released to the atmosphere, causing a strong methyl mercaptan odora that could be smelled by site personnel. During troubleshooting, methyl mercaptan was released both outside and inside the manufacturing building, triggering 32 methyl mercaptan gas alarmsb on the control panel throughout the 17 hours preceding the incident. Although methyl mercaptan is a toxic and flammable chemical, and at high enough concentrations lethal, some operations personnel did not respond in accordance with the nature of the emergency circumstances because they associated the alarms with the ongoing troubleshooting efforts. They did not perceive the methyl mercaptan alarms as signifying a serious hazard because they had normalizedc the methyl mercaptan odor within the Lannate® Unit, as well as the detector alarms. Early in the morning on Saturday, November 15, 2014, the hot water from the hoses warmed the hydrate plugging, causing it to dissociate, clearing the plugging. Due to the valve alignment, liquid methyl mercaptan flowed into the waste gas vent header, located inside the manufacturing building [1, pp. 25-26]. The vent header, however, was not intended nor designed for liquid methyl mercaptan. At 2:51 am, alarms began to sound on the control system indicating high pressure in equipment inside the manufacturing building. Operations personnel did not realize that liquid methyl mercaptan was causing the high pressure. Instead, they attributed the high pressure to a common, long-standing problem with process condensate, which DuPont La Porte personnel believed to be mostly water, accumulating in the vent header piping [1, p. 28]. The Lannate® control room board operator (Board Operator) contacted the night shift supervisor (Shift Supervisor) and another operator (Operator 1) separately, asking them to help troubleshoot the high-pressure situation. Manually draining the vent header inside the manufacturing building, a long-standing practice, was the typical approach used to remove process condensate from the vent header, as it successfully reduced system pressure many times a Methyl mercaptan has a low odor threshold. It gives off a smell like rotten cabbage. It can be smelled at only two parts per billion (ppb) [80, p. 1]. OSHA’s permissible exposure limit (PEL), however, is 10 parts per million (ppm), which is 5,000 times the minimum concentration that can be smelled. The low odor threshold of mercaptans makes them useful as fuel gas odorants [80, p. 2]. b DuPont used hydrogen sulfide (H2S) detectors to identify methyl mercaptan. The alarms activated when the detectors sensed the hydrogen sulfide equivalent of 25 ppm methyl mercaptan. Twenty-five ppm is the ERPG-2 level for methyl mercaptan (see Section 4.8) [82, p. 27]. This level “is the maximum airborne concentration below which nearly all individuals could be exposed for up to 1 hour without experiencing or developing irreversible or other serious health effects or symptoms which could impair an individual’s ability to take protective action.” Emergency responders use ERPG-1, -2, and -3 concentration data to determine how to protect the public [167]. DuPont records indicate that the device manufacturer stated the detector should be capable of detecting methyl mercaptan within 1 ppm [1, p. 37]. c Normalization of deviance is a phenomenon in which individuals or work teams gradually accept a lower standard of performance until the lower standard becomes the norm. It is typically the result of slowly changing and eroding conditions over time [79, p. 4]. Page 15 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX in the past.a The Shift Supervisor and Operator 1 each went separately to the manufacturing building, likely in order to drain liquid from the vent header piping manually. Sometime between 3:01 am and 3:13 am, a worker (likely the Shift Supervisor)b manually opened two sets of drain valves on the vent header piping, located on the third floor of the manufacturing building (Figure 2). But instead of the expected condensate composed mostly of water, the liquid methyl mercaptan that had filled the piping escaped out of the valves, vaporized, and killed the Shift Supervisor. Between 3:24 am and 3:26 am, three methyl mercaptan detectors inside the manufacturing building sensed at least 25 parts per million (ppm)c of methyl mercaptand and triggered alarms at the control panel (Figure 3). The Board Operator—still focused on reducing the high pressure—did not realize a major chemical release was occurring inside the manufacturing building (Section 3). a In 2011, DuPont installed a NOx (nitrogen oxides) reduced scrubbed (NRS) incinerator system. The waste gas vent header piping to the NRS incinerator was designed without sufficient consideration of liquid accumulation. It contained low points where liquid could accumulate, and there was no engineered equipment provided, such as a knock-out drum, to remove liquid safely from the waste gas vent header piping system. The liquid accumulation in the piping would create pressure in process equipment. Pressure buildup within the equipment was resolved by manually draining liquid from the waste gas vent header. See Section 6, Process Safety Management Deficiencies, and DuPont La Porte, Texas Chemical Facility Toxic Chemical Release: Interim Recommendations [1, p. 18]. b The Shift Supervisor was most likely the worker who opened the valves, based on both the location in the manufacturing building where he was recovered and information learned in interviews that suggested he was the worker most likely to have opened those specific valves to drain the vent header piping. c The methyl mercaptan detectors were evaluated post-incident. Although the detectors inside the building have the ability to span 0–50 ppm, these detectors were set to span 0–25 ppm. Post-incident, the span was increased to 50 ppm. Additionally, information from the methyl mercaptan detectors inside the manufacturing building displayed only on the distributed control system (DCS) monitor and was not recorded by the site’s DCS and data historian [1, p. 37]. CSB investigators, however, were able to obtain information about the alarms associated with the detectors from alarm logs. d The methyl mercaptan detectors alarm at 25 ppm—well above the NIOSH recommended exposure limit (REL) of 0.5 ppm and the OSHA enforceable PEL ceiling limit of 10 ppm. OSHA recommends that employers consider using the lower alternative occupational exposure limits because the agency believes that exposures above some of these alternative occupational exposure limits may be hazardous to workers, even when the exposure levels comply with the relevant PELs [149]. The Cal-OSHA permissible exposure limit (PEL) is an 8-hour time-weighted average (TWA) of 0.5 ppm, and the NIOSH REL is a 15-minute ceiling limit of 0.5 ppm [159], [50]. Page 16 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 2.  Waste Gas Vent Header Piping on the Third Floor of the Manufacturing Building.  This portion, where several waste gas  sources come together, is referred to as the waste gas vent header.  Waste gas from this portion of the vent header traveled up to  reach the NRS incinerator, a piping configuration that created a low spot where liquid accumulated.  To remove the liquid during waste  gas vent header piping high‐pressure events, operators were instructed to open valves (yellow circle) and drain the system through a  hose routed to a floor drain located near a safety shower.  The floor drain is connected an open trench‐type sump on the first floor.  At  the time of the incident, a second set of drain valves (red circle) were also opened directly to the floor inside the manufacturing  building.  Source: CSB.  Page 17 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 3.  Depiction Showing Where Drain Valves Were Opened.  These drain valves released toxic methyl mercaptan into the  manufacturing building.  Methyl mercaptan detectors on the first and fourth floors detected high concentrations of methyl  mercaptan shortly after the release began.  This depiction is a simplified graphic of the manufacturing building (see Section 4.5) and  does not show the location of Operator 1.  Source: CSB.  At about 3:30 am, Operator 1 made an urgent call for help over the radio. Various personnel interpreted her communication in different ways, generally as either “We need help!” or “I need help on the fourth floor!” The Board Operator tried to get more information through radio communication, but neither the Shift Supervisor nor Operator 1 ever responded [1, p. 29]. Two operators (Operator 2 and Operator 3) who were in the control room and heard the distress call ran to the manufacturing building to help. Another operator (Operator 4) saw Operator 2 and Operator 3 running to the manufacturing building, and he followed them. None of these operators knew of the major release of toxic methyl mercaptan inside of the manufacturing building; therefore, they did not wear any respiratory protection when they ran into the manufacturing building. The manufacturing building lacked automatic visual or audible Page 18 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX alarms to alert fieldworkers or prevent them from entering a potentially toxic atmosphere (Section 3). In addition, the building’s ventilation fans were not working, a situation that, in DuPont’s operating procedures, required “restricted access” to the building. But DuPont La Porte’s procedures did not define “restricted access” or require that operators wear respiratory protection in the building when access was restricted, even though a toxic chemical release could accumulate in the unventilated building [1, p. 29]. Operator 2, Operator 3, and Operator 4 each entered the south stairway and took different a route inside the manufacturing building to try to find Operator 1 (Figure 4). Operator 2 went to the third floor, where he was fatally overcome by methyl mercaptan [1, p. 29]. Operator 4 went to the second floor. He walked about 10 feet and hit what he later described as a “wall” of methyl mercaptan, but he managed to retreat to the stairwell [1, p. 29]. Operator 3 went to the fourth floor but did not find anyone. He then announced on the Lannate® Unit’s public-address system that he did not see anyone on the fourth floor. The Board Operator responded that the Shift Supervisor and Operator 1 may be on the third floor [1, p. 29]. Operator 3 then began to feel light-headed. He made his way to the stairwell and lost consciousness while descending from the fourth floor [1, p. 29]. Page 19 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 4.  Depiction of Paths Taken by Operator 2, Operator 3, and Operator 4 When Whey Responded to Operator 1’s Distress Call.  Locations of the deceased Shift Supervisor and Operator 1 are also shown.  Operator 2 was killed by methyl mercaptan exposure,  and Operator 3 and Operator 4 were exposed to high concentrations of methyl mercaptan.  This figure shows the opposite side of  the manufacturing building from the view in Figure 3.  Source: CSB. The Board Operator then tried to reach the Shift Supervisor, Operator 1, and Operator 2 over the radio, but they did not respond. An operator in the control room, Operator 6a (the brother of Operator 2), then grabbed three 5minute escape respirators. Other operators in the control room warned him not to enter the manufacturing building because they did not know what was going on or where the nonresponsive operators were. Operator 6, however, took the escape respirators and rushed to the manufacturing building [1, p. 29]. At about 3:40 am, Operator 6 encountered Operator 4 in the south stairway of the manufacturing building and put an escape respirator on him (Figure 5). The breathing air helped Operator 4 recover, and he exited the manufacturing building safely. A worker—likely Operator 6—then manually activated the manufacturing building fume release alarm, an alarm intended to alert area workers of a toxic chemical release in the building. Operator 6 then went to the third floor of the manufacturing building. At some point after helping Operator 4, a Operator 6 was a board operator for another process in the Lannate® Unit. Page 20 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Operator 6 retrieved a self-contained breathing apparatus (SCBA) from inside the manufacturing building. He tried to rescue his brother (Operator 2) by putting one of the escape respirators on his face. Operator 6 was then fatally overcome by methyl mercaptan before he could connect his own respirator mask to his SCBA tank. Figure 5.  Depiction of the Path Taken by Operator 6 Inside the Manufacturing Building.  Operator 6 helped Operator 4 escape by  providing him with a respirator.  Operator 6 was fatally overcome by methyl mercaptan when trying to rescue his brother,  Operator 2, on the third floor.  Source: CSB. EMERGENCY RESPONSE  At about 3:50 am, the Board Operator called for the plant emergency response team (ERT)a to respond to the manufacturing building, stating over the intercom system, “We need rescue people, and there’s people missing.” a At the time of the incident, three companies (DuPont, Kuraray, and Invista) operated at the La Porte site and shared one ERT for the site, which had members from each company and was managed by DuPont. The ERT members worked other, primary jobs for one of the three companies (such as unit operators), and they responded as ERT members during emergencies. The site’s ERT staffing included about 60 employees. Section 4.1 discusses the composition of the ERT in more detail. Page 21 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX This announcement started a chain of miscommunication. To the ERT, a request for “rescue” meant specifically high-anglea or confined-space rescue. Therefore, the ERT responded to the request for help by gathering only technical rescue gear (e.g., harnesses and ropes), not knowing that there was a major toxic chemical release (Section 4.3.1) [1, p. 30]. At 3:57 am, the Board Operator called the security guard at the main entrance to ask the guard to call 9-1-1. The Board Operator communicated only that workers were missing and requested rescue. The guard, in turn, gave limited information to the 9-1-1 operator: 9-1-1 Operator: Harris County 911. What is the location of your emergency? Caller: This is DuPont on Strang Road…. They had an emergency out here. They got four people missing.… I was just called by the Lannate® supervisor [Board Operator] that he has four people missing. 9-1-1 Operator: So, are they somewhere there, or you don’t know where they’re at? Caller: I don’t know, ma’am. I am up in the front. I just got the phone call. 9-1-1 Operator: Okay, you don’t know their names or anything? Caller: No ma’am, just they needed rescue. 9-1-1 Operator: They need rescue? Caller: Yes ma’am. 9-1-1 Operator: And you don’t know their names, no descriptions, nothing? Caller: No ma’am. I just know that they’re workers. At 3:58 am, site emergency responders from the ERT arrived at the scene with only their technical rescue gear. They quickly realized that there was an ongoing chemical release and that they needed additional personal protective equipment (PPE). At 4:05 am, the Incident Commander, who had responded to the initial rescue request, called for the ERT to come to the scene with bunker gearb and SCBAs—the PPE necessary to enter an area with a toxic and flammable chemical release. When ERT members attempted to start the mini-pumper truck that contained SCBAs and radios, however, it would not start and could not make it to the incident scene (Section 4.3.2).c a A high-angle rescue uses a variety of technical rope rescue techniques to retrieve injured or otherwise incapacitated persons on terrain at slopes of 60º or greater. Victims are hoisted from one level to another using ropes, pulleys, harnesses, belay devices, and various hauling implements [120]. b “Bunker gear” is a common term for firefighting protective clothing [96]. c The mini-pumper truck was located more than 2,000 feet from the control room. Page 22 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX The Incident Commander also requested safety data sheets for chemicals processed inside the manufacturing building, including methyl mercaptan. The ERT, however, did not initially use air monitoring equipment to determine what chemical was leaking. According to DuPont La Porte’s Lannate® emergency response plan,a area personnel control air monitoring equipment for their unit. Because the Shift Supervisor (Process Coordinator) who oversaw process operations was a victim of the incident and was not available to fulfill the assigned role of providing chemical hazard and unit-specific information about each of the processes to the ERT during an emergency, air monitoring was delayed during the early hours of the incident. Meanwhile, site personnel recognized the release by odor and believed that methyl mercaptan was the chemical leaking inside the building.b At around 4:10 am, the Incident Commander established a hot zone around the manufacturing building. The hot zone’s boundaries, however, were not clearly communicated or marked by the ERT (Section 4.7). At 4:12 am, an emergency operations center coordinator made a second 9-1-1 call, but he had not yet been informed by ERT personnel what chemical was leaking, or whether the leak posed a public threat, and was therefore unable to relay this critical information to the 9-1-1 operator: 9-1-1 Operator: Harris County 911. What is the location of your emergency? Caller: This is in La Porte, Texas.… We have an emergency at the DuPont Plant in La Porte.… We have a possible casualty five, is what my medics are telling me. We have some injuries. We need La Porte EMS for transportation.… 9-1-1 Operator: Okay, sir. How did this happen? Is it chemical-related? Caller: I am not certain. I just know … they’re doing a rescue—they’re doing a rescue right now. We have some injured people. I’m not sure if there’s any chemicals involved or not. I am just relaying the message. … Caller: I have just got some more information. We have five people unaccounted for. We have had a chemical release … I am not sure what chemical, in one of our buildings. Five people are unaccounted for. Rescue team is trying to reach them at this point. That’s all the information I can give you right now. a The Lannate® Unit emergency planning and response manual was developed to comply with the OSHA Process Safety Management of Highly Hazardous Chemicals standard, 29 C.F.R. § 1910.119(n) (2013). Under this standard, facilities are required to develop an emergency action plan and potentially an emergency response plan (29 C.F.R. § 1910.38 (2002); 29 C.F.R. §§ 1910.120 (a), (p), and (q) (2013)). An emergency response plan under the Hazardous Waste Operations and Emergency Response (HAZWOPER) standard is required if an internal emergency response team is responding to or has substantial threat of responding to releases of hazardous substances (29 C.F.R. §§ 1910.120 (a)(2)(iv) and (q)(1) (2013)). Because the La Porte site had an internal emergency response team that responded to releases of hazardous substances, HAZWOPER required that the site have an emergency response plan. b Using smell to locate or characterize sources of a release is a poor practice. Chemicals have different physical properties, including olfactory fatigue, no odor, and toxicity if inhaled. Page 23 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX … 9-1-1 Operator: Okay sir. And can you tell me, is this any risk to the public? Is it going to be a possible escaping from your premises? Caller: No ma’am, it is not. 9-1-1 Operator: No threat? Caller: No ma’am. … 9-1-1 Operator: And we don’t know what kind of chemical it is? Caller: No ma’am. As soon as I find out, I will let you know. I’ve got my team trying to determine that right now. At about 4:15 am, ERT members assigned an operator (Operator 7) to bring them SCBAs because the ERT mini-pumper truck holding SCBAs could not respond to the scene. DuPont stored additional SCBAs outside a building closer to the manufacturing building. Assisting the ERT as requested, Operator 7 went alone to retrieve these SCBAs and unknowingly walked into the path of the methyl mercaptan being released from the manufacturing building (Figure 6).a The hot zone was not clearly identified or communicated to plant personnel. As a result, when Operator 7 went to retrieve the SCBAs, she was unaware that she was entering a potentially hazardous area. When Operator 7 went outside, though unable to smell methyl mercaptan, she felt ill.b Realizing that she might be in a dangerous position, she retreated to the control roomc (Section 4.7). Figure 6.  Depiction of Path Taken by Operator 7 to Retrieve  SCBAs for ERT When the Mini Pumper Truck Would Not Start.   The hot zone was not controlled adequately to ensure that  personnel did not enter a hazardous area.  Source: Google  Earth, with annotations by CSB. a At 3:50 am, at Ellington Field, Texas (about 10.5 miles southwest of the DuPont La Porte facility), the wind was blowing from the northeast at 8.1 miles per hour (mph) [100]. b These symptoms are consistent with methyl mercaptan exposure. Olfactory fatigue is known to occur with exposure to methyl mercaptan, resulting in the exposed person not being able to detect the chemical by smell. Inhaling methyl mercaptan can also induce headaches, dizziness, nausea, vomiting, coma, and death [80]. c Operator 7 believes she was exposed to a high concentration of methyl mercaptan, but she was able to return to safety. Page 24 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX At about 4:20 am, Operator 3 regained consciousness and managed to exit the manufacturing building [1, p. 29]. ERT members saw him near the manufacturing building and escorted him to safety. Beginning at about 4:25 am, the first ERT entry team entered the manufacturing building. Although the ERT used breathing air (SCBAs) to protect themselves from toxic exposure, they did not monitor the atmosphere during this building entry to assess explosive hazards. Portions of the building likely had an explosive atmosphere during the incident (Section 4.4.1), and air monitoring could have alerted personnel to this potential hazard during this entry. The ERT’s post-incident critique stated “metering and [air] monitoring equipment were maintained by the unit. Since the technical knowledge basea was incapacitated, there was a delay in establishing [air] monitoring.” During the building entry, an ERT member found drain valvesb from the waste gas vent header on the third floor open, with a gas (later identified as methyl mercaptan) flowing from them. The ERT members also found the Shift Supervisor on the floor of the third story, about 30 feet north of the drain valves. They also found Operator 6 next to his brother (Operator 2), and both men were unresponsive. Operator 2 had a 5-minute escape respirator bag over his head. This respirator was one of the three escape packs brought into the building by Operator 6. Operator 6 had a 30-minute SCBA air bottle in front of him and the mask on his face, but he had not connected the mask to the air bottle. Methyl mercaptan likely incapacitated Operator 6 while he was trying to don his SCBA [1, p. 31]. A postmortem examination determined that the Shift Supervisor, Operator 2, and Operator 6 were killed by asphyxia through exposure to methyl mercaptan. During the release, the ERT used a plume dispersion model to predict the methyl mercaptan plume (cloud) size and concentration profile releasing from the manufacturing building. To predict the methyl mercaptan plume effectively, the modeling software required an estimate of the methyl mercaptan release rate. The emergency response personnel, however, did not have an available method to estimate the methyl mercaptan release rate. Lacking other data sources and based on the perceived low odor of methyl mercaptan outside the manufacturing building, they estimated a release rate of 10 pounds per hour. With this input, the model predicted that methyl mercaptan would not leave DuPont property at concentrations harmful to the public. The CSB determined, however, that the emergency response personnel greatly underestimated the release rate. It was not possible for the CSB to determine the exact off-site methyl mercaptan concentration immediately after the release; however, the CSB concluded that the total release of about 24,000 pounds of methyl mercaptan created the potential for a dangerous concentration of methyl mercaptan to have been released off-site (Section 4.8.1). Beginning at 5:08 am, three external firefighter groups arrived on-site, and at 5:15 am the ERT conducted its second entry into the manufacturing building. On the third floor, an ERT responder closed the open drain valves from which he had observed vapor (methyl mercaptan) escaping. a b The Shift Supervisor who served as the Process Coordinator—that is, the technical liaison—was killed by the release. These drain valves were not closed at this time. Page 25 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX At about 5:40 am, emergency responders established and barricaded the hot zone. Until this point, the hot zone had not been marked clearly. At 5:57 am, the Incident Commander requested Harris County personnel to perform air monitoring off-site. At 6:02 am, approximately three hours after the release started, DuPont La Porte personnel turned off the methyl mercaptan storage tank pump, which had been operating since the last startup attempt, before the release began (Figure 7). Shutting off this pump significantly slowed the methyl mercaptan release rate (Section 4.6).a Figure 7.  Location of Methyl Mercaptan Pump.  The pump was turned off nearly three hours after the release began.  Source:  Google Earth, with annotations by CSB.  From 6:10 am to 9:30 am, the ERT conducted the third, fourth, and fifth ERT building entries to search for Operator 1, who was still missing. Due to the complex layout and emergency responders’ lack of knowledge of the manufacturing building, the emergency responders had difficulty finding Operator 1. They had no maps to reference during their search, and DuPont La Porte did not have cameras in the manufacturing building to a The design of the nitrogen relief valves at the railcar loading and unloading stations did not consider a scenario in which the relief valves could be lined up with the discharge of the methyl mercaptan pumps, as they were at the time of the incident. The methyl mercaptan pump discharge pressure (90 pounds per square inch gauge (psig)) was higher than the set pressure (80 psig) of these nitrogen relief valves. Therefore, the methyl mercaptan pump would cause the relief valve to open and release the highly toxic and highly flammable chemical to the atmosphere. When tested post-incident, three of the four nitrogen rupture discs burst, and all four of the nitrogen relief valves leaked. Because the rupture discs and relief valves would not hold pressure when tested, an atmospheric release of highly toxic and highly flammable liquid methyl mercaptan likely occurred during the incident through this relief system that was intended to release and disburse nitrogen vapor [1, p. 46]. A rupture disc is a non-reclosing pressure relief device, a type of emergency relief device. According to the Center for Chemical Process Safety (CCPS), an emergency relief device is designed to open during an emergency or during abnormal conditions to prevent rise of internal fluid pressure in excess of a specified value. The device also may be designed to prevent excessive internal vacuum [110]. For more information on pressure relief devices, see “An Overview of Pressure Relief Devices” [111, pp. 20-27]. Page 26 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX provide a view of the different floors of the building (Section 4.5). To facilitate the search efforts, the ERT assigned area operators—including the Board Operator—to draw building maps to help emergency responders navigate the manufacturing building. During this time, ERT responders continued closing valves throughout the Lannate® Unit to stop the release of methyl mercaptan. At 6:14 am, a Harris County Sheriff’s sergeant noticed an “intense smell” in Deer Park (west of La Porte), and at 6:30 am, he communicated, “the odor on [Highway] 225 [is] strong” (Figure 8). At 8:07 am, Harris County’s Hazardous Materials Team performed off-site air monitoring to measure the concentration of toxic methyl mercaptan outside of the DuPont fence line. Harris County’s instrumentation did not detect methyl mercaptan in the air (Section 4.8.4). At 10:07 am—seven hours after the release began—DuPont activated the methyl mercaptan tank emergency isolation valve to isolate the methyl mercaptan storage tank completely from the leaking process piping (Section 4.6). Between 11:15 am and 11:55 am, during the sixth ERT entry into the manufacturing building, Operator 1 was found unresponsive in the north stairwell of the manufacturing building. The coroner later determined that Operator 1 had died from asphyxia and acute exposure to methyl mercaptan. Figure 8.  Locations Where a Sheriff’s Sergeant Reported Strong Methyl Mercaptan Odor During the Incident.  Source: Google Earth, with  annotations by CSB.  Page 27 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 3 DELAYED AWARENESS OF TOXIC CHEMICAL RELEASE BY OPERATIONS  Highly toxic methyl mercaptan was released into the manufacturing building for about 40 minutes before operations personnel in the control room realized the extent of the emergency in the building, and for more than six additional hours before the release was fully controlled. The CSB identified factors that led to this delay in recognizing a major chemical release, including: 1. The Board Operator was focused on process equipment high-pressure events that he believed were critical. Operations personnel became aware of the high-pressure events when insecticide manufacturing equipment venting into the waste gas vent header began to exhibit high-pressure alarms. At this point, operations personnel shifted their attention from the problem of plugging in the methyl mercaptan feed system to the current problem of high pressure in the waste gas vent header piping to the NRS incinerator. DuPont La Porte operations staff did not correlate the highpressure problem with the troubleshooting efforts to unplug the methyl mercaptan feed piping through hydrate dissociation. Rather, they attributed the high-pressure events to the routine problem of liquid accumulation in the waste gas vent header piping. The Board Operator directed personnel to help troubleshoot the high-pressure problem [1, p. 28]. The operating pressure of various pieces of process equipment inside the manufacturing building, however, continued to increase, in some equipment exceeding the high-scale detection limits of process instrumentation. The Board Operator was concerned about the potential for equipment overpressure and the release of toxic chemicals to the atmosphere outside the manufacturing building. Even though methyl mercaptan detectors were beginning to alarm, the Board Operator either was unaware of them or had normalized them, not realizing the alarms were alerting him that a significant release had started to occur inside the building. Unaware that a significant methyl mercaptan release had begun, the Board Operator remained focused on controlling the high pressure he was observing inside the equipment.a 2. Lannate® Unit personnel accepted methyl mercaptan releases and the associated alarms as normal because of methyl mercaptan’s low odor threshold,b a history of frequent alarms, and a lack of hazard recognition that methyl mercaptan could be lethal. Methyl mercaptan is a highly toxic chemical, but its odor can be detected at very low concentrations that are not a Although the Board Operator acknowledged the methyl mercaptan alarms on the control system during the incident, afterwards he did not recall that any methyl mercaptan detectors inside the manufacturing build had alarmed. b Odor threshold, in general, is the lowest concentration of a gas or other material’s vapor that can be detected by odor. Odor threshold values are not fixed physiological parameters or physical constants but instead statistical points representing the best estimated value from a group of individual responses [112, p. 2]. The odor threshold for methyl mercaptan is approximately two parts per billion (2 ppb). However, olfactory fatigue is known to occur with methyl mercaptan, causing the exposed person no longer to be able to detect the chemical by smell. As a result, odor may not provide adequate warning of hazardous concentrations [80, p. 1]. Page 28 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX considered a health risk to people.a Additionally, the Lannate® Unit used methyl isocyanate (MIC)b and chlorine,c which are generally accepted as being more hazardous (toxic) than methyl mercaptan.d As a result, even though Lannate® Unit personnel were trained on methyl mercaptan toxicity hazards,e personnel at the site became accustomed to smelling methyl mercaptan daily without experiencing negative health effects, leading workers to become less wary of methyl mercaptan leaks and the risks associated with them. According to one DuPont worker, there was a perception that methyl mercaptan (which workers called “MeSH”) was not dangerous: And I smell MeSH all the time … but it never … I smelled MeSH, but I never felt I couldn’t breathe. Like whether it’s, there’s—whether it’s a small leak or anything, it just never—I didn’t think MeSH was that dangerous. I thought it, you know, but it is. During the troubleshooting efforts before the major release began, smaller releases of methyl mercaptan had caused the site to have a strong odor of methyl mercaptan. Therefore, when the major release began, site personnel did not realize there was a major release, in part because they were accustomed to smelling the chemical. 3. Personnel were not wearing personal methyl mercaptan detectors. DuPont La Porte had some personal methyl mercaptan detectors available, but they were never issued to operators to wear in the field. Such detectors could have warned Operator 2, Operator 3, and Operator 4 (personnel who a Methyl mercaptan gives off a smell like rotten cabbage. It can be smelled at only 2 parts per billion [80, p. 1]. OSHA’s permissible exposure limit, however, is 10 parts per million, which is 5,000 times the minimum concentration that can be smelled. The low odor threshold of mercaptans makes them useful as fuel gas odorants [80, p. 2]. b MIC is a raw material used in the production of insecticides at La Porte, including the Lannate® process. The 1984 MIC release at the Union Carbide insecticide plant in Bhopal, India, that killed thousands of people is an example of the extremely toxic properties of MIC [148]. For more information, see Reflections on Bhopal after Thirty Years [148]. c DuPont’s corporate standard for the management of highly toxic materials identifies both methyl mercaptan and chlorine as highly toxic. DuPont considers a material to be highly toxic if it is handled, stored, or shipped in a sufficient quantity that a credible event could result in a concentration of Emergency Response Planning Guidelines (ERPG)–3, and if it has a Substance Hazards Index (SHI) greater than or equal to 4,000. This level “is the maximum airborne concentration below which nearly all individuals could be exposed for up to 1 hour without experiencing or developing life-threatening health effects.” Emergency responders use ERPG-1, -2, and -3 concentration data to determine how to protect the public [167]. DuPont determines the SHI using vapor pressure and ERPG-3 data for each chemical. Using this approach, DuPont derived an SHI of 19,855 for methyl mercaptan and 385,197 for chlorine. d Methyl mercaptan’s threshold quantity (5,000 pounds) that presents the potential for a catastrophic event, under PSM, is larger than that of chlorine (1,500 pounds) or MIC (250 pounds), making it less hazardous than either of the other two chemicals (29 C.F.R. § 1910.119, Appendix A). e DuPont La Porte used computer-based training to communicate hazards about methyl mercaptan (i.e., to perform hazard communication, or HAZCOM), consisting of methyl mercaptan hazard information and a quiz. The information gives some of the toxic exposure limits for methyl mercaptan. Additionally, the training details that gross exposure can result in death, but it does not specify the value at which the chemical is immediately dangerous to life and health. The training advises workers to use at a minimum an SCBA when responding to a methyl mercaptan alarm, and not to use smell to detect leaks because methyl mercaptan can cause olfactory fatigue, causing anyone exposed to it to stop perceiving an odor within minutes. If there is a leak, personal protective equipment (PPE) is supposed to be upgraded. Upgraded PPE also applies to line breaking, and it includes a chemical suit with taped sleeves and cuffs, chemical hood, chemical boots, chemical gloves, and an SCBA. Page 29 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX initially responded to Operator 1’s distress call) of the high methyl mercaptan concentration inside the manufacturing building. 4. DuPont La Porte did not have audible or visual alarms on or in the manufacturing building to alert field personnel of a methyl mercaptan release automatically. DuPont La Porte relied on verbal communication of alarms, which automatically displayed on a continuously manned control board. The delay in recognizing this event as a major toxic chemical release that was becoming a deadly concentration of methyl mercaptan inside the building contributed to the response of Operator 2, Operator 3, and Operator 4 to Operator 1’s distress call without respiratory protection. According to DuPont La Porte’s Lannate® emergency planning and response manual, if a sensor detected a methyl mercaptan leak and initiated an alarm, personnel were required to notify a shift supervisor, sound a plantwide fume release alarm, and wear appropriate PPE (including SCBA) during any attempts to stop the leak. The manufacturing building, however, including the building’s overall construction, detectors, and alarms, was not designed such that personnel could be readily notified of a major chemical release in the manufacturing building. Without being made aware of the major chemical release inside the building, Operator 2, Operator 3, and Operator 4 entered without respiratory protection. As a result, Operator 2 was killed by methyl mercaptan exposure, and Operator 3 and Operator 4 were exposed to dangerous concentrations of methyl mercaptan. GUIDANCE TO INDUSTRY  It is crucial that workers understand when an emergency is occurring. OSHA’s Hazardous Waste Operations and Emergency Response (HAZWOPER) standard requires that an emergency response plan address emergency recognition and prevention.a For this standard to be effective, companies should ensure that their systems associated with emergency recognition and prevention, such as alarms and training, can inform workers of hazards and emergencies. For example, audible or visual alarms can automatically relay to personnel in the field information about a hazardous condition—such as a release of a toxic chemical. Systems like those implemented at DuPont, on the other hand, where alarms displayed only on an operator’s control board and still needed an operator to verbally communicate alarms, have inherent potential delays. The Center for Chemical Process Safety’s book Continuous Monitoring for Hazardous Material Releases provides guidance on the use of such alarms: There are occasions when process equipment must be located indoors due to weather-related or quality control issues. Combustible [and toxic] gas detection should be provided in these buildings…. This detection should be configured to:  a Send an alarm signal to a continuously manned location; 29 C.F.R. § 1910.120 (q)(2)(iii) (Feb. 8, 2013). Page 30 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX  Activate visible and audible alarm devices on the exterior of the building at each entranceway and within the structure. The devices within the structure should be configured using the guidance for fire alarm devices, as provided in NFPA 72, National Fire Alarm and Signaling Code®; and  Include a local means of silencing the alarms [6, pp. 63-64]. Training is another important way to address emergency recognition and prevention. Under OSHA’s Hazard Communication (HAZCOM) standard, companies are required to provide information to employees about the hazardous chemicals that they may be exposed to at work, including through training.a Companies should ensure that, in addition to having access to chemical information, employees understand the hazards of all chemicals they are working with and may be potentially exposed to if there is a release. In cases of multiple hazardous chemicals, such as MIC, chlorine, and methyl mercaptan, it is important that companies effectively train workers on the hazards of each chemical. This training is important for workers to help ensure they have a working knowledge of chemical hazards. Working knowledge of the hazards of all chemicals they are working with and may be potentially exposed to if a release occurs can improve employees’ recognition of emergency conditions and help them prevent major accidents in the manner that an emergency response plan intends. 4 EMERGENCY RESPONSE OPERATIONS  On the night of the incident, the Board Operator’s request for the emergency response team (ERT) to come to the scene triggered the start of emergency response operations. From this initial request for ERT aid to the final response activities, the La Porte site’s emergency response efforts were characterized by miscommunication, disorganization, and a lack of situational awareness. The following key emergency response weaknesses are discussed in this section:  Based on DuPont La Porte’s emergency response plan, emergency response personnel relied on the expertise of the shift supervisor, who was the designated process coordinator. The Shift Supervisor, however, was a victim of the incident, and no one else on the shiftb was designated to backfill the role of process coordinator. This gap led to weaknesses in several aspects of the emergency response operations (Section 4.2), including the initial assessment of the problem and of the resources needed for an effective response. a 29 C.F.R. § 1910.1200 (b)(1) (Feb. 8, 2013). The Lannate® Unit’s emergency planning and response manual designated a primary and secondary backup for the process coordinator. These backups, however, were not on-site during the evenings and weekends, including when the incident occurred on November 15, 2014. b Page 31 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX  There was a delay in ERT deployment and readiness to respond to the release, due to both a misunderstanding of the type of emergency and the failure of an ERT mini-pumper truck that stored SCBAs to start (Section 4.3).  Searching for the missing workers put the ERT responders at high risk. ERT responders entered a hazardous and potentially explosive atmosphere without performing air monitoring. Additionally— unbeknownst to them—they entered an area of the manufacturing building that DuPont La Porte had previously identified as a collapse risk in the event of an explosion (Section 4.4).  DuPont La Porte’s emergency planning and response manual lacked a building map or floor plans to aid emergency responders in navigating the manufacturing building. As a result, the ERT experienced difficulties navigating the manufacturing building while searching for a missing operator; they resorted to assigning unit operators, including the Board Operator, to draw maps of the building to help guide them. This assignment diverted the Board Operator’s attention from other critical tasks, such as viewing process data on the control room computer screen to try to identify the source of the release (Section 4.5).  The methyl mercaptan release was not controlled until three hours after it began. Personnel did not evaluate process data to determine the cause of the release until hours into the response efforts. Analysis of process data from the methyl mercaptan storage tank earlier during the release may have revealed that the methyl mercaptan storage tank level was continually dropping and that isolating the tank could stop the release (Section 4.6).  Emergency responders established a hot zone that was not clearly marked or communicated, thereby allowing an operator to be potentially exposed to a dangerous concentration of methyl mercaptan when tasked to assist the ERT (Section 4.7).  The ERT underestimated the quantity of toxic methyl mercaptan released. Because DuPont La Porte lacked fence-line monitors and the ERT did not conduct air monitoring to determine the concentration of methyl mercaptan leaving the site, the ERT did not have accurate values to use in its dispersion model. Instead, ERT members estimated a small quantity of methyl mercaptan based on verbal descriptions of the release’s downwind odor. As a result, the incident command did not issue warnings to the community surrounding the La Porte facility to take protective actions from the possibility of toxic concentration of methyl mercaptan exiting the site during the release. Furthermore, because air monitoring had not occurred during the release, neither DuPont La Porte nor the CSB can pinpoint the exact methyl mercaptan concentration that left the site, or what the potential health risk was to the public, if any (Section 4.8). Page 32 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX ERT BACKGROUND  DuPont was originally the sole operator of the La Porte site. In recent years, however, DuPont had sold portions of the operations and leased its facilities to other companies, including Kuraraya and Invista.b Kuraray, Invista, and DuPont formed a consolidated ERT at the site, managed by DuPont but jointly staffed by members of the three companies.c All of the ERT members had other primary jobs for one of the three tenant companies (such as unit operators), and they responded as ERT members when alerted during emergencies. In its 2012 Risk Management Plan, DuPont La Porte stated that it used the National Incident Management System (NIMS) to systematically manage safety, tactics, strategy, personnel, equipment, and logistics, and to work seamlessly with any responding departments and agencies [7].d The site’s ERT was staffed by about 60 employees and had the following structure:  Incident Command Organization: 2–4 trained incident commanders on each shift o  Fire Brigade Members: 12 members on each shift o  Training: National Pro Board Certified as Advanced Exterior Fire Fighters and Interior Structural Fire Fighters (based on NFPA 1081 competencies) Emergency Medical Services: 2–3 members on each shift o  Training: National Pro Board Certifiede as Fire Service Instructors (based on National Fire Protection Association, or NFPA, 1041 competencies), and Advanced Exterior Fire Fighters, Interior Structural Fire Fighters, and Industrial Fire Brigade Leaders (based on NFPA 1081 competencies) Training: Texas Department of State Health Services–Certified Emergency Medical Technicians (EMTs), Basic and Intermediate Training Rescue Technicians: 3–5 members on each shift o National Pro Board Certified in Rope, Confined Space, and High Line Rescue (based on NFPA 1006 competencies) a Kuraray is a chemical company that specializes in functional materials [169]. Invista is a subsidiary of Koch Industries, Inc., that manufactures nylon, spandex, polyester, and specialty materials. c Post-incident, on July 1, 2015, DuPont La Porte’s performance chemicals business unit was spun off to Chemours [107], [108, p. 35]. Chemours also provides ERT members to the La Porte site. d According to the U.S. Federal Emergency Management Agency (FEMA), “NIMS provides a common, nationwide approach to enable the whole community to work together to manage all threats and hazards. NIMS applies to all incidents, regardless of cause, size, location, or complexity” [132]. e The National Board on Fire Service Professional Qualifications (aka the Pro Board) is an accreditation body in the fire service training community. It accredits fire service training organizations, which in turn certify emergency responders to specific levels of training and competency in accordance with professional qualification consensus standards developed by the National Fire Protection Association [97]. b Page 33 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board  Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX HAZMAT Technicians: most ERT members o Training: National Pro Board Certified (based on NFPA 472 competencies) Although ERT members were trained to perform emergency response functions, they were not trained on the specific hazards of each unit because there were many units within the three companies that processed various chemicals with different hazards. The La Porte site attempted to bridge this gap by designating a technical liaison position called the “process coordinator” to provide chemical hazard and unit-specific information about each of the processes to the ERT during an emergency. This position, along with the emergency operations center coordinators, was intended to play a critical role in interfacing with and helping to develop and execute emergency response actions with the ERT incident commander. PROCESS COORDINATOR WAS MISSING  The DuPont La Porte’s emergency response plan required the appointment of a shift “process coordinator” from each unit to assist the incident commander in providing technical knowledge specific about their unit. The emergency response plan defined the process coordinator as “the area emergency response director of the shop, warehouse, office building, or process unit involved in the incident who is responsible for developing an action plan with the Incident Commander and directing area resources.” The process coordinator was responsible for assisting the incident commander in several tasks during emergencies (see Figure 10), including the following: 1. Communicating (by radio) with the ERT’s incident commander and the site’s emergency operations center, as the operations technical liaison 2. Determining the source and size of chemical leaks (see Figure 9) Page 34 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 9.  Responsibilities of the Process Coordinator (Production Shift Supervisor).  In the Lannate® Unit’s emergency  planning and response manual, DuPont La Porte provided this checklist for a process coordinator to use to gather  information.  Source: DuPont.  3. Deciding whether the site needs to perform off-site air monitoring 4. Deciding whether to evacuate the unit Page 35 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 10.  A Section from the Lannate® Unit’s Emergency Planning and Response Manual.  It details the process  coordinator’s role during an emergency.  Source: DuPont.  As with most shifts, the Lannate® area process coordinator on the night of the incident was the Shift Supervisor. The Shift Supervisor in this case, however, was a victim of the toxic chemical release, and DuPont La Porte had not designated an on-site backup process coordinator for this shift.a As a result, these important functions were either performed in a disorganized manner by other operations personnel or never performed at all. In DuPont’s emergency response critiques conducted after the incident, emergency response personnel communicated the following: - “Weakness: Loss of area technical expertise led to confusion and lack of communication about the process. Personnel that would have staffed the technical specialists’ positions … were victims.” - “What are contingency plans? If team leader or subject expert are not available, how is that handled?” a The primary and secondary backup coordinator noted in Figure 10 were day shift employees and were not on-site at the time of the incident. Page 36 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX GUIDANCE TO INDUSTRY  Specific technical knowledge from process unit experts—including technical and operations personnel—can be invaluable to the incident commander in an emergency at a chemical processing facility. The Hazardous Waste Operations and Emergency Response (HAZWOPER) standard identifies persons who can provide this information as specialist employees.a Companies need to ensure that these individuals are preidentified as technical support personnel and to provide backup capability for all situations in the event the primary technical support personnel are unavailable. The emergency response plan can address how technical and operations personnel are integrated into emergency response roles—the HAZWOPER standard requires that the emergency response plan address “personnel roles, lines of authority, training, and communication.”b When developing an emergency response plan, companies should also consider the nature and extent of duties designated to particular people to ensure they can reasonably carry out those duties during an emergency. One way companies can ensure that a backup is available during a shift is to have a recall list that identifies alternates who can provide technical support. The Center for Chemical Process Safety (CCPS) gives the following guidance in its book Guidelines for Technical Planning for On-Site Emergencies: Technical support consists of personnel within the organization and outside emergency response groups. Technical support personnel within the organization include engineers, chemists, operators, maintenance personnel, and managers having special knowledge of process operations, emergency systems, building plans and equipment layout, and hazardous materials present. A technical support team consisting of these experts or others with similar qualifications will provide the incident commander with a pool of knowledge to draw on during emergencies. Technical support team members should be placed on the recall list with designated alternates in the event team members are directly involved with the emergency or are not available [8, pp. 283-284] (emphasis added). Another valuable tool that an emergency response team can use is a checklist. As suggested by CCPS, Planners should develop emergency action checklists to augment the emergency plan by providing memory joggers for actions. Action checklists are concise reminders to personnel of key actions that need to be undertaken [8, pp. 158-159]. a The HAZWOPER standard defines specialist employees as “employees who, in the course of their regular job duties, work with and are trained in the hazards of specific hazardous substances, and who will be called upon to provide technical advice or assistance at a hazardous substance release incident to the individual in charge”; it further specifies that they “shall receive training or demonstrate competency in the area of their specialization annually” (29 C.F.R. § 1910.120 (q)(5)). b 29 C.F.R. § 1910.120 (q)(2)(ii). Page 37 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX A company can develop these checklists in the incident response planning stage and use them during emergencies to ensure proper performance of important emergency response tasks like those DuPont assigned to the process coordinator, even in scenarios in which the primary assignee is unavailable. DELAY IN ERT READINESS TO SEARCH FOR MISSING WORKERS  It took 35 minutes from the request for ERT assistance for the La Porte ERT to initiate the first entry into the manufacturing building to search for the missing workers. Discussed below, miscommunication, the lack of a process coordinator, and inadequate emergency preparation by DuPont all contributed to the ERT’s delayed response. 4.3.1 CALL FOR ERT RESPONSE  When the Board Operator made his call for ERT assistance over the intercom system, he stated, “We need rescue people, and there’s people missing.” To the ERT, rescue specifically meant retrieval of a person from an area, so the team brought to the scene only technical rescue gear (e.g., ropes and harnesses). As discussed in Section 2.2, ERT members realized upon arrival that contrary to their presumption, there was a chemical release and they needed additional PPE. DuPont provided the CSB with a May 2014 slide presentation for new employees showing the structure of the ERT and how to request assistance from the ERT. The presentation detailed the differences in response groups (fire brigade, EMT, rescue, and fume release). While some operations personnel may have understood the organization of the ERT, a key problem at the time of the request for the ERT during the incident under study was that the incident was not yet fully understood. As a result, important details could not be communicated in the initial ERT call. In addition, DuPont lacked an on-site backup process coordinator to communicate and coordinate response operations with the ERT. In one of DuPont’s emergency response critiques conducted after the incident, emergency response personnel communicated the following: - “There was confusion on who was to respond.… For [a request for] EMT, only EMT responds. For [a request for] rescue, only rescue responds, and for [a request for] ERT (fume/fire) then everyone responds.” - “There was a communication problem initially. [We attempted] radio communication, not realizing that [the] leader had been lost. Operators were lost. No one [in the unit] knew how ERT worked.” Page 38 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX GUIDANCE TO INDUSTRY  Plant emergency procedures should clearly define the alerting and notification process for different types of plant emergencies. These procedures should also include guidance for situations in which initial information to effectively assess the nature of the problem and the amount and type of ERT resources required is incomplete. 4.3.2 ERT MINI‐PUMPER TRUCK NOT OPERATIONAL  When the ERT learned that the incident involved a chemical release, the Incident Commander asked ERT members to come to the scene with bunker gear and SCBAs. ERT members stored their SCBAs on a minipumper truck. When an ERT member tried to start this mini-pumper truck to bring the gear to the site where it was needed,a the vehicle did not start because of multiple mechanical malfunctions. An October 2, 2014, work order states, “Check[ed] batteries and they were not good, remove[d] and replace[d] with new ones.” Replacing the batteries, however, did not fully repair the truck, which failed to start at the time of the incident, impairing the effectiveness of the ERT response. After the incident, DuPont La Porte personnel replaced the truck’s alternator, battery cable, and belts to make it operable. Although the pumper truck was a critical piece of emergency response equipment, DuPont La Porte did not adequately maintain it before the incident to ensure its availability during an emergency. In DuPont’s emergency response critiques conducted after the incident, emergency response personnel communicated: - “Opportunity: Exercise and inspect the emergency services apparatus on a more frequent basis. Perform maintenance in a timely fashion to ensure the functionality and reliability.” - “Weakness: I had gear and equipment that didn’t make it to the scene. We get in a comfort zone and [think] it won’t happen to us, and it did.” Since the mini-pumper truck holding SCBAs could not come to the scene, the ERT assigned an operator to retrieve additional SCBAs in the Lannate® Unit for the ERT to use.b Retrieving the SCBAs may have exposed the operator to a high methyl mercaptan concentration because these SCBAs were downwind of the methyl mercaptan release point (Section 4.7). a The pumper truck was a Ford F-450 Mini Pumper. The SCBAs on the truck were rated for 60 minutes. Initially, the ERT had to use SCBAs from the area that were rated for 30 minutes. Later on, 60-minute SCBAs were transported to the scene. b Page 39 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX GUIDANCE TO INDUSTRY  Under the HAZWOPER standard, an emergency response plan must address PPE and emergency equipment,a such as the SCBAs and mini-pumper truck. It should also contain information on how to ensure that PPE and emergency equipment are always functional. Even though industrial facilities may call upon emergency response vehicles infrequently, it is essential that these vehicles operate as intended when needed. To ensure emergency vehicle reliability, companies need to develop and apply regular maintenance schedules. The National Fire Protection Association’s Standard for the Inspection, Maintenance, Testing, and Retirement of In-Service Emergency Vehicles (NFPA 1911) requires weekly visual and operational checks for emergency vehicles.b Annex C of NFPA 1911, titled Developing a Preventive Maintenance Program, also provides guidance and example checklists to use when performing preventive maintenance on emergency vehicles [9, pp. 79-99]. THE SEARCH FOR MISSING WORKERS WAS HIGH RISK   When the HAZMAT-trained ERT members and the necessary PPE arrived at the scene of the release, the emergency response still faced three major issues: 1. The ERT initially did not use air monitoring equipment to identify whether the building had an explosive atmosphere. 2. Emergency responders did not know the locations of the missing workers. 3. Emergency responders were not familiar with the layout of the building and processes. While no emergency responders were injured, operations under these conditions exposed responders to increased risk. a 29 C.F.R. § 1910.120 (q)(2)(xi). The 2017 version of NFPA 1911 states, “A visual and operational check of the apparatus shall be performed within 24 hours of a run or at least weekly” [9, p. 17]. The 2012 version of NFPA 1911, which was the applicable standard at the time of the incident, states, “An operational check and visual check of the fire apparatus shall be performed on a daily/weekly basis to ensure the operational readiness of the unit” [98, p. 13]. b Page 40 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 4.4.1 ENTRY INTO POTENTIALLY EXPLOSIVE ATMOSPHERE  During the incident, Harris County emergency responders used a QRAE monitora and a MultiRAE monitorb during their building entries. These monitors can inform personnel whether the environment is explosive or immediately dangerous to life or health (IDLH). Colorimetric gas detection tubes (e.g., Dräger-Tubes) can also measure gas concentrations during emergencies.c Air monitoring by ERT personnel is a critical element in employing a risk-based emergency response operation.d Failure to conduct air monitoring increases the potential for significant risks to emergency responders, employees, and the public, and it can lower the probability of a safe and effective emergency response. Emergency responders typically use portable air monitors to measure gas concentrations during entries into hazardous areas. During the ERT’s initial entry into the manufacturing building to search for the missing workers, ERT members did not use air monitoring equipment to characterize the building atmosphere. DuPont La Porte had assigned operations personnel to maintain and control air monitoring equipment within each of their business units to be made available to the incident commander or the process coordinator during emergencies. The DuPont La Porte emergency response plan identifies the incident commander as being responsible for directing personnele to conduct air monitoring downwind of the release. There was a delay in air monitoring inside the building, and the ERT could not determine if there was an explosive atmosphere (methyl mercaptan is a flammable gas)f during the initial entry into the manufacturing building.g Without this monitoring, the ERT may have unknowingly entered an explosive atmosphere. Later, the ERT entered the building with other external emergency response groups that had air monitoring equipment. The potential for a methyl mercaptan explosion in the building posed a serious hazard to emergency responders, due to both the inherent explosion effects (e.g., overpressure, shrapnel) and the structural collapse risk (Section 4.4.3). a The QRAE monitor is a four-sensor monitor specifically manufactured by RAE to continuously monitor, for example, oxygen, percentage of lower explosive limit, and toxic gases [124]. b The MultiRAE monitor, specifically manufactured by RAE, has up to six gas sensors to continuously monitor, for example, percentage of lower explosive limit (LEL), oxygen, and toxic gases [123]. To obtain percentage LEL, this type of detector is typically calibrated using methane, and the user multiplies the percentage LEL reading by a given correction factor to obtain the percentage LEL of the chemical of interest [84]. c “Dräger-Tubes are glass vials filled with a chemical reagent that reacts to a specific chemical or family of chemicals. A calibrated 100 ml sample of air is drawn through the tube. If the targeted chemical(s) is present, the reagent in the tube changes color and the length of the color change typically indicates the measured concentration” [125]. d A risk-based emergency response operation is an approach that sets policy and programmatic priorities based upon measured levels of risk to lives, property, and the environment [165, p. 6]. e Personnel can be either mechanics, operators, or emergency response personnel who are trained on air monitoring equipment and familiar with the area. f Methyl mercaptan is flammable at concentrations between 3.9 percent and 21.8 percent by volume [50]. g At approximately 7:30 am, the ERT was pulled out of the building to resolve issues with PPE because it was determined that methyl mercaptan posed a flammability risk. Page 41 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX GUIDANCE TO INDUSTRY  Entering a structure with an unknown environment may pose additional risks to emergency responders. For example, it may have the potential to be explosive, as in the situation at DuPont La Porte. Recognizing the issues associated with uncharacterized environments, the HAZWOPER standard requires the individual in charge (here, the incident commander) to identify to the extent possible “all hazardous substances or conditions present and shall address as appropriate site analysis, use of engineering controls, maximum exposure limits, hazardous substance handling procedures, and use of any new technologies.”a Additionally, the HAZWOPER standard also identifies a safety officer as an individual who assists the incident commander in identifying these hazardsb and makes safety decisions surrounding them.c This standard gives the incident commander the responsibility of determining the risks associated with the emergency response using available personnel and tools (emergency equipment and PPE). Before directing emergency response activities, the nature of the hazards needs to be identified and characterized to determine the appropriate actions to be taken. Incident commanders, safety officers, and other emergency response personnel can look to industry guidance to help them determine the safest course of action in a given situation. For example, NFPA 472, Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, gives illustrative example conditions—including those conditions present during the DuPont La Porte incident—in which NFPA recommends prohibiting emergency response personnel from entering the hot zone. They include, among other conditions:  flammable or explosive atmosphere present and  insufficient personnel to perform tasks [10, p. 100]. One method emergency responders can use to characterize unknown environments is air monitoring. To ensure that emergency responders can perform air monitoring of hazardous atmospheres, industrial facilities should provide ERT members with their own air monitoring equipment and train them in how to operate it (e.g., NFPA 472 requires that hazardous materials technicians be able “through detection, monitoring, and sampling,… [to] verify the presence of hazardous materials… [and] determine the concentration of hazardous materials in the atmosphere” [10, pp. 42-43]). If facilities choose to assign maintenance and storage of portable air monitoring equipment to non-ERT members, the company should also ensure that the ERT can readily locate and access the stored equipment. a 29 C.F.R. § 1910.120 (q)(3)(ii). “The individual in charge of the [incident command system] shall designate a safety officer, who is knowledgeable in the operations being implemented at the emergency response site, with specific responsibility to identify and evaluate hazards and to provide direction with respect to the safety of operations for the emergency at hand” (29 C.F.R. § 1910.120 (q)(3)(vii)). c “When activities are judged by the safety officer to be an IDLH and/or to involve an imminent danger condition, the safety officer shall have the authority to alter, suspend, or terminate those activities. The safety official shall immediately inform the individual in charge of the [incident command system] of any actions needed to be taken to correct these hazards at the emergency scene” (29 C.F.R. § 1910.120 (q)(3)(viii)). b Page 42 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 4.4.2 NO TECHNOLOGY TO LOCATE MISSING WORKERS  DuPont La Porte did not equip the manufacturing building with technology either to account for the entry of personnel into the building or to track their location once inside. The manufacturing building processed highly hazardous chemicals—including methyl mercaptan and chlorine—in an enclosed environment. Companies can use technology (such as cameras, badges, or chip readers) to track the locations of personnel upon entry into high-hazard areas or in the event of an incident. Knowing the location of personnel could help emergency responders conduct targeted rescues by allowing them to reach affected personnel quickly and minimize ERT member exposure to hazardous environments. GUIDANCE TO INDUSTRY  Facilities that handle large quantities of flammable or toxic chemicals have a responsibility to monitor highhazard areas, such as DuPont’s Lannate® manufacturing building, for releases and personnel injuries. That monitoring capability must be available to emergency response personnel to assess the scope and nature of any incident, including possible locations of employees within the area. High-hazard areas should be equipped with sufficient monitoring devices, such as detectors, alarms, and surveillance technology, to identify whether there is a chemical release (or other type of emergency) and whether personnel are affected.a When surveillance cameras are used, companies should consider having the camera feeds go to multiple plant locations, including control rooms, plant security stations, and the plant emergency operations center (EOC). 4.4.3 UNRECOGNIZED MANUFACTURING BUILDING COLLAPSE HAZARD  A 2002 DuPont La Porte facility siting study predicted potential damage to the manufacturing building based upon various explosion scenarios. In the analysis of a hypothetical methyl mercaptan explosion on the first floor of the manufacturing building, the study listed the “Predicted Building Damage Level” as “Collapse []-Building fails completely. Repair is not feasible.” Neither DuPont La Porte’s emergency response plan nor the Lannate® Unit’s emergency planning and response manual included information from the 2002 study on the potential risk of structural collapse in the event of an explosion. DuPont La Porte did not have a system in place to ensure that emergency planning documents were updated when site studies, such as a process hazard analysis (PHA), identified relevant information. Consequently, the emergency planning documents did not prepare ERT members for the risk that the manufacturing building could collapse. a According to Sutton, author of Plant Design and Operations, closed circuit television (CCTV) “can help with fire response—not so much with the initial detection but in providing information that can help with control of the facility and direction of the emergency response team. Cameras can be installed in a fixed position focused on high-risk areas or may permanently scan large areas.… Typical locations for CCTV cameras are pump floors in process and oil movement areas, road/railcar loading areas, jetties, and buildings that contain process equipment” [85, p. 203]. Page 43 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Although an explosion did not occur and the manufacturing building did not collapse, entry into the manufacturing building posed a serious safety risk to members of the ERT during emergency response activities following a significant methyl mercaptan release. GUIDANCE TO INDUSTRY  NFPA 1620, Standard for Pre-incident Planning, states, “The pre-incident plan shall address the structural integrity of walls, roofs, and floors” [11, p. 9]. This standard is intended to provide information to the incident commander. To help emergency responders become knowledgeable of known unit hazards, companies should develop a system to update emergency planning documents when other studies identify pertinent hazards and risks. DIFFICULTIES NAVIGATING MANUFACTURING BUILDING   Many of the emergency responders searching the manufacturing building worked at the La Porte site as operators in other units or for other companies located there. Some of these responders, therefore, were unfamiliar with the manufacturing building—a four-story building containing a large amount of piping and process equipment, dividing walls, multiple stairwells, and an elevator. Figure 11 shows photos taken inside the manufacturing building, illustrating the complexity of the layout inside the building. Figure 11.  Photos of the Interior of the Lannate® Manufacturing Building.  Source: CSB.  Page 44 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX The CSB found that the Lannate® Unit’s emergency planning and response manual did not have a building map or floor plan to aid emergency responders in understanding and navigating the manufacturing building during the incident. Emergency responders assigned Lannate® Unit operators—including the Board Operator—to draw maps of the manufacturing building to assist in the search. The Board Operator informed the CSB as follows: They got the big pad … and had me sit down and start drawing pictures. And [the emergency responder] said, “We want it as detailed as you can get.” So, I drew the building, I drew the stairwells, I drew the reactors, what reactors were where, you know, and coolers, you know, on each floor. That’s what they wanted me to do, draw a description of each floor as well as I could … so when they go in, they know where they’re going. They can look, and of course three of [the missing operators were] found already, but they never did—at that time, they didn’t know where [the fourth missing operator] was.… It took me about an hour and a half to draw stuff, you know. Seven months before the incident, DuPont La Porte performed a response drill for operators in the Lannate® Unit and developed a follow-up action item that “plot plans should be readily available for responder reference” (Figure 12). The CSB found that the drill leader, however, did not assign this action item to specific personnel or input the item into the site’s action item tracking system. Consequently, no one took responsibility for the action items, and the recommended plot plans were never created. Figure 12.  Excerpt from an April 2014 Drill Follow‐Up.  It recommended that plot plans be readily available  for responder reference.  A plot plan was never made for the manufacturing building.  Source: DuPont.   GUIDANCE TO INDUSTRY  Although the HAZWOPER standard requires that emergency response plans detail evacuation routes, evacuation procedures, safe distances, and places of refuge, it does not specifically require development of plot plans.a NFPA 1620, Standard for Pre-incident Planning, on the other hand, supports the development of plot a 29 C.F.R. § 1910.120 (q) (February 8, 2013). Page 45 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX plans in complex hazardous environments. The standard establishes criteria for developing “pre-incident plans to assist personnel in effectively managing incidents and events for the protection of occupants, responding personnel, property, and the environment” [11, p. 5]. It also defines different complexity levels of pre-incident plans: (1) Level 1, Basic, (2) Level 2, Intermediate, and (3) Level 3, Comprehensive. NFPA 1620 states, Level 3 information is the most detailed level of pre-incident planning and is intended to include process hazards and protection schemes, detailed occupancy considerations, room or area layouts, and operational features (e.g. ventilation, power) [11, p. 17]. (emphasis added) In addition, it is a good practice for site-level emergency responders—and external emergency response groups—to be familiar with the layout of enclosed buildings within chemical facilities in the event of an emergency. Familiarity with buildings and process areas can reduce recovery time and aid in life-saving rescue operations. Periodic drills inside process structures can help familiarize responders with the buildings and improve responder navigation during emergencies.a To help prepare for emergencies, chemical facilities should do the following: 1. Develop site maps and plot plans of the facility, including the layout of process buildings. Ensure these maps are up-to-date and readily available to emergency responders. 2. Coordinate regularly scheduled site tours for both plant and external emergency responders to establish strong working relationships and help ensure emergency responders are familiar with facility access points, hazards, emergency response issues, and site or facility layout.b 3. Familiarize responders with process structures or buildings to improve responder navigation during emergencies by having periodic drills inside them at established, recurring intervals. To enhance responder performance, members of an emergency response team should train together, especially in situations in which multiple companies are staffing a single team. a NFPA 1, Fire Code, Annex D, “Hazardous Materials Management Plans and Hazardous Materials Inventory Statements,” requires detailed site, building, and structure drawings. Additionally, facilities are required to have inventory assessments that include chemical names and their common names. Annex D is not a requirement of NFPA 1 unless it is specifically adopted [106, pp. 731-740]. b NFPA 600, Standard on Industrial Fire Brigades, states, “Facility fire brigade management should maintain a close working relationship with all emergency response organizations that could reasonably be expected to respond to the facility during an incident. This relationship should include … an invitation to the emergency response organizations to participate in a pre-fire planning walk-through or tour of the facility” [103, p. 19]. Page 46 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX NO ANALYSIS OF PROCESS DATA TO IDENTIFY SOURCE OF LEAK  Figure 13.  Location of Methyl Mercaptan Emergency Isolation Valve Relative to Manufacturing Building  Where Leak Occurred.  The emergency isolation valve was not activated until seven hours after the  release began.  Source: Google Earth, with annotations by CSB. DuPont La Porte had installed an emergency isolation valve for the methyl mercaptan storage tank. Companies often install emergency isolation valves to avoid the need to isolate chemical release points manually during large releases of a flammable or toxic chemical; locations for such valves include, for example, points near property lines, at the boundaries of process units, or at liquid outlets of vessels containing flammable or toxic chemicals.a The installation and use of these valves can help prevent someone from having to enter a flammable or toxic atmosphere to stop a chemical release. Even though the methyl mercaptan storage tank had an emergency isolation valve, its closure was significantly delayed. The release began just after 3:00 am, but 1. the methyl mercaptan storage tank pump was not turned off until 6:02 am—three hours after the release began—significantly reducing the rate of the methyl mercaptan release, and 2. the methyl mercaptan storage tank emergency isolation valve was not closed until 10:07 am—seven hours after the release began—finally isolating the methyl mercaptan storage tank from the process (Figure 13). a Emergency isolation valves could be designed to (1) close automatically, for example, during an emergency shutdown of a unit; (2) close remotely, by manual activation; or (3) be manually closed [81, pp. 123-124]. Page 47 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Earlier performance of these two critical equipment manipulations could have controlled the release much sooner. The CSB determined that the delay in isolating the methyl mercaptan storage tank from the process occurred for two reasons: 1. Personnel did not recognize the need to close the methyl mercaptan storage tank isolation valve when they determined that methyl mercaptan was the chemical being released inside the manufacturing building. 2. No one evaluated process data to determine what was causing the release until hours into the response efforts. Had personnel looked at the process data earlier during the release, it should have been clear that methyl mercaptan was flowing from the methyl mercaptan storage tank, requiring closure of the emergency isolation valve (Figure 14). Figure 14.  Process Data from November 15, 2014.  Data shows that methyl mercaptan was  abnormally flowing from the methyl mercaptan storage tank.  No one analyzed these data during  the first hours of the incident.  Source: CSB graph based on DuPont data. Page 48 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX The CSB identified three causes for not analyzing process data earlier during the release: 1. The Lannate® Unit’s Shift Supervisor (Process Coordinator), who was responsible for determining the source of any chemical release and identifying the valves to close to stop the release, had been overcome by methyl mercaptan exposure, and there was no designated backup on shift (Section 4.2). 2. During the chemical release, the Board Operator, who could have analyzed the process data, was repeatedly pulled away from monitoring the process to communicate with emergency responders and perform tasks such as drawing maps of the building (Section 4.5). 3. Even though there was a troubleshooting operation going on in the Lannate® Unit before the release, there was no technical or engineering support on-site to help the operators if the Lannate® process responded abnormally. Site personnel did not contact the on-call DuPont La Porte technical employeesa during the early stages of the incident for assistance in identifying the source of the methyl mercaptan release (Section 4.6). GUIDANCE TO INDUSTRY  When a process safety incident such as a chemical release occurs, it can be beneficial for technical personnel who are not immediately involved in emergency response functions to analyze process data and quickly identify the cause, scope, and magnitude of the incident. This analysis will help the company (or incident commander) identify needed equipment manipulations to stop or control the incident, such as shutting down equipment or closing isolation valves, to mitigate the effects of a release and the threat to responders and the public. In Guidelines for Technical Planning for On-Site Emergencies, CCPS provides guidance on the possible emergency roles of various plant personnel during an incident [8, p. 161] (Figure 15). a The DuPont La Porte technical employees were contacted individually throughout the morning by a variety of persons. Page 49 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 15.  Example Roles for Various Plant Personnel During and after an Emergency.   Source: CCPS.  INADEQUATE CREATION AND CONTROL OF HOT ZONE  The ERT did not adequately establish, physically mark, or communicate the boundary of the hot zone during the early stages of the emergency response efforts. The zone was physically marked only after external emergency services groups arrived at the scene. The absence of a clear hot zone boundary as part of the early emergency response led to poor incident scene control, including trouble determining who had entered and exited the hot zone and whether they were wearing proper PPE. Page 50 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX During the incident, the ERT asked an operator who was not an ERT member (Operator 7) to assist the team by retrieving SCBAs from the Lannate® Unit. Because the hot zone was not physically defined, and entry/exit control points were not staffed and controlled, the operator did not realize the SCBAs were in a potentially hazardous location. She entered the hot zone without respiratory protection and, based on the symptoms she exhibited, believes she was exposed to a high concentration of methyl mercaptan (Figure 6). In one of DuPont’s emergency response critiques conducted after the incident, emergency response personnel communicated: “Weakness: Visual markers and communication of the control zone boundaries.” GUIDANCE TO INDUSTRY  The establishment, communication, and control of a hot zone is necessary to help protect plant personnel and emergency responders. Under the HAZWOPER standard, an emergency response plan must address “safe distances and places of refuge.”a An emergency response plan can provide guidance in determining safe distances and places of refuge for different types of emergencies and in effectively communicating these zones. Companies can look to voluntary consensus standards for guidance on how to establish hot zones. For example, NFPA 472, Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, requires that the hazardous materials safety officerb “identify whether the boundaries of the established control zones are clearly marked … and are being maintained” and “verify that each team is protected and prepared to perform its assigned tasks by … verify[ing] whether the selection of PPE and equipment is consistent with the site safety and control plan” [10, p. 61]. Once personnel establish and communicate a hot zone, they must control entry and exit. HAZWOPER states that the incident commander “shall limit the number of emergency response personnel at the emergency site, in those areas of potential or actual exposure to incident or site hazards, to those who are actively performing emergency operations. However, operations in hazardous areas shall be performed using the buddy system in groups of two or more.”c These requirements help ensure that emergency response personnel minimize their potential exposure to hazards. a 29 C.F.R. § 1910.120 (q)(2)(iv). The hazardous materials safety officer is part of the incident command system and ensures that safe practices are followed during hazardous materials incidents [10, p. 58]. c 29 C.F.R. § 1910.120 (q)(3)(v). b Page 51 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board ERPG Levels  Emergency Response Planning Guidelines (ERPGs) are chemical concentration levels used when preparing for and responding to emergencies. They are designed to anticipate public health effects, not occupational health effects, from exposure to airborne chemicals. The three ERPG levels are as follows: ERPG-3: The maximum airborne concentration below which nearly all individuals could be exposed for up to one hour without experiencing or developing life-threatening health effects. ERPG-3 is a worst-case planning level. Exposure to concentrations above the ERPG-3 level will be lethal to some members of the community. ERPG-2: The maximum airborne concentration below which nearly all individuals could be exposed for up to one hour without experiencing or developing irreversible or other serious health effects, or symptoms that could impair an individual’s ability to take protective action. At concentrations above ERPG-2, some members of the community may experience significant health effects, which could impair them from taking protective action. Emergency responders often alert the community to take protective action in areas susceptible to the ERPG-2 concentration and above. ERPG-1: The maximum airborne concentration below which nearly all individuals could be exposed for up to one hour without experiencing more than mild, transient adverse health effects or without perceiving a clearly defined objectionable odor [86]. Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX To prevent a similar hazardous situation to personnel assisting industrial emergency response teams, companies should ensure that emergency response team members are trained (1) to physically designate the hot zone, and (2) to communicate the location of the hot zone and its entry control points to all personnel assisting with the emergency response, including operations personnel. DEFICIENCIES IN EVALUATING RISK TO THE  PUBLIC  DuPont La Porte did not effectively evaluate the impact of a potential major methyl mercaptan release on members of the public. Site personnel had several available methods (discussed below) to help identify whether a hazardous concentration of toxic methyl mercaptan was traveling off-site. As discussed in this section, the emergency responders  used a model of the chemical release that had inaccurate model inputs,  did not use available on-site methyl mercaptan concentration data to evaluate the potential for an offsite release,  misinterpreted methyl mercaptan physical property data by mistakenly believing methyl mercaptan was lighter than air and would not expose people off-site to hazardous concentrations,  did not adequately communicate to external emergency response parties the name of the chemical being released, and  did not perform air monitoring during the release to predict possible off-site consequences. Although there was a potential that methyl mercaptan may have exceeded ERPG-3a concentrations outside the fence line (see ERPG Levels box), the CSB is not aware of the actual a The ERPG values for methyl mercaptan in parts per million are ERPG-1, 0.005; ERPG-2, 25; ERPG-3, 100 [82]. People can typically detect methyl mercaptan odor at about 2 parts per billion (ppb) [80, p. 1]. Page 52 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX concentrations because timely air monitoring was not performed. Additionally, the CSB is unaware of any reported off-site injuries. 4.8.1 RELEASE MODELING  The ERT used software called SAFERa to model chemical releases in real time to help identify areas susceptible to hazardous concentrations of the chemical being released. Chemical release modeling is commonly used for assessing response scenarios during the emergency planning process and can also be used as part of incident management activities during a response. Its use is dependent upon having accurate source data, such as the chemical release rate. To create an effective model of a chemical release, SAFER needs an estimated chemical release rate based on accurate data. The Lannate® Unit’s emergency planning and response manual called for the SAFER operator to create a model of the release. Because there was no air monitoring information available, the SAFER operator estimated a release rate based upon an ERT member’s observations regarding the relative strength of the chemical odor outside of the manufacturing building. The SAFER operator informed the CSB as follows: Once I found out what the chemical was—methyl mercaptan—I plugged it in [to SAFER] and we still didn’t know what kind of release rate we had. So, I went ahead and plugged in 10 pounds [per hour] because based on what [they’re] telling me [they] could barely smell anything. I didn’t realize it was a significant release. … So, I just had to plug something in, so I plugged in 10 pounds an hour release rate. … We were just guessing at the release rate. Using the estimated release rate of 10 pounds per hour, the SAFER software predicted that a hazardous concentration of methyl mercaptan would not leave the company property. In part because the software model showed the chemical was not hazardous off-site, DuPont La Porte did not notify the authorities to alert the community to shelter-in-place or to divert traffic from the nearby Highway 225 (Figure 16). a At the time of the incident, DuPont La Porte was using SAFER Real-Time to do its emergency response dispersion modeling. This program is no longer supported, and SAFER has transitioned this program to SAFER TRACE [99]. Page 53 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 16.  Overhead Image of DuPont La Porte Facility.  A plume of methyl mercaptan left the DuPont property in a  southeasterly direction toward a major highway and residential area.  Source: Google Earth, with annotations by CSB.   Companies should not rely on unsupported data when making critical emergency response decisions, such as those affecting workers or the surrounding public and community. Companies are best positioned to determine the types of hazards that their processes and chemicals pose. Moreover, in developing emergency response plans, companies can develop scenarios for potential releases, which can be an important resource during an emergency. The U.S. Department of Transportation’s (DOT) 2016 Emergency Response Guidebooka provides a a The 2016 Emergency Response Guidebook is a joint publication of Transport Canada, the U.S. Department of Transportation (DOT), and the Secretariat of Communications and Transport of Mexico, with collaboration from Centro de Información Química para Emergencias of Argentina. The guidebook “is primarily a guide to aid first responders in quickly identifying the specific or generic hazards of the material(s) involved in the incident, and protecting themselves and the general public during the initial response phase of the incident.” It is primarily intended for use in transportation incidents involving dangerous goods [12, p. 358]. Page 54 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX format that can be used by companies to guide initial emergency response.a Table 1 in the guidebook provides standardized instructions for determining the isolation and protective action distances for small and large spills by predicting the size of downwind areas that could be affected by a cloud of toxic gas [12, p. 292]. This information is used as initial guidance to determine the size of the public area that should be alerted to take protective measures, including evacuation. The 2016 Emergency Response Guidebook is intended to be a reference for emergency responders during transportation emergency events that could affect the public. It has limitations when it comes to fixed chemical facilities. For example, in the guidebook, a large spill is anything greater than 55 gallons, yielding a very wide range in spill amounts. On the night of the incident, approximately 2,530 gallons of methyl mercaptan was released inside the Lannate® Unit,b which is about 46 times larger than 55 gallons. Even at 55 gallons, the guidebook recommends that in the event of large outdoor methyl mercaptan spills at night, emergency responders alert people to take protective action within 1.9 miles (3.1 kilometers) downwind of the release [12, p. 297]. Figure 17 shows the area to be protected if this guidance had been followed, which includes Highway 225 and a residential area. If DuPont La Porte had created its own version of a guidebook for release scenarios (including release of methyl mercaptan), actions may have been taken to protect the public. Following the incident, based on the methyl mercaptan storage tank level decrease, the CSB calculated that the methyl mercaptan release rate was closer to 9,000 pounds per hour, much of which was inside the manufacturing building—a rate 900 times greater than the dispersion model input. In an earlier study, DuPont determined that a leak greater than 4,500 pounds per hour (from an outdoor, elevated source) could result in hazardous off-site concentrations (ERPG-3 level) of methyl mercaptan.c According to DuPont’s guide for consequence analysis, concentrations above ERPG-2 require evacuation of the affected area. No evacuation occurred, because DuPont lacked adequate release information to provide to authorities. a The CSB has found in several of its investigations that application of the Emergency Response Guidebook may not be appropriate at all fixed industrial facilities due to larger quantities of chemicals at fixed facilities, hazardous process conditions, or possible proximity to other hazardous chemicals [142, p. 1]. Fixed facilities may find guidance in the Emergency Response Guidebook beneficial in some scenarios, but such facilities should also consider other information when conducting emergency response operations, such as equipment inventory, site-specific emergency response plans, and company-specific safety data sheets. If a site does use the Emergency Response Guidebook as an initial reference early in the release, process data, equipment inventory, and specific site hazards should always be evaluated to help determine effective emergency response operations. b The amount of methyl mercaptan released is based on DuPont’s calculations of how much was released during the incident. c Previously, DuPont had found in a study on a methyl mercaptan storage tank that in the event of a fire, the tank’s relief valves could release about 10,000 pounds per hour of methyl mercaptan to the atmosphere, causing off-site concentrations exceeding the ERPG-3 value. To reduce this release rate, DuPont insulated the methyl mercaptan storage tank to decrease the amount of methyl mercaptan that would exit the relief valves during a fire. DuPont aimed to prevent any methyl mercaptan release rate of greater than 4,500 pounds per hour “to avoid ERPG-3 concentrations.” During the incident, methyl mercaptan released at a rate of 9,000 pounds per hour—double the threshold release rate DuPont specified to avoid ERPG-3 (100 ppm) concentrations. Page 55 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 17.  Overhead Image of DuPont La Porte Facility with Recommended Downwind Protection Zone (Shown in Yellow) Based  on the 2016 Emergency Response Guidebook [12, p. 297].  Downwind sections of Highway 225 and residential areas were within  the area recommended for public protection from a methyl mercaptan chemical leak.  Source: Google Earth, with annotations by  CSB.  GUIDANCE TO INDUSTRY  Chemical dispersion modeling can be an effective risk-based emergency response tool, but its results are highly dependent on accurate input data. During an emergency, it can be difficult to obtain an accurate release rate, limiting the validity of resulting models [8, p. 239]. Companies can better protect the public from hazardous chemical exposures by identifying a conservative area where people should take protective action (e.g., sheltering-in-place) in the event of a chemical release, and then scaling back that area only when reliable information becomes available to justify reducing the protection zone. In addition, the data available to emergency responders can be enhanced by fence-line monitoring using fixed or portable monitors (Section 4.8.4). Such monitors can provide real-time data on whether the hazardous chemical is migrating off-site at dangerous concentrations. 4.8.2 PHYSICAL PROPERTIES OF METHYL MERCAPTAN   The ERT did not alert the local authorities to notify the public of the chemical release because some emergency response personnel believed methyl mercaptan was lighter than air and would not affect the local community. A La Porte facility employee informed the CSB as follows: Page 56 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX The [sheriff’s deputy] asked me, how did I know that [methyl mercaptan] was not affecting anybody in the La Porte area. I said, “I’ll ask that question while I’ve got [an emergency response representative] on the phone.” So, I asked, and that’s when I was told that methyl mercaptan is lighter than air and it dilutes out, and that it would have dissipated, pretty much, by the fence line. Methyl mercaptan, however, is heavier than aira and will tend to stay near ground level. DuPont’s technical standard for methyl mercaptan states that methyl mercaptan “gas is colorless and heavier than air, so that it can spread at ground level.” Also, DuPont’s safety data sheet (SDS)b for methyl mercaptan specifies its vapor density, showing that methyl mercaptan is heavier than air (Figure 18). The CSB could not determine why the emergency response representative communicating this information believed that methyl mercaptan was lighter than air. Figure 18.  DuPont’s Safety Data Sheet for Methyl Mercaptan.  It indicates that methyl mercaptan is heavier  than air.  Source: DuPont.  County emergency responders also had difficulty understanding the chemical properties of methyl mercaptan during the release. A post-incident narrative written by a member of the Harris County Hazardous Materials Response Team states: a The relative gas density or vapor density of methyl mercaptan is 1.66, meaning it is heavier than air, whose density is 1 [50]. Beginning in 2012, OSHA’s Hazard Communication Standard (HAZCOM) renamed material safety data sheet (MSDS) to safety data sheet (SDS) [156, pp. 5, 7]. Although referred to in this report as an SDS, the document shown in Figure 16 uses the older MSDS language. b Page 57 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Copies of the Safety Data Sheets were retrieved from the [Channel Industries Mutual Aid] Command Van. The terms “methyl mesh and methyl mash” were used in multiple conversations but there was no data in the SDSs concerning either term. “MeSH” is an industry initialism for methyl mercaptan, which DuPont personnel also use,a but personnel did not adequately communicate the formal chemical name to external emergency response agencies.b GUIDANCE TO INDUSTRY  Companies should ensure that all personnel who may assist with technical emergency response functions are trained on and understand the information contained in SDSs. Companies should also consider how to communicate formal chemical names to outside parties, such as emergency responders, by either ensuring that all staff are trained on and familiar with formal chemical names (e.g., methyl mercaptan, rather than MeSH) or by ensuring that SDSs include all alternative substance names, such as shorthand names, initialisms, or abbreviations [13]. 4.8.3 CHEMICAL SENSOR DATA  During the release, methyl mercaptan detectors inside and outside of the manufacturing building alarmed on the control panel. DuPont La Porte had designed the outside detectors to alarm on the control panel when they sensed a methyl mercaptan concentration of 25 parts per million (ppm) or greater,c specifically to “provide an early warning for a significant release of [methyl mercaptan] that could have impact off-site.” The three a “MeSH” is shorthand based upon methyl mercaptan’s chemical formula: CH3SH. “Me” represents the methyl group (CH3) and “SH” represents the mercaptan group (SH)—these initialisms combine to form “MeSH.” b The material safety data sheet in Figure 16 does include the term “MeSH” as a synonym for methyl mercaptan. Emergency responders had access to this sheet; however, they may have been specifically looking for the term “methyl mesh” as a synonym and may not have realized that the listed synonym “MeSH” referred to the same chemical. c The ERPG-2 level for methyl mercaptan is 25 ppm. This level “is the maximum airborne concentration below which nearly all individuals could be exposed for up to one hour without experiencing or developing irreversible or other serious health effects or symptoms which could impair an individual’s ability to take protective action.” Emergency responders use ERPG-1, -2, and -3 concentration data to determine how to protect the public [167]. Page 58 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX detectors inside the manufacturing buildinga (Figure 3) were also set to alarm on the control panel when they detected 25 ppm methyl mercaptan and were intended to protect workers from exposure to methyl mercaptan.b From DuPont’s management of change documentation for installation of methyl mercaptan detectors inside the manufacturing building: “Present Conditions and Description of Proposed Change: Personnel can enter a potentially hazardous location without knowing MeSH [methyl mercaptan] has been released to the environment.” The ERT, however, did not use the data from these detectors to identify whether there was a potential for an offsite release.c The CSB found that during the incident, the Board Operator communicated information about the process to emergency response personnel, possibly including readings from these detectors, but these concentration data do not appear to have been considered when determining the potential for dangerous methyl mercaptan concentrations off-site. The loss of the Shift Supervisor (Process Coordinator) appears to have contributed to DuPont La Porte’s not considering these data when assessing the magnitude of the release during the incident. 4.8.4 AIR MONITORING   DuPont La Porte personnel did not monitor (test) the air for methyl mercaptan along the site’s property line (fence line) during the release. DuPont did not have fixed fence-line detectors, necessitating the assignment of individuals to perform air monitoring manually. The company never performed this critical monitoring along the fence line during the initial release. Harris County personnel performed air monitoring near Texas Highway 225 (Figure 16) at approximately 8:07 am and did not detect methyl mercaptan in the air.d This air monitoring, however, was performed five hours after the release began and two hours after the methyl mercaptan pump was turned off (which significantly slowed the release). This value, therefore, did not accurately represent the off-site methyl mercaptan a There were three methyl mercaptan detectors located inside the manufacturing building, on the first and fourth floors. The third floor, where the release occurred, did not have any methyl mercaptan detectors. b The 25 ppm alarm set point is 50 times NIOSH’s REL of 0.5 ppm, and more than double OSHA’s ceiling limit of 10 ppm [50]. Therefore, alarming at this detection level could not protect workers from exposure to methyl mercaptan. c Post-incident, the methyl mercaptan detectors were tested and evaluated to determine whether they worked. Not all of the detectors had the correct span of 0 to 50 ppm, and so some of them would not have been able to read up to 50 ppm. Additionally, these detectors are limited to detecting a maximum concentration of 50 ppm. d During the morning of November 15, 2014, the Harris County Pollution Control Services Department and the Houston Bureau of Pollution Control and Prevention investigated odor complaints. There were 10 confirmed odor complaints downwind from the DuPont La Porte facility (see Appendix C: Odor Complaints). Page 59 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX concentrations during the release. A measurable concentration of methyl mercaptan would have been more likely to be detected when the methyl mercaptan pump was operating. GUIDANCE TO INDUSTRY  Monitoring for hazardous gases along the fence line at chemical facilities can help the company, emergency responders, and the public understand the nature and extent of a chemical release. Monitoring for hazardous gases at fence lines can be performed by fixed detectors, which can continually collect and record data, providing early notification of releases outside the property.a When fixed detectors are not available, a person using a portable gas detector may also perform air monitoring. This strategy, however, introduces additional risk because that individual may enter a hazardous or toxic environment. Proper PPE, including respiratory protection, must be worn during manual air monitoring operations. In conditions with an unknown concentration and a potential inhalation hazard, the proper respiratory PPE for personnel, under HAZWOPER, would be positive pressure air-supplying respirators (i.e., SCBAs) until it is determined to be otherwise.b Including air monitoring requirements in company emergency response plans and action checklists can help ensure that fence-line air monitoring is performed during emergencies. Personnel responsible for performing air monitoring should also be preassigned and quickly able to access air monitoring equipment. EMERGENCY RESPONSE CONCLUSIONS  As discussed in this section, there were significant deficiencies in DuPont La Porte’s emergency response to the toxic and flammable methyl mercaptan release. Many of the deficiencies stemmed from a flawed emergency response system, including flawed implementation of the emergency response plan. Solutions to most of these deficiencies are covered in Appendix D: Emergency Response Tables. The CSB encourages companies to review their emergency response systems and related plans to ensure they incorporate the lessons learned from this investigation. a In 2015, the EPA finalized a rule for refineries to monitor benzene at their fence lines [153, p. 3], [154], 40 C.F.R §§ 60, 63 (2015). In promulgating this rule, the EPA acknowledges the importance of monitoring potential sources of hazardous materials and their impact on the surrounding community [153, pp. 6, 9]. The CSB supported the EPA’s proposal for fence-line monitoring and advocated for an automatic, continuous system providing real-time data for several reasons, including strengthening community planning and preparedness [141, pp. 1-3]. b “Employees engaged in emergency response and exposed to hazardous substances presenting an inhalation hazard or potential inhalation hazard shall wear positive pressure self-contained breathing apparatus while engaged in emergency response, until such time that the individual in charge of the [incident command system] determines through the use of air monitoring that a decreased level of respiratory protection will not result in hazardous exposures to employees” (29 C.F.R. § 1910.120 (q)(3)(iv). Page 60 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 5 DUPONT’S PROCESS SAFETY MANAGEMENT SYSTEM  DuPont, an American Chemistry Council (ACC) member company and Responsible Care practitioner, experienced three major process safety incidents that the CSB investigated over the course of five years, despite implementing its own corporate process safety management system. These incidents were the 2014 La Porte, Texas, methyl mercaptan release; the 2010 Belle, West Virginia, phosgene release [14];a and the 2010 Buffalo, New York, hot work incident [15].b During the present investigation, the CSB found a large number of significant process safety deficiencies at DuPont La Porte that contributed to the incident (see Interim Recommendations and Section 6) [1]. According to CCPS, process safety management systemsc are “comprehensive sets of policies, procedures, and practices designed to ensure that barriers to episodic incidents are in place, in use, and effective” [16]. A process safety management system will have a variety of programs to address process safety. In addition to process safety, chemical manufacturing facilities typically also have programs to address personal safety. Personal safetyd programs and process safetye programs are distinct, and both are important. DuPont developed its own corporate process safety management system that integrated regulatory requirements and voluntaryf elements. Companies create their own process safety management systems to address regulatory requirements, including those under OSHA’s Process Safety Management (PSM) standard and the EPA’s Risk Management Plan (RMP) rule. Based on the chemicals stored on-site, including methyl mercaptan, DuPont La Porte determined that PSM and RMP applied to the Lannate® process (Sections 5.1.1 and 5.2.1). These federal safety regulations provide a process safety management system framework for companies to use in developing their own programs. In addition to meeting these regulatory requirements, DuPont also voluntarily sought to integrate the Responsible Careg Management System (RCMS) framework into the company’s own management system. a The CSB investigated three separate incidents that occurred in a 33-hour period at a DuPont facility in Belle, West Virginia. One worker was killed by the release of the highly toxic chemical phosgene [14]. b The CSB investigated a hot work incident in Buffalo, New York, that killed one contractor and seriously injured another [15]. c In general, the term process safety management system is interchangeable with process safety management program. d “Personal safety” incidents affect individual workers, resulting in first aid cases, recordable injuries, lost-time injuries, or fatalities. Typical causes of personal safety incidents include slips, trips, falls, lacerations, and dropped objects. Personal safety programs try to reduce the number of worker injuries from these types of hazards by managing individual behaviors. Common areas that personal safety programs address include personal protective equipment, stop work authority programs, working at heights, hazardous material communications, confined space permitting, lockout/tagout, cranes and heavy lifts, area access controls, and vehicle operation. e “Process safety” incidents, on the other hand, include chemical releases, fires, and explosions. Process safety incidents can result in large-scale destruction to site and community infrastructure and can lead to multiple injuries and fatalities. Process safety programs try to prevent these incidents by identifying and controlling the process hazards. Examples of process safety programs include process hazard analysis, inherently safer design, pressure relief systems, automated safety controls, operating procedures, management of change, audits, emergency response systems, and community involvement programs. f ACC’s Responsible Care Management System is one example of a voluntary process safety management system. Another is CCPS’s Risk Based Process Safety Management System, whose 20 process safety elements are detailed in Guidelines for Risk Based Process Safety [52]. g The chemical industry developed Responsible Care to help guide companies toward safe and responsible operation. Page 61 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX This section addresses DuPont’s requirements under OSHA, the EPA, and ACC that the DuPont La Porte site integrated into its site process safety management system used at the time of the November 15, 2014 incident:  OSHA’s Process Safety Management Standard (Section 5.1)  EPA’s Risk Management Plan Rule (Section 5.2)  ACC’s Responsible Care (Section 5.3) Additionally, this section discusses how DuPont integrated and implemented the frameworks provided by PSM, RMP, and Responsible Care into its own corporate safety management system. Ultimately, this PSM system governed operations at the DuPont La Porte facility at the time of the November 2014 incident (Section 5.4). DuPont La Porte’s ineffective implementation of the PSM standard, the RMP rule, Responsible Care, and DuPont’s corporate process safety management system resulted in numerous process safety deficiencies that led to the incident (Section 6). The incident prompted OSHA and the EPA to investigate the DuPont La Porte site and resulted in each of these agencies’ initiating enforcement actions for alleged violations of federal process safety regulations (Section 5.1.2 and Section 5.2.2). The November 2014 incident also caused both ACC and DuPont to evaluate and make changes to their process safety management systems (Section 5.3.4, Section 5.4.1.3, and Section 6.1). OSHA  The Occupational Safety and Health Act of 1970 (OSH Act) was enacted “to assure safe and healthful working conditions for working men and women; by authorizing enforcement of the standards developed under the Act; by assisting and encouraging the States in their efforts to assure safe and healthful working conditions; by providing for research, information, education, and training in the field of occupational safety and health; and for other purposes.”a The Act led to the establishment of OSHA on April 28, 1971 [17, p. 16]. OSHA developed the Process Safety Management standard in response to the 1990 Clean Air Act Amendments and multiple safety incidents, such as the 1984 Union Carbide toxic release in Bhopal, India, and the 1989 Phillips Petroleum Company explosions and fires in Pasadena, Texas [18]. 5.1.1 THE PROCESS SAFETY MANAGEMENT STANDARD  The stated purpose of the PSM standard is to prevent or minimize the consequences of catastrophic releases of toxic, reactive, flammable, or explosive chemicals that may result in toxicity, fire, or explosion hazards.b The a President Richard M. Nixon signed the Willams-Steiger Occupational Safety and Health Act of 1970 on December 29, 1970 [17, p. 17]. The OSH Act of 1970 (Jan. 1, 2004). b 29 C.F.R. § 1910.119. Page 62 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX standard aims to prevent these releases in locations where employees and others could be exposed to serious hazards resulting from chemicals that pose catastrophic risk when stored in quantities greater than stated thresholds [19]. Through this standard, OSHA strives to bring a systematic approach to addressing the hazards associated with these chemicals by establishing a framework for a process safety management system that integrates technologies, procedures, and management practices [18]. It does so through the PSM standard’s 14 elements,a which formalize bedrock safety principles in the form of regulatory requirements. Some of the requirements include performing a process hazard analysis (PHA), managing changes to a process or equipment, establishing sound operating procedures, ensuring adequate employee training and involvement, maintaining the mechanical integrity of all process equipment, and ensuring a satisfactory level of emergency preparedness in the event of a hazardous chemical release.b 5.1.2 DUPONT LA PORTE’S IMPLEMENTATION OF PSM  One of the avenues for the PSM standard to apply to a process is that a facility must store at least the established threshold quantity of what OSHA considers to be a highly hazardous chemical.c Based on the amount of methyl mercaptan stored at the DuPont La Porte facility, DuPont La Porte determined that PSM regulations applied.d Additionally, DuPont La Porte personnel integrated PSM requirements into the site’s process safety management system, including performing periodic PSM compliance audits. DuPont La Porte’s first-party PSM compliance audits,e which were divided over a three-year cycle, took 68 auditor-days to complete between 2012 and 2014.f These audits, however, did not identify or effectively correct long-standing PSM deficiencies in DuPont La Porte’s process safety management system (e.g., deficiencies in performing process hazard analysis and management of change) (for more detail, see Section 6: Process Safety Management Deficiencies). In the 10 years before the November 2014 incident, OSHA conducted one inspection at the DuPont La Porte facility a The 14 PSM elements are the following: employee participation, process safety information, process hazard analysis, operating procedures, training, contractor management, pre-startup safety review, mechanical integrity, hot work permits, management of change, incident investigation, emergency planning and response, compliance, and trade secrets. See 29 C.F.R. § 1910.119. b 29 C.F.R. § 1910.119. c The PSM standard applies to “(i) A process which involves a chemical at or above the specified threshold quantities listed in appendix A to this section; (ii) A process which involves a Category 1 flammable gas (as defined in 1910.1200(c)) or a flammable liquid with a flashpoint below 100°F (37.8°C) on-site in one location, in a quantity of 10,000 pounds (4,535.9 kg) or more except for: (A) Hydrocarbon fuels used solely for workplace consumption as a fuel (e.g., propane used for comfort heating, gasoline for vehicle refueling), if such fuels are not a part of a process containing another highly hazardous chemical covered by this standard; (B) Flammable liquids with a flashpoint below 100°F (37.8°C) stored in atmospheric tanks or transferred which are kept below their normal boiling point without benefit of chilling or refrigeration.” The PSM standard does not apply to “(i) Retail facilities; (ii) Oil or gas well drilling or servicing operations; or (iii) Normally unoccupied remote facilities” (29 C.F.R. § 1910.119(a)). d Under the PSM standard, the threshold quantity of methyl mercaptan is 5,000 pounds. 29 C.F.R. § 1910.119 (App. A). e 29 C.F.R. § 1910.119(o). f By dividing the PSM audits into a three-year cycle, the DuPont La Porte site was continually evaluated to see if it met PSM requirements. Page 63 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX following an oleuma release from the fluoroproducts section of the plant [20] [21]. After the November 2014 incident, OSHA investigated DuPont La Porte’s Lannate® facility for potential violations,b including identified PSM deficiencies that contributed to the methyl mercaptan release [22].c OSHA also performed an expanded inspection of the DuPont La Porte site (i.e., evaluated other business units’ compliance) under its National Emphasis Program (NEP) for chemical facilities [22].d Although the PSM standard was intended to be performance-based [23],e, f in some respects it functions primarily as a reactive and activity-basedg regulatory scheme. While OSHA intends for PSM program elements to reduce risk, no explicit requirement appears under the PSM standard to reduce risks or prevent catastrophic accidents. Moreover, OSHA is not responsible for proactively evaluating the effectiveness of controls or safeguards [24, pp. 31-32]. As discussed in the CSB’s investigation report Drilling Rig Explosion and Fire at the Macondo Well, Volume 4, the United States relies on a regulatory framework that can be satisfied by “checking the box” when completing a variety of required safety-related activities, such as a PHA or MOC. Yet mere compliance with those requirements can still fail to improve safety. The safety-related activity may not adequately identify major hazards or control major accident events, in part because the regulatory regime lacks targeted risk-reduction, goal-setting requirements [25, p. 26].h For example, a properly completed MOC can effectively reduce the potential for an accident; however, an ineffective one can satisfy regulatory requirements and still leave a facility with substantial unmitigated risk. Under the OSH Act, it is the employer’s responsibility to “furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or a Oleum is a dense, corrosive liquid consisting of concentrated sulfuric acid containing excess sulfur trioxide in solution [133]. Under Section 9 of the OSH Act, OSHA has six months to issue citations after a violation has occurred. c In May 2015, OSHA cited DuPont for 11 alleged safety violations stemming from the incident, including deficiencies in PHAs, operating procedures, equipment, MOCs, process safety information, training, alarm system, preventing toxic exposure, and contractor injury logs [164]. DuPont entered into a formal settlement with OSHA on July 17, 2017 [161]. d On July 9, 2015, OSHA cited DuPont for 8 alleged safety violations from an NEP inspection of the adjacent herbicide and fluoroproducts (hydrofluoric acid) business units at the DuPont La Porte site, including deficiencies in process safety information, process hazard analysis, operating procedures, inspections, and documenting and using recognized and generally accepted good engineering practices [155]. After issuing these citations, OSHA placed DuPont in its Severe Violator Enforcement Program [22]. On July 17, 2017, DuPont entered into a formal settlement agreement with OSHA [157]. e Also referred to as performance-based regulations, such goal-setting regulatory requirements and acceptance criteria are specified, and industry must document that its specific solutions meet the requirements, for example in terms of achieving acceptable risk levels. f Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents. Section III. Summary and Explanation of the Final Rule (February 24, 1992). g Activity-based standards and regulations require the mere completion of an activity and do not focus on the effectiveness of major accident prevention or risk reduction efforts. h The only two PSM elements that include goal-setting attributes are process hazard analysis and mechanical integrity. The PSM standard requires a PHA to “be appropriate to the complexity of the process and [to] identify, evaluate, and control the hazards involved in the process” (29 C.F.R. §1910.119(e)(1)). Additionally, under the heading “Mechanical Integrity,” the PSM standard requires that “the employer shall correct deficiencies in equipment that are outside acceptable limits (defined by the process safety information in paragraph (d) of this section) before further use or in a safe and timely manner when necessary means are taken to assure safe operation” (29 C.F.R. §1910.119(j)(5)). None of the other 12 elements include goal-setting requirements. Another example of a goal-setting system is ALARP (“As Low as Reasonably Practicable”). b Page 64 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX serious physical harm to his employees” and to “comply with occupational safety and health standards.”a Consequently, it is a company’s responsibility to ensure that its implementation of the PSM standard protects workers. OSHA typically investigates whether a company is effectively complying with PSM requirements, such as management of change, after an incident occurs. Some companies may be complying with PSM elements without actually reducing risks to employees, and that situation may not be recognized until after an incident occurs. For PSM elements to be effective in accident prevention, a facility’s implementation must be aimed at risk reduction, and company audits must be substantive, helping companies ensure that their PSM programs are working. 5.1.3 RECENT DEVELOPMENTS AFFECTING THE PSM STANDARD  The PSM standard has undergone little reform since its inception in the 1990s. Following the April 2013 explosion and fire at a fertilizer storage and distribution facility in West, Texas, President Obama issued Executive Order 13650, “Improving Chemical Facility Safety and Security.”b The executive order tasked a working group of federal agencies, including OSHA and the EPA, with modernizing policies, regulations, and standards to improve the safety and security of chemical facilities. In addition, the CSB placed “process safety management for the 21st century” on its Drivers of Critical Chemical Safety Change list because additional work is necessary to modernize federal process safety regulations [26]. ENVIRONMENTAL PROTECTION AGENCY  In early 1970, the United States began to experience a new and elevated sense of public concern about the environment, including air, land, and water pollution and protection. President Nixon sent to Congress a plan to consolidate many of the federal government’s environmental responsibilities under one new agency, the Environmental Protection Agency. Reorganizing would permit response to environmental problems in a manner that would exceed the previous capability of government pollution control programs. The EPA was established on December 2, 1970 [27]. 5.2.1 RISK MANAGEMENT PLAN RULE  The EPA’s Risk Management Plan rule constitutes that agency’s efforts aimed at chemical accident prevention through the creation of a process safety management system framework, paralleling OSHA’s PSM standard, discussed in the previous section.c Similar to OSHA’s PSM standard, the RMP rule applies to facilities that the Clean Air Act defines as stationary sources of air pollution, and that use or store specific regulated substances that the EPA has determined to be extremely hazardous in nature. If any of the specified toxic chemicals or a 29 U.S.C. § 654 (a) (2010). Exec. Order No. 13,650, 80 Fed. Reg. 34936 (Aug. 1, 2013). c 40 C.F.R. § 68. b Page 65 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX flammable substances are present at a facility at or above established threshold quantities listed by the EPA in its regulation, then the RMP rule applies to the chemical process using that substance at that facility. After determining that the RMP rule covers a process, a facility must determine which “prevention program” level (Program 1, 2, or 3) applies to the process, based on the process’s potential impact on the public, by using off-site consequence analyses, accident history, North American Industrial Classification System (NAICS) code classification, and PSM program applicability. Program 3a processes are subject to additional, more stringent requirements than Program 1b and Program 2c processes and must implement elementsd of a prevention program that are based primarily on OSHA’s PSM standard. In addition, the RMP rule requires all facilities to complete a hazard assessment based on analysis of worst-case and alternative (more likely) accident scenarios, and identify off-site consequences, compile a 5-year accident history, and coordinate with local emergency responders. Program 2 and 3 facilities must develop a management system to implement the RMP elements and address emergency response requirements of a responding or nonresponding facility to accidental releases of RMP substances. All of these facilities must submit to the EPA a risk management plan, which is a high-level summary of a facility’s implementation of and conformance with the RMP rule for all covered processes. A facility’s EPA risk management plan summary must include  an executive summary;  the registration information of the facility;  at least one worst-case scenario for regulated toxics and at least one worst-case scenario for flammables;  the five-year accident history of covered processes;  information concerning emergency response at the facility;  at least one alternative release scenario analysis for each regulated toxic substance and at least one alternative release scenario to represent all flammable substances; a Program 3 is the highest-level management program. Most PSM-covered processes are in Program 3, which requires a rigorous management program with detailed record retention criteria and all PSM program elements. Program 3 processes are either subject to OSHA’s PSM standard under federal or state OSHA programs or classified in one of 10 specified NAICS codes that require placement in Program 3. This designation imposes OSHA’s PSM standard as the prevention program as well as additional hazard assessment, management, and emergency response requirements [152], (40 C.F.R. § 68.12). b Program 1 is the lowest, simplest management program, covering processes that would not affect the public in a worst-case scenario and facilities that have recorded no accidents with specific off-site consequences within the past five years. This designation imposes limited hazard assessment requirements and minimal prevention and emergency response requirements [152], (40 C.F.R. § 68.12). c Program 2 is an intermediate management-level program and covers processes that cannot be designated as Program 1 but are not hazardous enough to be in Program 3. Program 2 imposes streamlined prevention program requirements, as well as additional hazard assessment, management, and emergency response requirements [152], (40 C.F.R. § 68.12). d Elements of RMP, similar to PSM requirements, include the following: process safety information, process hazard analyses, standard operating procedures, training, mechanical integrity, compliance audits, incident investigations, management of change, pre-startup reviews, employee participation, hot work permits, and contractors (40 C.F.R. §§ 68.65–68.87, Program 3 Prevention Program). Page 66 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX  a summary of the prevention program for each Program 2 process; and  a summary of the prevention program for each Program 3 process [28, pp. 1-2]. According to the EPA, the risk management plan can provide valuable information by identifying potential impacts of a chemical release, steps taken to prevent that release, and emergency procedures should the release occur, enhancing local first responders’ ability to prepare for and respond to an accident on a covered RMP process by fostering communications about and understanding of the hazards in the event of an emergency situation [29]. 5.2.2 DUPONT LA PORTE’S IMPLEMENTATION OF RMP  Based on the amount of methyl mercaptan stored at the DuPont La Porte facility, DuPont La Porte personnel determined that the RMP rule applied to the Lannate® process.a Additionally, DuPont La Porte personnel decided that Program 3 requirements applied to the Lannate® process and integrated Program 3 requirements into its process safety management system. For example, DuPont La Porte personnel conducted first-party compliance audits on its RMP program. These audits, however, were superficial, focusing on information presented in the submitted EPA risk management plan summary and not the substance of the RMP rule requirements. Although completing and submitting the risk management plan summary satisfies a part of the EPA’s regulatory requirement, the EPA typically does not assess the risk management plan’s effectiveness in reducing risk until after an incident. Similar to PSM, a company and its site managers are responsible for making their risk management plan effective.b After the incident, the EPA conducted an inspection of the DuPont La Porte facility and alleged 22 separate violations of the RMP, including failure to develop and implement written operating procedures, failure to adequately implement MOC procedures, failure to implement safe work practices, and mechanical integrity violations. This RMP inspection was the first one conducted at the DuPont La Porte facility. Based on these allegations, on behalf of the EPA, the U.S. Department of Justice filed a complaint on Monday, July 23, 2018, along with a stipulation of settlement with DuPont, in the U.S. District Court for the Southern District of Texas. According to the settlement, DuPont was required to pay $3.1 million in civil penalties without admitting liability. The EPA did not seek corrective actions because the DuPont La Porte facility is no longer manufacturing chemicals [30]. a Under RMP, the threshold quantity for methyl mercaptan is 10,000 pounds (40 C.F.R. § 68.130, Table 1). DuPont La Porte identified in its RMP a methyl mercaptan scenario that could lead to an off-site impact. b Under the General Duty Clause of the Clean Air Act Amendments of 1990, the owners and operators of facilities that have regulated and other extremely hazardous substances are responsible for ensuring that their chemicals are managed safely (42 U.S.C. § 7412(r)(1)). Page 67 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 5.2.3 RECENT DEVELOPMENTS AFFECTING THE RMP RULE  As noted above, President Obama’s Executive Order 13650, “Improving Chemical Facility Safety and Security,” created what the order referred to as the Chemical Facility Safety and Security Working Group. The working group took on many tasksa required by the executive order, including reviewing chemical hazards covered by RMP and PSM to determine if the RMP or PSM regulatory structures could and should be expanded to address additional regulated substances and types of hazards. In addition, the EPA and the Department of Labor were thereafter required to develop a plan, including a timeline and resource requirements, to implement and enforce any expansion of RMP and PSM in a manner that would address those additional regulated substances and types of hazards.b In response to the executive order, on July 31, 2014, the EPA published a request for information concerning its proposed supplementation of its RMP rule [31]. On March 14, 2016, the EPA published its proposed rule, titled Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 112(r)(7), for notice and comment [32]. On January 13, 2017, the EPA published a final RMP rule amending 40 C.F.R. § 68 requirements (82 Fed. Reg. 4594). Before the rule took effect, the EPA delayed the implementation of the January 13, 2017 amendments until February 19, 2019, to review three petitions it had received requesting reconsideration of the final rule.c Because PSM and RMP modernization is a priority goal of the CSB (see “Drivers of Critical Chemical Safety Change” [33]), the CSB provided written comments to the EPA on these occasions.d On September 21, 2018, the U.S. Court of Appeals for the D.C. Circuit issued its mandate, making the 2017 RMP Amendments Rule effective [34]. On December 3, 2018, the EPA published a final rule that will incorporate the RMP amendments into the Code of Federal Regulations (40 C.F.R. § 68) [34]. The EPA is also working on an RMP Reconsideration Rule, which proposes rescinding certain amendments, including those related to safer technology and alternative analyses, third-party audits, incident investigations, and information availability [35]. This proposed rule would also modify amendments relating to local emergency coordination, emergency exercises, public meetings, and compliance dates [35]. a For more information, see the Department of Homeland Security’s “Actions to Improve Chemical Facility Safety and Security—A Shared Commitment.” b Exec. Order No. 13,650, 80 Fed. Reg. 34936 (Aug. 1, 2013). c On June 14, 2017, the EPA published a final rule to delay the effective date of the RMP rule amendments until February 19, 2019 (82 Fed. Reg. 27133 (June 14, 2017)). In July 2017, various plaintiffs filed a petition for judicial review of the June 14, 2017 delay rule. On August 17, 2018, the U.S. Court of Appeals for the D.C. Circuit vacated the June 14, 2017 EPA regulation that delayed the effective date of the final RMP Amendments Rule (Air Alliance Houston et al. v. EPA et al., No. 17-1155 (DC Cir. 2018)). d Before the EPA issued its final RMP Amendments Rule on January 13, 2017, the CSB also expressed encouragement to the EPA over the needed improvements contained in its new regulations intended to prevent chemical incidents. The CSB viewed this activity to be a good initial step, since the rule adopted several new requirements to help advance chemical safety and the prevention of accidental releases, including improving communication between facilities and emergency responders, requiring root cause analyses of incidents and near misses, and requiring chemical facilities to consider “inherently safer” chemicals and production processes [143]. That is why, in July 2018, the CSB wrote with great concern to the EPA in response to that agency’s May 30, 2018, proposed rule, which proposed scaling back what had been previously proposed on January 13, 2017 [137]. For more information on the current RMP rule requirements, see “RMP Amendments Compliance Information” from the EPA. Page 68 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX AMERICAN CHEMISTRY COUNCIL  The roots of the American Chemistry Council (ACC) go back to the late 1800s and the formation of the Manufacturing Chemists’ Association. In 1978, the association changed its name to Chemical Manufacturers’ Association. Finally, in 2000, the association became the ACC [36]. The ACC’s mission is “to deliver value to our members through advocacy, using best-in-class member engagement, political advocacy, communications, and scientific research” [37]. The ACC is a trade organization in the United States that represents chemical companies [37] and requires its member companies to adhere to its Responsible Care program, a voluntary program developed by the chemical industry to help guide companies toward safe and responsible operation [38]. The design and implementation of this program are independent of government involvement and legislative or regulatory requirements.a According to the ACC, industry-based trade associations and process safety management systems, however, can only supplement government process safety regulations.b Even though DuPont experienced major chemical safety incidents and process safety management deficiencies, it still met its Responsible Care requirements. At the time of the November 15, 2014 incident, DuPont’s process safety management system conformed to the requirements of the Responsible Care Management System (RCMS), a key part of Responsible Care. As part of RCMS, DuPont La Porte’s process safety management system was audited for conformance. Neither first-party nor third-party Responsible Care conformance audits identified, prevented, or mitigated deficiencies in DuPont La Porte’s implementation of its management system (see Section 6). The November 15, 2014 incident at DuPont La Porte played a role in the ACC’s launch of a Process Safety Performance Improvement Task Force, discussed later in this section, endorsed to drive continuous improvement in process safety and occupational safety. This section discusses the history of Responsible Care (Section 5.3.1), the current requirements for Responsible Care (Section 5.3.2), the Responsible Care conformance audits at DuPont La Porte (Section 5.3.3), recent a Responsible Care is practiced in 65 economies around the world [89]. In some instances, Responsible Care is a requirement of a local trade association, allowing the associations to implement it according to their needs [88, p. 2]. b In the ACC’s public comment to the EPA’s RMP revisions (see Section 5.2.1), it suggested that instead of having new requirements for Safer Technology and Alternatives Analysis, there should be a working group to evaluate leveraging the use of voluntary programs such as Responsible Care to achieve these goals [126, p. 43]. Additionally, the ACC’s Process Safety Code states that the code “is also intended to complement regulatory requirements (e.g., OSHA’s PSM standard and EPA’s RMP standard). Regulatory standards, by necessity, focus on process safety at an individual facility. In contrast, the Process Safety Code addresses issues at a more universal level, such as across a division or corporation, and includes a company commitment to set expectations regarding process safety, define accountability for process safety performance, and allocate adequate resources to achieve performance expectations” [44, p. 1]. Page 69 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX developments in Responsible Care (Section 5.3.4), and improvement opportunities for Responsible Care (Section 5.3.5). 5.3.1 HISTORY OF RESPONSIBLE CARE  Prompted by several serious process safety incidents in the 1980s (notably the 1984 Bhopal disaster),a the Canadian Chemical Producers’ Association drafted the original Responsible Care Codes. Member companies were required to adhere to these codes to build public trust by showing that they were committed to “doing the right thing” by operating safely and responsibly [39]. In 1988, the ACCb—a U.S. trade association that currently represents 187 companiesc—adopted Responsible Care and made it a condition of membership [40].d Since its adoption, ACC’s Responsible Care program has evolved through efforts to meet the needs of industry and its members.e For example, in 2003, ACC reshaped its Responsible Care obligations from a series of codes into a management system called RCMS,f which is intended to provide a framework for integrating Responsible Care within a company’s management system. In 2003, ACC also added a third-party audit verification requirement to determine whether member companies are meeting their Responsible Care obligations. ACC made additional changes to the Responsible Care requirements in 2004, 2005, 2008, 2012, 2013, and 2017.g Furthermore, according to the ACC, “the development of the Process Safety Code demonstrates how Responsible Care evolves to maintain and improve effectiveness, as well as responds to industry trends and field learnings.” The ability to make such changes to the Responsible Care program quickly gives the ACC the flexibility to adapt the program as needed areas of improvement are identified from industry trends and field learnings. Regulatory changes, on the other hand, are historically more difficult and time-intensive to implement (see Sections 5.1.1 and 5.2.1). a On December 3, 1984, a methyl isocyanate release at the Union Carbide insecticide plant in Bhopal, India, resulted in an estimated 3,800 deaths within days, and tens of thousands of injuries. Over a period of years, the release killed tens of thousands of people [148]. b At the time of adoption of Responsible Care, the ACC was known as the Chemical Manufacturers Association. It changed its name to American Chemistry Council in June 2000 [119]. c The ACC represents 140 members, 17 affiliates, and 17 associate companies [170]. d An international trade association, the International Council of Chemical Associations, manages Responsible Care. The requirements, however, vary between member countries [89]. In this section, unless otherwise stated, Responsible Care requisites refer to the ACC’s obligations in the United States. e For example, an explosion occurred at the First Chemical plant in Pascagoula, Mississippi, in 2002. The CSB investigated the incident and found significant differences between what the company asserted in its Responsible Care self-audit report and the actual facility status before the explosion. After the accident, the ACC changed its audit methodology from sole reliance on first-party audits to the use of independent third-party audits [146, p. 59], [87, p. 20]. f The ACC defines a management system as a set of organized policies, procedures, and practices that express a set of commitments around a set of core objectives and values. g The ACC changed the Technical Specification in 2004, 2005, 2008, and 2013 [41, p. 18]. The Guiding Principles were revised in 2008 [40]. The third-party audit requirements were changed in 2017 [92]. The Product Safety Code and Process Safety Code were approved in 2012 and required beginning in 2013 [40], [41, p. 16]. Page 70 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 5.3.2 RESPONSIBLE CARE REQUIREMENTS  Today’s Responsible Care program has four main program elements: 1. Adhering to the Responsible Care Guiding Principles 2. Implementing the Responsible Care Product Safety Code, Process Safety Code, and Security Code 3. Measuring and publicly reporting performancea 4. Applying the Responsible Care Management System to achieve and verify results [38] According to the ACC, the Guiding Principles serve as the ethical foundation of the Responsible Care program [41, p. 1]; the Technical Specification of the RCMS and the supplemental codes are the portions of the system that have to be audited [42]. DuPont—as a member of the ACC—agreed to implement the latest versions of the Guiding Principles, Technical Specification, Security Code,b Product Safety Code,c and Process Safety Code. Per the ACC, Responsible Care’s 12 Guiding Principles are its foundation [41, p. 1]. ACC member companies endorse and commit to these aspirational objectives, which include the following:  To design and operate facilities in a safe, secure, and environmentally sound manner  To instill a culture throughout all levels of the organizations to continually identify, reduce, and manage process safety risks  To make continual progress toward a goal of no accidents, injuries, or harm to human health and the environment from products and operations, and openly report health, safety, environmental, and security performance [43] The ACC built the RCMS from its Responsible Care principles. The ACC asserts that the RCMS “is an integrated health, safety, security and environmental management system based on the principles of Responsible Care and the Policy-Plan-Do-Check-Act continual improvement cycle” [41, p. 1]. The Responsible Care Technical Specification divides the requirements of the RCMS into five categories: policy and leadership; planning; implementation, operation, and accountability; performance measurement and corrective and preventive action; and management review [41, p. 5]. The requirements stated in the Technical Specification overlap with both PSM and RMP. These requirements incorporate developing a management system that a The ACC publicly reports specific personal and process safety metrics by company and personal and process safety metrics in aggregate [127]. b According to the ACC, it adopted the Responsible Care Security Code “to further enhance the security of our facilities, our communities, and the essential products we produce” [128]. c According to the ACC, it adopted the Responsible Care Product Safety Code “to drive continuous improvement in chemical product safety as part of the industry’s signature environmental, health, safety, and security management system” [129]. Page 71 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX includes employee participation, process safety information, compliance (conformance audits), incident investigation, training, emergency planning and response, MOC, PHA, and contractor management. The ACC expanded its third-party audit requirements by adding codes. The organization states that these codes aim to supplement the Technical Specification of the RCMS [44, p. 1]. In 2012, the ACC published its Responsible Care Process Safety Code of Management Practices [44], requiring member companies to implement it by January 1, 2013 [41, p. 16]. The ACC states that the code sets forth its “collective commitment to a culture of process safety throughout our chemical processing operations, management systems and leadership organizations” [44, p. 1]. Additionally, the code “aims to supplement existing process safety requirements contained within the Responsible Care Management System® … technical specifications, by specifically addressing process safety concepts such as leadership, accountability, and culture in order to drive overall process safety performance improvement” [44, p. 1]. The Process Safety Code breaks down its management practices into seven categories: leadership and culture; accountability; knowledge, expertise, and training; understanding and prioritization of process safety risk; comprehensive process safety management system; information sharing; and monitoring and improving performance [44, pp. 1-3]. This code strengthens and expands obligations stated in the Responsible Care Technical Specification for practitioners to establish a comprehensive process safety management system [44, p. 2]. From Responsible Care’s Process Safety Code of Management Practices: “Companies will design systems to manage and mitigate identified risks with adequate safeguards. Management of process safety will take into account passive controls; engineering controls; operational controls; inherently safer approaches; inspection, maintenance and mechanical integrity programs; management of change procedures; and scenario planning” [44, p. 2]. Page 72 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 5.3.3 RESPONSIBLE CARE CONFORMANCE AUDITS  To verify conformance with the RCMSa and Responsible Care Codes,b ACC member companies must undergo an independent third-party auditc performed by a qualified auditord every three years [41, pp. 4, 16]. This audit evaluates the practicese of the corporation’s headquarters and a sampling of the company’s facilities,f depending on the number of facilities a company has [42, pp. 6-8]. For example, large companies, such as DuPont, which had more than 40 facilities at the time of the 2014 incident, can retain their certification by auditing only eight of their facilities and their headquarters every three years.g The ACC designed the auditing system to allow companies to manage their auditing process, including multiple location visits over their audit cycles. According to the ACC, companies can consider risk and other factors to determine which facilities to submit for third-party audits [42, pp. 7-8]. For example, DuPont’s Responsible Care auditing process began in 2005 and the company planned on completing all of its facility audits by 2019. As seen in DuPont’s plan, it could take more than 14 years before a facility is audited again under Responsible Care, potentially allowing facilities to fall out of certification or to be inconsistent with other company facilities for many years while the company remains certified under Responsible Care. Additionally, Responsible Care’s third-party audit requirements are divided into three groups, depending on the number of facilities a company has. As shown in Figure 19, the more facilities a company has, the smaller the percentage of its facilities that have to be audited during an audit cycle to obtain Responsible Care certification [42, p. 7]. a RCMS is contained in the Technical Specification of the code. This specification is the only portion of RCMS that is required to be audited. Responsible Care has undergone multiple changes including a shift to third-party audits and the addition of a Process Safety Code. The CSB recommended to the ACC in its investigation into an explosion at First Chemical that the ACC “ensure that ACC members understand the audit requirements of Responsible Care and accurately identify and address gaps in facility process safety programs” [146, p. 67]. Beginning in 2004, the ACC shifted from first-party to independent third-party audits for certification of a company’s RCMS program. It also required companies to report their statistics on the Responsible Care website. In 2012, Responsible Care added the Process Safety Code to supplement the Technical Specification, making it auditable as well [40]. b In November 2017, the ACC changed its third-party audit requirements [92, pp. 3-4]. c DuPont used both third-party audits and self-audits (first-party) to demonstrate conformance with Responsible Care. Self-audits are conducted by auditors from the facility being audited, and third-party audits are conducted by auditors from an independent organization [66, pp. 27-28]. d Third-party audits are not done by ACC; they are performed by independent auditing firms accredited by the ANSI-ASQ National Accreditation Board (ANAB). e The portions of Responsible Care that are audited are the Technical Specification and supplemental codes (Process Safety, Security, and Product) [45, p. 10]. f According to the ACC, for purposes of auditing, a facility is defined as a “location falling under an ACC member’s/Responsible Care Partner’s dues calculations at which commercial chemicals are manufactured, handled, transported, [and] stored and where employees or others working on behalf of the ACC member/Responsible Care Partner are present” [42, p. 2]. g The ACC requires that two-thirds of the facilities currently being audited be among those not audited in the previous audit cycle [42, p. 7]. Page 73 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 19.  Excerpt from Responsible Care’s Third‐party Audit Requirements.  It shows the more facilities a  company has, the lesser are the audit requirements [42, p. 7].  Source: ACC.  The ACC acknowledged that the DuPont La Porte site met its Responsible Care requirementsa in 2007, following a third-party audit conducted at the DuPont La Porte facility that certified the facility to be in conformance with the RCMS Technical Specification requirements.b This was the only third-party Responsible Care evaluation ever performed at the DuPont La Porte facility. A third-party evaluator determines only if a facility is meeting the Responsible Care requirements that exist at the time of the third-party audit. Furthermore, a third-party certification does not imply that a facility is meeting its RCMS requirements years later without an additional evaluation of the facility. Additionally, DuPont La Porte personnel performed six self-audits between 2007 and the date of the incident.c None of these audits, however, identified or effectively corrected the many serious and long-standing process safety deficiencies at the site. These process safety deficiencies were discussed in the CSB Interim Recommendations for this incident and are also described in this report in Section 6 [1]. a At the time of the 2007 audit, the Product Safety and Process Safety codes were not in place and the Guiding Principles were located in the Technical Specification. b According to the ACC, conformance means meeting code implementation and reporting deadlines; completion of required RCMS thirdparty certification in three-year cycles; and annual reporting of performance results, including process safety incident data. c The DuPont La Porte facility did include in its first-party audit the new requirements for Responsible Care. Page 74 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Although Responsible Care requires robust process safety programs at its member facilities, the CSB found that the RCMS on its own is not sufficient to ensure that a particular facility’s safety programs are effective.a For example, the quality of an audit or assessment can be affected by the amount of information it evaluates. An average Responsible Care third-party audit that evaluates a facility’s management system lasts three to five days [45, p. 6],b a relatively short amount of time to analyze significant and complex matters, which could potentially limit the scope and depth of any audit. The ACC’s expectation is that a company’s internal audit process be more detailed than the Responsible Care external audit. For example, a DuPont La Porte environmental, health, and safety manager stated that the facility’s Responsible Care audits were not as detailed as the audits the company performed to verify compliance under OSHA’s PSM standard.c DuPont La Porte’s 2007 third-party audit, which covered about 800 employees and contractors and three business units, took 12 auditor-days.d On the other hand, DuPont La Porte’s first-party PSM compliance audits,e which were divided over a three-year cycle, took 68 auditor-days to complete between 2012 and 2014.f Despite taking more than five times the auditor-days of the Responsible Care audit, the PSM compliance audit requirements were not sufficientg to identify and resolve process safety management deficiencies that contributed to the November 2014 incident (see Section 6). The ACC believes that Responsible Care audits verify that a robust, effective management system is in place [46]. The ACC further believes its auditable Process Safety Code “differs from regulatory standards that, by necessity, focus on process safety at an individual facility. The Process Safety Code is more universal—it addresses issues across a division or corporation, and includes a company commitment to set process safety expectations, define accountability for process safety performance and allocate adequate resources to achieve performance expectations” [47]. Understanding the health of an organization’s process safety management system, however, requires a comprehensive assessment of the content and implementation of its programs. a The ACC has stated to the CSB, “RCMS is not intended to be a company’s sole safety program. RCMS is one component of the Responsible Care program.… Responsible Care is intended to complement regulatory requirements, a company’s safety processes, and other initiatives—not replace them.” Moreover, the 2004 RCMS Technical Specification states, “the RCMS is also designed to incorporate individual company processes for maintaining regulatory compliance and implementing other company programs and commitments such as sustainable development initiatives.” b According to a 2015 ACC document, the usual cost for a third-party conformance audit ranges from $6,000 to $10,000. The audit typically costs $2,000 per audit day (travel plus auditor time). The CSB calculated the three to five days for audits based on these numbers [45, p. 6]. See American Chemistry Council and National Association of Chemical Distributors, A Comparison of ACC Responsible Care® and NACD Responsible Distribution® Initiatives. c OSHA requires PSM audits to be performed at least every three years at all facilities covered by the standard (29 C.F.R. § 1910.119(o)). d Two auditors worked six days to complete the audit. e 29 C.F.R. § 1910.119(o). f Through the division of the PSM audits into a three-year cycle, the DuPont La Porte site was continually evaluated to see if it met PSM requirements. g In past investigations, the CSB has identified areas of PSM that could be improved upon. “Modernization of U.S. Process Safety Management Systems,” previously on the CSB’s Drivers of Critical Chemical Safety Change List, was renamed in 2018 to “Process Safety Management for the 21st century” and remains on the list [26]. Page 75 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Although the ACC can remove membership from companies not satisfactorily conforming to the Responsible Care program,a one of the program’s objectives “is to keep as many companies actively implementing the program and striving to continuously improve their performance as possible” [48, p. 1]. This objective is contained in its Guiding Principles: To make continual progress toward a goal of no accidents, injuries or harm to human health and the environment from products and operations and openly report health, safety, environmental and security performance [43]. DuPont was meeting its Responsible Care requirements, as demonstrated by its audits, even though it continued to have major process safety incidents across the company.b The ACC informed the CSB that the November 2014 incident at the DuPont La Porte facility, however, “played a role in the launch of an ACC Process Safety Performance Improvement Task Force.” 5.3.4 RECENT DEVELOPMENTS IN RESPONSIBLE CARE  As noted in the previous section, the November 15, 2014 incident played a role in launching the ACC Process Safety Performance Improvement Task Force. The ACC Board’s Responsible Care Committeec proposed the task force, and it was endorsed by the ACC in November 2015 to drive continuous improvement by industry in process safety and occupational safety. In June 2016, the ACC Board approved the task force’s recommendations, including the following:  Establishment of new incident information and practice sharing forums  Formation of regional support networks  Enhanced collaboration with professional societies  Enriched data analytics and modified responsible metrics reporting  Continuous improvement Since the adoption of these recommendations, the ACC has begun implementing several of them. According to the ACC, starting in 2016, its Process Safety Committee has held annual process safety forums for ACC members to “share process safety information, lessons learned, and exemplary practices.” Additionally, the ACC developed a regional network model for sharing noncompetitive process safety knowledge and solutions a In the last 10 years, the ACC has removed six companies from its membership due to their failure to meet their Responsible Care requirements, and in other instances, companies opted to resign voluntarily from Responsible Care prior to potential removal. b The three major investigations were CSB DuPont La Porte Interim Recommendations [1]; E.I. DuPont de Nemours & Co., Inc., Belle, West Virginia: Methyl Chloride Release, Oleum Release, Phosgene Release [121]; E.I. DuPont de Nemours & Co Inc. Buffalo, New York Flammable Vapor Explosion [122]. c The Board Responsible Care Committee is composed of ACC member CEOs or presidents [45, p. 22]. Page 76 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX between site process safety practitioners. Specifically, the ACC established regional networks in Houston and Philadelphia and is developing three additional networks. Another development within the Responsible Care program is the ACC’s adoption of American Petroleum Institute (API) Recommended Practice 754—Process Safety Indicators for the Refining and Petrochemical Industries [49].a The ACC assessed some of its 2017 data and publicly reported its high-level findings in 2018.b 5.3.5 RESPONSIBLE CARE IMPROVEMENT OPPORTUNITIES  In light of the multiple DuPont incidents, the CSB encourages the ACC to evaluate Responsible Care and the RCMS for additional improvement opportunities, with the goals of helping member companies identify and correct process safety deficiencies, and preventing major chemical incidents at member company facilities.c An example of an opportunity for Responsible Care to strengthen its verification systems is including the aspirational Guiding Principles in its third-party verification audits. For example, a Responsible Care auditor could delve deeper than the management system and evaluate buildings that contain process equipment, given that one of the Responsible Care Guiding Principles is “to design and operate facilities in a safe, secure, and environmentally sound manner” [43].d As demonstrated by the facts of this incident, the Lannate® manufacturing building had design deficiencies. The portion of the manufacturing building where the incident took place did not have a stated design purpose—the building was not designed for the process, and the process a API 754 covers leading and lagging process safety indicators. According to API 754, “The purpose of process safety indicators is to identify events or conditions that could ultimately lead to higher-level consequences. Indicators provide a means to measure activity, status, or performance against requirements and goals. Monitoring and analyzing performance enables Companies to take corrective action as needed. Properly defined and understood indicators can give Companies confidence that the right things are being managed and tracked” [49, p. 23]. API further explains, “Leading indicators tend to be forward-looking and indicate the performance of the key work processes, operating discipline, or protective barriers that prevent incidents. They are designed to give an indication of potential problems or deterioration in key safety systems early enough that corrective actions may be taken” [49, p. 24]. Conversely, API 754 elaborates, “Lagging indicators tend to be outcome-oriented and retrospective; they describe events that have already occurred and may indicate potential recurring problems [that] may include fires, releases, and explosions” [49, p. 23]. In reliance on the now-familiar fourtier pyramid diagram first introduced by H. W. Heinrich in 1931 as a representation of his study of accident data gleaned from the insurance industry, API 754 breaks down indicators across four tiers. From top to bottom, indicators progress from lagging (Tier 1) to leading (Tier 4) [49, pp. 11-12]. The ACC has adopted API 754 to the Tier 2 level—a loss of primary containment but of lesser consequence than a Tier 1 incident (e.g., no casualties, property damage less than $2,000, on a release of less than a predefined reportable quantity of a process chemical) [145, p. 153]. The ACC has required mandatory reporting under API 754 beginning in calendar year 2018 for 2017. The CSB has discussed API 754 in its Macondo (Volume 3) and Williams investigations. Additionally, as part of the Macondo investigation, the CSB held a public hearing on process safety indicators. The CSB has also looked toward CCPS on approaches to leading and lagging indicators in its Guidelines for Process Safety Metrics. b The ACC reported Tier 1 findings and is still in the process of reviewing Tier 2 events [104]. For more information, see Responsible Care Process Safety. c As a result of its First Chemical investigation, the CSB previously made a recommendation to the ACC to evaluate its audit program: “Ensure that ACC members understand the audit requirements of Responsible Care and accurately identify and address gaps in facility process safety programs” (2003-01-I-MS-R11), [146, p. 67]. d At the time of the 2007 third-party RCMS conformance audit, the Responsible Care Guiding Principles were different and were included in the RCMS Technical Specification. The principle at the time of the audit that most closely relates is “To operate our facilities in a manner that protects the environment and the health and safety of our employees and the public.” Page 77 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX equipment did not need to be inside a fully enclosed manufacturing building.a Yet even without a process requirement to do so, DuPont accepted significant process risk by housing process equipment inside the enclosed building, making personnel vulnerable to highly toxic chemical exposure and asphyxiation hazards that DuPont had not effectively identified or controlled. The manufacturing building was not designed to limit the impact of a toxic chemical leak by containing the leak and routing it to a destruction device, such as an incinerator or scrubber. The manufacturing building trapped vapors from highly toxic chemical leaks and concentrated them inside the building, increasing risk to workers [1, p. 3]. Furthermore, this design did not eliminate the hazards associated with a release to the community or environment, which an effectively designed containment buildingb could have done. Since the manufacturing building’s ventilation fans (if functional) routed any toxic chemicals within the manufacturing building to the roof, discharging them directly to the atmosphere without an additional destruction device, they did not decrease the potential for a hazardous off-site release [1, p. 33]. In this case, a robust assessment of the process’s location inside the manufacturing building could have identified the hazards presented. To achieve the ACC’s aspirational objectives, such as “design[ing] and operat[ing] facilities in a safe, secure and environmentally sound manner” [43], Responsible Care auditors should look for deficiencies inconsistent with Responsible Care’s Guiding Principles. When the ACC developed the original RCMS Technical Specification in 2003, it fully incorporated the entire aspirational Guiding Principles into the specification. The ACC informed the CSB that adding the Guiding Principles as an element into its RCMS Technical Specification proved challenging for auditors and those audited, since the Guiding Principles overlapped with requirements found in other sections of the Technical Specification or within a company’s existing procedures, creating confusion as to whether separate, additional actions were necessary to show conformance with this element. In 2008, the ACC replaced the listing of the Guiding Principles within the RCMS Technical Specification with what it believed was a streamlined set of auditable requirements intended to reflect the key objectives of the Guiding Principles. The ACC stated that based on its experience, it believes the change it adopted in 2008 is the most effective way to address the key objectives of the Responsible Care Guiding Principles. Another opportunity for Responsible Care to improve its verification program is to evaluate whether the company’s process safety management system is functioning as the company intends. For example, Responsible Care requires companies to establish and maintain systems to “protect the environment, conserve resources, protect worker health and create a safe and secure work environment” and to “establish and maintain procedures to respond to accidents and emergency situations, and for preventing and/or mitigating the impacts a The packaging area of the building on the ground floor (west side) may have had a legitimate need to be inside a building. Dust control and keeping the packaging equipment and methomyl product dry appeared to be important considerations that may have justified keeping packaging area equipment housed inside a building [1, p. 32]. b A containment building is an enclosure around process equipment to contain potential releases to the environment. Companies typically use containment buildings to reduce off-site risk. DuPont La Porte has stated that the manufacturing building was not a containment building [1, p. 3]. According to CCPS, “a containment building provides protection outside the building, but can also trap and concentrate material from small leaks inside the building, increasing the risk to personnel. Provisions must be made to ensure worker protection for a process located in a containment building, such as monitoring the atmosphere in the containment structures, restricting access, and requiring proper personal protective equipment when entry into the containment structure becomes necessary” [109, p. 59]. Page 78 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX that may be associated with them” [41, pp. 8-9]. The CSB identified that the DuPont La Porte Responsible Care audits, however, did not evaluate whether the safety programs implemented to protect employees from potentially hazardous environments, such as the toxic methyl mercaptan detectors inside the manufacturing building, met the facility’s stated design purpose. For example, the 2007 La Porte Responsible Care third-party audit identified the existence of the methyl mercaptan detection system but did not evaluate whether this system could effectively protect workers by warning them of potentially toxic environments. It found the detection system to be in conformance simply because it existed. The CSB, on the other hand, found by evaluating DuPont La Porte’s MOC documentation and relevant chemical safety information that the alarm limits did not meet the intent of protecting personnel. Specifically, the methyl mercaptan detectors inside the manufacturing building were set to alarm at 25 parts per million—a value 50 times greater than the NIOSH recommended exposure ceiling limit and more than double OSHA’s ceiling limit [50], [51]. During the November 2014 incident, these methyl mercaptan detectors were alarming; however, the system did not signify an early release of methyl mercaptan (see Section 4.8.3), and the detectors did not warn workers that they were potentially in a life-threatening toxic environment, because the alarms were set above OSHA’s ceiling limit and they were not communicated to personnel. Additionally, Responsible Care audits did not identify the gaps in DuPont’s corporate standard for the Management of Highly Toxic Materials that allowed toxic gas detection systems to be set above OSHA exposure limits. Although the ACC does not make prescriptive requirements for its member companies, it should ensure that safety systems, such as toxic gas detection systems, will protect workers from unsafe conditions by functioning as the company intended. An effective Responsible Care audit can identify these discrepancies and an auditor can issue nonconformances or recommendations (opportunities for improvement) at the end of the audit. The ACC has multiple opportunities to improve Responsible Care, including assessing Responsible Care’s Guiding Principles in conformance audits, ensuring that safety systems effectively control hazards presented, and seeking to add value to the safe operation of member companies where possibilities present themselves. Because Responsible Care is a voluntary program applied by 187 companies in the United States and can readily adapt to change, it has the potential to be a powerful process safety program.a To fulfill Responsible Care’s original mission to build public trust by showing that chemical companies are committed to “doing the right thing” by operating safely and responsibly, and its Guiding Principles “to seek continual improvement in the integrated Responsible Care Management System to address environmental, health, safety and security performance,” the ACC should continue to seek opportunities to strengthen its Responsible Care program [15], [43]. GUIDANCE TO INDUSTRY  Although this section focused on Responsible Care, these learnings can apply to any safety management system. Companies can use a variety of programs to manage and evaluate their process safety management systems. a The ACC’s Responsible Care program covers multiple aspects of safety, including process safety, security, product safety, environmental protection, and occupational safety. Page 79 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Without an adequate focus on the effectiveness of a process safety management system and its corresponding safety program elements, such as the 20 elements of Risk Based Process Safety [52], implementing the system will likely not be sufficient to prevent major chemical incidents. Chemical companies should conduct comprehensive assessments of their process safety management systems and the accompanying implementation of those systems and safety program elements to understand the overall health of their organizations, including the effectiveness of accident prevention efforts and the resiliency of operations. Companies should assess the implementation of these systems and their associated safety program elements associated with them. Some ways in which a company can ensure effectiveness include these: 1. Ensuring that all company sites adhere to core process safety management system elements and stay current with all updates and changes to that system. Because companies can adapt to process safety learnings quickly, their process safety management systems should ensure that sites are evaluated to ensure consistency with evolving practices to maximize the effectiveness of these safety improvements. 2. Investing sufficient time and resources to conduct robust audits. This investment should help ensure that audits are not rushed and help companies meet the goal of preventing major chemical accidents. DUPONT’S DEVELOPMENT AND IMPLEMENTATION  OF ITS PROCESS SAFETY MANAGEMENT SYSTEM   DuPont has long been perceived as a safety leadera and has asserted that its history of process safety extends over two centuries, from its gunpowder manufacturing through its present-day production of chemicals [53, p. 114]. Over the course of this time, DuPont’s process safety management system evolved with the emergence of federal regulations, such as the PSM standard and the RMP rule, as well as the decision to engage in Responsible Care. DuPont developed several methods that it uses to manage and integrate its process safety systems, including its proprietary Safety Perception Surveys and Process Safety Management and Risk Model.b Its corporate process safety management system and implementation process involves four steps: (1) building a safety culture, (2) management leadership and commitment, (3) implementing a comprehensive process safety management a As recently as 2013, the DuPont Corporation received the Robert W. Campbell Award from the National Safety Council. According to the National Safety Council, “winners represent organizations that have taken great strides in [environmental health and safety] excellence. Award winners are acknowledged not only as leaders in the business realm, but also as those that recognize the value of protecting employees and their environment” [115].  b According to DuPont, there was a demand from other companies for DuPont to share its learnings and safety practices. In 1968, it established DuPont Sustainable Solutions, the branch of DuPont (now DowDuPont) that sells the company’s safety systems [113], [114]. DowDuPont’s Specialty Products division announced it will divest its DuPont Sustainable Solutions to create a new, independent global operations management consulting firm. The transaction is expected to close in July 2019 pending the completion of all closing conditions [135]. Page 80 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX program, and (4) operational discipline [54, p. 2]. According to DuPont, the effective implementation of these steps will result in a robust process safety management system [55, p. 10]. Consequently, DuPont La Porte used both the Safety Perception Surveys and the Process Safety Management and Risk Model in implementing its process safety management system. Despite having robust written process safety management programs (i.e., MOC and PHA), over the course of five years, DuPont had major process safety incidents—including those at its Belle, West Virginia; Buffalo, New York; and La Porte, Texas sites, each of which resulted in fatalities. The CSB found that DuPont La Porte’s ineffective implementation of its integrated process safety management system contributed to the severity of the highly toxic material release in the manufacturing building at La Porte. According to DuPont Sustainable Solutions’ “Quick 4-Step Review of Process Safety Management,” “A strong safety culture, based on a commitment to core values on safety, health, and environmental issues, and as evidenced by organizational policies, goals, metrics, and day-to-day decision-making, supports establishing safety systems where safety priorities are recognized, not as conflicting with other priorities, but rather as inherently necessary for completing any task the right way” [54]. DuPont’s corporate process safety management standard lists four key steps for the implementation and sustainability of an effective process safety management program: 1. Establishing an effective and sustainable unified safety culture (addressed in Section 5.4.1 below) 2. Providing management leadership and commitment (Section 5.4.2) 3. Implementing a comprehensive process safety management program, including organizational learning and continuous improvement to integrate new risk management knowledge, learnings, and practices into existing site and corporate systems (Section 5.4.2) 4. Achieving operational excellence through operational discipline (Section 5.4.2) This section breaks down these steps into two parts: (1) Building a Safety Culture (step one); and (2) Using the Process Safety Management and Risk Model (steps two through four). Page 81 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 5.4.1 BUILDING A SAFETY CULTURE  DuPont’s corporate process safety management standard states that process safety culturea “determines the manner by which PSM is implemented and managed at each site as part of both individual and group values and behaviors to enable sound decision making and continuous improvement.” Therefore, DuPont links the effectiveness of process safety management implementation to the process safety culture of a facility. Moreover, previous CSB investigations also support DuPont’s corporate standard that links effective process safety management systems with a strong process safety culture.b According to DuPont, establishing a safety culture is the first step in developing a process safety management system because a system will be only as effective as its safety culture permits. Additionally, DuPont’s corporate process safety management standard recommends periodic site evaluations of process safety culture.c DuPont’s standard further recommends that sites use the results of process safety culture assessments to highlight strengths and develop potential improvement strategies. In Essential Practices for Creating, Strengthening, and Sustaining Process Safety Culture, CCPS states, “A strong, positive process safety culture enables the facility’s [process safety management system] to perform at its best. This gives the facility its best chance to prevent catastrophic fires, explosions, toxic releases, and major environmental damage” [56, p. 2]. For more than a decade, DuPont developed and honed a safety culture program to reduce its OSHA total recordable injury rate by assessing and improving occupational (personal) safety, using its Bradley Curve and Safety Perception Survey tools (Appendix E). These tools, however, focus on only one aspect of safety culture—personal safety. DuPont La Porte used the Safety Perception Survey without doing a process safety culture assessment as recommended in the corporate process safety management standard. Because this survey did not formally assess process safety culture perceptions, DuPont La Porte never evaluated its process safety culture. Had its a Examples of a process safety culture from DuPont’s corporate standard include maintaining a sense of vulnerability in terms of process safety management risks to prevent complacency or overconfidence, and transparent, timely, and thorough responses to PSM concerns, action items, and issues, including leadership measures to prevent a “check-the-box” mentality (i.e., simply accomplishing a task as the objective rather than ensuring a high degree of focus on risk management and prevention). b Among other investigations, the CSB investigation of the Williams Geismar Olefins Plant Reboiler Rupture and Fire demonstrates the CSB’s position that to prevent process incidents, organizations must develop a culture that promotes effective process safety management systems [71, p. 52]. c DuPont’s corporate process safety management standard does not specifically address how its sites should perform process safety culture assessments. DuPont’s standard directs sites to include interactions and discussions with employees, review results of audits, and observe physical conditions of the site in performing process safety culture assessments. Page 82 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX efforts included a focus on perceptions of process safety as well as personal safety in its Safety Perception Survey, or had it performed a separate process safety culture assessment with the intent of improving process safety culture as recognized in DuPont’s corporate process safety management standard, DuPont La Porte likely would have been more aware of potential process safety issues and better positioned to prevent or mitigate future process safety incidents. CCPS recognizes the importance of a strong process safety culture in preventing major accidents [56, p. 2]. This section discusses the following:  The investigations into the catastrophic 2005 BP Texas City explosion that emphasized the way in which culture is shaped by the level of focus an organization places on process safety (Section 5.4.1.1)  The lack of formal process safety culture assessments at DuPont La Porte (Section 5.4.1.2)  Post-incident initiation of formal process safety culture assessments at DuPont legacy sites to address gaps in process safety culture perceptions in 2017 (Section 5.4.1.3) Page 83 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 5.4.1.1 BP TEXAS CITY INCIDENT  The CSB investigated a 2005 incident at a BP refinery in Texas City, Texas,a and due to concerns about the effectiveness of the safety management systems at this refinery and BP’s other North American refineries, as well as concerns about BP’s corporate safety culture, the CSB issued an urgent safety recommendation to the BP Global Executive Board of Directors to commission an independent panel to conduct a thorough review of BP’s corporate organizational culture, safety management systems, and Figure 20.  Excerpt from the Baker Panel Report.  The Baker Panel found that BP  corporate safety oversight at its U.S. emphasized personal (worker) safety performance and did not adequately focus on  refineries [57, pp. 3-4]. As a result, process safety.  Similarly, 12 years after this accident, DuPont La Porte’s safety culture  assessments at its site focused solely on personal safety performance.  Source: Baker  BP formed the BP U.S. Refineries Panel Report [58]. Independent Safety Review Panel, commonly referred to as the Baker Panel,b which conducted an independent organizational assessment of BP’s culture and its corporate-level oversight of safety management systems at its U.S. refineries [58, pp. viii-ix]. The Baker Panel developed a process safety culture survey and supervised its administration among BP’s U.S. refinery workforce, including employees and contractors [58, p. 7]. The survey contained 65 items related to the process safety culture at participants’ workplaces. The Baker Panel concluded that BP “mistakenly interpreted improving personal [worker] injury rates as an indication of acceptable process safety performance” (Figure 20) [58, p. xii]. The panel also noted, “the presence of an effective personal safety management system does not ensure the presence of an effective process safety management system … [and] BP’s [worker] injury rates were not predictive of process safety performance at BP’s five U.S. refineries” [58, p. 21]. a On March 23, 2005, a series of explosions occurred at the BP Texas City, Texas, refinery during the restarting of a hydrocarbon isomerization unit—killing 15 workers and injuring 180 others. The explosions occurred when a distillation tower flooded with hydrocarbons and was overpressurized, causing a geyser-like release from the vent stack [140]. For more information, see the CSB’s BP America Refinery Explosion investigation. b Former Secretary of State James Baker III chaired the BP U.S. Refineries Independent Safety Review Panel (the Baker Panel) [58, p. viii]. Page 84 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX After the 2005 BP accident and the published findings of both the Baker Panel and the CSB, much of the chemical process industry began to emphasize the importance of understanding and assessing process safety culture.a A major process safety incident, such as the one at DuPont La Porte, can reveal weaknesses in the management of process safety.b 5.4.1.2 DUPONT LA PORTE DID NOT FORMALLY ASSESS PROCESS SAFETY CULTURE  DuPont La Porte did not use any type of robust, formal process safety culture assessment. Process safety culture can affect whether a site has a sense of vulnerability in terms of process safety management risks; complacency or overconfidence; and transparent, timely, and thorough responses to PSM concerns, action items, and issues, including leadership measures to prevent a “check-the-box” mentality (i.e., simply accomplishing a task as the objective rather than ensuring a high degree of focus on risk management and prevention). The Safety Perception Surveys conducted at the DuPont La Porte facility before the November 2014 incident were designed to lower OSHA total recordable injury rates [59, p. 8]. DuPont did not intend for these surveys to measure or address the perception of process safety performance. As part of DuPont La Porte’s 2012 Safety Perception Survey, comments were collected and organized by job position. Some of these comments, from different levels of the organization, raised safety culture concerns. For example, one hourly worker (operator) stated, Some fi[rs]t line [supervisors]c turn the other way if a worker put[s] production over safety.d A professional employee expressed concerns about PSM initiatives at the site: Some days it seems like the focus is more about creating documentation and reviewing that documentation than on targeting those areas that will have the biggest impact on improved PSM performance. From my perspective, I feel like “real” process safety management has suffered in some respects and that our processes may actually be less safe than they were before the initiatives. Safety concerns were expressed by multiple supervisors in the survey comments: I hate to say it but not all employees put the same value on safety. That includes [wage roll] employees and first line supervisors. DuPont employee actions demonstrate to me that safety rules are suggestions and do not have to be followed. a In March 2007—two years after the BP Texas City explosion—CCPS published its book Guidelines for Risk Based Process Safety, which featured “process safety culture” as an element in its new Risk Based Process Safety model [91]. b Other CSB investigations that found a weak process safety culture contributing to an incident include Williams Geismar Olefins Plant Reboiler Rupture and Fire [71, p. 52], CSB Macondo Investigation Report, Volume 3 [61, pp. 233-241], and CSB BP Texas City Investigation Report [60, pp. 142-195]. c At DuPont La Porte, first-line supervisors include shift supervisors. d Original comment was written using all capital letters. Page 85 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX DuPont has always been a strong leader in safety principles for the industry that we work in. The [La Porte] plant has a strong leadership for safety yet sometimes the message does not always get across to the employe[es]. Some still feel that production is above safety yet all managers have stated and demonstrated that production is far down the list when it comes to safety. I believe our “passion” for safety has slipped over the past 10 years. I believe this has impacted [our] ability to consistently achieve safety excellence. I interact with safety professionals from many companies in our area and my opinion is that, as a company, we are no longer the safety leader we were once thought of as. Despite concerns about its safety culture expressed by multiple levels of personnel within the organization, DuPont La Porte did not use these comments to take corrective actions that would institute process safety culture change at the DuPont La Porte facility. In 2014, DuPont La Porte hired an organizational consultant to increase production in the Lannate® Unit. Safety concerns resembling the ones from the 2012 Safety Perception Survey were raised again. According to an interview of a front-line supervisor in July 2014, four months before the incident, “…we just are not as good as we think we are.… not in pay, benefits, safety, etc.… We used to sell the safety program. We spend more time on driving incidents down, to keep the number down. We just have to make it look good. Don’t need to report every detail. Long slow slide— may not even notice how far we have fallen. This supervisor also noted in that interview that DuPont La Porte was at its most vulnerable point because younger engineers were most impressed by improved production, and “safety first” was not always the practice. Had DuPont La Porte formally assessed its process safety culture and taken effective corrective actions, cultural weakness that contributed to significant and long-standing process safety program deficiencies, which the CSB determined were causal to the November 15, 2014 incident (listed below), may have been identified, communicated, and addressed. These deficiencies are discussed in further detail in the CSB Interim Recommendations report on the incident [1] and Section 6:  Poor hazard analysis practices. Site personnel did not perform a hazard analysis on the troubleshooting techniques that they used leading up to the incident. Additionally, the DuPont La Porte site did not adequately analyze hazards associated with the manufacturing building’s ventilation system in PHAs. A PHA on the ventilation system could have evaluated the ability of the fans to handle toxic releases and established more robust management systems to protect workers when a fan was broken [1, pp. 47; 25-26].  Poor design of the manufacturing building. DuPont housed the Lannate® process inside a manufacturing building. The building design increased hazards for the workforce by confining toxic chemicals indoors. The building’s ventilation design also did not consider chemical toxicity hazards inside the building [1, p. 33]. Page 86 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX  Failure to maintain safety-critical equipment. Two “PSM critical”a ventilation fans were not operational at the time of the incident [1, pp. 33-35]. DuPont recognized that a ventilation fan breakdown could result in a high-consequence event. Both fans, however, exhibited poor reliability. One fan had been down since June 2014, five months prior to the incident, due to an electrical problem. On October 20, 2014, the other fan was making a noise significant enough that DuPont operators turned it off and wrote an “urgent”b work order to have it repaired [1, p. 20]. Even had the fans worked, they probably would not have prevented a lethal atmosphere inside the building due to the large amount of toxic gas released [1, p. 3].  Failure to develop written procedures for operator actions. DuPont La Porte did not establish a formal procedure for draining liquid from the waste gas vent header piping, aside from its line-breaking policy (Section 6.5). In addition, when the DuPont Technical Team met to discuss how to clear the plugging in the piping system, they did not develop a written procedure for the techniques used to clear plugging in equipment, even though the plugging formed where it had never been before [1, p. 25].  Lack of hazard recognition. The methyl mercaptan detectors installed in the manufacturing building were not intended for worker safety—the alarms were set to alarm at 25 parts per million (ppm), which was above OSHA’s ceiling limitc of 10 ppm. Operators also normalized smelling methyl mercaptan because of its low odor threshold and perceived lack of negative health impacts at those low concentrations, even though it is a toxic chemical. Although formally trained,d numerous employees lacked a working knowledge of methyl mercaptan’s hazards and did not recognize that the chemical could be both lethal and explosive. As a result, operators often confirmed methyl mercaptan leaks by purposely smelling for the chemical’s odore without understanding the dangers of this practice. Furthermore, this method of leak confirmation is a poor, unsafe, and unreliable practice that could have been replaced by using portable monitors set at appropriate levels [1, pp. 37-39]. Further, as the CSB concluded in its 2005 BP Texas City investigation, personal safety performance is not an effective gauge of process safety performance [60]. Similar to its investigation findings from BP Texas City, the CSB found that DuPont La Porte also focused on personal safety and did not place enough emphasis on its process safety programs. For example, the Safety Perception Surveys used at the DuPont La Porte facility evaluated only the perception of personal safety performance and did not identify process safety weaknesses at the facility. Even though DuPont La Porte was aware of the importance of BP Texas City’s findings, before the a DuPont assigns the designation of “PSM Critical” to equipment whose failure could result in a high-consequence event [1, p. 34]. While the timing required to complete an “urgent” work order is not specifically defined, based on CSB’s review of DuPont records and interviews conducted with DuPont employees, it has a practical meaning of two to three days. c The ceiling limit for a substance is the concentration that must never be exceeded under OSHA (29 C.F.R. § 1910.1000(a)(1) (2016)). d DuPont La Porte included a toxic fume release and methyl mercaptan procedures in its emergency response plan. e The DuPont La Porte facility had an emergency response procedure for a methyl mercaptan leak. If a leak was detected, personnel were required to put on an air demand mask and contact a supervisor or the control room to sound a plantwide fume alarm. b Page 87 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX incident it continued to use the Safety Perception Survey without conducting additional formal process safety culture assessments that could identify process safety weaknesses. 5.4.1.3 DUPONT’S INITIATION OF PROCESS SAFETY CULTURE ASSESSMENTS   DuPont La Porte’s safety culture assessment program (the Safety Perception Survey) before the November 2014 incident focused on lowering its OSHA total recordable injury rate. Even as the industry concentrated on improving process safety following the 2005 BP Texas City incident, and DuPont’s consultant arm developed process safety questions for the survey, DuPont La Porte lagged and did not incorporate DuPont’s process safety questions into its Safety Perception Survey.a Furthermore, DuPont La Porte did not formally assess aspects of its culture beyond the Safety Perception Survey. In 2017, however, DuPont required each site to assess its process safety culture periodically and added process safety questions to the Safety Perception Surveys.b This shift in incorporating process safety culture questions in its Safety Perception Surveys is important because, as explained in Chapter 6.2 of Volume 3 of the CSB’s Macondo report, the accuracy of a site’s culture assessment may be called into question if all aspects of culture are not considered as part of the assessment [61, pp. 236-238]. Furthermore, DuPont practice has become more aligned with its corporate philosophy that a process safety management program is only as effective as its safety culture. The CSB views the adoption of process safety culture questions in DuPont’s Safety Perception Survey as a positive development. GUIDANCE TO INDUSTRY  The CSB has investigated several major incidents caused by weaknesses in process safety culture.c In recent years, process safety culture has been studied as a component of the broader topic of organizational culture, an analytical approach that the CSB first articulated in Volume 3 of its Macondo report [61, pp. 233-41]. Referencing the work of Sonja Haber and Edgar Schein, the CSB explained that organizational culture refers to characteristics of the overall environment, values, and rules that shape employees’ perceptions and attitudes [61, pp. 234-36]. This analytical framework extends to a culture for process safety, as these same varied components work together to determine the importance that an organization places on process safety. A “safety culture” is thus often accurately described as “the way we do things around here,” or “how the organization behaves when no one is watching” [62, pp. 9-10]. The chemical process industry then further defined process safety culture as a DuPont corporate conducted Safety Perception Surveys at all of its manufacturing sites. It chose not to include process safety perception questions in these surveys. b DuPont changed some of its process safety culture questions and increased the number of questions from 13 to 14. In 2017, DuPont updated its corporate process safety management standard to require each site to evaluate the process safety culture survey results and identify opportunities for improvement. c Other CSB investigations in which a weak process safety culture was found to contribute to the incident include Williams Geismar Olefins Plant Reboiler Rupture and Fire [71, p. 52], CSB Macondo Investigation Report, Volume 3 [61, pp. 233-241], and CSB BP Texas City Investigation Report [60, pp. 142-195]. Page 88 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX “the common set of values, behaviors, and norms at all levels in a facility or in the wider organization that affect process safety” [63]. According to CCPS, a sound or positive safety culture is “the pattern of shared written and unwritten attitudes and behavioral norms that positively influence how a facility or company collectively supports the successful execution and improvement of its Process Safety Management System (PSMS) resulting in preventing process safety incidents” [56, p. 6]. Additionally, a company’s espoused commitments and values, its messages from management to its workforce and the public, the quality of its written safety management programs, and the effectiveness of the implementation of those programs in sound operations are all paramount.a In its book Guidelines for Risk Based Process Safety, CCPS identified six themes of process safety culture:  Maintain a sense of vulnerability  Combat normalization of deviance  Establish an imperative for safety  Perform valid/timely hazard/risk assessments  Ensure open and frank communications  Learn and advance the culture [56, p. 23], [52, pp. 39-66] CCPS expanded on these process safety culture themes in Guidelines for Risk Based Process Safety and developed 10 core principles of process safety culture in Essential Practices for Creating, Strengthening, and Sustaining Process Safety Culture [56, p. 23]. To successfully implement the process safety culture principles in Figure 21, the later principles should build upon the earlier principles because each principle depends on the others [56, pp. 24-25]. a CCPS focuses on the quality of programs and the fidelity to those programs as “Conduct of Operations” and “Operational Discipline,” respectively [63]. Page 89 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 21.  Excerpt from “Overview of Core Principles of Process Safety Culture,” in CCPS, Essential  Practices for Creating, Strengthening, and Sustaining Process Safety Culture [56, p. 24].  Source:  CCPS.  One tool to evaluate a facility’s process safety culture is the use of anonymous process safety culture assessments of staff. These assessments have historically been conducted by surveying a site’s employees through multiple-choice questionnaires. Facilities may also use qualitative assessment practices that go beyond simple employee questionnaire surveys. Such process safety culture assessments include personnel interviews, focus group discussions, and detailed document analyses. In qualitative assessments, workers interact with Page 90 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX auditors, “using their own terms and concepts to express their point of view…. Intensive and in-depth information can be obtained using the [workers’] own language” [64]. Guidance published in recent years describes how to conduct process safety culture assessments of chemical process facilities. In 2011, Contra Costa County in California published a guidance document on conducting process safety culture assessments, and CCPS released the second edition of its book Guidelines for Auditing Process Safety Management Systems [65], [66]. Chapter 4 of the CCPS book provides detailed guidance for auditors evaluating an organization’s process safety culture [66]. Additionally, in 2018, CCPS published Essential Practices for Creating, Strengthening, and Sustaining Process Safety Culture, which details how to assess, develop, and sustain a process safety culture in relation to a company’s process safety management system [56].a In developing a process safety culture assessment, companies should follow the findings of the Baker Panel and ensure that improved injury rates are not perceived as an indication of acceptable process safety performance.b Process safety culture assessments are a tool for understanding a company’s overall commitment to process safety. Furthermore, companies can use the assessments’ findings to develop action items for continual improvement efforts. To ensure a strong culture of process safety, companies must address any process safety culture assessment findings not consistent with the core principles of their process safety culture. Leadership plays an important role in ensuring that deficiencies in the process safety culture are addressed. As Andrew Hopkins noted in his article “Why Safety Cultures Don’t Work,” improving an organization’s process safety culture flows from top management commitment and cascades down to managers and employees [67, pp. 1, 3-4]. Hopkins argued that companies with strong leadership will best achieve process safety excellence by establishing systems (including the use of leading indicators) that drive catastrophic accident prevention [48, pp. 1-3]. Such companies are better equipped to avoid or prevent major process safety incidents because, as Hopkins observed, such companies can better “identify the obvious precursors to catastrophe and get serious about eliminating them” [67, pp. 1, 3-4]. a Essential Practices for Creating, Strengthening, and Sustaining Process Safety Culture includes in an appendix that contains a sample process safety culture assessment protocol [56, pp. 343-380]. b The Baker Panel found that BP “mistakenly interpreted improving personal injury rates as an indication of acceptable process safety performance” (see Figure 20). Page 91 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 5.4.2 USING THE PROCESS SAFETY MANAGEMENT AND RISK MODEL  Figure 22.  DuPont’s Process Safety Management and Risk Model [54, p. 2].  Source: DuPont  Sustainable Solutions.  DuPont created the Process Safety Management and Risk Model (also called the PSM Wheel) to represent visually how the last three steps (management leadership and commitment, implementing a comprehensive process safety management program, and operational discipline) should interact with each other, using a wheel to show that DuPont’s process safety management system integrates management leadership and commitment with operational discipline (Figure 22) [54, p. 2]. The second step in implementing DuPont’s process safety management system, management leadership and commitment, is at the center of the PSM Wheel. According to DuPont, it placed this core value at the center because it affects all aspects of a process safety management system, from forming and fostering a safety culture to implementing policies and providing resources for safety-related activities [54, p. 2]. Additionally, “the actions of all levels of management must support and reinforce strong PSM programs and accountability” [54, p. Page 92 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 2]. DuPont believes that visible top management involvement (i.e., “felt leadership”a) in safety systems, processes, and programs is necessary for their sustainability. In addition, it notes that felt leadership, commitment, and role modeling greatly influence employees’ interest in, understanding of, and value for safety. The third step in establishing DuPont’s process safety management system, Implementing a Comprehensive PSM Program, is in the spokes of the wheel. Each spoke represents one of 14 aspects of DuPont’s corporate process safety management program.b These spokes are divided into three groups: a. Facilities to handle and manufacture hazardous materials: 1. 2. 3. 4. Management of “subtle changes” Mechanical integrity Pre-startup safety reviews Quality assurance b. Technology of the process: 1. 2. 3. 4. Management of technology change Operating procedures and safe practices Process hazards analysis Process safety information c. Personnel who operate, maintain, and support the process: 1. 2. 3. 4. 5. 6. Auditing Emergency planning and response Management of personnel change Incident investigation Contractors Training and performance [68, p. 2] a DuPont defines “felt leadership” as a respect through action for the well-being of people. It is a building block in constructing trust and real-world relationships among employees, customers, shareholders, and communities [116]. CCPS also defined felt leadership in its CCPS Vision 20/20: “Felt leadership means that the executives and other leaders personally involve themselves in process safety activities. Employees know the executives care about process safety because of what they see and feel executives doing, not just by [what] they hear them saying. Felt leadership is leading by passionate example” [56, p. 31]. b Note that DuPont’s PSM Wheel does not include trade secrets and employee participation, which are elements of OSHA’s PSM standard. Page 93 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX The final step, Operational Discipline, is the rim of the PSM Wheel. DuPont defines operational discipline as “the deeply rooted dedication and commitment by every member of an organization to carry out each task, the right way, each time” [54, p. 2]. According to DuPont, operational discipline translates a documented process safety management system into tangible results (see Figure 23). Additionally, DuPont believes that it reflects the strength of an organization’s safety culture in Figure 23.  Excerpt from DuPont Presentation Titled “Developing a Robust PSM Framework  at DuPont.” This slide illustrates DuPont’s perception of the characteristics of an effective  making safety, health, and operational discipline program that translates to operational excellence [118, p. 11].   environmental (also known as Source: DuPont Sustainable Solutions. SHE) systems effective and in providing observable results for preventing injuries and incidents [69, p. 58]. DuPont management uses the Process Safety Management and Risk Model at its sites, including DuPont La Porte, and sells its process safety management system to other companies. DUPONT’S PROCESS SAFETY MANAGEMENT SYSTEM CONCLUSIONS  DuPont integrated the PSM standard, RMP rule, and Responsible Care into its corporate process safety management system. In addition to other requirements, these frameworks obligate companies to establish a comprehensive corporate process safety management system. As shown in this section, companies need to ensure that there is an adequate focus on the effectiveness of a corporate process safety management system and its corresponding safety program elements. Without sufficient focus, implementing a corporate process safety management system will likely not be enough to prevent major chemical incidents. At the DuPont La Porte facility, an inadequate focus on the effective implementation of the corporate process safety management system resulted in process safety management deficiencies that led to the November 2014 incident. The following section discusses some of the deficiencies in DuPont La Porte’s process safety management system. 6 PROCESS SAFETY MANAGEMENT DEFICIENCIES  As part of its investigation, the CSB evaluated DuPont La Porte’s implementation of its process safety management system at the site (see Appendix A: Causal Analysis). The CSB found that DuPont La Porte had Page 94 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX multiple deficiencies in its process safety management program elements that contributed to the incident, including process hazard analysis (PHA), auditing, management of change (MOC), operating procedures, and safe work practices.a This section details some of these process safety management system deficiencies at the DuPont La Porte facility. Section 4 discusses the deficiencies in DuPont La Porte’s emergency response program.b Additionally, the CSB found that DuPont La Porte’s incentive compensation program did not conform to the OSHA guidance that existed at the time of the incident. Even though DuPont and DuPont La Porte had extensive written policies, these policies did not translate into effective implementation of or adequate focus on the effectiveness of its process safety management system at the DuPont La Porte site. The CSB determined that a company’s development of its own process safety management system is critical to prevent major accidents. Companies should ensure that the safety program elements within their process safety management system are effective, fully implemented, and functioning as intended. PROCESS HAZARD ANALYSIS EVALUATION  DuPont’s internal PHA training documents state, “historically, the most significant failure in PHAs, identified through the investigation of incidents in which a breakdown of the PHA element was found to be a key factor, is the failure to identify the specific sequence of events that led to the accident (e.g., either failed to ask the right What If question or failed to completely develop the hazardous event scenario).” Without identifying the full extent of a potential hazardous event scenario, PHA teams are not likely to develop adequate safeguards to mitigate a hazard. Figure 24.  Where PHA is Located on DuPont’s Process Safety Management and Risk  Model (PSM Wheel) [54, p. 2].  Source: DuPont, with annotations by CSB. One of the causes of the highly toxic methyl mercaptan release was a lack of safeguards to prevent the methyl a Section 4 covers process safety management deficiencies related to emergency response. The PSM standard requires companies to have either an emergency action plan or an emergency response plan. Although the standard does not detail requirements for an emergency response program, it incorporates by reference regulations that dictate requirements for emergency action plans and emergency response plans (29 C.F.R. § 1910.119(n)). b Page 95 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX mercaptan hydrate from solidifying in the feed piping. In one of the hundred-plus what-if scenarios considered in the 2011 PHA, the DuPont La Porte PHA team acknowledged the potential for methyl mercaptan hydrate to solidify in the feed piping. The PHA team identified a scenario in which water back-flowing into the methyl mercaptan feed system could cause the formation of methyl mercaptan hydrate (Figure 25). The consequence of this scenario was the hydrate plugging the methyl mercaptan feed piping. The team identified that heating would dissociate the hydrate and unplug the system, but it did not fully develop (evaluate) the potential hazards resulting from the plugging, including hazards caused by dissociating the methyl mercaptan hydrate. The PHA team assessed the plugging as presenting an unlikely, low-severity hazard, assigning it the lowest possible risk ranking.a As a result of this risk ranking, no additional safeguards or further protective actions were required to address this scenario. Figure 25.  CSB’s Reproduction of the Hazard Evaluation Worksheet from the 2011 PHA.  It that identified the methyl mercaptan  hydrate formation as a hazard.  Source: DuPont, with modifications by CSB for readability.  As discussed earlier, the PHA team did not comprehensively evaluate this scenario. For example, it did not ensure that a procedure or safeguard existed to heat the piping safely. Figure 25 shows that the PHA team identified one existing safeguard for the hydrate plugging scenario—the company’s standard for backflow prevention. This safeguard, however, was inadequate because this standard addresses backflow from a process (MeSNa cooler) to a service or a utility (water supply). Therefore, applying this standard would not have prevented or offered protection from water flowing into the methyl mercaptan feed piping. Hence, the PHA team underestimated the risk, noting, “Ultimately by heating the line externally it will vaporize and return to [methyl mercaptan] and water vapor.” Even though the PHA team identified heating as a means to dissociate the methyl mercaptan hydrate, DuPont La Porte did not identify the need to develop a formal procedure or engineered system to safely heat the line and address the hazard the team had identified. As a a DuPont La Porte used a risk matrix that evaluated risk by assessing consequence and frequency. The DuPont La Porte PHA team assigned the lowest-level possible consequence (C-1) and frequency (F-1) to the methyl mercaptan hydrate. This assignation resulted in the methyl mercaptan hydrate having the lowest possible risk (IV), which meant the PHA team did not have to mitigate the hazard. A C1 consequence equates to no significant injury or health impact on-site or off-site and no significant environmental impact. As long as the consequence was classified as C-1, the frequency of the event would not have mattered; the PHA still would not have had to mitigate the risk. Page 96 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX result, on November 14, 2014, the DuPont Technical Team had to develop a troubleshooting plan to address the hydrate plugging (Section 6.3). This plan was developed without performing any hazard analysis, developing a written procedure, training personnel, or providing sufficient technical resources for the night shift. Although DuPont La Porte’s 2011 PHA of the process identified methyl mercaptan hydrate formation,a the PHA team did not recognize the need to address the potential methyl mercaptan hydrate formation risk by providing additional safeguards, such as heat tracing,b or to develop a written procedure to safely dissociate the hydrate (see Section 6.3). When critically evaluating any PHA scenario following a major accident, it is not uncommon to identify how a PHA team could have recommended additional or more effective safeguards. The difficulty PHA teams face is how to ensure that what is perceived as “good enough” when evaluating a potential hazard scenario will ultimately provide sufficient protection (effective risk mitigation). Had DuPont La Porte installed effective safeguards, such as heat tracing, to maintain the piping contents above 52°F, the facility could have avoided the abnormal situation that led to the deaths of four workers. Following the November 15, 2014 incident, DuPont completed two new baseline PHAs using a more robust PHA methodology for the Insecticide Business Unit. Despite performing PHAs for more than 30 years, DuPont La Porte employees told CSB investigators that the improved approach for conducting PHAs was resulting in hundreds of action items, never previously identified, to control hazards. Difficulties in performing PHAs highlight the importance of having a strong process safety culture foundation to drive site personnel to effectively respond to real-time events with robust process safety management system programs, including MOCs or safe work practices. GUIDANCE TO INDUSTRY  PHAs can be subjective and can result in underestimating the risk of potential hazardous event scenarios. Because in PHAs the assignment of event frequencies and consequence severities can make a significant difference in safeguard requirements, companies need to ensure that PHA teams have a robust process and adequate resources in place to fully develop hazard scenarios and assign appropriate initiating event frequencies and consequence severities to them. Additionally, PHA teams need to ensure that the safeguards applied to the hazard scenarios are relevant and effective in controlling the hazards. a The methyl mercaptan hydrate hazard was also identified in DuPont La Porte’s technical standard (see Section 6.3). “Heat tracing is used to prevent heat loss from liquids inside process piping in situations where low fluid temperatures could lead to problems such as an unacceptable increase in viscosity, hydrate formation, congealing or solidification, the separation of components, or when water in the line could form corrosive materials” [131, p. 157]. Heat tracing can be either steam or electrical heat applied to the surface of a pipe and covered by insulation [131, p. 158]. b Page 97 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX IMPLEMENTATION OF CORRECTIVE ACTIONS   According to OSHA’s Process Safety Management Guidelines for Compliance, taking corrective actions is one of the most important parts of an audit and includes identifying deficiencies, planning, following up, and documenting needed corrections [19]. Audits, PHAs, incident investigations, and emergency response drills are among the various PSM program elements that can generate corrective action items. At times, the corrective action program at DuPont La Porte did not appropriately correct gaps identified by site PSM audits (Figure 26). Figure 26.  Where Auditing is Located on DuPont’s PSM Wheel [54, p. 2].  Source:  DuPont, with annotations by CSB. One of DuPont’s process safety metrics was tracking the completion of corrective action items. However, this metric addressed only one aspect of the site’s corrective action program—time needed to close the corrective action. Time to close corrective actions can indicate the priority management gives to completion of corrective action items. DuPont La Porte’s focus on time to complete, however, sometimes resulted in closing action items after developing a plan to correct a deficiency rather than actually correcting it. In Guidelines for Risk Based Process Safety CCPS states, A safety management system can be seriously deficient, yet appear satisfactory by superficial measures—the paperwork appears to be in place and no serious incidents have been recorded. Complacency replaces a sense of vulnerability, and the execution of program tasks becomes perfunctory [52, p. 639]. Similarly, based on its corrective actions metric, the DuPont La Porte facility did not appear to have a large number of process safety management deficiencies—while the CSB’s review of corrective actions at La Porte Page 98 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX revealed that some corrective actions were closed without addressing the issue identified by the underlying recommendation.a As such, closing out some corrective actions became perfunctory paperwork closures. For example, in 2009, a second-party PSM audit found that the DuPont La Porte site lacked documentation showing the manufacturing building’s ventilation systemb was ever tested to ensure it could effectively distribute fresh air within the building. Based on this finding, the audit recommended that the site set up a program to test the manufacturing building’s ventilation system periodically. The two sides of the manufacturing building were separately ventilated by dilution air exhaust fans located on the roof of the building. The dilution air ventilation system design used roof-mounted fans to pull fresh dilution air into the manufacturing building. Fans drew fresh air into each floor on each side of the building, at floor level, through a mechanical louver system.c When the system operated properly, air would flow from the fresh air louvers, across the process equipment, and up into return ducts on the ceiling along the internal wall to sweep away any flammable or toxic gases.d Exhaust air from each side of each floor moved inside the ceiling-mounted duct toward the north end of the building (Figure 27), where it was collected in a vertical duct header that directed the exhaust air from all of the floors on each side up to the respective (wet or dry end) dilution air exhaust fan on the roof. Exhaust air from the fans discharged directly to atmosphere. The ventilation system was not equipped with any kind of environmental destruction system, such as a scrubber or incinerator, to remove contaminants. a The CSB found multiple incidents at the DuPont La Porte facility in which corrective actions were closed by sending emails to relevant parties without following up to ensure effective implementation (e.g., coordination with other companies located on-site, deviation from a highly toxic material requirement, etc.). b The stated design objective for the ventilation system is as follows: “The main objectives of industrial ventilation for the LANNATE®/ [agricultural products intermediates] manufacturing building are to: a. control contaminants to acceptable work place exposure levels, e.g., comply with OSHA regulation or Corporate AELs (acceptable exposure limits), and b. prevent fires and explosions.” The actual design calculations, however, do not take toxicity into consideration. In addition, DuPont has not established an AEL for methyl mercaptan [1, p. 33]. c The louver is a set of angled slats or flat strips fixed or hung at regular intervals in a shutter to allow air to pass through [1, p. 13]. d DuPont La Porte records indicate that the manufacturing building ventilation system design code is National Fire Protection Association (NFPA) 497, Recommended Practice for the Classification of Flammable Liquids, Gases, or Vapors and of Hazardous (Classified) Locations for Electrical Installations in Chemical Process Areas. NFPA 497 defines adequate ventilation as that sufficient to ensure that the concentration of flammable gases does not exceed 25 percent of the lower flammability limit (also called the lower explosive limit (LEL)). DuPont’s methyl mercaptan safety data sheet indicates that the LEL for methyl mercaptan is 3.9 percent [1, p. 13]. Page 99 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 27.  Simplified Graphical Representation of a Typical Floor of the Manufacturing Building.  It shows how fresh  air was pulled in from the outside walls, swept across the floor, and entered the exhaust return air ducts on each  side.  Source: CSB.  To close the action item generated—to ensure the ventilation system was routinely tested—DuPont La Porte personnel created a program within their computerized maintenance system that periodically generated a work order to conduct dilution air flow testing [1, p. 34]. DuPont La Porte closed the corrective action in March 2010 after creating this program. But the CSB found serious deficiencies in the implementation of this program:  DuPont La Porte personnel were supposed to schedule the first ventilation system test in November 2010. This test was delayed and did not occur until two years later, in 2012 [1, p. 34]. This delay occurred in part because personnel closed the corrective action without assigning a specific individual to ensure completion of the ventilation testing.  On the dry end side of the building, DuPont La Porte personnel measured dilution air flow without analyzing the data or establishing acceptable air flow criteria. Additionally, they never measured the air flow on the wet end side where the November 15, 2014 release occurred. Therefore, DuPont La Porte never verified whether the manufacturing building’s ventilation system could effectively remove flammable or toxic chemical leaks. Had the corrective action met the intent of the PSM audit recommendation, the need for additional safeguards in the manufacturing building (e.g., a better ventilation system, increased chemical detectors, respiratory protection) should have been evaluated. Effective ventilation system testing and analysis should have identified Page 100 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX and corrected poorly ventilated areas to reduce worker hazards posed by potential flammable or toxic gas leaks in the manufacturing building.a At the time of the November 2014 incident, neither the wet end nor the dry end fans were functioning. Had the deficiencies in the DuPont La Porte ventilation system been recognized, access to the manufacturing building should have been restrictedb and personnel could have been required to wear SCBAs inside it. Adequate safeguards could have protected workers when the fatal toxic release occurred. Closing corrective action items with only a limited plan to address an audit finding is a poor practice—it can result in the action item’s being implemented ineffectively or not at all. At DuPont La Porte, even though personnel closed as complete the ventilation system testing action item, they never completed the testing to ensure the effectiveness of the ventilation system. GUIDANCE TO INDUSTRY  Companies should ensure that their corrective actions meet the intent of their recommendations. One way to make the intention of the recommendation the focus of any follow-up activity is to evaluate the substance of the corrective action in addition to the time it takes to complete the action. a For more information on the ventilation systems, see the Interim Recommendations report (CSB DuPont La Porte Interim Recommendations [1, pp. 12-16]). b The CSB Interim Recommendations report discusses how DuPont La Porte’s emergency procedures called for restricting access to the manufacturing building if a ventilation fan, such as the wet end or dry end fans, is out of service. However, the actual practice for manufacturing building access was no different with a fan out of service than if all the fans were operating [1, p. 35]. Page 101 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX PROCESS SAFETY PRACTICES DURING TROUBLESHOOTING OPERATIONS  A robust strategy for troubleshooting is important because if hazards are not identified before starting an activity, workers could be unprepared for dealing with them, like what happened during the November 2014 incident. Troubleshooting implicates multiple PSM elements, including management of change, operating procedures, and safe work practices (Figure 28). Although DuPont La Porte had written policies and procedures for MOCs, operating procedures, and safe work practices, it did not have a strong process safety approach for dealing with troubleshooting operations. Figure 28.  Where troubleshooting Could Fall on DuPont’s PSM Wheel [54, p.  2].  Source: DuPont, with annotations by CSB. During the morning of November 14, 2014, Lannate® Unit engineers and managers (Technical Team) met as a group with the day shift supervisor to discuss the plugging problem in the methyl mercaptan piping and to develop a troubleshooting plan for clearing the piping and restarting both the Lannate® and agricultural products intermediates processes [1, p. 23]. In this meeting, the Technical Team identified the likely scenario that water had entered the methyl mercaptan system, developing a solid hydrate. DuPont’s methyl mercaptan technical standard shows the potential formation of a hydrate at low temperatures. The technical standard states that methyl mercaptan “will form a hydrate with water, which is a solid below [40°F [degrees Fahrenheit]] per information provided by a [methyl mercaptan] supplier” [1, p. 23]. Prior to implementing the troubleshooting plan developed by the Technical Team, however, site personnel did not develop written procedures, conduct any type of hazard analysis for abnormal conditions, conduct a job safety analysis, perform an MOC process, or conduct any other type of hazard analysis [1, p. 25]. Several methods can identify potential hazards and prevent or mitigate potential incidents caused by troubleshooting, including development and use of MOC processes, operating procedures, or safe work practices. A robust troubleshooting approach can include the following methods:  An MOC approach, which should identify and address possible hazards [52, pp. 423-426, 255-256]  An operating procedure approach, which should incorporate safeguards while methodically working through troubleshooting steps [52, pp. 255-256] Page 102 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board  Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX A safe work practices approach, which should address unexpected process upsets by using work permits (i.e., line-breaking permits) that can address specific troubleshooting hazards [70, p. 393], [52, pp. 285298] A combination of these PSM approaches may be prudent depending on the complexity and urgency of the problem. One or more of the noted PSM approaches could have identified the pathway the liquid methyl mercaptan took into the manufacturing building before personnel put hot water on the insulated piping, leading to the November 2014 incident. GUIDANCE TO INDUSTRY  Companies should develop an action plan to manage troubleshooting operations. There are multiple approaches a company can take, including addressing troubleshooting hazards in PHAs, operating procedures, MOCs, or work permits. MOC PRACTICES  According to OSHA, “contemplated changes to a process must be thoroughly evaluated to fully assess their impact on employee safety and health and to determine needed changes to operating procedures” [18]. Therefore, to prevent safety incidents and ensure worker safety, companies must ensure that the following considerations are addressed in their MOC process prior to the implementation of any change:  The technical basis for the proposed change  Impact of the change on employee safety and health  Modifications to operating procedures  Necessary time period for the change Figure 29.  Where MOC is Located on DuPont’s PSM Wheel [54, p. 2].  Source:  DuPont, with annotations by CSB.   Page 103 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board  Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Authorization requirements for the proposed change [18]a As explained in the CSB’s Williams Geismar Olefin Plant Case Study, robust management of change practices are needed to ensure that personnel review hazards for the entire process affected by the change [71, p. 23]. Within DuPont, MOC policies are defined in standards at the corporate level and adopted according to each site’s procedures. The DuPont corporate standard defines three types of MOCs: technology, subtle changes, and personnel (Figure 29). An MOC for technology is defined as “any change in the technology of the process.”b A “subtle change” is defined as “any change within the documented technology that is not a replacement in kind.”c, d MOCs are intended to be completed prior to any implementation of these types of change. DuPont La Porte adopted DuPont’s corporate MOC policies into its own site policies and procedures. The CSB found, however, that DuPont La Porte personnel did not use MOCs for changes to equipment or procedures that contributed to the incident. 6.4.1 NO MOC FOR HEATING PIPING OR FOR NEW PIPING ALIGNMENT  To clear the plugging, the Technical Team asked operators to put hot water on the outside of the methyl mercaptan feed piping, under the insulation, to warm the piping and its contents to dissociate the hydrate back to liquid methyl mercaptan and water (Figure 30) [1, p. 23]. a 29 C.F.R. § 1910.119 (l)(2). According to DuPont, management of change of “subtle changes” includes rerouting a piping system during field modifications or replacement and installation of an automatic valve to replace a manual valve with the same function. c According to DuPont, management of change technology includes managing changes in the design basis for existing equipment, changes in process materials or operating parameters, and process control changes. d In its Belle investigation, the CSB recommended that DuPont “[r]eevaluate and clarify the DuPont corporate MOC policies to ensure that staff can properly identify and use the distinctions between subtle and full changes and train appropriate personnel how to properly apply the distinctions on any changes in the policy.” [144, p. 110]. The CSB closed the recommendation in April 2013 [147]. b Page 104 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 30.  Hot Water Hose Positioned on the Liquid Methyl Mercaptan Feed Piping.  Hot water flowed  between the piping and the insulation to heat the piping and dissociate the solid hydrate that had formed  after water inadvertently entered the methyl mercaptan storage tank.  Source: CSB.  At low temperatures (≤ 52°F), water and methyl mercaptan form a solid, ice-like material called methyl mercaptan clathrate hydrate [72]. Temperatures in the Houston area for the 24 hours preceding the incident averaged approximately 40°F and had been consistently below 55°F since Tuesday, November 11, 2014. Although years earlier, DuPont’s methyl mercaptan technical standard and a PHA identified the potential for methyl mercaptan hydrate formation, DuPont did not have safeguards, such as heat tracing, or develop a procedure to dissociate the hydrate safely [1, p. 22]. The Technical Team realized that when methyl mercaptan was heated it would expand and need a safe place to vent to avoid overpressure in the feed piping. To address this concern, DuPont operations personnel opened three valves between the methyl mercaptan feed line and the waste gas vent header—piping intended to remove excess or unwanted vapor from the process and route it to the NRS incinerator for thermal destruction. DuPont La Porte personnel used pressure gauges at those three valves (Figure 31) to determine the location of the blockage and their progress in clearing it. At the time of the incident, one of these three valves between the methyl mercaptan feed system and the waste gas vent header was fully open, and a second valve was slightly open [1, p. 25]. Page 105 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 31.  Excerpt from CSB Animation.  It depicts the three locations where valves connected the methyl mercaptan feed piping  (blue) to the waste gas vent header piping (orange).  Workers used the pressure gauges shown at these locations to monitor the  progress of clearing the hydrate blockage inside the methyl mercaptan feed piping.  Source: CSB.  Operations personnel began implementing the plan that the Technical Team had developed by applying hot water under the insulation, on the outside of the liquid methyl mercaptan piping. DuPont La Porte operators started this process at the methyl mercaptan storage tank and the associated methyl mercaptan feed pump piping segments, and then worked their way down the methyl mercaptan feed piping toward the reaction system. Workers used pressure gauges at each of the three block valves between the liquid methyl mercaptan feed piping and the vapor waste gas vent header piping system to determine the success and progress of the work [1, p. 26]. Page 106 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 32.  Excerpt from CSB Animation.  It depicts the piping arrangement that allowed liquid methyl mercaptan from the  feed line (blue) to flow into the waste gas vent header piping (orange).  Source: CSB.  Using these valves in this way followed the plan developed by the Technical Team. This alignment, however, created a direct path between the liquid methyl mercaptan system and the waste gas vent header (vapor system), as shown in Figure 32, which was not DuPont’s design intent [1, p. 26]. Additionally, applying hot water to the outside of the methyl mercaptan liquid piping system exceeded the heat input design for the thermal expansion relief valve on this system [1, p. 26]. But DuPont La Porte personnel did not perform an MOC before instructing operations personnel to use the hot water to heat the piping, or before creating the piping alignment. DuPont corporate standards, as well as the EPA’s Risk Management Plan (RMP) rule and OSHA’s PSM regulations, require an MOC for these types of process changes [1, p. 25]. Performing an effective MOC before heating the piping with the hot water hose, and before creating the unusual piping alignment, could have identified and controlled the hazards that led to the incident. An MOC should have also triggered the creation of a written troubleshooting procedure. On the day of the incident, the Technical Team did not provide a written procedure to guide operations or to track the progress toward clearing the plugged methyl mercaptan feed piping. A written procedure should communicate the planned approach to multiple shifts and help avoid confusion. Additionally, it should alert personnel to potential hazards, such as the valve alignment that created the pathway for liquid methyl mercaptan to flow into the manufacturing building. Page 107 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 6.4.2 NO MOC FOR NEW PIPING ALIGNMENT TO NITROGEN RELIEF VALVES  During the troubleshooting operations, the nearly identical nitrogen relief systems located at two railcar loading and unloading stations were lined up to the discharge of the methyl mercaptan pumps (Figure 33). The nitrogen relief valves, however, were not designed for this new piping alignment. DuPont La Porte PHAs and relief valve design documents did not consider the possibility of lining up the methyl mercaptan storage tank pumps to these relief valves—as they were at the time of the incident. As a result, liquid methyl mercaptan discharged from a system designed for nitrogen vapor because the methyl mercaptan pump discharge pressure (90 psig)a was higher than the set pressure (80 psig) of these nitrogen relief valves. Pressurized methyl mercaptan from the pump caused the relief valves to open and release the highly toxic and highly flammable methyl mercaptan to the atmosphere [1, p. 46]. No one recognized this serious hazard because DuPont La Porte personnel did not perform an MOC when it changed the piping alignment during troubleshooting operations. An effective MOC should look at the design basis for equipment to determine whether the proposed use is compatible with its design. a The abbreviation psig stands for pounds per square inch gauge (pressure). Page 108 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 33.  Nitrogen Relief Valves at One of the Two Methyl Mercaptan Railcar Unloading Stations.  DuPont PHAs and  relief valve design documents never considered the possibility of lining up the methyl mercaptan storage tank pumps  to these relief valves—as they were at the time of the incident.  As a result, liquid methyl mercaptan was discharged  from a system designed for nitrogen vapor.  Source: CSB.  6.4.3 NO MOC OR PROCEDURE FOR VENT HEADER DRAINING OPERATION  In 2011, DuPont La Porte invested about $20 million in a project to increase production rates and reduce environmental emissions for the Insecticide Business Unit.a The key piece of equipment installed for this project was the nitrogen oxides (NOx) reduced scrubbed incinerator (NRS) shown in Figure 34.b a Lannate® was a sold-out product, and DuPont routinely looked for opportunities to increase capacity [1, p. 17]. b The NOx (nitrogen oxides) reduced scrubbed (NRS) incinerator system was a vertical thermal oxidizer system for the destruction of organics, halogenated organics, and nitrogen-containing wastes with removal of acid gas from discharge [1, p. 18]. Page 109 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 34.  NRS Incinerator.  NRS was installed in 2011 to reduce emissions and allow  increased production at the DuPont La Porte facility.  Source: CSB.  The NRS incinerator destroyed process waste gas streams that vented from equipment throughout the process. One of these waste gas streams contained methyl mercaptan vapor collected in a process vent system, referred to as the waste gas vent header piping. This header originated from various Lannate® and agricultural products intermediates process vessels, from methyl mercaptan railcar unloading facilities, and from the methyl mercaptan storage tank. The waste gas vent header piping provided the path for these waste gas streams to be directed to the NRS incinerator for thermal destruction (combustion) [1, p. 18]. Following the 2011 installation of the NRS incinerator, DuPont experienced frequent high-pressure events in equipment connected to the waste gas vent header piping.a DuPont decided one significant cause of these high- a The high pressure in the waste gas vent header piping restricted vent sources flowing into the header, causing high-pressure events in process equipment. If left unaddressed, these high-pressure events could result in relief valves’ opening and discharging hazardous chemicals to the atmosphere [1, p. 18]. Page 110 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX pressure events was liquid accumulation in the vapor waste gas vent header piping.a DuPont La Porte personnel had designed and installed the waste gas vent header piping to the NRS incinerator in 2011 without sufficient consideration of liquid accumulation. For example, the piping had low points where liquid could accumulate, and with no engineered equipment provided, such as a knock-out drum,b liquids could not be safely removed from the waste gas vent header piping system.c Because some of the process vents contained water vapor, the common belief was that the accumulated liquid consisted primarily of condensed water with small amounts of other process chemicals, including methyl mercaptan. As a result, area management instructed operations personnel to address high-pressure events in the waste gas vent header piping by opening manual drain valves from the waste gas vent header piping to the atmosphere, directing the liquid toward floor drains located within the manufacturing building [1, p. 18]. DuPont La Porte personnel never completed an MOC or established a specific procedure or used safe work practices, such as line-breaking permits, for draining this liquid from the waste gas vent header piping. Rather, area management directed operators to drain the system through written instructions to operations staff in a daily instruction log book [1, p. 18]. Beginning January 14, 2014, and continuing until the incident, the daily instructions directed operators to drain the methyl mercaptan waste gas vent header’s “low point” on the third floor once per shift. After installation of a flexible hose from the waste gas vent header drain valve to the floor, the instructions changed to include directing the liquid through the hose under a running safety shower until the liquid stopped flowing from the hose [1, p. 18]. DuPont La Porte personnel never sampled or analyzed the liquid workers routinely drained from this system [1, p. 18]. Daily instructions before the incident asked the operators to sample the unknown liquid. DuPont La Porte wanted samples of the liquid for a subsequent laboratory analysis to identify its chemical composition because workers reported that the liquid had a strong, noxious odor of sulfur compounds [1, p. 18]. Even though DuPont La Porte was aware that the liquid likely contained more than just water and was unaware of the actual chemical composition [1, p. 18], instructions to workers did not specify that additional precautions—such as wearing additional personal protective equipment (PPE)—were needed when draining the waste gas vent header. Weeks before the November 2014 incident, DuPont La Porte employees started an MOC to reduce liquid buildup by connecting a hose from the waste gas vent header piping to a process vessel, thus eliminating the need to drain the header liquid onto the floor. This MOC recognized that draining the waste gas vent header on a DuPont personnel believed the likely source of liquid accumulation was condensation from saturated vapor streams that originated in equipment operating above ambient temperatures. As these vapor streams entered the cooler waste gas vent header, liquid could condense and accumulate over time [1, p. 18]. b Knock-out drum is an industry term for a process vessel that provides for separation of vapor and liquid. c The CSB identified three locations in the waste gas vent header piping to the NRS incinerator where liquid could accumulate: (1) inside the manufacturing building, (2) the piping outside the manufacturing building as it passed through the MIC unit, and (3) at detonation arresters just prior to where the waste gas from the waste gas vent header entered the NRS incinerator. Each location was equipped with a drain valve—two locations had atmospheric drains and only one location’s drain was routed to a caustic scrubber [1, p. 18]. Page 111 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX the third floor was “not a good practice, since sometimes nitrogen is used to purge the line, which can lead to a nitrogen release inside the building.” Although area management recognized that this draining “was not a good practice” and could lead to a release of nitrogen,a the practice continued. Once personnel recognized the hazardous nature of this practice, the draining should have at least required additional safeguards, such as restricted access and respiratory protection. GUIDANCE TO INDUSTRY  Companies should always use MOCs where required by corporate policy or federal process safety regulations. Special attention should be paid to nonroutine or abnormal operations because these may involve issues with safety systems, equipment, procedures, or personnel practices that can create additional hazards, potentially leading to serious safety incidents if there are poor MOC practices. Company MOC reviewers should be thoughtful and comprehensive so that potential dangers can be avoided or mitigated. a As an asphyxiant, nitrogen can displace oxygen, creating a potentially hazardous environment [168, p. 2]. Page 112 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX LINE‐BREAKING PRACTICES  Companies should ensure the use of safe work practices,a such as linebreaking permits, to manage nonroutineb processes, such as draining the waste gas vent header piping. Under the PSM standard, a company must develop and implement safe work practices to provide for the control of hazards during work activities, such as lockout/tagout, confined space entry, or opening process equipment or piping (i.e., line breaking).c According to Guidelines for Risk Figure 35.  Where Safe Work Practices Are Located on DuPont’s PSM Wheel [54, p.  Based Process Safety, from CCPS, 2].  Source: DuPont, with annotations by CSB. safe work practices help control hazards and manage risks involved with nonroutine activities [52, p. 286]. Managing risks associated with nonroutine processes requires robust systems, thorough training and awareness, sound culture, and diligence [52, p. 293]. CCPS further suggests developing an integrated system for safe work practices, including safe work procedures, permits, checklists, and other written standards [52, pp. 291-92] (Figure 35). Any time a valve is opened to the atmosphere, the mechanical integrity of the system is compromised. Under PSM, employers must develop and implement safe work practices to control hazards during line breaking [18].d Figure 36 shows an approach to line and equipment opening (breaking) from a document that was produced under OSHA’s grant program. a CCPS defines safe work practices as “an integrated set of policies, procedures, permits, and other systems that are designed to manage risks associated with non-routine activities such as performing hot work, opening process vessels or lines, or entering a confined space” [150]. b CCPS defines a nonroutine activity as any activity that is not fully described in an operating procedure. Additionally, nonroutine does not refer to the frequency of an activity; rather, it refers to whether the activity is part of the normal sequence of converting raw materials to finished materials [52, p. 288]. c 29 C.F.R. § 1910.119 (f)(4). d According to OSHA, line breaking “means the intentional opening of a pipe, line, or duct that is or has been carrying flammable, corrosive, or toxic material, an inert gas, or any fluid at a volume, pressure, or temperature capable of causing injury” 29 C.F.R. § 1926.1202. Page 113 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 36.  Triangle Approach to Line and Equipment Opening Permits.  This slide is from a training  document about OSHA operating procedures, safe work practices, and training [73, p. 27].   Source: OSHA website.  Employees at the DuPont La Porte facility understood that there were hazards associated with nonroutine procedures, such as line breaking. DuPont’s corporate standard, which was also DuPont La Porte’s linebreaking procedure, specifically includes opening a valve to the atmosphere in its definition of line breaking, which requires a written job plan if it involves a hazardousa process or system.b Personnel at the DuPont La Porte facility, however, did not understand that draining the waste gas vent header through the flexible hose constituted a line break and required a permit. To drain the header using the existing equipment and work instructions, operations personnel had no choice but to open a valve to let the liquid flow toward the floor drain (and thus to the atmosphere), breaking the mechanical integrity of the line. a DuPont line-breaking training defines a hazardous process or system as a “process or system that contains any material at any pressure that could cause a risk of injury to an individual(s), a risk of fire or explosion, an environmental risk, or an off-site risk. Examples of hazardous processes or systems include, but are not limited to, compressed fluids, especially gases in pipes and vessels; corrosive and/or flammable substances and toxic process lines; and any other lines that could contain material that is hazardous on contact or inhalation, including fluid whose temperature is higher than 140°F (60°C) or lower than 14°F (-10°C).” b DuPont’s corporate line-breaking standard and DuPont La Porte’s site line-breaking procedure states, “A written job plan that specifically addresses safety, health, and environment (SHE) issues shall be prepared and implemented for all line breaks on hazardous processes and systems until all hazards have been learned or controlled. The job plan shall be prepared by qualified personnel and reviewed by everyone involved in the work prior to the start of the line break.” Page 114 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Although area management left written instructions, there was no written job plan and no specific requirement to obtain a line-breaking permit before draining the header. Had the instructions specified the requirement, the personnel could have recognized the need.a Figure 37.  Photo Showing Another Line Break.  Operators drained liquid accumulation in another vent header  without using line‐breaking procedures.  Source: CSB.   In addition to the periodic draining of the waste gas vent header, the CSB found that DuPont La Porte operators routinely drained other hazardous process equipment (see Figure 37 and Figure 38) without using line-breaking procedures. a At the DuPont La Porte site, if a procedure described how to do a line break and the appropriate precautions to take, personnel were not required to obtain a permit. Page 115 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 38.  Methylene Chloridea Compressor.  Photo shows where operators routinely drained liquid accumulation  from a methylene chloride compressor without using line‐breaking procedures.  Source: CSB.  In both February and October 2014, DuPont La Porte personnel held problem-solving meetings with two different shifts of operations personnel to discuss high-pressure events in the waste gas vent header, and both times personnel identified liquid accumulation in piping low points as well as draining liquid from the vent header. Additionally, both shifts proposed modifying piping to eliminate low points where liquid accumulated as a potential solution. These meetings, however, did not ensure that personnel were safely troubleshooting the high-pressure events. It is important for companies to recognize that problem-solving sessions are opportunities to evaluate hazards and ensure that MOCs, operating procedures, and safe work practices are being used. In situations with unknown conditions, safe work practices required by PSM provide an organized approach to proceed safely. Consistently using safe work practices, such as line-breaking permits, ensures that each time a piece of process equipment is put into a nonroutine situation, personnel use effective safeguards. Furthermore, a permit process can address procedures, hazard analysis, PPE, and safeguards. Additionally, if hazards are identified, corrective actions should be developed, and effective safeguards should be implemented. GUIDANCE TO INDUSTRY  Companies should recognize that nonroutine operations such as line breaking—even with established permit processes—can represent significant potential dangers. One way to help ensure that personnel understand the permit process is to train them on the different scenarios that would trigger a permit. Companies should analyze recurring operational or safety issues that trigger permits and eliminate the underlying causes of those issues. In a Methylene chloride is a toxic chemical that can cause death at certain concentrations [93]. Page 116 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX instances requiring repeated line breaking, a hazard analysis should be performed, and an engineering solution should be applied (following an effective MOC) to avoid recurrence of the hazard. SHIFT COMMUNICATION PRACTICES  Companies should develop procedures and practices for effective communication among their personnel (Figure 39). Effective communication depends on reliable and complete information that is transmitted and received in a timely manner. Understanding the information is imperative for safe operations. In its Guidelines for Risk Based Process Safety, CCPS outlines several approaches for communications including formalizing communications between workers, Figure 39.  Where Shift Communication Falls on DuPont’s PSM Wheel [54, p. 2].   Source: DuPont, with annotations by CSB.  formalizing communications between shifts, and formalizing communications between work groups. Depending on the type of communication and group involved, verbal or written communication may be appropriate. When verbal communication is used, there should be a sufficient dialogue to verify that the person receiving information understands it. Additionally, personnel can use log books and written communications to transmit particularly important information. Using a combination of these two methods can benefit operations, as the CCPS book notes in the section on how formalize shift communications [52, pp. 475-76]. During the troubleshooting operations, DuPont personnel relied upon verbal communications to convey the Technical Team’s plan to the incoming shift (the shift working at the time of the incident) [1, pp. 25-26]. Postincident, it remains unclear what the prior shift communicated to the incoming shift about the Technical Team’s plan and the status of the troubleshooting, because this information was communicated only verbally.a According to a DuPont training, “An effective shift turnover is important for chemical operations to ensure continuity across operating shifts and ensure all operating personnel fully understand both normal and abnormal or unusual conditions within the operating area in order to avoid misunderstandings or lack of information.” a The only written communication to the night shift supervisor was a note in the shift log that stated: “Unplugging M[e]SH Header.” MeSH is DuPont’s abbreviation for methyl mercaptan [1, p. 26]. Page 117 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Having continuity in operations from shift to shift ensures that processes run smoothly and equips workers coming on shift with information that helps strengthen process safety performance. During the troubleshooting operations, DuPont relied upon verbal communications at several key times:  The Technical Team’s verbal communication of the plan to the day shift supervisor [1, p. 25].  The face-to-face verbal communication between shift supervisors to transition the efforts from the day shift to the night shift [1, pp. 25-26]. Reliance on verbal communication during this troubleshooting operation proved detrimental because this problem was novel, and the night shift supervisor (referred to in this report as the “Shift Supervisor”) was learning of the shutdown and subsequent startup difficulties for the first time when he came on shift. Although the Technical Team verbally communicated with the day shift supervisor, the Technical Team did not meet with the newly involved night shift supervisor, nor did it communicate verbally or in writing with the night shift operations personnel. Improved communication could have helped ensure continuity of the troubleshooting operation by better informing the night shift of all the relevant activities that had occurred during the week and the steps needed to continue with the troubleshooting process. It is important for a company to assess the type of communication necessary for effective information sharing between shifts and between departments or divisions of a company. The more complicated the process and the more novel the problem, the more imperative it is to have effective communication. Consideration should be given to using multiple modes of communication (including written communication) to ensure that all affected employees get the information they need to perform their jobs safely, within the broader context of other ongoing operational and process safety issues, to maximize the chance for continuity and safety in operations. GUIDANCE TO INDUSTRY  Effective communication between different operational units at a facility, and between supervisors and workers on changing shifts, is critical to safety. Communication is necessary to convey the status of operations, ongoing changes, abnormalities, unusual operating conditions, or other relevant issues associated with chemical process equipment. The more complex the process involved, the greater the imperative to ensure that communication is effective. Reliance solely upon one form of communication, especially verbal communication, can leave the workforce vulnerable to potential gaps in information communicated, misunderstandings, or absence of critical information in what oftentimes can be an evolving situation. 7 ADDITIONAL FACTS, CONDITIONS, AND CIRCUMSTANCES IDENTIFIED  The CSB is tasked with investigating and reporting “to the public in writing the facts, conditions, and circumstances and the cause or probable cause of any accidental release resulting in a fatality, serious injury, or Page 118 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX substantial property damages.”a This information is beneficial in promoting safe workplaces and helping to protect workers, the public, and the environment. The CSB identified numerous conditions and circumstances that existed at the time of the November 15, 2014 DuPont La Porte incident. In September 2015, the CSB issued an Interim Recommendations report to address conditions and circumstances, some of which were causal to the incident, before the DuPont La Porte Lannate® facility restarted [1]. Similar to its Interim Recommendations, the CSB identified a condition and circumstance, DuPont La Porte’s employee incentive program, that could be strengthened to further promote safe workplaces at DuPont legacy sites. Section 7.1 addresses the guidance for incentive compensation programs that existed at the time, and the corresponding Guidance to Industry section covers newly published OSHA guidance and industry guidance. EMPLOYEE INCENTIVE PROGRAM  Companies should ensure that safety incentive programs do not disincentivize personnel from reporting injuries or other deficiencies in process safety management systems.b The DuPont La Porte facility implemented a variable compensation (bonus) system called the La Porte Local Performance Based Compensation (LPBC) program. The LPBC, however, did not use process safety management performance metrics. Instead, it used a safety modifier based solely on OSHA total recordable injuries, and it was constructed in a way that could have potentially disincentivized reporting injuries. The stated purpose of the LPBC, which was in effect at the time of the November 2014 incident, was “to provide the opportunity for eligible employees to share in business results that exceed expectations.” This program created incentive compensation opportunities for DuPont La Porte employees in various categories, including operators, mechanics, and general helpers, who were represented by the International Chemical Workers Union Council of the United Food and Commercial Workers (ICWUC/UFCW) Local 900C labor union. The structure of the LPBC program for this group of employees evolved over the established range of performance years but involved two primary components. The first part, referred to as the Business Metric, a 42 U.S.C. § 7412(6)(C)(i). Under OSHA’s Recording and Reporting Occupational Injuries and Illnesses regulations, an employer “must establish a reasonable procedure for employees to report work-related injuries and illnesses promptly and accurately. A procedure is not reasonable if it would deter or discourage a reasonable employee from accurately reporting a workplace injury or illness” (29 C.F.R. § 1904.35(b)(1)(i)). The OSH Act and OSHA regulations, including its Recording and Reporting Occupational Injuries and Illnesses regulations, prohibit employers from discriminating, retaliating, or instituting other adverse consequences on employees who report injuries or other safety concerns. According to OSHA, “OSHA’s Whistleblower Protection Program enforces the whistleblower provisions of more than twenty whistleblower statutes protecting employees who report violations of various workplace safety and health, airline, commercial motor carrier, consumer product, environmental, financial reform, food safety, health insurance reform, motor vehicle safety, nuclear, pipeline, public transportation agency, railroad, maritime, and securities laws. Rights afforded by these whistleblower protection laws include, but are not limited to, worker participation in safety and health activities, reporting a work-related injury, illness or fatality, or reporting a violation of the statutes herein” [166] (29 C.F.R. § 1904.35(b)(1)(iv)). b Page 119 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX rewarded success with respect to site financial goals, such as increases in after-tax operating income and improvement in cash flow from operations. The second part, referred to as Line of Sight, represented a weighted average of operational performance metrics among the different units at the DuPont La Porte site, and consisted of things like reducing costs and exceeding production targets. Any incentive eligible to be paid for exceeding business performance goals, however, would then potentially be reduced by what the LPBC termed a “safety modifier.” For example, in performance year 2011, the DuPont La Porte site established the safety modifier based on the number of OSHA total recordable injuries, with the number of recordable injuries causing a reduction in available incentive award payments that were otherwise due to be paid to members of that portion of the workforce. Specifically, at the program’s start in 2011, if there were three or fewer recordable injuries, the LPBC set the safety modifier value at 1, which did not reduce the incentive payable for business performance; however, as more recordable injuries occurred, the safety modifier incrementally reduced the total incentive paid to employees.a Over the years, the LPBC evolved in terms of how the safety modifier worked. In 2014, the year of this incident, the LPBC adjusted the safety modifier so that every reported worker injury would decrease the group’s bonus payout by 5 percent, with a maximum 50 percent reduction of any available bonus paid to employees. By using a safety modifier that considered only worker injuries, DuPont La Porte equated safety performance with occupational safety metrics, similar to DuPont’s Safety Perception Surveys. Thus, DuPont La Porte did not include a process safety performance metric in its incentive. A disproportionate emphasis on occupational safety metrics as the measurement for safety performance could confuse personnel into viewing occupational safety and process safety as the same or perceiving that occupational safety is more important than process safety. Furthermore, emphasizing a low number of total recordable injuries could give personnel false confidence about process safety performance. As stated recently by CCPS in its publication on process safety culture, Essential Practices for Creating, Strengthening, and Sustaining Process Safety Culture, “Money is one of the strongest influences on human behavior, for better or worse. When developing compensation and incentive schemes based on process safety performance, it is critical to design them carefully to reinforce the desired cultural attributes and behaviors. It is equally critical to be aware of the many pitfalls that lead a well-intentioned compensation scheme to unwittingly support negative behaviors [56, p. 109].” a In 2011, if there were four recordable injuries, then the modifier reset to 0.9, if there were five recordable injuries it reset to 0.8, and for six or more recordable injuries it reset to 0.75. Over subsequent years, the safety modifier became more impactful in a negative way if the site had not improved its total recordable injury rate from the previous year. Page 120 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX If a company decides to use an incentive to focus on safety performance, it should consider having a process safety component that uses leading indicators over multiple years. Because process safety incidents are typically infrequent, personnel can perform poorly in process safety for a long time without experiencing a major accident [56, p. 110]. Therefore, using lagging indicators, such as the number of process safety incidents, could hide poor process safety performance [56, p. 110]. On the other hand, using leading indicators related to correct behaviors, such as percentage of inspection completion, is better because the events on which such indicators are based happen more frequently [56, p. 110]. Additionally, companies can drive long-term process safety performance by using multiyear incentives because process safety needs to be performed consistently well over time [56, p. 110]. If companies employ yearly schemes, management should ensure that rewards are provided in recognition of steady process safety performance over the course of a year [56, pp. 110-111]. If a process safety incentive is used, companies should ensure that process safety incentives are measuring key aspects of process safety management systems or process safety culture, and not personal or occupational safety metrics [56, p. 112]. Furthermore, to prevent confusion between process safety and occupational safety, management should not combine process safety indicators and occupational safety indicators into a single safety incentive [56, p. 112]. Regardless of its precise formulation and despite small changes made to the safety modifier throughout the range of years represented in this program, DuPont La Porte’s LPBC potentially created a disincentive for workers to report injuries. Employees working under these types of programs would report injuries at financial risk to themselves and their co-workers. In addition, safety incentive programs like this one may not be effective in driving safety improvement [74]. Furthermore, when constructed in this manner, a safety incentive program can be susceptible to “gaming,” with workers refraining from reporting workplace injuries to earn the otherwise available incentive due to be paid [74].a This phenomenon can make it difficult to spot trends in worker safety issues, leaving other workers vulnerable to the same injury as potentially dangerous conditions go uncorrected, among other practical concerns. As OSHA Deputy Assistant Secretary Fairfax explained in a March 12, 2012, memorandum to agency regional administrators and whistleblower program managers, If employees do not feel free to report injuries or illnesses, the employer’s entire workforce is put at risk. Employers do not learn of and correct dangerous conditions that have resulted in injuries, and injured employees may not receive the proper medical attention, or the workers’ compensation benefits to which they are entitled. Ensuring that employees can report injuries or illnesses without fear of retaliation is therefore crucial to protecting worker safety and health [75]. The memorandum further expressed concern that these types of safety incentive bonus programs may place implicit pressure on employees not to report workplace injuries or illnesses: a In a recent National Safety Council article, one corporate safety manager noted that these types of incentive programs have surface allure but do not usually drive actual safety improvement, and suggested that some incentive programs may instead actually promote “covering up” and “cooking the books” through underreporting or nonreporting of workplace illnesses or injuries so employees can remain eligible for rewards [74]. Page 121 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Some employers establish programs that unintentionally or intentionally provide employees an incentive to not report injuries. For example, an employer might enter all employees who have not been injured in the previous year in a drawing to win a prize, or a team of employees might be awarded a bonus if no one from the team is injured over some period of time. Such programs might be well-intentioned efforts by employers to encourage their workers to use safe practices. However, there are better ways to encourage safe work practices, such as incentives that promote worker participation in safety-related activities, such as identifying hazards or participating in investigations of injuries, incidents or “near misses.” OSHA’s [Voluntary Protection Programs] Guidance materials refer to a number of positive incentives, including providing tee shirts to workers serving on safety and health committees; offering modest rewards for suggesting ways to strengthen safety and health; or throwing a recognition party at the successful completion of company-wide safety and health training [75]. After the November 2014 incident, the DuPont La Porte site changed its LPBC bonus system to align it with OSHA guidance that existed at the time, such that the safety modifier would not discourage workers from reporting injuries. The new 2015 La Porte safety modifier was based on employees’ completing computerbased training courses and annual medical examinations. The CSB viewed DuPont La Porte’s correction of the potential disincentive in the LPBC as a positive development. The CSB lacks documentation showing that workers on DuPont La Porte’s Safety Committee or those covered by the LPBC objected to this safety modifier prior to the incident. None of the workers on the Safety Committee participated in the capacity of official union representative of ICWUC/UFCW Local 900C. However, when workers have concerns about an incentive program that can impact the reporting of incidents, they should report these concerns to their union, if they are represented, or to a health and safety committee or a manager. It is imperative, regardless of having a particular incentive program, that workers report unsafe conditions and safety (personal or process) incidents to help prevent future incidents. Consistent with OSHA regulations and guidance, all legacy DuPont sites should evaluate any safety incentive programs or variable pay initiatives that reduce employee bonus awards based solely upon injury rates, or that otherwise potentially impair OSHA record-keeping requirements, and change the payout structure to incentivize improved safety performance. OSHA itself does not consider “conditioning a benefit on compliance with legitimate safety rules or participation in safety-related activities” to violate section 1904.35(b)(1)(iv), so long as programs that do so are instituted appropriately.a As DuPont reviews incentive programs at its legacy sites, the CSB similarly encourages DuPont to continue to explore ways to encourage positive safety performance, with respect to both personal and process safety. Specifically, the CSB encourages DuPont to consider expanding a “For example, raffling off a $500 gift card each month in which employees universally complied with legitimate workplace safety rules—such as using required hard hats and fall protection and following lockout-tagout procedures—would not violate the rule. Likewise, rewarding employees for participating in safety training or identifying unsafe working conditions would not violate the rule. On the contrary, OSHA encourages employers to find creative ways to incentivize safe work practices and accident-prevention measures that do not disproportionately penalize workers who report work-related injuries or illnesses” [158]. Page 122 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX consideration of safety incentive programs by broadening the company’s focus beyond personal safety programs. If DuPont desires to retain safety incentive programs, the company should also consider how it can incentivize safety more holistically, ensuring that process safety and major accident prevention efforts are bolstereda along with more traditional efforts aimed at reducing workplace illnesses and injuries. In no case, however, should any incentive program act in any way to discourage the required reporting of safety issues such as injuries, illnesses, incidents, hazards, or near-miss incidents. GUIDANCE TO INDUSTRY  Understanding how incidents occur can be beneficial in preventing future worker injuries and strengthening process safety management systems. Some safety incentive programs, however, may create a culture of nonreporting of safety incidents, potentially hampering learning from the underlying events, possibly resulting in a failure to address the causes of the incident. In response to these types of concerns, OSHA created recordkeeping requirements and issued regulations to prevent whistleblower retaliation for reporting injuries.b, c Additionally, OSHA recently published guidance on how to formulate an incentive without disincentivizing workers from reporting injuries. On October 11, 2018, Kim Stille, Acting Director of Enforcement Programs at OSHA, issued a memorandum to Regional Administrators titled “Clarification of OSHA’s Position on Workplace Safety Incentive Programs and Post-Incident Drug Testing Under 29 C.F.R. § 1904.35(b)(1)(iv)” [76]. In that memorandum, Acting Director Stille sought to clarify OSHA enforcement around workplace safety incentives paid by employers. She stated that “29 C.F.R. § 1904.35(b)(1)(iv) does not prohibit workplace safety incentive programs” as long as such programs “are not implemented in a manner that discourages reporting” of workplace injuries [76]. The memorandum then elaborated on how an employer could avoid even “inadvertent deterrent effects of a ratea According Andrew Hopkins, “Other things like incentives need to be rethought. Performance agreements and bonuses now reinforce the priorities of speed and production. They’ve been made to reinforce personal safety in recent years. They need now to be rethought again to incentivize the avoidance of catastrophe” [67, p. 3]. b According to the 2012 Fairfax memorandum, “Incentive programs that discourage employees from reporting their injuries are problematic because, under section 11(c), an employer may not ‘in any manner discriminate’ against an employee because the employee exercises a protected right, such as the right to report an injury.… If an employee of a firm with a safety incentive program reports an injury, the employee, or the employee’s entire work group, will be disqualified from receiving the incentive, which could be considered unlawful discrimination. One important factor to consider is whether the incentive involved is of sufficient magnitude that failure to receive it ‘might have dissuaded reasonable workers from’ reporting injuries. Burlington Northern & Santa Fe Railway Co. v. White, 548 U.S. 53, 68 (2006).” The memorandum continues, “In addition, if the incentive is great enough that its loss dissuades reasonable workers from reporting injuries, the program would result in the employer’s failure to record injuries that it is required to record under Part 1904. In this case, the employer is violating that rule, and a referral for a recordkeeping investigation should be made.… This may be more likely in cases where an entire workgroup is disqualified because of a reported injury to one member, because the injured worker in such a case may feel reluctant to disadvantage the other workgroup members” [75]. c In explaining OSHA’s amended regulation found at 29 C.F.R. § 1904.35(b)(1)(i), OSHA Deputy Assistant Secretary Dorothy Dougherty made explicit the longstanding requirement for employers to have a reasonable procedure for employees to report workrelated injuries and illnesses, and (b)(1)(iv) incorporated the existing prohibition on retaliating against employees for reporting workrelated injuries or illnesses under section 11(c) of the OSH Act, 29 U.S.C. § 660(c). She also made clear, however, that “Section 1904.35(b)(1)(iv) does not prohibit safety incentive programs. Rather, it prohibits taking adverse action against employees simply because they report work-related injuries or illness. Withholding a benefit—such as a cash prize drawing or other substantial award— simply because of a reported injury or illness would likely violate section 1904.35(b)(1)(iv) regardless of whether such an adverse action is taken pursuant to an incentive program [158].” Page 123 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX based incentive program by taking positive steps to create a workplace culture that emphasizes safety, and not just rates” [76]. For example, Acting Director Stille noted that any inadvertent deterrent effect caused by a ratebased incentive program could be “counterbalanced” by affirmative steps such as  creating an incentive program that rewards employees for identifying unsafe conditions in the workplace;  implementing a training program for all employees to reinforce reporting rights and responsibilities, emphasizing the employer’s nonretaliation policy; or  instituting a mechanism for accurately evaluating employees’ willingness to report injuries and illnesses [76]. In Essential Practices for Creating, Strengthening, and Sustaining Process Safety Culture, CCPS posed the question of whether a company should forgo all process safety–related incentives. CCPS stated that an argument can be made to that effect, with working injury-free serving as a long-term benefit for any worker. Nevertheless, money is a strong human motivator, and if used with care, it can influence behavior for the better [56, p. 109]. As with occupational safety–based incentives, management should consider whether the use of a process safety incentive creates a potential for inverse effects. An incentive could lead to the opposite of the desired behavior (e.g., using incident numbers or incident reduction for the basis of an incentive “may drive personnel to hide or under-report incidents”) [56, p. 110]. Companies should assess safety incentive programs currently in place to ensure they are effective in driving positive safety change and do not serve as a disincentive for reporting workplace safety issues. 8 KEY FINDINGS  In its investigation of the November 15, 2014, DuPont La Porte incident, the CSB found that 1. DuPont did not effectively respond to a toxic chemical release; 2. DuPont’s corporate process safety management system did not ensure that DuPont La Porte implemented and maintained an effective process safety management system; and 3. DuPont La Porte did not assess its culture for process safety in the site’s Safety Perception Surveys or any other formal assessment program, allowing serious process safety deficiencies to exist at the site. The CSB issues recommendations to the DuPont La Porte facility, DuPont, and the Local 900C of the International Chemical Workers Union Council of the United Food and Commercial Workers, as well as guidance and key lessons for the chemical industry, to address these key findings and to help prevent future incidents. Page 124 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 9 SAFETY GUIDANCE  The CSB, through the course of its investigation, identified key lessons from the November 15, 2014 incident that companies can use at their facilities (for more information, see Guidance to Industry from referenced sections). 1. Companies should ensure that employees understand the hazards of chemicals that they are working with and may be potentially exposed to if there is a release. Where there are multiple hazardous chemicals, such as methyl isocyanate (MIC) and methyl mercaptan, it is important that companies effectively train workers on the hazards of each chemical at their facility. Furthermore, companies should train workers who handle multiple highly toxic chemicals, such as methyl mercaptan and MIC, to treat these chemicals with equal importance. This training is important for workers to help ensure they have a working knowledge of the relevant chemical hazards. (Section 3: Delayed Awareness of Toxic Chemical Release) 2. Automatic alarms designed to alert personnel of hazardous conditions—such as a release of a toxic chemical or the existence of an explosive atmosphere—can relay critical safety information immediately to personnel, without the potential delays inherent in a system that relies solely on a control room operator to communicate safety alarms verbally to operators in the field. (Section 3: Delayed Awareness of Toxic Chemical Release) 3. Specific technical knowledge from unit experts—including technical and operations personnel—can be invaluable to the incident commander in an emergency at a chemical processing facility. Companies need to ensure that these individuals are preidentified as technical support personnel and that backup capability is available in the event the primary technical support personnel become unavailable. (Section 4.2: Process Coordinator Was Missing) 4. Plant emergency procedures should clearly outline the alerting and notification protocols for different types of plant emergencies. These procedures should also include guidance for situations in which there is insufficient initial information to effectively assess the nature of the problem and the level of emergency response team resources required. (Section 4.3.1: Call for ERT Response) 5. Even though industrial facilities may infrequently call upon emergency response vehicles, it is essential that those vehicles function as intended when needed. To ensure emergency vehicle reliability, companies must develop and apply regular maintenance and testing schedules for their emergency response vehicles. (Section 4.3.2: ERT Mini-Pumper Truck Not Operational) 6. Companies need a reliable means for emergency response teams to characterize hazardous atmospheres. Companies should provide air monitoring equipment to emergency response teams and train those teams on how to operate the equipment and interpret monitoring results. At facilities that assign the inspection, maintenance, and storage of portable air monitoring equipment to personnel who are not members of the emergency response team, the company should ensure that team members know where Page 125 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX the equipment is stored and can access it. (Section 4.4.1: Entry into Potentially Explosive Atmosphere) 7. High-hazard areas should be equipped with adequate detectors, alarms, and surveillance technology to identify whether there is a chemical release (or other type of emergency) and if personnel are affected. (Section 4.4.2: No Technology to Locate Missing Workers) 8. Companies need to develop a system to update emergency planning documents when pertinent hazards are identified. Changes to emergency planning documents should be effectively communicated to the site emergency response team. (Section 4.4.3: Unrecognized Manufacturing Building Collapse Hazard) 9. Chemical facilities should ensure that their emergency response plans include maps showing the layout of buildings containing hazardous chemicals, for use by emergency responders and to aid evacuation and rescue efforts. Facilities should also coordinate regularly scheduled site tours for both plant and external emergency responders to develop strong working relationships and help ensure responders are familiar with facility access points, hazards, emergency response issues, and site or facility layout. Additionally, facilities should familiarize responders with process structures or buildings by having periodic drills inside them, to improve responder navigation during emergencies. To enhance responder performance, members of an emergency response team should train together, especially when multiple companies are staffing a single, integrated team. (Section 4.5: Difficulties Navigating Manufacturing Building) 10. When a process safety incident occurs, such as a chemical release, it can be beneficial for technical personnel who are not immediately involved in emergency response functions to analyze process data to assess the source, scope, and magnitude of the incident. This analysis can help the company (and the incident commander) identify needed equipment manipulations to stop or control the incident, such as shutting down pumps or closing isolation valves. (Section 4.6: No Analysis of Process Data to Identify Source of Leak) 11. Companies should ensure emergency response team members are trained to (1) physically designate the hot zone; (2) communicate the location of the hot zone and entry control points to all personnel assisting with the emergency response, including operations personnel; and (3) control entry and exit points of the hot zone. (Section 4.7: Inadequate Creation and Control of Hot Zone) 12. Dispersion modeling of chemical releases can be an effective risk-based emergency response tool, but its results are highly dependent on accurate input data. During an emergency, it can sometimes be difficult to obtain an accurate release rate, limiting the accuracy of resulting models. Companies should not rely on unsupported data when making critical emergency response decisions, such as those affecting workers, members of the public, or people or property in the surrounding area. In emergencies that could affect the public and in which chemical release rates cannot be accurately estimated (for model input), written guidelines for how and when to alert the public should be available to emergency Page 126 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX responders. As better information about the release becomes available, the public protection zone can be adjusted accordingly. (Section 4.8.1: Release Modeling) 13. Monitoring for hazardous gases along the fence line at chemical facilities can help companies understand the extent of a release. This monitoring can be performed by fixed detectors, which can continually collect and record data, providing early notification of releases outside the property. When fixed detectors are not available, a person using a portable gas detector may also perform air monitoring. This strategy, however, introduces additional risk because that individual may enter a hazardous environment unknowingly. Proper personal protective equipment, including respiratory protection, is needed during manual air monitoring operations. (Section 4.8.4: Air Monitoring) 14. Employing any particular management system on its own, without additional work aimed at successful implementation, may not be sufficient to prevent major chemical incidents. Companies should conduct periodic comprehensive assessments of their process safety management systems and their implementation of these systems at established intervals to evaluate and identify opportunities to strengthen their systems’ effectiveness. (Section 5.3: American Chemistry Council) 15. Companies should ensure that when a process safety management system changes, their sites update their programs simultaneously and adhere to those changes. The ability to adapt quickly to industry trends and field learnings can be beneficial. To maximize the value of improvements, companies should consider reevaluating sites to ensure consistency with evolving practices. (Section 5.3.3: Responsible Care Conformance Audits) 16. Companies should invest time and resources to conduct audits. These resources should be used to ensure that audits are robust and comprehensive. (Section 5.3.3: Responsible Care Conformance Audits) 17. Personal safety performance and process safety performance are two different safety measures that all chemical process facilities should evaluate. Personal injury statistics are not an effective gauge of the quality of process safety management systems or process safety culture. (Section 5.4.1: Building a Safety Culture) 18. Companies should have a process in place to ensure that hazard scenarios are fully developed and that process hazard analysis (PHA) teams assign appropriate initiating event frequencies and consequence severities to the scenario because it can make a significant difference in safeguard requirements. Additionally, PHA teams need to ensure that the safeguards applied to the hazard scenario are relevant and effective in controlling the hazard. (Section 6.1:Process Hazard Analysis Evaluation) 19. Companies should ensure before corrective actions are closed that the intent of a recommendation is met. One way to make the intention of the recommendation the focus of a corporate or site action is to evaluate the substance of the corrective action in addition to the time it takes to complete the action. (Section 6.2: Implementation of Corrective Actions) Page 127 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 20. Companies should develop an action plan to identify and control hazards during troubleshooting operations. There are multiple approaches a company can take to address troubleshooting, including PHAs, operating procedures, management of change (MOC) procedures, and safe work practices. (Section 6.3: Process Safety Practices during Troubleshooting Operations) 21. Companies should always use MOCs where required by corporate policy or federal safety regulations (OSHA’s Process Safety Management standard or the EPA’s Risk Management Plan rule). Special attention should be paid to nonroutine or abnormal operations because there may be issues with safety systems, equipment, procedures, or personnel practices that can create additional hazards, potentially leading to serious safety incidents if there are poor management of change practices. MOC reviewers should be thoughtful and comprehensive, so potential dangers can be avoided or mitigated. (Section 6.4: MOC Practices) 22. Companies should recognize that nonroutine operations such as line breaking—even with established permit processes—can represent significant potential dangers. One way to help ensure that personnel understand the permit process is to train them on the different scenarios that would trigger a linebreaking permit. Companies should analyze recurring operational or safety issues that trigger permits and eliminate their underlying causes. In instances requiring repeated line breaking, for example, a hazard analysis should be performed, and an engineering solution should be applied (following an effective MOC) to avoid recurrence of the hazard. (Section 6.5: Line-Breaking Practices) 23. Effective communication between different operational units at a facility, and between supervisors and workers on changing shifts, is critical to safety. Communications are essential to convey the status of operations, any ongoing changes, abnormalities, unusual operating conditions, or other relevant issues associated with chemical process equipment. The more complex the process involved, the more of an imperative exists to ensure that communication is effective. Reliance solely upon one form of communication, especially verbal communication, can leave the workforce vulnerable to potential gaps in information communicated, misunderstandings, or the absence of critical information in what oftentimes can be an evolving situation. (Section 6.6: Shift Communication Practices) 24. Employee incentive programs that reduce bonuses to employees based upon the number of recordable injuries—or other similar metric—can create a disincentive for workers to report injuries or incidents. Understanding how incidents occur can be beneficial in preventing future worker injuries and strengthening process safety management systems. Some safety incentive programs, however, may create a culture of nonreporting of safety incidents, potentially hampering learning from the underlying events, possibly resulting in a failure to address the causes of the incident. If employees do not feel free to report workplace injuries, incidents, or near misses, the employer’s entire workforce is put at risk. Ensuring that employees can report injuries or other process safety management system deficiencies is therefore central to protecting worker safety and health and aiding accident prevention. (Section 7.1: Employee Incentive Program) Page 128 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX 10 RECOMMENDATIONS  The CSB makes the following safety recommendations: DUPONT LA PORTE, TEXAS, CHEMICAL FACILITY   2015-01-I-TX-R8 Work together with emergency response team (ERT) member companies (DuPont, Chemours, Kuraray, and Invista), the International Chemical Workers Union Council of the United Food and Commercial Workers (ICWUC/UFCW) Local 900C, and the ICWUC/UFCW staff (if requested by the Local 900C) to update the DuPont La Porte emergency response plan. The emergency response program should ensure that periodic exercises or drills are performed on new procedures developed to address key lessons to strengthen ERT capabilities. The emergency response program should address the following:  Preidentifying unit experts as technical support personnel and ensuring that backup capability is available in the event the primary technical support personnel become unavailable. (Section 4.2: Process Coordinator Was Missing)  Clearly detailing in plant emergency procedures the alerting and notification protocols for different types of plant emergencies. Provide initial training to new plant personnel and periodic training to all plant personnel on these emergency communication procedures. These procedures should also include guidance for emergency responders when there is insufficient initial information to effectively assess the nature of the problem and the level of ERT resources required. (Section 4.3.1: Call for ERT Response)  Developing and applying regular maintenance schedules for emergency response vehicles consistent with the National Fire Protection Association’s Standard for the Inspection, Maintenance, Testing, and Retirement of In-Service Emergency Vehicles (NFPA 1911), which requires weekly visual and operational checks of emergency vehicles and has example checklists to use when performing preventive maintenance on emergency vehicles. (Section 4.3.2: ERT Mini-Pumper Truck Not Operational)  Ensuring that ERTs have reliable means to characterize hazardous atmospheres, for example equipment that monitors toxicity, explosivity, and oxygen levels. Additionally, ensure that ERT members know where the equipment is stored, can access it, and are trained on its proper use. (Section 4.4.1: Entry into Potentially Explosive Atmosphere)  Evaluating high-hazard areas, including PSM covered processes, to determine whether detectors and alarms are necessary to identify chemical releases (or other types of emergencies). Additionally, consider equipping high-hazard areas with surveillance technology to identify personnel in the field. (Section 4.4.2: No Technology to Locate Missing Workers) Page 129 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX  Developing and implementing written policy and procedures to update emergency response plan documents when hazards are identified. For example, personnel can identify these types of hazards in process hazard analyses, facility siting studies, management of change reviews, and incident investigations. Changes to emergency planning documents should be effectively communicated to the site ERT as soon as possible after identifying the hazard. (Section 4.4.3: Unrecognized Manufacturing Building Collapse Hazard)  Ensuring that emergency response planning accounts for difficulties in conducting response efforts, including (1) maps included in emergency response plans to show the layout of buildings containing hazardous chemicals, for use by emergency responders and to aid evacuation and rescue efforts; (2) coordination of periodic (at least annual) site tours for plant and external emergency responders; (3) training emergency responders to help ensure familiarity with facility access points, hazards, emergency response issues, and site or facility layout; and (4) building teamwork by having members (from the different companies) of the ERT field train (by conducting drills) together when practicable. (Section 4.5: Difficulties Navigating Manufacturing Building)  Assigning knowledgeable personnel the responsibility to analyze process data to assess the source, scope, and magnitude of any incident. (Section 4.6: No Analysis of Process Data to Identify Source of Leak)  Training emergency response team members to (1) physically designate the hot zone; (2) communicate the location of the hot zone and entry control points to all personnel assisting with the emergency response, including operations personnel; and (3) control entry and exit points of the hot zone. (Section 4.7: Inadequate Control of Hot Zone)  Addressing in the emergency response plan how to characterize (including size, concentration, location, and direction of release) hazardous chemical releases and providing guidance on how and where people should take protective action (e.g., sheltering-in-place) in the event of a chemical release. (Section 4.8.1: Release Modeling)  Developing a procedure in the emergency response plan to effectively monitor for hazardous gases along the fence line at chemical facilities during the release to help workers understand and clearly communicate the extent of a release. (Section 4.8.4: Air Monitoring) In addition, provide a copy of the emergency response plan to the Emergency Response Team and their local union representatives. Page 130 FINAL COPY  Toxic Chemical Release at the DuPont La Porte Chemical Facility U.S. Chemical Safety and Hazard Investigation Board La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX  LOCAL 900C OF THE INTERNATIONAL CHEMICAL WORKERS UNION COUNCIL (ICWUC)  OF THE UNITED FOOD AND COMMERCIAL WORKERS (UFCW) a   2015-01-I-TX-R9 Work together with DuPont to develop and implement the emergency response plan described in Recommendation R8 (2015-01-I-TX-R8).   a The union members at the DuPont La Porte facility were represented by the (ICWUC) of the (UFCW) and Local 900C. Page 131 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX REFERENCES  [1] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "DuPont La Porte, Texas Chemical Facility Toxic Chemical Release: Interim Recommendations," 30 September 2015. [Online]. Available: https://www.csb.gov/assets/1/20/dupont_la_porte_interim_recommendations_2015-09-30_final1.pdf?15526. [2] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "DuPont LaPorte Facility Toxic Chemical Release," [Online]. Available: http://www.csb.gov/dupont-laporte-facility-toxic-chemical-release-/. [3] U.S. Environmental Protection Agency (USEPA), "List of Regulated Substances under the Risk Management Plan (RMP) Program," [Online]. Available: https://www.epa.gov/rmp/list-regulatedsubstances-under-risk-management-plan-rmp-program. [Accessed 2017 August 28]. [4] K. Baker, "DuPont Closing Texas Plant Where 4 Died," The News Journal, 1 April 2016. [Online]. Available: https://www.usatoday.com/story/money/2016/04/01/dupont-closing-texas-plant-where-4died/82512270/. [Accessed 29 June 2017]. [5] DuPont, "Form 8-K," 31 March 2016. [Online]. Available: https://www.sec.gov/Archives/edgar/data/30554/000003055416000115/dd33116form8-k.htm. [6] Center for Chemical Process Safety (CCPS), Continuous Monitoring for Hazardous Material Releases, CCPS/AIChE, 2009. [7] DuPont, "EPA RMP Submission for EPA Facility ID: 100000148912 La Porte Plant," 2012. [8] Center for Chemical Process Safety (CCPS), Guidelines for Technical Planning for On-Site Emergencies, 1995. [9] National Fire Protection Association (NFPA), "NFPA 1911: Standard for the Inspection, Maintenance, Testing, and Retirement of In-Service Emergency Vehicles," 2017. [Online]. Available: http://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-andstandards/detail?code=1911. [10] National Fire Protection Association (NFPA), "NFPA 472: Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents," 2018. [Online]. Available: http://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-andstandards/detail?code=472. [Accessed 26 12 2017]. Page 132 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [11] National Fire Protectioon Association (NFPA), "NFPA 1620: Standard for Pre-Incident Planning," 2015. [Online]. Available: http://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-andstandards/detail?code=1620. [Accessed 29 December 2017]. [12] U.S. Department of Transportation (USDOT), "2016 Emergency Response Guidebook," 2016. [Online]. Available: https://www.phmsa.dot.gov/sites/phmsa.dot.gov/files/docs/ERG2016.pdf. [13] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "OSHABrief - Hazard Communication Standard: Safety Data Sheets," [Online]. Available: https://www.osha.gov/Publications/OSHA3514.html. [Accessed 10 Jan 2018]. [14] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "DuPont Corporation Toxic Chemical Releases," [Online]. Available: http://www.csb.gov/dupont-corporation-toxic-chemical-releases/. [15] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "E.I. DuPont De Nemours Co. Fatal Hotwork Explosion," [Online]. Available: https://www.csb.gov/e-i-dupont-de-nemours-co-fatal-hotworkexplosion/. [16] Center for Chemical Process Safety (CCPS), "Process Safety Glossary - Process Safety Management Systems," [Online]. Available: https://www.aiche.org/ccps/resources/glossary/process-safetyglossary/process-safety-management-systems. [Accessed 29 May 2019]. [17] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "OSHA Celebrates 40 years of accomplishments in the Workplace," 2011. [Online]. Available: https://www.osha.gov/osha40/OSHATimeline.pdf. [Accessed 25 September 2018]. [18] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "OSHA 3132: Process Safety Management," 2000. [Online]. Available: https://www.osha.gov/Publications/osha3132.html. [Accessed 29 March 2018]. [19] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Process Safety Management Guidelines for Compliance," 1993. [Online]. Available: https://www.osha.gov/Publications/osha3133.html. [Accessed 31 August 2017]. [20] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Inspection: 310260567 - Dupont Packaging & Industrial Polymers," [Online]. Available: https://www.osha.gov/pls/imis/establishment.inspection_detail?id=310260567. [Accessed 18 March 2019]. [21] K. Moran, "DuPont plant in La Porte releases acidic compound," 26 January 2007. [Online]. Available: https://www.chron.com/news/houston-texas/article/DuPont-plant-in-La-Porte-releases-acidic-compound1805747.php. [Accessed 18 March 2019]. Page 133 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [22] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Deaths of four workers prompts deeper look at DuPont Safety Practices," 9 July 2015. [Online]. Available: https://www.osha.gov/news/newsreleases/region6/07092015. [Accessed 25 September 2018]. [23] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Preamble to Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting Agents.," 24 February 1992. [Online]. Available: https://www.osha.gov/laws-regs/federalregister/1992-02-24. [Accessed 29 May 2019]. [24] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Regulatory Report: Chevron Richmond Refinery Pipe Rupture and Fire," 10 2014. [Online]. Available: https://www.csb.gov/chevron-refinery-fire/. [Accessed 29 10 2018]. [25] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Drilling Rig Explosion and Fire at the Macondo Well Report: Volume 4," 17 April 2016. [Online]. Available: https://www.csb.gov/macondoblowout-and-explosion/. [Accessed 20 November 2018]. [26] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Process Safety Management for the 21st Century," [Online]. Available: https://www.csb.gov/recommendations/most-wanted-program-modernize-usprocess-safety-management-regulations/. [Accessed 25 September 2018]. [27] U.S. Environmental Protection Agency (USEPA), "The Origins of EPA," [Online]. Available: https://www.epa.gov/history/origins-epa. [Accessed 3 October 2018]. [28] U.S. Environmental Protection Agency (USEPA), "General Guidance on Risk Management Program for Chemical Accident Prevention (40 CFR Part 68): Chapter 9," March 2009. [Online]. Available: https://www.epa.gov/sites/production/files/2013-11/documents/chap-09-final.pdf. [Accessed 12 October 2018]. [29] U.S. Environmental Protection Agency (USEPA), "Risk Management Plan (RMP) Rule Overview," [Online]. Available: https://www.epa.gov/rmp/risk-management-plan-rmp-rule-overview. [Accessed 3 October 2018]. [30] U.S. Environmental Protection Agency (USEPA), "EPA and Justice Department Reach $3.1 Million Settlement with DuPont for Alleged Chemical Accident Prevention Violations," 26 July 2018. [Online]. Available: https://www.epa.gov/newsreleases/epa-and-justice-department-reach-31-million-settlementdupont-alleged-chemical-accident. [Accessed 14 November 2018]. [31] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "U.S. Chemical Safety and Hazard Investigation Board’s (CSB’s) response to the EPA’s July 31, 2014 Request for Information (at 79 Fed. Reg. 44604) on potential revisions to its Risk Management Program regulations and program," 29 October 2014. [Online]. Available: https://www.csb.gov/assets/1/6/epa_rfi2.pdf. [Accessed 3 October 2018]. Page 134 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [32] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "CSB’s response to the EPA’s March 14, 2016 Proposed Rule, “Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 112(r)(7)” (Docket No. EPA-HQ-QEM-2015-0725)," 10 May 2016. [Online]. Available: https://www.csb.gov/assets/1/6/csb_comments_epa-hq-oem-2015-0725_51020161.pdf. [Accessed 3 October 2018]. [33] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Drivers of Critical Chemical Safety Change," [Online]. Available: https://www.csb.gov/recommendations/mostwanted/. [Accessed 29 June 2017]. [34] U.S. Environmental Protection Agency (USEPA), "Risk Management Plan (RMP) Delay Rule Vacatur," [Online]. Available: https://www.epa.gov/rmp/risk-management-plan-rmp-delay-rule-vacatur. [Accessed 15 October 2018]. [35] U.S. Environmental Protection Agency (USEPA), "Proposed Risk Management Program (RMP) Reconsideration Rule," [Online]. Available: https://www.epa.gov/rmp/proposed-risk-management-programrmp-reconsideration-rule. [Accessed 26 February 2019]. [36] Chemtrec, "History," [Online]. Available: https://www.chemtrec.com/about-chemtrec/who-we-are/history. [Accessed 3 October 2018]. [37] American Chemistry Council, "About the American Chemistry Council," [Online]. Available: https://www.americanchemistry.com/About/. [Accessed 2 November 2017]. [38] American Chemistry Council, "Responsible Care Program Elements," [Online]. Available: https://responsiblecare.americanchemistry.com/ResponsibleCare/Responsible-Care-Program-Elements.aspx. [Accessed 06 Oct 2017]. [39] Chemistry Industry Association of Canada, "A Brief History of Responsible Care," [Online]. Available: https://web.archive.org/web/20180610195147/http://www.canadianchemistry.ca/responsible_care/index.php/ en/responsible-care-history. [Accessed 10 Oct 2017]. [40] American Chemistry Council, "30 Years Responsible Care: Milestones and Achievements," 2018. [Online]. Available: https://responsiblecare.americanchemistry.com/rc/media/30-Years-Responsible-Care-MilestonesAchievements.pdf. [41] American Chemistry Council, "Responsible Care Management System: Technical Specification," 1 May 2013. [Online]. Available: https://responsiblecare.americanchemistry.com/Responsible-Care-ProgramElements/Management-System-and-Certification/RCMS-Technical-Specifications.pdf. [42] American Chemistry Council, "Responsible Care Third-Party Audit Requirement Requirements for ACC Members and Responsible Care Partners," October 2017. [Online]. Available: Page 135 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX https://responsiblecare.americanchemistry.com/Program-Elements/Management-System-andCertification/RC501.pdf. [Accessed 29 March 2018]. [43] American Chemistry Council , "Responsible Care Guiding Principles," [Online]. Available: https://responsiblecare.americanchemistry.com/Responsible-Care-Program-Elements/GuidingPrinciples/PDF-Responsible-Care-Guiding-Principles.pdf. [Accessed 2 March 2018]. [44] Amercian Chemistry Council, "Responsible Care Process Safety Code of Management Practices," 9 November 2012. [Online]. Available: https://responsiblecare.americanchemistry.com/Responsible-CareProgram-Elements/Process-Safety-Code/Responsible-Care-Process-Safety-Code-PDF.pdf. [Accessed 26 March 2018]. [45] American Chemistry Council and National Association of Chemical Distributors, "A Comparison of ACC Responsible Care and NACD Responsible Distribution Initiatives," 2015. [Online]. Available: https://www.nacd.com/pub/?id=35145BAD-93AE-F152-9978-FD6AE231C5F8. [Accessed 27 May 2019]. [46] American Chemistry Council, "Accountability & Impacts," [Online]. Available: https://responsiblecare.americanchemistry.com/AccountabilityandImpacts.html. [Accessed 20 November 2018]. [47] American Chemistry Council, "Process Safety Code," [Online]. Available: https://responsiblecare.americanchemistry.com/Process-Safety-Code/. [Accessed 30 May 2019]. [48] American Chemistry Council, "American Chemistry Council Letter to Center for Effective Government," 16 October 2015. [Online]. Available: https://www.foreffectivegov.org/sites/default/files/blowing-smoke/accresponse.pdf. [Accessed 10 December 2017]. [49] American Petroleum Institute (API), API Recommended Practice 754 - Process Safety Indicators for the Refining and Petrochemical Industries, 2016. [50] Centers for Disease Control and Prevention, "NIOSH Pocket Guide to Chemical Hazards: Methyl mercaptan," 11 April 2016. [Online]. Available: https://www.cdc.gov/niosh/npg/npgd0425.html. [Accessed 29 June 2017]. [51] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Methyl Mercaptan," [Online]. Available: https://www.osha.gov/chemicaldata/chemResult.html?recNo=560. [Accessed 2 March 2018]. [52] Center for Chemical Process Safety (CCPS), Guidelines for Risk Based Process Safety, Hoboken, NJ: Wiley, 2007. Page 136 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [53] J. A. Klein, "Two Centuries of Process Safety at DuPont," Process Safety Progress, vol. 28, no. 2, pp. 114122, June 2009. [54] DuPont Sustainable Solutions, "Quick 4-Step Review of Process Safety Management," [Online]. Available: http://www2.dupont.com/DuPont_Sustainable_Solutions/en_US/assets/downloads/Quick_4Step_Review_Sheet.pdf. [Accessed 25 September 2018]. [55] DuPont Sustainable Solutions, "Developing a Robust PSM Framework at DuPont," February 2013. [Online]. Available: http://ips.se/files/pages/59/ips-david-guss-dupont-februari-2013.pdf. [Accessed 7 September 2018]. [56] Center for Chemical Process Safety (CCPS), Essential Practices for Creating, Strengthening, and Sustaining Process Safety Culture, Hoboken, NJ: John Wiley & Sons, Inc., 2018. [57] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "CSB Urgent Recommendation BP Global Executive Board of Directors," 17 August 2005. [Online]. Available: https://www.csb.gov/assets/1/20/bp_recs.pdf?13851. [58] Baker Panel, "The Report of The BP U.S. Refineries Independent Safety Review Panel," January 2007. [Online]. Available: https://www.csb.gov/assets/1/20/baker_panel_report1.pdf?13842. [Accessed 27 December 2017]. [59] DuPont, "Relative Culture Strength: A Key to Sustainable World-Class Safety Performance," 2011. [Online]. Available: http://www.dupont.com/content/dam/dupont/products-and-services/consulting-servicesand-process-technologies/consulting-services-and-process-technologieslanding/documents/Sustainable_World-Class_Safety_Performance.pdf. [60] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Investigation Report: Refinery Explosion and Fire: BP, Texas City, March 23, 2005," March 2007. [Online]. Available: https://www.csb.gov/bpamerica-refinery-explosion/. [Accessed 27 December 2017]. [61] U.S. Chemical Safety and Hazard Identification Board (USCSB), "Investigation Report Volume 3: Drilling Rig Explosion and Fire at the Macondo Well," 17 April 2016. [Online]. Available: https://www.csb.gov/macondo-blowout-and-explosion/. [Accessed 29 May 2019]. [62] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Tesoro Martinez Refinery: Process Safety Culture Case Study: Martinez, California: February 12, 2014 and March 10, 2014 Sulfuric Acid Release Incidents," 2016. [Online]. Available: https://www.csb.gov/assets/1/20/tesoro_martinez_final_case_study1.pdf?15674. [Accessed 19 February 2017]. Page 137 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [63] Center for Chemical Process Safety (CCPS), Conduct of Operations and Operational Discipline-For Improving Process Safety in Industry, Hoboken, New Jersey: CCPS/John Wiley & Sons, Inc., 2011. [64] D. A. Wiegmann, H. Zhang, T. L. von Thaden, G. Sharma and A. M. Gibbons, "Safety Culture: An Integrative Review," The International Journal of Aviation Psychology, vol. 14, no. 2, pp. 117-134, 2004. [65] Contra Costa Health Services, "Industrial Safety Ordinance Guidance Document, Section F-Safety Culture Assessments," 15 June 2011. [Online]. Available: http://cchealth.org/hazmat/pdf/iso/section_f.pdf. [Accessed 11 01 2018]. [66] Center for Chemical Process Safety (CCPS), Guidelines for Auditing Process Safety Management Systems, New York, New York: Wiley, 2011. [67] A. Hopkins, "Why Safety Cultures Don't Work," [Online]. Available: http://www.futuremedia.com.au/docs/Why_Safety_Cultures_Don't_Work.pdf. [Accessed 26 September 2018]. [68] DuPont, "DuPont Process Safety Management," [Online]. Available: http://www2.dupont.com/DuPont_Safety_Resources/en_SG/assets/downloads/PSM%20Brochure.pdf. [Accessed 26 September 2018]. [69] J. A. Klein, "A Revised Program for Operational Discipline," Process Safety Progress, vol. 27, no. 1, pp. 5865, March 2008. [70] Center for Chemical Process Safety (CCPS), Guidelines for Auditing Process Safety Management Systems, Hoboken: Wiley, 2011. [71] U.S. Chemical Safety and Hazard Identifcation Board (USCSB), "Williams Geismar Olefins Plant: Reboiler Rupture and Fire: Geismar, Louisiana," 2013. [Online]. Available: https://www.csb.gov/williams-olefinsplant-explosion-and-fire-/. [Accessed 29 May 2019]. [72] A. H. a. R. D. Mohammadi, "Equilibrium Data of Sulfur Dioxide and Methyl Mercaptan Clathrate Hydrates," Journal of Chemical & Engineering Data, vol. 56, pp. 1666-1668, 2011. [73] Georgia Tech Applied Research Corporation, "Process Safety Management of Highly Hazardous & Explosive Chemicals Module 4: PSM Standard Operating Procedures," [Online]. Available: https://www.osha.gov/harwoodgrants/grantmaterials/fy2008/sh-17811-08. [Accessed 29 5 2019]. [74] K. W. Morrison, "What's your reward? The debate over incentive programs," 1 April 2011. [Online]. Available: http://www.safetyandhealthmagazine.com/articles/5501-whats-your-reward. [Accessed 10 January 2018]. Page 138 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [75] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Employer Safety Incentive and Disincentive Policies and Practices," 12 March 2012. [Online]. Available: https://www.osha.gov/as/opa/whistleblowermemo.html. [Accessed 2015]. [76] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Clarification of OSHA’s Position on Workplace Safety Incentive Programs and Post-Incident Drug Testing Under 29 C.F.R. § 1904.35(b)(1)(iv)," 11 October 2018. [Online]. Available: https://www.osha.gov/lawsregs/standardinterpretations/2018-10-11. [Accessed 26 October 2018]. [77] DuPont Sustainable Solutions, "The DuPont Bradley Curve (video)," 5 November 2015. [Online]. Available: https://www.youtube.com/watch?v=tMoVi7vxkb0. [Accessed 17 November 2017]. [78] DuPont, "DuPont Bradley Curve," 2017. [Online]. Available: http://www.dupont.com/products-andservices/consulting-services-process-technologies/brands/sustainable-solutions/sub-brands/operational-riskmanagement/uses-and-applications/bradley-curve.html. [Accessed 17 November 2017]. [79] Center for Chemical Process Safety (CCPS), in RECOGNIZING CATASTROPHIC INCIDENT WARNING SIGNS IN THE PROCESS INDUSTRIES, Hoboken, New Jersey: Wiley, 2012. [80] Agency for Toxic Substances and Disease Registry (ATSDR), "Methyl Mercaptan," [Online]. Available: https://www.atsdr.cdc.gov/MHMI/mmg139.pdf. [Accessed 29 June 2017]. [81] Center for Chemical Process Safety (CCPS), Guidelines for Fire Protection in Chemical, Petrochemical, and Hydrocarbon Processing Facilities, New York, New York: American Institute of Chemical Engineers, 2003. [82] American Industrial Hygiene Association (AIHA), "Current ERPG Values," 2014. [Online]. Available: https://www.aiha.org/getinvolved/AIHAGuidelineFoundation/EmergencyResponsePlanningGuidelines/Documents/2014%20ERPG% 20Values.pdf. [83] DowDuPont, "About DowDuPont," 2017. [Online]. Available: http://www.dow-dupont.com/about-dowdupont/default.aspx. [Accessed 6 Oct 2017]. [84] RAE Systems by Honeywell, "Technical Note TN-156, Correction Factors for Combustible Gas (LEL) Sensors," [Online]. Available: http://www.raesystems.com/sites/default/files/content/resources/Technical%20Note%20156%20Correction %20Factors%20For%20Combustible%20Gas%20LEL%20Sensorsnr%2002%2016.pdf. [Accessed 06 Oct 2017]. [85] I. Sutton, Plant Design and Operations, 2nd ed., Cambridge, MA: Gulf Professional Publishing, 2017. Page 139 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [86] F. Cavender, S. Phillips and M. Holland, "Development of Emergency Response Planning Guidelines (ERPGs)," Journal of Medical Toxicology, vol. 4, no. 2, pp. 127-131, June 2008. [87] American Chemistry Council, "ACC Responsible Care Management System and Certification Overview," 18 March 2003. [Online]. Available: https://texasiof.ceer.utexas.edu/texasshowcase/pdfs/presentations/b5/bstutts.pdf. [Accessed 10 Oct 2017]. [88] International Council of Chemical Associations, "2015 Responsible Care Status Report," [Online]. Available: https://www.icca-chem.org/wp-content/uploads/2015/09/2015-Responsible-Care-StatusReport.pdf. [Accessed 2 November 2017]. [89] International Council of Chemical Associations, "Responsible Care: The Quest for Performance Excellence," [Online]. Available: https://www.icca-chem.org/responsible-care/. [90] M. Speegle, Safety, Health, and Environmental Concepts for the Process Industry, 2nd ed., New York: Delmar, 2013, p. 58. [91] W. L. Frank, "Process safety culture in the CCPS risk based process safety model," Process Safety Progress, vol. 26, no. 3, pp. 203-208, September 2007. [92] American Chemistry Council, "Responsible Care Third-Party Audit Requirement," 10 2017. [Online]. Available: https://responsiblecare.americanchemistry.com/Program-Elements/Management-System-andCertification/RC501.pdf. [Accessed 6 12 2017]. [93] CCOHS, "Methylene Chloride," 3 January 2017. [Online]. Available: http://www.ccohs.ca/oshanswers/chemicals/chem_profiles/methylene.html. [Accessed 9 December 2017]. [94] DuPont, "DuPont Lannate SP Insecticide," 14 1 2016. [Online]. Available: http://www.dupont.ca/content/dam/dupont/tools-tactics/crop/canada-label-msds/documents/cp_PSD68_Lannate_130000000505_20160114_MSDS_E.pdf. [Accessed 14 12 2017]. [95] U.S. National Library of Medicine, "Haz-Map Methyl Mercaptan," [Online]. Available: https://hazmap.nlm.nih.gov/category-details?id=192&table=copytblagents. [Accessed 14 12 2017]. [96] P. Hasenmeier, "The History of Firefighter Personal Protective Equipment," Fire Engineering , 6 6 2008. [Online]. Available: http://www.fireengineering.com/articles/2008/06/the-history-of-firefighter-personalprotective-equipment.html. [Accessed 14 12 2017]. [97] The Pro Board, "The Pro Board," [Online]. Available: http://www.theproboard.org/. [Accessed 15 12 2017]. [98] National Fire Protection Association (NFPA), "NFPA 1911: Standard for the Inspection, Maintenance, Testing, and Retirement of In-Service Emergency Vehicles," 2012. [Online]. Available: Page 140 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX http://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-andstandards/detail?code=1911&year=2012. [Accessed 28 December 2017]. [99] SAFER Systems, "SAFER Trace," [Online]. Available: https://www.safersystem.com/products/safer-trace/. [Accessed 29 December 2017]. [100] Weather Underground, "Ellington Field, TX," [Online]. Available: https://www.wunderground.com/history/airport/KEFD/2018/1/8/DailyHistory.html?cm_ven=localwx_histor y. [Accessed 08 01 2018]. [101] American Society of Mechanical Engineers (ASME), Boiler & Pressure Vessel Code, VIII Rules for Construction of Pressure Vessels, Division 1, 2013. [102] American Petroleum Institute (API), API 521 - Pressure-relieving and Depressuring Systems, 6th ed., 2014. [103] National Fire Protection Association (NFPA), "NFPA 600: Standard on Facility Fire Brigades," 2015. [Online]. Available: http://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-andstandards/detail?code=600. [Accessed 29 December 2017]. [104] American Chemistry Council, "Safety," [Online]. Available: https://responsiblecare.americanchemistry.com/ResponsibleCare/Performance-Results/Safety/. [Accessed 29 March 2018]. [105] Dow, "DowDuPont Merger Successfully Completed," 1 September 2017. [Online]. Available: https://www.dow.com/en-us/news/press-releases/dowdupont-merger-successfully-completed. [Accessed 4 April 2018]. [106] National Fire Protection Association (NFPA), "NFPA 1: Fire Code," 2018. [Online]. Available: https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codes-andstandards/detail?code=1. [Accessed 12 April 2018]. [107] DuPont, "DuPont Completes Spin-off of The Chemours Company," 1 July 2015. [Online]. Available: http://www.dupont.com/corporate-functions/media-center/press-releases/dupont-completes-spin-off-of-thechemours-company.html. [Accessed 1 May 2018]. [108] Chemours, "Creating Higher Value Chemistry: The Chemours Company 2015 Annual Report," [Online]. Available: https://s21.q4cdn.com/411213655/files/doc_financials/annual_reports/Chemours-2015-AnnualReport.pdf. [Accessed 1 May 2018]. [109] Center for Chemical Process Safety (CCPS), Inherently Safer Chemical Processes - A Life Cycle Approach, 2nd ed., New York: John Wiley & Sons, Inc., 2009. Page 141 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [110] Center for Chemical Process Safety (CCPS), "Emergency Relief Device," [Online]. Available: https://www.aiche.org/ccps/resources/glossary/process-safety-glossary/emergency-relief-device. [Accessed 7 May 2018]. [111] Eastman Chemical Company, "An Overview of Pressure Relief Devices," 16 September 2014. [Online]. Available: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=5&ved=0ahUKEwj1q5yO9fXaAhU C_4MKHesZAFcQFghVMAQ&url=https%3A%2F%2Fwww.aiche.org%2Fsites%2Fdefault%2Ffiles%2Fco mmunity%2F160956%2Faiche-community-site-files%2F198496%2Faichemeeting9162014.pptx&us. [112] S. S. Murnane, A. H. Lehocky and P. D. Owens, Odor Thresholds for Chemicals with Established Occupational Health Standards, 2nd ed., Falls Church, Virginia: American Industrial Hygiene Association (AIHA), 2013. [113] Chemical Processing, "DuPont Sustainable Solutions Celebrates 50th With Global Panel Series," 13 April 2018. [Online]. Available: https://www.chemicalprocessing.com/industrynews/2018/dupont-sustainablesolutions-celebrates-50th-with-global-panel-series-2/. [Accessed 6 September 2018]. [114] DuPont Sustainable Solutions, "DuPont Sustainable Solutions," [Online]. Available: http://www.dupont.com/products-and-services/consulting-services-process-technologies/brands/aboutus.html. [Accessed 6 September 2018]. [115] National Safety Council, "Robert W. Campbell Award," [Online]. Available: https://www.campbellaward.org/winners/. [Accessed 6 September 2018]. [116] DuPont Sustainable Solutions , "Felt Leadership Workshop," [Online]. Available: https://www.training.dupont.com/safety-workshops/felt-leadership. [Accessed 18 September 2018]. [117] DuPont Sustainable Solutions, "DuPont Sustainable Solutions Can Help Create Lasting Improvements to Your Process Safety Management Systems," [Online]. Available: http://www2.dupont.com/Sustainable_Solutions/en_US/assets/downloads/psm_infographic/PSMOverview_ SustainableImprovements.pdf. [Accessed 26 September 2018]. [118] DuPont Sustainable Solutions, "Developing a Robust PSM Framework at DuPont," February 2013. [Online]. Available: http://ips.se/files/pages/59/ips-david-guss-dupont-februari-2013.pdf. [Accessed 26 September 2018]. [119] ICIS, "US CMA Changing Name to American Chemistry Council," 09 Jun 2000. [Online]. Available: https://www.icis.com/resources/news/2000/06/09/114009/us-cma-changing-name-to-american-chemistrycouncil/. [Accessed 30 June 2017]. Page 142 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [120] Code Red Safety, "High Angle Resccue," [Online]. Available: https://coderedsafety.com/rescueservices/high-angle-rescue/. [Accessed 4 October 2018]. [121] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Investigation Report: E.I. DuPont DE Nemours & Co. Inc.: Belle, West Virginia," September 2011. [Online]. Available: https://www.csb.gov/assets/1/20/csb%20final%20report.pdf?13966. [122] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Case Study: E.I. DuPont de Nemours & Co Inc.: Buffalo, New York," [Online]. Available: https://www.csb.gov/e-i-dupont-de-nemours-co-fatalhotwork-explosion/. [123] RAE Systems, "MultiRAE," [Online]. Available: https://www.raesystems.com/products/multirae. [Accessed 23 October 2018]. [124] RAE Systems, "QRAE 3," [Online]. Available: http://www.raesystems.com/products/qrae-3. [Accessed 15 12 2017]. [125] Drager, "Drager-Tubes & accuro-Pump," [Online]. Available: https://www.draeger.com/Products/Content/tubes-accuro-pump-pi-us.pdf. [Accessed 06 Oct 2017]. [126] American Chemistry Council, "www.regulations.gov," 13 May 2016. [Online]. Available: https://www.regulations.gov/document?D=EPA-HQ-OEM-2015-0725-0537. [Accessed 4 December 2017]. [127] American Chemistry Council, "Safety," [Online]. Available: https://responsiblecare.americanchemistry.com/ResponsibleCare/Performance-Results/Safety/. [Accessed 29 10 2018]. [128] American Chemistry Council, "Security Code," [Online]. Available: https://responsiblecare.americanchemistry.com/Security-Code/. [Accessed 6 November 2018]. [129] American Chemistry Council, "Product Safety Code," [Online]. Available: https://responsiblecare.americanchemistry.com/Product-Safety-Code/. [Accessed 6 November 2018]. [130] National Center for Biotechnology Information, "Acute Exposure Guideline Levels for Selected Airborne Chemicals: Volume 15: 2. Methyl Mercaptan Acute Exposure Guideline Levels," [Online]. Available: https://www.ncbi.nlm.nih.gov/books/NBK201324/. [Accessed 14 November 2018]. [131] I. Sutton, Plant Design and Operations, Ashland: Elsevier, 2017. [132] USFEMA, "National Incident Management System," [Online]. Available: https://www.fema.gov/nationalincident-management-system. [Accessed 21 February 2019]. Page 143 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [133] Oxford Dictionary, "Oleum," [Online]. Available: https://en.oxforddictionaries.com/definition/oleum. [Accessed 18 March 2019]. [134] DowDuPont, "DowDuPont," [Online]. Available: http://www.dow-dupont.com/home/default.aspx. [Accessed 26 April 2019]. [135] M. P. Bailey, "DuPont's Sustainable Solutions Business to Become Independent Consulting Firm," Chemical Engineering Essentials for the CPI Professional, 19 February 2019. [Online]. Available: https://www.chemengonline.com/duponts-sustainable-solutions-business-to-become-independentconsulting-firm/. [Accessed 26 April 2019]. [136] National Fire Protection Association (NFPA), "NFPA 497: Recommended Practice for the Classification of Flammable Liquids, Gases, or Vapors and of Hazardous (Classified) Locations for Electrical Installations in Chemical Process Areas," 2017. [Online]. Available: https://www.nfpa.org/codes-and-standards/all-codesand-standards/list-of-codes-and-standards/detail?code=497. [Accessed 29 May 2019]. [137] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Docket No. EPA-HQ-OEM-2015-0725, Accidental Release Prevention," 20 July 2018. [Online]. Available: https://www.csb.gov/assets/1/6/csb_comments_epa_rmp_20180720.pdf. [Accessed 17 October 2018]. [138] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Board Order 22: Recommendations Program," [Online]. Available: https://www.csb.gov/assets/record/csb_board_order_022_final_20161.pdf. [139] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Board Order 40: Investigation Program," [Online]. Available: https://www.csb.gov/assets/record/board_order_040_approved_2_14_17.pdf. [140] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "BP American Refinery Explosion," [Online]. Available: https://www.csb.gov/bp-america-refinery-explosion/. [Accessed 15 May 2018]. [141] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "CSB Letter to EPA: Re: Docket Number EPA-HQ-OAR-2010-0682," 28 October 2014. [Online]. Available: http://www.csb.gov/assets/1/7/EPA_Proposed_Rule_(Refineries)_10-28-2014.pdf. [142] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "CSB Letter to PHMSA: Attention: Docket No. PHMSA-2014-0099; Notice No. 14-11," 3 October 2014. [Online]. Available: https://www.csb.gov/assets/1/6/dot_erg__rfi10_1_1411.pdf. [Accessed 23 October 2018]. [143] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Docket No. EPA-HQ-OEM-2015-0725, Accidental Release Prevention Requirements: Risk Management Programs Unde the Clean Air Action, Section 112(r)(7)," 10 May 2016. [Online]. Available: https://www.csb.gov/assets/1/6/csb_comments_epahq-oem-2015-0725_51020161.pdf. [Accessed 17 October 2018]. Page 144 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [144] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Final Investigation Report: E.I. DuPont de Nemours & Co., Inc. Belle, West Virginia," September 2011. [Online]. Available: https://www.csb.gov/assets/1/20/csb%20final%20report.pdf?13966. [Accessed 7 October 2018]. [145] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Investigation Report Volume 3: Drilling Rig Explosion and Fire at the Macondo Well," 17 April 2016. [Online]. Available: https://www.csb.gov/macondo-blowout-and-explosion/. [Accessed 27 March 2018]. [146] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Investigation Report: Explosion and Fire: First Chemical Corporation," October 2003. [Online]. Available: https://www.csb.gov/assets/1/20/first_report.pdf?13794. [147] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Recommendations Status Change Summary: 2010-6-I-WV-R14," 10 April 2013. [Online]. Available: https://www.csb.gov/assets/recommendation/status_change_summary_dupont_corporate_r14.pdf. [Accessed 10 October 2018]. [148] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Reflections on Bhopal after Thirty Year," 1 December 2014. [Online]. Available: http://www.csb.gov/videos/reflections-on-bhopal-after-thirty-years/. [Accessed 2 November 2017]. [149] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Permissible Exposure Limits – Annotated Tables," [Online]. Available: https://www.osha.gov/dsg/annotated-pels/. [Accessed 9 May 2018]. [150] Center for Chemical Process Safety (CCPS), "CCPS Process Safety Glossary- Safe Work Practices," [Online]. Available: https://www.aiche.org/ccps/resources/glossary/process-safety-glossary/safe-workpractices. [Accessed 1 February 2017]. [151] U.S. Environmental Protection Agency (USEPA), "Chapter 8: Emergency Response Program," [Online]. Available: https://www.epa.gov/rmp/general-rmp-guidance-chapter-8-emergency-response-program. [Accessed 14 May 2018]. [152] U.S. Environmental Protection Agency (USEPA), "General Guidance on Risk Management Programs for Chemical Accident Prevention (40 CFR Part 68): Chapter 2: Applicability of Program Levels," [Online]. Available: https://www.epa.gov/sites/production/files/2013-10/documents/chap-02-final.pdf. [Accessed 3 October 2018]. [153] U.S. Environmental Protection Agency (USEPA), "Petroleum Refinery Fenceline Monitoring Stakeholder Engagement Webinar," 22 6 2016. [Online]. Available: https://www.epa.gov/sites/production/files/201606/documents/state_local_tribal_webinar_june_2016.pdf. [Accessed 19 12 2017]. Page 145 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [154] U.S. Environmental Protection Agency (USEPA), "Petroleum Refinery Sector Risk and Technology Review and New Source Performance Standards (NSPS)," [Online]. Available: https://www.epa.gov/stationarysources-air-pollution/petroleum-refinery-sector-risk-and-technology-review-and-new-source. [Accessed 19 12 2017]. [155] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Citation and Notification of Penalty- Inspection Number: 1019650," 9 July 2015. [Online]. Available: https://www.osha.gov/ooc/citations/EIDuPontDeNemoursCo_1019650.pdf. [Accessed 21 February 2019]. [156] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Hazard Communication 2012 - The Revised Standard and What Changes You Can Expect in the Workplace," 13 8 2012. [Online]. Available: https://www.osha.gov/dsg/hazcom/schc_alliance_webinar_20120809/schc_alliance_webinar_20120809.pptx . [Accessed 19 12 2017]. [157] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Inspection Detail: 1019650.015," [Online]. Available: https://www.osha.gov/pls/imis/establishment.inspection_detail?id=1019650.015. [Accessed 21 February 2019]. [158] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Interpretation of 1904.35(b)(1)(i) and (iv)," 19 October 2016. [Online]. Available: https://www.osha.gov/recordkeeping/finalrule/interp_recordkeeping_101816.html. [Accessed 1 December 2017]. [159] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "OSHA Annotated Table Z-1," [Online]. Available: https://www.osha.gov/dsg/annotated-pels/tablez-1.html. [Accessed 9 May 2018]. [160] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "OSHA News Release - Region 6," 9 July 2015. [Online]. Available: https://www.osha.gov/news/newsreleases/region6/07092015. [Accessed 29 June 2017]. [161] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "OSHA: Inspection Detail 1008319.015," [Online]. Available: https://www.osha.gov/pls/imis/establishment.inspection_detail?id=1008319.015. [Accessed 21 February 2019]. [162] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Permissible Exposure Limits - Annotated Tables," [Online]. Available: https://www.osha.gov/dsg/annotated-pels/. [Accessed 27 December 2017]. Page 146 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX [163] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Permissible Exposure Limits / OSHA Annotated Table Z-1," 2017. [Online]. Available: https://www.osha.gov/dsg/annotated-pels/tablez-1.html. [Accessed 27 December 2017]. [164] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "Proper protections could have saved four DuPont workers killed by gas," 14 May 2015. [Online]. Available: https://www.osha.gov/news/newsreleases/region6/05142015. [Accessed 21 February 2019]. [165] U.S. Federal Emergency Management Agency (USFEMA), "Risk-Based A Principal in Emergency Management," [Online]. Available: https://training.fema.gov/hiedu/docs/principlesofem/principles%20of%20em%20-%20session%205%20%20risk-based.ppt. [Accessed 9 May 2018]. [166] U.S. Department of Labor (USDOL) Occupational Safety and Health Administration (OSHA), "The Whistleblower Protection Programs," [Online]. Available: https://www.whistleblowers.gov/. [Accessed 12 April 2019]. [167] National Oceanic Atmospheric Association (NOAA), "Office of Response and Restoration: Emergency Response Planning Guidelines (ERPGs)," 29 June 2017. [Online]. Available: http://response.restoration.noaa.gov/oil-and-chemical-spills/chemical-spills/resources/emergency-responseplanning-guidelines-erpgs.html. [168] U.S. Chemical Safety and Hazard Investigation Board (USCSB), "Safety Bulletin - Hazards of Nitrogen Asphyxiation," 6 2003. [Online]. Available: https://www.csb.gov/hazards-of-nitrogen-asphyxiation/. [Accessed 8 12 2017]. [169] Kuraray, "Corporate Overview," [Online]. Available: https://www.kuraray.com/company/overview. [Accessed 29 May 2019]. [170] American Chemistry Council, "Responsible Care: About," [Online]. Available: https://www.americanchemistry.com/Membership/MemberCompanies/. [Accessed 29 May 2019]. [171] U.S. Department of Labor Bureau of Labor Statistics, "Appendix C, Bulletin 2424: Occupational Injuries and Illnesses in the United States by Industry, 1991," May 1993. [Online]. Available: https://books.google.com/books?id=msRH9BUNUP0C&pg=PA75&lpg=PA75&dq=%22Incidence+rates+ca n+be+used+to+show+the+relative+level+of+injuries+and+illnesses+among+different+industries%22&sourc e=bl&ots=nnEiD8ko8E&sig=3rCxnPVa8dOykr8BAXCed4MKOs0&hl=en&sa=X&ved=0a. [Accessed 27 December 2017]. [172] National Fire Protection Association (NFPA), "NFPA 921: Guide for Fire & Explosion Investigations," 2017. [Online]. Available: https://www.nfpa.org/codes-and-standards/all-codes-and-standards/list-of-codesand-standards/detail?code=921. Page 147 FINAL COPY  Toxic Chemical Release at the DuPont La Porte Chemical Facility U.S. Chemical Safety and Hazard Investigation Board [173] La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX U.S. Chemical Safety and Hazard Identification Board (USCSB), "Safety Digest: Preparing Equipment and Instrumentation for Cold Weather Operations," September 2018. [Online]. Available: https://www.csb.gov/assets/1/6/csb_winterization_safety_digest.pdf. [Accessed 5 June 2019].   Page 148 FINAL COPY  Toxic Chemical Release at the DuPont La Porte Chemical Facility U.S. Chemical Safety and Hazard Investigation Board La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX APPENDIX A: CAUSAL ANALYSIS  The AcciMapa (size 11" x 17") can be found at www.csb.gov on the DuPont La Porte investigation page.   a An AcciMap is a multilayered causal diagram that arranges the various causes of an accident in terms of their remoteness from the initiating events. This approach differs from other analysis techniques in that it identifies causes in all parts of the system, ranging from the physical sequence of events right up to causes at the governmental, regulatory, and societal levels. It is a CSB internal investigation procedure that is especially useful for developing broadly applicable recommendations for prevention. Page 149 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX APPENDIX B: INCIDENT TIMELINE  Approximate Time Activity Wednesday, November 12, 2014 2:00–3:00 pm 3:00 pm Friday, November 14, 2014 10:00 am–3:02 am Investigation Note Operators attempt to restart the Lannate® process after a unit shutdown, but flow is not established because equipment is plugged. Operators begin troubleshooting the Lannate® process to try to clear the plugging. Methyl mercaptan is released outside and inside the manufacturing building while troubleshooting to clear the plugging continues. Detectors inside and outside the manufacturing building identify high levels of methyl mercaptan and trigger alarms 32 separate times. These alarms display only on the control panel (there are no building or exterior alarms). Operations personnel who are aware of the alarms and the troubleshooting do not perceive the leaks as posing a serious hazard (see Investigation Note below). Operations personnel likely normalized both the methyl mercaptan odor and the detector alarms. Personnel associated these methyl mercaptan leaks with the ongoing troubleshooting activities. Saturday, November 15, 2014 (Day of Incident) 2:51 am–2:54 am 2:58 am–3:03 am 3:01 am–3:13 am High pressure in equipment inside the manufacturing building triggers control system alarms. Operations personnel attribute the high pressure to a common long-standing problem with process condensate accumulating in the waste gas vent header piping. Unknown to the operations personnel, in this instance the high pressure is not caused by the typical process condensate accumulation. The high pressure is a symptom of a different problem: liquid methyl mercaptan flowing into the waste gas vent header piping, due to the piping alignment being used to clear the plugging during the troubleshooting efforts. Shift Supervisor and Operator 1 separately go to the third floor of the manufacturing building to try to reduce the equipment pressure. They plan to drain the equipment of what they believe is normal process condensate to reduce the high pressure—a longstanding practice used to reduce pressure in this equipment. Two drain valves on the waste gas vent header are manually opened on the third floor of the manufacturing building. Highly toxic and highly flammable liquid methyl mercaptan flows out of the valves, overcoming the Shift Supervisor. Page 150 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board 3:13 am 3:24 am–3:26 am 3:30 am 3:30 am 3:30 am – 3:40 am 3:30 am 3:30 am Investigation Note 3:30–3:35 am 3:30–3:35 am 3:30–3:35 am Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX The second-floor chlorine detector records a value of -1. This type of detector is known to go negative when sensing methyl mercaptan (-1 parts per million chlorine indication ≈ 33 parts per million methyl mercaptan). Three methyl mercaptan detectors inside the manufacturing building (two on the first floor and one on the fourth floor) sense at least 25 parts per million methyl mercaptan, triggering alarms at the control panel. The Board Operator may see these alarms but does not realize a chemical release has begun, likely associating the alarms with process troubleshooting. His focus is on mitigating the equipment high-pressure event. Operator 1, who is likely on third floor of manufacturing building, makes an urgent distress call over the radio for help. Personnel do not know where Operator 1 is located or the type of emergency she is experiencing. Some DuPont La Porte personnel who hear her distress call interpret the communication to mean that Operator 1 has a personal injury—such as a broken leg. Personnel in the control room do not yet realize there is a toxic chemical release. Control room operator tries to get more information through radio communication, but neither the Shift Supervisor nor Operator 1 responds. An operator (Operator 5) on the first floor of the manufacturing building is exposed to methyl mercaptan and experiences dizziness and blurry vision. He escapes from the manufacturing building, runs across the street, and lies down in the grass, where he starts to recover. Two operators (Operator 2 and Operator 3) in the control room run into the manufacturing building to respond to the distress call made by Operator 1. They do not realize they are responding to a serious toxic methyl mercaptan leak. They do not wear or take with them any respiratory protection. Operator 4, who is outside, sees Operator 2 and Operator 3 running into the manufacturing building and follows them. He also does not realize they are responding to a serious toxic methyl mercaptan leak. He does not wear or take with him any respiratory protection. No visual or audible alarms are installed inside the manufacturing building to warn operators in the field of the hazardous concentration of methyl mercaptan inside the manufacturing building. Operations personnel entering the manufacturing building responding to Operator 1’s distress call have no indication of a lethal methyl mercaptan concentration in the manufacturing building. Operator 2 enters the south stairway and likely goes directly to the third floor, where he is incapacitated by methyl mercaptan. Operator 3 goes up the stairs to the fourth floor but does not find anyone. Operator 4 goes up the stairs to the second floor. He walks about 10 feet and hits a “wall” of methyl mercaptan. He manages to retreat to the stairwell. Page 151 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board 3:35 am 3:35 am 3:40 am 3:40 am 3:40 am 3:50 am 3:57 am 3:58 am 4:05 am Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Operator 3 announces on the unit’s public-address system that he does not see anyone on the fourth floor. The control operator responds that the Shift Supervisor and Operator 1 may be on the third floor. Operator 3 begins to feel light-headed. He makes his way to the staircase and loses consciousness while descending the stairs from the fourth floor. The Board Operator attempts to reach the Shift Supervisor, Operator 1, and Operator 2 over the radio, but they do not respond. Personnel in the control room begin to realize something is wrong. Operator 6—the brother of Operator 2—grabs three 5minute escape respirators. Other operators in the control room tell him not to enter the manufacturing building because they do not yet know what is going on or where the nonresponsive operators are. Operator 6, however, takes the escape respirators and heads into the manufacturing building. Operator 6 encounters Operator 4 in the stairway and puts an escape respirator on him. The breathing air helps Operator 4 recover, and he exits the manufacturing building safely. Operator 5 attempts to communicate by radio to inform co-workers of his exposure to a chemical release in the manufacturing building. (It is unclear if others hear him.) The manufacturing building fume release alarm sounds. It is a manually activated alarm intended to alert area workers of a toxic chemical release in the building. Operator 6 likely activated it. The Board Operator calls for the plant emergency response team (ERT) to respond, communicating that workers are missing. ERT members believe they are called to perform a rescue (e.g., broken bone) and do not know there is a toxic chemical release. The Board Operator calls the security guard at the main entrance and asks the guard to call 9-1-1. There is still confusion about what is going on, and the Board Operator communicates that workers are missing and requests rescue. The guard gives limited information to the 9-1-1 operator. Site emergency responders from the ERT arrive at the scene, but they do not have proper personal protective equipment (PPE) to enter a building with an active hazardous chemical release (methyl mercaptan is both highly toxic and highly flammable). They have prepared and responded to perform a technical rescue and brought gear only for that operation (harnesses, ropes, and haul systems). When they arrive at the manufacturing building, they realize it is a chemical release and they need additional PPE. The site Incident Commander who responded to the initial rescue request calls for the ERT to come to the scene with bunker gear and self-contained breathing apparatus (SCBA)—necessary PPE to enter an area with a toxic chemical release. Page 152 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board 4:10 am 4:12 am 4:18 am 4:20 am 4:25–4:45 am 5:08 am 5:09 am 5:10 am 5:15 am 6:02 am 6:10 am–9:30 am Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX The truck containing the ERT’s SCBAs and radios does not start and cannot come to the scene. An October 2, 2014 work order stated, “Check batteries and they were not good, remove and replace with new ones.” Replacing the battery did not fully repair the truck, and it still could not start at the time of the incident. After the incident, DuPont replaced the truck’s alternator, battery cable, and belts. DuPont did not adequately maintain the SCBA truck before the incident to ensure it could operate during an emergency. A second 9-1-1 call is made by one of the area supervisors. Harris County Sherriff’s deputies arrive at control room. Operator 3 regains consciousness and manages to exit the manufacturing building of his own volition. Fire brigade members escort him to safety. First ERT team enters manufacturing building. While they are in the manufacturing building they do not monitor the concentration of methyl mercaptan, which in addition to being toxic, is a highly flammable chemical. CSB calculations indicate that at times a portion of the building had an explosive atmosphere from the release. A 2002 DuPont study found that a methyl mercaptan vapor cloud explosion could cause the manufacturing building to collapse, but the ERT did not know that. An ERT member finds drain valves from the waste gas vent header on the third floor open with a gas (later determined to be methyl mercaptan) flowing from them. The Shift Supervisor is found unconscious on the third floor approximately 30 feet north of the drain valves. Operator 6 is found next to his brother (Operator 2), both unconscious. Operator 2 has a 5-minute escape respirator on his head. The respirator is one of the three escape packs brought into the building by his brother (Operator 6). Operator 6 has a 30-minute SCBA air bottle in front of him and the mask on his face, but he has not connected the mask to the air bottle. (Operator 6 was likely incapacitated by methyl mercaptan while trying to don the SCBA, before he connected his mask to the SCBA air bottle.) It is later determined that the Shift Supervisor, Operator 2, and Operator 6 died from toxic exposure / asphyxiation. First group of external fire fighters arrive on-site. Second group of external fire fighters arrive on-site. Third group of external fire fighters arrive on-site. Second ERT entry conducted. DuPont and other plant ERT emergency responders do not monitor the methyl mercaptan concentration inside of the manufacturing building. On the third floor, an ERT responder closes an open drain valve from which a gas (methyl mercaptan) is escaping. Methyl mercaptan storage tank pump is turned off, significantly slowing the methyl mercaptan release to the atmosphere. Third, fourth, and fifth ERT entries are conducted to look for missing Operator 1. DuPont and other plant ERT emergency responders do not monitor the methyl mercaptan concentration inside of the manufacturing building. (When Harris County Page 153 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board 6:14 am 6:38 am 8:07 am 10:07 am 11:15 am–11:55 am 11:40 am Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX emergency responders conduct building entries, beginning after about 6:40 am, they monitor the air inside the manufacturing building using a QRAE monitor and a MultiRAE monitor.) Emergency responders cannot find Operator 1, possibly because there could be areas inside the manufacturing building that they are not aware they have not searched. They have no maps to reference during their search, and the manufacturing building is not equipped with cameras to view the different floors of the building. Area operators—including the Board Operator—draw building maps to assist emergency responders in navigating the manufacturing building. ERT responders continue closing valves to stop the release of methyl mercaptan. Sheriff’s sergeant notices an “intense smell” in Deer Park (west of La Porte). A sheriff’s sergeant driving on Texas Highway 225 communicates that “the odor on 225 is strong.” Harris County performs first off-site air monitoring (near Highway 225) and does not detect methyl mercaptan in the air. DuPont activates the methyl mercaptan tank emergency isolation valve to stop methyl mercaptan from flowing to the process. Sixth ERT entry is conducted. Operator 1 is recovered in the north stairwell of the manufacturing building. She is later determined to be deceased, having died from toxic exposure / asphyxiation. Final waste gas vent header drain valve is closed to fully stop methyl mercaptan release. Page 154 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX APPENDIX C: ODOR COMPLAINTS FROM NOVEMBER 15, 2014  Figure 40.  Map of the Odor Complaints (Yellow Pins) from the November 15, 2014 Incident.  Source: Harris County, Texas.  Page 155 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX APPENDIX D: EMERGENCY RESPONSE TABLES  The regulatory tables in this appendix focus on the most significant OSHA and EPA requirements regarding Emergency Response and Preparedness. Companies should first determine what regulations apply to their process or facility and whether they are statutorily required to conduct or will voluntarily conduct an emergency response.a Based on this information, companies should develop an integrated approach to their requirements. Table 1.  OSHA and EPA Regulations That Apply to Emergency Response Preparedness.  Regulation Name 29 C.F.R. § 1910.119 Process Safety Management of Highly Hazardous Chemicals (PSM) 29 C.F.R. § 1910.38 Emergency Action Plans 29 C.F.R. § 1910.120 Hazardous Waste Operations and Emergency Response (HAZWOPER) 42 U.S.C. § 116 Emergency Planning and Community Right-to-Know Act (EPCRA) 40 C.F.R. § 68(G) Risk Management Plan (RMP)b Requirement Requires an emergency action plan or an emergency response plan (if there is an internal emergency response team). Dictates the minimum procedures necessary to alert emergency personnel of an emergency. Requires an emergency response plan if there are hazardous materials and there is an internal emergency response. Requires states to develop a state emergency planning commission and local emergency planning committees (LEPC). Requires an emergency response plan and emergency notifications. Requires an emergency response program. Requirements may potentially be fulfilled by developing emergency response plans required by other agencies. a The term response has the same meaning under OSHA’s Hazardous Waste Operations and Emergency Response (HAZWOPER) standard and EPA’s Risk Management Plan rule [151, p. 2]. OSHA defines emergency response under the HAZWOPER standard as “a response effort by employees from outside the immediate release area or by other designated responders (i.e., mutual aid groups, local fire departments, etc.) to an occurrence which results, or is likely to result, in an uncontrolled release of a hazardous substance. Responses to incidental releases of hazardous substances where the substance can be absorbed, neutralized, or otherwise controlled at the time of release by employees in the immediate release area, or by maintenance personnel are not considered to be emergency responses within the scope of this standard. Responses to releases of hazardous substances where there is no potential safety or health hazard (i.e., fire, explosion, or chemical exposure) are not considered to be emergency responses” (29 C.F.R. § 1910.120(a)(3)). b The EPA has published general guidance on Emergency Response Programs and other aspects of RMP. Page 156 FINAL COPY  Toxic Chemical Release at the DuPont La Porte Chemical Facility U.S. Chemical Safety and Hazard Investigation Board La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX   Table 2.  Requirements for an Emergency Action Plan (29 C.F.R. § 1910.38) and Emergency Response Plan (29 C.F.R. § 1910.120) under  OSHA.  Requirement Emergency Action Plan Emergency Response Plan ✓ Procedures for reporting a fire or other emergency Procedures for emergency evacuation, including type of evacuation and exit route assignments Procedures for employees who remain to operate critical plant operations before they evacuate Procedures to account for all employees after evacuation Procedures for employees performing rescue or medical duties The name or job title of every employee who may be contacted by employees who need more information about the plan or an explanation of their duties under the plan Pre-emergency planning and coordination with outside parties ✓ ✓ ✓ ✓ ✓ ✓ Personnel roles, lines of authority, training, and communication ✓ Emergency recognition and prevention ✓ Safe distances and places of refuge ✓ Site security and control ✓ Evacuation routes and procedures ✓ Decontamination ✓ Emergency medical treatment and first aid ✓ Emergency alerting and response procedures ✓ Critique of response and follow-up ✓ Personal protective equipment and emergency equipment ✓     Page 157 FINAL COPY  Toxic Chemical Release at the DuPont La Porte Chemical Facility U.S. Chemical Safety and Hazard Investigation Board La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Table 3.  Emergency Response Program requirements under RMP for Responding Facilities.  Elements Emergency response plan Planning coordination Emergency equipment Employee training Response plan evaluation Requirement An emergency response plan maintained at the facility that includes (1) procedures for informing the public and emergency response agencies about releases, (2) documentation of proper first aid and emergency medical treatment necessary to treat human exposures, and (3) procedures and measures for emergency response Coordination with local response agencies on responses to potential release of regulated substances Procedures for using, inspecting, testing, and maintaining emergency response equipment Training for all employees in relevant procedures Procedures for reviewing and updating the response plan to reflect changes at the facility and for ensuring that employees are informed of the changes     Page 158 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Table 4.  Industry and Government Guidance Related to Emergency Response.  Organization Federal Emergency Management Agency (FEMA) American Petroleum Institute (API) National Fire Protection Association (NFPA) National Fire Protection Association (NFPA) National Fire Protection Association (NFPA) National Fire Protection Association (NFPA) National Fire Protection Association (NFPA) Name National Incident Management System (NIMS) RP API 1174, API Recommended Practice for Pipeline Emergency Preparedness and Response NFPA 472, Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents NFPA 475, Recommended Practice for Organizing, Managing, and Sustaining a Hazardous Materials/Weapons of Mass Destruction Response Program NFPA 600, Standard on Facility Fire Brigades NFPA 704, Standard System for the Identification of the Hazards of Materials for Emergency Response NFPA 1221, Standard for the Installation, Maintenance, and Use of Emergency Services Communications Systems National Fire Protection Association (NFPA) NFPA 1250, Recommended Practice in Fire and Emergency Service Organization Risk Management National Fire Protection Association (NFPA) NFPA 1561, Standard on Emergency Services Incident Management System and Command Safety National Fire Protection Association (NFPA) NFPA 1600, Standard on Continuity, Emergency, and Crisis Management Description A common framework for overall incident management. A comprehensive approach that is applicable at all jurisdictional levels Enhanced framework for an emergency management system for onshore hazardous liquid pipeline operators Minimum levels of competence required by responders to emergencies involving hazardous materials or weapons of mass destruction Criteria for the organization, management, and deployment of personnel, resources, and programs for entities responsible for the hazardous materials/weapons of mass destruction emergency preparedness function Requirements for organizing, operating, training, and equipping industrial fire brigades The NFPA’s Hazard Diamond, a labeling system that identifies the hazards of materials The installation, performance, operation, and maintenance of communications systems and facilities used by public emergency services Criteria to develop, implement, or evaluate a fire and emergency service organization risk management program for effective risk identification, control, and financing Requirements for the structure and operation of an incident management system for emergency services, including principles of command safety to be incorporated into all incidents, training, or emergencies, to ensure the safety of emergency responders and others on the scene of an incident Common set of criteria for all hazards, disaster, emergency management, and business continuity or continuity-of-operations programs Page 159 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Organization National Fire Protection Association (NFPA) Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Name Description NFPA 1620, Standard for PreIncident Planning Criteria for developing pre-incident plans to help responders effectively manage emergencies Page 160 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX APPENDIX E: DUPONT SAFETY PERCEPTION SURVEYS  For more than a decade, DuPont developed and honed a safety culture program to reduce its OSHA total recordable injury rate by assessing and improving occupational (personal) safety, using its Bradley Curve and Safety Perception Survey tools. In the 1990s, DuPont identified a significant discrepancy in safety performance at different DuPont sites around the world. Some of the company’s sites had few recordable injuries, and other sites had many. To improve safety performance at DuPont sites, a former DuPont Chairman and CEO created a team dubbed the Discovery Team to find a sustainable way to strengthen safety performance at all DuPont facilities, with the ultimate goal of having zero incidents throughout the entire organization [77]. The Discovery Team found that the sites with the best worker safety records more prevalently practiced DuPont safety principles. The Discovery Team also asserted that sites with the most worker injuries had a lack of management commitment to safety, more communication breakdowns, and inconsistent safety leadership. Overall, the Discovery Team claimed that DuPont sites with fewer worker injuries had a distinctive safety culture that permeated the entire facility [77]. Verlon Bradley, then manager of the DuPont plant in Beaumont, Texas, along with the Discovery Team, created a model named the Bradley Curve (Figure 41). The Bradley Curve aimed to illustrate the strength of an organization’s safety culture and its relationship to the number of worker (OSHA recordable) injuries [77]. DuPont began using the Bradley Curve model internally, and in 1995, DuPont’s consulting service, DuPont Sustainable Solutions, began applying the Bradley Curve model to improve safety performance at other companies in various industries [78]. Page 161 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 41.  The DuPont Bradley Curve.  The Bradley Curve correlates improved safety culture with reduced OSHA  recordable injury rates.  For more information, see Bradley Curve. Source: DuPont.  In 1999, DuPont formalized a method to assess an organization’s safety culture with its Safety Perception Surveya to measure the strength of the safety culture at each site. The Safety Perception Survey consists of 24 multiple-choice questions to measure safety culture across three categories of safety management: (1) leadership, (2) processes and actions, and (3) structure [59, p. 2]. The survey addresses only 12 of DuPont’s 22 essential elements of an integrated safety management system (Figure 42). It focuses on elements it labels “cultural” and places under “Management Commitment” and does not address components related to what it calls “risk-based” process safety, such as management of change. According to DuPont Sustainable Solutions, the Bradley Curve benchmarking system, combined with DuPont’s Safety Perception Surveys, has helped DuPont and its clients improve their safety culture performance [78]. a A safety management consultant and former DuPont executive developed the Safety Perception Survey, which was first published in 1999. DuPont acquired the survey in 2000. DuPont modified it and incorporated it into its consulting methodology for benchmarking and action planning [59, p. 2]. Page 162 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Figure 42.  To DuPont, Each Wheel Represents Different Aspects of Safety.  The wheel on the left  (Cultural) represents the only aspects of safety that DuPont’s Safety Perception Surveys cover.   The wheel on the right (Risk‐Based) represents aspects of safety typically associated with process  safety.  Source: DuPont.  Beginning in 2007, DuPont began calculating a “Relative Culture Strength” (RCS) score based on responses to the Safety Perception Surveys.a DuPont found that higher RCS correlated with a lower OSHA total recordable injury rate.b The correlation also fit the Bradley Curve (Figure 43) [59, p. 7]. Because of this correlation, DuPont often uses the OSHA total recordable injury rate “as [its] measure of safety performance” [59, p. 2]. Additionally, DuPont uses the RCS in combination with the Bradley Curve (Figure 43) to determine what stage of safety culture a facility has achieved. The curve represents the progress of a facility’s culture strength. The a RCS is a proprietary number calculated by comparing a company’s responses to survey questions against a benchmark established by DuPont in 2008 based on the best and worst sites that had taken the Safety Perception Survey [59, p. 3]. b The OSHA recordable injury rate is the annual number of injuries and illnesses per 100 full-time workers. The OSHA injury rate, which excludes fatalities, is a normalized rate that is used for comparison across industries [171, p. 75]. Page 163 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX higher the score, the further along the facility is on the curve, with the highest level designated “World Class.”a DuPont classified facilities with a calculated RCS value of 80 or greater as having a “World Class” safety culture. Results from a 2012 Safety Perception Survey conducted at the La Porte site, the last safety culture survey conducted at the site before the incident, classified its perception of safety performance as “World Class.” This safety classification, however, relied on the DuPont La Porte site’s employees’ perception of personal (worker) safety performance only, because the Safety Perception Survey used at DuPont La Porte did not include process safety considerations. Figure 43.  DuPont Bradley Curve with Plotted RCS results from 169,000 Safety Perception Surveys.  The yellow bars show the range  of the middle 50 percent of the data in each category, and the horizontal blue line in each box indicates the median.  DuPont found  that a higher RCS correlated with a lower worker injury rate (OSHA total recordable injury rate).  Source: DuPont.  a The Safety Perception Survey ranks performance by five categories (from best to worst): World Class, Excellence, Skill, Awareness, and Fundamentals. World Class is defined as “the organization leads its industry in safety performance as a direct result of its safety focus, leadership, deliberate organizational design, and the portfolio of activities it carries out to maintain a safe workplace.” Excellence is defined as “the organization has strong capabilities to identify, learn from, and correct at-risk behaviors and workplace hazards. Safety is a top priority. There is a free flow and exchange of information without the fear of retribution, and the organization is focused on learning and improving. Hazard reporting, auditing, and corrective implementation are well designed and executed on a regular basis.” The Skill level is defined as “the organization shows numerous signs of continuous improvement and has a track record of modest and consistent improvement in safety performance. Personnel are skilled in the application of basic safety management tools and techniques.” The Awareness level is defined as “the organization is aware of its performance and has established basic policies and processes to measure and improve safety performance. There is relatively high value for safety efforts, and an auditing system is in place to eliminate workplace hazards.” The Fundamentals level is defined as “the organization has processes in place to avoid known workplace hazards and uses trailing injury statistics for performance measurement. Injuries and incidents are the main driving force behind discussion of safety management practices. There is a written safety policy that may not be familiar to employees or be perceived as of high value. Safety performance is known to some in the organization but is not widely known or thought out.” Page 164 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX DuPont Sustainable Solutions responded to the new learnings about process safety culture after BP Texas City by developing 13 new process safety questions for its Safety Perception Surveys. These questions are considered optional and may be included in the survey at clients’ request. Page 165 FINAL COPY  U.S. Chemical Safety and Hazard Investigation Board Toxic Chemical Release at the DuPont La Porte Chemical Facility La Porte, Texas Incident Date: November 15, 2014 No. 2015-01-I-TX Members of the U.S. Chemical Safety and Hazard Investigation Board: Kristen Kulinowski, PhD Interim Executive Manuel Ehrlich Member Richard Engler Member Page 166 FINAL COPY