Un quizz sécurité vous est proposé ici :
http://elan.ifp-school.com/blogsecu/quiz.html
Sunday, June 9, 2013
Wednesday, May 1, 2013
Explosion in FCC Unit
La Mède, France, Total, 1992
Summar data:
Date: November 9, 1992
Place: La Mède, South of France
Type of accident: Gas release from the gas
plant followed by lots of explosions
Outcome: 6 deaths (workers), 38 injured, 2
hectares damage (control room, Fluid Catalytic Cracking Unit and surrounding
process units. Loss about $600 million (facilities repair: 64%, loss of
production: 34%).
View of the fire during the accident (source:
AFP)
What
happened?
At 05:20 on
the morning of November 9, a major explosion occurred at the FCCU (Fluid
catalytic cracking unit) at Total’s La Mede refinery, in southern France.
Six
operators were killed, three of whom were in the control room, which collapsed.
Three others were seriously injured.
Little
contamination of the environment was reported as most of the water used to
extinguish the fires was collected and treated and the superficial
contamination of the lake was contained. No air contamination was measured.
The FCCU
and surrounding process units were severely damaged, resulting in the whole
refinery being shut down for several months, with the FCCU taking a year to
rebuild. Damage to property was reported in the town of Martigues, 4.5 km
(almost 3 miles) away. The total cost of the incident was around $600 million.
Red dots indicate where people died and green
ones where people were injured
Why?
How?
The
incident arose from a release of about 15 tons of hydrocarbons when a hole of
about 25 cm² in area, created through corrosion, suddenly appeared in a 200 mm
absorber stripper reflux cooler bypass line. The release occurred over about 10
minutes creating a large vapor cloud of 14 000m², which engulfed other process
units.
Hole in the bypass line
When the
cloud ignited, after touching the heater 100m away, the resulting overpressure
caused massive damage to the plant and equipment and collapsed the roof on the
process control room, killing 3 of the occupants and injured the others.
A massive
fire created a major domino effect that led to further loss of containment and
escalation. In addition to the FCCU gas recovery plant, four main areas were
affected: a main pipe rack, a building containing a turbine generator, a 2500
m3 spent caustic soda tank containing a layer of light hydrocarbon, and a 5000
m3 fuel oil tank.
Although
the fires in the turbine building and tankage were quickly extinguished, other
areas were allowed to burn under control for 3 days until their sources of fuel
were exhausted.
The control
room was built in 1953, and had not been retrospectively blast protected.
View of the
control room View of a
heavy gazole tank Gas plant
area after the accident
Managers’
responsibilities
An expert
witness claimed that the corrosion was foreseeable; leading to the conclusion
that management and maintenance were negligent.
In April
2002, a court found the then-President of Total guilty of involuntary
manslaughter and sentenced him to a suspended sentence of 18 months in prison
and a fine of 4500€. Two inspection managers (18 months suspended and 2500€),
two plant inspectors (4 months suspended and 1500€) were also sentenced.
Conclusion
Finally, as
in a lot of accidents, a combination of multiple factors leads to this terrible
ending. We propose here a list of lessons to be learned from this accident:
-
Build a blastproof control room, resistant to
shock waves, and locate it far from sensitive units.
Reinforce regulations about construction and
control of pipes and their accessories.
Keep enough space between units to avoid any
domino effect and to allow easier access to emergency services.
Increase the number of gas detectors,
positioned as close as possible to potential source of leakage to figure out the
presence of gas faster.
Install numerous sprinkler systems water
systems in “sensitive” areas to cool them down in case of fire in the unit.
Automate safety and security systems as far as
possible.
Sources :
Explosion de gaz dans les unités craquage
catalytique et gas plant d’une raffinerie, le 9 novembre 1992, Aria - Ministère
chargé de l'environnement, fiche juin 2008, available at http://www.aria.developpement-durable.gouv.fr/ressources/fd_3969_lamede_version090608.pdf
Monday, April 29, 2013
TEXAS CITY DISASTER
Another case of explosion with Ammonium Nitrate Fertilizer
One of the biggest disasters in this cursed
city, the Texas City which is a busy deepwater port on Texas' Gulf Coast, as
well as a petroleum refining and petrochemical manufacturing centre. Being a
major destination for chemical companies this city has been prone to many
disasters of which the one that occurred on the 16th April 1947 left
a big hole in the history of chemical industry.
This date is almost 2 years after nuclear
explosion in Japan by USA, 1 day after India achieved its Independence and 2
days after Pakistan got independence. The gruesome terror was bestowed on this
unfortunate city by a French ship named Grandcamp which was laden with Ammonium
Nitrate based fertilizer.
The
Accident, as it happened
The ship was docked in port of Texas City
and was loaded with approximately 2300 tons with Ammonium Nitrate fertilizer. In
the morning at 8:15 am smoke was observed to be coming out from the lower
decks. Attempts were made to arrest this fire using drinking water and hand
fire extinguishers but flames were seen to be increased. At this moment the
fire dosing pumps were ready to use the water but the second captain ordered
not to use water in order to save the cargo. But after 15 minutes when the
smoke continued to come out, the fire department was called in. But the
pressures continued to build and at 9:12 am the man-made disaster unleashed its
fury. A fury that is considered to be one of the biggest non-nuclear
explosions! The first explosion killed everyone in the blast radius implicating
the maximum fatalities of around 400.
The chemical plant of Monsanto was engulfed
in fires that originated from the blast and it literally burned this plant to
ashes. To add to the misery, another ship named SS High Flyer, in dock for repairs and also carrying ammonium
nitrate, was ignited by the first explosion; it was towed 100 feet from the
docks before it exploded about sixteen hours later, at 1:10 A.M. on April 17.
 |
Refineries and oil storage tanks of the Monsanto chemical plant burn in the waterfront area
in Texas City, Texas, April 16, 1947 |
Consequences
of this accident
In all, the explosions killed 581 and
injured over 5,000 people. The monetary losses are pegged at 1.03 billion
dollars.
 |
The SS Wilson B. Keene, destroyed in the disaster's second explosion
|
Lessons
learnt from this accident
This accident is referred to worst disaster
in American history and naturally it left a big mark. The reasons are more or
less the same that can happen even today but it is more about the best
practices that can be learnt from disasters of this scale.
Below are the reasons that lead to the
accident and are also in a sense the lessons learnt regarding the handling and
shipping of ammonium nitrate fertilizers are as follows:
1) All containers shall be tight. No
leaking or shifting containers or containers that give the evidence of leaking
or shifting shall be placed on board the vessel.
2) Shipper is required to give written notification
in advance to the vessel regarding the characters tics of a dangerous cargo.
3) No smoking is allowed during loading
operations.
4) In case of fire, e, immediate
application of water in large quantities is probably the best procedure, even
though a large water loss may result, as the ammonium nitrate is highly soluble
in water.
5) Gas masks should be worn by fire
fighters, as the oxides of nitrogen are toxic.
6) Packaging should be in metal drums or
tight wooden casks to prevent accidental spillage
7) Handling in transit should be done as
carefully as in storage.
8) Strict control over prevention of
contamination of fertilizer with acids, oxidizing compounds.
Sources
Thursday, April 25, 2013
Bhopal Disaster : The World’s Worst Industrial Disaster
Summary
data
Date :
December 3rd 1984
Place : Union Carbide India Limited
(UCIL) pesticide plant in Bhopal, India
Type of accident : Methyl Isocyanate (MIC) release
Outcome: The Bhopal disaster killed nearly 3,800
people immediately, 10,000 in the first days and between 15,000 and 20,000 in
the subsequent two decades due to early and late effects. 520,000 persons
were exposed to the gases and 100,000 people or more have been permanently
injured.
|
Overview of the accident :
 |
| Union Carbide Corporation location |
The plant was located on a site that was not
designed for hazardous industry but only for light industrial and commercial
use. The plant was initially only approved for the formulation of pesticides
from certain components such as Methyl Isocyanate (MIC) in relatively small
quantities. However, pressure from competition led UCIL to manufacture raw
materials and intermediate products for formulation of the final product within
one facility which required a more developed and hazardous process.
In these conditions, the accident was initiated when the MIC production unit had been shut down for 2 months for routine maintenance. On December 2, 1984, the factory management ordered the cleaning of several pipes linked to three MIC storage tanks.
In these conditions, the accident was initiated when the MIC production unit had been shut down for 2 months for routine maintenance. On December 2, 1984, the factory management ordered the cleaning of several pipes linked to three MIC storage tanks.
During the cleaning operation water and MIC mixed where many pipelines were interconnected.
 |
| MIC Release scenario |
Pressure and heat from the vigorous exothermic
reaction in the tank continued to build. The gas flare safety system was out of
action and had been for three months.
Nearly 2 hours later, a safety valve gave way and led to a sudden release of 40 tons of MIC into the atmosphere.
Environmental conditions had an aggravating
effect; due to the absence of wind that night, the toxic gas formed a huge
cloud, which stagnated over the city.
 |
| Death in Bhopal |
The number of people killed in the first few
days ran as high as 10,000, with 15,000 to 20,000 premature deaths in the
subsequent two decades.
The Indian government reported that more than
half a million people were exposed to the gas and several epidemiological
studies showed significant morbidity and increased mortality rates in the
exposed population.
Nearly twenty-eight years later, the Bhopal
disaster remains one of the worst industrial disasters ever, as the waste
stored in the site continues to contaminate groundwater and harm the
environment.
Dysfunctions analyses and lessons from the accident :
The Bhopal disaster revealed that expanding
industrialization in developing countries without concurrent evolution in
safety regulations can have catastrophic consequences.
Technical and organizational malfunctions were the
origin of the dysfunction in the redundant systems designed to capture and
neutralize Methyl Isocyanate at the reactor outlet in case of accident.
In fact, these systems were inoperative due to a maintenance problem (organizational dysfunction). In addition, because of the severe economic issues faced by the company, the plant safety systems were not designed to meet extreme cases (technical dysfunction) and then put-off the alert.
In fact, these systems were inoperative due to a maintenance problem (organizational dysfunction). In addition, because of the severe economic issues faced by the company, the plant safety systems were not designed to meet extreme cases (technical dysfunction) and then put-off the alert.
The adjacent slum population (dense
urbanization in the immediate vicinity of the site) was alerted too late.
Beside the different causes describes above,
there were some ethical issues which made the Bhopal accident a symbol of
negligence by the company and the government :
- Poor quality and lack of many instruments, safety equipment and reduced operation of critical systems
- Workers were never informed of the dangers of MIC as well as other chemicals
- The local community was never given any information about MIC and other chemicals
- Jobs were continually cut to reduce costs and many workers never had the expertise required for their positionsTraining went down from 6 months to 15 days.
The video below summarizes the steps of the accident development :
Sources :
- The Bhopal disaster and its aftermath by Edward Broughton, 2005, available at : http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1142333/
- Dec. 3, 1984: Bhopal - Worst Industrial Accident in History by Tony Long, 2010, available at : http://www.redicecreations.com/article.php?id=13417
- http://www.aria.developpement-durable.gouv.fr/ressources/fd_7022_bhopal_inde_ih_fr_vfinal08062010.pdf
Wednesday, April 24, 2013
Explosion of a superheater in a steam cracking unit
Saint-Avold - Carling TOTAL
Explosion of a superheater
in a steam cracking unit
Explosion of a superheater
in a steam cracking unit
Date: July 15, 2009
Place: Saint-Avold (Moselle), France
Type of accident: gas explosion
Outcome : 2 death (workers), 4
injured, overheaters damaged.
Hi all! Today we are going to
present to you the Saint-Avold accident, the one you were the MOST interested
in, according to the survey we did.
Why were
you so interested in it? It is not the deadliest accident in the history of our
industry and no contamination of the environment was reported… So, you may want
to know more about this accident simply because it took place in France,
recently (2009), and because Total’s indictment was announced last year? We
hope you are going to learn some more about that in this article.
Where
did this accident take place?
Carling is
a small city in the northeast of France, where an important industrial platform
has been built in the 50s, for chemical and petrochemical activities.
External view of the Carling
site
The unit involved was the steam cracker. Its role was
to convert a light naphtha into lighter molecules such as ethylene, propylene
and methane, which are then used to make polyethylene
and polystyrene. The cracking reaction takes place at a high temperature.
In the Carling installation, the steam was first
produced in a heat exchanger by cooling down the outlet stream from the
cracking heaters. This steam is overheated in two overheaters to avoid
the formation of droplets. The superheated steam is then used as the driving
force for the cracked gas compressor.
Two unit’s superheaters,
on the left
What happened?
During the night of July 13 to 14, 2009, heavy
rains leaked into a technical room. As the electrical board was damaged, the
steam cracker unit was stopped and secured.
On the morning of the 14th of July, the
restart procedure of the unit was began. At 3pm, the superheater was reset in
order to proceed to the manual light-up of the burners.
An operator, with a long lighter, came above the
heater to light the pilot flame.
The superheater exploded at this moment.
Two operators, above the superheater, died. Four suffered
2nd degree burns. Material damages only occurred to the superheater
and its close environment.
No environmental or sanitary damage has been
reported, no fire, no particle cloud, no contamination. Some pieces of the
heater, including parts of the refractory, up to 50 cm in diameter, were 100m
away but no other unit was affected by any domino effect.
What actually happened?
One of the burners was probably leaking and some
inflammable gases accumulated in the heater, and reached the explosive limits.
The operator then lit the gas cloud, which exploded.
Some elements have been identified as having
contributed to the accident:
- The superheater was not flushed with steam before the light-up, in spite of the procedure recommended by the manufacturer.
- The gas feed to a burner is allowed even if no flame is present on the associated pilot.
- The safety device which forbid the gas feed of the burner without any flame was not working.
- The superheater was not flushed with steam before the light-up, in spite of the procedure recommended by the manufacturer.
- The gas feed to a burner is allowed even if no flame is present on the associated pilot.
- The safety device which forbid the gas feed of the burner without any flame was not working.
This device was supposed to turn off the gas inlet if no flame was detected on the burner for 10 seconds. This device was not reliable and it regularly shut down the superheater without any reason so it would have been turned off.
The consequences:
We now have to flush the superheater with steam and
measure the explosive limit before lighting the pilot. In addition, a correctly
functioning safety device must be installed to shut down the gas feed if there
is no flame.
The company operating in Carling, Total, actually
had to review all the starting sequences to include all these safety paths.
They also had to automate all the procedure, which reduce the presence of
operators around the superheater during the startup.
Conclusion:
Above all, please remember that safety devices are
used to ensure your safety, and that you, and all workers come back home safe.
They are definitely not there to be turned off because it annoys everybody (and
because nobody actually remembers what it is really for… right?).
Remember: it is far easier to fix a problem with a
device than call your team members’ families with bad news!
Sources:
Sources:
Flixborough Disaster - Explosion of a Cyclohexane Cloud
Flixborough Disaster
Explosion of a Cyclohexane Cloud
Summary
data:
Date: June 1st, 1974
Place: Flixborough, United Kingdom
Type of accident: Explosion in a cyclohexane
processing plant
Outcome: 28 deaths (workers), 89 injured (36 on site, 53 off-site), 1821 damaged
houses. Loss about $66 million which is
equivalent to $200 million today .
Almost 40 years after
the explosion at the Flixborough chemical plant, the mystery remains as to the
true causes of this accident.
View of the
Flixborough chemical plant after the explosion
The story began in 1938 when a plant to produce
fertilisers was built near the village of Flixborough. Then, it evolved in 1964
to produce caprolactam, a precursor for the manufacture of Nylon. The process used the hydrogenation of
phenol. In 1972, a new unit was implemented to increase the production to 70000
tons per year. The technology was based on the oxidation of cyclohexane into
cyclohexanone : this process was known to be more hazardous than the phenol
process.
Nevertheless, the company Nypro, owner of the
site, was experiencing serious economic problems. In reality, the unit only
produced 47 000 tons of caprolactam per year. Last but not least, the
government had been with a miners’ strike since 1973. They declared a state of
emergency and established a three day working week to save electricity. It was
not possible to operate the process on this basis. So emergency generators were
used to run the essential equipment and other equipment, such as the six
stirrers in the cyclohexane reactors, was stopped.
Overview of
the accident: The largest industrial explosion ever in the UK
To understand the accident, the diagram below
represents the unit concerned and its process.
In the six in-line stirred reactors, the
cyclohexane is oxidized by injecting compressed air. The process operates at
8,8 bar and 155°C and produces cyclohexanone and cyclohexanol. But this
reaction yield is low, therefore, the cyclohexane is recirculated to feed it
again.
Configuration of the
cyclohexane oxidation process
On Saturday 1 June 1974 at 4:53 pm, the plant
and all the surrounding buildings within 600 meters were devastated. The
deflagration was heard up to 50 kms away. This accident caused the death of 28
workers, with no survivors from the control room, and 89 people were injured: 36 on site, 53 off-site. The fires
burned for several days. The only ‘positive’ point in this tragedy is the
accident happened during the week-end. On a regular weekday, 550 employees
worked there.
 |
| By-pass pipe between reactors 4 and 6 |
The immediate cause of the main
explosion was the rupture of the 20 inch by-pass assembly between reactors 4
and 6. 40 to 60 tons of cyclohexane
escaped and were ignited 30 seconds after by the reforming tower forming a
cloud two hundred meters in diameter and 100 meters in height. Before this
explosion, on 27 March, a vertical crack in reactor 5 had been discovered
leading to a cyclohexane leak. A serious problem was identified, so this
reactor was removed and replaced by a simple by-pass between reactors 4 and 6.
Causes: No
witnesses … Several theories
Despite the investigation lead by the Secretary
of State for Employment, no unanimous conclusion could be drawn. However several
theories were born to explain the rupture of the 20 inch by-pass assembly between
reactors 4 and 6.
The 20 inch pipe theory
According to the inquiry, the 20 inch pipe
broke because of temperature and pressure conditions higher than usual, even if
they were within the range of operating conditions. Simulation tests could not replicate
failure at similar conditions, so an ambiguity remained. The real cause
remained the assembly pipe between reactors 4 and 6 since no study and no test
were launched before its installation. The problem on reactor 5 should have
been studied before running the unit again. In fact, the reactors had been sprayed
with water to dilute the cyclohexane leaks to limit flammability, but the
nitrates of the water dripped into the steel pipe and caused to corrosion.
The 8 inch hypothesis
An alternative theory was studied, based on the
8 inch pipe hypothesis. It stated that the first explosion could have been due
to a cyclohexane leak on an 8 inch pipe causing failure of the main 20 inch
by-pass. The problem on the 8 inch pipe could have been due to faulty seals or
check valve, bad fitting of two bolts, contact between zinc and steel, leading
to a double leak of cyclohexane and then the cracking of the 20 inch pipe.
This theory was abandoned because the
succession of events was too improbable.
The water theory
The last theory was not considered by the
inquiry since it was formulated by scientists who continued to work on it after its closure. The rupture of
the 20 inch pipe could be due to a sudden rise of pressure because of the water
presents in reactor 4. An azeotrope could have formed between the water and the
cyclohexane. Normally there is no water in the reactors but on the day of the
accident, the stirrer (reactor 4) had a mechanical problem and was
stopped: water may have been present.
Cyclohexane and water are normally immiscible.
The stirrers normally prevent the water from having a low solubility in the cyclohexane
but, that day, two phases may have occurred with an unstable interfacial layer,
the azeotrope. At start-up, the temperature increased, the boiling point of the
azeotrope was reached and this may have led to a sudden pressure rise and the
cyclohexane ejection. The bypass failed under the high pressure in the reactor.
Lessons from
the accident
Facilities design: The place and the structure of the
control room have to be carefully chosen. The best solution is to be as far
away as possible from the more hazardous units and to minimize the quantity of
dangerous products on the site.
Process modifications: For hazardous processes, every little change has to follow the same
standards. Good industry practices require that modifications should not be
carried out without having undertaken a safety, engineering and technical
review. In this case, there was no professional engineer in the plant at the time
of the accident. For example, they needed a 28 inch pipe to join reactors 4 and
6, but they only had a 20 inch pipe… they fitted it with strapping and a plate
instead of shutting down the unit.
Maintenance planning (anticipation): It is essential to establish a planning to
anticipate the problems. If a problem occurs temporary repairs are not the
solution, particularly if it stays in place 2 months (as was the case). The
startup of a unit after a problem must only take place after identifying the
causes.
Human analysis: The employees who are responsible
for the unit should know the unit, the risks and how to find the basic
documents in case of a problem (technical documents, design specifications …).
Experienced people may recognize the precursors of an accident.
Last but not least, the employees do not have
to choose between safety and production: safety comes first.
Sources:
- Explosion catastrophique d’un nuage de cyclohexane, le 1er
juin 1974, Aria - Ministère chargé de l'environnement, fiche mai 2008,
available at http://www.aria.developpement-durable.gouv.fr/ressources/5611_flixborough_eb_fr1.pdf
- Major
Technological Risk, An assessment of Industrial Disasters – P. Lagadec,
translated by H. Ostwald, available at http://www.patricklagadec.net/fr/pdf/Amoco_Cadiz_EN.pdf
Subscribe to:
Posts (Atom)