Tuesday, March 25, 2014

Buncefield Fire

Buncefield fire

Oil storage terminal explosions

Lien vers BBC news:

https://www.youtube.com/watch?v=0FlJQWewjTc

Summary data:

Date: December 11, 2005

Place: Buncefield oil storage depot, Hemel Hempstead, Hertfordshire

Type of accident: Explosion & fire

Outcome: Several explosions wich overwhelmed 20 large sot range tanks, several nearby office blocks were hit.

2000 people were evacuated

43 injured persons, 2 seriously injured

Estimated cost: $ ~1 billions (repairs and compensation)

Lawsuit: Settlement in 2010 ($15 million for victims)

About the oil storage terminal

The Buncefield complex was the fifth largest oil-products storage depot in the UK, with a capacity of about 60,000,000 imperial gallons (270 ML) of fuel. This was about 8% of UK oil storage capacity.

What happened?

On the night of Saturday 10 December 2005, Tank 912 at the Hertfordshire Oil Storage Limited (HOSL) part of the Buncefield oil storage depot was filling with petrol.

The tank had two forms of level control: a gauge that enabled the employees to monitor the filling operation; and an independent high-level switch (IHLS) which was meant to close down operations automatically if the tank was overfilled. The first gauge stuck and the IHLS was inoperable – there was therefore no means to alert the control room staff that the tank was filling to dangerous levels. By 0537 hrs on 11 December, the level within the tank exceeded its ultimate capacity and petrol started to spill out of vents in the tank roof.

Soon after that a white vapour was seen to emanate from the bund around the tank. In the windless conditions this vapour cloud, which was likely to have been a mixture of hydrocarbons and ice crystals, gradually spread to a diameter of about 360 metres, including areas off the Buncefiield site.

The vapour cloud was noticed by members of the public off site and by tanker drivers on site waiting to fill their vehicles. They alerted employees on site. The fire alarm button was pressed at 0601 hrs, which sounded the alarm and started the firewater pump. A ‘vapour cloud explosion’ occurred almost immediately, probably ignited by a spark caused by the firewater pump starting. By the time the explosion occurred, over 250 000 litres of petrol had escaped from the tank.

The British Geological Survey monitored the event, which measured 2.4 on the Richter Scale. It was reported that people were woken in south London, and as far west as 28 miles (45 km)), where in its southern suburb, numerous people felt the shockwave after the initial explosion. Subsequent explosions occurred at 06:27 and 06:28.

Several nearby office blocks were hit so badly that almost every window, front and back, was blown in as the explosion ripped through them. During the working day, these offices would have been full of people, and many deaths may have resulted.

Reaction and Response

The emergency services announced a major emergency at 06:08 and a huge fire fighting effort began. At peak times this effort consisted of 25 fire engines, 20 support vehicles and 180 fire fighters. Around 150 firefighters were called immediately to the incident, and began tackling the blaze at 08:20 on the morning of 12 December, putting in containment measures before applying a large quantity of foam. Plans had been in place to start using foam at midnight on 11 December, but were delayed by last-minute concerns over possible pollution of local rivers and underlying water sources.

Half of the 20 individual fires were reported extinguished by midday.

By 16:30 on Monday 12 December, it was reported that a further two tank fires had been extinguished, but that one of the tanks extinguished earlier had ruptured and re-ignited, and was now threatening to cause the explosion of an adjacent tank. By midday on 13 December, all but three fires had been extinguished, although the largest tank was still burning. t was reported at 16:45 that all tank fires had been extinguished, although some smaller fires persisted.75% of firefighters for Hertfordshire were involved in fighting the fire, supported by 16 other brigades.

Hundreds of homes in the Hemel Heapstead area were evacuated, and about 2,000 people had to find alternative accommodation; emergency services asked residents of the smoke-affected areas to close their windows and doors and to stay inside.

Seventy-eight schools in Luton were closed on 13 December, along with a limited number of schools in Bedforshire on the advice of Hertfordshire's Health Protection Agency that all schools within a 10-mile (16 km) radius of the incident site should be closed because of concerns surrounding the effect of the smoke plume on children's health. Schools reopened as normal on 14 December.

The incident occurred close to junction 8 of the M1 motorway.The motorway was shut between junctions 12 and 6a—about 18 miles (29 km)—shortly after the incident. Other roads in the vicinity were also closed. Fuel shortages continued for months after the explosion.

Root causes of the loss of containment analysis

What lay behind the immediate cause and subsequent failures of containment?

Tank 912 was fitted with a new independent high-level switch (IHLS) on 1 July 2004. This had been designed, manufactured and supplied by TAV Engineering Ltd. TAV had designed the switch so that some of its functionality could be routinely tested. AV was aware that its switches were used in high-hazard installations and therefore were likely to be safety critical. The design fault could have been eradicated at an early stage if the design changes had been subjected to a rigorous review process. In any event, clear guidance, including instructions about the safety criticality of the padlock, should have been passed on to installers and users. It appears that nobody within Motherwell knew the safety critical significance of the padlock. The IHLS on Tank 912 was installed without the padlock because it seems that Motherwell staff thought it was for security ‘anti-tamper’ purposes only. In addition to the failures of the manufacturers and installers of the IHLS, the site operator did not exercise sufficient oversight of the ordering, installation and testing procedure. While the switch was periodically tested, none of the staff at the HOSL site was aware of the need for the padlock to be replaced so that the test lever was held in the correct position. The site operator should have had greater oversight of safety critical operations and equipment so that they understood fully how it worked, particularly given the expertise available within large oil companies.

Failure of the ATG system was the other immediate cause of the incident. The servo-gauge had stuck (causing the level gauge to ‘flatline’) – and not for the first time. In fact it had stuck 14 times between 31 August 2005, when the tank was returned to service after maintenance, and 11 December 2005. Sometimes supervisors rectified the symptoms of sticking by raising the gauge to its highest position then letting it settle again, a practice known as ‘stowing’.

Prior to the Buncefield incident, petroleum storage sites were generally not considered to be sites where an explosion incident on this scale could occur. Buncefield challenged this worldwide perception. Buncefield Major Incident Investigation Board Publish Recommendations on four main areas :

· The Design and Operation of Fuel Storage Sites

· Emergency preparedness and response,

· Explosion Mechanism,

· Land Use Planning.

On design and operations at storage sites, the paramount need is for precautions to be in place to prevent fuel escaping from the vessels in which it is contained. Further precautions are needed if fuel does escape, to prevent it forming a flammable vapour and stop pollutants contaminating the environment.

Those recommendations covered a total of 86 sites in England & Wales !

About the refinery

Union Oil refinery employed more than 700 workers and processed 151,000 barrels of oil a day.

What happened?

5h45 p.m. : Vapor leak was noticed on a Vessel

About the Vessel :

- Amine absorber removing H2S from acid stream

- 55 foot tall, one-inch thick carbon steel (34-tonne storage)

- Pressured

Refinery workers, including the outside operator and an assistant outside operator, unsuccessfully attempted to by-pass the vessel and to depressurize it.

5:52 p.m. : The leak in the vessel wall had spread around the entire eight foot circumference of the vessel and it erupted like a missile. The top 45 feet of the vessel was lifted by the vapor cloud. The bottom 10 feet of the vessel stayed intact on the ground. The eruption of the vessel released a massive vapor cloud which ignited, causing a fire ball.

This explosion engulfed much of the refinery in flames.

Firefighters from the Union Oil Fire Brigade responded immediately with the company’s two engines, followed closely by the Romeoville Fire Department.

As a result of the explosion, many towers, tanks, and other refinery structures began to rupture or collapse and the site’s fire hydrant system was damaged. So firefighers were forced to draft water from a nearby sanitary canal.

They were just beginning to attack the flames when a tank containing liquefied petroleum gas erupted. The explosion created a huge fireball that rose thousands of feet into the air. Several members of the Union Oil Fire Brigade were caught in the blast. Later reports stated that the explosion was felt fifteen miles away. Local residents recalled seeing a “bright mushroom cloud” emanating from the facility and a very powerfull blast.

The enormity of the fire brought mutual aid fire apparatus and ambulances from more than 30 cities, including two medical evacuation helicopters from the University of Chicago Hospital and a Chicago Fire Department fireboat sent via the sanitary canal. An AMOCO refinery in Indiana even sent truckloads of Aqueous Film-Forming Foam (AFFF) to help extinguish the fire.

Firefighters were needed to both put out the flames and also prevent more refinery structures from catching fire. Once the burning structures were isolated, fire officials determined that allowing the fires to burn out on their own was the safest way to extinguish the blaze. The fires burned throughout the night at temperatures of 2,200 °C, luckily without further explosions or loss of life, even though some workers jumped into the Illinois & Michigan Canal to escape the extreme heat.`

Amine vessel failure analysis

As required by law, the inside of the vessel was inspected every two years. The inspectors were Union Oil employees in management positions. The vessel was last inspected three months before the explosion and the vessel inspectors found no problems with the vessel. Testimony from one of Union Oil’s own engineers indicated that his metallurgical testing performed after the explosion indicated that there were cracks in the vessel walls at least four years before the accident. The plaintiff’s evidence established that Union Oil’s vessel inspectors made only a visual inspection which was inadequate to detect cracking within the vessel walls. The evidence indicated that Ultrasonic and wet magnetic particle testing techniques were well known and used in the oil industry to detect vessel wall cracking, but Union Oil did not use them on this vessel.

Three other primary contributors to the settlement, Santa Fe Braun, Inc., UOP, Inc., and the Ralph M. Parsons Company, had responsibilities relating to the erection, process design and functioning of this vessel. One of Santa Fe Braun’s corporate predecessors, C.F. Braun and Company, was the general contracting firm that erected the vessel. Its engineers helped to determine the process requirements and capabilities of this vessel, specifically including what amount of chemical activity would go on within the vessel. UOP was also involved in those decisions, made with respect to process engineering. The Ralph M. Parsons Company has been hired by Union Oil to revamp part of the refinery, including the subject vessel. In its revamp, Parsons altered some of the process requirements of that vessel, and as well, made independent determinations of the suitability of the vessel and its characteristics for use in the amine treating system. The Union Oil Compagny alleged that the process design work done by these three companies was inadequate in that it failed to provide for sufficient safeguarding against corrosion which contributed to the cracking and the failure of the vessel.

Union Oil determined that the operation of the subject vessel had caused significant metallurgical problems to the bottom portion of the vessel and that one of the vessel sections would need to be replaced. Welders from the Morrison Construction Company attempted to replace a major section of the vessel but due to poor quality control and inadequate welding work, were taken off the job by Union Oil and replaced by welders from the Nooter Corporation. Nooter’s welders finished the job using specifications which the Union Oil Compagny claimed were inadequate. The welding specifications used by Morrison and Nooter contributed to the "high hardness" of the metal adjacent to the weld, which made it more brittle and subject to failure.

Metallurgical testing work done after the explosion, both by engineers retained by Union Oil and engineers retained by the Illinois State Fire Marshall, showed that the cracking in this vessel which lead to the explosion and fire started in the metal adjacent to the welds done by Morrison and Nooter.

Links:

Broadcast News 1984-07-23:
https://www.youtube.com/watch?v=-UVmtQ_Gm-M

News-Post 1984-07-25:
http://www3.gendisasters.com/illinois/6895/romeoville-il-refinery-explosions-july-1984

Chicago Tribune / 10 Years Later, Survivors And Witnesses Recall Fatal Refinery Blast In Romeoville:
http://articles.chicagotribune.com/1994-08-03/news/9408030340_1_refinery-explosion-mushroom-cloud-fire

Concise recaps:

http://www.oilandgasiq.com/integrity-hse-maintenance/articles/five-deadliest-onshore-oil-gas-blasts-part-3/

https://www.ideals.illinois.edu/bitstream/handle/2142/94/Union%20Oil%20Company%20Refinery%20Fire,%201984.pdf?sequence=2

http://abduh137.wordpress.com/2008/04/25/the-50-major-engineering-failures-1977-2007-part-1/

Jury verdict:
http://www.jvra.com/verdict_trak/article.aspx?id=29401

US Departement of Labor Analysis:

https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=INTERPRETATIONS&p_id=19415

Thursday, March 13, 2014

Piper Alpha

Piper Alpha
- Worst offshore disaster -

Summary data:

Date: July 6, 1988,

Location: North Sea 110 miles from Aberdeen, Scotland,

What happened: The platform experienced a series of catastrophic explosions and fires. It had 226 people on board at the time of the event, 165 of whom perished (in addition, two emergency response personnel died during a rescue attempt). The platform was totally destroyed.

Causes: Simultaneous maintenance work on the pump and safety valve resulted in a condensate leak.

What happened?

A release of light hydrocarbon (condensate; propane, butane, and pentane) occurred when a pump was restarted after maintenance. Unaware to the personnel starting the pump, a relief valve in the pump discharge had also been removed for service and a blank had been loosely installed in its place on the piping flange. Upon restart of the pump, this flange leaked, producing a flammable hydrocarbon cloud, which subsequently found an ignition source.

The Piper Alpha platform was at the hub of a network of platforms interconnected by oil and gas pipelines. The initial explosion ruptured oil lines on Piper Alpha and the leaks were fed by the still-pressurized inter-platform pipelines. Managers on other platforms, aware of a problem on Piper Alpha (but not its severity), assumed that they would be instructed to shut down their operations, if needed. However, the explosion had interrupted communications from Piper Alpha and considerable intervals (from 30 to 60 minutes) passed before these other platforms were shut in.

A series of follow-on explosions occurred as the fires on the platform weakened natural gas riser pipelines on Piper Alpha. The intensity of the fires prevented rescue efforts, either by helicopter or by ship. At the height of the event, natural gas was being burned on Piper Alpha at a rate equivalent to the entire United Kingdom natural gas consumption rate.

Many of the platform crew retreated to the crew accommodation module, as they had been trained, to await evacuation. No organized attempt to was made to retreat from the accommodation module, even though it became increasingly apparent that the conditions in the module were becoming untenable. 81 personnel died from smoke inhalation in the crew quarters, awaiting further instructions that never came. Survivors found ways, on their own initiative, to get to the water (some jumping to the sea from considerable heights on the platform).

The subsequent investigation revealed the following :

· Two separate work permits had been issued for the condensate pump, one for the pump repair and one for testing the relief valve. The relief valve job had not been completed by the end of the shift and, rather than working overtime to complete it, it was decided to terminate the permit for that day and continue on the next. The craft supervisor suspended the permit and returned it to the control room without notifying operations staff of the job status.

· During shift turnover, the status of the pump work was addressed, but no mention was made of the relief valve work, and there was no mention of it in the control room or maintenance logs. Continuing problems with the adequacy of turnovers and log entries were a problem known to some (one staff member: “It was a surprise when you found out some things which were going on.”)

· The work permits for the pump and the relief valve did not reference each other, and it is likely that the permits had been filed in separate locations (one on the control room and one in the Safety Office). When the on-line condensate pump failed later in the shift, creating an imperative to start the spare to enable continued production, control room personnel were only aware of the pump repair work permit, and proceeded to have the pump returned to service.

· The permit to work (PTW) system was often not implemented according to procedure (“... the procedure was knowingly and flagrantly disregarded.”). For example, (1) omissions (e.g., signatures and gas test results) were common, (2) operations representatives often did not inspect the jobsite before suspending the permit at the end of the shift, or closing the permit indicating the work had been completed, and (3) craft supervisors often left permits on the control room desk at the end of a shift, rather than personally returning them to the responsible operations representative, as required by the procedure.

· Although the PTW system was monitored by the lead safety operator, no indications of problems were reported, and management did not independently review the operation of the system. Based upon an absence of information to the contrary, management assumed that they “knew that things were going all right.” It is noted that a senior maintenance technician had voiced his concerns about the PTW system at a meeting at corporate headquarters earlier in the year. In addition, the company had entered a guilty plea in a civil legal proceeding involving a worker fatality caused, in part, by a PTW system problem; however, no substantive improvements in the PTW system resulted.

· The diesel-powered fire pumps had been placed in manual control mode due to the presence of divers in the water around the platform. This practice was more conservative than company policies and a 1983 fire protection audit report had recommended that this practice be discontinued. Placing the pumps in manual meant that personnel would have had to reach the pumps to start them after the explosion. However, conditions prevented this and, as a result, the Piper Alpha deluge system was unavailable.

· Had firewater been available, its efficacy might have been limited. Distribution piping, including that in the platform module where the fires were most severe, was badly corroded and pluggage of sprinkler heads was a known problem dating back to 1984. Various fixes had been attempted and a project to replace the fire protection piping had been initiated, but work was lagging behind schedule. Tests in May 1988 revealed that approximately 50% of the sprinkler heads in the subject module were plugged.

· To put the previous two observations in perspective, the structural steel on Piper Alpha had no fireproofing and it was known (at least to management) that “... structural integrity could be lost with 10-15 minutes if a fire was fed from a large pressurized hydrocarbon inventory.”

· The investigation revealed that emergency response training given to new platform personnel was cursory and not uniformly provided. Workers were required to be trained if they had not been on Piper Alpha in the last six months. However, training was often waived even if the interval was considerably longer, or if the individual reported that he had previously worked off-shore elsewhere. A number of survivors reported that they had never been trained on the location of the life rafts or how to launch them.

· Evacuation drills were not conducted weekly as required (one 6 month period recorded only 13 drills). No full-scale shutdown drill had been conducted in the three years prior to the explosion.

· Platform managers had not been trained on their response to such an emergency on another platform (Note: that the various platforms were owned or operated by different companies.)

· Approximately one year before the explosion, company management had been cautioned in an engineering report that a large fire from escaping gas could pose serious concerns with respect to the safe evacuation of the platform. However management discounted the likelihood of such an event, citing existing protective systems. In fact, the gas risers upstream of the emergency isolation valves on Piper Alpha were not protected against fire exposure and, because of the diameter and length of the inter-platform gas lines, several days would be required to depressurize the pipelines in the event of a breach. It was the failure of these lines that destroyed Piper Alpha and prevented its evacuation.

Aftermath :

Because of damages costing almost $3.4 billion, the Piper Alpha disaster was the largest man-made disaster at the time and continues to be the worst offshore oil disaster in terms of life lost and industry impact. Although the Cullen Inquiry found Occidental guilty of inadequate maintenance and safety procedures, no criminal charges were brought against the company.

The inquiry resulted in 106 recommendations for changes to North Sea safety procedures—all 106 were accepted by the industry. And finally, a 3-year investigation into the safety and integrity of over 100 offshore installations.

Video of the explosion :

http://www.youtube.com/watch?v=mBYdDeVOuQo

National Geographic Documentary :

http://www.youtube.com/watch?v=7VXHiQ0bViU

Major Industrial Accidents

Tuesday, March 25, 2014

Buncefield Fire

About the oil storage terminal

The Buncefield complex was the fifth largest oil-products storage depot in the UK, with a capacity of about 60,000,000 imperial gallons (270 ML) of fuel. This was about 8% of UK oil storage capacity.

What happened?

Reaction and Response

Root causes of the loss of containment analysis

Links:

Romeoville: Refinery explosion and fire

About the refinery

What happened?

Amine vessel failure analysis

Links:

Thursday, March 13, 2014

Piper Alpha

What happened?

Video of the explosion :