What happened
On 23 April 2004, at a PVC plant in Illiopolis, Illinois, an operator cleaning a reactor went to the lower level to open its drain valves but went to a different, nearby reactor that was in operation. Its bottom valve would not open because an interlock prevented opening while the reactor was pressurised. The operator used an emergency air supply to override the interlock, a method intended only for emergencies. Vinyl chloride was released and ignited. Five workers died and others were seriously injured.
The CSB found that the risk of opening the wrong reactor's valve was known, that earlier hazard analysis recommendations were not implemented, that a similar release had happened at another plant of the company, and that the lower level had no indication of reactor status.
Lessons for SIS and instrumentation
- Overrides must be harder than the error they protect against. Emergency overrides should be secured (locks, keys, authorisation) and their use alarmed and logged.
- Design for human error. Clear identification, status indication at the point of action and layouts that reduce confusion are part of the protection.
- Near misses elsewhere are relevant. Lessons from sister plants should be assessed, not dismissed because details differ.
Related First Out AI articles
"Managing bypasses, overrides and start-up inhibits", "What qualifies as an independent protection layer".
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.