Document ZnwO97KO8ErgEKe254pdQq26V

REPLY TEXT TO ENVIRONMENTAL PROTECTION AGENCY REQUEST OF MAY 12, 1981 FROM Conoco Chemicals Company Oklahoma City, Oklahoma September 15, 1981 DTH 000071396 Page No(s). 1 1 2- 55 2 3 4- 18 4 5 6- 10 6 7 7 8 8 9 9 9 9 10 11'-16 11 14 15 15 16 16 16 16--18 18 19--21 22 23--30 23 24 26 29 31--37 31 32 33 35 36 EPA Question No. PartTs) 1 1 A, B, C 2 2 A, B, C 2 D, E, F 2G 2H 2I 2J 2 2 A, B 2 c, D, E, F 2 G, H, I 2J 2 2 A, B 2 c. D 2 E, F, G 2 H, I 2J INDEX Description Release of April 5, 1978 Release of August 13, 1978 Release of August 13, 1978 Releases of August 13, 1978 (and October 20, 1979) I. Changeout of Discs II. Special Study of Disc Ruptures III. Improvements Relating To The Disc Assemblies 1. improved Rupture Disc Holders 2. Improved Disc Holders Under Relief Valves 3. Piping Improvements 4. Pre-Installation Testing of Rupture Discs 5. Post-Installation Testing of Rupture Discs 6. Supervision of Hydrostatic Tests 7. Training in Rupture Disc Installation Procedures 8. Reduction in Placement Time 9. Improved Venting Procedures 10. Investigations into Secondary Disc Protectioi IV. Improvements to Prevent Reactor Pressure Rises 1. Improvements to the Reactor Kill System 2. Improvements to the Cooling Water System 3. Improved Emergency Electrical Power Supply 4. Power Line Protection 5. Infrared Surveys 6. Severe Weather Radio 7. New Pressure Indicators V. Improvements to Limit The Magnitude of Releases Release of August 13, 1978 Release of August 13, 1978 Release of August 13, 1978 Release of November 26, Release of November 26, Release of November 26, Release of November 26, Release of November 26, 1978 1978 1978 1978 1978 Release of July Release of July Release of July Release of July Release of July Release of July 22, 22, 22, 22, 22, 22, 1979 1979 1979 1979 1979 1979 WH 000071397 CONFIDENTIAL Page No(s) . 38- 44 38 39 40 43 45- 55 45 48 49 50 52 54 56- 63 56 58 58 59 59 59 60 61 64- 73 64 64 65 65 66 67 68 71 72 73 74 75- 62 75 76 76 77 79 79 82 EPA Question No. ^art(s) 2 2 A, B, C, D, 2 E, F 2 G, H, I 2J 2 2 A, B 2 C, D, E 2F 2G 2 H, I 2J 3 3A 3B 3C 3D 3E 4 4 A(l) 4 A(2) 4 A (3) 4 A(4) 5 A, B, C 6 6A 6 B (1) 6 B (2) 6 B (3) 6 B (4) 6C 6D INDEX (Cont. ) Description Release of October 20, 1979 Release of October 20, 1979 Release of October 20, 1979 Release of October 20, 1979 Release of October 20, 1979 Release of March 23, Release of March 23, Release of March 23, Release of March 23, Release of March 23, Release of March 23, Release of March 23, 1980 1980 1980 1980 1980 1980 1980 Release of August 13, 1978 Release of October 20, 1979 Release of August 13, 1978 Release of October 20, 1979 Release of August 13, 1978 Release of October 20, 1979 Release of November 26, 1978 Release of Julv 22, 1979 Release of March 23, 1980 Release of November 26, 1978 Release of July 22, 1979 Release of March 23, 1980 Mr. Daniel Farrier Mr. Scott Ward Mr. Fred Graham Short-Stop System DTH 000071398 Page No(s). EPA Question No. Part(s) 83-95 83 83 83 84 84 85 85 85 86 87 87 89 90 91 93 93 95 96-101 96 97-101 98 99 7 7A 7B 7C 7D 8 8A 8B INDEX (Cont.) Description Studies and Other Alternatives Considered 1. Emergency Lighting in the V-40 Area 2. Automatic AMS Addition 3. Backflow Preventer Bypass 4. Revised Emergency Procedure 5. Firewater Cross-tie 6. Elevated Water Supply Tank 7. Blowdown Drum 8. Emergency Power 9. Alternative Rupture Discs 10. Alternative Kill Systems 11. Increasing Relief Valve Set Pressure 12. Remote Operated Block Valve On Double Disc Assembly 13. Reactor Relief Collection And Containment 14. Reactor Level Alarms Large Reactor Pilot Plant--Oklahoma City PVC Plant Comparison Aberdeen Chemical Plant--Oklahoma City PVC Plant Comparison DTH 000071399 Introduced at Page Figure No. 11 22 23 3 31 4 38 5 45 6 45 7 50 8 23 9 26 10 INDEX (Cont.) CONFIDENTIAL Description Process Flow Diagram Reactor D-305 Release, April 5, 1978 Process Flow Diagram Reactor D-305 Release August 13, 1978 Process Flow Diagram Reactor D-301 Release November 26, 1978 Process Flow Diagram Reactor D-305 Release July 22, 1979 Process Flow Diagram Reactor D-303 Release October 20, 1979 Process Flow Diagram Reactor D-301 Release March 23, 1980 Process Diagram Reactor Catalyst Charge System Process Diagram Revised Reactor Catalyst Charge System AMS Injection System for Reaction Termination (Prior to 12/01/78) Process Diagram AMS Injection System for Reaction Termination (Installed 12/01/78) DTH 000071400 CONFIDENTIAL QUESTION 1 PLEASE PROVIDE A LIST OF ALL RELIEF DISCHARGES OF VCM WHICH OCCURRED AT THE PLANT FOR THE PERIOD BEGINNING JANUARY 21, 1977 THROUGH SEPTEMBER 1, 197B. DATA DEMANDED IN THE FOLLOWING, WHICH HAS ALREADY BEEN SUBMITTED, SHOULD BE REFERENCED AND NEED NOT BE RESUBMITTED. THE LIST SHOULD INCLUDE THE FOLLOWING INFORMATION FOR EACH DISCHARGE: During the time period from January 21, 1977, through September 1, 1978, the Plant had two emergency discharges of VCM from the PVC reactors. The two incidents occurred on April 5, 1978, and August 13, 1978. The April 5, 1978 release is discussed immediately below. The August 13, 1978 release is discussed in Question 2. Release of April 5, 1978 A. IDENTIFICATION OF THE SOURCE AND RELIEF DEVICE(S). The source of the VCM release was the double rupture disc assembly on reactor D-305. A double rupture disc assembly consists of two rupture discs in series. A process flow diagram is attached as Figure 1. B. DESCRIPTION OF THE NATURE AND CAUSE OF THE DISCHARGE. The double rupture disc assembly failed prematurely during the recovery/steam stripping operation of a partial reactor batch. The double rupture disc assembly failed at 139 psig. and 152F. Both discs in the assembly were rated to burst at 200 psig. The cause of the premature failure is unknown. Calculations from available records indicate that the premature failure resulted in the release of approximately 4,000-6,000 pounds of VCM. C. DATE AND TIME (START/FINISH) OF THE DISCHARGE. The release occurred at approximately 1:30 a.m. on April 5, 1978. The length of the discharge was approximately three minutes. DTH 000071401 CONFIDENTIAL QUESTION 2 PLEASE PROVIDE A LIST OF ALL RELIEF DISCHARGES OF VCM WHICH OCCURRED AT THE PLANT SUBSEQUENT TO AUGUST 1, 1978. DATA DEMANDED IN THE FOLLOWING, WHICH HAS ALREADY BEEN SUBMITTED OR INCLUDED IN THE RESPONSE TO QUESTION 1, ABOVE, SHOULD BE REFERENCED AND NEED NOT BE RESUBMITTED. THE LIST SHOULD INCLUDE THE FOLLOWING DATA FOR EACH DISCHARGE: Subsequent to August 1, 1978, the Plant had five emergency relief discharges. The discharges occurred on August 13, 1978, November 26, 1978, July 22, 1979, October 20, 1979, and March 23, 1980. Each discharge is discussed separately below. Release of August 13, 1978 A. IDENTIFICATION OF SOURCE AND RELIEF DEVICE(S). INCLUDE A PROCESS FLOW DIAGRAM OF SOURCE RELATIVE TO DISCHARGE POINT AND GROUND LEVEL. The source of the emergency VCM release was the double rupture disc assembly on reactor D-305. A process flow diagram of the system is shown in Figure 2. B. DESCRIPTION OF THE NATURE AND CAUSE OF THE DISCHARGE. The emergency VCM release was the result of the premature failure of the two rupture discs in the double rupture disc assembly. The rupture discs were rated to burst at 200 psig pressure but failed at 110 psig, which is 10 psig below normal polymerization pressure. The double disc assembly had been in service for 103 days. Subsequent metallurgical evaluations revealed that the rupture discs had suffered a particular type of corrosion commonly referred to as chloride stress corrosion cracking. As explained in the discussion under Questions 21 and 3E, Conoco did not expect that chloride stress corrosion cracking would occur in either rupture disc during the 6-months that they would be in service. The corrosion was discovered by Conoco's metallurgical experts after microscopic analysis of the failed discs. The chloride stress corrosion cracking was the apparent cause of the rupture discs failing prematurely. C. DATE AND TIME (START/FINISH) OF THE DISCHARGE. The emergency discharge occurred on August 13, 1978, at approximately 8:20 a.m. The release continued for approximately 20 minutes until the reactor depressured. DTH 000071402 2 CONFIDENTIAL * D. APPROXIMATE TOTAL QUANTITY OF VCM DISCHARGED AND A COPY OF THE CALCULATIONS OF TOE EMISSION ESTIMATE IN SUFFICIENT DETAIL TO ASSESS THE VALIDITY OF SUCH CALCULATIONS. The premature failure resulted in the release of approximately 50,000 pounds of VCM. Standard Plant procedures in use at that time called for each batch to be charged with 50,000 pounds of VCM (in addition to the other reaction ingredients). At the point in time that the release occurred, the reactor had completed only 20 minutes of its approximately 5-1/2 hours of reaction time needed to complete the batch. It was assumed that the amount of VCM converted to PVC was insiginificant and that the entire 50,000 pounds was released. With this assumption, no calculations were required. E. THE DATE OF THE NOTIFICATION LETTER, REPORTING THE DISCHARGE TO EPA. IF THE DISCHARGE WAS NOT REPORTED TO EPA, PLEASE INDICATE WHY NOT. The date of the notification letter submitted to the EPA was August 18, 1978. F. A DESCRIPTION OF ALL CORRECTIVE STEPS TAKEN BEFORE AND DURING EACH DISCHARGE TO PREVENT AND/OR MINIMIZE THE RELEASE OF VCM TO THE ATMOSPHERE INCLUDING, BUT NOT LIMITED TO, SUCH STEPS AS: REACTOR, (1) EFFORTS TO INCREASE COOLING RATE ON PVC (2) EFFORTS TO TERMINATE REACTION IN PVC REACTOR, (3) EFFORTS TO VENT PVC REACTOR TO A RECOVERY PROCESS OR OTHER CONTAINMENT, OR (4) WITH LOSS OF INCINERATION CAPABILITY, EFFORTS TO REROUTE VCM EMISSION VENTS TO A HOLDING OR COLLECTION VESSEL, TEMPORARILY, UNTIL INCINERATION IS RESTORED OR PLANT IS SHUT DOWN. Corrective action was not taken prior to the discharge because the reaction was running smoothly and there was no indication or reason to expect a premature failure of the double rupture disc assembly. Once the rupture discs failed, there was no method available for stopping the VCM discharge. The only possible method avail able to reduce the amount of VCM released was to start the reactor recovery system. This action was not taken, however, because the operators on duty were appropriately concerned DTH 000071403 3 CONFIDENTIAL about drawing air into the reactor leading to a potential explosion. G. DESCRIBE ALL MEASURES TAKEN TO PREVENT A FUTURE OCCURRENCE OF EACH DISCHARGE LISTED INCLUDING, BUT NOT LIMITED TO, CORRECTIVE MEASURES REGARDING EQUIPMENT CHANGES, CHANGES IN OPERATING AND MAINTENANCE PROCEDURES, OPERATOR TRAINING AND DISCIPLINARY ACTIONS. STATE THE DATES WHEN EACH ACTION WAS INITIATED AND COMPLETED. WHERE INFORMATION ON THE CORRECTIVE MEASURES HAS NOT BEEN SUBMITTED TO DATE, EXPLAIN WHY THIS INFORMATION HAS NOT BEEN PROVIDED TO EPA AS REQUIRED BY 40 CFR, 161.10(c). Following the premature failure of August 13, 1978, the Plant took several steps to reduce the potential for premature failures. Following the premature disc failure on October 20, 1979, additional steps were taken to under stand and prevent premature rupture disc failures. This section describes the many preventative measures Conoco has taken in this area. With reference to the general requirements of 40 CFR 61.10(c), Conoco does not believe that notification of these various improvements was required by that Section, although notice of some of these actions has in fact been given to the agency. I. CHANGEOUT OF DISCS At the time the discs failed on reactor D-305 on August 13, 1978, the Plant had already decided to replace the Continental Discs on reactor D-305 with rupture discs manufactured by BS&B Corporation. (Please see Question 3A for further details concerning the decision for changing rupture disc brands.) The new BS&B discs (S-90 pre-scored discs) were installed in the double rupture disc assembly on reactor D-305 before the reactor was returned to service on August 13, 1978. BS&B representatives came to the Plant to augment the training of the Plant's maintenance personnel in the installa tion procedures for the S-90 discs. This retraining program was conducted in August, 1978. The two rupture discs that failed prematurely on August 13, 1978 were sent to Conoco's metallurgical specialists for analysis. Subsequent metallurgical evaluation revealed that the discs had suffered chloride stress corrosion cracking. The corrosion was detected by microscopic analysis and reported to the Plant on October 17, 1978. The new discs installed in the double rupture disc assembly on reactor D-305 on August 13, 1978 were made of nickel, which is DTH 000071404 4 immune to chloride stress corrosion cracking. The BS&B double rupture discs on the Plant's four original reactors were stainless steel, as were all of the discs used in the Plant up to that time. None of these discs had shown any evidence of chloride stress corrosion cracking in the sevenyear history of the Plant. Nevertheless, these double discs were changed to the new nickel discs as shown below. Notifica tion of our disc chageover was provided to EPA in general terms in our notification letter to EPA dated August 18, 1978. REACTOR D-301 D-302 D-303 D-304 DATE OF DOUBLE RUPTURE DISC CHANGEOUT November 14, December 1, December 1, December 1, 1978 1978 1978 1978 II. SPECIAL STUDY OF DISC RUPTURES While the changeout of the rupture disc material from stainless steel to nickel eliminated chloride stress corrosion cracking as a cause of premature rupture disc failures, premature failures of rupture discs due to other causes remained as a concern. A meeting was held on March 27 and 28, 1979, to coordinate Conoco's efforts in addressing the Vinyl Chloride NESHAP Standard, including the premature failure problem. As a result of this meeting, a study was initiated, the results of which had a significant impact on Conoco's under standing of premature failures of rupture discs. Following the above meeting, the rupture disc manufacturer (BS&B) was consulted, as they had been in the past, on several points regarding rupture discs. Their ideas on the cause of premature failures, the reliability of double rupture disc assemblies and of rupture disc-relief valve assemblies, and their recommendations concerning the preven tion of premature failures were collected for evaluation. Most of this information was collected by August of 1979 but followup work and additional testing has continued. At the same time, records were searched to document premature failures of rupture discs at the Oklahoma City PVC Plant, Aberdeen PVC Plant, R&D large reactor pilot plant, and the small reactor pilot plants in Ponca City. This data was DTH 000071405 CONFIDENTIAL analyzed for potential causes and trends. This analysis was completed during September 1979. Information supplied by the rupture disc manufacturer (BS&B) indicated that improper installation of rupture discs in rupture disc holders was a potential cause of premature disc failures. This was supported by discussions with other rupture disc vendors and with engineers in Conoco's Engineering Center. At that time, the rupture disc assemblies used in the Plant had to be field assembled. While the Plant's maintenance department had been trained in proper rupture disc installation procedures, it was believed that a differ ent rupture disc holder offered by BS&B, which could be shop assembled, offered an additional level of safety. The Plant therefore requested that money be included in the 1980 capital budget for the purchase and installation of the new rupture disc holders. As described in the next Section III, these rupture disc holders were placed on order.*and installed on the reactor double disc assemblies by November 1, 1979. Finally, tests were conducted during January of 1980 by Conoco in conjunction with BS&B (rupture disc manufacturer) and Consolidated (relief valve manufacturer). These experi ments were designed to determine if there was an optimum spacing and piping configuration which would protect the relief device if the primary disc (next to the reactor) failed prematurely. These tests showed that the spacing configuration used at the Plant was the best possible arrange ment. The data from all these tests and studies were still being collected and evaluated when a double rupture disc assembly on reactor D-303 failed prematurely at 168 psig on October 20, 1979. (Details concerning this release are presented later in this report.) This event, in conjunction with the incom plete results of the rupture disc study, led to a series of action steps designed to prevent premature failures of rupture discs. These action steps are discussed in the -following sections. III. IMPROVEMENTS RELATING TO THE DISC ASSEMBLIES 1. Improved Rupture Disc Holders Improved rupture disc holders were installed in place of the existing double rupture disc holders to help prevent premature disc failures. The holders used prior to this change had to be assembled in the field. The improved rupture disc holders are assembled under controlled condi- DTH 000071406 6 CONFIDENTIAL tions in the maintenance shop, which minimizes the problems of field installation and ensures proper torquing of the assembly. The new holders minimize stresses imposed by equipment vibration and/or the weight of the discharge piping on the rupture disc assembly. Improper disc positioning, improper torque, and stresses on the rupture discs are all theorized as potential causes of premature disc failures. The new holders for the double rupture disc assembly were ordered on October 23, 1979. Hie holders were installed on the reactors as shown below: REACTOR DATE OF NEW HOLDERS INSTALLATION (DOUBLE DISC ASSEMBLY) D-301 D-302 D-303 D-304 D-305 November 1, October 28, October 29, October*28, November 1, 1979 1979 1979 1979 1979 2. Improved Disc Holders Under Relief Valves The rupture discs under the two relief valves on each reactor were subject to the same potential causes of premature failure as the rupture discs in the double disc assemblies. While a premature failure of a rupture disc under a relief valve had not caused a relief valve discharge at the plant, it is believed that the pressure shock waves resulting from a premature rupture disc failure can cause the relief valve to open momentarily, resulting in a relief valve discharge. In order to reduce this possibility, the rupture disc holders for the rupture discs under the reactor relief valves were replaced with the new pretorqued holders. These holders were placed on order on October 30, 1979 and installed as shown below: REACTOR D-301 D-302 D-303 D-304 D-305 DATE OF CHANGE-OUT OF REACTOR SHELL ASSEMBLY REACTOR CONDENSER ASSEMBLY 12/11/79 12/11/79 01/09/80 01/09/80 01/18/80 01/18/80 01/21/80 01/21/80 01/03/80 01/03/80 3. Piping Improvements The double rupture disc assembly on each reactor is equipped with a discharge pipe which directs the material DTH 000071407 7 u released during a reactor discharge out and away from any personnel who may 1m in the area. It has been theorized that the weight of the discharge piping can impose stresses on the rupture disc which can result in a premature failure. Equipment vibration and the manner in which the discharge piping is supported can magnify these stresses. In order to reduce the possibility of a premature failure from these causes, the Plant has taken a number of action steps. These are discussed below: a. The discharge piping on each double rupture disc assembly was replaced with a lighter weight pipe. b. New support systems for the discharge pipes were installed. The new discharge piping supports were designed to prevent equipment vibration from magnifying the stresses imposed on the rupture discs. The support allows a small degree of movement in the discharge piping, making it immune to most equipment vibration. c. Steam is injected into the reactor cooling water jackets during certain steps in the batch process. This is a source of equipment vibration. A steam sparging system was installed in each reactor jacket to reduce equip ment vibration from this source. Items "a" and "b" were initiated following the October 20, 1979 release and were completed on November 1, 1979. Item "cM was initiated during the spring of 1980 and was completed on each reactor by October of 1980. 4. Pre-Installation Testing of Rupture Discs Rupture discs from each lot of discs shipped from the manufacturer are randomly selected and burst in the maintenance shop to verify the rated rupture pressure of the disc. This procedure was initiated on December 11, 1979 to help detect metallurgical and/or manufacturing defects or shipping damages which could lead to a premature failure. Under this program, the plant tests ten percent of the discs shipped, but at least one disc in shipments of less than ten. 5. Post-Installation Testing of Rupture Discs In addition to metallurgical and manufacturing defects, mechanical damage to the rupture disc during assem bly of the disc in the holder can cause premature failures. DTH 000071408 8 Thus, as recommended by the disc manufacturer, each disc is tested to 90 percent of its rated set pressure in the plant shop test stand after it has been assembled in its holder, but before installation on the reactor. A damaged disc should rupture in this test. Maintenance supervisory personnel are required to witness each assembly and pressure test. This procedure began on December 12, 1979. 6- Supervision of Hydrostatic Tests Mechanical damage to the rupture disc during the installation on the reactor can be a cause of premature failures. Maintenance supervisory personnel therefore observe all phases of the installation process in order to detect any possible damage. After installation is complete, the reactor is hydrostatically tested to 90 percent of the rated set pressure of the lowest rated disc on the reactor to help detect any mechanical damage. The hydrotest proce dures are carried out in a manner that minimizes the risk of damage to the disc. Engineering or operations supervisory personnel witness all hydrostatic tests. These procedures became effective on October 30, 1979. 7. Training in Rupture Disc Installation Procedures Because of the importance of proper rupture disc installation, representatives from the rupture disc manufac turer repeated training courses in proper rupture disc installation procedures during August 1978, October 1979, March 1980, and August 1981 for plant maintenance employees. 8. Reduction in Replacement Time Plant procedures required reactor rupture discs to be changed out after six months of reactor operation. Starting on December 11, 1979, the Plant began rupturing in the shop a majority of discs removed from the reactor to determine if their set pressure had changed. This program revealed that a few of the primary rupture discs in the double rupture disc assembly were failing below their rated pressure. Maintenance procedures, therefore, were modified in early 1981 so that the primary rupture disc in the double rupture disc assemblies was replaced after three months of service. 9. Improved Venting Procedures Part of the Plant's procedures for handling certain upset conditions call for VCM to be vented from one reactor DTH 000071409 9 to another. The procedures call for the reactor receiving the vent to be air-free. This is done to prevent the possi bility of an explosion during the venting operation. Air is removed from the empty reactor through a vacuum system which leaves the reactor under a deep vacuum. In evaluating items which could lead to a premature rupture disc failure, it was felt that the sudden changes in directional forces acting upon the rupture disc when the empty reactor's pressure changed from a deep vacuum to normal reactor operating pressures could result in shock damage to the disc. In order to prevent damage to the disc that could result in a premature failure, the procedure was modified. Current procedures call for the reactor to be pressured to approxi mately 5 psig with VCM before the venting process begins. This procedure was published in May, 1981. 10. Investigations into Secondary Disc Protection * The rupture disc manufacturer initiated work on its own to determine if a rupture disc system could be designed that, if a premature disc failure occurred, would fail in a way to not effect the downstream rupture disc or relief valve. While preliminary tests of a new, layered disc assembly were successful, subsequent tests showed that it would not be an improvement. The disc manufacturer has not been able to develop such a disc assembly. Also rupture disc manufacturers were canvassed to determine if they knew of a system that could be installed on the disc to detect disc damage and impending failure. One suggested a bicycle spoke triggered alarm that had been designed to detect rupture disc failure. That approach was rejected for a number of reasons including reliability and safety. A second manufacturer has a rupture disc opening alarm system that uses thin wires imbedded in a plastic film insert fitted next to the disc. When the disc opens, the wires are broken and the alarm sounds. However, this system was designed for low pressure applications (atmospheric storage tanks) and it only detects failure, not impending failure. Both manufacturers were asked to develop a system to detect disc damage and impending failure, but neither has done that to date. DTH 000071410 IV. IMPROVEMENTS TO PREVENT REACTOR PRESSURE RISES The scope of the action steps listed to this point concerns the prevention and detection of damage to rupture discs. While these action steps reduce the possibility of discs failing at pressures below their design setting, other causes of premature failures of rupture discs may exist of which neither Conoco nor the rupture disc manufacturers are aware. In order to further reduce the potential of premature rupture disc failures, Conoco has evaluated the emergency systems used to control reactors during process upset conditions and power failures. This evaluation concentrated on changes which would minimize the pressure rise in a reactor during upset conditions. Premature failures should be less likely to occur at lower pressures and, if one does occur, the downstream rupture disc or relief valve is more likely to contain the reactor contents without a discharge. Action steps resulting from these evaluations are described below. Due to the very general nature of Conoco's original waiver requests, we do not feel that notification of these improvements was required by 40 CFR 61.10(c). 1. Improvements to the Reactor Kill System The reactor kill system in use at the Plant during the October 20, 1979, incident consisted of an emergency short stop injection system and emergency reactor cooling water. The injection system consisted of a single 2-1/2 gallon injection pot which could be connected to any one of the reactors through a flexible hose with a quick disconnect coupling at the end of the hose. Normally, one or two injections of AMS (the reaction short stop agent) would bring a reactor under control in a power failure. The emergency cooling water passing through the reactor condenser would cause some of the VCM vapors to condense. The condensed VCM would drop back into the liquid reaction mass, providing both cooling and a low level of agitation. More VCM would then vaporize to maintain equilibrium pressure and temperature in the reactor, resulting in some boiling action in the slurry. The combination of boiling and condensation provides agitation to help mix the AMS with the VCM and thereby greatly improves the effectiveness of the reaction short stop agent. While this system was effective in killing the reactors, a short period of time was required to inject DTH 000071411 CONFIDENTIAL sufficient AMS into the reactors to kill them. During this time period, the reactor pressures would rise, increasing the possibility of a premature rupture disc failure. In order to reduce this possibility, it was decided to install a new AMS injection system. The new system includes several improvements which reduce the possibility of premature failures of rupture discs by minimizing pressure increases during power failures. The new kill system consists of a prefilled and prepressurized AMS injection pot for each reactor. Each injection pot is connected to a reactor through two separate injection lines. One line contains the necessary equipment to allow the control panel operator to actuate injection of the kill solution from the control panel. The second line is a manual injection line. The new AMS injection system was installed in stages. The injection pots and the manual injection lines were added first, and the second injection line and instru mentation were installed as instrument and equipment deliv eries allowed. The major completion dates are shown in the following table. REACTOR D-301 D-302 D-303 D-304 D-305 DATE OF INSTALLATION OF INJECTION POT AND REMOTE-OPERATED MANUAL INJECTION LINE INJECTION LINE 01/11/80 06/05/81 02/01/80 06/05/81 01/15/80 06/05/81 01/09/80 04/24/81 01/18/80 04/21/81 While the new injection system was being designed and installed, several changes were made to the then existing AMS injection system to improve its efficiency and reliability. These improvements are summarized below. a. All operating personnel were retrained in the emergency procedures. This was accomplished during shift meetings and consisted of lectures, field training, and dry runs. This training was completed by October 31, 1979. b. Since most power failures occur during severe thunderstorms and high wind conditions, a wind shield was built around the AMS injection system. Wind could blow AMS on the operator while he was refilling the system with AMS. Contact with AMS causes a strong burning sensation 12 which would greatly hinder an operator's effectiveness. The wind shield was installed during November, 1979. c. A supply of AMS was kept in the reactor area for both normal and emergency operations. The supply of AMS at the emergency injection system was increased to prevent an operator from having to obtain additional AMS from the normal operation storage area to bring all the reactors under control. This addition was made October 30, 1979. d. The supply of bottled nitrogen used for injecting the AMS into the reactors was increased to give additional assurance that the operators would not have to change nitrogen bottles during the reactor kill operation. The nitrogen supply was increased on December 10, 1979. e. The AMS injection hose was sonnected to the reactor through a quick disconnect fitting. Plant procedures called for the testing of each quick disconnect fitting and injection nozzle once each week to ensure its mechanical reliability. To give an additional layer of protection, a second quick disconnect fitting was installed on a separate nozzle on each reactor. These additional nozzles were installed on the reactors by November 1, 1979. f. As part of its emergency equipment, the Plant has a pneumatic fire detection system which will turn on the reactor area firewater sprinkler system automatically if a fire is detected. The fire detection element consists of small metal strips which will melt under low heat condi tions and vent the air out of the pneumatic system, thereby activating the system. During the power failure of October 20, 1979, several small leaks in the pneumatic fire detection system caused the air pressure in the system to drop to the point where the firewater system was activated. The fire water system was a hindrance to the operators during the reactor kill operation. In order to prevent the premature activiation of the Plant's firewater sprinkler system, the system was modified by adding an air supply tank. This tank provides a reserve supply of pressurized air to the sprinkler pneumatic control system in a power failure. This modification was completed on December 7, 1979. g. The premature activation of the firewater sprinkler system caused one of the two-way radios (which the operators use for communication with the control room) to fail. The loss of one radio did not hinder the two operators in their efforts to kill the reactors. However, their DTH 000071413 effectiveness would have been severely limited if both operators' radios had failed. In order to prevent this from occurring, waterproof radios were obtained for the operating personnel. These radios were placed on order on December 20, 1979 and arrived on February 28, 1980. 2. Improvements to the Cooling Water System The Plant has two supplies of emergency reactor cooling water which can be used during power failures or other process upsets affecting the cooling water system. The primary source of emergency reactor cooling water is a cross-connection between the city water supply to the Plant and the cooling water system. This system can be activated by turning a switch on the control panel which opens an air-operated valve separating the two systems. The second supply of emergency cooling water consists of a crossconnection, via a manual valve, between the Plant's fire water system and the cooling water system. The Plant's firewater system is supplied by two diesel driven firewater pumps. In order to improve the efficiency of the emergency cooling water system and, therefore, minimize the pressure increase in the reactors, the Plant modified the emergency cooling water supply as described below. a. A second cross-connection between the firewater and cooling water systems was installed. The second crossconnection was equipped with a remotely operated valve which is activated from the Plant control panel. This reduces the time required to initiate the secondary supply of emergency cooling water. This valve was installed on February 1, 1981. b. During power failures, the only equipment that requires emergency cooling water is the reactors where the polymerization reaction is in progress. On November 8, 1979, the plant installed one control panel switch that stops the cooling water flow to all major cooling water users except the reactors. This change decreased the time required to stop cooling water flow to non-reactor cooling water users and minimized the possibility of operator error. c. Upon loss of instrument air pressure, all valves controlling the flow of cooling water to the reactors go to the full open position, putting full cooling water flow to each reactor. In a power failure situation, the Plant needs to be able to direct the emergency cooling water flow to the reactors which are in the polymerization reaction DTH 000071414 14 step of the process and to prevent the flow of emergency cooling water to those reactors where the reaction is not in progress. To accomplish this, the Plant has a supply of emergency instrument air for power failures. The supply consists of two bottle racks, each containing 20 pressurized nitrogen bottles. The system bleeds nitrogen automatically into the instrument air system whenever the instrument air pressure drops to below 60 psig (95 to 100 psig is normal). The Plant is studying a project for installation of an emergency air compressor to add a second supply of emergency instrument air. d. The second supply of emergency reactor cool ing water for power failures consists of the Plant's fire water supply. However, a disadvantage of this system is that the Plant's firewater pumping capacity is inadequate for simultaneous cooling and firefighting. The Plant is studying a project which will increase the Plant's pumping capacity of firewater, allowing firewater to be available for both emergency reactor cooling and firefighting. 3. Improved Emergency Electrical Power Supply Currently, the Plant's emergency electrical power systems consist of a series of battery packs which provide electrical power for control panel instrumentation and control room lighting. The part of the battery system which supplies power to the control panel controls is backed up by a small 1-1/2 KW generator. The Plant is studying a project for expansion of the battery system and installation of a 35 KW generator. This project would provide generator backup capabilities for all of the battery packs and emer gency power for additional users. These users could include emergency area lighting for the reactor area, reactor recorder chart drives, and the Plant's two-way radio base station. 4. Power Line Protection The power supply to the Plant consists of above ground power lines supported by power poles. The power lines run along some of the Plant access roads and through the Plant parking lot. An automobile accident could result in a power failure affecting the entire Plant. The Plant has, therefore, installed metal guards around the power poles. The guards were installed by July, 1980. DTH 000071415 5. Infrared Surveys An electrical short in the Plant's motor control center, power distribution system, or in the electrical supply lines could result in a partial or complete power failure to the Plant. The Plant has conducted infrared surveys to detect potential trouble spots. 6. Severe Weather Radio The Plant has established procedures and guidelines for operating during severe weather. The implementation of the procedures is the responsibility of the Shift Supervisor. The Plant has obtained a severe weather radio for the Shift Supervisor's office to give him the information necessary to make his decisions. This radio was purchased on June 5, 1979. 7. New Pressure Indicators Quick and accurate monitoring of the pressure of each reactor is necessary during power failures so that the panel operator and Shift Supervisor can direct the killing of the reactors. Originally, the pressure of each reactor was recorded on a strip chart in the control room. A second digital pressure indicator for each reactor has been installed in the control room. The instrument loop for the second pressure indicator is completely separate from the original pressure recorder to ensure that the failure of a component of one loop will not result in the loss of reactor pressure indication. The new indicators were installed during May, 1981. V. IMPROVEMENTS TO LIMIT THE MAGNITUDE OF RELEASES Originally, the reactors were equipped with three separate pressure relief devices. These three devices consisted of a rupture disc/relief valve assembly designed to begin discharg ing at 185 psig, a second rupture disc/relief valve assembly designed to begin discharging at 195 psig, and a double rupture disc assembly designed to discharge at 200 psig. With this system, the two rupture disc/relief valve assem blies should have relieved before the double rupture disc assembly. In this manner, the magnitude of a release would have been limited to the amount which was required to lower the reactor pressure to below the relief valve set pressure, except for a worst case condition where the relief capacity of all three pressure relief devices would have been required. DTH 000071416 16 CONFIDENTIAL The October 20, 1979 premature failure of the double rupture disc assembly convinced the Plant that it could no longer depend upon the double rupture disc assembly to fail at its design pressure. The Plant has taken many action steps to prevent future premature failures of rupture discs. However, it was not known if the undetermined cause of the October 20, 1979 premature failure had been corrected. In order to reduce the possibility of a similar premature failure causing a VCM release and to reduce the quantity of VCM discharged if a release occurred, the Plant decided to replace the double rupture disc assembly on each reactor with two rupture disc/relief valve assemblies. The Plant now believes that a relief valve is less likely to open than a secondary rupture disc when a primary rupture disc placed between it and the reactor fails prematurely. In addition, if the relief valve does open, it should reseat, thereby reducing the quantity of VCM discharged-to the atmosphere. The decision to replace the double rupture disc assemblies on each reactor was made following the premature failure of October 20, 1979. Design of the relief system for replacement of the double rupture discs represented a significant engineering problem. Two critical items involved in sizing the relief system were the polymerization reaction rate and the relief valve capacity determinations. The polymerization reaction rate depends on the rate of free radical generation by decomposing reaction initiator. Initiator decomposition rate, and thus the polymerization reaction rate, is temperature dependent, increasing exponentially with increasing reactor temperature. Also the polymerization reaction is highly exothermic which leads to increasing reactor temperature if sufficient heat is not removed. Thus, in emergency situations, the exothermic reaction generates heat (increases temperature) which increases the reaction rate and causes even faster heat generation and temperature rise. This "snowballing" effect leads to poly merization reaction rates which are increasing so rapidly that small errors in the design of the reactor relief system can have a significant impact on the ability of the system to protect the reactor from unsafe over-pressure conditions. Therefore, careful computer simulation of the polymerization reaction rate was required as part of the relief system design work. Empirical data and reaction kinetics information from Conoco's Research and Development Department were used in the simulation. DTH 000071417 17 Additionally, a relief valve discharge from a PVC reactor involves multiphase, flashing, critical flow through the relief valve. Mathematical models for predicting the flow rate of material through relief valves were not readily available for these multiphase, flashing, critical flow conditions. Extensive study was required to determine how to simulate the capacity of a relief valve under these conditions. As with simulations of the polymerization reaction rate, careful computer simulations of relief valve capacities under these conditions were required to prevent inadequate relief sizing which could lead to unsafe over pressure of a reactor. The computer simulation work was sufficiently complete to allow the Plant to request funds for the project as part of its 1981 Capital Budget. When the budget was reviewed by Conoco Chemicals management during July, 1980, it was deter mined that the project should be approved as a 1980 capital project. The computer simulation work, process design, and cost estimate were completed by September 1980. The final approval for the project was granted and mechanical design work initiated. The project required additional nozzles to be placed in the reactor. The nozzles were installed during a Plant turnaround in May of 1981. The turnaround was origi nally scheduled for the fall of 1981 but was rescheduled for the nozzle installation. The relief valves where shipped from the manufacturer and arrived at the Plant during the last week of May. Installation of the rupture disc/relief valve assemblies in place of the double rupture discs was completed on all reactors by July 1, 1981. In addition to replacing the double rupture disc assembly, the Plant modified the existing reactor rupture disc/relief valve assemblies to improve the probability of the relief valve reseating. The relief valves on each reactor originally were installed at a slight angle from the vertical position. The relief valve manufacturer indicated that a vertical relief valve is more likely to reseat than one at an angle. The relief valves were moved to the vertical position during June, 1981. H. PROVIDE A COPY OF ALL DOCUMENTS RELATING TO EACH DISCHARGE. THIS SHOULD INCLUDE ALL RELATED PORTIONS OF REPORTS REGARDING EACH DISCHARGE INCIDENT INCLUDING, BUT NOT LIMITED TO, DAILY PLANT LOGS (E.G. REACTOR OPERATING LOGS AND GENERAL PLANT AND SHIFT FOREMAN LOGS). I>TH 000071418 cover. The requested documents are submitted under separate I. FOR EACH DISCHARGE, STATE WHETHER CONOCO BELIEVES IT WAS OR WAS NOT A VIOLATION OF 40 CFR, 61.64(a)(3) or 61.65(a) AND INCLUDE THE BASIS FOR THAT POSITION. The release which occurred on August 13, 1978 was the result of a sudden and unanticipated premature failure of the double rupture disc assembly on Reactor D-305. Conoco does not believe that this discharge was a violation of 40 CFR 61.65(a). Specifically, we do not feel that the discharge was preventable. Relief devices on PVC reactors are essential. Without devices to relieve excessive reactor pressure, the reactors could explode with catastrophic results. As dis cussed more fully in the following section, the#Plant's original decision to install Continental KBA discs on reactor D-305 was made after a thorough evaluation of available alternatives. The Plant and BS&B felt that the "buckling" problems which had been encountered with BS&B SRK discs presented a potentially serious safety hazard. Failure of discs to relieve at proper set pressures can result in cataclysmic explosions. The decision to install Continental KBA discs on Reactor D-305 was based upon an internal evaluation which led the Plant to the following conclusions: 1. At the time, the only alternative reverse buckling disc which could accommodate all of the Plant's disc assemblies was the RB-90 disc from BS&B. Since the RB-90 discs were virtually identical to the Continental KBAs, the KBAs were selected due to their lower cost and better delivery schedule.* 2. Data indicated that the Continental double rupture disc assemblies were effective in preventing VCM releases in the event of a premature failure of the primary (upstream) disc. Continental tests showed that a shockwave of 15,000 PSI per second would not cause a disc to fail if the maximum static pressure did not reach 90 percent of the design pressure of the disc. 3. Continental's data indicated that their discs were quite resistant to errors in torquing. *BS&B S-90 discs were available at this time, but only in a 6-inch size - not the 8-inch size. 19 DTH 000071419 CONFIDENTIAL 4. Conoco's Aberdeen plant had been using Continental discs and had reported no unusual problems when asked by the Oklahoma City plant. Hence, the Plant felt confidence in Continental's reputation as a disc manufacturer. Prior to August 13, 1978, Plant management had no evidence to indicate that Continental KBA double rupture discs were less effective than other available relief devices in preventing VCM releases during the kind of normal run conditions existing at the time of the August 13th release. To the contrary, there was some concern that the Continental discs (and the BS&B SRK discs on the Plant's other four reactors) could fold back under normal operation, leading them to fail at pressures higher than set pressure. The Plant had already decided in 1977 to replace the rupture discs on all five of its reactors with BS&B S-90 nickel discs. The BS&B S-90 assemblies were ordered^in July of 1977. Production problems at BS&B led to delays, however, such that delivery didn't take place until July of 1978. These were the first 8" S-90 assemblies delivered by BS&B to industry. Installation of the new assemblies had not been completed prior to the August 13, 1978 incident. One question that might arise at this point is why the Plant decided to switch from stainless steel to nickel discs in 1977. Our review of the Plant files shows no evidence that this decision was prompted by a concern over the corrosion or cracking resistance of stainless steel discs. Rather, the decision was based primarily upon the following considerations: 1. BS&B was discontinuing the SRK rupture disc line which the Plant had been using on its four original reactors. To the best of our knowledge, these discs had not presented a problem with premature failures leading to VCM releases. 2. The Continental KBA discs had proven to be a cause of excessive reactor downtime due to the development of small pinhole leaks in the primary discs. These leaks were caused by the discs' folding back on the rupture disc knife blades. This situation could cause the discs to fail at pressures much higher than their set pressure. 3. Evidence was available that nickel was more resistant to polymer buildup than stainless steel. Polymer buildup could prevent a rupture disc from rupturing at its set pressure. DTH 000071420 20 Prior to August 13, 1978, Conoco had no reason to suspect that chloride stress cracking would occur in its stainless steel rupture discs. Indeed, the reactors themselves are made of stainless steel. The Plant's original four reactors had been in place for seven years at the time of this incident with no evidence of chloride stress cracking. Futhermore, the internal surface of Reactor D-305 and the other reactors, which are also stainless steel, had been checked for chloride stress cracking on an annual basis. Since the beginning of in-reactor steam stripping in 1975, the part of the reactor wall immediately adjacent to the steam inlet has been inspected thoroughly for chloride stress cracking. This part of the reactor had been exposed to temperatures of between the slurry temperature of 225F and the steam temperature of 365F and is the point in the reactor thought to be most likely to develop such cracking. No evidence of chloride stress cracking was ever found. As a result, the Plant had no reason to anticipate.*the occurrence of chloride stress cracking in rupture discs that were in service for a maximum of 180 days and, being on the top of the reactor (and in the vapor space), were exposed to far less extreme temperatures. In this same vein, it must be noted that both of the discs which failed on August 13, 1978 had experienced chloride stress cracking. The only way that the downstream secondary disc could have been exposed to the reactor's internal conditions was if the primary disc had leaked. However, standard operating procedures call for all reactor disc assemblies to be checked for such leakage prior to charging. Where such leakage is found, the discs are changed out prior to charge. Hence, it is logical to suspect that the chloride stress cracking which caused the August 13th release was due to a latent defect in one or both of the discs involved. Since the Plant had no reason to suspect chloride stress cracking in in-use rupture discs, there would have been no conceivable reason for the Plant to have subjected new discs to the microscopic analysis necessary to reveal latent chloride stress cracks. In summary, there were no measures the Plant could have taken to anticipate or prevent this release. The discs in question had only been in service for 103 days prior to their failure, and the Plant had no evidence whatsoever to suspect that chloride stress cracking could occur in that period of time. DTH 000071421 CONFIDENTIAL J. FOR EACH RELIEF DISCHARGE OF VCM FROM A PVC REACTOR, PLEASE PROVIDE THE FOLLOWING ADDITIONAL INFORMATION: (1) REACTOR TEMPERATURE AND PRESSURE AT START OF DISCHARGE. The reactor pressure and temperature at the start of the VCM discharge was 110 psig and 119F. (2) COPY OF REACTOR TEMPERATURE CHART AND PRESSURE CHART, AT LEAST ONE HOUR BEFORE DISCHARGE OCCURRED AND ONE HOUR AFTER DISCHARGE WAS TERMINATED. The requested documents are submitted under separate cover. (3) DESCRIBE THE STATUS OF OTHER PVC REACTORS BEFORE, DURING AND AFTER EACH DISCHARGE INCIDENT. The status of the other four reactors prior to, during, and after the discharge is given below: REACTOR PRIOR TO DURING AFTER D-301 D-302 D-303 D-304 in polymerization in polymerization in steam stripping/ recovery in polymerization in polymerization in polymerization (awaiting resump tion of steam stripping recovery) in polymerization in polymerization in polymerization (awaiting resump tion of steam stripping recovery) in polymerization (4) DESCRIBE EXTERNAL CONDITIONS CONCERNING SUCH ITEMS AS WEATHER, UTILITY SUPPLIES AND OTHER PROCESS UPSETS REQUIRING ATTENTION DURING EACH DISCHARGE. There were no external conditions requiring attention during or before this release. DTH 000071422 22 Release of November 26, 1978 A. IDENTIFICATION OF SOURCE AND RELIEF DEVICE(S). INCLUDE A PROCESS FLOW DIAGRAM OF SOURCE RELATIVE TO DISCHARGE POINT AND GROUND LEVEL. The source of the VCM release was the rupture disc/relief valve assembly on the condenser of reactor D-301. The process flow diagram is shown in Figure 3. B. DESCRIPTION OF THE NATURE AND CAUSE OF THE DISCHARGE. The events leading up to the emergency relief valve discharge of November 26, 1978, began approximately one hour before the VCM discharge occurred. Reactor D-301 had been in the polymerisation phase of the batch cycle for approximately 90 minutes. As indicated by the cooling water flow, inert gases were collecting in the reacto* condenser. As is normal procedure, the control panel operator opened a small vent valve between the reactor condenser and the VCM vent collection header by operating a switch on the control panel. The vent process usually requires between 30 and 60 minutes. During this time period, a severe thunderstorm developed in the area which led to a complete power outage. At the time of the power outage, two of the Plant's five reactors had polymerization reactions in progress. Emergency power failure procedures (as described under Question 2F below) were pursued in order to avoid the development of excessive pressure in the two affected reactors. The emergency procedures were effective in killing the reaction in one of the reactors but were ineffective in controlling reactor D-301. This was because the panel operator had failed to close the inert vent valve on reactor D-301, thereby frustrating efforts to control the reactor. The portion of the emergency power failure procedures made ineffective by the panel operator's leaving the vent valve open are those that deal with the injection of reaction Short stop chemical (AMS) into the reactors. The reaction short stop injection system consists of an injection pot which is filled with AMS by the operators and pressured into the reactor with bottled (high pressure) nitrogen. The AMS injection point on reactor D-301 was tied into the same piping arrangement as the reactor inert gas vent line. (See Figure 9 for details.) Since the valve to the low pressure vent collection header was open, the AMS apparently went to the low pressure header rather than into reactor D-301. DTH 000071423 Unaware that the vent valve was open, and that the AMS was not going into the reactor, the operators at the reactor continued to inject more AMS until they were ordered to evacuate the area because the VCM release was imminent. The failure to close the inert vent valve prevented the operators from controlling the reactor and resulted in the VCM release. The operator not only failed to close the valve when the emergency occurred, but failed to detect his error when repeated attempts to kill the reactor failed. As described in the discussion under Question 4A3, the panel operator was well trained in the operation of the control panel and had been through at least one previous power failure where the Plant was controlled without a VCM discharge. C. DATE AND TIME (START/FINISH) OF THE DISCHARGE. The relief valve discharge began at approximately 2:40 a.m. The duration of the discharge was not recorded. D. APPROXIMATE TOTAL QUANTITY OF VCM DISCHARGED AND A COPY OF THE CALCULATIONS OF THE EMISSION ESTIMATE IN SUFFICIENT DETAIL TO ASSESS THE VALIDITY OF SUCH CALCULATIONS. Approximately 30,000 pounds of VCM were released during the incident. The basis for this estimate is discussed in the notification letter to EPA dated December 1, 1978. The written calculations supporting this estimate are unavailable. E. THE DATE OF THE NOTIFICATION LETTER, REPORTING THE DISCHARGE TO EPA. IF THE DISCHARGE WAS NOT REPORTED TO EPA, PLEASE INDICATE WHY NOT. 1978. The discharge was reported by letter dated December 1, F. A DESCRIPTION OF ALL CORRECTIVE STEPS TAKEN BEFORE AND DURING EACH DISCHARGE TO PREVENT AND/OR MINIMIZE THE 'RELEASE OF VCM TO THE ATMOSPHERE INCLUDING, BUT NOT LIMITED TO, SUCH STEPS AS: REACTOR, (1) EFFORTS TO INCREASE COOLING RATE ON PVC (2) EFFORTS TO TERMINATE REACTION IN PVC REACTOR, (3) EFFORTS TO VENT PVC REACTOR TO A RECOVERY PROCESS OR OTHER CONTAINMENT, OR DTH 000071424 24 (4) WITH LOSS OF INCINERATION CAPABILITY, EFFORTS TO REROUTE VCM EMISSION VENTS TO A HOLDING OR COLLECTION VESSEL, TEMPORARILY, UNTIL INCINERATION IS RESTORED OR PLANT IS SHUT DOWN. As soon as the power failure occurred, the Plant took immediate action steps to bring the two affected reactors under control. The normal Plant operations staff at that time consisted of one shift supervisor, one control panel operator, and two outside operators. One outside operator is normally assigned to the reactor area and the other is assigned to the non-reactor portions of the Plant. As soon as the power failure occurred, all normal operating duties were suspended and the four operations personnel took action to control the reactors. The two outside operators went to the two affected reactors and began to inject the reaction short-stop agent. Their efforts continued until the pressure in reactor D-301 reached the point that a discharge was imminent. At that point, the shift supervisor ordered the reactor area evacuated. When the power failure occurred, the control panel operator turned the switch on the control panel, which opened an air-operated valve and allowed emergency cooling water (city water) to enter the cooling water supply system. He then operated the reactor cooling water controls such that the flow of emergency cooling water was directed to the two affected reactors and not to the other users. The panel operator then monitored the affected reactors and kept the other Plant personnel informed of their status. When the injections of AMS did not seem to affect the reactor pressure rise, the shift supervisor opened the manual valve between the Plant's firewater system and the cooling water supply system, starting the second supply of emergency cooling water to the reactors in order to help control the reactors. It should be noted that the emergency cooling water serves two important functions. First, the emergency cooling water removes heat from the reactors, retarding the rise in reactor temperature and pressure. In addition, the removal of heat causes some of the VCM vapors in the reactor condenser to condense and drop back into the reaction mass. The action of the condensed VCM dropping into the reaction mass causes agitation, greatly improving the effectiveness of the reaction killing agent. Despite these efforts, the reactor relieved since the AMS apparently never reached the reaction mass. DTH 000071425 25 CONFIDENTIAL G. DESCRIBE ALL MEASURES TAKEN TO PREVENT A FUTURE OCCURRENCE OF EACH DISCHARGE LISTED INCLUDING, BUT NOT LIMITED TO, CORRECTIVE MEASURES REGARDING EQUIPMENT CHANGES, CHANGES IN OPERATING AND MAINTENANCE PROCEDURES, OPERATOR TRAINING AND DISCIPLINARY ACTIONS. STATE THE DATES WHEN EACH ACTION WAS INITIATE AND COMPLETED. WHERE INFORMATION ON THE CORRECTIVE MEASURES HAS NOT BEEN SUBMITTED TO DATE, EXPLAIN WHY THIS INFORMATION HAS NOT BEEN PROVIDED TO EPA AS REQUIRED BY 40 CFR, 61.10(c). Plant personnel investigated the events surrounding the release and evaluated alternatives for preventing similar VCM releases in the future. Two alternatives were considered: 1. Rely upon additional operator training to ensure that the vent valve would be closed when the reactor kill system was activated. .* 2. Modify the AMS injection piping such that the AMS can only flow into the reactor. The Plant pursued both alternatives, putting greater reliance on the second because of its greater reliability in preventing VCM releases in this situation. The modifications to the injection line are shown in Figure 10. The modifications were completed on the five reactors by December 1, 1978. H. PROVIDE A COPY OF ALL DOCUMENTS RELATING TO EACH DISCHARGE. THIS SHOULD INCLUDE ALL RELATED PORTIONS OF REPORTS REGARDING EACH DISCHARGE INCIDENT INCLUDING, BUT NOT LIMITED TO, DAILY PLANT LOGS (E.G. REACTOR OPERATING LOGS AND GENERAL PLANT AND SHIFT FOREMAN LOGS). cover. The requested documents are submitted under separate I. FOR EACH DISCHARGE, STATE WHETHER CONOCO BELIEVES IT WAS OR WAS NOT A VIOLATION OF 40 CFR, 61.64(a)(3) or 61.65(a) AND INCLUDE THE BASIS FOR THAT POSITION. Conoco does not believe that the VCM release of November 26, 1978 was preventable within the meaning of 40 CFR 61.65(a). As such we do not feel it was a viola tion of that section. The incident was caused by an unusual interplay of mechanical and human factors during a severe thunderstorm. DTH 000071426 26 With respect to the mechanics of the emergency AMS kill system, Conoco first became aware that the existing short-stop system could be ineffective due to inadvertent diversion of AMS to the VCM vent collection line during injection of the short stop on the day of the release, November 26, 1978. This problem had never occurred before and was not anticipated. The primary reason that this problem was not anticipated was that the Plant's training procedures, together with the Plant's sophisticated control panel lighting features, should have been adequate to prevent this release. Mr. Daniel Farrier, the individual in charge of the control panel at the time, had joined Conoco in March of 1973. In the years that followed, Dan became thoroughly familiar with control room operation, having worked as a control panel operator for over four years. - In addition to his extensive on-the-job training and experience, Mr. Farrier received formal training in emergency procedures. This training took place in several forms. First, the Plant's emergency manual contains an outline of the action steps that should be taken in the event of Plant upsets or power failures. This manual had been maintained during the entire time period that Mr. Farrier worked at the Plant. Plant policy calls for this manual to be updated on a periodic basis (usually once a year) and that all operations personnel be trained in it a minimum of once each year. This training usually took place as part of the Plant's monthly safety meeting program or in special training sessions. In addition to this training, three major programs in classroom training were conducted at the Plant during Mr. Farrier's employment. The first of these occurred in 1974. This program covered a range of subjects from basic mechanical and engineering principles to the theory and operation of different Plant systems. Mr. Farrier attended these classes. Extensive changes to Plant operating procedures and philosphies were made between 1974 and 1977 due to the efforts to reduce VCM emissions and exposure. The Plant felt that a complete retraining of the operations personnel was required. A process engineer was, therefore, detached from the Engineering Department to serve as temporary shift DTH 000071427 27 supervisor. In this job, the process engineer was able to become completely familiar with the Plant systems and possible upset conditions. When this learning experience was completed, the engineer was assigned, along with an operations supervisor, to completely rewrite the Plant operating manual. This project was completed in mic$-1977. The manual was then reviewed by the different Plant groups (including the operators). Extensive training classes were then held with each shift going over the new manual. This program included thorough training in emergency procedures and the detection of reactor upset conditions. Practice runs were made with each shift simulating various emergency conditions. After each "dry run", the process superintendent and the operators would critique the performance of the test. Mr. Farrier participated in this training program. In the summer of 1978, the new equipment to bring the Plant into compliance with the EPA-VCM emission regulations was installed. The Plant operating manual was revised to include the new equipment and procedures. Training classes were conducted in these new sections of the operating manual. Mr. Farrier participated in this training program. Mr. Farrier's extensive operator experience and training gave him a detailed knowledge of the emergency procedures and equipment. He had served as a control panel operator during a power failure in 1976 when three reactors were successfully killed without incident. When repeated injections of AMS had failed to kill the reactor on November 26, 1978, it is reasonable to assume that he would check the reactor control instrumentation. The reactor controls are installed in a color coded graphic representation of the reactor and are supplied with backup power. The control valve switches appear in their appropriate position in the graphic assembly, and green (open) and yellow (closed) lights represent the valve positions. A quick glance at the control panel would have shown that two reactor valves had green (open) indications instead of one. All other lights on the reactor panel were yellow. Observing that an additional valve was open and the fact that the emergency kill procedures were ineffective should have led Mr. Farrier to suspect the cause of the problem. The only realistic way to characterize the November 26th occurrence is as an unpreventable accident. In the real-world industrial setting of a chemical plant during a severe thunderstorm and power failure, individuals can make mistakes. Control panel warnings and special automated precautions can minimize the number of such mistakes but they cannot eliminate DTH 000071428 28 them. Prior to this occurrence, the Plant had taken numerous measures to increase its ability to kill runaway reactors. Training programs in emergency procedures were held at which Mr. Farrier was a participant. The emergency kill system had proven itself effective in power failures, including the killing of Reactor D-302 on November 26, 1978. The control panel was designed to provide a clear picture of the status of all reactor valves. Despite these and other precautions, Mr. Farrier made a mistake under the stressful conditions of a power failure. J. FOR EACH RELIEF DISCHARGE OF VCM FROM A PVC REACTOR, PLEASE PROVIDE THE FOLLOWING ADDITIONAL INFORMATION: (1) REACTOR TEMPERATURE AND PRESSURE AT START OF DISCHARGE. The reactor pressure and temperature at the start of the VCM discharge were 183 psig and 163F. (2) COPY OF REACTOR TEMPERATURE CHART AND PRESSURE CHART, AT LEAST ONE HOUR BEFORE DISCHARGE OCCURRED AND ONE HOUR AFTER DISCHARGE WAS TERMINATED. The requested documents are submitted under separate cover. (3) DESCRIBE THE STATUS OF OTHER PVC REACTORS BEFORE, DURING AND AFTER EACH DISCHARGE INCIDENT. The status of the other four reactors prior to, during, and after the VCM discharge is given below. REACTOR PRIOR TO DURING AFTER D-302 in polymerization (reaction killed) in polymerization (reaction killed) in polymerization (reaction killed) D-303 in polymerization (charged but not initiated) in polymerization (charged but not initiated) in polymerization (charged but not initiated) D-304 stripped product partially dumped stripped product partially dumped stripped product partially dumped D-305 paritally recovered and steam stripped partially recovered and steam stripped partially recovered and steam stripped DTH 000071429 29 (4) DESCRIBE EXTERNAL CONDITIONS CONCERNING SUCH ITEMS AS WEATHER, UTILITY SUPPLIES AND OTHER PROCESS UPSETS REQUIRING ATTENTION DURING EACH DISCHARGE. From the start of the power failure until the release occurred, the operators did not have any other upset conditions which required their attention. External factors did exist which made their job more difficult. These are listed below: a. thunderstorm. The Plant was experiencing a severe b. The Plant had experienced a power failure. c. The reactor area firewater sprinkler system activated during the power failure. 000071430 dth 30 Release of July 22, 1979 A. IDENTIFICATION OF SOURCE AND RELIEF DEVICE(S). INCLUDE A PROCESS FLOW DIAGRAM OF SOURCE RELATIVE TO DIS CHARGE POINT AND GROUND LEVEL. The source of the emergency VCM release was the rupture disc/relief valve assembly on the condenser of reactor D-305. A process flow diagram is shown in Figure 4. B. DESCRIPTION OF THE NATURE AND CAUSE OF THE DISCHARGE. The Plant employs a batch process for producing polyvinyl chloride (PVC) from vinyl chloride monomer (VCM). The major processing steps involved in making each batch are listed in order as follows: 1. Charge the reactor with VCM, water, reaction initiator, and other micro-ingredients. 2. Polymerize VCM into PVC (exothermic reaction requiring heat removal). 3. Remove unreacted VCM from the PVC/water slurry by subjecting the reactor to vacuum conditions while steam is injected. tanks. 4. Dump slurry from the reactor to the blend During the polymerization process (step 2), reactor temperature and pressure are controlled by an automatic temperature controller which is located in the control room. The temperature controller automatically regulates the flow of cooling water to the reactor cooling water system in order to maintain a constant temperature and pressure in the reactor during the exothermic polymerization reaction. During step 3, this controller is placed in the manual mode and the cooling water valves are closed by the control panel operator in order to stop the cooling water flow to the reactor to allow the slurry to be heated to higher tempera tures to increase the removal of the unreacted VCM. The control panel operator returns this controller to the auto matic mode during or immediately after the reactor is charged for the next polymerization. If the controller is left in the manual mode, the cooling water control valves will not automatically open. DTH 000071431 31 Prior to the subject relief discharge, D-305 reactor was charged with the reaction ingredients and was in the process of heating up to the desired reaction tempera ture. The qualified panel operator failed to reset the temperature controller from the manual mode back to the automatic mode. Since everything appeared to be running smoothly, the control panel operator asked an outside opera tor (who was not qualified for control panel operation) to watch the control panel while he went to the restroom. This was a clear violation of established Plant rules of conduct. Within a few minutes after the qualified operator left the control room, both the high temperature and pressure alarms for reactor D-305 were activated. The alarms consist of a horn which sounds in the control room and a flashing light for each upset condition. The alarm light is labeled with a description of the upset condition. The outside operator who was left in *he control room shut off the alarm horn but failed to recognize that the temperature and pressure in reactor D-305 were continuing to increase and that cooling water flow had not been estab lished. Approximately 15 minutes later, while the qualified operator was still away from the control room, the reactor pressure reached 178 psig and the rupture disc/relief valve assembly opened, relieving the reactor pressure. The qualified control panel operator committed two serious errors in direct violation of clearly established Plant procedures. First, he forgot to place the reactor temperature controller in automatic. Second, he left an unqualified outside operator in charge of the control panel. The Shift Supervisor, who was a qualified panel operator, was available for his relief at the time. C. DATA AND TIME (START/FINISH) OF THE DISCHARGE. The emergency discharge occurred on July 22, 1979, at approximately 4:45 a.m. The release continued for approxi mately five minutes. D. APPROXIMATE TOTAL QUANTITY OF VCM DISCHARGED AND A COPY OF THE CALCULATIONS OF THE EMISSION ESTIMATE IN SUFFI CIENT DETAIL TO ASSESS THE VALIDITY OF SUCH CALCULATIONS. The discharge resulted in approximately 33,000 pounds of VCM being released during the incident. The basis for this estimate is discussed in the notification letter to EPA dated July 27, 1979. The written calculations supporting this estimate are included under separate cover. DTH 000071432 32 E. THE DATE OF THE NOTIFICATION LETTER, REPORTING THE DISCHARGE TO EPA. IF THE DISCHARGE WAS NOT REPORTED TO EPA, PLEASE INDICATE WHY NOT. The discharge was reported to the EPA by letter dated July 27, 1979. F. A DESCRIPTION OF ALL CORRECTIVE STEPS TAKEN BEFORE AND DURING EACH DISCHARGE TO PREVENT AND/OR MINIMIZE THE RELEASE OF VCM TO THE ATMOSPHERE INCLUDING, BUT NOT LIMITED TO, SUCH STEPS AS: REACTOR, (1) EFFORTS TO INCREASE COOLING RATE ON PVC (2) EFFORTS TO TERMINATE REACTION IN PVC REACTOR, (3) EFFORTS TO VENT PVC REACTOR TO ArRECOVERY PROCESS OR OTHER CONTAINMENT, OR (4) WITH LOSS OF INCINERATION CAPABILITY, EFFORTS TO REROUTE VCM EMISSION VENTS TO A HOLDING OR COLLECTION VESSEL, TEMPORARILY, UNTIL INCINERATION IS RESTORED OR PLANT IS SHUT DOWN. The unqualified operator did not realize that an emergency condition existed and, therefore, did not take any corrective action prior to the discharge. Once the discharge began, full cooling water flow was placed on the reactor to help minimize the magnitude of the release from the relief valve. G. DESCRIBE ALL MEASURES TAKEN TO PREVENT A FUTURE OCCURRENCE OF EACH DISCHARGE LISTED INCLUDING, BUT NOT LIMITED TO, CORRECTIVE MEASURES REGARDING EQUIPMENT CHANGES, CHANGES IN OPERATING AND MAINTENANCE PROCEDURES, OPERATOR TRAINING AND DISCIPLINARY ACTIONS. STATE THE DATES WHEN EACH ACTION WAS INITIATED AND COMPLETED. WHERE INFORMATION ON THE CORRECTIVE MEASURES HAS NOT BEEN SUBMITTED TO DATE, EXPLAIN WHY THIS INFORMATION HAS NOT BEEN PROVIDED TO EPA AS REQUIRED BY 40 CFR 61.10(c). After the subsequent investigation, the Plant took the following action steps to prevent this type of incident from causing a future VCM release: 1. The Plant published a letter which listed those employees who were qualified control panel operators and reemphasized the Plant policy requiring proper relief DTH 000071433 33 CONFIDENTIAL before leaving the control room. This list was (and contin ues to be) posted in the Shift Supervisor's office which is adjacent to the control room. This list is updated whenever new individuals become qualified to operate the control panel, and it specifically reminds Plant personnel that at least one qualified panel operator is to be in the control room at all times during Plant operation. This letter was originally published on July 23, 1979. 2. The operations personnel on each shift met with the Process Superintendent who emphasized to them that a qualified panel operator was to be in the control room at all times. 3. The Plant alarm system was evaluated to find a mechanical method of protecting the Plant against this type of occurrence. The Plant subsequently installed a second high pressure alarm which comes on at 149 psig (Normal operating pressure is 120 psig, normal alarm pres sure is 130 psig, and the lowest rated rupture disc pressure is 185 psig). The additional high pressure alarm at 140 psig activates a siren which can be heard not only in the control room, but also in the process area and Plant offices to alert all operators so that action can be quickly taken. Initially, this alarm was set up such that the alarm would come back on within 30 seconds after the alarm was acknowledged, and would keep coming back on until the pressure dropped below 140 psig. These alarms were installed on all reactors by September 5, 1979. This arrangement resulted in several difficulties. When the reactors are hydrostatically tested to ensure the mechanical reliability of the rupture discs, the siren would be activated during this test procedure. In addition, malfunctions of the reactor pressure transmitter resulted in the siren sounding until maintenance could be notified and make the necessary repairs. The siren can be easily heard in the residential area north of the Plant and can be bothersome to residents, especially when the tests or malfunctions occur at night. To correct these problems, the alarm system was modified such that each reactor high pressure alarm which activates the siren has its own special "acknowledge" switch. The acknowledge switch activates a large flashing red light whenever the high pressure alarm (siren) is in the acknowledged position. DTH 000071434 34 4. The panel operator involved in the incident, Dan Farrier, was suspended without pay for a period of three days, and a disciplinary letter was placed in his personnel file. On November 21, 1979, the same panel operator, Dan Farrier, once again left the control panel without securing proper relief. This action led to his termination on Novem ber 26, 1979. H. PROVIDE A COPY OF ALL DOCUMENTS RELATING TO EACH DISCHARGE. THIS SHOULD INCLUDE ALL RELATED PORTIONS OF REPORTS REGARDING EACH DISCHARGE INCIDENT INCLUDING, BUT NOT LIMITED TO, DAILY PLANT LOGS (E.G. REACTOR OPERATING LOGS AND GENERAL PLANT AND SHIFT FOREMAN LOGS). cover. The requested documents are submitted under separate I. FOR EACH DISCHARGE, STATE WHETHER CONOCO BELIEVES IT WAS OR WAS NOT A VIOLATION OF 40 CFR 61.64(a)(3) OR 61.65(a) AND INCLUDE THE BASIS FOR THAT POSITION. Conoco does not believe that the release of July 22, 1979 was a violation of 40 CFR 61.65(a). The basic cause of this release was the malfeasance of Mr. Daniel Farrier. By leaving the control panel in the care of someone he knew to be unqualified, Mr. Farrier committed a serious violation of clearly established Plant rules for which he was suspended from work without pay. Mr. Farrier's extensive experience in control room opera tions, as detailed in the discussion under Question 4A3, made him keenly aware of how quickly emergency conditions can develop in a PVC plant. At the very least, Mr. Farrier should have secured relief by a qualified operator before leaving his post. The Shift Supervisor, who was a qualified control panel operator, was in the immediate vicinity and could have been contacted from the control room by radio. Had Mr. Farrier not committed this serious breach of Plant rules, the release would not have occurred. All Plant systems were working normally, and the high pressure and temperature alarms would have alerted a qualified panel operator that cooling water flow had not been established. The mere turning of a switch would have solved the problem. dTH 000071435 35 Conoco does not believe that 40 CFR 61.65(a) imposes liability on a corporation under these circumstances. Conoco had taken all feasible measures to prevent this type of occurrence prior to July of 1979. Mr. Farrier had been thoroughly trained in control room operation and was com pletely aware of his obligation to ensure that he or another qualified panel operator was in the control room at all times. There is no way that Plant or corporate management can police its employees 24 hours per day to ensure that they do not endanger Plant operations through actions out side the scope of their employment.* J. FOR EACH RELIEF DISCHARGE OF VCM FROM A PVC REACTOR, PLEASE PROVIDE THE FOLLOWING ADDITIONAL INFORMATION: (1) REACTOR TEMPERATURE AND PRESSURE AT START OF DISCHARGE. The reactor pressure and temperature at the start of the VCM discharge were 178 psig and 165F. (2) COPY OF REACTOR TEMPERATURE CHART AND PRESSURE CHART, AT LEAST ONE HOUR BEFORE DISCHARGE OCCURRED AND ONE HOUR AFTER DISCHARGE WAS TERMINATED. The requested documents are submitted under separate cover. (3) DESCRIBE THE STATUS OF OTHER PVC REACTORS BEFORE, DURING AND AFTER EACH DISCHARGE INCIDENT. The status of the other four reactors prior to, during, and after the discharge is given below: REACTOR PRIOR TO DURING AFTER D-301 D-302 * D-303 D-304 in polymerization in steam stripping/ recovery in polymerization in polymerization in polymerization in steam stripping/ recovery in polymerization in polymerization in polymerization in steam stripping/recovery in polymerization in polymerization *The fact that Mr. Farrier was away from his station for more than 15 minutes creates a very real question as to his actual whereabouts during this incident. DTH 000071436 (4) DESCRIBE EXTERNAL CONDITIONS CONCERNING SUCH ITEMS AS WEATHER, UTILITY SUPPLIES AND OTHER PROCESS UPSETS REQUIRING ATTENTION DURING EACH DISCHARGE. There were no other upset or external conditions existing at the time of the discharge. DTH 000071437 Release of October 20, 1979 A. IDENTIFICATION OF SOURCE AND RELIEF DEVICE(S). INCLUDE A PROCESS FLOW DIAGRAM OF SOURCE RELATIVE TO DIS CHARGE POINT AND GROUND LEVEL. The source of the emergency VCM release was the double rupture disc assembly on reactor D-303. A process flow diagram of the system is attached as Figure 5. B. DESCRIPTION OF THE NATURE AND CAUSE OF THE DISCHARGE. During the afternoon of October 20, 1979, the Plant suffered a series of "power dips" and then a complete power outage. The interruption to the electrical power supply was the result of action taken by a property owner several miles from the Plant. This individual was attempt ing to remove a tree from his property and in attempting to protect a chain link fence, pulled the tree into a high voltage power line which supplies the Plant's electrical power. When the power dips began. Plant personnel took action steps to bring the four reactors in polymerization under control. (See discussion under Question 2F below. While these action steps were being undertaken, the double rupture disc on reactor D-303 failed prematurely at 168 psig. The discs were rated for 200 psig and had only been in service for two months. The then-existing Plant proce dures called for the change out of the rupture disc after six months of service. C. DATE AND TIME (START/FINISH) OF THE DISCHARGE. The emergency discharge occurred on October 20, 1979 at approximately 2:15 p.m. The duration of the release was not recorded. D. APPROXIMATE TOTAL QUANTITY OF VCM DISCHARGED AND A COPY OF THE CALCULATIONS OF THE EMISSION ESTIMATE IN SUFFI CIENT DETAIL TO ASSESS THE VALIDITY OF SUCH CALCULATIONS. The premature failure of the double rupture disc assembly resulted in the release of approximately 38,000 DTH 000071438 pounds of VCM. The basis for this estimate is discussed in the notification letter to EPA dated October 26, 1979. The written calculations supporting this estimate are included under separate cover. E. THE DATE OF THE NOTIFICATION LETTER, REPORTING THE DISCHARGE TO EPA. IF THE DISCHARGE WAS NOT REPORTED TO EPA, PLEASE INDICATE WHY NOT. The emergency discharge was reported to the EPA by letter dated October 26, 1979. F. A DESCRIPTION OF ALL CORRECTIVE STEPS TAKEN BEFORE AND DURING EACH DISCHARGE TO PREVENT AND/OR MINIMIZE THE RELEASE OF VCM TO THE ATMOSPHERE INCLUDING, BUT NOT LIMITED TO, SUCH STEPS AS: REACTOR, (1) EFFORTS TO INCREASE COOLING RATE-ON PVC (2) EFFORTS TO TERMINATE REACTION IN PVC REACTOR, (3) EFFORTS TO VENT PVC REACTOR TO A RECOVERY PROCESS OR OTHER CONTAINMENT, OR (4) WITH LOSS OF INCINERATION CAPABILITY, EFFORTS TO REROUTE VCM EMISSION VENTS TO A HOLDING OR COLLECTION VESSEL, TEMPORARILY, UNTIL INCINERATION IS RESTORED OR PLANT IS SHUT DOWN. In order to control the PVC reactors during the incident of October 20, 1979, the Plant personnel took immediate action steps which are outlined below. After each power dip, the control panel operator immediately reestablished reactor agitation and cooling in order to prevent any reactor temperature rise. These criti cal items were restarted from the control panel and were given priority over other Plant equipment. When the power dips continued, the panel operator initiated the supply of emergency cooling water to the reactors from the city water supply system. While the power was still cycling on and off, the emergency cooling water system supplied reactor cooling during the power dips. The two outside operators checked out the emergency equipment in the reactor area and then went to the reaction short stop injection system. When the power continued to cycle on and off, it appeared to the personnel that a complete power DTH 000071439 outage was imminent and the decision to kill the reaction was made. At the point in time when the premature failure occurred, an outside operator had just completed his second injection of kill agent into reactor D-303 and was standing near the top of the reactor condenser. Once the premature failure occurred, there were no possible methods of con taining the reactor contents. G. DESCRIBE ALL MEASURES TAKEN TO PREVENT A FUTURE OCCURRENCE OF EACH DISCHARGE LISTED INCLUDING, BUT NOT LIMITED TO, CORRECTIVE MEASURES REGARDING EQUIPMENT CHANGES, CHANGES IN OPERATING AND MAINTENANCE PROCEDURES, OPERATOR TRAINING AND DISCIPLINARY ACTIONS. STATE THE DATES WHEN EACH ACTION WAS INITIATED AND COMPLETED. WHERE INFORMATION ON THE CORRECTIVE MEASURES HAS NOT BEEN SUBMITTED TO DATE, EXPLAIN WHY THIS INFORMATION HAS NOT BEEN PROVIDED TO EPA AS REQUIRED BY 40 CFR 61-10(c). Conoco has not determined the cause of the premature failure. Conoco has taken numerous action steps to prevent possible causes of premature failures. In addition, Conoco has made and is continuing to make improvements in their emergency reactor control equipment in order to minimize or prevent any pressure rise in a reactor during upset condi tions. Conoco feels that these actions will further reduce the possibility of premature failures. All of the action steps taken by Conoco to prevent premature failures are described in detail in the answer to Question 2G for the release of August 13, 1978. H. PROVIDE A COPY OF ALL DOCUMENTS RELATING TO EACH DISCHARGE. THIS SHOULD INCLUDE ALL RELATED PORTIONS OF REPORTS REGARDING EACH DISCHARGE INCIDENT INCLUDING, BUT NOT LIMITED TO, DAILY PLANT LOGS (E.G. REACTOR OPERATING LOGS AND GENERAL PLANT AND SHIFT FOREMAN LOGS). cover. The requested documents are submitted under separate I. FOR EACH DISCHARGE, STATE WHETHER CONOCO BELIEVES IT WAS OR WAS NOT A VIOLATION OF 40 CFR, 61.64(a)(3) OR 61.65(a) AND INCLUDE THE BASIS FOR THAT POSITION. Conoco does not believe that the release of October 20, 1979 was a violation of 40 CFR 61.65(a). Prior to the premature failure of this BS&B double rupture disc assembly, the Plant had never experienced such a failure resulting in VCM release. Indeed, this type of disc had a proven track record of holding up to its set pressure range during the incidents of November 26, 1978 and July 22, 1979. DTH 000071440 40 CONFIDENTIAL The immunity of nickel to the type of chloride stress cracking which caused the August, 1978 disc failure was believed to have greatly reduced the possibility of premature rupture disc failure. Indeed, Conoco specialists never were able to identify the cause of the premature disc failure of October, 1979. As discussed earlier, the Plant, therefore, initiated a project soon after this release which, after extensive analysis and engineering work, led to the replacement of all double rupture discs at the Plant with rupture disc/relief valve assemblies. This step, while it will not prevent a VCM release in the event of a premature primary rupture disc failure, will reduce the likelihood of such a release, and should limit the amount of VCM released to the atmosphere. Prior to October 20, 1979, Conoco had taken numerous steps to understand and prevent premature rupture disc failures. These action steps were taken despite the Plant's confidence that a changeover to nickel discs would minimize the chance of future premature failures. These steps, which have been discussed in detail earlier included an intensive study of premature rupture disc failures. During this time period, Conoco was attempting to determine the cause and possible methods of preventing premature failures of rupture discs. The study of the problem was approached from several different vantage points, including the following: 1. A literature search was conducted to determine the extent that published information existed concerning the cause or prevention of premature failures of rupture discs. 2. The records of Conoco's PVC Plants and Research and Development Pilot Plants were examined to document the premature failure problem and to determine if trends or causes of premature failures could be established. 3. Extensive discussions were held with the rupture disc manufacturer and with experienced engineers in Conoco*s Engineering Center to determine what information and recommendations they had concerning the cause and prevention of premature failures. This study was still continuing at the time of the October 20, 1979 double disc failure. The rupture disc manufacturer thought that the most likely cause of premature failure was improper handling and installation of the disc. Other areas that were suspected by the Conoco Team at that time were damage to the disc during hydraulic pressure testing (hydrotesting) of the reactor, circumstances DTH 000071441 41 particular to certain reactor piping configurations, and manufacturing flaws. The Plant felt that it was adequately protected from these causes of premature failures as described below: 1. The rupture disc manufacturer had trained the maintenance department personnel in the correct installation procedures during August of 1978. The maintenance personnel had written instructions available to them on the correct installation procedures. These written instructions are supplied with the rupture disc in each new rupture disc container. 2. The hydraulic testing of the reactor to 140 psig had been a procedure which had been used for many years in the Plant. This procedure had not resulted in a premature failure leading to a VCM release in that time period and there was no reason to expect that the situation had changed. 3. There were no unusual piping configurations which were linked to premature failures leading to a VCM release at this Plant. In addition, at this time, the only known cause of a premature failure of a rupture disc leading to a VCM release at the Plant was the result of a chloride stress corrosion cracking, which cracking was impossible with the new type of nickel rupture disc. The Conoco Engineering and Research Center in fconca City had issued interim recommendations to help with the premature failure problem. At the time of the release, the Plant had not finished their evaluation of these recom mendations. The Plant's procedures at that time already incorporated items similar to the recommendations. In summary, this release was caused by the sudden and unexplained premature failure of a rupture disc during a power failure. Had the disc held properly. Plant emergency procedures would have successfully killed Reactor D-303 and prevented the release, just as they were successful in killing the other three reactors that were in the polymeri zation phase at the time of the power failure. Conoco does not believe that this discharge can realistically be called preventable. The Plant had taken all reasonable measures to understand and prevent premature rupture disc failures prior to this release. Despite these DTH 000071442 CONFIDENTIAL measures, this particular rupture disc failed prematurely for reasons Conoco was never able to determine. J. FOR EACH RELIEF DISCHARGE OF VCM FROM A PVC REACTOR, PLEASE PROVIDE THE FOLLOWING ADDITIONAL INFORMATION: (1) REACTOR TEMPERATURE AND PRESSURE AT START OF DISCHARGE. The reactor pressure at the start of the emergency discharge was 168 psig. The reactor temperature recorder did not ink the reactor strip chart during the power failure and, thus, the actual reactor temperature is not available. Calculations from physical property data indicate that the temperature was 160F. (2) COPY OF REACTOR TEMPERATURE CHART AND PRESSURE CHART, AT LEAST ONE HOUR BEFORE DISCHARGE OCCURRED AND ONE HOUR AFTER DISCHARGE WAS TERMINATED. The requested documents are submitted under separate cover. (3) DESCRIBE THE STATUS OF OTHER PVC REACTORS BEFORE, DURING AND AFTER EACH DISCHARGE INCIDENT. The status of the other four reactors prior to, during, and after the VCM discharge is given below: REACTOR PRIOR TO DURING AFTER D-301^ D-302 in polymerization, (reaction killed) partially recovered and steam stripped in polymerization, (reaction killed) partially recovered and steam stripped D-304^^ D-305^ in polymerization, (reaction killed) in polymerization, (reaction killed) in polymerization, (reaction killed) in polymerization, (reaction killed) in polymerization, (reaction killed) partially recovered and steam stripped in polymerization, (reaction killed) in polymerization, (reaction killed) ^ Each reactor had received two injections of reaction short stop injection chemical before the release occurred. (4) DESCRIBE EXTERNAL CONDITIONS CONCERNING SUCH ITEMS AS WEATHER, UTILITY SUPPLIES AND OTHER PROCESS UPSETS REQUIRING ATTENTION DURING EACH DISCHARGE. DTH 000071443 43 In addition to the power failure, another external condition which affected attempts to control the four affected reactors prior to the discharge was the Plant's firewater system. During the power failure, small leaks in the pneumatic fire detection system and a loss of makeup air (due to the power failure) resulted in the firewater system being activated. One of the firewater monitors which acti vated was aimed at the work area where the two operators were trying to kill the reactors. One operator was dis patched to reposition the monitor -- an action that reguired only a few moments' time. DTH 000071444 Release of March 23, 1980 A. IDENTIFICATION OF SOURCE AND RELIEF DEVICE(S). INCLUDE A PROCESS FLOW DIAGRAM OF SOURCE RELATIVE TO DISCHARGE POINT AND GROUND LEVEL. The source of the emergency VCM release was the rupture disc/relief valve assembly on reactor D-301. A process flow diagram is shown in Figure 6. B. DESCRIPTION OF THE NATURE AND CAUSE OF THE DISCHARGE. The reactor relief valve discharge which occurred on March 23, 1980, was the result of an unusual set of circumstances involving the use of an injection pot on the bottom of reactor D-301. This pot is used for the injection of both reaction catalyst and reaction termination chemicals. To completely explain the situation, the use of.-the injection system must be understood. After VCM, water, and a suspending agent have been charged to the reactor, an outside operator begins the catalyst injection process. Because of the hazards involved in handling catalyst, the system is a manual one requiring the complete attention of the operator. Established procedures require the outside operator to completely perform the following procedure without interruption: (Please refer to Figure 7.) 1. The reactor area operator pours the catalyst into the catalyst injection pot through a funnel and then shuts the valve below the funnel. Each reactor has its own catalyst injection system. 2. The reactor area operator opens the high pressure water flush valve pressuring the injection pot to over 200 psig. 3. The operator then opens the V-3 valve on the bottom of the reactor. The high pressure service water flushes the catalyst into the reactor which is at approximately 90 psig. DTH 000071445 45 4. Normally, the flushing of water through the catalyst injection system continues until the catalyst flush water meter indicates that sufficient water has been flushed through the system. In this particular case, the flush water meter was out of service for mechanical repair. In this circumstance. Plant practices called for the operator to flush the catalyst injection system for 3-5 minutes. The operator then closed the V-3 valve and the high pressure water flush valve. 5. The water remaining in the catalyst injection pot is then vented and drained. In the March 23 incident, the reactor area operator simply failed to perform steps 4 and 5. The outside operator had had extensive training in the use of the system and was thoroughly familiar with its operation. Normal operating procedures would require him te use the system over ten times each day that he worked as the reactor area operator. (The two outside operators rotate jobs so that each works as a reactor area operator every other day.) At the time the operator committed the error, he left the catalyst injection system before completing the specified procedure. The failure to complete the catalyst injection procedure resulted in the flush water continuing to enter the reactor. After approximately 2-1/2 hours, the reactor level reached the point where it began to limit the ability of the reactor condenser to remove the heat resulting from the polymerization reaction. Therefore, the reactor temper ature and pressure began to rise. The temperature and pressure rise, as indicated on the strip chart recorders, appeared to be a normal rise which occurs when a reactor system is marginally short of cooling capacity or when inert gases are building up in the condenser. (Venting of inert gases to the recovery system is a normal operation procedure.) The control panel operator took the appropriate steps to slowly vent the inerts from the reactor condenser. The rise in reactor temperature stopped approximately two degrees above the normal polymerization temperature and held there for approximately 15 minutes. When the reactor temperature and pressure began to rise again, the panel operator instructed the reactor area operator to inject one quart of AMS into the bottom of the reactor through the catalyst DTH 000071446 CONFIDENTIAL injection pot. (This is normal operating procedure in cases where reactor temperature or pressure are trending upwards.) The reactor area operator, upon finding the reactor catalyst injection pot pressured up, due to the previous operator's error, shut off the high pressure service water and began to drain the pot. Upon finding the catalyst injection pot in a non-routine condition, he failed to adequately check out the system before taking action. Reactor contents entered the catalyst pot through the open V-3 valve and began to discharge from the open drain valve on the catalyst pot, forcing the operator to immediately close the valve. This action caused the reactor contents (including VCM) to fill the catalyst injection pot. Before the pot could be used again, this material would have had to be flushed back into the reactor through the high pressure flush water system. Therefore, the second outside operator was dispatched to add two gallons of AMS to the reactor through the emergency reactor kill system at the top of the reactor. Two gallons of AMS is sufficient to completely kill a reactor batch with agitation. After the two gallons of AMS were added to the top of the condenser, the panel operator started the reactor recovery system and opened the reactor to it. When the reactor reached 160 psig, the panel operator instructed the outside operator to inject the entire contents of the new emergency AMS injection pot (approximately 25 gallons). When the injection of the 25 gallons of AMS was approximately half complete (less than one minute), the operator noted that the reactor pressure had jumped from 160 psig to 180 psig. The injection of the AMS was stopped at this point to prevent further pressure rise in the reactor. According to the reactor strip chart, the reactor held constant at approximately 180 psig for approximately five minutes, after which the reactor rupture disc (rated at 195 psig) and relief valve (rated at 185 psig) began to discharge the reactor contents. When the discharge began, the control panel operator shut off the reactor recovery system. The sudden jump in reactor pressure was a positive indication that the reactor was liquid full. The ineffective ness of the two gallons of AMS added to the reactor was another indication of a liquid full reactor since the AMS normally drops through the reactor condenser, which is full of VCM vapor, into the reaction mass. In this case, the AMS dropped into the liquid in the reactor condenser tubes preventing the immediate mixing of the AMS with the contents of the reactor. Immediate clean-out of the reactor contents DTH 000071447 47 from the catalyst injection system followed by AMS injection from this system may have effectively killed the reactor since this system injects into the bottom of the reactor. It should be pointed out here that the non-operational state of the flush meter also contributed to this release. One central meter is used to measure the flow of water going to the catalyst injection system on each of the five reactors. Normally, when the outside operator prepared to use the catalyst system on one of the other reactors, he would have detected the flow of water to the catalyst injection system on reactor D-301 by observing the flow meter. Indeed, between the time when the operator failed to finish the catalyst injection procedure on the date in question, and the time the reactor pressure and temperature began to climb, the system was used three times. However, the flow was not detected because the meter was temporarily out of service. C. DATE AND TIME (START/FINISH) OF THE DISCHARGE. The emergency relief valve discharge occurred on March 23, 1980, at approximately 9:15 p.m. The release continued for approximately four minutes. D. APPROXIMATE TOTAL QUANTITY OF VCM DISCHARGED AND A COPY OF THE CALCULATIONS OF THE EMISSION ESTIMATE IN SUFFICIENT DETAIL TO ASSESS THE VALIDITY OF SUCH CALCULATIONS. The discharge resulted in approximately 10,000 pounds of VCM being released during the incident. The basis for this estimate is discussed in the notification letter to EPA dated April 1, 1980. The written calculations supporting this estimate are submitted under separate cover. E. THE DATE OF THE NOTIFICATION LETTER, REPORTING THE DISCHARGE TO EPA. IF THE DISCHARGE WAS NOT REPORTED TO EPA, PLEASE INDICATE WHY NOT. The EPA was notified of the emergency relief valve discharge by letter dated April 1, 1980. DTH 000071448 48 F. A DESCRIPTION OF ALL CORRECTIVE STEPS TAKEN BEFORE AND DURING EACH DISCHARGE TO PREVENT AND/OR MINIMIZE THE RELEASE OF VCM TO THE ATMOSPHERE INCLUDING, BUT NOT LIMITED TO, SUCH STEPS AS: REACTOR, (1) EFFORTS TO INCREASE COOLING RATE ON PVC (2) EFFORTS TO TERMINATE REACTION IN PVC REACTOR, (3) EFFORTS TO VENT PVC REACTOR TO A RECOVERY PROCESS OR OTHER CONTAINMENT, OR (4) WITH LOSS OF INCINERATION CAPABILITY, EFFORTS TO REROUTE VCM EMISSION VENTS TO A HOLDING OR COLLECTION VESSEL, TEMPORARILY, UNTIL INCINERATION IS RESTORED OR PLANT IS SHUT DOWN. The action steps taken by the operators to prevent the VCM release are discussed in detail in the discussion under Question 2B above. For reference, they are briefly summarized here: 1. The panel operator vented the reactor condenser to a control device to remove the possibility of inerts building up in the condenser. 2. The reactor automatic temperature controller placed full cooling water flow to the reactor system. 3. The panel operator instructed the reactor area operator to add reaction short stop chemical to the bottom of the reactor through the catalyst injection system. (The catalyst system is used for normal additions of AMS to the reactor at the end of each polymerization batch.) 4. When the bottom kill system became filled with reactor contents, the panel operator instructed the other outside operator to inject two gallons of AMS into the reactor through the reactor emergency AMS kill system on the top of the reactor condenser. 5. The panel operator started the large reactor recovery system and vented the reactor to it until the VCM discharge occurred. 6. After the outside operator injected two gallons of AMS into the top of the reactor's condenser, the reactor pressure continued to rise. The operator then DTH 000071449 began to inject AMS from the new emergency kill system into the top of the reactor's condenser. G. DESCRIBE ALL MEASURES TAKEN TO PREVENT A FUTURE OCCURRENCE OF EACH DISCHARGE LISTED INCLUDING, BUT NOT LIMITED TO, CORRECTIVE MEASURES REGARDING EQUIPMENT CHANGES, CHANGES IN OPERATING AND MAINTENANCE PROCEDURES, OPERATOR TRAINING AND DISCIPLINARY ACTIONS. STATE THE DATES WHEN EACH ACTION WAS INITIATED AND COMPLETED. WHERE INFORMATION ON THE CORRECTIVE MEASURES HAS NOT BEEN SUBMITTED TO DATE, EXPLAIN WHY THIS INFORMATION HAS NOT BEEN PROVIDED TO EPA AS REQUIRED BY 40 CFR, 861.10(c). Action Steps Taken. The subsequent investigation of the relief valve discharge resulted in a number of action steps being taken. These steps were designed to prevent similar errors from occurring again and to detect such errors if they do occur. The action steps are detailed below: 1. The Process Superintendent held meetings with each shift and reemphasized to all operations personnel the importance of following established operating procedures. Special review was given to the requirement of giving full attention to the catalyst injection procedure until the operation is complete. These meetings were held on March 24, 25, and 26, 1980. Additionally, the Process Superintendent issued a letter on March 28, 1980 which restated for all operations personnel the procedures for catalyst injection. 2. The catalyst injection system was modified by including instrumentation capable of detecting a similar operator error. Specifically, a pressure switch set to activate at 80 psig was installed on each reactor catalyst injection line (refer to Figure 8). The pressure switch is activated during each catalyst charge and lights an indicating light next to the reactor controls on the control panel. If the pot's pressure remains above 80 psig for more than five minutes, an alarm sounds in the control room indicating that an abnormal condition exists which requires correction. These units were installed by August, 1980. Items Under Study. In addition to the action steps taken above, Conoco made an evaluation of the reactor system to determine if other possible mechanical or operational errors could potentially result in a liquid full reactor. A number of projects are being studied as a result of this evaluation. These projects are discussed below: DTH 000071450 1. The first step in the the reaction process is to charge the reactor with the correct quantities of VCM, water, and a suspending agent. One potential source of a liquid full reactor develops when excess quantities of one of the reaction ingredients are charged through either operational or mechanical error. Procedures have existed for many years to prevent the operational errors which could cause overcharging of a reactor. Also, the VCM charge quantity and the suspending agent charge quantity are each determined by two separate metering devices, thereby minimizing the possibility of mechanical errors. However, the charge water quantity is determined by only one meter. (A second water charge meter has now been installed.) 2. In order to prevent polymer buildup in the reactors, the Plant employs a reactor wash system where reactor cleaning chemicals are injected into the reactors through a spray nozzle. The Plant experienced .plugging of the spray nozzle during the polymerization process and subsequently installed a continuous water flush on the nozzle to prevent plugging. One potential source of a liquid full reactor is an excessive injection rate of water into the reactor from this source. A project is therefore being studied for detection and alarm of excessive injection rates. Currently, standard operating procedures to prevent excessive flush rates require operations personnel to period ically check the rotameters on the flush water injection lines. 3. Failure to completely drain the reactor prior to charging the reactor ingredients is another potential source of a liquid full reactor. Currently, two separate operating procedures are used to prevent this event from occurring. First, the control panel operator observes the end of the drain line from the reactor through a television camera. This establishes that draining is occurring, as well as the rate of draining and its termination point. Second, when excessive time is required for reactor evacua tion prior to charge, operators will check the reactor to determine if material is still in it. Long evacuation times are an indication that the reactor is not empty. A project is currently being studied for installation of the appropriate instrumentation to detect a reactor which has not been completely drained. 4. Another method of improving the protection of reactors from the operational and mechanical errors previously listed would be to install a high level alarm on / the reactor. Conoco is currently testing instrumentation to DTH 000071451 51 1 determine what type of level sensing instrumentation is required for this service. H. PROVIDE A COPY OF ALL DOCUMENTS RELATING TO EACH DISCHARGE. THIS SHOULD INCLUDE ALL RELATED PORTIONS OF REPORTS REGARDING EACH DISCHARGE INCIDENT INCLUDING, BUT NOT LIMITED TO, DAILY PLANT LOGS (E.G. REACTOR OPERATING LOGS AND GENERAL PLANT AND SHIFT FOREMAN LOGS). cover. The requested documents are submitted under separate I. FOR EACH DISCHARGE, STATE WHETHER CONOCO BELIEVES IT WAS OR WAS NOT A VIOLATION OF 40 CFR, 61.64(a)(3) or 61.65(a) AND INCLUDE THE BASIS FOR THAT POSITION. Conoco does not believe that the release of March 23, 1980 was a violation of 40 CFR 61.65(a). - The March 23, 1980 release was a highly unusual coincidence of operator errors. The first error by Mr. Scott Ward in failing to close the V-3 and high pressure water flush valves was the event which ultimately led to the release. Mr. Ward initially had had extensive training and experience in the use of the catalyst injection system and was thoroughly familiar with its operation. On this particular occasion, he simply failed to complete the specified procedures which he had completed literally hundred of times in the past. Under normal circumstances, Mr. Ward's error would not have led to a VCM release. Even if one of the outside operators fails to notice that the flush water has not been shut off, the ultimate rise in reactor pressure due to overfilling will be detected in the control room. This is in fact what happened on the day in question. After approximately 2-1/2 hours, the reactor level reached the point where it began to limit the ability of the reactor condenser to remove heat from the reactor. The resulting temperature and pressure rise, as indicated on the strip chart recorders, appeared to be a normal rise which occurs when a reactor system is marginally short of cooling capacity or when inert gases are building up in the condenser. The operator took the appropriate steps to slowly vent the inerts from the reactor condenser. When the reactor temperature and pressure began to rise again, the panel operator properly instructed the reactor area operator to inject one quart of DTH 000071452 52 CONFIDENTIAL AMS into the bottom of the reactor through the catalyst injection pot.* *The first indication of a hydraulically filled ("hydroed") reactor is an upward trend in pressure/temperature. Other causes can lead to the same type of upward trend, but in all cases the indication is that the reactor is marginally short of cooling capacity or that inerts are building up in the reactor's condenser. Routine procedures for controlling an upward trend in temperature/pressure involve venting inerts to the recovery system followed by a small addition of AMS if the venting does not solve the problem. A reactor is described as "hydroed" when AMS addition causes a downward trend in temperature/pressure followed by an upward trend requiring more AMS addition. If a reactor is not hydroed, the downward trend following AMS injection normally leads to stabilization of pressure/temperature. In any event, a control panel operator does not have indication of a hydroed reactor when the temperature/pressure initially start an upward trend. On March 23, 1980, the affected reactor was in its initial upward trend in temperature when the first action to combat the upward trend was taken -- venting inerts to a recovery system. Venting stabilized the temperature but did not cause a downward trend. When the temperature/pressure resumed an upward trend, the second action to combat an upward trend was initiated -- addition of a small amount of AMS. DTH 000071453 53 Killing a reactor in this fashion is normally a routine matter under these circumstances. In this particular case, however, the reactor area operator who was assigned to kill the reactor did not realize that the valve between drain the injection system and the AMS injection system (the same system used to inject catalyst) was open. By attempting to drain the injection System without closing this valve, reactor contents entered the injection system, requiring that the reactor contents be flushed back into the reactor before it could be used again. This led to immediate use of the backup AMS injection system on the top of the reactor. This system was unable to kill the reactor, however, due to the high level of slurry in the reactor condenser. Had this unusual accident not occurred, it is almost certain that the reactor would have been killed by the bottom injection of AMS. Indeed, the Plant had detected and killed reactors with high slurry levels several times in the past. Mr. Fred Graham, the outside operator who was attempting to kill the reactor from the bottom, had been thoroughly instructed in the use of the AMS/catalyst injec tion system. In this particular case, however, he failed to recognize an unusual condition. After this occurred, the Plant took other steps to prevent a release -- e.g., AMS injection from the top of the reactor, all to no avail. Had Messrs. Ward and Graham been poorly trained for their respective duties, it could be argued that the March 23rd release was preventable. Similarly, if the Plant had had reason to anticipate this chain of events, it could be argued that preventative measures could have been taken to avoid its occurrence. Yet, neither of these contentions can withstand analysis in this case. Both Mr. Ward and Mr. Graham had been thoroughly trained in their respective tasks. Nonethe less, on this particular occasion, they failed to perform their tasks completely. Neither error, by itself, would -have been sufficient to cause a VCM release under normal circumstances. The combination of these particular errors, however, led to an unforeseeable chain of events that cul minated in a VCM release. Conoco does not believe that this occurrence was preventable in light of Plant experience at the time. J. FOR EACH RELIEF DISCHARGE OF VCM FROM A PVC REACTOR, PLEASE PROVIDE THE FOLLOWING ADDITIONAL INFORMATION: DTH 000071454 54 (1) REACTOR TEMPERATURE AND PRESSURE AT START OF DISCHARGE. The reactor pressure and temperature at the start of the relief valve discharge were 180 psig and 168F. (2) COPY OF REACTOR TEMPERATURE CHART AND PRESSURE CHART, AT LEAST ONE HOUR BEFORE DISCHARGE OCCURRED AND ONE HOUR AFTER DISCHARGE WAS TERMINATED. cover. The requested documents are submitted under separate (3) DESCRIBE THE STATUS OF OTHER PVC REACTORS BEFORE, DURING AND AFTER EACH DISCHARGE INCIDENT. The status of the other four reactors prior to, during, and after the discharge is given below: REACTOR PRIOR TO DURING AFTER D-302(1) D-303 D-304 D-305 in dump in polymerization in polymerization in polymerization in dump in polymerization in polymerization in polymerization in dump in polymerization in polymerization in polymerization Dump is a condition where stripped slurry is drained from the reactor. (4) DESCRIBE EXTERNAL CONDITIONS CONCERNING SUCH ITEMS AS WEATHER, UTILITY SUPPLIES AND OTHER PROCESS UPSETS REQUIRING ATTENTION DURING EACH DISCHARGE. There were no other upset conditions at the time of the discharge which required operator attention. DTH 000071455 QUESTION 3 FOR EACH VCM DISCHARGE IN QUESTION 2, ABOVE, WHICH INVOLVED PREMATURE FAILURE OF RUPTURE DISK(S) OR A DISCHARGE FROM DOUBLE RUPTURE DISKS, PROVIDE THE FOLLOWING INFORMATION TO THE EXTENT THAT IT WAS NOT ADDRESSED IN QUESTION 2: A. DESCRIBE THE TYPE OF RUPTURE DISKS AND RUPTURE DISK MATERIAL BEING USED ON THE AFFECTED EQUIPMENT AND EXPLAIN WHY IT WAS DIFFERENT FROM RUPTURE DISKS ON SIMILAR EQUIPMENT USED IN THE SAME SERVICE AT THE PLANT. Release of August 13, 1978 On August 13, 1978, the double rupture disc assembly on reactor D-305 failed prematurely at 110 psig. The discs were rated for 200 psig. The rupture discs on the affected reactor were manufactured by Continental Disc Corporation. The rupture discs were stainless steel, reverse buckling type KBA discs equipped with knife blades. The other four reactors (D-301, D-302, D-303, and D-304) were equipped with rupture discs manufactured by BS&B. These rupture discs were stainless steel reverse buckling SRK type discs equipped with knife blades. To better understand why reactor D-305 was equipped with a different type of rupture disc than the other reactors, a brief history of the Plant's rupture discs is given below. When the Plant originally started operation during April of 1971, the original four reactors were equipped with Ametek S/N 3838 discs (Ametek was subsequently acquired by BS&B). These discs were not satisfactory and had to be replaced on a frequent basis due to leaks and other mechani cal problems. During October of 1971, Conoco placed an Ametek SRK rupture disc in one relief assembly to determine if it would give better service life. These discs did give a better service life, but mechanical problems still existed. Specifically, these discs would buckle and fold back against the knife blades. Eventually, the knife blades would cause a pinhole to develop in the disc. These pinholes were detected by the operator's check before each batch was charged. Charge would then be delayed and the disc would be replaced. The average disc life at this time was approximately three months. Prior to 1975, BS&B acquired the Ametek SRK rupture disc line as the result of a patent infringement case. DTH 000071456 56 After acquiring the rupture disc line, BS&B determined that the rupture diac did not meet their quality standard and made moves to discontinue the SRK rupture disc line. Both BS&B and the Plant became concerned with the safety of the rupture disc on the PVC reactors. BS&B indicated that a rupture disc folded back on the knife blades would not relieve until the development of pressures much greater than the set pressure. This was a serious safety problem. Buckled rupture discs were replaced whenever they were detected. At approximately this time (1975), Conoco was designing a fifth reactor for the Plant. It was decided that the new reactor was to be equipped with what was represented as a safer and more reliable rupture disc. It was determined that the Continental Disc Corporation's KBA discs appeared to be the best choice based upon the following information: 1. At the time, the only alternative reverse buckling disc which could accomodate all of the Plant's disc assemblies was the RB-90 disc from BS&B. Since the RB-90 discs were virtually identical to the Continental KBAs, the KBAs were selected due to their lower cost and better delivery schedule.* 2. Data indicated that the Continental double rupture disc assemblies were effective in preventing VCM releases in the event of a premature failure of the primary (upstream) disc. Continental tests showed that a shockwave of 15,000 PSI per second would not cause a disc to fail if the maximum static pressure did not reach 90 percent of the design pressure of the disc. 3. Continental's data indicated that its discs were quite resistant to errors in torquing. 4. Conoco's Aberdeen plant had been using Continental discs and had reported no unusual problems when asked by the Oklahoma City plant. Hence, the Plant felt confidence in Continental's reputation as a disc manufacturer. Reactor D-305 was brought on-line during August of 1976. Despite the Plant's original optimism, the Continental rupture discs proved to be a frequent source of reactor downtime due to having to replace leaking discs. These leak problems were similar to leak problems that had been encoun tered with the BS&B SRK discs. As pointed out earlier, the primary risk associated with these leaks was that discs would fail at set pressures that were too high -- not too low. *BS&B S-90 discs were available at this time, but only in a 6-inch size -- not the 8-inch size. 57 DTH 000071457 Discussions with the representatives from Continental Disc Corporation did not resolve the situation. The Plant therefore decided to replace the discs on all five reactors with BS&B S-90 discs. The new BS&B S-90 rupture discs and holders were placed on order during July of 1977. Because of production problems, BS&B was not able to deliver the new discs and holders until July, 1978. Indeed, the 8" double disc assemblies delivered to the Plant were the first S-90 discs of that size made by BS&B. Release of October 20, 1979 On October 20, 1979, the double rupture disc assembly on reactor D-303 failed prematurely at 168 psig. The discs were rated at 200 psig. The discs on the affected reactor were manufactured by BS&B and were a nickel, reverse buckling disc, type S-90. The rupture discs on the other four reactors were identical to those of D-303 and, prior to this time, had never resulted in a VCM release due to a premature failure at the Plant. B. DO ALL PVC REACTORS AT THE PLANT NOW UTILIZE THE SAME TYPE OF RUPTURE DISKS? IF SO, STATE THE TYPE AND MANUFACTURER OF THE DISKS, AND THE DATE OF CHANGE. IF NOT, STATE THE TYPE AND KIND USED, AND EXPLAIN THE REASONS FOR USE OF DIFFERENT TYPES OF RUPTURE DISKS. All reactors in the Oklahoma City PVC Plant are equipped with the same type of rupture disc. There are no longer any double disc assemblies on the reactors. The double disc assemblies were each replaced by two rupture disc/relief valve assemblies. Each reactor utilized BS&B nickel, reverse buckling, S-90 rupture discs. Prior to the replacement of double disc assemblies on each reactor, the double disc assemblies were equipped with BS&B reverse buckling S-90 discs as follows: Reactor D-301 D-302 D-303 D-304 D-305 Date of S-90 Double Disc Installation November 11, 1978 December 1, 1978 December 1, 1978 December 1, 1978 August 13, 1978 C. FOR EACH DISCHARGE STATE THE LENGTH OF TIME THE RUPTURE DISK(S) WAS IN SERVICE PRIOR TO ITS FAILURE. IF THIS IN-SERVICE TIME OF THE AFFECTED RUPTURE DISK IS NOT CONSISTENT WITH THE CURRENTLY ESTABLISHED PROCEDURE FOR REPLACEMENT, DESCRIBE THE INCONSISTENCY AND EXPLAIN WHY. 000071456 DTH 58 Release of August 13, 1978 The rupture discs in the double rupture disc assembly on reactor D-305 were installed on Hay 3, 1978, and had been in service for 103 days when they failed on August 13, 1978. At the time of the August 13, 1978 release, the KBA rupture disc next to the reactor in the double disc assembly had a variable life, depending upon when the disc folded back against the knife blades. The procedure at that time was to replace both discs when the "in reactor service" disc in the double disc assembly developed a pinhole or was observed to be folded back or after six months service time. Release of October 20, 1979 The rupture discs in the double disc Assembly on reactor D-303 were installed on August 23, 1979, and had been in service for 58 days when they failed prematurely on October 20, 1979. At the time of the October 20, 1979 release. Plant procedures called for all reactor rupture discs to be changed out every six months. Currently, the Plant does not employ the use of double disc assemblies. Procedures for changing out rupture discs under relief valves on the reactors call for them to be replaced every six months. D. DO ALL OF THE INITIAL PVC REACTORS AT THE PLANT STILL HAVE DOUBLE RUPTURE DISK ASSEMBLIES AS WELL AS SAFETY RELIEF VALVES? IF NOT, EXPLAIN WHY AND DESCRIBE THEIR CURRENT STATUS, INCLUDING DATE THAT APPLICABLE REVISION WAS COMPLETED. The Plant does not have double rupture disc assemblies on any of the reactors. Each reactor currently has four rupture disc/relief valve assemblies. Each double rupture disc assembly was replaced with two rupture disc/relief valve assemblies on the dates shown on the following table: DTH 000071459 Reactor Replacement of Double Rupture Disc Assembly D-301 D-302 D-303 D-304 D-305 6-16-81 6-18-81 6-23-81 6-25-81 6-30-81 The double rupture disc assemblies were eliminated in order to reduce the possibility of a premature primary rupture disc failure causing an emergency relief discharge of VCM and, if one should occur, to reduce the amount of VCM released through the reseating action of the relief valve. (See also Section V under the response to question 2G for August 13, 1978.) E. BASED ON CONOCO'S INVESTIGATION, WHAT..DOES CONOCO BELIEVE TO BE THE PRIMARY CAUSE OF THE PREMATURE FAILURE OF RESPECTIVE RUPTURE DISKS THAT RESULTED IN VCM DISCHARGES. The August 13, 1978 VCM release and the October 20, 1979 VCM release were caused by the premature failure of a rupture disc. Both failures involved double rupture disc assemblies. Release of August 13, 1978 The suspected cause of the August 13, 1978 failure was chloride stress cracking of both discs in the double disc assembly. Both of the failed discs were studied by an engineer in the Corrosion and Metallurgy Division of Conoco's Engineering Center. Chloride stress cracking was found in both discs. The discs were made of 316 stainless steel which can be susceptible to chloride stress cracking under some combination of conditions involving temperature, chlor ide and oxygen concentrations, water, and tensile stress. Stainless steel rupture discs had been used exclusively in the Plant since its startup in 1971 without any indication of chloride stress cracking having occurred. Also, the reactors themselves are made of solid 304L stainless steel which has similar susceptability to chloride stress cracking. The original reactors had been in service for seven years at the time of the double disc failure. They are inspected routinely for chloride stress cracking and none has ever been found. Furthermore, resin had been steam stripped in the reactors for two years with the part of the reactor immediately adjacent to the steam DTH 000071460 inlet being exposed to temperatures between the slurry temperature of 225F and the steam temperature of 365F. That part of the reactor was inspected with particular emphasis for chloride stress cracking and none has ever been found. As a result, the Plant did not expect to have chloride stress cracking occur service for a maximum of the reactor and in as high a tempertaure in the rupture discs that were in of only 180 days and, being on the top its vapor space, were not exposed to as the steam inlet area of the reactor. However, the downstream disc was found to have experienced chloride stress corrosion. That disc could only have been exposed to the reactor's internal conditions if the upstream disc had leaked. The reactor area operator procedures call for checking the pressure gauge and excess flow check valve downstream of the process side rupture disc with the reactor under 10 to 20 psig of VCM pressure before the reactor is charged. This check would indicate if leakage of the upstream disc was occurring. In light of these facts, there is some question as to whether the chloride stress cracking was initiated in the manufacturer's shop or warehouse prior to the discs being installed in the reactor. If so, the cracking would not have been visible to the naked eye and would not have been noticed by the manufacturer's quality inspectors or the Plant's maintenance crew that installed the discs. The chloride stress cracks in the failed discs were only detected after polishing, etching, and examination under a microscope. In any event, the stainless steel rupture discs on all the PVC reactors were replaced with nickel discs after this premature failure. Nickel is immune to chloride stress cracking. The Plant had been considering changing to nickel discs before the premature failure because a rupture disc vendor had provided information indicating that nickel was less susceptible to polymer buildup than stainless steel. Also, the Plant had consulted with an engineer in the Conoco's Corrosion and Metallurgy Division and had been told that nickel has a corrosion resistance equal to, or better than, stainless steel. Release of October 20, 1979 The cause of the other premature failure of a rupture disc, the release occurring on October 20, 1979, not been determined. has It is known, however, that premature failure of rupture discs can have many causes, including: DTH 000071461 61 1. Forming errors by the rupture disc manufacturer. 2. Integral inconsistencies and weaknesses in the metal sheet used in manufacturing the rupture disc. 3. Damage to the rupture disc in storage and transit. 4. Damage to the rupture disc during installation. 5. Damage to the disc during its service on the reactor. Conoco cannot state which, if any, of the above was the primary cause of the premature failure of the rupture disc assembly on October 20, 1979. The Plant is nonetheless taking extensive steps to minimize the possibility of another premature rupture disc failure. These steps are discussed in detail earlier. Since the releases occurred due to premature failure of two rupture discs in series, each with identical set pressures of 200 psig, it is logical to question why the downstream disc did not hold when the disc next to the reactor failed. This would have prevented the VCM release. Conoco explored this question with BS&B, the rupture disc manufacturer. They did expect the second disc to hold if the first disc failed prematurely. However, subsequent tests in their shop (at the Plant's request) with a rupture disc in series with a safety relief valve showed that failure of the rupture disc at pressures below the set pressure of the relief valve could still cause the relief valve to open momentarily. The same response could occur if two rupture discs are used instead of a rupture disc and relief valve.* Apparently, if the premature failure results in a sudden snap action opening of the rupture disc, a shock wave is created that can open the downstream rupture disc or relief valve. It is expected that premature failure of the upstream rupture disc at some level below set pressure (and in Conoco did testing with a disc/relief valve combination rather than a double rupture disc assembly because, at the time (January, 1980), engineering work was under way to determine how the double rupture disc assemblies could be replaced with rupture disc/relief valve combinations. DTH 000071462 62 particular a premature failure that results in only partial or incomplete opening of the disc) may not create enough of a shock wave to open the downstream rupture disc or relief valve. DTH 000071463 QUESTION 4 FOR EACH DISCHARGE LISTED IN THE RESPONSE TO QUESTION 2-B AS BEING CAUSED/ IN WHOLE OR IN PART, BY OPERATOR OR MAINTENANCE ERROR, PLEASE PROVIDE THE FOLLOWING INFORMATION: A. IDENTIFY EACH OPERATOR, MAINTENANCE PERSON AND SUPERVISOR RESPONSIBLE FOR THE ERROR AND PROVIDE THE FOLLOWING FOR EACH: (1) DATE AND TOTAL TIME WORKED ON THE DAY OF THE DISCHARGE AND ON EACH OF THE 7 DAYS PRIOR TO THE DISCHARGE. Each operator who was responsible for committing an error which led to an emergency relief valve discharge is listed below along with the number of hours which he worked for the previous seven days. Release of November 26, 1978 Operator: Daniel Farrier Date Hours Worked November November November November November November November November 19, 20, 21, 22, 23, 24, 25, 26, 1978 1978 1978 1978 1978 1978 1978 1978 8 8 0 0 8 8 8 8 Release of July 22, 1979 Operator: Daniel Farrier Date July July July July July July July July 15, 16, 17, 18, 19, 20, 21, 22, 1979 1979 1979 1979 1979 1979 1979 1979 Hours Worked 8 8 8 8 0 0 8 8 000071464 PTH Release of March 23, 1980 Operator: Scott Ward complete procedure) Date (First error, failure to Hours Worked* March 16, March 17, March 18, March 19, March 20, March 21, March 22, March 23, 1980 1980 1980 1980 1980 1980 1980 1980 0 0 12 12 0 0 12 12 Operator: Fred Graham check out system) Date (Second error, failure Hours Worked* to March 16, March 17, March 18, March 19, March 20, March 21, March 22, March 23, 1980 1980 1980 1980 1980 1980 1980 1980 0 0 12 12 0 0 12 12 *In August of 1979, the Operations Department had voted to change their work schedule from eight-hour days to 12-hour days. Each operator continued to work an average 42-hour work week just as he had with the eight-hour schedule. (2) BRIEFLY IDENTIFY ALL DUTIES FOR WHICH RESPONSIBLE AT THE TIME OF EACH DISCHARGE. Release of November 26, 1978 The operator error which eventually led to the emergency relief valve discharge of November 26, 1978, was committed during a time period when the operations personnel were attempting to kill the reaction in two reactors during an areawide power failure. The operator error prevented the injection of the reaction short stop chemical into one reactor which subsequently suffered a VCM discharge. The operator committing the error was a Number 1 Chemical Operator in charge of the Plant control room. This was his normal duty assignment. DTH 000071465 65 At the time prior to and during the release, the control panel operator's duties consisted of helping to control the pressure rise in the reactors. Specifically, his duties were: 1. Start the emergency electrical generator for the control panel instruments. This generator was located in the motor control center adjacent to the control room. The generator is started by pushing a start button on the generator. 2. Start the supply of emergency cooling water by turning the control switch which opens the block valve between the city water supply system and the cooling water system. 3. Open the cooling water control valve on each reactor in polymerization to establish full flow through the reactor condenser on the affected reactors. This is done by turning a switch located on the control panel near the controls for each individual reactor. At the time of this incident, two reactors were in the polymerization phase. 4. Check to make sure that the cooling water valves are closed on the nonaffected reactors so that the supply of emergency cooling water can be concentrated on the affected reactors. This is done by observing cooling water valve position indicators on the control panel. 5. Monitor the affected reactor instrumentation and communicate the status of the reactors to the operators attempting to kill the reactors with the reaction short stop injection system. 6. As time allows, shut off the motor control switches which would otherwise start motors automatically when power is restored. These actions are designed to prevent damage to electrical equipment and are not directly related to prevention of VCM releases. Items 1-4, it should be noted, require only a few minutes to complete. Thus, step 5 -- monitoring the affected reactor(s) -- is the singular and principal activity of the panel operator during most of this critical time period. Release of July 22, 1979 The two operator errors committed on July 22, 1979, which eventually resulted in the VCM discharge both oooo-n*66 66 CONFIDENTIAL \ occurred during the normal routine operation of the Plant. No upset condition required operator attention prior to the errors. Both errors were committed by the same control panel operator. Release of March 23, 1980 The VCM release of March 23, 1978 resulted from two operator errors committed by different individuals at different times. The first error occurred during routine operation of the Plant. The second error occurred during the response to the upset condition which resulted from the first error. Both operator errors were committed by Number 2 Chemical Operators whose duty assignments covered the reactor area of the Plant. Their general duties include field work (no control panel duty) involving the operation* of the reactor section of the Plant. These duties include the operation of the reactors, charge system, evacuation system, recovery system, steam stripping system, dump system, rinse system, and chemical wash system. They are also required to make up reactor charge chemicals, monitor equipment perfor mance, and respond to any process upsets. At the time the first error occurred. Plant policy limited Mr. Ward's duties to one job: injection of the reaction catalyst into the reactor. Established practice called for this task to be completed in a continuous fashion and no other duties whatsoever were to intervene. The Plant has this policy due to the hazards involved with handling catalyst. The catalyst must be properly handled because of its instability to atmospheric temperatures. Decomposition of the catalyst can be both rapid and violent. The Plant policy of not performing other tasks during the entire catalyst injection period (less than five minutes) is based upon these safety considerations. The second operator error occurred during the response to the upset condition caused by the first error. In reacting to the temperature/pressure rise, the panel operator instructed the reactor area operator to inject a small quantity of reaction termination chemical into the reactor to reduce the reaction rate, allowing the reactor cooling system to bring the reactor under control. At the point in time that this error was committed, this was the reactor area operator's only responsibility. DTH 000071467 67 (3) DESCRIBE HISTORY OF TRAINING IN EMERGENCY PROCEDURES TO PREVENT OR MINIMIZE VCM DISCHARGES. INCLUDE DATES AND SUBJECT MATTER OF ALL SUCH TRAINING PERIODS. The Plant has experienced three VCM releases as the result of operator error. Some of these errors involved emergency procedures and some involved normal routine operation of the Plant. Question 4A3 speaks directly of the emergency training each individual has received. Since the reason given for requesting this information spoke to determining if the release was a violation of the standard, we have interpreted this question to refer to the training that the operator had received in regard to the error he committed, not necessarily toward his training in emergency procedures. Complete documentation of the training that the Plant has given to its personnel is not maintained in the Plant records. However, through our search of the Plant files and through our knowledge of past training programs, we are confident that the information provided below for each operator is correct: Mr. Daniel Farrier Operational errors that Mr. Farrier committed were responsible for the VCM discharges of November 26, 1978, and July 22, 1979. Mr. Farrier's errors concern both emergency procedures and normal Plant operation. A summary of his employment history and training is given below. Mr. Farrier joined Conoco on March 3, 1973 as a Number 2 Chemical Operator. His duties at that time included all noncontrol room operations involving all sections of the Plant, including VCM railcar unloading, reactor area opera tions (including the reactor support systems), utility systems, product drying and storage systems, and emergency equipment. On May 14, 1974, Mr. Farrier was promoted to Number 1 Chemi cal Operator in charge of the control panel which governs and monitors the previously mentioned equipment systems. With the exception of some time spent as a temporary shift supervisor, Mr. Farrier remained in the position of Number 1 Chemical Operator until his termination on November 26, 1979. The basic training that Mr. Farrier received was conducted prior to his assuming the duties as a Number 2 Chemical Operator and then again as a Number 1 Chemical Operator. DTH 000071468 68 This training was conducted on shift by the Shift Supervisor and other qualified operators. In addition to the Plant Management, the Shift Supervisor and other operators that he would work with had to agree that he was capable of perform ing his duties before assuming them. Besides his extensive on-the-job training and experience, Mr. Farrier received formal training in emergency procedures. Mr. Farrier's training took place in several forms. The Plant's emergency manual consists of an outline of the action steps that should be taken in the event of certain emergency conditions, including power failures. The manual has been maintained during the entire time period that Mr. Farrier worked at the Plant. Plant policy calls for this manual to be updated on a periodic basis (usually once a year) and for all operations personnel to be retrained in emergency procedures at a minimum of once each year. This training usually took place as part of the Plant's monthly safety meeting program or in special training sessions. In addition to this training, three major programs in class room training were conducted at the Plant during Mr. Farrier's employment. The first of these occurred in 1974. Prior to this time, the Plant was in the process of developing the optimum operating procedures for Conoco's new large reactor technology. Because many of the procedures had been devel oped on shift, large variations existed on a shift to shift basis. To eliminate these variations, the Shift Supervisors (under the direction of the Process Superintendent) devel oped an operating manual and training program. The program covered a range of subjects from basic mechanical and engi neering principals to the theory and operation of different Plant systems. Mr. Farrier attended these classes. Extensive changes to Plant operating procedures and philoso phies were made between 1974 and 1977 due to efforts to reduce VCM emissions and exposure. Therefore, the Plant felt that a complete retraining of the Operations personnel was required. A process engineer was, therefore, dispatched from the engineering department to serve as a temporary shift supervisor. In this job, the process engineer was able to become completely familiar with the Plant systems and operations. When this learning experience was com pleted, the engineer was assigned, along with a supervisor, to completely rewrite the Plant operating manual. This project was completed in mid-1977. The manual was then reviewed by various Plant groups (including the operators). Extensive training classes covering the new manual were then held with each shift going over the new manual. Several DTH 000071469 69 alternative procedures were suggested during this training program and these were subsequently incorporated into the manual as appropriate. This program included extensive training in emergency procedures and the detection of reactor upset conditions. Practice runs were made with each shift simulating various emergency conditions. After each "dry run", the Process Superintendent and the operators would critique the performance of the test. in this training program. Mr. Farrier participated In the summer of 1978, the new equipment to bring the Plant into compliance with the EFA-VCM emission regulations was installed. The Plant operating manual was revised to in clude sections covering the new equipment and procedures. Training classes were conducted on these new sections of the operating manual. Mr. Farrier participated in this training program. * Mr. Farrier's operator error of November 26, 1978, prevented the Plant from performing its emergency procedures by caus ing the reaction short stop chemical agent to enter the VCM vent collection header instead of the reactor. Mr. Farrier's extensive operator experience and training gave him a de tailed knowledge of the emergency procedures and equipment. Indeed, he had served as a control panel operator during a power failure in 1976 when three reactors were successfully killed without incident. When repeated injections had failed to kill the reactor on November 26, it is reasonable to assume that the panel operator would have checked the reactor controls and recognized his error. The reactor controls are installed in a color coded graphic representation of the reactor. The control valve switches appear in their appropriate position in the graphic assembly and green (open) and yellow (closed) indi cating lights represent the valve positions. A quick glance at the control panel would have shown that two reactor valves had green (open) indications instead of one. All other lights on the reactor control panel were yellow. Observing that one additional valve was open and the fact that the emergency kill procedures were ineffective should have led Mr. Farrier to suspect the cause of the problem. On July 22, 1979, Mr. Farrier committed two operator errors during normal routine operation of the Plant. First, Mr. Farrier forgot to put the reactor temperature controller in the automatic mode after reactor charge. Second, Mr. Farrier left the control room in the care of an unqualified panel operator (a Number 2 Chemical Operator) for a period in excess of 15 minutes. plH 000071470 70 rvlEA 'U.w IW'1 it1 wn^ wmr % 'lr nifrtw 'T The first error was one of carelessness tut -odd act hev-*. resulted in an emergency condition had Mr. Farrier stayed in the control room. (The alarms would have alerted him tc his error if he had remained at his duty station.) By leaving the control room under unqualified supervision, he subjected the Plant to a substantial risk, even if the first error had not been committed. Operational upset conditions can develop at any time and quick response can be cricital as Mr. Farrier's five years of control room experience should have taught him. Mr. Farrier had adequate reason to know that he was not to leave the control room without securing proper relief. During his employment with Conoco, Mr. Farrier had received several letters (given to all Plant employees) which list the Plant rules of conduct and which state that violation will result in disciplinary action. One of these rules expressly prohibits the leaving of one's work palace without being properly relieved. Mr. Farrier was suspended for three days without pay follow ing the July 22, 1979, incident. On November 21, 1979, Mr. Farrier once again left the control room in the control of an unqualified panel operator. For this offense, Mr. Farrier's employment was terminated. Mr. Scott Ward The emergency relief valve discharge of March 23, 1980, was caused by two separate operator errors. The first of these was committed by Mr. Scott Ward. (Mr. Ward's error was to fail to complete the reactor catalyst injection procedure, resulting in flush water continuously flowing into the reactor.) This error was committed during the performance of Mr. Ward's normal duties. Mr. Ward joined Conoco on March 28, 1977, as a Utility Helper. The Utility Helper position is the entrance level position for the Plant. Utility Helpers can serve as either assistant maintenance men or as Number 2 Chemical Operators. Before a Utility Helper can serve as a Number 2 Chemical Operator, he has to be trained and subsequently qualified for that position. Mr. Ward was promoted to a Number 2 Chemical Operator on June 19, 1978. He remained in that position until he re signed to accept another job on July 28, 1980. During this time period, the responsibilities of the Number 2 Chemical Operator on each shift included all noncontrol room duties plH 000071471 71 CONFIDENTIAL involving all sections of the Plant, e.g. VCM railcar unloading, reactor area operations including the reactor support systems, utility systems, VCM incinerator, VCM emission recovery system, product dryer and storage systems, and emergency equipment. Mr. Ward's error involved the use of the catalyst injection system. Mr. Ward was thoroughly familiar with the system from both his on-the-job experience and his classroom train ing. When the incident occurred, Mr. Ward had served as a Number 2 Chemical Operator for over 1-1/2 years and had served in this capacity on a part-time basis for over a year before that. Mr. Ward worked as a reactor area operator every other day. On those days, his normal duties would have required him to use the catalyst injection system over ten times per day. Mr. Ward participated in the same training program as Mr. Farrier attended in 1977 and 1978. The use of the catalyst injection system was reviewed in detail during the 1977 training program. Mr. Fred Graham Mr. Graham committed the second operator error on March 23, 1980, which subsequently led to the relief valve discharge. Mr. Graham had been instructed to perform the normal reactor area operator duty of injecting a small quantity of AMS into the reactors through the catalyst injection bomb. (The pot is routinely used for both the injection of catalyst and AMS into the reactor.) When Mr. Graham reached the bomb, he immediately noted that the bomb was not depressured and drained as it should have been. Mr. Graham stopped the flow of water to the bomb and began to drain the pot. In doing so, Mr. Graham failed to adequately check out the rest of the system and failed to notice that the valve position indicator showed that the valve between the reactor and the pot was open. This action allowed the reactor contents to enter the injection pot making it useless until it could be cleared of VCM. Mr. Graham joined Conoco on January 30, 1980 as a Utility Helper. The Utility Helper position is the entry level position in the Plant and these individuals work as either maintenance helpers or as Number 2 Chemical Operators. Before a Utility Helper can serve as a Number 2 Chemical Operator, he must be trained and qualified for that position. Mr. Graham received that training and was working as a Number 2 Operator in charge of the reactor area on March 23, 1980. Mr. Graham was instructed to use the catalyst injection system to inject the AMS into the reactor. The use of the DTH 000071472 72 CONFIDENTIAL system to inject either catalyst or AMS into the reactor is a normal routine operation which takes place at least twice during the production of each batch of resin in each reactor. When Mr. Graham reached the injection system he immediately noted that the system was not in its normal condition when not in use. Realizing that he had an upset condition, Mr. Graham failed to check the position of the reactor valve before taking action to correct the situation. Since the closing of the reactor valve, the stopping of the flush water flow, and the draining of the bomb is an operation that is performed sequentially and without pausing, it is logical to assume that Mr. Graham would suspect that the valve was open. (4) A COPY OF PERSONNEL RECORDS RELATING TO ALL DISCIPLINARY ACTIONS AND JOB PERFORMANCE EVALUATIONS SINCE JANUARY 21, 1977. The requested documents are submitted under separate cover. DTH 000071473 73 CONFIDENTIAL QUESTION 5 PLEASE PROVIDE A DATED COPY OF ALL DOCUMENTS OR PORTIONS THEREOF REGARDING (1) STANDARD OPERATING AND MAINTENANCE (0 & M) PROCEDURES, (2) TESTING AND INSTALLATION PROCEDURES AND (3) TRAINING MANUALS (OR OTHER INSTRUCTIONS) WHICH HAVE BEEN EMPLOYED AT THE PLANT SINCE JANUARY 21, 1977 WHICH: A. SPECIFY HOW FREQUENT AND ON WHAT BASIS RUPTURE DISKS ON EQUIPMENT IN VCM SERVICE ARE REPLACED BEFORE FAILURE, B. SPECIFY PROCEDURES FOR PRETESTING, POST-TESTING AND INSTALLATION OF RUPTURE DISKS ON PVC REACTORS, AND C. RELATE TO PREVENTION OF RELIEF DISCHARGES OF VCM FROM PVC REACTORS AT THE PLANT. The requested documents are submitted under separate cover. DTH 000071474 74 QUESTION 6 SHORT-STOP SYSTEM A. BY LETTERS DATED DECEMBER 8, 1976 AND MARCH 29, 1977, CONOCO REQUESTED WAIVERS OF COMPLIANCE, PURSUANT TO 40 CFR 61.11, FOR CERTAIN EQUIPMENT LOCATED AT THE PLANT. IN REQUESTING A WAIVER OF COMPLIANCE WITH 40 CFR 61.65(a) FOR THE RELIEF VALVES AND OTHER RELIEF DEVICES ON EACH PVC REACTOR, CONOCO STATED THAT "AN UPGRADED SHORT-STOP INJECTION SYSTEM WILL BE INSTALLED TO IMPROVE RELIABILITY OF REACTION TERMINATION CAPABILITY" TO CONTROL REACTOR RELIEF VALVE DISCHARGES IN AN ABNORMAL SITUATION. WITH REGARD TO THIS WAIVER REQUEST, PLEASE PROVIDE A COPY OF THE ENGINEERING DESIGN, PROCESS DESCRIPTION AND STANDARD OPERATING PROCEDURES FOR THE SHORT-STOP INJECTION SYSTEM INSTALLED BY SEPTEMBER 1, 1977. The emergency AMS system design and the operating procedures for Reaction Short Stop and Heat-Kick Control, are submitted under separate cover in file folder 6A. The detailed operating procedures for heat-kick control are not applicable and are not included. The short-stop system had been installed for some time and had been used successfully in emergencies including two plant power failures that occurred in 1976. It was replaced with an improved manual injection system in 1977 after a plant investigation indicated that the existing system could be improved. Specifically, the volume of the injection pot was increased from one gallon to 2-1/2 gallons to shorten the AMS injection time by at least one-half. A level gauge was installed on the injection pot to help the operator control the injection. A large fill valve and funnel were added to shorten the time required to fill the pot after an injection. Also, a vent valve was added to the injection pot to further speed refilling. A storage rack and five 2-gallon containers were located next to the injec tion pot to help further shorten the time required to recharge the pot with AMS in an emergency. Finally, a second nitrogen bottle and regulator were valved to the existing bottle and regulator to provide a backup nitrogen supply if a regulator failed or if the nitrogen supply was lost. DTH 000071475 75 CONFIDENTIAL B. BY LETTER OF DECEMBER 1, 1978, FROM JOHN FRIEND TO HOWARD G. BERGMAN, CONOCO REPORTED TO THE ENVIRONMENTAL PROTECTION AGENCY THAT IT HAD REVISED THE INJECTION SYSTEM DESIGN ON EACH PVC REACTOR AT THE PLANT FOR REACTION TERMINA TION (REFERRED TO HEREIN SIMPLY AS "SHORT-STOP INJECTION SYSTEM"). (1) EXPLAIN WHY CONOCO DID NOT CONSIDER AND MAKE THIS REVISION TO SHORT-STOP INJECTION SYSTEM DURING THEIR APPROVED WAIVER OF COMPLIANCE PERIOD FOR THE APPLICABLE STANDARD, 61.65(a). Refer to Question 2, page 26, for an explana tion of how the injection system piping at reactor D-301 was installed at the time of the operator error and how it was changed to prevent that error from occurring again. Originally, the valve above the AMS injection connection was used as an atmospheric vent valve to purge inerts from the^condenser. After the OSHA VCM regulation was issued, the operators were told not to vent to the atmosphere through that valve to help minimize their VCM exposure. This condenser vent valve was connected to the new emission recovery system installed in 1978 as part of the Plant's compliance with the EPA's VCM standard. Once again the operators were allowed to vent inerts from this condenser (to the emission recovery to improve the operation of the condenser. With the of the period when no venting was allowed, there was system) exception a possibility that an operator would try to inject AMS into a reactor in an emergency with the vent valve open, as happened in the November 26, 1978 incident. However, that had not happened. The inert vent valve is remotely operated by a switch on the control panel. Position lights are installed in the switch assembly to indicate the valve position. The panel operator is expected to review the position of all the remote operated valves on a reactor in an emergency and close those that are not required to be open. Since carry-over of the injected AMS away from the reactor had not occurred in the Plant's 7-1/2 year history, and since instrumentation existed to alert the panel operator to open valves, this problem was not expected. (2) DESCRIBE ALL THE ALTERNATIVES CONSIDERED BY CONOCO PRIOR TO ITS DECISION TO REVISE THE EXISTING SHORT STOP INJECTION SYSTEM AFTER OCTOBER 21, 1978. Prior to November 26, 1978, no alternatives were considered since there was no indication or anticipation DTH 000071476 76 of the problem with the existing short stop injection system. The following two alternatives were considered to correct this kind of problem in the period between the reactor relief discharge on November 26, 1976, and the point a decision was made and reported in John Friend's December 1, 1978 letter to Howard Bergman of EPA: a. Train the Plant operators to close the valve in the VCM vent collection line before the short stop chemical is injected; or, b. Provide a separate short stop injection line connection to each reactor. Although the training option was pursued, the second alternative was selected since it will prevent carry-over of the short stop chemical away from the reactor into the vent line, and is not dependent on the-*operator remembering to close the vent collection line valve. (3) SUBMIT A COPY OF THE WRITTEN EMERGENCY POWER FAILURE PROCEDURES IDENTIFIED BY THE DECEMBER 1, 1978 LETTER AND ANY MODIFICATIONS TO THIS DOCUMENT TO AVOID RELIEF DISCHARGES OF VCM FROM THE PVC REACTORS. The written emergency power failure procedures in effect at the time of the November 26, 1978 reactor release and the detailed procedures for injecting the short stop chemical into the reactor are submitted under separate cover. (See file folders 6B and 6A, respectively.) The emergency power failure procedures were reviewed but not revised immediately following the November 26, 1978 release since the potential for a reactor release caused by such an operator error in the future was eliminated by changing the short stop injection point on each reactor. The duties and guidelines for operators during reactor upset conditions caused by power failure or other events were briefly listed in a letter by M. L. Ashby dated March 30, 1980 and submitted under separate cover in file folder 6B. There were no changes from the procedures in effect on November 26, 1978 however. John Friend restated the Plant's policy of injecting AMS into the reactors to stop polymerization immediately upon power failure in a letter to Mike Ashby dated November 21, 1979. John Friend defined in this letter DTH 000071477 a change in Plant operating philosophy to minimize the risk of VCM releases from reactors during potential upsets caused by severe weather. That letter is submitted under separate cover in file folder 6B. Mike Ashby, the Plant Process Superintendent, issued a letter to Plant operations personnel on January 14, 1980, detailing the operating procedures to be used with the new AMS emergency kill system that was then being installed. That letter is submitted under separate cover in file folder 6B. Mike Ashby issued a letter to Plant operations personnel on April 16, 1981, discussing the installation and operation procedures for the recently installed automatic valve in the firewater connection to the cooling water supply header. That valve allows the control panel operator to remotely start firewater flow through the cosling water system to provide cooling for the reactors in a power fail ure or other emergency where cooling water flow is lost. The letter is submitted under separate cover in file folder 6B. Chris Turner, the present Process Superinten dent, issued a letter on April 16, 1981 to Plant operations personnel discussing procedures to be followed in testing the automatic (remote operated) AMS injection valves on a weekly basis. It is submitted under separate cover in file folder 6B.* A copy of the latest revision to the Plant's emergency power failure procedures is submitted under separate cover in file folder 6B. There were equipment and instrumentation changes after the November 26, 1978 release but, excluding the relocation of the injection point, those changes were not a consequence of the November, 1978 release and are not -listed here. *The procedure for testing the mechanical reliability of the new AMS kill system was modified to improve the reliability check. Originally, the contents of each injec tion pot were to be injected into the reactor weekly. This check, however, would not detect an injection line that was almost plugged with polymer buildup. Furthermore, the injection of 15 gallons of AMS from each of the six AMS injection bombs could cause problems with the effluent water treatment system. The procedures were, therefore, modified to detect partially plugged lines and to decrease the amount of AMS injected into the reactor. 78 DTH 000071478 CONFIDENTIAL (4) STATE THE DATE WHEN CONOCO FIRST BECAME AWARE THAT THE EXISTING SHORT-STOP INJECTION SYSTEM WAS NOT ADEQUATE TO AVOID OPERATOR ERROR THAT COULD RESULT IN DISCHARGES OF VCM FROM PVC REACTORS PROHIBITED BY $61.65(a). Conoco first became aware that the existing short stop system could be ineffective due to the operator error of venting the reactor to the VCM vent collection line during injection of the short stop on the day of the release, November 26, 1978. As discussed above, that problem had never occurred before and was not anticipated. C. CONFIRM WHETHER OR NOT THE BACK-UP SHORT STOP INJECTION SYSTEM, WHICH YOU PROPOSED IN YOUR LETTER TO ME [DIANA DUTTON] DATED DECEMBER 12, 1979 AND WHICH WAS APPROVED FOR THE NEW PVC REACTOR, HAS NOW BEEN INSTALLED ON ALL OTHER PVC REACTORS AT THE PLANT. EXPLAIN WHY THIS BACK-UP INJECTION SYSTEM WAS NOT CONSIDERED FOR PVC REACTORS BEFORE SEPTEMBER 1, 1977 TO PREVENT RELIEF DISCHARGES OF VCM. The backup short stop injection system discussed in the December 12, 1979 letter has been installed on the new PVC reactor and on the other five PVC reactors. Also, the reactor and backup cooling water instrumentation changes mentioned in that letter have been completed and the double rupture discs on the first five reactors have been replaced with two relief valves in series with rupture discs. The new backup injection system uses pressurized pots next to each reactor to quickly charge the short stop chemical to the reactor in an emergency on command from the operator in the plant control room. During the fall of 1976, the Plant considered installing an AMS kill system for each reactor which would consist of a prefilled and prepressurized injection bomb on each reactor. The system would use bottled nitrogen pressure to force the AMS into the reactors. The Plant's only approved AMS supplier then informed the Plant that the effectiveness of the AMS would be questionable because the AMS would start to react with itself under nitrogen pressure. The AMS reaction inhibitor would break down without the presence of oxygen. The pots could not be pressurized with air or oxygen because of the possibility of creating an explosive gas mixture if the oxygen entered the reactors.* After *The current system does not have this restriction because Conoco's current AMS supplier uses an AMS reaction inhibitor which does not break down in the absence of oxygen. 79 DTH 000071479 investigating this alternative, it was rejected due to safety considerations. By 1977, plant experience with the small manual injection system had proven that it could prevent reactor releases in a Plant power failure. The design modifications included in the manual injection system installed in 1977 (see the discussion under Question 6A above) simplified and shortened the time required for the injection of the short stop chemical. The Plant was confident that the new manual injection system would be fully capable of stopping the polymerization reaction in the Plant reactors during an emergency. Therefore, it was decided to replace the small manual injection system with a larger and improved manual system in 1977 rather than the more complicated remote controlled injection system. It is also important to understand that, at the time of the decision to install the improved manual kill system. Plant management was not aware of any reactor releases which had been caused by the premature failure of a rupture disc. Also, the Plant had found the city water supply pressure to be adequate in a power failure to ensure effective killing of the polymerization reaction with manual AMS injection. It was not until the premature failure of the nickel double rupture disc assembly on October 20, 1979, that the Plant realized there was a significant potential for a premature failure and reactor release from a nickel disc. In addition to an investigation into the causes and prevention of premature failure, after this premature disc failure, the Plant decided that the emergency kill system should be designed to kill the reactors as quickly as possible to minimize pressure increases in an emergency. Obviously, the lower the reactor pressure, the less likely a premature disc failure will be. The manual kill system required some time for the sequential injection of AMS into the reactors, whereas the remote operated kill system can inject AMS into each reactor in less than a minute after the control panel operator remotely opens the emergency kill injection valves on each reactor. Following the October, 1979 release, the Plant came to recognize that this time savings could be important in limiting the reactor pressure rise thereby reducing the probability of a reactor release due to a premature rupture disc failure. Finally, it must be pointed out that in the thorough review of the Plant's procedures and systems to prevent reactor releases following the October 20, 1979 release, it was concluded that the city water supply pressure was no DTH 000071480 80 CONFIDENTIAL longer sufficiently reliable for city water to be a dependable source of backup cooling in a power failure. Backup cooling was very important with the manual kill system in use at the time because it provided agitation in the reactors due to the condensed VCM falling back from the condenser into the reacting slurry. Enough agitation was created to effectively mix the AMS with the VCM and stop polymerization. The Plant had a control panel operated valve in a connecting line between the in-plant city water supply line and the Plant's cooling water supply header. In a power failure or other emergency, the control panel operator would open that valve, immediately providing the cooling and reflux necessary to mix the short stop chemical with the reacting slurry, stop the polymerization, and thereby stop the pressure increase inside the reactor. During the late seventies, a large residential area was developed immediately north of the Plant. That, plus other major developments in the area of the Plant, caused increased city water consumption and correspondingly lower city water supply pressure. Also, with increasing electricity costs, the city water department became more careful about balancing the number of operating water pumps with water consumption. As a result, a sudden increase in water flow was more likely to cause a drop in supply pressure than in the past. After the Plant realized that it could not depend on city water backup cooling in an emergency, research studies were made to determine if a larger injection volume of the short stop chemical would be successful in stopping the polymerization without dependence on city water cooling. These tests were successful. Therefore, a new injection system with a larger injection pot for each reactor was installed in 1980. Essentially everything that could be done to maximize the reliability of the reactor kill system was incorporated, including remote operated injection valves and a remote operated valve in a line between the plant firewater line and the cooling water line to provide another source of backup cooling in an emergency. The research work and the change made to the Plant and incorporated in the new emer gency kill system were discussed in the above referenced letter from John Friend, dated December 12, 1979. DTH 000071481 81 The important point is that the improved manual short stop injection system installed in 1977 was fully capable of preventing reactor releases when installed because sufficient cooling water flow was available/ even in a power failure, to provide the required reflux action mixing in the reactors. A remote controlled injection system was not needed in 1977. D. STATE WHETHER THE REVISIONS IDENTIFIED IN QUESTIONS 6-A, B AND C FOR THE PVC REACTORS AT THE PLANT ARE USED AT ANY OTHER CONOCO PLANT. STATE THE LOCATION OF EACH PLANT, THE RESPECTIVE REVISION EMPLOYED, AND THE DATE AND REASON FOR THE REVISION. Conoco has two other plants, one at Aberdeen, Mississippi and a pilot plant adjacent to the Plant at Oklahoma City, Oklahoma. The pilot plant is currently shut down. * The Aberdeen plant is now installing a remote operated AMS injection system similar to the one installed at the Oklahoma City plant. The Aberdeen plant also plans to cross-connect firewater supply lines to the cooling water supply lines with remote operated valves to provide a source of backup cooling in a power failure. The Oklahoma City pilot plant uses a manual AMS injection system combined with a city water tie-in for backup cooling. Its one reactor is one-tenth the size of the commercial Plant's reactors and the pilot plant reactor's condenser is oversized in comparison to Plant reactors. In the past the pilot plant has been able to control the poly merization rate and reactor pressure with city water flow alone in a power failure. Past experience has confirmed that the combination of manual AMS injection and backup city water cooling will prevent a reactor release in an emergency. There are no plans to install a remote operated AMS injection system at the pilot plant. DTH 000071482 CONFIDENTIAL QUESTION 7 STUDIES AND OTHER ALTERNATIVES CONSIDERED A. PRIOR TO SEPTEMBER 1, 1978, DID CONOCO, OR ITS CONSULTANT OR CONTRACTOR, PREPARE ANY MEMORANDA, REPORTS, ANALYSES, OR DOCUMENTS OTHER THAN THOSE DESCRIBED IN QUESTION 6-A, WHICH RELATED TO THE OCCURRENCE, CAUSE OR PREVENTION OF RELEASES OF VCM FROM RELIEF VALVES OR OTHER RELIEF DEVICES ON PVC REACTORS AT THE PLANT? IF SO, PROVIDE A DATED COPY OF ALL SUCH DOCUMENTS. Documents are submitted under separate cover. B. STATE ALL THE ALTERNATIVES CONSIDERED BY CONOCO PRIOR TO AND DURING THE WAIVER PERIOD (OCTOBER 21, 1976 to SEPTEMBER 1, 1978) TO ACHIEVE COMPLIANCE WITH 40 CFR, 861.64(a)(3) AND 861.65(a) FOR MANUAL VENT VALVES, THE RELIEF VALVES AND OTHER RELIEF DEVICES ON THE PVC REACTORS AT THE PLANT. Prior to and during the waiver period, the Plant had not experienced significant problems with respect to reactor relief discharges. Nevertheless, various ideas and proposals were developed during this period as described below. 1. Emergency Lighting in the V-40 Area The V-40 area is the process area containing the PVC reators. Prior to and during the named period, the Plant did not feel that emergency lighting was required. However, the Plant is currently reconsidering the value of emergency lighting. 2. Automatic AMS Addition In a 1974 conceptual study, an automatic AMS addition was recommended to provide a faster and more controlled addition sequence. The Plant followed this recommendation with an evaluation of the existing emergency manual AMS kill system. It was decided to improve the emergency kill system. Alternates of installing an automatic AMS kill system and an improved manual kill system were considered. The improved manual kill system was selected and installed because it was considered to be more reliable than the automatic system as it was designed then, and also because the Plant's experience with the original manual system proved that a manual system DTH 000071483 83 could be used to prevent reactor releases. The evaluation is discussed in more detail in the discussion under Question 6C above. 3. Backflow Preventer Bypass A commercial design backflow preventer has been installed in the city water supply line to the Plant to prevent a process stream from backflowing into the city water main. The backflow preventer contains two check type valves that close when the pressure drop (flow) across the unit is reversed and a bleed valve that opens to bleed any leakage to grade. Some pressure is lost across the backflow preventer when there is a high city water flow such as would occur when the city water connection to the cooling water supply header is opened in a power failure. A remote operated bypass around the backflow preventer was recommended to provide a higher city water pressure and, therefore, greater cooling water flow to the reactors in a power failure. This option was rejected by the Plant due to concern that the bypass valve would eliminate the protection of the city water supply against contamination in a power failure and would, through malfunction or misoperation, create a serious threat of contaminating the city water main in a backflow situation in normal Plant operation. 4. Revised Emergency Procedure A control panel mounted switch to start automatic AMS addition, open the backflow preventer bypass valve, and open other valves in the city water backup system was recommended. As discussed above, the Plant rejected an automatic AMS system and determined that a backflow preventer bypass would not be installed. The Plant already had a control panel mounted switch to allow the panel operator to remotely open a valve and start city water flow into the cooling water supply header. Also, it was recommended that the emergency procedure include instructions to use an empty reactor as a blowdown vessel for a reactor in the peak period of polymerization. The Plant decided not to include this in the written emergency procedures. The existing procedures (city water cooling combined with manual AMS addition) had prevented reactor releases in emergency situations. In addition, the poly merization would continue in the second reactor, requiring cooling and emergency AMS addition to prevent a relief discharge. Since the emergency kill system would have to work to prevent a release in both reactors in a power failure, there was no advantage to transferring reacting slurry. DTH 000071484 5. Firewater Cross-tie A cross-tie between the Plant's firewater line and the cooling water supply line was recommended to further ensure a source of backup cooling. The cross-tie was installed. 6. Elevated Water Supply Tank The Plant evaluated an elevated tank as a second source of emergency reactor cooling water for power failure conditions. The Plant decided to install the cross-tie between the Plant firewater system and cooling water system instead of this alternative because the Plant firewater system could supply emergency cooling water for a far greater time period than the elevated tank. 7. Blowdown Drum A standby empty pressure vessel (a blowdown drum) could receive slurry or VCM vapor from a reactor in an emergency and slow down the reaction rate and corresponding increase in pressure via the auto-refrigeration that would result. This would provide more time for operations personnel to stop the reaction with the emergency kill system. While a 1974 conceptual study concluded that complete blowdown of all unreacted VCM would be impractical, blowdown of about five percent of the total VCM charge from a reactor at peak reaction rate (about 73 percent conversion) could put the reaction in the VCM-limited, slower-reaction-rate portion of the batch (referred to as the pressure drop phase of the reaction) and therefore make the reaction easier to control. Conceivably, this could reduce the rate of pressure increase in a reactor that was at its peak reaction rate by allowing enough VCM to be vented to the blowdown drum to carry the reaction to a higher conversion and correspondingly lower reaction rate. This alternate was not recommended due to its cost and the Plant's infrequent history of power failures. More importantly, an effective emergency killing system and backup cooling would still be required to prevent the reactor from overpressuring and releasing VCM. In addition, emer gency killing and cooling systems would be required for the blowdown tank to control and terminate the reaction in any liquid vented to the blowdown drum. Therefore, the Plant agreed with the study's recommendation not to pursue a blowdown drum. This alternate, even if it did help control a reactor at peak heat release, would still require an effective emergency killing and cooling system for the other reactors. It is extremely unlikely that two or more reactors would be at peak reaction rate at the same time. DTH 000071485 The notion that the auto-refrigeration resulting from venting a reactor will help prevent or minimize the release from a reactor in an emergency was disproved in a recent Conoco study, which is submitted under separate cover. That study concluded that venting a reactor at a rate known to be close to the maximum to avoid slurry entrain ment from the reactor only postpones the timing of the release by 30 seconds to 1-1/2 minutes, depending on the percent conversion in the reactor at the time of the emer gency. In other words, the auto-refrigeration resulting from venting VCM vapor from the reactor only slightly impedes the polymerization heat release and provides very little time. It is unlikely that something could be done in 1-1/2 minutes to prevent a release if it could not have been done in 10 to 15 minutes between the start of the emergency and the point the reactor pressure relief occurs. Venting at a higher rate will result in both slurry and VCM vapor being vented based on Plant experience in recovering unreacted VCM from the reactors in a normal batch. The auto-refrigeration benefit is lost in part when slurry is vented since the slurry flow in the vent reduces the VCM vapor flow in the vent. The VCM left in the reactor continues to react and fuel the release. The conclusion is that a release is best prevented by the Plant's effective polymerization control system in an emergency. 8. Emergency Power Diesel driven generators were considered to provide backup power for the reactor cooling water system and agitators. However, the Plant was told that four to five minutes would be required before the diesel motor would be at its rated speed and the generator could develop its rated power. That time lag would allow the reactor pressure and reaction rate to increase to the point where restored agitation and cooling may not regain control of the reactor pressure. An emergency AMS kill system and a source of backup cooling would still be required. In particular, this could be the case if the emergency were caused by failure of a reactor's agitator motor assembly or failure of the cooling water pumps. For these reasons, a 1974 study did not recommend backup power and the Plant agreed with that conclusion. A recent reevaluation of the merits of emergency power reached the same conclusion. Emphasis should be and is being placed on ensuring that the AMS kill system is reliable and effective and that there is a reliable source of backup cooling. 86 DTH 000071486 9. Alternative Rupture Discs The Plant investigated the advantages of different types of rupture discs to find one that was both safe and not subject to premature failure. As shown in the documents submitted under separate cover with this letter, the Plant has had problems with rupture discs virtually since Plant startup in 1971. For the most part, these problems have been with disc reversal against knife blades but not opening. To our knowledge, only since 1978 has premature disc failure caused VCM releases. The Plant has worked since shortly after startup to find a rupture disc that would be reliable and immune to premature reversal. Documen tation of some of the correspondence with rupture disc vendors and others is submitted under separate cover. This work concluded with the decision in June 1977 to purchase the BS&B S-90 reverse buckling discs. The Plant's rupture disc experiences and evaluations are discussed in the August 13, 1978 portion of the answer to Question 2G. When the Plant evaluated alternate types of rupture discs in 1975 in making a change from the SRK disc, BS&B proposed using their reverse buckling, pre-scored S-90 rupture discs with their pre-torqued "safety-head" rupture disc holder as one of several options. However, BS&B, at the time, thought the advantage of the safety-head assembly was that it made disc installation easier and allowed the disc assembly to be removed from a line during maintenance and then be reinserted in the line and used again. These advan tages were not considered important by the Plant since rupture discs on the reactors were replaced every six months routinely and that replacement coincided with the 12-month maintenance schedule on the relief valves. BS&B had not recognized the external stress isolation benefits now claimed for their pre-torqued safety head assembly. 10. Alternative Kill Systems Alternative killing agents were evaluated in Conoco's Research and Development Department. While a number of different killing agents were evaluated for their ability to stop the reaction at the end of the polymerization cycle and not affect produced quality, two in particular were evaluated as emergency killing agents. These two were sodium nitrite and nitric oxide (NO). Sodium nitrite was found to be an effective killing agent if the reacting slurry had a basic pH. Since the slurry in the Conoco reactor is normally acidic, sodium nitrite would not be effective. The evaluation work done with NO has at times DTH 000071487 87 CONFIDENTIAL indicated that it is superior to AMS as a killing agent. However, as more thorough work was done, Conoco learned that if AMS were added correctly and in sufficient quantity, it was as effective as NO. In a power failure situation where there is no mixing action in the reactor, the AMS must be injected into the top of the reactor so it will directly contact the reacting VCM phase which, being less dense than water, will float to the top of the liquid. The NO, being a gas at reactor pressure, must be injected in the bottom of the reactor to help ensure contact with the reacting VCM. A number of cylinders of NO must be injected into a reactor in a power failure to ensure that the reaction is terminated. Also, NO is a hazardous gas and precautions must be taken to prevent leakage. At the same time, as the first comparative evaluation of NO and AMS the plant considered an automatic AMS kill system and an improved manual AMS kill^system. As discussed above, the improved manual AMS system was selected because it was of known reliability and effectiveness. The NO system was rejected because of concern about its toxicity and because it was not more effective than AMS. Also, if the NO gas did not dissolve in the slurry it could collect in the reactor condenser and greatly reduce the heat removal of the condenser with backup cooling in an emergency. An alternate automatic AMS kill system was briefly considered that consisted of a small AMS container connected directly to the reactor but isolated from the reactor with a rupture disc. The rupture disc set pressure would be between the normal polymerization pressure and the lowest relief rupture disc set pressure. When the reactor pressure increased in an emergency to the set pressure of the rupture disc between the reactor and the AMS container, the rupture disc would open, allowing AMS to drain into the reactor and terminate the reaction. However, the AMS supplier (Dow) did not recommend subjecting the AMS in the container to the high reactor temperatures reached during the recovery/ stripping phase of the reactor cycle because the AMS would polymerize and be rendered ineffective. Therefore, the Plant did not pursue this alternate. A study of the effectiveness of the AMS from four different suppliers was conducted by R&D in 1977. All four were found to be equally effective in killing the polymerization reaction in an eight gallon pilot plant reactor. The Plant uses AMS to stop the batch reaction at a specified conversion to control the quality of the PVC resin produced. This is in addition to the use of AMS to stop polymerization in an emergency. The main objective of the DTH 000071488 88 R&D study was to determine if suppliers other than Dow could provide an AMS that would be equally effective at stopping the reaction at the desired conversion in a normal batch. However, the tests also indicated that AMS from the three alternate sources would be equally effective in stopping the reaction in an emergency at any point in the reaction. Similar studies to determine if there is a more effective killing agent than AMS have been conducted and are submitted under separate cover. 11. Increasing Relief Valve Set Pressure. The Plant considered raising the relief set pressure of the two rupture disc/relief valve assemblies on each reactor to allow more of a pressure increase and there fore more time for killing the reactors in a power failure. Conoco's Process Engineering Department (PED) was asked to consider whether this could safely be done as part of their work to prepare the process design for the Plant's fifth reactor installation. After a preliminary evaluation which recognized the complexity of modeling the reactor relief situation, including multi-phase flow and changing reaction rates with reactor pressure, a recommendation was made that the relief setting not be raised. The Plant agreed with that recommendation. The question of raising the reactor rupture discs' and relief valves' set pressures has been discussed several times during the Plant's history. There has always been a reluctance to do this because of the safety consider ations involved and the limited benefits from this action. Raising the pressure at which the reactor relief devices begin to discharge has a significant effect on the rate that the relief devices must relieve the reactor contents in order to protect the reactor from overpressure. The reaction rate for the highly exothermic polymerization reaction increases exponentially as the temperature increases. An increase in the discharge pressure of the relief devices on the reactor will result in a significant increase in the rate at which material must be relieved to prevent the overpressure of the reactor. An increase in the required relief rate may require additional pressure relief devices. Increasing the number of relief devices increases the possi bility of a mechanical defect or installation error resulting in a premature failure of a rupture disc. The benefits gained from increasing the pressure at which the reactor relief devices start discharg ing is limited in most cases. The additional time available 89 DTH 000071489 CONFIDENTIAL to add killing agent or take other action to prevent a relief valve discharge is extremely short because of the fast rate of pressure rise in the reactors at elevated temperatures. Also, raising the set pressures of the two rupture disc/relief valve assemblies on each reactor would reduce the margin separating the relief set pressures of those assemblies from the double disc assembly. The reactor relief system is designed to relieve excess reactor pressure first through one rupture disc/relief valve assembly. If the pressure continues to increase, a second rupture disc/relief valve assembly opens. The double disc assembly would relieve only if the reactor pressure continued to increase. In an emergency situation where the reaction is not proceeding at its maximum rate (partial kill, early or late in the polymeri zation, etc.), the relief valve(s) discharge may be sufficient to control the reactor pressures. As the pressure margin between the second rupture disc/relief valve assembly and the double disc assembly is lowered, the potential that the reactor pressure may increase just enough to open the double discs is increased. Of course, all the VCM in the reactor would be vented if that occurred. Since the Plant has now eliminated the double disc assembly, the Plant plans to reevaluate raising the set pressures of the relief devices. In any case, the benefits will be minimal. 12. Remote Operated Block Valve On Double Disc Assembly. The Plant briefly considered installing a remote operated, open-close action valve downstream of each reactor's double rupture disc assembly to limit the VCM discharge in an emergency situation to only that required to keep the reactor pressure at or below its rated pressure of 200 psig. The control panel operator would close the valve after the reactor pressure dropped below 200 psig in a -relief situation. This idea was rejected due to concern that the operator might close the valve at the wrong time leading to a potential explosion. Also, in a relief situa tion, the two rupture disc/relief valve combinations on a reactor should already be relieving before the double rupture disc assembly relieved since the double discs have the highest relief set pressure. At 200 psig the reaction rate and therefore the reactor pressure increase rate are high. Probably most of the reacting slurry would have to be dis charged to allow safe containment of the reactor. Also, emergency cooling or AMS injection would be needed to prevent the slurry contained in the reactor after the partial relief from again increasing in temperature and causing another relief. 90 DTH 000071490 CONFIDENTIAL 13. Reactor Relief Collection And Containment. Several systems to collect and contain VCM emissions in a gas holder have been investigated. In 1975, gas holders were evaluated along with other systems in determing how best to modify Conoco's PVC plants to comply with the CPA's proposed VCM standard. Two different schemes using gas holders for both normal process gas surge and for relief containment were evaluated. An evaluation of a gas holder specifically designed for reactor relief containment was made in 1977. The designs prepared for that evaluation were based on a number of assumptions and were intended to give only an order of magnitude cost estimate. That evalua tion was prompted by concern about the flammability of the VCM vented from a reactor in a pressure relief situation. An alternate of flaring the vented VCM was also considered. A more extensive investigation of relief containment, venting, and flairing was made in 1980. That study is sxbmited under separate cover. The part of the TRW Phase I report of the effectiveness of the EOA VCM standard that references Conoco's study is also submitted under separate cover. The later study examined alternates of reactor relief containment in a gas holder or a closed blowdown drum, and also reactor relief through a vent stack or flare stack. A number of major problem areas were found with each of these four alternatives. They are summarized in the list below. a. All alternatives require a vent collection header. The header design would be of critical importance. If it were undersized, the reactor would not be able to relieve as quickly as necessary to prevent a reactor overpressure and explosion. If oversized, entrained slurry could disengage from the VCM vapor flow. It would be difficult to size the header correctly for every situation since the flow could vary widely, depending on the number of reactors relieving, the cause of a reactor relief, and whether the reaciton in a relieving reactor has been partially killed. Another problem is that this type of multi-phase flow situation can create unpredictable and varying back pressures that may also lead to reactor overpressure. Also the vent collection header would have to be designed to prevent solids from settling and plugging the vent collection header. b. All alternatives except the blowdown drum require a large knockout vessel to separate entrained slurry from the VCM flow. The separation is necessary to prevent slurryy from entering the gas holder or the atmosphere. DTH 000071491 91 Gas holders are not designed for handling solids. In fact a major gas holder manufacturer suggested that if solids were to enter its gas holder they would best be removed manually with shovels. Likewise, slurry removal from a blowdown drum would be difficult. Slurry separation is necessary with a vent stack or flare to avoid the nuisance aspect of PVC fines (or, in the case of the flare, partially burned PVC fines and HC1) dispersed over a large area adjacent to the Plant. Preliminary sizing of the knockout vessel indicates that it would have to have a diameter of 58 feet and a length of 173 feet. c. All alternatives must be completely reliable in order to always ensure that the reactors will be able to safely relieve. One plant is known to have tried relieving reactors through a vent collection header. Solids accumulation in the vent line created by a high back pressure in the header in a reactor relief situation during a power failure caused the header to rupture and started a fire. While vent collection headers can be designed to minimize the potential for solids accumulation, there will always be a chance that accumulation will occur and not be detected before a relief occurs. Therefore, the reliability of the vent header would remain questionable until it was proven by years of safe operation. In the interim, PVC reactor venting or relieving to a vent collection system must have additional pressure relief valves that vent directly to the atmosphere. If the vent collection system limited the reactor relief flow, the atmospheric relief valves would prevent the reactor from overpressuring and exploding. The potential would still exist for a reactor to relieve directly to the atmosphere. In an atmospheric relief through a relief valve, the high velocity of the vent gas flow entrains enough air to quickly dilute the vented VCM below its lower flammability limit. This dilution greatly reduces the length and fuel content of the flammable zone in the relief discharge. The exit velocity from a vent stack is much lower than the relief valve discharge velocity. The loss of air dilution can be compensated for in part by elevating the vent stack. However/ if there is very little wind, the vented VCM vapor, being heavier than air, could drop from the vent stack with very little mixing and create a large ground level flammable cloud. Likewise, failure of the seal in a gas holder would create a low velocity discharge and could result in a large flammable cloud being formed at ground level. DTH 000071492 92 confidential A reactor-sized pressure vessel could be used as a containment vessel for a small amount of vapor or slurry in a reactor upset. However, this blowdown vessel would require an effective short stop injection system and would also have atmospheric pressure relief valves. If the blowdown drum kill system is effective, the reactor kill system should also be effective and, therefore, the blowdown drum would not be needed. If the reactor kill system is ineffective in a power failure, such a small blowdown drum would not prevent a runaway reactor from relieving to the atmosphere. Also the blowdown drum may also relieve to the atmosphere in that situation. Conoco concluded from this study that from both a safety and an environmental standpoint, the best control system for a PVC reactor is a reliable and effective kill system. The different containment alternatives have serious safety drawbacks that, given the potential for explosion and the VCM releases that would result, also create environmental problems. Venting through a tall vent stack or flaring do not prevent the VCM (or HC1) emission. An effective kill system is the best control alternative because it controls and contains the potential VCM release in the affected reactor without compromising Plant safety. The Plant considered these safety disadvantages to far outweigh the advantage of relief containment and these preliminary investigations were not pursued. 14. Reactor Level Alarms Prior to development of the VCM Standard, the Plant evaluated a number of reactor level indicating schemes to prevent the production loss associated with reactors which had a higher than normal liquid level. The investigation indicated that the only alternative which might work was a nuclear device. The Plant decided not to pursue this alternative because of the potential safety problems associated with nuclear instrumentation. C. AT THE TIME CONOCO CONSIDERED THESE ALTERNATIVES DID CONOCO EVALUATE SYSTEMS USED IN ANY OTHER PLANTS? IF SO, IDENTIFY THE SYSTEMS EVALUATED, THE PLANT, AND PROVIDE A DATED COPY OF ALL RELEVANT DOCUMENTATION FOR EACH EVALUATION. Conoco evaluated the following systems used in other plants during this period: 1. The nitric oxide (NO) system used at Conoco*s Aberdeen, Mississippi PVC Plant. This system and the rea- DTH 000071493 93 CONFIDENTIAL sons it was not used in Conoco's Oklahoma City PVC Plant are discussed in the response to Question 8B. 2. The AMS injection system and emergency cooling water control at the Conoco PVC Pilot Plant adjacent to the Conoco PVC Plant at Oklahoma City. The pilot plant systems for preventing a reactor release and the Plant's evaluation of them are discussed in 8B. There is no documentation of the evaluation. 3. The General Tire Gas Holder system. In 1974, General Tire's PVC plant at Ashtabula, Ohio used a gas holder to receive process vents and the discharges from some relief valves. It did not receive the reactor relief valve's discharge although it did receive the discharge from a small (approximately one inch) relief valve on each reactor's charge piping manifold. A copy of the report discussing the trip made to the General Tire Plant is submitted under separate cover. A gas holder containment system was considered and rejected by Conoco as discussed earlier. 4. The emergency kill system used by Diamond Shamrock's Pasadena, Texas Plant. At the time. Diamond used a multi-point AMS injection system to kill the polymerization reaction in their large reactors in an emergency. Their reactors did not have condensers. The multi-point injection was necessary to help mix the AMS with the reacting VCM. Conoco considered its system at the Oklahoma City Plant (manual AMS injection with backup cooling) to be at least equally effective to Diamond's system. The Conoco system uses cooling water flow to provide reflux from the reactor condenser and to so mix the AMS with the reacting slurry. Also the AMS injection point is located above the condenser, which is an area that is much less likely to foul with polymer than the wall area inside the reactor. Therefore, the condenser injection nozzle would be much less likely to plug with polymer. Documents pertaining to this evaluation are submitted under separate cover. 5. Two alternative polymerization short-stop agents used by other plants were suggested to the Plant in addition to the nitric oxide system. Investigations indicated that the two alternatives, sodium nitrite and isoprene, were not as effective as AMS. dTH 000071494 94 D. PROVIDE A DATED COPY OF ALL STUDIES REGARDING THE EFFICIENCY AND RELIABILITY OF THE EQUIPMENT CONOCO HAS INSTALLED FOR AVOIDANCE OF RELIEF DISCHARGES FROM THE PVC REACTORS AT THE PLANT. The requested documents are submitted under separate cover. DTH 000071495 CONFIDENTIAL QUESTION 8 A. STATE WHETHER CONOCO'S OTHER PLANTS HAVE EXPERIENCED (1) POWER FAILURES, (2) PREMATURE FAILURES OF RUPTURE DISKS, AND (3) OPERATOR ERRORS SIMILAR TO THOSE REPORTED IN CONOCO'S LETTERS OF AUGUST 18 AND DECEMBER 1, 1978, JULY 27 AND OCTOBER 26 of 1979 AND APRIL 1 OF 1980. Our letter of August 18, 1978 reported the premature failure of rupture discs at 110 psig under normal operating conditions. The rupture discs' rated burst pressure was 200 psig. Conoco's Large Reactor PVC Pilot Plant at Oklahoma City and Conoco's Aberdeen Chemical Plant (PVC plant) at Aberdeen, Mississippi, have both experienced similar premature failures of rupture discs.* Our letter of December 1, 1978 reported an operator error during a power failure which resulted in ehort stop chemical not being injected into the reactor as intended but rather the short stop chemical was injected into the EPA recovery system. The connection on the reactor used for emergency injection of short stop chemical also had a branch connection through a remote operated valve which tied into the EPA recovery system. The remote operated valve was open, venting reactor inerts to the EPA recovery system when the power failure occurred. The control panel operator failed to remotely close this valve before short stop injec tion, which resulted in the chemical flowing down the branch connection to the EPA recovery system which was at lower pressure than the affected reactor. We know of no similar incidents which have occurred at Conoco's other plants. Our letter of July 27, 1979 reported an incident involving two operator errors. First, the qualified control panel operator failed to place the affected reactor's tempera ture controller in the automatic mode during reactor heat-up after charge (the controller was left in the manual mode with the cooling water control valve shut off). Then the qualified control panel operator left the control room to go to the bathroom, but the only person remaining in the control room was not qualified to operate the control panel. During the absence of the qualified control panel operator from the control room, the affected reactor's conditions reached the *This evaluation has not been extended to control technology applied by Vinatex Ltd. (formerly a Conoco owned British PVC producer) which was sold by Conoco in the late 1970s. This evaluation also has not been extended to the small reactor modules which Conoco operated at its Aberdeen facility in the early 1970s. These units were shut down in the mid-1970s. 96 DTH 000071496 CONFIDENTIAL high temperature/pressure alarm point. The alarm sounded, and the employee remaining in the control room shut off the alarm but took no other action. We know of no similar incidents which have occurred at Conoco's other plants. Our letter of October 26, 1979 reported the premature failure of rupture discs at approximately 168 psig during a power failure. The rupture discs' rated burst pressure was 200 psig. During the power failure, the affected reactor was injected with short stop chemical as were other Plant reactors which did not discharge VCM. Conoco's Aberdeen Chemical Plant (PVC plant) at Aberdeen, Mississippi, has experienced similar premature failures of rupture discs at pressures above normal operating pressure but significantly below rated burst pressures. Our letter of April 1, 1980, reported an operator error which resulted in a hydraulically filled reactor under polymerization conditions. The operator error involved a high pressure water injection valve which was mistakenly left open, filling the reactor. Conoco's Aberdeen Chemical Plant (PVC plant) at Aberdeen, Mississippi, has experienced a liquid filled reactor, but this condition was not caused by similar operator error. B. DESCRIBE ANY DIFFERENT EQUIPMENT, PROCEDURES AND METHODS USED AT CONOCO'$ OTHER PLANTS TO PREVENT VCM DIS CHARGES. STATE THE REASONS THAT SUCH MEASURES ARE NOT EMPLOYED AT THE OKLAHOMA CITY PLANT. Conoco operates two PVC plants in addition to the Oklahoma City PVC Plant. These two plants are the Oklahoma City Large Reactor Pilot Plant and the Aberdeen Chemical Plant located in Aberdeen, Mississippi. A review of dif ferences in operating procedures and equipment used at the three plants has been completed. These differences are detailed in the following discussion. Conoco's Research and Development Department operates the Large Reactor Pilot Plant on the same site as the Conoco Chemicals Oklahoma City PVC Plant. The Pilot Plant operates one 1,500 gallon pilot reactor, support facilities, and product drying systems. Utilities and VCM storage are supplied by the Plant. After reviewing the operation of the other two plants, the following differences in procedures and equip ment for preventing reactor relief valve discharges have been determined. The following is a list of items that the DTH 000071497 97 CONFIDENTIAL Large Reactor Pilot Plant has to prevent reactor relief valve discharges, that are not employed at the Oklahoma City PVC Plant. Large Reactor Pilot Plant -- Oklahoma City PVC Plant Comparison 1. The reactor condenser on the Pilot Plant reactor is sized for very high heat load conditions in order to accommodate research tests with short polymerization times. The Plant does not operate under the high heat load conditions that the Pilot Plant reactor is designed for. Hence, the Oklahoma City Plant does not have as large a surplus heat removal capacity designed into its condensers. 2. The Pilot Plant's supply of emergency cooling water to the reactors is initiated automatically on loss of instrument air pressure. The Pilot Plant system is designed in this manner because the original design of the Pilot Plant did not include an emergency instrument air supply system. The Oklahoma City Plant's supply of emergency cooling water is initiated by turning a switch on the control panel. The Plant's system is designed in this manner because its nitrogen cylinder backup prevents the instantaneous loss of instrument air pressure upon power failure. 3. The Pilot Plant was designed to conduct studies involving the stripping of PVC slurry both internal and external of the PVC reactor. The external stripping experiments are conducted in a pressurized stripping tank. In an emergency, some of the reactor contents can be vented to the stripping tank. The Plant performs all of its strip ping operations in the reactor and does not have an external stripping vessel. 4. The Pilot Plant has a common injection pot system for normal kill and for emergency kill. This results in the system being used once per day and serves both as a check of the equipment's reliability and as a training program for the operators. The injection pot must be manu ally filled with AMS and pressured into the reactor in an emergency. The Oklahoma City Plant emergency AMS kill system has an injection pot for each reactor that is filled with AMS and pressured with nitrogen. It is checked before every batch. The AMS can be injected either through remote activated valves or local manual valves. The Plant tests its emergency AMS kill system once per week on each reactor. It is felt that the procedure used in the Plant is sufficient to maintain both mechanical reliability and operator awareness. DTH 000071498 98 CONFIDENTIAL 5. The Pilot Plant reactor area has emergency lighting in the event of a power failure. The Plant is studying a project involving an emergency generator which could provide emergency lighting for the reactor area. All Plant operators are issued flashlights at the present time. 6. The Pilot Plant has a manually started instrument air compressor for emergency instrument air. The Plant has an emergency supply of instrument air consisting of pressurized nitrogen bottles. This system comes on-line automatically upon loss of air pressure. The Plant is studying a project which would utilize an emergency air compressor as a second supply of emergency instrument air. Aberdeen Chemical Plant -- Oklahoma City PVC Plant Comparison a* 1. Both Oklahoma City and Aberdeen have emergency systems for halting the reaction in PVC reactors during an emergency upset condition, such as, power failure or loss of agitation. Oklahoma City uses a combination of emergency cooling water and AMS as the short stop agent. The AMS is injected into the reactor condenser and drops into the reaction mass. The emergency cooling water passing through the condenser condenses VCM vapors. The condensed VCM drops back into the liquid reaction mass, producing agitation and improving the effectiveness of the killing agent. Aberdeen uses nitric oxide as the reaction short stop agent. The nitric oxide bubbles up through the reaction mass, causing a low level of agitation and allowing the agent to stop the reaction. The Plant uses the AMS kill system instead of the nitric oxide system because tests convinced the Plant that AMS in conjunction with emergency cooling, is at least as effective as NO as a reactor killing agent. 2. Following any coarse batch, i.e., suspension agent failure, Aberdeen inspects the reactor condenser for plugging and uses a low reaction catalyst loading on the next batch. Oklahoma City has not had a severe problem with plugging of the reactor condenser following a coarse batch. 3. Both Aberdeen and Oklahoma City are concerned about improper draining of the reactor following the final rinse step. Water left in the reactor can result in a batch becoming liquid full during the charging of reaction ingre dients. The discharge pressure of the pumps is sufficient DTH 000071499 99 to cause a relief valve discharge. In order to make sure that the reactor is properly drained, Aberdeen does the following: a. After reactor rinse is complete the panel operator checks the reactor agitator to assure that it indicates no load on the agitator. b. The outside operator checks the site glass in the drain line and indicates to the panel operator that there is no flow from the reactor. c. The panel operator then puts rinse water into the reactor and the outside operator observes the site glass to determine if flow from the reactor is normal and thus will completely drain. the site stops. glass d. and The outside operator continues informs the panel operator when to observe flow e. The reactor will then be evacuated and charged if the previous steps proceed normally. f. If high amperage on the agitator or improper draining is detected, the Shift Supervisor is notified and he further checks to assure the reactor is empty before charging. The Oklahoma Procedure is somewhat different in that it calls for the operators to: a. Observe the draining of the rinse from the reactor using a control room mounted TV monitor which is focused on the flow of rinse water at the end of the reactor drain line. b. Observe the reactor evacuation time. (Evacuation is the step immediately prior to charging the reactor.) If the reactor evacuation time is longer than normal, indicating that water is left in the reactor, the reactor is redrained. Both procedures are adequate to detect improperly drained reactors. 4. Aberdeen's procedures call for the complete killing of the reactor if the pressure reaches 145 psig as compared to a normal run pressure of 120 psig. DTH 000071500 Oklahoma City procedures do not specify the pressure at which reactors are to be completely killed. Under normal conditions, Oklahoma City procedures call for the operators to begin to add short stop agent in small quantities when the reactor temperature rises to 137F as compared to a normal run temperature between 131F and 134F. The point where normal kill procedures are abandoned and complete kill is initiated is left to the judgment of the Shift Supervisor and/or control panel operator. Under emergency conditions -- e.g., loss of power or agitation -- Oklahoma City procedures call for complete kill immediately. 5. The Aberdeen Plant has emergency lighting for the reactor area in the event of a power failure. The Oklahoma City Plant is studying a project involving an emergency generator which could provide emergency lighting for the reactor area. DTH 000071501 Figure 1 Process Flow Diagram Reactor D-305 Release, April 5, 1978 iqure 2 Proces >' Flow Diagram Reactor D-305 ReTease, August 13, 1978 Reactor Agitator Figure 3 Process Flow Diagram Reactor D-301 Release, November 26, 1978 fa* %/ Release Source, Reactor Agitator DTH 000071504 Release Source, P roces f'-Tow Ji aq ram Reactor 22, 1979 6 %> % Reactor Agitator DTH 000071505 Figure 5 Process Flow Diagram Reactor D-3Q3 Release, October 20. 1979 a Procesli l-low Diagram C Reactor D-301 Release, March 23, 1980 Process" D i a gram Reactor~CaTaTy;T Charge System Emergency Reactor -5Kill System Reactor Condenser LEGEND Manual Valve Pressure Gauge Process Sewer DTH 000071508 cure Process Pi a: ram Revised ReactorTatalysTTharge System Emergency Reactor LEGEND OO Manual Valve Pressure Gauge Pressure Switch DTH 000071509 gure 9 Process Diagram AMS Injection System tor Reaction Termination ~~ CPHo" to IW/78'J-------------------- To VCM Vent Collection System 5 -C&-C Hose Connection For AMS Injection Reactor LEGEND (--j Valve With. Actuator For Board Control Manual Valve --c Hose Connection Hh- Orifice Flange DTH 000071510 "igure 10 Process t?iagrar AMS Injection System for Reaction Termination fin stall eel 12/01/76) LEGEND Hose Connection Manual Valve Pressure Transmitter 0000715^