Wednesday, May 1, 2013


Explosion in FCC Unit 

La Mède, France, Total, 1992


Summar data:
Date: November 9, 1992
Place: La Mède, South of France
Type of accident: Gas release from the gas plant followed by lots of explosions
Outcome: 6 deaths (workers), 38 injured, 2 hectares damage (control room, Fluid Catalytic Cracking Unit and surrounding process units. Loss about $600 million (facilities repair: 64%, loss of production: 34%). 


 View of the fire during the accident (source: AFP)

What happened?

At 05:20 on the morning of November 9, a major explosion occurred at the FCCU (Fluid catalytic cracking unit) at Total’s La Mede refinery, in southern France.
Six operators were killed, three of whom were in the control room, which collapsed. Three others were seriously injured.
Little contamination of the environment was reported as most of the water used to extinguish the fires was collected and treated and the superficial contamination of the lake was contained. No air contamination was measured.
The FCCU and surrounding process units were severely damaged, resulting in the whole refinery being shut down for several months, with the FCCU taking a year to rebuild. Damage to property was reported in the town of Martigues, 4.5 km (almost 3 miles) away. The total cost of the incident was around $600 million.

Red dots indicate where people died and green ones where people were injured

Why? How?

The incident arose from a release of about 15 tons of hydrocarbons when a hole of about 25 cm² in area, created through corrosion, suddenly appeared in a 200 mm absorber stripper reflux cooler bypass line. The release occurred over about 10 minutes creating a large vapor cloud of 14 000m², which engulfed other process units.


Hole in the bypass line

When the cloud ignited, after touching the heater 100m away, the resulting overpressure caused massive damage to the plant and equipment and collapsed the roof on the process control room, killing 3 of the occupants and injured the others.
A massive fire created a major domino effect that led to further loss of containment and escalation. In addition to the FCCU gas recovery plant, four main areas were affected: a main pipe rack, a building containing a turbine generator, a 2500 m3 spent caustic soda tank containing a layer of light hydrocarbon, and a 5000 m3 fuel oil tank.
Although the fires in the turbine building and tankage were quickly extinguished, other areas were allowed to burn under control for 3 days until their sources of fuel were exhausted.
The control room was built in 1953, and had not been retrospectively blast protected.


             View of the control room                View of a heavy gazole tank        Gas plant area after the accident


Managers’ responsibilities

An expert witness claimed that the corrosion was foreseeable; leading to the conclusion that management and maintenance were negligent.
In April 2002, a court found the then-President of Total guilty of involuntary manslaughter and sentenced him to a suspended sentence of 18 months in prison and a fine of 4500€. Two inspection managers (18 months suspended and 2500€), two plant inspectors (4 months suspended and 1500€) were also sentenced.

Conclusion

Finally, as in a lot of accidents, a combination of multiple factors leads to this terrible ending. We propose here a list of lessons to be learned from this accident:
-        
Build a blastproof control room, resistant to shock waves, and locate it far from sensitive units.
Reinforce regulations about construction and control of pipes and their accessories.
Keep enough space between units to avoid any domino effect and to allow easier access to emergency services.
Increase the number of gas detectors, positioned as close as possible to potential source of leakage to figure out the presence of gas faster.
Install numerous sprinkler systems water systems in “sensitive” areas to cool them down in case of fire in the unit.
Automate safety and security systems as far as possible.


Sources :
Explosion de gaz dans les unités craquage catalytique et gas plant d’une raffinerie, le 9 novembre 1992, Aria - Ministère chargé de l'environnement, fiche juin 2008, available at http://www.aria.developpement-durable.gouv.fr/ressources/fd_3969_lamede_version090608.pdf

Monday, April 29, 2013


TEXAS CITY DISASTER 

Another case of explosion with Ammonium Nitrate Fertilizer





One of the biggest disasters in this cursed city, the Texas City which is a busy deepwater port on Texas' Gulf Coast, as well as a petroleum refining and petrochemical manufacturing centre. Being a major destination for chemical companies this city has been prone to many disasters of which the one that occurred on the 16th April 1947 left a big hole in the history of chemical industry.

This date is almost 2 years after nuclear explosion in Japan by USA, 1 day after India achieved its Independence and 2 days after Pakistan got independence. The gruesome terror was bestowed on this unfortunate city by a French ship named Grandcamp which was laden with Ammonium Nitrate based fertilizer.

The Accident, as it happened

The ship was docked in port of Texas City and was loaded with approximately 2300 tons with Ammonium Nitrate fertilizer. In the morning at 8:15 am smoke was observed to be coming out from the lower decks. Attempts were made to arrest this fire using drinking water and hand fire extinguishers but flames were seen to be increased. At this moment the fire dosing pumps were ready to use the water but the second captain ordered not to use water in order to save the cargo. But after 15 minutes when the smoke continued to come out, the fire department was called in. But the pressures continued to build and at 9:12 am the man-made disaster unleashed its fury. A fury that is considered to be one of the biggest non-nuclear explosions! The first explosion killed everyone in the blast radius implicating the maximum fatalities of around 400.

The chemical plant of Monsanto was engulfed in fires that originated from the blast and it literally burned this plant to ashes. To add to the misery, another ship named SS High Flyer, in dock for repairs and also carrying ammonium nitrate, was ignited by the first explosion; it was towed 100 feet from the docks before it exploded about sixteen hours later, at 1:10 A.M. on April 17.



Refineries and oil storage tanks of the Monsanto chemical plant burn in the waterfront area 

in Texas City, Texas, April 16, 1947



Consequences of this accident

In all, the explosions killed 581 and injured over 5,000 people. The monetary losses are pegged at 1.03 billion dollars.

The SS Wilson B. Keene, destroyed in the disaster's second explosion



Lessons learnt from this accident


This accident is referred to worst disaster in American history and naturally it left a big mark. The reasons are more or less the same that can happen even today but it is more about the best practices that can be learnt from disasters of this scale.

Below are the reasons that lead to the accident and are also in a sense the lessons learnt regarding the handling and shipping of ammonium nitrate fertilizers are as follows:

1) All containers shall be tight. No leaking or shifting containers or containers that give the evidence of leaking or shifting shall be placed on board the vessel.
2) Shipper is required to give written notification in advance to the vessel regarding the characters tics of a dangerous cargo.
3) No smoking is allowed during loading operations.
4) In case of fire, e, immediate application of water in large quantities is probably the best procedure, even though a large water loss may result, as the ammonium nitrate is highly soluble in water.
5) Gas masks should be worn by fire fighters, as the oxides of nitrogen are toxic.
6) Packaging should be in metal drums or tight wooden casks to prevent accidental spillage
7) Handling in transit should be done as carefully as in storage.
8) Strict control over prevention of contamination of fertilizer with acids, oxidizing compounds.


Sources



Thursday, April 25, 2013


Bhopal Disaster : The World’s Worst Industrial Disaster



  

Summary data
Date :  December 3rd  1984
Place : Union Carbide India Limited (UCIL) pesticide plant in Bhopal, India
Type of accident : Methyl Isocyanate (MIC) release
Outcome:  The Bhopal disaster killed nearly 3,800 people immediately, 10,000 in the first days and between 15,000 and 20,000 in the subsequent two decades due to early and late effects. 520,000 persons were exposed to the gases and 100,000 people or more have been permanently injured.





Overview of the accident :

Union Carbide Corporation location
In the 1970s, the Indian government introduced policies to encourage foreign companies to invest in local industry. Union Carbide Corporation (UCC) applied to build a plant for the manufacture of Sevin, a pesticide commonly used throughout Asia. Under the agreement, the Government of India insisted that a significant percentage of the investment come from local shareholders. The government itself had a 22% stake in the subsidiary Union Carbide India Limited company (UCIL).

The plant was located on a site that was not designed for hazardous industry but only for light industrial and commercial use. The plant was initially only approved for the formulation of pesticides from certain components such as Methyl Isocyanate (MIC) in relatively small quantities. However, pressure from competition led UCIL to manufacture raw materials and intermediate products for formulation of the final product within one facility which required a more developed and hazardous process.


In these conditions, the accident was initiated when the MIC production unit had been shut down for 2 months for routine maintenance. On December 2, 1984, the factory management ordered the cleaning of several pipes linked to three MIC storage tanks.

During the cleaning operation water and MIC mixed where many pipelines were interconnected.

MIC Release scenario
In fact a jumper line (installed several months prior to the disaster to ease routine maintenance) allowed water to flow through. Along with another leaky pipe connected to the MIC tank (610) the water was able to pass into it and triggered the reaction between 1 ton of water and 40 tons of MIC.

An operator noticed a small leak of methyl isocyanate (MIC) gas and increasing pressure inside the storage tank. The vent-gas scrubber, a safety device designer to neutralize toxic discharge from the MIC system, had been turned off three weeks prior.
Pressure and heat from the vigorous exothermic reaction in the tank continued to build. The gas flare safety system was out of action and had been for three months.

Nearly 2 hours later, a safety valve gave way and led to a sudden release of 40 tons of MIC into the atmosphere.

Environmental conditions had an aggravating effect; due to the absence of wind that night, the toxic gas formed a huge cloud, which stagnated over the city.
Death in Bhopal
Within hours, the streets of the adjacent area were littered with human corpses and the carcasses of animals; 3,800 people died immediately, mostly in the poor slums in the vicinity of the UCC site.
The number of people killed in the first few days ran as high as 10,000, with 15,000 to 20,000 premature deaths in the subsequent two decades.
The Indian government reported that more than half a million people were exposed to the gas and several epidemiological studies showed significant morbidity and increased mortality rates in the exposed population.
Nearly twenty-eight years later, the Bhopal disaster remains one of the worst industrial disasters ever, as the waste stored in the site continues to contaminate groundwater and harm the environment.


Dysfunctions analyses and lessons from the accident :


The Bhopal disaster revealed that expanding industrialization in developing countries without concurrent evolution in safety regulations can have catastrophic consequences.
Technical and organizational malfunctions were the origin of the dysfunction in the redundant systems designed to capture and neutralize Methyl Isocyanate at the reactor outlet in case of accident. 

In fact, these systems were inoperative due to a maintenance problem (organizational dysfunction). In addition, because of the severe economic issues faced by the company, the plant safety systems were not designed to meet extreme cases (technical dysfunction) and then put-off the alert.


The adjacent slum population (dense urbanization in the immediate vicinity of the site) was alerted too late.
Beside the different causes describes above, there were some ethical issues which made the Bhopal accident a symbol of negligence by the company and the government :
  • Poor quality and lack of many instruments, safety equipment and reduced operation of critical systems
  • Workers were never informed of the dangers of MIC as well as other chemicals
  • The local community was never given any information about MIC and other chemicals
  • Jobs were continually cut to reduce costs and many workers never had the expertise required for their positionsTraining went down from 6 months to 15 days.

The video below summarizes the steps of the accident development :





Sources :










Wednesday, April 24, 2013

Explosion of a superheater in a steam cracking unit


Saint-Avold - Carling TOTAL
Explosion of a superheater 
in a steam cracking unit

Date: July 15, 2009
Place: Saint-Avold (Moselle), France
Type of accident: gas explosion
Outcome : 2 death (workers), 4 injured, overheaters damaged.

Hi all! Today we are going to present to you the Saint-Avold accident, the one you were the MOST interested in, according to the survey we did.

Why were you so interested in it? It is not the deadliest accident in the history of our industry and no contamination of the environment was reported… So, you may want to know more about this accident simply because it took place in France, recently (2009), and because Total’s indictment was announced last year? We hope you are going to learn some more about that in this article.


Where did this accident take place?

Carling is a small city in the northeast of France, where an important industrial platform has been built in the 50s, for chemical and petrochemical activities.

 External view of the Carling site

The unit involved was the steam cracker. Its role was to convert a light naphtha into lighter molecules such as ethylene, propylene and methane, which are then used to make polyethylene and polystyrene. The cracking reaction takes place at a high temperature.
In the Carling installation, the steam was first produced in a heat exchanger by cooling down the outlet stream from the cracking heaters. This steam is overheated in two overheaters to avoid the formation of droplets. The superheated steam is then used as the driving force for the cracked gas compressor.
 Two unit’s superheaters, on the left

What happened?

During the night of July 13 to 14, 2009, heavy rains leaked into a technical room. As the electrical board was damaged, the steam cracker unit was stopped and secured.
On the morning of the 14th of July, the restart procedure of the unit was began. At 3pm, the superheater was reset in order to proceed to the manual light-up of the burners.
An operator, with a long lighter, came above the heater to light the pilot flame.

The superheater exploded at this moment.

Two operators, above the superheater, died. Four suffered 2nd degree burns. Material damages only occurred to the superheater and its close environment.
No environmental or sanitary damage has been reported, no fire, no particle cloud, no contamination. Some pieces of the heater, including parts of the refractory, up to 50 cm in diameter, were 100m away but no other unit was affected by any domino effect.

View of damages on the top and the floor of the superheater

What actually happened?

One of the burners was probably leaking and some inflammable gases accumulated in the heater, and reached the explosive limits. The operator then lit the gas cloud, which exploded.

Some elements have been identified as having contributed to the accident:
The superheater was not flushed with steam before the light-up, in spite of the procedure recommended by the manufacturer.
The gas feed to a burner is allowed even if no flame is present on the associated pilot.
The safety device which forbid the gas feed of the burner without any flame was not working. 

This device was supposed to turn off the gas inlet if no flame was detected on the burner for 10 seconds. This device was not reliable and it regularly shut down the superheater without any reason so it would have been turned off.

The consequences:

We now have to flush the superheater with steam and measure the explosive limit before lighting the pilot. In addition, a correctly functioning safety device must be installed to shut down the gas feed if there is no flame.
The company operating in Carling, Total, actually had to review all the starting sequences to include all these safety paths. They also had to automate all the procedure, which reduce the presence of operators around the superheater during the startup.

Conclusion:

Above all, please remember that safety devices are used to ensure your safety, and that you, and all workers come back home safe. They are definitely not there to be turned off because it annoys everybody (and because nobody actually remembers what it is really for… right?).
Remember: it is far easier to fix a problem with a device than call your team members’ families with bad news!

Sources:





Flixborough Disaster - Explosion of a Cyclohexane Cloud

Flixborough Disaster

Explosion of a Cyclohexane Cloud

Summary data:
Date: June 1st, 1974
Place: Flixborough, United Kingdom
Type of accident: Explosion in a cyclohexane processing plant
Outcome: 28 deaths (workers), 89 injured  (36 on site, 53 off-site), 1821 damaged houses. Loss about $66 million which is equivalent to $200 million today .

Almost 40 years after the explosion at the Flixborough chemical plant, the mystery remains as to the true causes of this accident. 


View of the Flixborough chemical plant after the explosion
  
The story began in 1938 when a plant to produce fertilisers was built near the village of Flixborough. Then, it evolved in 1964 to produce caprolactam, a precursor for the manufacture of Nylon. The process used the hydrogenation of phenol. In 1972, a new unit was implemented to increase the production to 70000 tons per year. The technology was based on the oxidation of cyclohexane into cyclohexanone : this process was known to be more hazardous than the phenol process.

Nevertheless, the company Nypro, owner of the site, was experiencing serious economic problems. In reality, the unit only produced 47 000 tons of caprolactam per year. Last but not least, the government had been with a miners’ strike since 1973. They declared a state of emergency and established a three day working week to save electricity. It was not possible to operate the process on this basis. So emergency generators were used to run the essential equipment and other equipment, such as the six stirrers in the cyclohexane reactors, was stopped.

Overview of the accident: The largest industrial explosion ever in the UK

To understand the accident, the diagram below represents the unit concerned and its process.
In the six in-line stirred reactors, the cyclohexane is oxidized by injecting compressed air. The process operates at 8,8 bar and 155°C and produces cyclohexanone and cyclohexanol. But this reaction yield is low, therefore, the cyclohexane is recirculated to feed it again.
Configuration of the cyclohexane oxidation process

On Saturday 1 June 1974 at 4:53 pm, the plant and all the surrounding buildings within 600 meters were devastated. The deflagration was heard up to 50 kms away. This accident caused the death of 28 workers, with no survivors from the control room, and 89 people were injured: 36 on site, 53 off-site. The fires burned for several days. The only ‘positive’ point in this tragedy is the accident happened during the week-end. On a regular weekday, 550 employees worked there. 
By-pass pipe between reactors 4 and 6


The immediate cause of the main explosion was the rupture of the 20 inch by-pass assembly between reactors 4 and 6.  40 to 60 tons of cyclohexane escaped and were ignited 30 seconds after by the reforming tower forming a cloud two hundred meters in diameter and 100 meters in height. Before this explosion, on 27 March, a vertical crack in reactor 5 had been discovered leading to a cyclohexane leak. A serious problem was identified, so this reactor was removed and replaced by a simple by-pass between reactors 4 and 6.


 Causes: No witnesses … Several theories

Despite the investigation lead by the Secretary of State for Employment, no unanimous conclusion could be drawn. However several theories were born to explain the rupture of the 20 inch by-pass assembly between reactors 4 and 6. 

The 20 inch pipe theory
According to the inquiry, the 20 inch pipe broke because of temperature and pressure conditions higher than usual, even if they were within the range of operating conditions. Simulation tests could not replicate failure at similar conditions, so an ambiguity remained. The real cause remained the assembly pipe between reactors 4 and 6 since no study and no test were launched before its installation. The problem on reactor 5 should have been studied before running the unit again. In fact, the reactors had been sprayed with water to dilute the cyclohexane leaks to limit flammability, but the nitrates of the water dripped into the steel pipe and caused to corrosion.

The 8 inch hypothesis
An alternative theory was studied, based on the 8 inch pipe hypothesis. It stated that the first explosion could have been due to a cyclohexane leak on an 8 inch pipe causing failure of the main 20 inch by-pass. The problem on the 8 inch pipe could have been due to faulty seals or check valve, bad fitting of two bolts, contact between zinc and steel, leading to a double leak of cyclohexane and then the cracking of the 20 inch pipe.
This theory was abandoned because the succession of events was too improbable.

The water theory
The last theory was not considered by the inquiry since it was formulated by scientists who continued to  work on it after its closure. The rupture of the 20 inch pipe could be due to a sudden rise of pressure because of the water presents in reactor 4. An azeotrope could have formed between the water and the cyclohexane. Normally there is no water in the reactors but on the day of the accident, the stirrer (reactor 4) had a mechanical problem and was stopped:  water may have been present.
Cyclohexane and water are normally immiscible. The stirrers normally prevent the water from having a low solubility in the cyclohexane but, that day, two phases may have occurred with an unstable interfacial layer, the azeotrope. At start-up, the temperature increased, the boiling point of the azeotrope was reached and this may have led to a sudden pressure rise and the cyclohexane ejection. The bypass failed under the high pressure in the reactor.

Lessons from the accident

Facilities design: The place and the structure of the control room have to be carefully chosen. The best solution is to be as far away as possible from the more hazardous units and to minimize the quantity of dangerous products on the site.

Process modifications: For hazardous processes, every little change has to follow the same standards. Good industry practices require that modifications should not be carried out without having undertaken a safety, engineering and technical review. In this case, there was no professional engineer in the plant at the time of the accident. For example, they needed a 28 inch pipe to join reactors 4 and 6, but they only had a 20 inch pipe… they fitted it with strapping and a plate instead of shutting down the unit.

Maintenance planning (anticipation): It is essential to establish a planning to anticipate the problems. If a problem occurs temporary repairs are not the solution, particularly if it stays in place 2 months (as was the case). The startup of a unit after a problem must only take place after identifying the causes.

Human analysis: The employees who are responsible for the unit should know the unit, the risks and how to find the basic documents in case of a problem (technical documents, design specifications …). Experienced people may recognize the precursors of an accident.
Last but not least, the employees do not have to choose between safety and production: safety comes first.

    Sources:
  - Explosion catastrophique d’un nuage de cyclohexane, le 1er juin 1974, Aria - Ministère chargé de l'environnement, fiche mai 2008, available at http://www.aria.developpement-durable.gouv.fr/ressources/5611_flixborough_eb_fr1.pdf
   - Major Technological Risk, An assessment of Industrial Disasters – P. Lagadec, translated by H. Ostwald, available at http://www.patricklagadec.net/fr/pdf/Amoco_Cadiz_EN.pdf