463

A publication of

CHEMICAL ENGINEERING TRANSACTIONS

VOL. 31, 2013
Guest Editors: Eddy De Rademaeker, Bruno Fabiano, Simberto Senni Buratti Copyright 2013, AIDIC Servizi S.r.l., ISBN 978-88-95608-22-8; ISSN 1974-9791 The Italian Association of Chemical Engineering Online at: www.aidic.it/cet

A Case Study of an Ethylene Oxide Explosion in a Sterilization Facility

Ali Reza, Erik Christiansen*
Exponent, Failure Analysis Associates, 5401 McConnell Ave. Los Angeles, CA 90066 USA [email protected]

Ethylene oxide is widely used as a sterilizing agent for medical and food applications and products. However, due to its broad range of flammability (2.6 % to 100 %) in air, this gas presents a particularly serious explosion hazard, which is compounded by extremely stringent and ever increasing requirements for pollution control equipment. Many emission control devices contain potential ignition sources, such as open flames, that could trigger an explosion. Engineering controls and safety interlocks are therefore critical to prevent explosions during abnormal operation and process upsets. This paper describes an investigation of a large explosion that caused extensive damage at a sterilization facility in the United States in August, 2004. The incident occurred as workers were attempting to troubleshoot one of their sterilization chambers and consequently bypassed safety interlocks while evacuating the gas. This allowed a flammable mixture to enter an ethylene oxide destruction unit (abator), which utilized an open flame to preheat waste gases before they passed through a catalytic oxidizer bed. The resulting deflagration propagated through the ductwork and back into the sterilization chamber, which exploded. The authors present the lessons learned from this incident through their direct involvement with the incident investigation as well as a review of previous, similar incidents investigated by the United States Environmental Protection Agency (EPA). The root cause and contributory factors for this explosion are discussed and recommendations provided on how similar incidents might be avoided in the future. One of the authors serves on the NFPA committee responsible for publishing the standard on safe storage, handling and use of ethylene oxide, and the paper concludes with an regulatory and industry perspective on alternative designs and equipment that could have prevented the explosion or vented/diverted the overpressure in order to lessen the damage to the workers and the facility.

1. Ethylene oxide background

Ethylene oxide (a.k.a. oxirane) is one of the most widely produced petrochemical products worldwide, with annual production rates of approximately 19 Mt (Bernardo and Clarizia, 2011). A substantial majority of this is used as an intermediary in the synthesis of ethylene glycols and associated chemicals. While use of raw ethylene oxide as a sterilization agent only accounts for approximately 1 % of its total production, it presents unique hazard due to its extreme flammability, toxicity and carcinogenic properties. 1.1 Flammability Ethylene oxide has the chemical formula C2H4O. Due to its cyclic ether structure, the molecule is highly reactive. Ethylene oxide is flammable in concentrations from 2.6 % up to 100 %, where the decomposition reaction can propagate as a self-sustaining flame: C2H4O ->CO + CH4 + 3.05MJ/kg (1)

Ignition of the thermal decomposition reaction can occur at 500 C at atmospheric pressure and has been observed to occur at pressures as low as 33 kPa (albeit at higher temperatures). Due to the broad flammability range, preventing ethylene oxide deflagrations is particularly challenging. Furthermore, ethylene oxide flames can transition to detonation when propagating through ductwork or piping of sufficient length (Thibault et al., 2000). The supersonic speed of the reaction front can create extreme

464

overpressures, causing ducting and vessels to fail catastrophically. Accordingly, manufacturers offer flame arrestors specially designed for ethylene oxide (which is rated as a Class B fuel), and these arrestors are recommended by the American Chemistry Council (ACC, 2007). Within the past four years, at least one manufacturer has also introduced a detonation flame arrestor rated for ethylene oxide (Wolf, 2008). However, these devices require frequent maintenance because they can create flow restrictions and are subject to plugging, particularly when used with ethylene oxide that can polymerize. 1.2 Toxicity and environmental concerns Worker exposure to ethylene oxide in the United States is regulated by the Occupational Safety and Health Administration (OSHA). The 8-hour time weighted permissible exposure limit (PEL) is 1 ppm, with up to 5 ppm allowed during a 15-minute time weighted average period (OSHA, 2002). Concentrations of 800 ppm are considered to be immediately dangerous to life and health (loss of life or irreversible health effects within 30 minutes) by the National Institute for Occupational Safety and Health (NIOSH) (ACC, 2007). Due to the hazardous nature of ethylene oxide, atmospheric releases in the United States are regulated by the EPA and local jurisdictions may require even more stringent policies. Emissions control devices such as acid scrubbers or catalytic oxidizers are frequently used to reduce ethylene oxide concentrations to appropriate levels. To reduce worker exposure to residual vapours, sterilization chambers using ethylene oxide often incorporate backvents at the rear of the chamber that are interlocked with the front door so that they automatically activate when the door is opened. This creates a negative pressure within the chamber as a large fan pulls air from the chamber through the backvent. An ethylene oxide detector is often installed at the floor level near the front door alarms if ethylene oxide is released. 1.3 Previous Incidents In 1994, the EPA required sterilization facilities to remove 99 % of ethylene oxide from exhaust emissions. The regulation required operators to select the maximum achievable control technology for each source of ethylene oxide. The most effective emissions control device was often an oxidizing unit (for example, a thermal or catalytic oxidizer). In the five years following the mandate, ten explosions occurred in sterilization facilities using ethylene oxide, causing several injuries and one fatality. Most of these incidents involved catalytic oxidizers that were inadvertently fed flammable concentrations of ethylene oxide, causing ignition of the mixture (NIOSH, 2000). A common thread amongst these incidents is the lack of an interlock that prevents the opening of the backvent when a hazardous concentration of ethylene oxide is present in the chamber (ACC, 2007). In response to the explosion hazard, the EPA rescinded backvent requirements in 1997. However, the California Air Resources Board (CARB) maintained this requirement for sterilization facilities in the state of California.

2. Process description
An overall layout of the subject sterilization facility is shown in Figure1. Palletized product is sterilized with ethylene oxide gas to comply with various United States Food and Drug Administration requirements. The process is broken down into three steps: pre-conditioning, sterilization, and aeration. During preconditioning, the product is held in a large environmental chamber where the temperature and humidity are held at high levels to allow the product to more effectively respond to the ethylene oxide sterilization. Afterward, the product is moved to a sterilization chamber, a. During the sterilization step, the chamber is sealed, evacuated, and a small amount of steam is introduced to further warm the product. Next, the chamber (which is still under vacuum) is flooded with high concentrations of ethylene oxide mixed with nitrogen. The product remains surrounded by the mixture for a dwell period; the duration and gas concentration is specific to the product being sterilized. Once the allotted time has passed, the chamber is evacuated and flooded with nitrogen repeatedly to flush the chamber and ensure that the concentration of ethylene oxide is below hazardous levels. Finally, as the door to the chamber is cracked open, a butterfly valve (Figure 2 b) automatically opens a backvent at the rear of the chamber (Figure 2 c), which pulls the atmosphere within the chamber away from the door to prevent worker exposure to any remaining ethylene oxide. After the product is removed from the chamber, it is placed in an aeration room for up to four days where ethylene oxide absorbed or trapped in the product is removed via forced ventilation of air and elevated temperatures. 2.1 Emission controls The incident facility had two separate emission control devices for removing ethylene oxide from the exhaust gases. The bulk removal of ethylene oxide after the sterilization cycle was accomplished via an acid scrubber, which used a sulphuric acid solution to turn the ethylene oxide into ethylene glycol. Acid scrubbers are very effective in removing high concentrations of ethylene oxide; however, they perform poorly when there are small amounts of ethylene oxide present in large flow rates, such as the exhaust

465

from the backvent. To handle the low-concentration exhaust from the aeration room and the chamber backvents, the facility used a direct-fired catalytic oxidizer (Figure 2 d). Exhaust streams from the backvents and the aeration room were combined in a mixing chamber directly upstream of the oxidizer in a ratio of four to one (aeration to backvent). The oxidizer pre-heated the exhaust stream in two stages to reach the optimum temperature (150 C) for the catalyst. In the first stage, a counterflow heat recovery exchanger recovered heat from the treated exhaust before it exited the stack. In the second stage, the exhaust gases were exposed to the open flames from a direct-fired natural gas burner. The exhaust then passed through a metal catalyst bed that removed the ethylene oxide. The treated exhaust then travelled through the heat recovery exchanger, a blower, and finally out an exhaust stack.

3. Incident description
3.1 Sequence of events prior to incident During routine operations on August 19, 2004, plant workers reported a malfunction in the ethylene oxide injection system for one of the chambers. They referred the problem to the maintenance crew that was due to begin work during the next shift. Despite running several test cycles, the maintenance crew could not replicate the reported problem. They successfully injected 57 kg of the gas into the chamber as part of a calibration cycle and, since the work crew that had originally reported the problem had already left, elected to bring the system back into production. The chamber was evacuated to half the test pressure, and the workers attempted to open the chamber doors without operating the nitrogen wash cycles. Subsequent investigation determined that they were under the mistaken belief that the wash cycles were not necessary because there was no product in the chamber. Although the computer control system did not allow this action, the workers accessed a high-level password that allowed them to override these safeguards and forced a bypass of the wash cycles to open the front door to the chamber. This triggered the backvent butterfly valve, drawing the ethylene oxide in the chamber to the catalytic oxidizer, as shown in Figure 3 3.2 Explosion Almost immediately after the chamber front door was opened, an ethylene oxide detector just outside the door started alarming. Before the workers could react, a flammable gas mixture was drawn through the ductwork and into the abator. An explosion was initiated by the open flame within the unit and propagated back upstream through the ductwork into the chamber. Witnesses reported the explosion occurred between 10 and 20 s after the front door was opened. The overpressure from the explosion blew both the front and rear doors off the chamber, sending them as far as 23 m. The chamber itself was bulged outwards from the extreme internal pressure. Shrapnel from the explosion fractured the windows to the control room, causing injuries to four workers from the broken glass. The building roof and internal walls and the exhaust ductwork suffered structural damage from the blast, and the total property loss exceeded $ 27 M. However, the ethylene oxide system was not breached, and there was no post-explosion fire.

466

4. Analysis
Following the incident, Exponent was retained by the property insurance carrier for the plant operator to conduct an independent investigation. Incident investigations were also conducted internally within the company and by the United States Chemical Safety and Hazard Investigation Board (CSB, 2006). 4.1 Hazard awareness The employees controlling the chamber at the time of the incident did not understand that repeated nitrogen washes were necessary to purge the chamber before the door could be opened, even if there was no product in the chamber. As a consequence, they discharged a flammable mixture of ethylene oxide to the abator, which contained an open flame ignition source. A similar explosion had occurred at another sterilization plant operated by the same company approximately seven years earlier when a chamber door and backvent were operated while a high ethylene oxide concentration was present. However, that

467

incident occurred in a manually operated chamber, and the interlocked computer control system in the subject plant had been designed to prevent a similar occurrence. Although the computer control system had mandatory nitrogen washes programmed into the cycle, the workers accessed a high level password that allowed them to bypass these essential steps. A hazard review conducted to identify potential failure mechanisms for an explosion within the process did not identify this mechanism as a potential explosion source, presumably because the presence of a high level bypass password was not identified. Similarly, although a flame arrestor was originally installed on the high concentration line prior to installation of the acid scrubber, the manufacturer of the abator did not specify a similar device at the low-concentration inlet. 4.2 Chamber ethylene oxide monitoring The concentration of ethylene oxide within the chamber is not measured directly but is estimated based on the amount of injected ethylene oxide and inerts and the pressure during the different phases of the cycle. Previous generations of ethylene oxide lower explosion limit (LEL) detectors were susceptible to sensor saturation at high concentrations, and therefore only suited to applications external to the chamber. However, subsequent advances in sensor technology had made direct measurement of ethylene oxide concentration within the chamber feasible. By 2002, the committee responsible for NFPA 560: Standard for the Storage, Handling, and Use of Ethylene Oxide for Sterilization and Fumigation had introduced a requirement for monitoring ethylene oxide concentration in the chamber when the backvent is connected to an oxidizer (NFPA, 2002). If such sensors are present, they can be interlocked with the control system to prevent the operation of the backvent if the concentration exceeds a certain percentage of the LEL. Additionally, if a backvent is opened when the concentration is at a hazardous level, the exhaust can be diverted before the mixture reaches the abator. Although the facility operator had installed the new generation LEL sensors in their manually operated chambers, they had not installed these in computercontrolled chambers like the one involved in this incident 4.3 Abator inlet concentration monitoring Catalytic oxidizers are routinely employed as emission control devices in various industries including ethylene oxide sterilization. Since oxidizers are primarily used in the removal of volatile organic compounds, which also pose ignition hazards, they are included within the scope of NFPA 86: Standard for Ovens and Furnaces (NFPA, 2003). With a few modifications, they are required to meet the same safety standards as ovens that operate with potentially flammable atmospheres (Class A ovens). NFPA 86 has specific requirements for concentration limits based on the method used to estimate or measure vapour concentration. One recognized method is to dilute the exhaust flow to the oxidizer sufficiently to ensure that the concentration is held below the LEL level. NFPA 86 limits the flammable vapour concentration to 25 % of LEL when the concentration is controlled by dilution. For ethylene oxide sterilizers, this method is not always feasible, due to the broad flammability limits of ethylene oxide and the potential for high concentrations to be drawn through the backvent. The abator in this incident scenario had a 4:1 dilution ratio, which was insufficient to prevent ignition when the backvent was operated with a large concentration of ethylene oxide in the chamber. High dilution ratios are also logistically problematic since they require air handling ducts and equipment that are much larger than would otherwise be necessary. A second solution is to install an LEL detector in the backvent exhaust duct upstream of the oxidizer. If a hazardous concentration of ethylene oxide is detected, it can activate a fast-acting diverter valve such that the mixture is not sent to the oxidizer. Such a protection scheme is feasible, although it requires fast acting sensors and diverter valves in order to be effective, as well as sufficient distance between the backvent and the oxidizer. NFPA 86 allows concentrations up to 50 % of LEL when continuous monitoring is employed, and stresses that the response time and location of the sensor be carefully chosen. Although an ethylene oxide specific LEL meter at the inlet of the oxidizer was considered in the original design of the subject abator, the system was never installed. 4.4 Explosion protection and suppression In the event a flammable mixture does enter the oxidizer, there are various methods for preventing the deflagration from propagating upstream in order to limit the extent of damage. Flame arrestors have been proven to be effective at quenching deflagrations, provided they are properly selected and NFPA 560 recommends appropriate flame arrestors for all sterilization chamber applications (NFPA, 2002). Alternatively, deflagrations can be diverted by specially designed valves so they do not propagate back into the sterilization chamber. These passive devices require no electronic controls and activate by the overpressure and momentum of the deflagration. One type uses a rupture disc to vent the explosion, while another uses a heavy hinged door that requires minimal or no action to reset. More sophisticated systems that incorporate fast acting explosion sensors to actuate isolation or diverter valves to protect upstream ductwork and equipment are also available. These systems must have rapid response times when used to

468

protect against ethylene oxide explosions as deflagration-detonation transition is known to occur (Thibault et al., 2000). Requirements for the installation of explosion protection systems are covered in NFPA 69: Standard for Explosion Protection Systems (NFPA, 2008). 4.5 Abator design While a catalytic oxidizer is considered to be the most effective method for removing ethylene oxide from the backvent exhaust, alternate abator designs that eliminate open flame exposure are also available. The ignition temperature of ethylene oxide decomposition is 500 C, while the catalyst only requires temperatures of 150 C to operate effectively. An indirect-fired unit (where a heat exchanger separates the burner compartment from the exhaust flow) is a safer alternative because the exhaust from the sterilization chamber is not exposed to an open flame. Abators that use steam or electric heat are also less likely to cause ignition. However, it is acknowledged that these alternate designs may not be able to handle the large volumetric throughput that direct-fired units can, and may also cost more to operate.

5. Conclusions
The root cause of the explosion was that workers did not recognize that nitrogen wash cycles were necessary to reduce the ethylene oxide concentration and used a high-level password to bypass safety steps programmed into the control system. During their trouble-shooting process, they vented a flammable gas mixture to an oxidizer that utilized an open flame. The exhausted gases ignited, causing a deflagration to propagate upstream through the ductwork and back into the chamber, which failed catastrophically. Our investigation revealed several design changes and engineering controls that could have mitigated damage to the facility, or prevented the explosion entirely. For example, technology to directly measure ethylene oxide concentrations inside the chamber was available, and these sensors were required by the current edition of the applicable standard (NFPA 560). Such sensors could have been interlocked with the backvent to prevent operation when the concentration of ethylene oxide in the chamber exceeded LEL, preventing the incident. The abator also fell under the scope of NFPA 86, which required that inlet concentrations be maintained at safe levels either through sufficient dilution or constant monitoring. Neither of these methods was employed in the incident system. An abator design that did not expose the exhaust stream to an open flame could have been selected. Protection devices such as flame arrestors, explosion diverters and fast-acting explosion suppression systems could have been installed in the ductwork between the abator and the chamber. Properly engineered and installed, these devices would have prevented the deflagration from propagating back to the chamber and reduced the likelihood of worker injury and structural damage to the facility. References American Chemistry Council (ACC), 2007, The Ethylene Oxide Product Stewardship Guidance Manual, 3rd ed, Washington DC, U.S.A. Bernardo P., Clarizia G., 2011, Potential of Membrane Operations in Redesigning Industrial Processes. The Ethylene Oxide Manufacture, Chemical Engineering Transactions, 25, 617-622. National Fire Protection Association, 2002, NFPA 560: Standard for the Storage, Handling, and Use of Ethylene Oxide for Sterilization and Fumigation, Quincy, MA, U.S.A. National Fire Protection Association, 2007, NFPA 86: Standard for Ovens and Furnaces, Quincy, MA, U.S.A. National Fire Protection Association, 2008, NFPA 69: Standard on Explosion Prevention Systems, Quincy, MA, U.S.A. National Institute for Occupational Health and Safety (NIOSH), April 2000, Alert Preventing Worker Injuries and Deaths from Explosions in Industrial Ethylene Oxide Sterilization Facilities, United States Department of Health and Human Services, Publication No. 2000-119. Occupational Safety and Health Administration (OSHA), 2002, Ethylene Oxide Fact Sheet, United States Department of Labor. Thibault P., Britton L., Zhang F., 2000, Deflagration and Detonation of Ethylene Oxide Vapor in Pipelines, Process Safety Progress, 19 (3), 125-139. United States Chemical Safety and Hazard Investigation Board, Investigation Report: Sterigenics, Report No. 2004-11-I-CA, March, 2006. Wolf, J., 2008, First Approved Flame Arrestor for Acetylene and Ethylene Oxide Worldwide, Braunschweiger Flammenfilter GmbH, Braunschweig, Germany.