Monday, April 14, 2014

Tosco Refinery Fire


Tosco Refinery fire
Flawed Management Supervision


Summary Data:

Date: February 23, 1999,

Location: Avon refinery in Martinez, California,

What happened: Four workers were killed in a fiery accident. The men were in the process of replacing corroded pipes at one of the refinery’s oil fractionators

Causes: The project was classified as low-risk routine maintenance, no special precautions were in place. The fractionator continued to operate, with large volumes of flammable vapor and liquid flowing inside the tower and its attached piping




What Happened ?

Earlier that morning, under the direction of a Tosco maintenance supervisor, workers had removed a section of corroded naphtha piping 112 feet up the tower, near where the piping joined the fractionator. But things had not been going as planned. When a second cut was made 26 feet below the first, petroleum naphtha – a volatile hydrocarbon mixture that ignites spontaneously at 232°C – began to ooze out and workers had to immediately reseal the pipe.
After breaking for lunch, the workers climbed 40 to 100 feet up scaffolding alongside the tower. They tried to drain the piping system of naphtha by opening a pipe flange 36 feet up and directing the leaking fuel into a vacuum truck using makeshift plastic sheeting and a bucket.
The operation proceeded without apparent problem for 30 minutes, when suddenly a large volume of naphtha, propelled by vapor pressure from the operating fractionator, shot out of the open pipe overhead, spraying the workers. For the five men high on the scaffold, there were few avenues of escape as the hot surface of the fractionator ignited the naphtha, engulfing them in flames.
Although emergency teams arrived quickly, no one could approach the victims for 20 minutes because of the fire. One man died at the scene, three died at the hospital and another, who had thrown himself off the scaffolding to escape the flames, survived with critical injuries.


Recurring naphta leaks

The Chemical Safety Board investigated the accident, Tosco’s second in two years, to determine root causes. Almost two weeks before the accident, on February 10, operators had observed a naphtha leak coming off the fractionator, which they treated as an emergency at the time. Workers located a pinhole leak in the naphtha piping 112 feet up and closed a series of valves in an effort to eliminate it. But the leaks kept recurring. In succeeding days, one attempt after another failed to completely staunch the flow of naphtha. Shut-off valves malfunctioned repeatedly, and drain valves were found to be clogged beyond use or repair.
Ultrasound and X-ray tests were ordered, and these revealed that both the piping and the valves were severely corroded and needed to be replaced. Although the unit operator argued for shutting down the process before attempting to replace the deteriorated piping, a maintenance supervisor decided to do the job while the hot fractionator continued to run. This fateful decision did not receive any oversight or scrutiny from the facility’s management.


Process should have been shut down

Good operating practice calls for draining hazardous materials from lines and equipment and verifying that the equipment has been isolated before opening for maintenance. But that could not be done at Tosco so long as the fractionator was operating. The repeated recurrence of naphtha leaks was a strong indicator that shutoff valves were corroded and were not functioning properly. As long as the fractionator was running, naphtha continued to leak into the piping, and vapor from the fractionator pressurized the escaping fuel.

In the 13 days that elapsed between the first occurrence of the leak and the fatal accident, Tosco personnel missed numerous opportunities to reassess the hazards of the pipe replacement work and take measures to ensure the work would be performed safely. In this case, such safety measures would have included shutting down the fractionator as the only way to eliminate both the source of the naphtha and the potential sources of its ignition.
Avon did not have a systematic job planning and authorization process to ensure that this kind of maintenance work received appropriate scrutiny before going forward. No formal hazard evaluation was conducted before or during the maintenance project, and managers and safety specialists were not sufficiently involved in decision-making and oversight. Instead, individual workers were given the authority to put a halt to unsafe work.


Corrosion, management of change of programs

The naphtha piping and valves had been run to the point of breakdown due to corrosion, leading to a potentially hazardous situation. The valves and piping had corroded at an excessive rate because an upstream vessel known as the crude oil desalter was being operated beyond its design lim- its. Tosco had routinely processed excessive volumes of crude oil with high water content, overtaxing the desalter.
As a result, water and corrosive materials like ammonium chloride were carried over into the fractionator, where they began to deteriorate the piping and valves.


Key recommendations

The CSB recommended that Tosco conduct periodic safety audits of its refineries and document all findings in writing. The CSB said audits should examine the conduct of hazardous non-routine maintenance, the role of management in overseeing safety, and the corrosion control and management of change programs. Audit findings and recommendations should be shared with the workforce and tracked to completion.

The Board recommended that the refinery, implement a program to ensure that hazardous non-routine maintenance is conducted safely. The refinery should require a written hazard evaluation by a multidisciplinary team before any hazardous job is started. The refinery should also require higher levels of approval for higher hazard jobs, develop a written protocol for making shutdown decisions, and make sure that managers and safety officials provide adequate oversight for hazardous work.
The Board also recommended that the refinery improve its management of change and corrosion control programs to prevent situations where safety is compromised.




Tosco Final report :


http://www.csb.gov/assets/1/19/Tosco_Final_Report.pdf

Tuesday, March 25, 2014

Buncefield Fire

Buncefield fire
Oil storage terminal explosions

Lien vers BBC news:

Summary data:
Date: December 11, 2005
Place: Buncefield oil storage depot, Hemel Hempstead, Hertfordshire
Type of accident: Explosion & fire
Outcome: Several explosions wich overwhelmed 20 large sot range tanks, several nearby office blocks were hit.
2000 people were evacuated
43 injured persons, 2 seriously injured
Estimated cost: $ ~1 billions (repairs and compensation)
Lawsuit: Settlement in 2010 ($15 million for victims)
                                                 


About the oil storage terminal

The Buncefield complex was the fifth largest oil-products storage depot in the UK, with a capacity of about 60,000,000 imperial gallons (270 ML) of fuel. This was about 8% of UK oil storage capacity.

What happened?

On the night of Saturday 10 December 2005, Tank 912 at the Hertfordshire Oil Storage Limited (HOSL) part of the Buncefield oil storage depot was filling with petrol.

The tank had two forms of level control: a gauge that enabled the employees to monitor the filling operation; and an independent high-level switch (IHLS) which was meant to close down operations automatically if the tank was overfilled. The first gauge stuck and the IHLS was inoperable – there was therefore no means to alert the control room staff that the tank was filling to dangerous levels. By 0537 hrs on 11 December, the level within the tank exceeded its ultimate capacity and petrol started to spill out of vents in the tank roof.



Soon after that a white vapour was seen to emanate from the bund around the tank. In the windless conditions this vapour cloud, which was likely to have been a mixture of hydrocarbons and ice crystals, gradually spread to a diameter of about 360 metres, including areas off the Buncefiield site.

The vapour cloud was noticed by members of the public off site and by tanker drivers on site waiting to fill their vehicles. They alerted employees on site. The fire alarm button was pressed at 0601 hrs, which sounded the alarm and started the firewater pump. A ‘vapour cloud explosion’ occurred almost immediately, probably ignited by a spark caused by the firewater pump starting. By the time the explosion occurred, over 250 000 litres of petrol had escaped from the tank.

The British Geological Survey monitored the event, which measured 2.4 on the Richter Scale. It was reported that people were woken in south London, and as far west as 28 miles (45 km)), where in its southern suburb, numerous people felt the shockwave after the initial explosion. Subsequent explosions occurred at 06:27 and 06:28.

Several nearby office blocks were hit so badly that almost every window, front and back, was blown in as the explosion ripped through them. During the working day, these offices would have been full of people, and many deaths may have resulted.

Reaction and Response

The emergency services announced a major emergency at 06:08 and a huge fire fighting effort began. At peak times this effort consisted of 25 fire engines, 20 support vehicles and 180 fire fighters. Around 150 firefighters were called immediately to the incident, and began tackling the blaze at 08:20 on the morning of 12 December, putting in containment measures before applying a large quantity of foam. Plans had been in place to start using foam at midnight on 11 December, but were delayed by last-minute concerns over possible pollution of local rivers and underlying water sources.
Half of the 20 individual fires were reported extinguished by midday.

By 16:30 on Monday 12 December, it was reported that a further two tank fires had been extinguished, but that one of the tanks extinguished earlier had ruptured and re-ignited, and was now threatening to cause the explosion of an adjacent tank. By midday on 13 December, all but three fires had been extinguished, although the largest tank was still burning. t was reported at 16:45 that all tank fires had been extinguished, although some smaller fires persisted. 75% of firefighters for Hertfordshire were involved in fighting the fire, supported by 16 other brigades.

Hundreds of homes in the Hemel Heapstead area were evacuated, and about 2,000 people had to find alternative accommodation; emergency services asked residents of the smoke-affected areas to close their windows and doors and to stay inside.

Seventy-eight schools in Luton were closed on 13 December, along with a limited number of schools in Bedforshire on the advice of Hertfordshire's Health Protection Agency that all schools within a 10-mile (16 km) radius of the incident site should be closed because of concerns surrounding the effect of the smoke plume on children's health. Schools reopened as normal on 14 December.
The incident occurred close to junction 8 of the M1 motorway.The motorway was shut between junctions 12 and 6a—about 18 miles (29 km)—shortly after the incident. Other roads in the vicinity were also closed. Fuel shortages continued for months after the explosion.

Root causes of the loss of containment analysis 

What lay behind the immediate cause and subsequent failures of containment?

Tank 912 was fitted with a new independent high-level switch (IHLS) on 1 July 2004. This had been designed, manufactured and supplied by TAV Engineering Ltd. TAV had designed the switch so that some of its functionality could be routinely tested. AV was aware that its switches were used in high-hazard installations and therefore were likely to be safety critical. The design fault could have been eradicated at an early stage if the design changes had been subjected to a rigorous review process. In any event, clear guidance, including instructions about the safety criticality of the padlock, should have been passed on to installers and users. It appears that nobody within Motherwell knew the safety critical significance of the padlock. The IHLS on Tank 912 was installed without the padlock because it seems that Motherwell staff thought it was for security ‘anti-tamper’ purposes only. In addition to the failures of the manufacturers and installers of the IHLS, the site operator did not exercise sufficient oversight of the ordering, installation and testing procedure. While the switch was periodically tested, none of the staff at the HOSL site was aware of the need for the padlock to be replaced so that the test lever was held in the correct position. The site operator should have had greater oversight of safety critical operations and equipment so that they understood fully how it worked, particularly given the expertise available within large oil companies.

Failure of the ATG system was the other immediate cause of the incident. The servo-gauge had stuck (causing the level gauge to ‘flatline’) – and not for the first time. In fact it had stuck 14 times between 31 August 2005, when the tank was returned to service after maintenance, and 11 December 2005. Sometimes supervisors rectified the symptoms of sticking by raising the gauge to its highest position then letting it settle again, a practice known as ‘stowing’.

Prior to the Buncefield incident, petroleum storage sites were generally not considered to be sites where an explosion incident on this scale could occur. Buncefield challenged this worldwide perception. Buncefield Major Incident Investigation Board Publish Recommendations on four main areas :
·        The Design and Operation of Fuel Storage Sites
·        Emergency preparedness and response,
·        Explosion Mechanism,
·        Land Use Planning.
On design and operations at storage sites, the paramount need is for precautions to be in place to prevent fuel escaping from the vessels in which it is contained. Further precautions are needed if fuel does escape, to prevent it forming a flammable vapour and stop pollutants contaminating the environment.

Those recommendations covered a total of 86 sites in England & Wales !

Links:

BBC article on Buncefield explosion:
Buncefield Revisited: Lessons Learned, Progress Made Webinar – ABS Group
https://www.youtube.com/watch?v=U1J6NatGZFI
Buncefield Investigation Homepage
Reports of the Major Incident Investigation Board




Romeoville: Refinery explosion and fire

Romeoville
- Refinery explosion and fire -

Video from broadcast news:



Summary data:
Date: July 23, 1984
Place: Union Oil Company refinery in Romeoville, Illinois
Type of accident: Explosion & fire
Outcome: 2 major explosions, Structures burning once isolated burned out on their own;               
17 people dead (11 firefighters), 22 injured persons ;
Estimated cost: $ ~530 million (repairs and compensation)
Lawsuit: Settlement in 1989 ($29.9 million for victims)


About the refinery

Union Oil refinery employed more than 700 workers and processed 151,000 barrels of oil a day.


What happened?

5h45 p.m. :               Vapor leak was noticed on a Vessel
 About the Vessel :
- Amine absorber removing H2S from acid stream
- 55 foot tall, one-inch thick carbon steel (34-tonne storage)
                                       - Pressured
Refinery workers, including the outside operator and an assistant outside operator, unsuccessfully attempted to by-pass the vessel and to depressurize it.

5:52 p.m. :                 The leak in the vessel wall had spread around the entire eight foot circumference of the vessel and it erupted like a missile. The top 45 feet of the vessel was lifted by the vapor cloud. The bottom 10 feet of the vessel stayed intact on the ground. The eruption of the vessel released a massive vapor cloud which ignited, causing a fire ball.

This explosion engulfed much of the refinery in flames.

Firefighters from the Union Oil Fire Brigade responded immediately with the company’s two engines, followed closely by the Romeoville Fire Department.

As a result of the explosion, many towers, tanks, and other refinery structures began to rupture or collapse and the site’s fire hydrant system was damaged. So firefighers were forced to draft water from a nearby sanitary canal.

They were just beginning to attack the flames when a tank containing liquefied petroleum gas erupted. The explosion created a huge fireball that rose thousands of feet into the air. Several members of the Union Oil Fire Brigade were caught in the blast. Later reports stated that the explosion was felt fifteen miles away.  Local residents recalled seeing a “bright mushroom cloud” emanating from the facility and a very powerfull blast.

The enormity of the fire brought mutual aid fire apparatus and ambulances from more than 30 cities, including two medical evacuation helicopters from the University of Chicago Hospital and a Chicago Fire Department fireboat sent via the sanitary canal. An AMOCO refinery in Indiana even sent truckloads of Aqueous Film-Forming Foam (AFFF) to help extinguish the fire.

Firefighters were needed to both put out the flames and also prevent more refinery structures from catching fire. Once the burning structures were isolated, fire officials determined that allowing the fires to burn out on their own was the safest way to extinguish the blaze. The fires burned throughout the night at temperatures of 2,200 °C, luckily without further explosions or loss of life, even though some workers jumped into the Illinois & Michigan Canal to escape the extreme heat.`

Amine vessel failure analysis

As required by law, the inside of the vessel was inspected every two years. The inspectors were Union Oil employees in management positions. The vessel was last inspected three months before the explosion and the vessel inspectors found no problems with the vessel. Testimony from one of Union Oil’s own engineers indicated that his metallurgical testing performed after the explosion indicated that there were cracks in the vessel walls at least four years before the accident. The plaintiff’s evidence established that Union Oil’s vessel inspectors made only a visual inspection which was inadequate to detect cracking within the vessel walls. The evidence indicated that Ultrasonic and wet magnetic particle testing techniques were well known and used in the oil industry to detect vessel wall cracking, but Union Oil did not use them on this vessel.


Three other primary contributors to the settlement, Santa Fe Braun, Inc., UOP, Inc., and the Ralph M. Parsons Company, had responsibilities relating to the erection, process design and functioning of this vessel. One of Santa Fe Braun’s corporate predecessors, C.F. Braun and Company, was the general contracting firm that erected the vessel. Its engineers helped to determine the process requirements and capabilities of this vessel, specifically including what amount of chemical activity would go on within the vessel. UOP was also involved in those decisions, made with respect to process engineering. The Ralph M. Parsons Company has been hired by Union Oil to revamp part of the refinery, including the subject vessel. In its revamp, Parsons altered some of the process requirements of that vessel, and as well, made independent determinations of the suitability of the vessel and its characteristics for use in the amine treating system. The Union Oil Compagny alleged that the process design work done by these three companies was inadequate in that it failed to provide for sufficient safeguarding against corrosion which contributed to the cracking and the failure of the vessel.
Union Oil determined that the operation of the subject vessel had caused significant metallurgical problems to the bottom portion of the vessel and that one of the vessel sections would need to be replaced. Welders from the Morrison Construction Company attempted to replace a major section of the vessel but due to poor quality control and inadequate welding work, were taken off the job by Union Oil and replaced by welders from the Nooter Corporation. Nooter’s welders finished the job using specifications which the Union Oil Compagny claimed were inadequate. The welding specifications used by Morrison and Nooter contributed to the "high hardness" of the metal adjacent to the weld, which made it more brittle and subject to failure.


Metallurgical testing work done after the explosion, both by engineers retained by Union Oil and engineers retained by the Illinois State Fire Marshall, showed that the cracking in this vessel which lead to the explosion and fire started in the metal adjacent to the welds done by Morrison and Nooter.

Links:

Chicago Tribune / 10 Years Later, Survivors And Witnesses Recall Fatal Refinery Blast In Romeoville:
http://articles.chicagotribune.com/1994-08-03/news/9408030340_1_refinery-explosion-mushroom-cloud-fire
Concise recaps:
US Departement of Labor Analysis: