Chapter 26

Case Histories

Chapter Outline
26.1 Introduction 448 26.5.7 The Worldwide Impact of the Bhopal
26.1.1 Incident Sources 448 Incident 470
26.1.2 Incident Databases 449 26.6 Pasadena 471
26.1.3 Reporting of Incidents 450 26.6.1 The Site and the Plant 471
26.1.4 Reporting of Injuries in Incidents 450 26.6.2 Events Prior to the Explosion 471
26.1.5 Reporting of Injuries at National Level 451 26.6.3 The Explosion 471
26.1.6 Incident Diagrams, Plans, and Maps 451 26.6.4 The Emergency and the Aftermath 472
26.1.7 Incidents Involving Fire Fighting 451 26.6.5 Some Lessons of Pasadena 472
26.1.8 Incidents Involving Condensed Phase 26.7 Canvey Reports 473
Explosives 451 26.7.1 First Canvey Report 474
26.1.9 Incidents Involving Spontaneously 26.7.2 First Canvey Report: Installations and
Combustible Substances 451 Activities 474
26.1.10 Case Histories 452 26.7.3 First Canvey Report: Identified Hazards 474
26.2 Flixborough 452 26.7.4 First Canvey Report: Failure and Event Data 476
26.2.1 The Site and the Works 453 26.7.5 First Canvey Report: Hazard Models and Risk
26.2.2 The Process and the Plant 453 Estimates 476
26.2.3 Events Prior to the Explosion 453 26.7.6 First Canvey Report: Assessed Risks and
26.2.4 The Explosion 454 Actions 477
26.2.5 Some Lessons of Flixborough 454 26.7.7 Second Canvey Report 479
26.3 Seveso 457 26.7.8 Second Canvey Report: Reassessed Risks and
26.3.1 The Site and the Works 457 Actions 480
26.3.2 The Process and the Plant 457 26.7.9 Second Canvey Report: Technical Aspects 480
26.3.3 TCDD and its Properties 458 26.8 Rijnmond Report 480
26.3.4 Events at Seveso 458 26.8.1 The Investigation 480
26.3.5 The Release 1 458 26.8.2 Installations and Activities 480
26.3.6 The Release 2 458 26.8.3 Event Data 480
26.3.7 The Later Aftermath, Contamination, and 26.8.4 Hazard Models 480
Decontamination 460 26.8.5 Population Characteristics 480
26.3.8 Some Lessons from Seveso 461 26.8.6 Mitigation of Exposure 482
26.4 Mexico City 462 26.8.7 Individual Assessments 482
26.4.1 The Site and the Plant 462 26.8.8 Assessed Risks 482
26.4.2 The Fire and Explosion 1 463 26.8.9 Remedial Measures 482
26.4.3 The Emergency 464 26.8.10 Critiques 482
26.4.4 The Fire and Explosion 2 2 464 26.9 San Carlos De La Rapita Disaster 482
26.4.5 Some Lessons of Mexico City 465 26.9.1 The Camp Site 483
26.5 Bhopal 465 26.9.2 The Road Tanker 483
26.5.1 The Site and the Works 465 26.9.3 The Fire and Explosion 483
26.5.2 The Process and the Plant 466 26.9.4 The Emergency and the Aftermath 483
26.5.3 MIC and its Properties 467 26.9.5 Lessons of San Carlos De La Rapita Disaster 483
26.5.4 Events Prior to the Release 467 26.10 Piper Alpha 483
26.5.5 The Release 467 26.10.1 The Company 484
26.5.6 Some Lessons Learned from the Bhopal 26.10.2 The Field and the Platform 484
Incident 468 26.10.3 Events Prior to the Explosion 484

Lees’ Process Safety Essentials.

© 2014 Elsevier Inc. All rights reserved. 447
448 Lees’ Process Safety Essentials

26.10.4 The Explosion, the Escalation, and the 26.14 BP America Refinery Explosion, Texas City, Texas,
Rescue 485 USA 493
26.10.5 Some Lessons of Piper Alpha 486 26.14.1 The Company 493
26.10.6 Recommendations on the Offshore Safety 26.14.2 Incident Description 493
Regime 486 26.14.3 Aftermath and Emergency 496
26.11 Three Mile Island 486 26.15 Buncefield 496
26.11.1 The Company 486 26.15.1 Description of the Incident 496
26.11.2 The Site and the Works 486 26.15.2 Causes of the Incident 496
26.11.3 The Process and the Plant 486 26.15.3 Lessons Learned from the Incident 497
26.11.4 Events Prior to the Excursion 487 26.16 Space Shuttle Columbia Disaster 497
26.11.5 The Excursion 1 487 26.16.1 Development of the Space Shuttle Program 497
26.11.6 The Emergency and the Aftermath 488 26.16.2 Columbia’s Final Flight 497
26.11.7 The Excursion 2 488 26.16.3 Accident Analysis 497
26.11.8 Some Lessons 488 26.16.4 Other Factors Considered 498
26.12 Chernobyl 488 26.16.5 The Accident’s Organizational Causes 498
26.12.1 The Site and the Works 489 26.16.6 Implications for the Future of Human Space
26.12.2 The Process and the Plant 489 Flight 498
26.12.3 Events Prior to the Release 489 26.16.7 Recommendations 498
26.12.4 The Release 490 26.17 Deepwater Horizon 499
26.12.5 The Emergency and the Immediate 26.17.1 The Companies 499
Aftermath 490 26.17.2 The Site and the Works 499
26.12.6 The Later Aftermath 491 26.17.3 Events Prior to the Explosions 499
26.12.7 Some Lessons of Chernobyl 491 26.17.4 Events Prior to April 19 499
26.13 Hurricanes Katrina and Rita 491 26.17.5 Events on April 19 and 20 500
26.13.1 Introduction 491 26.17.6 Lessons from the Deepwater Horizon
26.13.2 Hurricane Katrina 491 Incident 502
26.13.3 Hurricane Rita 492 26.17.7 Impact 502
26.13.4 Effect on the Industry 492 Acronyms 502
26.13.5 Lessons Learned 493 References 503
26.13.6 Recommendations 493

26.1. INTRODUCTION profile US chemical plant and refinery case histories. As

An essential feature of the learning process in safety and
loss prevention is the study of case histories.
26.1.1 Incident Sources
The powerful impact of the internet has changed the way
we obtain our information on process safety, as well as
everything else. In recent years, various governmental
agencies and private organizations have improved our
access to details of recent and past case histories. A num-
ber of websites provide a narrative of the event, the
technical reasons for the accident, as well as the manage-
ment system shortcomings and valuable lessons learned.
Written reports sometimes supported by graphics and
photos are often published by various agencies and pro-
vided on governmental websites. There are also university
and corporate organizations that collect incidents and
publish the information on their websites.
Since about 1996, the US Environmental Protection
Agency (EPA), under the Chemical Emergency Preparedness
and Prevention, has investigated and reported on many high
a result of these investigations, some Alerts focusing on
certain type of incidents have been developed. EPA reports
are available at the following internet website http://www.epa.
gov/emergencies/publications.htm.
The US Chemical Safety and Hazard Investigation
Board (CSB) was created by an Act of the US Congress
in the late 1990s and their mission is to promote the
prevention of chemical accidents. The focus of the CSB
is on-site and off-site chemical safety, determining causes
and preventing chemical-related incidents, fatalities,
injuries, property damage and enhancing environmental
protection. The CSB started investigations on selected
important chemical plant and refinery incidents in about
1998, and also provide reports on the internet at the fol-
lowing web address: http://www.csb.gov/investigations/
default.aspx
The Center for Chemical Process Safety (CCPS) of the
American Institute of Chemical Engineers started provid-
ing brief one-page summaries of types of hazards in late
2001. These high-impact messages were designed with
the chemical process operator and others involved with the
manufacturing processes to focus quickly on an important
Chapter | 26 Case Histories
topic. This publication is entitled the Beacon and can be
found at: www.aiche.org/ccps/safetybeacon.htm.
The Mary Kay O’Connor Process Safety Center at
Texas A&M University in College Station, Texas, is an
international leader in process safety and is increasing in
stature each year. The Center is a rich source of process
safety information as well as documented case histories.
The Center’s web address is: http://process-safety.tamu.
edu.
The British Institution of Chemical Engineers
(IChemE) offers links to a comprehensive list of well
over 150 other websites of incident reports. The IChemE
site mainly describes incidents of interest to chemical or
process engineers, and includes a time span of incidents
from historical to today’s events. The collection includes
both information and viewpoint. The address of this site
is: http://slp.icheme.org/incidents.html.
The Delft University of Technology of the Netherlands
offers a vivid array of about two dozen outstanding fire
and explosion photos, an accident database, and more. The
university’s main research effort is focused on measuring
and modeling dust and gas explosions. The incident photos
can be found at: http://www.dct.tudelft.nl/part/explosion/
gallery.html.
Another internet source of process safety information,
including case histories, is www.acusafe.com. The AcuSafe
website provides a comprehensive electronic newsletter
entitled AcuSafe News. Their newsletter is devoted to serv-
ing industry, government, and interested members of the
public by providing process safety practices, incident news,
lessons learned, and regulatory developments.
A booklet entitled Large Property Damage Losses
in the Hydrocarbon-Chemical Industry—A Thirty Year
Review is a source of information in print form. This
publication presents summaries of large property losses
of incidents from around the globe. The information is
from a property insurance viewpoint and is presented in
an easy-to-understand form. Most of the damages are the
result of fires and explosions occurring in refineries, pet-
rochemical plants, gas-processing plants, terminals, and
offshore, with a miscellaneous category also provided.
It is updated every few years. The 21st edition of Marsh’s
The 100 Largest Property Losses 1972 2009 (in the
Hydrocarbon Industry) reviews the 100 largest property
damage losses that have occurred in the hydrocarbon
processing industries since 1972.
Collections of case histories have been published in
Case Histories of Accidents in the Chemical Industry by the
Manufacturing Chemists Association (1962 , c1975.)
and by Kier and Muller (1983). Specialized collections
have been published on particular topics such as major
hazards (Harvey, 1979, 1984; Carson and Mumford, 1979;
Lees, 1980; Marshall, 1987), fire and explosions (Vervalin,
1964, 1973; Doyle, 1969), vapor cloud explosions (Gugan,
449
1979; Slater, 1978; Lewis, 1980; Davenport, 1987; Lenoir
and Davenport, 1993), LPG (L.N. Davis, 1979), instrumen-
tation (Doyle 1972a,b; Lees, 1976), transport (Haastrup and
Brockhoff, 1990), and pipelines (Riley, 1979). The series
Safety Digest of Lessons Learned by the API gives case his-
tories with accompanying analyses. Another such series is
published by the American Oil Company (Amoco) which
includes Hazards of Water and Hazards of Air. The Canvey
Reports and the Rijnmond Report gives information on cer-
tain incidents. The reports of the HSE provide case histories
of investigations by a regulator, as do those of the NTSB,
which deal with rail, road, pipeline, and marine accidents.
Incidents involving large economic loss are described in the
periodic review 100 Large Losses by Marsh and
McLennan.
Case histories are also given in the Annual Report of
HM Chief Inspector of Factories, The Chemical Safety
Summary of the Chemical Industry Safety and Health
Council (CISHC), and in journals such as Petroleum
Review and NFPA Journal. In addition, the Loss Prevention
Bulletin issued by the IChemE is a major source of safety
case studies for the process industries. There are also
numerous case histories described in much greater detail in
various papers and reports. The analysis of case histories
to draw the relevant lessons is exemplified pre-eminently
in the work of Trevor Kletz’s many books and numerous
technical articles:
G Critical Aspects of Safety and Loss Prevention (1990),
G Lessons from Disaster—How Organisations Have No
Memory and Accidents Recur (1993)
G What Went Wrong?—Case Histories of Process Plant
Disasters, 5th edn (2009)
G An Engineer’s View of Human Error, third edition
(2001a)
G Learning from Accidents, third edition (2001b) and
numerous technical articles.
G Still Going Wrong!: Case Histories of Process Plant
Disasters and How They Could Have Been Avoided
(2003)
26.1.2 Incident Databases
There are a number of databases specifically dealing with
case histories. They include the following:
G The incident databases MHIDAS (the Major Hazard
Incident Data Service) is a database of incidents involv-
ing hazardous materials that had an off-site impact, or
had the potential to have an off-site impact. MHIDAS
is maintained by AEA Technology plc, on behalf of the
UK Health and Safety Executive and EIDAS (Explosives
Incidents Database Advisory Service), which contains
readily accessible and searchable information about the
causes and effects of explosives and firework incidents
450
in the United Kingdom, from the 1850s up to the present
day, maintained by HSE. Website: http://www.hse.gov.
uk/explosives/eidas.htm.
G TNO has developed the FACTS incident database
covering 24,000 (industrial) accidents (incidents)
involving hazardous materials or dangerous goods that
have happened worldwide over the past 90 years.
G Major Accident Reporting System (MARS) is a distri-
bution information network, consisting of 15 local
databases from the European Union and the European
Commission’s Joint Research Centre in Ispra (MAHB).
The database allows complex text retrieval and pattern
analysis.
G Hydrocarbon Releases Database System contains infor-
mation, dating from October 1992, concerning offshore
releases of hydrocarbons reported to the HSE Offshore
Division (OSD) under the Reporting of Injuries,
Diseases and Dangerous Occurrences Regulations 1995
(RIDDOR), and prior offshore legislation. Website:
https://www.hse.gov.uk/hcr3/.
G
HSEES: US federal database. The activities of the HSEES
database program are now administered by the National
Toxic Substance Incidents Program (NTSIP) Website:
http://www.atsdr.cdc.gov/ntsip/National_Database.html.
G
ARIA (France) database records accidents which
had or could have had an adverse effect on public
safety or health, agriculture, nature, and the environ-
ment. Website: http://www.aria.developpement-durable.
gouv.fr/The-ARIA-Database--5425.html.
G
Fire & Explosion in the Canadian Upstream Oil and
Gas Industry. Website: http://www.firesandexplosions.
ca/index.php.
26.1.3 Reporting of Incidents
The extent and accuracy of the reporting of incidents and
injuries is variable and this creates problems, particularly
for attempts to perform statistical analysis of incident
data.
Three distinct problems may be identified: (1) occur-
rence of an incident, (2) injuries associated with an incident,
and (3) national injury statistics. These three cases are
considered in this section and in the next two sections,
respectively.
The awareness of incidents in the engineering commu-
nity worldwide varies according to the country in which
the incident has occurred and the size and impact of the
incident. For example, in the recent past, incidents in the
United States have generally been reported in the techni-
cal press, but reports of comparable incidents in the
USSR have been relatively few.
With regard to the effects of scale and impact, the
probability of worldwide reporting of an incident clearly
increases with these factors. The probability that an
Lees’ Process Safety Essentials
accident of the magnitude of Bhopal is not reported in
countries with a free press is negligible. However, as the
size of the incident decreases, the probability that it is not
reported or at least is not picked up in incident collections
and databases increases.
OSHA (Regulations) Part 1094: recording and reporting
occupational injuries and illness was developed to require
employers to report and record work-related fatalities, inju-
ries, and illness. The standard also provides guidelines about
the process that should be performed. For more information,
refer to OSHA’s website: http://www.osha.gov/pls/oshaweb/
owasrch.search_form?p_doc_type5STANDARDS&p_toc_
level51&p_keyvalue51904.
Key highlights of Standard part 1904:
G All employers covered by the OSH Act must report to
OSHA any workplace incident that results in a fatality
or the hospitalization of three or more employees
[1904.39].
G Each employer is required by Part 1904.4 to keep records
of fatalities, injuries, and illnesses, and must record each
fatality, injury, and illness that is work-related, is a new
case, and meets one or more of the general recording
criteria of part 1904.7, or if it applies to specific cases in
part 1904.8 through part 1904.12.
G Employers must save the OSHA 300 Log, the privacy
case list (if one exists), the annual summary, and the
OSHA 301 Incident Report forms for 5 years following
the end of the calendar year that these records cover
[Part 1904.33].
Within 8 h after the death of any employee from a
work-related incident or the in-patient hospitalization
of three or more employees as a result of a work-related
incident, employers must orally report the fatality/
multiple hospitalization by telephone or in person to the
Area Office for OSHA, and the US Department of Labor
that is nearest to the site of the incident [part 1904.39]
(OSHA).
26.1.4 Reporting of Injuries in Incidents
For various reasons, accounts of incidents tend to differ
in the number of injuries and, to a lesser extent, fatalities
that are reported. A discussion of this problem has been
given by Haastrup and Brockhoff (1991).
There are a number of reasons for differences in the
numbers quoted. One is that early reports of an incident
tend not be very accurate, but are sometimes quoted with-
out sufficient qualification and the numbers then receive
currency.
With regard to fatalities, a difference arises between
immediate and delayed deaths. A case where a proportion
of delayed deaths is fairly common is burn casualties.
Chapter | 26 Case Histories
The most frequent and large differences, however, are
in ‘injuries’. Here, much of the difference can usually be
accounted for by differences in definition.
As an illustration, consider the injuries in the explosion
at Laurel, Mississippi, on January 25, 1969. The NTSB
report on this incident (NTSB 1969 RAR) states that 2 per-
sons died, 33 received treatment in hospital, and numerous
others were given first aid. Some authors have therefore
quoted this as 2 dead, 33 injured. Eisenberg et al. (1975)
refer to the NTSB report and also to a private communica-
tion from a railroad source and state that 976 persons were
injured, 17 being in hospital for more than a month. This
incident is one of those quoted by Haastrup and Brockhoff
(1991) as an example of the problem.
26.1.5 Reporting of Injuries
at National Level
It is normal for there to be a regulatory requirement for the
reporting, as a minimum, of deaths and injuries. In the
United Kingdom, the relevant regulations are RIDDOR
1985. The information gathered in this way is published by
the HSE in the series Health and Safety Statistics.
The reporting is incomplete. A study supplementary to
the household-based Labour Force Survey 1990 in the
United Kingdom showed that only approximately 30% of
non-fatal injuries were reported to the HSE, but that the
level of reporting varied significantly across industries
(Kiernan, 1992). For the energy industry, the proportion
of such accidents reported was 75%, and it seems proba-
ble that the level of reporting in process industries such
as oil refining, petrochemical, and chemicals is similar.
In the United States, the Hazardous Substances
Emergency Events Surveillance (HSEES) system, maintained
by the Agency for Toxic Substances and Disease Registry
(ATSDR), is a key component in monitoring the acute health
effects, causes, and circumstances of chemical, biological,
radiological, and nuclear release in the United States
(MKOPSC, 2009). For all incidents, other than petroleum-
only releases, the HSEES system details the substances
involved, causes of the incident, associated equipment
items, the type of location, victim demographics, the type of
emergency response, injury details, personnel protective
equipment in use, nearby vulnerable populations, and other
pertinent information. Currently, 14 state health departments
have cooperative agreements with ATSDR to participate
in HSEES: Colorado, Florida, Iowa, Louisiana, Michigan,
Minnesota, New Jersey, New York, North Carolina, Oregon,
Texas, Utah, Washington, and Wisconsin.
26.1.6 Incident Diagrams, Plans, and Maps
Many accounts of incidents give diagrams, plans, or maps
showing features such as derailed tank cars, location of
451
missiles, and location of victims. In particular, such
diagrams are a feature of the accident reports by the HSE
and the NTSB and of case histories described in the Loss
Prevention Bulletin.
26.1.7 Incidents Involving Fire Fighting
A feature of some interest in incidents is the experience
gained in fire fighting. Further information may be found
in the following accounts:
Brindisi, 1977 (Mahoney, 1990)
Milford Haven, 1983 (Dyfed County Fire Brigade, 1983)
Thessalonika, 1986 (Browning and Searson, 1989)
Grangemouth, 1987 (HSE, 1989)
Port Heriot, 1987 (Mansot, 1989)
26.1.8 Incidents Involving Condensed
Phase Explosives
A number of the incidents given in the following sections
involve explosives. There have been, however, a large
number of other explosives and munitions incidents that
are of only marginal interest here. An account of explo-
sions up to 1930 is given in History of Explosions by
Assheton (1930), later treatments are in Explosions in
History by Wilkinson (1966), and Darkest Hours by Nash
(1976). Some principal explosions are listed by Nash. His
list gives death tolls that in some cases differ from those
given elsewhere.
26.1.9 Incidents Involving Spontaneously
Combustible Substances
Spontaneous combustible substances are materials which
can ignite without any flame, spark, heat, or other ignition
source. Hence, the definition of ‘spontaneous combustion’
is ‘combustion that results when materials undergo atmo-
spheric oxidation at such a rate that the heat generation
exceeds heat dissipation and the heat gradually builds up
to a sufficient degree to cause the mass of material to
inflame’ (Carson and Mumford, 2002). A number of
materials can be classified as spontaneous combustibles
including linseed oil, alkyd enamel resins, and drying
oils. A more comprehensive list of spontaneous combusti-
bles can be found in the ‘National Fire Protection
Handbook (18th edition), Table A.10: Materials subject
to spontaneous heating’. The worst consequences of
spontaneous combustion include fatalities through blast
trauma and asphyxiation from CO and mental disorders in
survivors of disaster/accidents.
A large number of incidents involving spontaneous
combustion happened in the underground mining environ-
ment. For example, there has been an increase in the number
452 Lees’ Process Safety Essentials

of spontaneous combustion incidents in the past years,

culminating in the closure of Southland Colliery in TABLE 26.1 The Most Frequently Mentioned
December 2003. Since 1972, spontaneous combustion Chemicals
has resulted in three underground mine explosions which Ammonia 48 Chlorine 37
killed 41 workers in Queensland and some pit closures in
Caustic soda 88 Sulfuric acid 46
New South Wales (Ham, 2005). A report by Richardson
and Ham (1996) outlines several incidents of spontane-
ous combustion in Queensland underground coal mines.
A total of 51 spontaneous combustion incidents were
reported in Queensland between 1972 and 2004. The
most damaging of these incidents were Box Flat in 1972, TABLE 26.2 The Most Frequently Mentioned
Kianga in 1975, and Moura No 2 Mine in 1994. These Operations
incidents involved explosions that resulted in 17, 13,
Loading 38 Steaming 32
and 11 fatalities, respectively, as well as closures of the
mines. Maintenance 82 Tank entry 39

Pipe fitting 27 Transfer 46

Process reaction 66 Unloading 64
26.1.10 Case Histories Sampling 24 Welding 36
One of the principal sources of case histories is the MCA
collection. There are a number of themes which recur
repeatedly in these case histories. They include:
Failure of communications
Failure to provide adequate procedures and instructions TABLE 26.3 The Most Frequently Mentioned
Failure to follow specified procedures and instructions Equipment
Failure to follow permit-to-work systems
Centrifuge 24 Machine 27
Failure to wear adequate protective clothing
Failure to identify correctly plant on which work is to Cylinder 26 Pump 60
be done Drum 76 Rotameter, sight glass 27
Failure to isolate plant, to isolate machinery and
Hose 57 Tank 46
secure equipment
Failure to release pressure from plant on which work Industrial truck 31 Tank car 59
is to be done Laboratory 85 a
Tank truck 35
Failure to remove flammable or toxic materials from
Line 105 Valve 86
plant on which work is to be done
a
Failure of instrumentation In the first 1623 case histories.
Failure of rotameters and sight glasses
Failure of hoses
Failure of, and problems with, valves
Incidents involving exothermic mixing and reaction
processes 26.2. FLIXBOROUGH
Incidents involving static electricity
At about 4:53 p.m. on Saturday, June 1, 1974, the
Incidents involving inert gas.
Flixborough Works of Nypro (UK) Ltd (Nypro) were
In the 2108 case histories described, the most fre- virtually demolished by an explosion of war-like dimen-
quently mentioned chemicals and the corresponding num- sions. Of those working on the site at the time, 28 were
ber of entries are given in Table 26.1. killed and 36 others suffered injuries. If the explosion had
The most frequently mentioned operations are given occurred on an ordinary working day, the number of
in Table 26.2. casualties would have been much greater. Outside the
The most frequently mentioned kinds of equipment Works, injuries and damage were widespread, but no one
are given in Table 26.3. was killed. Fifty-three people were recorded as casualties
It is emphasized, however, that in many instances it is by the casualty bureau, which was set up by the police;
not appropriate to assign a single cause. For more details, hundreds more suffered relatively minor injuries, which
refer to MCA collections. were not recorded. Property damage extended over a
Chapter | 26 Case Histories
wide area, and a preliminary survey showed that 1821
houses and 167 shops and factories had suffered to a
greater or lesser degree (Parker, 1975—the Flixborough
Report, para. 1).
The Flixborough explosion was by far the most seri-
ous accident that had occurred in the chemical industry in
the United Kingdom for many years.
Within a month of the disaster, a Court of Inquiry
under the chairmanship of Mr. Parker was set up under
Section 84 of the Factories Act 1961 to establish the
causes and circumstances of the disaster and to point out
any lessons which might be learned.
The Court’s report The Flixborough Disaster, Report
of the Court of Inquiry (Parker, 1975) (the Flixborough
Report), was the most comprehensive inquiry conducted
in the United Kingdom at that time of a disaster in the
chemical industry.
The Flixborough disaster was of crucial importance in
the development of safety and loss prevention in the
United Kingdom. It made both the industry and the public
much more aware of the potential hazard of large chemi-
cal plants and led to an intensification of both the efforts
within industry to ensure the safety of major hazard plants
and of the demands for public controls on such plants.
The setting up of the Advisory Committee on Major
Hazards (ACMH) at the end of 1974 was a direct result
of the Flixborough disaster.
26.2.1 The Site and the Works
The nearest villages are Flixborough itself and Amcotts,
both of which are about half a mile away. The town of
Scunthorpe lies at a distance of approximately 3 miles.
The works is surrounded by fields, and the population
density in the neighborhood beyond is very low.
Other plants on the site included an acid plant and a
hydrogen plant. There was also a large ammonia storage
sphere.
26.2.2 The Process and the Plant
The cyclohexane plant consisted of a train of six reactors
in series in which cyclohexane was oxidized to cyclohex-
anone and cyclohexanol by air injection in the presence
of a catalyst. The feed to the reactors was a mixture of
fresh cyclohexane and recycled material. The product
from the reactors still contained approximately 94% of
cyclohexane. The liquid reactants flowed from one reac-
tor to the next by gravity. In subsequent stages, the reac-
tion product was distilled to separate the unreacted
cyclohexane, which was recycled to the reactors, and the
cyclohexanone and cyclohexanol, which were converted
to caprolactam. The design operating conditions in the
453
reactor were a pressure of 8.8 kg/cm2 and a temperature
of 155 C. The reaction is exothermic.
The heat required for initial warm-up and for supple-
mentation of the heat of reaction during normal operation
was provided by a steam-heated heat exchanger on the
reactor feed. The steam flow to the exchanger was con-
trolled by an automatic control valve. There was a bypass
around this valve, which was needed to pass the larger
quantities of steam required during start-up.
Removal of the heat of reaction from the reactors dur-
ing normal operation was effected by vaporizing part of
the cyclohexane liquid. The vaporized cyclohexane passed
out in the off-gas from the reactors. The rest of this off-gas
was mainly nitrogen with some unreacted oxygen.
The off-gas passed through the feed heat exchanger
and then through a cooling scrubber and an absorber, in
which the cyclohexane was condensed out, and thence via
an automatic control valve to a flare stack.
The atmosphere in the reactor was controlled using
nitrogen from high-pressure nitrogen storage tanks. The
nitrogen was brought into the works by tankers.
The reactor pressure was controlled by manipulating
the control valve on the off-gas line. Safety valves venting
into the relief header to the flare stack were set to open
at 11 kgf/cm2.
A trip system was provided which shut off air to, and
injected nitrogen into, the reactors in the event of either a
high oxygen content in the off-gas or a low liquid level in
the nitrogen supply tank. This trip could be disarmed;
however, by setting the timer to zero, fixing the duration
of the purge.
26.2.3 Events Prior to the Explosion
On the evening of March 27, 1974, it was discovered
that Reactor No. 5 was leaking cyclohexane. The reactor
was constructed of 1/2 in. mild steel plate with 1/8 in.
stainless steel bonded to it on the inside. A vertical crack
was found in the mild steel outer layer of the reactor. The
leakage of cyclohexane from the crack indicated that
the inner stainless steel layer was also defective. It was
decided that the plant be shut down for a full investigation.
The following morning’s inspection revealed that the crack
had extended some 6 ft. This was a serious state of affairs
and a meeting was called to decide on a plan of action.
The decision was made to remove Reactor No. 5 and to
install a bypass assembly to connect Reactors No. 4 and 6
so that the plant could continue production.
The openings to be connected on these reactors were
28 in. diameter, with bellows on the nozzle stubs, but the
largest pipe which was available on site and which might
be suitable for the bypass was 20 in. diameter. The two
flanges were at different heights so that the connection
had to take the form of a dog-leg of three lengths of
454
20 in. pipe welded together with flanges at each end
bolted to the existing flanges on the stub pipes on the
reactors.
Calculations were done to check (1) that the pipe was
large enough for the required flow and (2) that it was
capable of withstanding the pressure as a straight pipe.
No calculations were made which took into account the
forces arising from the dog-leg shape of the pipe.
No drawing of the bypass pipe was made other than in
chalk on the workshop floor.
The bypass assembly was supported by a scaffolding
structure. This scaffolding was intended to support the
pipe and to avoid straining of the bellows during con-
struction of the bypass. It was not suitable as a permanent
support for the bypass assembly during normal operation.
No pressure testing was carried out either on the pipe
or on the complete assembly before it was fitted. A pressure
test was performed on the plant, however, after installation
of the bypass. The equipment was tested to a pressure
of 9 kgf/cm2, but not up to the safety valve pressure of
11 kgf/cm2. The test was pneumatic, not hydraulic.
Following these modifications, the plant was started
up again. The bypass assembly gave no trouble. There
did appear, however, to be an unusually large usage of
nitrogen on the plant, and this was being investigated at
the time of the accident.
On May 29, the bottom isolating valve on a sight glass
on one of the vessels was found to be leaking. It was
decided to shut the plant down to repair the leak.
On the morning of June 1, start-up began. The precise
sequence of events is complex and uncertain. The crucial
feature, however, is that the reactors were subjected to
a pressure somewhat greater than the normal operating
pressure of 8.8 kgf/cm2.
A sudden rise in pressure up to 8.5 kgf/cm2 occurred
early in the morning when the temperature in Reactor No. 1
was still only 110 C and that in the other reactors was
less, while later in the morning, when the temperature in the
reactors was closer to the normal operating value, the
pressure reached 9.1 9.2 kgf/cm2.
The control of pressure in the reactors could normally
be affected by venting the off-gas, but this procedure
involved the loss of considerable quantities of nitrogen.
Shortly after warm-up began, it was found that there was
insufficient nitrogen to begin oxidation and that further
supplies would not arrive until after midnight. Under
these circumstances, the need to conserve nitrogen would
tend to inhibit reduction of pressure by venting.
26.2.4 The Explosion
During the late afternoon, an event occurred which
resulted in the escape of a large quantity of cyclohexane.
This event was the rupture of the 20 in. bypass system,
Lees’ Process Safety Essentials
with or without contribution from a fire on a nearby 8 in.
pipe. The cyclohexane formed a vapor cloud and the
flammable mixture found a source of ignition.
At about 4:53 p.m., there was a massive vapor cloud
explosion. The explosion caused extensive damage and
started numerous fires. The blast of the explosion shat-
tered the windows of the control room and caused the
control room roof to collapse. Of the 28 people who died
in the explosion, 18 were in the control room. Some of
the bodies had suffered severe injuries from flying glass.
Others were crushed by the roof. No one escaped from
the control room.
The main office block was also demolished by the
blast of the explosion. Since the accident occurred on a
Saturday afternoon, the offices were not occupied. If they
had been, the death toll would have been much higher.
The fires on the site burned for many days. Even after
10 days the fires were hindering rescue work on the site.
The large ammonia sphere was lifted up a few inches.
It leaked slightly at a flange, but the leak was not serious.
26.2.5 Some Lessons of Flixborough
There are numerous lessons to be learned from the
Flixborough disaster. The lessons include both public
controls on major hazard installations and the manage-
ment of such installations by industry. In the latter area,
there are lessons on both management systems and tech-
nological matters and on both design and operational
aspects.
The fact that alternative hypotheses were advanced
concerning the cause of the explosion does not detract
from these lessons, but rather means that a greater num-
ber of lessons can be drawn. Some of these lessons are
now considered.
26.2.5.1 Public Controls on Major Hazard
Installations
The effect of the Flixborough disaster was to raise the
general level of awareness of the hazard from chemical
plants and to make the existing arrangements for the con-
trol of major hazard installations appears inadequate.
The government therefore set up the ACMH to advise
means of control for such installations. The committee
issued three reports (Harvey, 1976, 1979, 1984).
This work was a major input to the development of
the EC Major Accident Hazards Directive, which was
implemented in the United Kingdom as the CIMAH
Regulations 1984. These require the operator of a major
hazard installation to produce a safety case. Major hazard
installations receive a greater degree of supervision by
the local Factory Inspectorate. The CIMAH safety case
plays an important part in this.
Chapter | 26 Case Histories
26.2.5.2 Siting of Major Hazard Installations
As the Flixborough Report (para. 11) points out, the
number of casualties from the explosion might have been
much greater if the site had not been on open land.
The question of the siting of major hazard installations,
or more generally land use planning in relation to such
installations, became a principal concern of the ACMH,
and is treated in its three reports.
26.2.5.3 Licensing of Storage of
Hazardous Materials
The situation at Flixborough revealed the need for better
methods of notification of major hazard installations to
the local planning authorities and for greater guidance
to these authorities by the HSE. The notification of major
hazard installations is a requirement of the 1982 NIHHS
Regulations and the 1984 CIMAH Regulations.
26.2.5.4 Regulations for Pressure Vessels
and Systems
The escape of cyclohexane at Flixborough was caused by
a failure of the integrity of a pressure system.
At the time of the Flixborough incident, legislation on
pressure systems in the United Kingdom consisted of reg-
ulations for steam boilers and receivers and air receivers.
It failed to cover the Flixborough situation in two crucial
respects. It applied only to steam and air, not to hazardous
materials such as cyclohexane, and it dealt only with
pressure vessels, not with pressure systems. This latter
point is relevant, because at Flixborough, the failure
occurred in a pipe not a vessel.
The Flixborough Report (para. 209) recommends that
existing regulations relating to the modification of steam
boilers should be extended to apply to pressure systems
containing hazardous materials.
26.2.5.5 The Management System for Major
Hazard Installations
The works did not have a sufficient complement of
qualified and experienced people. Consequently, manage-
ment was not able to observe the requirement that persons
given responsibilities should be competent to carry them
out. In particular, there was no works engineer in post
and no adequately qualified mechanical engineer on site.
Moreover, individuals tended to be overworked and thus
more liable to make errors.
The management system, however, is more than the
individuals. It includes the whole structure which supports
them. Thus the system should provide, for example, for the
coverage of absence due to resignation, illness, and so on.
455
The use of a comprehensive set of procedures is
another important aspect of the management system.
A crucial procedure which was deficient at Flixborough
was that for the control of plant modifications.
The role of the safety officer at Flixborough was not
well defined.
The importance for major hazard installations of the
management and the management system was the single
most prominent theme in the work of the ACMH.
Emphasis by the HSE on management aspects has
steadily grown.
26.2.5.6 Relative Priority of Safety
and Production
The Flixborough Report (paras 57, 206) drew attention to
the conflict of priorities between safety and production.
It states:
We entirely absolve all persons from any suggestion that their
desire to resume production caused them knowingly to embark
on a hazardous course in disregard of the safety of those operat-
ing the Works. We have no doubt, however, that it was this
desire which led them to overlook the fact that it was potentially
hazardous to resume production without examining the remain-
ing reactors and ascertaining the cause of the failure of the fifth
reactor. We have equally no doubt that the failure to appreciate
that the connection of Reactor No. 4 to Reactor No. 6 involved
engineering problems was largely due to the same desire.
26.2.5.7 Use of Standards and Codes
of Practice
As the Flixborough Report (paras 61 73) describes, the
20 in. bypass assembly was not constructed and installed
in accordance with the relevant standards and codes of
practice. The bellows manufacturer, Teddington Bellows
Ltd, produced a Designer’s Guide which made it clear
that two bellows should not be used out of line in the
same pipe without adequate support for the pipe.
26.2.5.8 Limitation of Inventory in the Plant
The Flixborough Report (para. 14) makes it clear that the
large inventory of flammable material in the plant contrib-
uted to the scale of the disaster.
The Second Report of the ACMH proposes that limita-
tion of inventory should be taken as a specific design
objective in major hazard installations.
The limitation of inventory is a particular aspect of
the more general principle of inherently safer design,
which is now widely recognized.
456
26.2.5.9 Engineering of Plants
for High Reliability
The explosion at Flixborough occurred during a plant
start-up. The Flixborough Report (para. 206) suggests
that special attention should be given to factors which
necessitate the shut-down of the chemical plant so as to
minimize the number of shut-down/start-up sequences
and to reduce the frequency of critical management
decisions.
26.2.5.10 Dependability of Utilities
The high-pressure nitrogen required for the blanketing
of the reactors at Flixborough was brought into the works
by tankers. There was insufficient nitrogen available
during the start-up when the explosion occurred. The
Flixborough Report (para. 211) emphasizes the impor-
tance of assuring dependable supplies of nitrogen where
these are necessary for safety.
26.2.5.11 Limitation of Exposure of Personnel
The Flixborough Report (para. 1) states that the number
of casualties would have been much greater if the explo-
sion had occurred on a weekday instead of on a Saturday.
The First Report of the ACMH (para. 68) suggests that
limitation of exposure of personnel be made a specific
design objective.
Aspects of limitation of exposure are controls on access
to hazardous areas and design and location of buildings in
or near such areas.
26.2.5.12 Design and Location of Control
Rooms and Other Buildings
Of the 28 deaths at Flixborough 18 occurred in the con-
trol room. The Flixborough Report (para. 218) refers to
various suggestions made to the inquiry concerning the
siting of control rooms, laboratories, offices, etc., and the
construction of control rooms on blockhouse principles.
The construction of buildings for chemical plant is
considered in the First Report of the ACMH (para. 69).
26.2.5.13 Control and Instrumentation of Plant
The control and instrumentation system was not a promi-
nent feature in the Flixborough inquiry. The Flixborough
Report (para. 204) considered that the controls in the
control room followed normal practice. But it also states
‘Nevertheless we conclude from the evidence that greater
attention to the ergonomics of plant design could provide
rewarding results’.
Lees’ Process Safety Essentials
26.2.5.14 Decision Making Under
Operational Stress
The Flixborough Report (para. 205) draws attention to
the problem of decision making under operational stress
and emphasizes the desirability of reducing the number of
critical management decisions which have to be made
under these conditions.
Such critical decisions are not necessarily confined
to management, however. Process operators may also be
required to take important decisions in emergency
conditions.
26.2.5.15 Restart of Plant After Discovery
of a Defect
Following the discovery of the serious defect in Reactor
No. 5 at Flixborough, the reactor was removed, a bypass
assembly was installed, and the plant was started up
again. The Flixborough Report (para. 57) is critical of the
fact that the remaining reactors were not examined, and
the cause of the failure in the fifth reactor was not ascer-
tained before plant start-up.
26.2.5.16 Control of Plant and Process
Modifications
The Flixborough Report (para. 209) states:
The disaster was caused by the introduction into a well-designed
and constructed plant of a modification which destroyed its integ-
rity. The immediate lesson to be learned is that measures must be
taken to ensure that the technical integrity of plant is not violated.
As it happens, there was also a process modification
at Flixborough, although this is not emphasized in the
report. The agitator in Reactor No. 4 was not in use at
the time of the disaster. The absence of agitation in the
reactor could have allowed a water layer to accumulate
more easily in the bottom of the vessel.
26.2.5.17 Security of and Control of Access
to Plant
The Flixborough Report (para. 194) draws attention to the
fact that there were two unguarded gates through which
it was possible for anyone at any time to gain access,
although this fact did not contribute to the disaster.
26.2.5.18 Planning for Emergencies
The Flixborough Report (para. 222) calls for a disaster
plan for major hazard installations.
Chapter | 26 Case Histories
26.2.5.19 The Metallurgical Phenomena
The Flixborough disaster drew attention to several important
metallurgical phenomena. Thus, the Flixborough Report
describes the nitrate stress corrosion cracking of mild steel
(paras 53, 212); the creep cavitation of stainless steel (para.
214); the zinc embrittlement of stainless steel (para. 213);
and the use of clad mild steel vessels (para. 224).
The HSE subsequently issued Technical Data Notes
(1976 TON 53/1, 53/2; 1977 TON 53/3) on the first three
of these problems.
It was apparent from the discussion in the engineering
profession following publication of the report that although
metallurgical specialists were aware of failure due to zinc
embrittlement, the phenomenon was not well known
among engineers generally.
26.2.5.20 Vapor Cloud Explosions
The explosion at Flixborough was a large vapor cloud
explosion. Although such explosions had become more
common in the preceding years, none compared with
Flixborough in scale and impact. The Flixborough Report
(para. 215) draws attention to the marked lack of informa-
tion on the conditions under which a vapor cloud can
explode.
26.2.5.21 Investigation of Disasters
and Feedback of Information on
Technical Incidents
The Flixborough disaster was investigated by a Court of
Inquiry. There was some feeling in the engineering pro-
fession that a legal inquiry of this kind is not a satisfac-
tory means of establishing the facts concerning technical
incidents.
The Flixborough Report (para. 216) states that the
inquiry would have been greatly assisted if the essential
instrument records in the control room had not been
destroyed in the explosion, and recommends that consid-
eration be given to systems that record and preserve
vital plant information, such as the ‘black box’ used in
aircrafts.
The points just outlined by no means exhaust the
lessons to be learned from the Flixborough disaster. In
particular, there are many instructive aspects of the 8 in.
pipe hypothesis relating to such features as lagging fires,
directed flames, and sprinkler sensor performance.
26.3. SEVESO
At 12:37 p.m. on Saturday July 9, 1976, a bursting disc
ruptured on a chemical reactor at the works of the
ICMESA Chemical Company at Meda near Seveso,
a town of about 17,000 inhabitants some 15 miles from
457
Milan. A white cloud drifted from the works and material
from it settled out downwind. Among the substances
deposited was a very small amount of TCDD, one of the
most toxic chemicals known. There followed a period of
great confusion due to lack of communication between
the company and the authorities and the latter’s inexperi-
ence in dealing with this kind of situation. Over the next
few days in the contaminated area, animals died and
people fell ill. A partial and delayed evacuation was car-
ried out. In the immediate aftermath, there were no deaths
directly attributable to TCDD, but a number of pregnant
women who had been exposed had abortions.
A Parliamentary Commission of Inquiry, drawn
equally from the Chamber of Deputies and the Senate
and chaired by Deputy B. Orsini, was set up. The
Commission’s report (the Seveso Report) (Orsini, 1977,
1980) is a far-ranging inquiry not only into the disaster
but also into controls over the chemical industry in Italy.
The impact of the Seveso disaster in Continental
Europe has in some ways exceeded that of Flixborough
and has led to much greater awareness of process industry
hazards on the part of the public and demands for more
effective controls.
The EC Directive on Major Accident Hazards of 1982
was a direct result of the Seveso disaster, and indeed this
Directive was initially often referred to as the ‘Seveso
Directive’.
In addition to the Seveso Report, there are other
accounts of the Seveso disaster and of TCDD in The
Superpoison by Margerison et al. (1980) and The Chemical
Scythe by Hay (1976a e, 1981, 1982), Bolton (1978),
Marshall (1980), Theofanous (1981, 1983), Rice (1982),
Sambeth (1983), and Howard (1985).
26.3.1 The Site and the Works
When ICMESA built its works at Meda, the site was sur-
rounded by fields and woods. Over the years, however,
the area near the site was developed.
The reactor, Reactor A101, in which the runaway
occurred, was in Department B of the works.
26.3.2 The Process and the Plant
The process which gave rise to the accident was the
production of 2,4,5-trichlorophenol (TCP) in a batch
reactor.
TCP is used for herbicides and antiseptics. Givaudan
(parent company of ICMESA) required it for making the
bacteriostatic agent hexachlorophene. It manufactured its
own because the herbicide grades contained impurities
unacceptable in this application. Between 1970 and 1976,
some 370 te of the chemical were produced.
458
The reaction was carried out in two stages. Stage 1
involved the alkaline hydrolysis of 1,2,4,5-tetrachloroben-
zene (TCB) using sodium hydroxide in the presence of a
solvent ethylene glycol at a temperature of 170 2 180 C
to form sodium 2,4,5-trichlorophenate. The reaction mix-
ture also contained xylene, which was used to remove the
water by azeotropic distillation. In Stage 2, the sodium
trichlorophenate was acidified with hydrochloric acid to
TCP and purified by distillation.
On completion of the Stage 1 reaction, some 50% of
the ethylene glycol would be distilled off and the temper-
ature of the reaction mixture lowered to 50 2 60 C by the
addition of water.
The process was a modification by Givaudan of a pro-
cess widely used in the industry. The conventional pro-
cess used methanol rather than ethylene glycol and
operated at some 20 bar pressure.
In this reaction, the formation of small quantities of
TCDD as a byproduct is unavoidable. At a reaction
temperature below 180 C, the amount formed would be
unlikely to exceed 1 ppm of TCP, but with prolonged
heating in the temperature range 230 260 C, it could
increase a thousand fold.
During manufacture, nearly all (99.7%) of the TCDD
formed concentrated in the distillation residues from
which it was collected and incinerated. Only 0.3% found
its way into the TCP, giving a maximum concentration
of 10 ppb.
The reactor was a 138751 vessel with an agitator and
with a steam jacket supplied with steam at 12 bar. The
saturation temperature of steam at this pressure is 188 C.
The controls on the reactor were relatively primitive.
There was no automatic control of the heating.
The reactor was provided with a bursting disc set at
3.5 bar and venting direct to atmosphere. The prime
purpose of this disc was to prevent overpressure when
compressed air was being used on the reactor.
The works had an incinerator for the destruction of
hazardous plant residues at temperatures of 800 1000 C.
26.3.3 TCDD and its Properties
The properties of TCDD are given in the Seveso Report
and in Dioxin, Toxicological and Chemical Aspects by
Cattabeni et al. (1978) and by Rice (1982). 2,3,7,8
Tetrachlorodibenzo-p-dioxin is also known as TCDD or
dioxin. It is generated by the elimination of two mole-
cules of HCl from 2,4,5 trichlorophenol.
TCDD is one of the most toxic substances known. The
lowest LD50 quoted is for guinea pigs and is 0.6 µg/kg,
which is a dose of 0.6 3 1029 per unit of body weight.
TCDD can be taken into the body by ingestion,
inhalation, or skin contact. A leading symptom of TCDD
poisoning is chloracne, which is an acne-like skin effect
Lees’ Process Safety Essentials
caused by chemicals. A mild case of chloracne usually
clears within a year, but a severe case can last many
years. Other effects of TCDD include skin burns and
rashes and damage to liver, kidney, and urinary systems
and to the nervous system. It appears to have an unusual
ability to interfere with the metabolic processes. There are
varying degrees of evidence for carcinogenic, mutagenic,
and teratogenic properties. These are reviewed in the report.
TCDD is a stable solid which is almost insoluble in
water and resistant to destruction by incineration except
at very high temperatures.
26.3.4 Events at Seveso
The start of the batch began at 16:00 on Friday, July 9
(Table 26.4). The reactor was charged with 2000 kg TCB,
1050 kg sodium hydroxide, 3300 kg ethylene glycol, and
600 kg xylene.
After the reaction had taken place, part of the ethyl-
ene glycol was distilled off, but the fraction removed
was only 15% instead of the usual 50% so that most of
the solvent was left in the vessel. Distillation was inter-
rupted at 5:00 on July 10 and heating was discontinued,
but water was not added to cool the reaction mass.
The reactor was not brought down to the 50 2 60 C
temperature range specified. The temperature recorder
was switched off, with 158 C being the last temperature
recorded.
The shift ended at 6:00. This time coincided with the
closure of the plant for the weekend. The reactor was left
with the agitation turned off but without any action to
reduce the temperature of the charge.
During the weekend, with the steam turbine on reduced
load, the steam supply to the reactor jacket became super-
heated at a temperature of about 300 C.
26.3.5 The Release 1
The release contaminated the vicinity of the plant with
TCDD. Figure 26.1 is a map of the area, showing the
zones later established, and Table 26.5 gives the concen-
trations later measured in these zones.
The area of Zone A was 108 ha (1.08 km2) with
concentrations of TCDD averaging 240 µg/m2 and rising
to over 5000 µg/m2. The area of Zone B was 269 ha
(2.69 km2) with concentrations averaging 3 µg/m2 but
rising to 43 µg/m2. In the Zone of Respect, Zone R, which
had an area of 1430 ha (14.3 km2), the concentrations
varied from indeterminable to 5 µg/m2.
26.3.6 The Release 2
It is known that above 230 C, such a reactive mixture will
undergo an exothermic decomposition reaction. However,
Chapter | 26 Case Histories 459

TABLE 26.4 Timetable of Events at Seveso

July 09 Friday 16:00 Final Reactor Batch Started

10 Saturday 5:00 Final reactor batch interrupted

12:37 Bursting disc on reactor ruptures
Barni visits houses near plant to warn against eating garden produce. He asks carabinieri to repeat
warning but they refuse
11 Sunday Barni and Paoletti inform von Zwehl. They are unable to contact Ghetti or his deputy. They inform Rocca
and Malgrati. Von Zwehl informs Sambeth
12 Monday Rocca and Uberti visit ICMESA. Letter of von Zwehl to Health Officer
13 Tuesday Report of Uberti to Rocca and Malgrati
14 Wednesday Sambeth and Vaterlaus inspect Dept B and contaminated area. Uberti writes to Provincial Health Officer
in Milan
15 Thursday Dubendorf Laboratories give first analyses showing high TCDD content. Sambeth telegraphs Waldvogel in
Turkey and asks von Zwehl to inform local authorities. Sambeth informs Hoffmann La Roche and seeks
clinical advice and permission to close plant. Rumours grow in Seveso. Citizens invade Uberti’s office.
Rocca and Uberti meet von Zwehl. They decide to declare polluted zone and to post warning notices

16 Friday Workforce goes on strike. Efforts are made to contact Ghetti in remote holiday farmhouse. Warning
notices are erected. Rocca, Uberti, and others meet von Zwehl again. Uberti insists on evacuation. Rocca
requests and obtains permission for evacuation from Deputy Prefect of Milan. Rocca contacts journalist
friend
17 Saturday II Giorno carries front-page headlines on ‘poison gas’ at Seveso. Press descends on town. Uberti contacts
Cavallaro
18 Sunday Cavallaro’s team of health inspectors investigate contaminated area. Rocca, Ghetti, Cavallaro, and
Adamo meet von Zwehl. Cavallaro presses to know identity of poison released. Adamo threatens to arrest
ICMESA management
19 Monday Waldvogel arrives in Seveso and offers local authority financial compensation, which is refused

20 Tuesday Cavallaro and Ghetti meet Vaterlaus in Zurich. Vaterlaus reveals that poison released was TCDD
Uberti’s letter to Provincial Health Officer in Milan arrives
16:00 Ghetti telephones Rocca to say substance was TCDD. Prefect in Milan is informed
21Wednesday 9:30 Meeting at prefecture. Rivolta and Carreri take over responsibility. Carabinieri arrest von Zwehl
and Paoletti
23 Friday 9:00 Meeting at prefecture. Rivolta decides against evacuation. Reggiani visits Rocca and urges
evacuation. Reggiani asked to leave Deputy Prefect’s meeting unheard
14:00 Rivolta reassures meeting in Seveso town hall. Reggiani argues with Rivolta and calls for
evacuation. Carabinieri try unsuccessfully to arrest Reggiani, who returns to Switzerland
24 Saturday 9:30 Meeting of regional health council. Vaterlaus presents map of locations affected. Council decides to
recommend evacuation and defines evacuation zone (part of Zone A)
26 Monday 179 people evacuated
29 Thursday Zone A extended and further 550 evacuated

accidents have been known to occur involving a reaction
runaway above this temperature.
Due to the interruption of the batch, the usual sharp
reduction in the temperature of the charge at the termina-
tion of the reaction did not take place, and after 7.5 h, the
explosion occurred.
Investigations carried out after the accidents using
differential thermal analysis showed that there exist two
slow exotherms (Theofanous, 1981, 1983). One starts at
about 185 C, peaking at 235 C and giving a 57 C adiabatic
temperature rise. The other starts at about 255 C, peaking
at 265 C and giving an estimated 114 C temperature rise.
460 Lees’ Process Safety Essentials

M r
The adiabatic induction times for the two exotherms are
e
ot
or Riv 2.1 and 0.5 h, respectively. The decomposition exotherm
wa R
y starts at about 280 2 290 C and shows a rapid pressure rise
at about 300 C.
Icmesa R
A mechanism for the reaction runaway has been
works Seves proposed by Theofanous. It states that due to layering of
lwa
y the reaction mix, the amount of residual heat in the upper
Rai
A section of the reactor wall was sufficient to raise the
Rive

temperature of the top layer of liquid to 200 220 C,

r

a temperature high enough to initiate exotherms leading

R to decomposition.
In conducting the final batch, there were failures of
adherence to operating procedures. Howard (1985)
B instances (1) failure to distil off 50% of the glycol;
R
(2) failure to add water; (3) failure to continue agitation;
(4) switching off of the reactor temperature recorder;
and (5) failure to bring the reactor temperature down
from its value of 158 C to the normal value of 50 60 C.
Riv

26.3.7 The Later Aftermath, Contamination,

er

R
and Decontamination
Mo

There was a prolonged period in which the authorities

tor
wa

tried to assess the situation and determine measures for

y

Milano dealing with it. They were advised by a team from

0 1 2 c. 30 km
Cremer and Warner (C&W), and an account has been
Kilometres given by Rice (1982).
(deduced scale) The release was modeled using fluid jet and gas disper-
sion models, and predictions were made on the probable
FIGURE 26.1 Plan of the Seveso area, showing Zones A and B and
Zone of Respect. Source: After Orsini (1980). ground level concentrations of TCDD. Accounts have been
given by Comer (1977) and Rice (1982). In this work,
the reaction mass was taken as 2800 kg ethylene glycol,
2030 kg trichlorophenol 2030, 542 kg sodium chloride, and
562 kg sodium hydroxide.
TABLE 26.5 Concentrations of TCDD in Zones A and B Estimates of the amount of TCDD generated in the
at Seveso reactor and dispersed over the countryside vary. Cattabeni
et al. (1978) give an estimated range of 0.45 3 kg
Zone Concentration (mg/m2)
released. The amount assumed in the C&W modeling
Mean Maximum Minimum work was 2 kg.
A1 580.4 5477 n.v.d Other parameters used in the modeling were bursting
disc rupture pressure at 376 kPa; a vent pipe diameter of
A2 521.1 1700 6.1
127 mm; and a discharge height above ground of 8 m.
A3 (north) 453.0 2015 1.7 The bursting disc rupture was assumed to a first approxi-
A3 (south) 93.0 441 n.v.d. mation to be due to the vapor pressure of ethylene glycol
at 250 C. From these data, the value obtained for the
A4 139.9 902 n.v.d.
vapor exit velocity was 274 m/s. Two limiting cases were
A5 62.8 427 n.v.d. considered for the discharge: Case A, pure vapor (density
A6 29.9 270 n.v.d. 1.61 kg/m3) and Case B, a two-phase vapor liquid mix-
ture (density 8.99 kg/m3). Eyewitness accounts indicated
A7 15.5 91.7 n.v.d.
that the actual event was intermediate between these two
B 3 43.8 n.v.d. extremes. For Case A, the total plume rise was estimated
at 83 m with the downwind distance to the maximum
n.v.d. 5 no value determined.
Source: After Orsini (1980). height as 103 m, and the corresponding figures for Case
B were 55 and 95 m, respectively.
Chapter | 26 Case Histories
The modeling work proved useful in defining the
problem and planning the decontamination. The results
showed that beyond about 1.5 km, there was little differ-
ence in the concentration estimates for the two cases.
There was much agreement between the predicted and the
measured concentrations. This gave some confidence that
the amount released was indeed about 2 kg. There had
been some speculation by scientists that an amount as
high as 130 kg had been released.
Various methods of decontamination were put forward
by various parties, but were rejected by various reasons.
TCDD is virtually insoluble in water, which reduces the
threat to the water supply, but means that the effect of
rain is to transfer it from the vegetation to the soil rather
than to remove it.
The decontamination measures actually carried out are
described by Rice. They include collection of vegetation
and cleaning of buildings by high intensity vacuum clean-
ing followed by washing with high-pressure water jets.
It is worth mentioning that people may also have been
affected by materials other than TCDD in the reactor
charge. Marshall (1980) indicates that on the basis of the
ground concentrations found in the contaminated area,
a minimum of 0.25 kg was released. He points out that
there were some 5 10 te of charge in the reactor and that
several tons of material, including sodium hydroxide,
must have been ejected. He suggests that burns around
the hands and other parts of the body suffered by 413 per-
sons who did not develop chloracne were probably caused
by sodium hydroxide.
Data from the official report on ground concentrations
in zones A and B are given in Table 26.5.
Kimbrough et al. (2010) provides a short account of
the extent to which humans actually were exposed to the
chemicals from soil, food, or air. The large air borne
release of TCDD may have provided an acute inhalation
dose compared to the one ingested from locally grown
produce after the release.
26.3.8 Some Lessons from Seveso
Some of the numerous lessons to be learnt from the
Seveso disaster, many of which were brought out in the
Commission’s report, are considered.
26.3.8.1 Public Control of Major Hazard
Installations
The Seveso disaster had the effect of raising the general
level of awareness of the hazards from chemical plants
in Italy and in Europe, and highlighted the deficiencies in
the existing arrangements for the control of major
hazards.
461
The Italian government set up the Commission of
Inquiry to investigate the cause of the disaster and to
make recommendations. It also gave strong support to the
development of the EC Directive.
26.3.8.2 Siting of Major Hazard Installations
The release at Seveso affected the public because in the
period since the site was first occupied, housing develop-
ment had encroached on the area around the plant. The
accident underlined the need for separation between
hazards and the public.
26.3.8.3 Acquisition of Companies Operating
Hazardous Processes
A lesson which has received relatively little attention is
the problem faced by a company which becomes owner
by acquisition of another company operating a hazardous
process. At Seveso, the problem was compounded by the
fact that ICMESA was owned by Givaudan and the latter
by Hoffmann La Roche, so that the company ultimately
responsible was twice removed. As a result, the directors
of the latter were not familiar with the hazards.
26.3.8.4 Hazard of Ultra Toxic Substances
Seveso threw into sharp relief the hazard of ultra toxic
substances. The toxicity of TCDD is closer to that of a
chemical warfare agent than to that of the typical toxic
substance which the chemical industry is used to handling.
As it happened, the British Advisory Committee on
Major Hazards was presenting its First Report, giving a
scheme for the notification of hazardous installations,
when Seveso occurred. It contained no notification propo-
sals for ultra toxics. In the Second Report, this deficiency
was rectified. The EC Directive places great emphasis on
toxic and ultra toxic materials.
Research on the toxicity of dioxins continues to shed
light on the effects that were observed after the incident.
Population-based studies (Pesatori et al., 2008) and short/
long term morbidity and mortality (Pesatori et al., 2003)
have been investigated. During the 20 year period,
mortality and morbidity findings indicate that there is an
increased risk from lymphoemopoietic neoplasm, digestive
system cancer, and respiratory system cancer.
26.3.8.5 Hazard of Undetected Exotherms
The characteristics of the reaction used had been investi-
gated, and the company believed it had sufficient informa-
tion. It was well aware of the hazard from the principal
exotherm. Subsequent studies showed, however, that other,
weaker exotherms existed which, given time, could also
cause a runaway.
462
The complete identification of the characteristics of
the reaction being operated is particularly important.
If these are not known, or only partially known, there is
always the danger that the design will not be as inherently
safe as intended, that operating modifications will have
unforeseen results, and/or that protective measures will be
inadequate.
After the incident, studies were carried out to better
understand and investigate the trichlorophenol synthesis,
such as the research conducted by Braun et al. (1999).
26.3.8.6 Hazard of Prolonged Holding
of Reaction Mass
The interruption of the reaction and the holding of the
reaction mass for a prolonged period after the main reac-
tion was complete without reducing the temperature gave
time for the weak exotherms to occur and lead to
runaway.
26.3.8.7 Inherently Safer Design of
Chemical Processes
The reactor was intended to be inherently safe to the
extent that the use of steam at 12 bar set a temperature
limit of 188 C so that the contents could not be heated
above this by the heating medium. Unfortunately, this
feature was defeated by allowing the reaction charge to
stand hot for too long so that weak exotherms occurred,
which the company did not know about.
The bursting disc was not intended for reactor venting,
but, as the Commission pointed out, if the set pressure of
the disc had been lower, the reactor would have vented at
a lower temperature and with less dioxin in the charge.
26.3.8.8 Control and Protection of Chemical
Reactors
The control and protection system on the reactor was
primitive. Operation of the reactor was largely manual.
There was no automatic control of the cooling and no
high temperature trip.
The reactor was not designed to withstand a runaway
reaction. It was not rated as a pressure vessel to withstand
pressure build-up prior to and during venting, the disc
was not designed for reaction relief, and there was no
tank to take the ultra toxic contents of the reactor.
26.3.8.9 Adherence to Operating Procedures
The conduct of the final batch involved a series of failures
to adhere to the operating procedures.
Lees’ Process Safety Essentials
26.3.8.10 Planning for Emergencies
As the account given above indicates, the handling of the
emergency was a disaster in its own right. Information on
the chemical released and its hazards was not immedi-
ately available from the company. There was failure of
communication between the company and the local
and regulatory authorities, and within those authorities.
Consequently, there was lack of action and failure to pro-
tect and communicate with the public. These deficiencies
might in large part have been overcome by emergency
planning.
26.3.8.11 Difficulties of Decontamination
The incident illustrates the difficulties of decontamination
of land where the contaminant is both ultra toxic and
insoluble in water.
26.4. MEXICO CITY
At about 5:35 a.m. on the morning of November 19,
1984, a major fire and a series of explosions occurred at
the terminal at San Juan Ixhuatepec (commonly known
as San Juanico), Mexico City. As a consequence of this
incident, more than 500 people were killed, around 7000
sustained injuries, and the terminal was destroyed.
The accident was investigated by a team from TNO
who visited the site about 2 weeks after the disaster and
has published its findings (Pietersen, 1985, 1986a,b,
1988). A further account has been given by Skandia
International (1985).
26.4.1 The Site and the Plant
The oldest part of the plant dated from 1961 to 1962, and
was thus over 20 years old. In the intervening period,
residential development had crept up to the site. By 1984,
the housing was within 200 m of the installation, with
some houses within 130 m.
The terminal was used for the distribution of LPG,
which came by pipeline from three different refineries.
The main LPG storage capacity of 16,000 m3 consisted of
6 spheres and 48 horizontal cylinders. The daily through-
put was 5000 m3. The layout of the terminal with storage
tank capacities is shown in Figure 26.2. The two larger
storage spheres had individual capacities of 2400 m, and
the four smaller spheres had capacities of 1600 m3. The
site covered an area of 13,000 m2.
The plant was said to have been built to API stan-
dards, and much of it to have been manufactured in the
United States.
A ground level flare was used to burn off excess gas
(see 7 in Figure 26.2). The flare was submerged in the
Chapter | 26 Case Histories 463

20
N
24

14
Unigas Gasomatico

1 2 6 9 19
5 13
3 22
8
7 4
10 12
15 18

11
16 17
23
21

Legenda:
7 Flare pit (2nd flare pit 16 LPG storage UNIGAS
1 2 Spheres of 2,400 m3, φ = 16.5 m see fig 1.3) 17 LPG storage GASOMATICO
2 4 Spheres of 1,600 m3, φ = 14.5 m 8 Pond 18 Bottling terminal
Pemex LPG installation 3 4 Cylinders of 270 m3, φ = 35.5 m, L = 32 m 9 Control room 19 Depot of cards with bottles
10 Pump house 20 Entrance
San Juan Ixhuatepec, 4 14 Cylinders of 180 m3, φ = 3.5 m, L = 21 m
11 Fire pumps 21 Rail car loading
Mexico City 5 21 Cylinders of 36 m3, φ = 2 m, L = 13 m 12 Road car loading 22 Store
6 6 Cylinders of 54 m3, φ = 2 m, L = 19 m 13 Gas bottle store 23 Water tank
3 Cylinders of 45 m3, φ = 2 m, L = 16 m 14 Pipe/valve manifold 24 Garrison
Scale 1:2,200 15 Water tower

FIGURE 26.2 Layout of the PEMEX site at Mexico City (Pietersen, 1985). Source: Courtesy of TNO.

ground to prevent the flame being extinguished by the
strong local winds.
Adjoining the PEMEX plant, there were distribution
depots owned by other companies. The Unigas site was some
100 200 m to the north and contained 67 tank trucks at the
time of the accident. Further away was the Gasomatico site,
with large numbers of domestic gas cylinders.
26.4.2 The Fire and Explosion 1 eyewitnesses put at 200 3 150 m with a height of 2 m,
Early on the morning of November 18, the plant was
being filled from a refinery 400 km away through 8 in.
feed pipeline. The previous day, the plant had become
almost empty, and refilling started during the afternoon.
The two larger spheres and the 48 cylindrical vessels had
been filled to 90% full, and the four smaller spheres to
about 50% full, so that the inventory on site was about
11,000 m3, when the incident occurred.
About 5:30 a.m., a fall in pressure was registered in
the control room and at a pipeline pumping station 40 km
away. The 8 in. pipe between sphere F4 and the Series G
cylinders had ruptured. The control room personnel tried
to identify the cause of the pressure fall but were not
successful.
The release of LPG continued for some 5 10 min.
There was a slight wind of 0.4 m/s. The wind and the
sloping terrain carried the gas toward the south-west.
People in nearby housing heard the noise of the escape
and smelled the gas.
When the gas cloud had grown to cover an area which
it found a flare and ignited at 5:40 a.m. The cloud caught
fire over a large area, causing a high flame and a violent
ground shock. When this general fire had subsided, there
remained a ground fire, a flame at the rupture, and fires
in some 10 houses.
Workers at the plant now tried to deal with the escape.
One drove off to another depot to summon help. Five
others who may have been on their way to the control
room or to man fire pumps were found dead and badly
burned. At a late stage, someone evidently pressed the
emergency shut-down button.
464 Lees’ Process Safety Essentials

footnote indicates, it is suggested by Skandia (1985) that

TABLE 26.6 Timetable of Events at Mexico City the initial explosion, or violent deflagration, was probably
A Seismograph Readings not recorded.
Numerous missiles were generated by the bursting of
1 5h 44 min 52 s 6 6h 49 min 38 s the vessels. Many of these were large and travelled far.
2 5h 46 min 01 s 7 6h 54 min 29 s Twenty-five large fragments from the four smaller spheres
3 6h 15 min 53 s 8 6h 59 min 22 s
weighing 10 2 40 te were found 100 2 890 m away.
Fifteen of the 48 cylindrical vessels weighing 20 te became
4 6h 31 min 5s 9 7h 01 min 27 s missiles and rocketed over 100 m, one travelling 1200 m.
5 6h 47 min 56 s Four cylinders were not found at all. The missiles caused
damage both by impact and by their temperature, which
B General Timetable
was high enough to set houses on fire.
5:30 Rupture of 8 in. pipe. Fall of pressure in control A timetable of events during the disaster is given in
room Table 26.6, Section B.
5:40 Ignition of gas cloud. Violent combustion and
high flame
5:45 First explosion on seismograph, a BLEVE 26.4.3 The Emergency
Fire department called Accounts of the emergency give little information about
the response of the on-site management in the emergency,
5:46 Second BLEVE, one of most violent
and deal mainly with the rescue and firefighting.
6:00 Police alerted and civilian traffic stopped The site became the scene of a major rescue operation
6:30 Traffic chaos which reached a climax in the period 8:00 2 10:00 a.m.
Some 4000 people participated in rescue and medical
7:01 Last explosion on seismograph, a BLEVE
activities, including 985 medics, 1780 paramedics, and
7:30 Continuing tank explosionsa 1332 volunteers. At one point, there were some 3000 people
11:00 Last tank explosion in the area. There were 363 ambulances and five helicopters
involved.
8:00 10:00 Rescue work at its height
The rescuers were at risk from a large BLEVE. The
12:00 18:00 Rescue work continues Skandia report states, ‘If a BLEVE had occurred during
23:00 Flames extinguished on last large sphere the later morning, a large number of those 3000 people
who were engaged in rescue and guarding would have
Disturbances 2 and 7 were the most intense with a Richter scale intensity
of 5. Skandia suggests that the first violent combustion may not have been killed’.
been recorded.
a
The fire services were called by surrounding plants and
Explosions of cylindrical vessels.
by individual members of the public at about 5:45 a.m.
They went into the plant area only 3 h after the start of the
incident. Initially, they moved toward the Gasomatico site
In the neighboring houses, some people rushed out
where a sphere fragment had landed and started a fire that
into the street, but most stayed indoors. Many thought it
caused the domestic gas cylinders to explode.
was an earthquake.
The fire brigade also fought the fire on the two larger
At 5:45 a.m., the first BLEVE occurred. About a min-
spheres, which had not exploded. They were at an appre-
ute later, another explosion occurred, one of the two most
ciable risk from a BLEVE in these two spheres. In this
violent during the whole incident. One or two of the
event, however, these burned themselves out. The last
smaller spherical BLEVEs produced a fireball 300 m in
flames on the spheres went out at about 11:00 p.m. Some
diameter.
200 firemen were at the site.
A rain of LPG droplets fell on the area. Surfaces
covered in the liquid were set on fire by the heat from the
fireballs. People also caught on fire.
There followed a series of explosions as vessels
26.4.4 The Fire and Explosion 2 2
suffered BLEVEs. There were some 15 explosions over a The TNO report gives technical information on the course
period of an hour and a half. BLEVEs occurred in the four of the disaster and on the fire and explosion phenomena
smaller spheres and many of the cylindrical vessels. which occurred during it.
The explosions during the incident were recorded on a The report discusses the effects of explosions, including
seismograph at the University of Mexico. The timing of vapor cloud explosions (VCEs), BLEVEs, and physical
the readings is given in Table 26.6 Section A. As the explosions; the effects of fire engulfment and heat
Chapter | 26 Case Histories
radiation; and the effects of missiles, including fragments
from bullet tanks and spheres.
The report gives estimates of the overpressure from
the BLEVEs of the principal vessels. It states that the
degree of blast damage to the housing was not great, that
the VCE effects were not responsible for major damage,
that the second explosion, a BLEVE, was the most violent
and did damage houses, that the worst explosion damage
was probably from gases which had accumulated in
houses, and that much of the damage was caused by fire.
Films were available for many of the BLEVEs, though
not for the second, violent explosion. From this evidence,
the BLEVEs had diameters of 200 2 300 m and durations
of some 20 s. Heavy direct fire damage was found at
distances up to about 300 m, which agrees reasonably
well with the estimates of fireball size.
A very large fire burned on the site for about an hour
and a half, punctuated by BLEVEs. Details are given on
the number, size, and range of fragments from spheres
and bullet tanks.
26.4.5 Some Lessons of Mexico City
Mexico City incident is one of largest incidents in process
safety and involving catastrophic BLEVEs. Things to be
learned from the incident may be as described here.
26.4.5.1 Siting of Major Hazard Installations
The high death toll at Mexico City occurred because
housing was too near the plant. At the time the plant was
constructed the area was undeveloped, but over the years
the built-up area had gradually crept closer to the site.
26.4.5.2 Layout and Protection
of Large LPG Storages
The total destruction of the facility occurred because
there was a failure in the overall system of protection,
including layout, emergency isolation, and water spray
systems.
26.4.5.3 Gas Detection and Emergency
Isolation
One feature which might have averted the disaster is
more effective gas detection and emergency isolation.
The plant had no gas detector system and, probably as a
consequence, emergency isolation happened too late.
26.4.5.4 Planning for Emergencies
One particularly unsatisfactory aspect of the emergency
was the traffic chaos which built up as residents sought to
flee the area and the emergency services tried to get in.
465
Another risk was due to the large number of rescuers
who came on site due to the possibility of a BLEVE of
one of the larger spheres.
26.4.5.5 Fire Fighting in BLEVE Hazard
Situations
The fire services appear to have taken a considerable risk
in trying to fight the fire on the two larger spheres. The
potential death toll if a BLEVE had occurred was high.
26.4.5.6 Boiling Liquid Expanding
Vapor Explosions
After Flixborough the problem of vapor cloud explosions
received much attention. Mexico City demonstrates that
boiling liquid expanding vapor explosions are an equally
important hazard.
The Mexico City incident represents the largest series
of major BLEVEs which have occurred, and provides
much information on BLEVEs. However, the TNO report
remains as the major source of information about this
accident. More than two decades have passed after the
explosion at the San Juanico LPG terminal, and no offi-
cial investigation report has been released to the public
by PEMEX or Mexican authorities.
26.5. BHOPAL
Early in the morning of December 3, 1984, a relief valve
lifted on a storage tank containing highly toxic methyl
isocyanate (MIC) at the Union Carbide India Ltd (UCIL)
works at Bhopal, India. A cloud of MIC gas was released
onto housing, including shantytowns, adjoining the site.
Close to 2000 people died within a short period and tens
of thousands were injured.
The accident at Bhopal is by far the worst disaster
which has ever occurred in the chemical industry. Its
impact has been felt worldwide, but particularly in India
and the United States. There are a lot of lessons we
should learn.
26.5.1 The Site and the Works
The works was in a heavily populated area. Much of the
housing development closest to the works had occurred
since the site began operations in 1969, including the
growth of the J.P. Nagar shantytown. Although these
settlements were originally illegal, in 1984 the govern-
ment gave the squatters rights of ownership on the land to
avoid having to evict them. Other residential areas which
were affected by the gas cloud had been inhabited for
over 100 years.
466
26.5.2 The Process and the Plant
Monomethylamine (MMA) is reacted with excess phos-
gene in the vapor phase to produce methylcarbamoyl
chloride (MCC) and hydrogen chloride, and the reaction
products are quenched in chloroform. The unreacted
phosgene is separated by distillation from the quench
liquid and recycled to the reactor. The liquid from the
still is fed to the pyrolysis section where MIC is formed.
The stream from the pyrolyser condenser passes as feed
to the MIC refining still (MRS). MIC is obtained as the
top product from the still. The MIC is then run to storage.
The MIC storage system (MSS) consisted of three
storage tanks, two for normal use and one for emergency
use. The tanks were 8 ft diameter by 40 ft long with a
nominal capacity of 15,000 USgal. They were made out
of 304 stainless steel with a design pressure of 40 psig at
121 C and with a hydrostatic test pressure of 60 psig.
A diagram of the storage tank system is shown in
Figure 26.3.
A 30 ton refrigeration system was provided to keep
the tank contents at 0 C by circulating the liquid through
an external heat exchanger.
FIGURE 26.3 Flow diagram of Tank 610 system (Bhushan and Subramanian, 1985) Source: Courtesy of Business India.
Lees’ Process Safety Essentials
On each storage tank, there was a pressure controller
which controlled the pressure in the tank by manipulating
two diaphragm motor valves (DMVs), a make-up valve to
admit nitrogen and a blowdown valve to vent vapor. Each
tank had a safety relief valve (SRV) protected by a burst-
ing disc. They also had high temperature alarms and low
and high level alarms.
A vent gas scrubber (VGS) and a flare were provided
to handle vented gases. The VGS was a packed column
5 ft 6 in. diameter in which the vent gases were scrubbed
with caustic soda. There were two vent headers going
into the column: the process vent header (PVH), which
collected the MIC system vents, and the relief valve vent
header (RVVH), which collected the safety valve dis-
charges. Each vent header was connected both to the
VGS and the flare and could be routed to either. The vent
stack after the VGS was 100 ft (33 m) high.
The VGS had the function of handling process vents
from the PVH and of receiving contaminated MIC, in either
vapor or liquid form, and destroying it in a controlled
manner.
The function of the flare was to handle vent gases
from the carbon monoxide unit and the MMA vaporizer
Chapter | 26 Case Histories
safety valve and also vent gas from the MIC storage
tanks, the MRS and the VGS.
In the 2 years preceding, the number of personnel on
site were reduced, 300 temporary workers were laid
off and 150 permanent workers pooled and assigned as
needed to jobs, some of which they said they felt unquali-
fied to do when interviewed. The production team at the
MIC facility was cut from 12 to 6.
26.5.3 MIC and its Properties
MIC is a colorless liquid with a normal boiling point
of 39 C. It has a low solubility in water. It is relatively
stable when dry, but is highly reactive and in particular
can polymerize and will react with water. It is flamma-
ble and has a flashpoint of 218 C and a lower flamma-
bility limit of 6% v/v. It is biologically active and highly
toxic.
The high toxicity of MIC is indicated by the fact that its
TLV at the time was 0:02 ppm. This is very low, relative to
most typical compounds handled in industry.
MIC is an irritant gas and can cause lung edema,
but it also breaks down in the body to form cyanide. The
cyanide suppresses the cytochrome oxidase necessary for
oxygenation of the cells and causes cellular asphyxiation.
Information on the inhalation toxicity of MIC is given
by Kimmerle and Eben (1964) and ten Berge (1985).
MIC can undergo exothermic polymerization to the
trimer, the reaction being catalyzed by hydrochloric acid
and inhibited by phosgene. It also reacts with water, iron
being a catalyst for this reaction. This reaction is strongly
exothermic.
26.5.4 Events Prior to the Release
In 1982, a UCC safety team visited the Bhopal plant.
Their report gave a generally favorable summary of the
visit, but listed ten safety concerns.
Following this visit, valves on the MIC plant were
replaced, but degraded again. At the time of the accident,
the instruments on Tank 610 had been malfunctioning for
over a year.
Between 1981 and 1984, there were several serious
accidents on the plant. In December 1981, three workers
were gassed by phosgene and one died. Two weeks later,
24 workers were overcome by another phosgene leak.
In February 1982, 18 people were affected by an MIC
leak. In October 1982, three workers were injured and
nearby residents affected by a leak of hydrochloric acid
and chloroform.
Following this latter accident, workers from the plant
posted a notice in Hindi which read, ‘Beware of fatal
accidents . . . lives of thousands of workers and citizens in
danger because of poison gas . . . Spurt of accidents in the
467
factory, safety measures deficient’. These posters were
also distributed in the community.
About a year before the accident, a ‘jumper line’ was
connected between the PVH and the RVVH. Figure 26.3
shows the MIC storage tank and pipework arrangements.
The jumper line is between valves 1 and 2. The object of
the modification was to allow gas to be routed to the
VGS if repairs had to be made to one of the vent headers.
In June 1984, the 30 ton refrigeration unit cooling the
MIC storage tanks was shut down. The charge of Freon
refrigerant was drained from the system.
In October, the VGS was turned off, apparently
because it was thought unnecessary when MIC was only
being stored not manufactured. In the same month, the
flare tower was taken out of service, a section of corroded
pipe leading to it was removed so that it could be
replaced.
Another difficulty was experienced in pressurizing MIC
storage Tank 610. It appeared that since nitrogen was pass-
ing through the make-up valve satisfactorily, the blowdown
valve was leaking and preventing pressurization.
According to plant workers, there were other instru-
mentation faults. The high temperature alarm had long
been faulty. There were also faults on the pressure con-
troller and the level indicator.
The plant had a toxic gas alarm system. This consisted
of a loud siren to warn the public and a muted siren to
warn the plant. These two sirens were linked and could
be activated from a plant toxic alarm box. The loud siren
could be stopped from the control room by delinking the
two. A procedure had been introduced according to which
after delinking, the loud siren could be turned on only by
the plant superintendent.
Plant workers stated that on the morning of December 2,
washing operations were undertaken. Orders were given to
flush out the downstream sections of four filter pressure
safety valves lines. These lines are shown in Figure 26.3.
In order to carry out this operation, Valve 16 on the diagram
was shut, Valves 18 2 21 and 22 2 25 were opened and
then Valve 17 was opened to admit water.
It was suggested water might have entered MIC stor-
age Tank 610 as a result of this operation—the water
washing theory. In this hypothesis, water evidently leaked
through Valve 16, into the RVVH and passed through the
jumper line into the PVH and then into Tank 610. This
would require that Valves 3 and 12 were open to connect
the tank to the PVH and Valves 1 and 2 open to connect
the RVVH to the PVH via the jumper line.
26.5.5 The Release
On the evening of December 2, a shift change took
place at the plant at 22:45. At 23:00, the control room
operator noticed that the pressure in Tank 610 was
468
10 psig. This was higher than normal but within the
2 2 25 psig operating pressure of the tank. At the
same time, the field operator reported a leak of MIC
near the VGS. At 00:15, the field operator reported an
MIC release in the process area, and the control room
operator saw that the pressure on Tank 610 was now
at 30 psig and rising rapidly. He called the supervisor
and ran outside to the tank. He heard rumbling sounds
coming from the tank and a screeching noise from the
safety valve and felt heat from the tank. He returned
to the control room and turned the switch to activate
the VGS, but this was not in operational mode
because the circulating pump was not on.
At 00:20, the production supervisor informed the plant
superintendent of the release. At 00:45 operations in the
derivative unit were suspended due to the high concentra-
tion of MIC.
At 01:00, an operator in this unit turned on the toxic
gas alarm siren. After 5 min the loud siren was switched
off leaving only the muted siren on.
At about the same time, the plant superintendent and
control room operator verified that MIC was being emit-
ted from the VGS stack into the atmosphere, and turned
on and directed water monitors at the stack fixed fire to
knock down the vapor.
Water was also directed at the MIC tank mound
and at the vent header for the VGS. Steam issued
from the cracks in the concrete showing that the tank
was hot.
One plant supervisor tried to climb the structure to
plug the gas leak but was overcome, falling and breaking
both legs.
Some time between 01:30 and 02:30, the safety valve
on Tank 610 reseated and the release of MIC ceased.
At about 02:30, the loud siren was switched on again.
The cloud of MIC gas spread from the plant toward
the populated areas to the south. There was a light wind
and inversion conditions.
People in the housing around the plant felt the irritant
effect of the gas. Many ran out of their houses, some
toward the plant. Within a short period, animals and peo-
ple began to die.
At Railway Colony some 2 km from the plant,
where nearly 10,000 people lived, it was reported that
within 4 min 150 died, 200 were paralyzed, and 600
rendered unconscious, with 5000 people severely
affected.
People tried to telephone the plant but were unable to
get through. At 01:45, a magistrate contacted the plant
superintendent.
The cloud of toxic gas hung around the area for the
entire day of December 3. During the day, it stopped
moving toward the city, but resumed its movement in that
direction during the night.
Lees’ Process Safety Essentials
26.5.6 Some Lessons Learned from
the Bhopal Incident
The Bhopal disaster was a wakeup call for the chemical
industry around the world. Concerns from the public
before the incident were mainly health issues along with
environmental losses. The Bhopal incident brought up
questions of public confidence in the chemical industries.
There are numerous lessons learned from the Bhopal
incident. Some of these lessons are now considered.
26.5.6.1 Public Control of Major Hazard
Installations
The disaster at Bhopal received intense publicity for an
extended period and put major hazards on the public
agenda worldwide, but particularly in India and the United
States, who had not reacted as strongly to Flixborough and
Seveso as Europe had. The incident was a stimulus
to question the practices and attitudes toward the safety
of chemical plants. Extensive legislative and industrial
improvements were brought up worldwide throughout
decades.
26.5.6.2 Siting of and Development Control
at Major Hazard Installations
Very large numbers of people were at risk from the plant
at Bhopal. This situation was due in large part to the
encroachment of the shantytowns, which came up to the
site boundary. Although these settlements were illegal,
the Indian authorities had acquiesced to them.
In this instance, however, this was not the whole story.
The accident showed that the site was built close enough
to populated areas to present a hazard, when used for the
production of a chemical as toxic as MIC. If the manufac-
ture of such a chemical was envisaged from the start, the
problem may be regarded as one of siting. If not, it may
be viewed as one of intensification of the siting hazard.
26.5.6.3 Management of Major Hazard
Installations
The plant at Bhopal was by any standards a major hazard
and needed to be operated by a suitable competent man-
agement. The standards of operation and maintenance do
not give confidence that this was so.
There had been recent changes in the responsibility
for the plant which suggest that the new management
may not have been familiar with the demands of a major
hazardous operation. However, many of the problems at
the plant appear to have predated these changes.
Chapter | 26 Case Histories
26.5.6.4 Highly Toxic Substances
MIC is a highly toxic substance, much more toxic than
substances such as chlorine which are routinely handled in
the chemical industry. The hazard from such highly toxic
substances has perhaps been insufficiently appreciated.
This hazard will only be realized if there is a mecha-
nism for dispersion. At Bhopal, this mechanism was the
occurrence of exothermic reactions in the storage tank.
26.5.6.5 Runaway Reaction in Storage
The hazard of a runaway reaction in a chemical reactor is
well understood, but such a reaction in a storage tank had
received very little attention. At Bhopal, this occurred
due to ingress of water. When such a reaction could act
as the mechanism of dispersion for a large inventory of
a hazardous substance, the possibility of its occurrence
should be carefully reviewed.
26.5.6.6 Water Hazard in Plants
In general terms, the hazard of water ingress into plants is
well known. In particular, water may contact hot oil and
vaporize with explosive force or may cause a frothover,
it may corrode the equipment and it may cause a blockage
by freezing. Bhopal illustrates the hazard of an exothermic
reaction between a process fluid and water.
26.5.6.7 Relative Hazard of Materials
in Process and in Storage
There has been a tendency to argue that the risks from
materials in storage are less than from materials in process,
since, although usually the inventories in storage are larger,
the probability of a release is much less. The release at
Bhopal was from a storage tank, albeit from one associated
with a process.
26.5.6.8 Relative Priority of Safety
and Production
The features which led to the accident have been
described above. As indicated, the Union Carbide Report
Union Carbide Corporation (1985) itself refers to a num-
ber of these.
The ICFTU-ICEF report states that at the time of the
accident the plant was losing money and lists a number of
measures which had been taken, apparently to cut costs.
These include the manning cuts and the cessation of
refrigeration.
26.5.6.9 Limitation of Inventory in the Plant
The hazard at Bhopal was the large inventory of highly
toxic MIC. The process was the same as that used at
469
UCC’s West Virginia plant. UCIL had stated that it
regarded this inventory as undesirable, but was overruled
by the parent company, which wished to operate the same
process at both plants.
Processes are available for the manufacture of MIC
which requires only small inventories of the material.
Moreover, carbaryl can be made by a route which does
not involve MIC. The alternatives to the use of MIC are
discussed by Kletz (1988).
26.5.6.10 Set Pressure of Relief Devices
It is preferred from an operational viewpoint that the set
pressure of a relief valve be such that the valve opens
when a pressure rise threatens the integrity of the vessel,
but not when normal, minor operating pressure deviations
occur. However, when the cause of a potential pressure
rise is a runaway reaction, there is a penalty for a high set
pressure as it may allow the reaction to reach a higher
temperature and to proceed more rapidly before venting
starts. There is a need to balance these two factors.
26.5.6.11 Disabling of Protective Systems and
Alarms
It was evident that the flare system was not viewed as a
critical component for the protection of the plant, since it
was allowed to remain out of commission for the 3 months
prior to the accident. The community alarm, which was
activated 5 min after the leak, was then deactivated for
nearly an hour. It is essential that there be strict procedures
for the disabling of any item which is critical for protection
and alarm systems. It is also very important that the time
for which an item is out of action be kept to a minimum.
26.5.6.12 Maintenance of Plant Equipment
and Instrumentation
The 1982 UCC safety team drew attention to the pro-
blems in the maintenance of the plant. The Union
Carbide Report Union Carbide Corporation (1985) gives
several examples of poor maintenance of plant equipment
and instrumentation, and the ICFTU-ICEF report gives
further details. Workers stated that leaking valves and
malfunctioning instruments were common throughout the
plant.
Maintenance was very slow. Although the crucial
safety system was not operational, no action was con-
ducted to fix the problem. The flare system, which was a
critical protective system, had been out of commission
for 3 months before the accident. The vent gas scrubber
that was supposed to neutralize MIC gas with caustic
soda was not fully operational. Temperature and pres-
sure gauges were not giving reliable information and
alarms failed to work. The refrigeration system to cool
470
MIC to around 0 C was shut down. Maintenance to keep
a certain level of safety in the process should never be
overlooked.
26.5.6.13 Isolation Procedures for Maintenance
A particular deficiency in the maintenance procedures
was the failure to properly isolate the section of the plant
being flushed out by positive isolation using a slip plate
or equivalent means. The fact that the water may not
have entered in this way does not detract from this lesson.
26.5.6.14 Control of Plant and Process
Modifications
A principal hypothesis to explain the entry of water into
Tank 610 is that the water passed through the jumper
line. The installation of this jumper line was a plant modi-
fication. In a chemical plant, even the smallest change
must go through reviews to verify any potential hazards
before restarting the process. Company procedures called
for plant modifications to be checked by the main office
engineers, but they were evidently disregarded. The man-
agement of change (MOC) program is meant to prevent
any unforeseen consequences that may result in disastrous
outcomes.
Insufficient MOC in Bhopal was one of the reasons
why several safety measures at the plant failed to operate
at the time of the incident. The spare tank which was
designed to be empty for emergency situations was not
empty, and other tanks were filled over the recommended
level with MIC. A properly managed MOC program is a
crucial part of safety procedures in running a chemical
plant.
26.5.6.15 Information for Authorities and Public
UCIL failed to provide full information on the substances
on site to the authorities, emergency services, workers,
and members of the public exposed to the hazards.
Budget cuts in the company resulted in insufficient train-
ing for many plant personnel, causing a lack of general
safety awareness. Many workers interviewed said they
had had no information or training about the chemicals.
The training, although done within the lower administra-
tive level, can never be neglected, as it can play a signifi-
cant part in performing safety measures. This is more
crucial where process safety management principles and
measures are insufficiently provided.
26.5.6.16 Planning for Emergencies
The response of the company and the authorities to the
emergency suggests that there were no effective emer-
gency plans, procedures, or actions in place.
Lees’ Process Safety Essentials
Within the works, defects revealed by the emergency
include the hesitation about the use of the siren system
and the lack of escape routes.
The preliminary condition for emergency planning to
protect the public outside the works is provision to the
authorities of full information about the hazards. This was
not done. In consequence, the people exposed did not
know what the siren meant or what action to take, the
hospitals did not know what they might be called on to
handle, and so on.
Likewise, the essential action in an actual emergency
is to inform the authorities what has happened and what
the hazards are. On the morning of the accident, the hos-
pitals were in the dark about the nature and effects of the
toxic chemical whose victims they were trying to treat.
Legislation to frame the outline of chemical emer-
gency responses, covering specification on emergency
planning, emergency release notification, hazardous
chemical storage reporting requirements, and toxic chemi-
cal release inventory, is required at the community level.
26.5.6.17 Hazard Evaluations
The MIC process was running without fully functional
safety systems. The refrigeration system was shut down
and gauges and alarms were not reliable. The vent gas
scrubber was not fully operative and the flare tower and
water curtain system were not designed to prevent any
unexpected release of MIC. If any proper hazard evalua-
tions had been done, the management level would ques-
tion the safety of running the process without the factors
mentioned above.
Hazard evaluations help to identify any inherent haz-
ard or potential critical scenario when running the pro-
cess. It is recommended to evaluate the hazards that may
arise from the product and communicate the results to the
plant workers as well.
26.5.7 The Worldwide Impact of
the Bhopal Incident
The Bhopal incident was a tragedy that attracted
widespread attention to the concept of process safety.
Although process safety had been generally slighted in
the chemical industry, this incident provided the momen-
tum to implement process safety into the industry’s
standard practices.
The US Congress passed the Clean Air Act Amendments
(CAAA) in 1990 after Bhopal and several other domestic
incidents. It included some major provisions toward
the chemical industry and enlisted the Occupational Safety
and Health Administration (OHSA) to enforce the Process
Safety Management of Highly Hazardous Chemicals
(29 CFR 1910.119). The legislation also directed the
Chapter | 26 Case Histories
Environmental Protection Agency (EPA) to establish
the Risk Management Program (40 CFR 68) to target the
safety of personnel and communities in case of an acciden-
tal release.
Despite the complex political and geographical
background, the European Union has tried to set a common
regulatory frame work toward the requirements of the
European Commission and the United Nations Economic
Commission for Europe. Before the Bhopal incident, the
Seveso incident in 1976 initiated the ‘Council Directive
82/501/EEC on the major-accident hazards of certain
industrial actives’ known as ‘Seveso I’ to prevent serious
consequences to the environments and public. After the
Bhopal incident, the regulation was amended and the
Directive 88/610/EEC ‘Seveso II’ related to the Control of
Major Accident Hazards (COMAH) came into effect.
Before the Bhopal incident, Indian regulations lacked
a sufficient system to protect the public from industry
hazards. The Environment Protection Act of 1986 was
established and, along with the Indian Factories Act of
1948, the Air Act was amended to regulate the facilities
dealing with hazardous materials. The Hazardous Waste
Rules of 1989 and the Public Liability Insurance Act of
1991 followed, and the Environment Protection Rules
were amended in 1992.
26.6. PASADENA
Shortly after 1:00 p.m. on October 23, 1989, a release
occurred in a polyethylene plant at the Phillips 66
Company’s chemical complex at Pasadena, near Houston,
Texas. A vapor cloud formed and ignited, giving rise to a
massive vapor cloud explosion. There followed a series
of further explosions and a fire. Twenty-two people on
the site were killed and one later died from injuries, mak-
ing a death toll of 23. The number injured is variously
given as 130 and 300.
A report on the investigation of the accident has been
issued by OSHA (1990). Other accounts include those
of Mahoney (1990), T. Richardson (1991), and Scott
(1992).
26.6.1 The Site and the Plant
The Phillips works was sited in the Houston Chemical
Complex along the Ship Channel, the location of a num-
ber of process companies.
The plant in which the release occurred was Plant
V, one of the two active polyethylene plants in the com-
plex. The plant operated at high pressure (700 psi) and
high temperature. The process involved the polymeriza-
tion of ethylene in isobutane, the catalyst carrier. Particles
of polyethylene settled out and were removed from set-
tling legs.
471
26.6.2 Events Prior to the Explosion
On the previous day work began to clear three of the six
settling legs on Reactor No. 6, which were plugged. The
three legs were prepared by a company operator and were
handed over to the specialist maintenance contractors,
Fish Engineering.
At 8:00 a.m. on Monday, October 23, work began on
the second of the three blocked legs, Leg No. 4. The iso-
lation procedure was to close the DEMCO ball valve and
disconnect the air lines to it.
The maintenance team partially disassembled the leg
and were able to remove part of the plug, but part
remained lodged in the pipe 12 18 in. below the ball
valve. One of the teams was sent to the control room to
seek assistance. Shortly after, at 1:00 p.m., the release
occurred.
Although both industry practice and Phillips corporate
safety procedures require isolation by means of a double
block system or a blind flange, at local plant level a pro-
cedure had been adopted which did not conform to this.
It was subsequently established that the DEMCO ball
valve was open at the time of the release. The air hoses to
the valve had been cross-connected so that the supply
which should have closed it actually opened it. The hose
connectors for the ‘open’ and ‘close’ sides of the valve
were identical, thus allowing this cross-connection to be
made. Although procedures laid down that the air hoses
should not be connected during maintenance, there was
no physical barrier to the making of such a connection.
The ball valve had a lockout system, but it was inade-
quate to prevent the valve being inadvertently or inten-
tionally opened during maintenance.
26.6.3 The Explosion
The mass of gas released was estimated as some
85,200 lb of a mixture of ethylene, isobutane, hexene, and
hydrogen, which escaped within seconds. The release
was observed by five eyewitnesses. A massive vapor
cloud formed and moved rapidly downwind.
Within 90 2 120 s, the vapor cloud found a source of
ignition. Possible ignition sources were a gas-fired cata-
lyst activator with an open flame; welding and cutting
operations; an operating forklift truck; electrical gear in
the control building and the finishing building; 11 vehi-
cles parked near the polyethylene plant office; and a
small diesel crane, although this was not operating.
The TNT equivalent of the explosion was estimated in
the OSHA report as 2.4 tons. An alternative estimate
from seismograph records is 10 tons.
There followed two other major explosions, one when
two 20,000 gallon isobutane storage tanks exploded and
the other when another polyethylene plant reactor failed
472
catastrophically, the timings being some 10 15 min and
some 25 45 min, respectively, after the initial explosion.
One witness reported hearing 10 separate explosions over
a 2 h period.
Debris from the explosion was found 6 miles from
the site.
All 22 of those who died at the scene were within 250 ft
of the point of release and 15 of them were within 150 ft.
Injuries which occurred outside the site were mainly
due to debris from the explosion.
The explosion resulted in the destruction of two
HOPE plants.
26.6.4 The Emergency and the Aftermath
People in the immediate area of the release began running
away as soon as they realized that gas was escaping.
The alarm siren was activated, but the level of noise in
the finishing building was such that there was a question
whether some employees there failed to hear it.
The immediate response to the emergency was pro-
vided by the site fire brigade, which undertook rescue and
care of the injured and began fighting the fire. Twenty-
three people were unaccounted for, but for an extended
period, the area of the explosion remained dangerous to
enter.
Severe difficulties were experienced in fighting the
fires resulting from the explosion. There was no dedicated
fire water system, water for firefighting being drawn from
the process water system. The latter suffered severe rup-
ture in the explosion so that water pressure was too low
for firefighting purposes. Fire hydrants were sheared off
by the blast. Fire water had to be brought by hose from
remote sources such as settling ponds, a cooling tower, a
water treatment plant, and a water main on a neighboring
plant. These difficulties were compounded by failures
of the fire pumps. The electrical cables supplying power to
the regular fire pumps were damaged by the fire so that
these pumps were put out of action. Further, of the three
backup diesel fire pumps, one was down for maintenance
and one quickly ran out of fuel. Despite these problems,
the fire was brought under control within some 10 h.
The handling of the emergency was handicapped by
the facts that the intended command center had been dam-
aged and that telephone communications were disrupted.
Telephone lines were jammed for some hours following
the accident.
The emergency response was coordinated by the site
chief fire officer and involved the local Channel Industries
Mutual Aid (CIMA) organization, a cooperative of some
106 members in the Houston area.
More than 100 people were evacuated from the
administration building across the Houston Ship Channel
by the US Coast Guard and by Houston fireboats; they
Lees’ Process Safety Essentials
would otherwise have had to cross the area of the explo-
sion to reach safety.
The media were quickly aware of the explosion, and
within an hour, there were on-site 150 media personnel
from 40 different organizations.
The financial loss in this accident is comparable with,
and may exceed, that of the Piper Alpha disaster.
Redmond (1990) has quoted a figure of $1400 million,
divided almost equally between property damage and
business interruption losses.
On the basis of a review of company reports and of
the defects found during the investigation of the disaster,
OSHA issued a citation to the company for wilful viola-
tions of the ‘general duty’ clause. The citation covered
the lack of hazard analysis; plant layout and separation
distances; flammable gas detection; ignition sources;
building ventilation intakes; and the fire water system;
the permit system; and isolation for maintenance.
26.6.5 Some Lessons of Pasadena
Some of the lessons to be learned from Pasadena are
described here:
26.6.5.1 Management of Major Hazard
Installations
The OSHA report details numerous defects in the man-
agement of the installation. Some of these are described
below.
26.6.5.2 Hazard Assessment of Major
Hazard Installations
According to the report, the company had made no use of
hazard analysis or an equivalent method to identify and
assess the hazards of the installation.
26.6.5.3 Plant Layout and Separation Distances
The report was critical of the separation distances in the
plant in several respects. It stated that the separation dis-
tances between process equipment plants did not accord
with accepted engineering practice and did not allow time
for personnel to leave the polyethylene plant safely during
the initial vapor release; and that the separation distance
between the control room and the reactors was insuffi-
cient to allow emergency shut-down procedures to be car-
ried out.
26.6.5.4 Location of Control Room
As just mentioned, the control room was too close to the
plant. In addition, the control room was not built up to
Chapter | 26 Case Histories
the expected explosion over protection necessary for their
location. It was destroyed in the initial explosion.
26.6.5.5 Building Ventilation Intakes
The ventilation intakes of buildings close to or downwind
of the hydrocarbon processing plants were not arranged
so as to prevent intake of gas in the event of a release.
26.6.5.6 Minimization of Exposure of Personnel
Closely related to this, there was a failure to minimize the
exposure of personnel. Not only the control room but the
finishing building had relatively high occupancy.
26.6.5.7 Escape and Escape Routes
As already stated, the separation distances were not such
as to allow personnel on the polyethylene plant to escape
safely. Further, the only escape route available to people
in the administration block (other than across the ship
channel) was across the area of the explosion.
26.6.5.8 Gas Detection System
Despite the fact that the plant had a large inventory of
flammable materials held at high pressure and tempera-
ture, there was no fixed flammable gas detection system.
26.6.5.9 Control of Ignition Sources
The control of ignition sources around the plant was
another feature criticized in the OSHA report.
26.6.5.10 Permit-to-Work Systems
The OSHA report stated that an effective permit system
was not enforced for the control of the maintenance activ-
ities either of the company’s employees or of contractors.
26.6.5.11 Isolation Procedures for Maintenance
In this incident, the sole isolation was a ball valve, which
was meant to be closed but was in fact open. There was
no double block system or blind flange.
The practice of not providing positive isolation was a
local one and violated corporate procedures. The implica-
tion is that it had not been brought to light by any safety
audits conducted.
26.6.5.12 Integrity of Fire Water System
The practice of relying for fire water on the process water
system and the failure to provide a dedicated fire water
system meant that the fire water system was vulnerable to
an explosion.
473
26.6.5.13 Dependability of Fire Pumps
The electrical cables to the regular fire pumps were not
laid underground and were therefore vulnerable to damage
by explosion and fire. One of the back-up diesel pumps
had insufficient fuel and one had been taken out for main-
tenance without informing the chief fire officer.
26.6.5.14 Audibility of Emergency Alarm
As described, the level of noise in some areas was such
that the employees might not have been able to hear the
siren.
26.6.5.15 Follow-Up of Audits
The OSHA report criticized the company’s failure to act
upon reports issued previously by the company’s own
safety personnel and by external consultants, which drew
attention to unsafe conditions.
26.6.5.16 Planning for Emergencies
The disaster highlighted a number of features of emer-
gency planning. The company had put a good deal of
effort into planning and creating personal relationships
with the emergency services, by means such as joint exer-
cises, and these paid off. The value of planning, training,
and personal relations was one of the most positive
lessons drawn.
Another area in which a proactive approach proved
beneficial was in relations with the media. Senior person-
nel made themselves available, and the company evidently
felt it received fair treatment.
One weakness of the emergency planning identified
was that it had not envisaged a disaster of the scale which
actually occurred.
The incident brought out the need to be able to respond
clearly to calls from those liable to be affected about the
toxicity of the fumes and smoke generated in such an
event.
The behavior of rescue helicopters posed a problem.
Personnel on the ground had no means of communication
with them and the craft tended to come in low, creating
the danger of blowing flames or toxic fume onto those
below. A need was identified for altitude and distance
guidelines for helicopters.
26.7. CANVEY REPORTS
The most comprehensive hazard assessment of non-
nuclear installations in the United Kingdom is the Canvey
study, carried out for the HSE by SRD.
The first phase of the work is described in Canvey: An
Investigation of Potential Hazards from Operations in the
474
Canvey Island/Thurrock Area (the First Canvey Report)
(HSE, 1978). The report is in two parts: Part 1 is an intro-
duction by the HSE and Part 2 is the SRD study.
The origin of the investigation was a proposal to
withdraw planning permission for the construction of an
additional refinery in the area. Two oil companies,
Occidental Refineries Ltd and United Refineries Ltd, had
been granted planning permission for the construction of
oil refineries. The construction of the Occidental refinery
was begun in 1972, but was halted in 1973 pending a
major design study review. United Refineries had valid
planning consents, but had not started construction. It was
a public inquiry into the possible revocation of the plan-
ning permission for the United Refineries development
which gave rise to the investigation.
Responses to the First Canvey Report centered mainly
on two aspects: the methodology used and the magnitude
of the assessed risks. The HSE commissioned further
work, leading to the Second Canvey Report (HSE, 1981),
in which the methodology used is revised and the
assessed risks are rather lower.
26.7.1 First Canvey Report
The terms of reference of the investigation were:
In the light of the proposal by United Refineries Limited to
construct an additional refinery on Canvey Island, to investigate
and determine the overall risks to health and safety arising from
any possible major interactions between existing or proposed
installations in the area, where significant quantities of danger-
ous substances are manufactured, stored, handled, processed
and transported or used, including the loading and unloading of
such substances to and from vessels moored at jetties; to assess
the risk; and to report to the Commission.
The members of the investigating team were
appointed as inspectors of the HSE under the provisions
of the Health and Safety at Work etc. Act of 1974 and
were given specified powers to enable them to make the
necessary inquiries. The overall approach taken in the
investigation was
1. To identify any potentially hazardous materials, their
location and the quantities stored and in process.
2. To obtain and review the relevant material properties
such as flammability and toxicity.
3. To identify the possible ways in which failure of
plants might present a hazard to the community.
4. To identify possible routes leading to selected failures.
Typically, the factors examined included operator
errors, fatigue or aging of the plant, corrosion, loss of
process control, overfilling, impurities, fire, explosion,
missiles and flooding.
Lees’ Process Safety Essentials
5. To quantify the probability of the selected failures
occurring and their consequences.
The investigation involved the identification of the
principal hazards of the installations and activities in the
area, the assessment of the associated risks to society and
to individuals, and the proposal of modifications intended
to reduce these risks.
Some 30 engineers were engaged in the investigation,
which cost about d400,000.
26.7.2 First Canvey Report: Installations
and Activities
The principal hazardous installations and activities identi-
fied in the investigation are summarized in Table 26.7.
26.7.3 First Canvey Report: Identified
Hazards
The investigation identified several principal hazards in
the area. These are:
1. oil spillage over bund;
2. LNG vapor cloud release (1000 t);
3. LPG vapor cloud release (1000 t);
4. ammonium nitrate explosion (4500 t of 92% solution);
5. ammonia vapor cloud release (1000 t);
6. hydrogen fluoride cloud release (1000 t).
The figures in parentheses indicate standard cases
considered in the study.
A severe fire might occur if there is an escape of
flammable liquids from storage so that large quantities flow
down into the residential area. This hazard is presented by
the large storages of flammable liquids.
A severe vapor cloud fire and/or explosion might
occur if there is a spillage of LNG so that a vapor cloud
forms and ignites. This hazard is presented by the large
LNG terminal and storage at British Gas. The spillage
might occur at sea or on land.
Similarly, a severe vapor cloud fire and/or explosion
might occur if there is a spillage of LPG so that a vapor
cloud forms and ignites.
A severe explosion might occur if there is a rupture of
an ammonium nitrate storage tank.
A severe toxic release might occur if there is a spillage
of ammonia. The spillage might occur at sea or on land.
A severe toxic release might also occur if there is a
rupture of storage or process plant containing hydrogen
fluoride. This hazard is presented by the alkylation facili-
ties at Shell, at the Mobil extension and at the proposed
Occidental refinery.
TABLE 26.7 First Canvey Report: Principal Hazardous Installations and Activities at Canvey

Location Company Installation or Activity Storage Employees Transport In Transport Out

Canvey British Gas LNG terminal Fully refrigerated storage of LNG (atmospheric pressure, 200 Sea Mainly pipeline (as vapor)
Island Corporation , 2162 C) 6 3 4000 t above-ground tanks 2 3 1000 t but some road
above ground tanks 4 3 20,000 t in ground tanks. Fully
refrigerated storage of butane (atmospheric pressure,
,10 C) 1 3 10,000 t tank 2 3 5000 t tanks
Texaco Ltd Petroleum products storage Atmospheric storage of petroleum products .80,000 t 130 Sea Pipeline, road, sea
total capacity
London and Coastal Flammable and toxic Atmospheric storage of liquids .300,000 t total capacity 50 Mainly sea but Pipeline (Texaco oil). Rest
Wharves Ltd liquids storage some road mainly road but some sea
Occidental Oil refinery (proposed) Pressure storage of LPG (atmospheric temperature)
Refineries Ltd 2 3 750 t propane spheres 2 3 400 t butane spheres
United Refineries Ltd Oil refinery (proposed) Pressure storage of LPG (atmospheric temperature)
4 3 200 t propane spheres 3 3 900 t butane spheres.
Process and storage containing hydrogen fluoride
Coryton Mobil Oil Co. Ltd Oil refinery Pressure storage of LPG (atmospheric temperature) 800 LPG produced Pipeline, road, rail, sea
1 3 1000 t 1 14 other vessels, giving 4000 t total capacity on site

Oil refinery (extension) Pressure storage of LPG (atmospheric temperature) LPG produced Pipeline, road, rail, sea
4 3 1000 t LPG spheres. Fully refrigerated storage of LPG on site
(atmospheric pressure) 1 3 5000 t tank. Process and
storage containing hydrogen fluoride
Calor Gas Ltd LPG terminal Pressure storage of LPG (atmospheric temperature) 100 Pipeline (from oil Road (cylinders, bulk
3 3 60 t propane vessels 2 3 60 t butane refineries) tankers)
vessels 1 cylinders, giving 500 t total inventory

Shell Haven Shell Oil U.K. Ltd Oil refinery Pressure storage of LPG (atmospheric temperature) 1900 LPG produced Pipeline, road, rail, sea
1 3 1700 t butane sphere 1 3 other butane spheres, on site
giving 3200; t total butane capacity 4 3 400 t propane
spheres 3 3 135 t LPG horizontal vessels
Fully refrigerated storage of liquid anhydrous ammonia Sea Sea, road, occasionally rail
(atmospheric pressure, 233 C) 1 3 14,000 t tank. Process
and storage containing hydrogen fluoride 2 3 40 t vessels

Stanford-le- Fisons Ltd Ammonium nitrate plant Storage of 92% aqueous ammonium nitrate solution 80 Ammonium nitrate Road
Hope 1 3 5000 t tank 1 3 2000 t tank produced on site

Ammonia storage Semi-refrigerated pressure storage of liquid anhydrous Rail Ammonia used on site
ammonia (pressure above atmospheric, 6 C) 1 3 2000 t
sphere
Canvey/ General Transport of hazardous
Thurrock area materials by river, road,
rail, and pipeline
476
26.7.4 First Canvey Report: Failure
and Event Data
The investigation required the estimation of the
probabilities of various occurrences and of their
consequences.
Some of the sources of information on such probabilities
used in the study were:
1. UK industries, including oil, chemical and other process
industries and transport;
2. government organizations such as those concerned
with fire, road, rail, sea, and air transport;
3. professional institutions, for example, Institution of
Chemical Engineers, Institution of Civil Engineers,
American Institute of Chemical Engineers;
4. international safety conference proceedings, for exam-
ple, loss prevention in the process industries, ammonia
plant safety, and hazardous materials spills;
5. industry-based associations, for example, Chemical
Industries Association, Institute of Petroleum, American
Petroleum Institute, Liquefied Petroleum Gas Industry
Technical Association;
6. international insurance interests, for example, Lloyds,
Det Norsk Veritas, and industrial risk insurers, Fire
Protection Association;
7. overseas government and international agencies,
for example, US Coast Guard, US Department of
Transportation, OECD, and EEC;
8. specialized research laboratories;
9. individual subject specialists known or recommended
to the investigating team.
The degree of uncertainty associated with the probability
estimates is indicated by the following code:
a. assessed statistically from historical data—this method
is analogous to the use of aggregate estimates in
economic forecasting;
b. based on statistics as far as possible but with some
missing figures supplied by judgment;
c. estimated by comparison with previous cases for
which fault tree assessments have been made;
d. ‘dummy’ figures—likely always to be uncertain,
a subjective judgment must be made;
e. not used;
f. fault tree synthesis, an analytically based figure which
can be independently arrived at by others.
26.7.5 First Canvey Report: Hazard Models
and Risk Estimates
The investigation involved the study of a wide range of
hazards and scenarios.
Lees’ Process Safety Essentials
The projects that were initiated as part of the investi-
gation were:
1. consideration of known history of identified storage
tanks and their possibility of failure;
2. probability of particular storage tanks or process vessels
being hit by missiles caused by fires or explosions
on site or adjacent sites, by fragmentation of rotating
machines or pressure vessels, or transport accidents;
3. effects of vapor cloud explosions on people, houses,
engineering structures, etc.;
4. evaporation of LNG from within a containment area
on land or from a spill on water;
5. special problems of frozen earth storage tanks for
LNG and the effect of flooding;
6. study of possible failures in handling operations;
7. consideration of the possible benefits and practicality
of evacuation;
8. civil engineering aspects of the sea-wall—the chance of
it being breached by subsidence, explosion or impact
of ships, consideration of the timing of improved
defenses, consideration of the time for floods to rise;
9. statistics of ship collisions and their severity, ground-
ings, etc., applying extensive world experience to the
Canvey Island area;
10. reliability and analysis of fluid handling practices,
ship to shore, and store to road vehicles and pipelines;
11. toxicology of identified hazardous substances;
12. studies to determine the lethal ranges for various
releases of toxic or explosive materials leading to a
number of special studies such as
a. the behavior of ammonia spilt on water or land, and
b. an assessment of the relative importance of explo-
sion or conflagration from a cloud of methane or
liquefied petroleum gas.
The subjects that are considered in appendices to the
report are:
1. a review of current information on the causes and
effects of explosions of unconfined vapor clouds
(F. Briscoe);
2. fires in bunds—calculations of plume rise and position
of downwind concentration maximum (R. Griffiths);
3. a quantitative study of factors tending to reduce the
hazards from airborne toxic clouds (Q.R. Beattie);
4. the dispersal of ammonia vapor in the atmosphere with
particular reference to the dependence on the conditions
of emission (F. Abbey, R.F. Griffiths, S.R. Haddock,
G.D. Kaiser, R.J. Williams, and B.C. Walker);
5. statistics on fires and explosions at refineries
(Q.H. Bowen);
6. missiles—penetration capability (E.A. White);
7. discussion of data base for pressure vessel failure
rate (T.A. Smith);
Chapter | 26 Case Histories
8. risk of aircraft impacts on industrial installations in
the vicinity of Canvey Island (L.S. Fryer);
9. the dispersion of gases that are denser than air, with
LNG vapor as a particular example (G.D. Kaiser);
10. not used;
11. the risk of a liquefied gas spill to the estuary (D.F.
Norsworthy);
12. the toxic and airborne dispersal characteristics of
hydrogen fluoride (Q.R. Beattie, F. Abbey, S.R.
Haddock, G.D. Kaiser);
13. transient variation of the wall temperature of an LNG
above-ground storage tank during exposure to an
LNG fire in an adjacent bund (I.R. Fothergill);
14. the escape of 1000 t of anhydrous ammonia from
a pressurized storage tank (L.S. Fryer, G.D. Kaiser,
and B.C. Walker);
15. graphical calculation of toxic ranges for a release of
1000 t of ammonia vapor (J.H. Bowen);
16. effect of unbunded spill of hydrocarbon liquid from
refinery at Canvey Island (A.N. Kinkead);
17. estimated risk of missile damage causing a vapor
cloud release from existing and proposed LPG stor-
age vessels at the Mobil refinery, Coryton (D.F.
Norsworthy);
18. risks of accidents involving road tankers carrying
hazardous materials (L.S. Fryer);
19. toxicology of lead additives (S.R. Haddock);
20. compatibility of materials stored at London and
Coastal Wharves Ltd (S.R. Haddock);
21. blast loading on a spherical storage vessel (Q. Wall);
22. statistical comment on data on distribution of cracks
found on inspection of steel vessel (Q.C. Moore);
23. calculation of resistance of ship hull to collision
(A.N. Kinkead);
24. reduction of apparent risk by shared experience
(Q.H. Bowen).
The treatment of some of the topics which is given in
the report is now described as follows:
1. failure of pressure vessels;
2. failure of pressure piping;
3. failure of pipelines;
4. generation of and rupture by missiles;
5. crash of and rupture by aircraft;
6. ship collision and other accidents;
7. flow of a large release of oil;
8. temperature of the wall of an LNG tank exposed to
an LNG fire in an adjacent bund;
9. evaporation of LNG and ammonia on water;
10. dispersion of an LNG vapor cloud;
11. unconfined vapor cloud fire and explosion;
12. ammonium nitrate explosion;
13. toxicity of chlorine, ammonia, hydrogen fluoride,
and lead additives;
477
14. dispersion of ammonia and hydrogen fluoride vapor
clouds;
15. factors mitigating casualties from a toxic release;
16. road tanker hazards;
17. evacuation.
For a more complete discussion of the methods and
of the background to and application, please consult the
report.
26.7.6 First Canvey Report: Assessed
Risks and Actions
The hazards described in Section 26.7.3 were assessed
using appropriate failure and event data as described in
Section 26.7.4. Hazard models and risk estimates to be
used are listed in Section 26.7.5.
The results of the risk assessments are presented by
the investigators as risks of causing casualties, that is,
severe hospitalized casualties or worse. This is in accor-
dance with established practice (e.g., Department of
Defense, n.d.; Glasstone, 1964). It was considered mis-
leading to attempt to distinguish between severe injury
and death.
These results have several interesting features. The
hazards may be ranked for societal risks in order of des-
cending frequency for accidents of different magnitude.
The hazard arising from the very large quantities of
LNG stored is a serious one, but is no worse than that
from the considerably smaller quantities of LPG.
The obvious hazards of LNG, LPG, and ammonia are
equaled by others, such as oil and hydrogen fluoride,
which are perhaps less well appreciated.
The relative importance of the hazards changes with
the scale of the accident. For the smaller scale accidents,
oil spillage, flammable vapor clouds, and toxic gas clouds
are all important. As the scale increases, it is the toxic gas
clouds that dominate.
There are a number of interactions identified both
within sites and between sites. These include the threat to
LPG storage at Mobil from the Calor Gas site, to the oil
storage at Texaco from explosives barges, to the ammonia
sphere at Fisons from rotating machinery, and from the
ammonium nitrate plant at Fisons, to various installations
from process and jetty explosions, and possibly to the
ammonia storage tank at Shell from explosion in the
Shell refinery.
The relative hazard of the pressure storage of anhy-
drous ammonia at Fisons is much greater than that of the
refrigerated storage of the same chemical at Shell. The
risk for the latter was assessed as negligible with the
possible exception of rupture by an explosion.
The assessed societal risks are shown in Figure 26.4.
Figure 26.4(a) gives the societal risks for all the existing
478 Lees’ Process Safety Essentials

32 FIGURE 26.4 First Canvey Report:

30 societal risks for existing installations
Probability of exceeding scale of accident indicated

and proposed developments (Health

28 Existing and Safety Executive, 1978). (a) All
26 Existing, after existing installations. (b) All proposed
24 improvements suggested developments. Source: Courtesy of
22 HM Stationery Office.
(chances in 10 000/y)

20
18
16
14
12
10
8
6
4
2
0
10 1000 5000 10 000 15 000 18 000
Scale of accident (no. of casualties)
(a)
Probability of exceeding scale of accident

20
indicated (chances in 10 000/y)

18 Proposed developments
16 Proposed developments,
after improvements suggested
14
12
10
8
6
4
2
0
10 1000 5000 10 000 15 000 18 000
Scale of accident (no. of casualties)
(b)

installations. It shows that the risk of an accident causing 2. LNG tank flooding—construction of a dike;
more than 10 casualties is 31 3 10 4/year. Figure 26.4(b) 3. spontaneous failure of LPG spheres—high standard
gives the societal risks for all the proposed developments. of inspection;
It shows that the risk of an accident causing more than 10 4. LPG vessel rupture by missile (Mobil)—measures
casualties is 16 3 10 4/year. including fitting of pressure relief valves on cylinders
The assessed individual risks are given for all the at Calor Gas depot;
existing installations as given in Table 26.8. 5. LPG tank failure at BG jetty—improvement of bund;
The investigators made a number of recommendations 6. LPG pipeline failure (BG)—removal of pipeline;
for the reduction of the hazards. These included 7. spontaneous failure of ammonia sphere—high stan-
dard of inspection, control of ammonia purity;
1. oil spillage—construction of a simple containing 8. ammonia release at Shell jetty—provision of water
wall around the London and Coastal Wharves and sprays at jetty;
Texaco sites and the proposed Occidental and UR 9. HF plant rupture (Mobil, Occidental)—provision of
refinery sites; water sprays;
Chapter | 26 Case Histories 479

TABLE 26.8 First Canvey Report: Rank Order of Societal Risks for Some Principal Hazards of Existing and Proposed
Installations at Canvey
Frequencies in Units of 10 6/year

.10 Casualties .4500 Casualties .18,000 Casualties

1 Oil spillage 1366 1 Ammonia vapor cloud 258 1 HF vapor cloud 100
2 LPG vapor cloud (BG) 970 2 HF vapor cloud 246 2 Ammonia vapor cloud 73
3 Ammonia vapor cloud 735 3 Oil spillage 150 3 LNG vapor cloud 7
4 LPG vapor cloud (others) 637 4 LPG vapor cloud (other) 96
5 LNG vapor cloud 497 55 LNG vapor cloud 80
6 HF vapor cloud 464 55 LPG vapor cloud (BG) 80

7 AN explosion 85 7 AN explosion 17

Source: After Health and Safety Executive, (1978).

TABLE 26.9 First Canvey Report: Rank Order of Societal Risks for Some Principal Hazards of Existing and Proposed
Installations at Canvey, After Improvements Suggested
Frequencies in Units of 10 6/year

. 10 Casualties .4500 Casualties .18,000 Casualties

1 LPG vapor cloud (other) 421 1 Ammonia vapor cloud 71 1 HF vapor cloud 24
2 LNG vapor cloud 396 2 HF vapor cloud 67 2 Ammonia vapor cloud 18
3 Ammonia vapor cloud 240 3 LNG vapor cloud 66 3 LNG vapor cloud 7

4 HF vapor cloud 115 4 LPG vapor cloud (other) 63

5 AN explosion 8 5 AN explosion 2

Source: After Health and Safety Executive (1978).

10. ship collision—strict enforcement of the speed as given in Table 26.9. Oil spillage and LPG vapor cloud
restriction of 8 knots; (BG) are eliminated.
11. road tanker hazards—road tanker traffic restriction to
new road only (if road built).
26.7.7 Second Canvey Report
The assessed effect of the proposed modifications is to
In 1981, the Second Canvey Report was issued, entitled
eliminate the hazards from oil spillage, from LPG vapor
Canvey: A Review of Potential Hazards from Operations in
cloud due to explosion at the jetty and pipeline failure
the Canvey Island/Thurrock Area Three Years after
at British Gas, and from vessel rupture at Mobil due to
Publication of the Canvey Report (HSE, 1981). The report
missiles from Calor Gas, and to reduce greatly many of
was again in two parts: Part 1, an introduction by the HSE
the other hazards.
and Part 2, the SRD study. In the next two sections,
The rank order for societal risk of the hazards assum- accounts are given of the reassessed risks and actions and
ing that the proposed modifications are carried out is then of some technical aspects of the second report.
480
26.7.8 Second Canvey Report: Reassessed
Risks and Actions
The risks assessed in the Second Canvey Report are
generally less than those in the first report. Thus, for
example, at Stanford-le-Hope the individual fatality risk
is given as 0.6 3 10 4/year, as opposed to 5 3 10 4/year
in the first report, a reduction by a factor of 8.
The HSE in Part 1 adduce the following reasons for
this: (1) physical improvements already carried out; (2)
changes in operation; (3) detailed studies by companies;
(4) changes in assessment techniques; (5) correction of
errors; and (6) further changes firmly agreed but yet to be
made.
One major change in operation was the cessation of
ammonia storage at Shell.
In a number of cases in the first report, estimates of the
risks had to be made without benefit of detailed studies.
Subsequent studies by the companies involved showed that
in some cases the risks had been overestimated. A case in
point was the limited ammonia spill at Fisons.
In a large proportion of cases, the effect of the use of
improved models for heavy gas dispersion was to reduce
the travel distance of the cloud and hence the risks.
The HSE describes a number of further actions taken
or pending to reduce the risks.
26.7.9 Second Canvey Report: Technical
Aspects
The Second Canvey Report revisits some of the frequency
estimates and gives a revised set of hazard models and
injury relations, covering the following aspects: (1) emis-
sion; (2) gas dispersion; (3) ignition; (4) fire events; (5)
vapor cloud explosions; and (6) toxic release. With these
improvements, the second report may give more reason-
able assessment.
Another comprehensive hazard assessment is the
Rijnmond study carried out for the Rijnmond Public
Authority by Cremer and Warner.
This work is described in Risk Analysis of Six
Potentially Hazardous Industrial Objects in the Rijnmond
Area, a Pilot Study issued by the Rijnmond Public
Authority (1982) (the Rijnmond Report).
The Rijnmond is the part of the Rhine delta between
Rotterdam and the North Sea. Within the Rijnmond area
of 15 3 40 km2, about one million people are located,
as well as a vast complex of oil, petrochemical, and
chemical industries and the largest harbor in the world.
A description of the industrial complex at Rijnmond has
been given by Molle and Wever (1984). There are five
oil refineries with a refining capacity of some 81 Mt/year,
including the large refineries of Shell at Pernis and BP
Lees’ Process Safety Essentials
near Rozenburg, and major petrochemicals complexes
operated by Shell, Gulf, and Esso.
26.8. RIJNMOND REPORT
26.8.1 The Investigation
The aim of the work was to evaluate the methods of
risk assessment for industrial installations and to obtain
experience in the practical application of these methods.
Such evaluation was considered to be essential before any
decision could be made on the role of such methods in
the formulation of safety policy.
The COVO steering committee was reinforced with
experts from industry. The overall approach taken in the
investigation was:
1. to collect basic data and define the boundary limits of
the installation;
2. to identify the potential failure scenarios;
3. to select and apply the best available calculation models
for physical phenomena;
4. to collect and apply the best available basic data and
models to calculate the probabilities of such events;
5. to choose and develop different forms of presentation
of the final results;
6. to investigate the sensitivity of the results for variations
in the assumptions used and to estimate the accuracy
and reliability of these results;
7. to investigate the influence of risk reducing measures.
26.8.2 Installations and Activities
The six installations studied were Acrylonitrile storage
(Paktank); Ammonia storage (UKF); Chlorine storage
(AKZO); LNG storage (Gasunie); Propylene storage
(Oxirane); Hydrodesulfurizer (Shell).
26.8.3 Event Data
The event data used in the study were a mixture of
generic data, plant data, and estimates.
26.8.4 Hazard Models
The principal hazard models used are given in Table 26.10.
26.8.5 Population Characteristics
The study covered the risks both to employees and to the
public. For the off-site population, a grid was used show-
ing the number of people over an area of some 75 km2,
which covered the whole of the Rijnmond. Populations
were estimated for each 500 m2 square using data from
the 1971 census, updated in 1975.
Chapter | 26 Case Histories 481

TABLE 26.10 Rijnmond Report: Some Hazard Models Used

Event Model

A Emission
Flow from
A. Vessel containing liquid at atmospheric pressure
B. Vessel containing liquid above atmospheric boiling point
C. Vessel containing gas only
Two-phase flow Fauske Cude (Fauske, 1964; Cude, 1975)
B Vaporization
Spreading of liquid spill Shaw and Briscoe (1978 SRD R100)
Vaporization of cryogenic liquid
On water Shaw and Briscoe (1978 SRD R100)
On land Shaw and Briscoe (1978 SRD R100); AGA (1974)
Combined spreading and vaporization of cryogenic liquid on land
Vaporization from spill into complex bunds
Evaporation of volatile liquid Pasquill (1943), Opschoor (1978)
C Gas dispersion
Neutral density gas dispersion Pasquill Gifford
Dense gas dispersion R.A. Cox and Roe (1977)
Dispersion of jet of dense gas Ooms, Mahieu and Zelis (1974)
D Vapor cloud combustion
Initial dilution with air
Continuous release Ooms et al. (1974)
Instantaneous release Empirical relation
Ignition sources
Fire versus explosion
E Vapor cloud explosion

Vapor cloud explosion TNO (Wiekema, 1980)

F Pool fire
Flame emissivity
Liquid burning rate Burgess et al. (1961)
Flame length P.H. Thomas (1963)
Flame tilt P.H. Thomas (1965b)
Fraction of heat radiated
View factor Rein, Sliepcevich and Welker (1970)
G Jet flame
Flame length API (1969 RP 521)
Deflection effect API (1969 RP 521)
Buoyancy and liquid effects MITI (1976)
View factor Rein et al. (1970)

H Fireball
Fireball dimensions
Radius R.W. High (1968)
Duration R.W. High (1968)
View factor McGuire (1953)
482
Outside the population grid, average population densi-
ties were used. These were required only in cases where an
exceptionally large cloud occurred.
For the particular installations studied, data was
obtained on the numbers of employees present during day
and night and on their locations.
For toxic gas hazard, it was assumed that 1% of the
population is outdoors. This estimate includes an allowance
for people taking shelter. For explosion hazard, it was
assumed that 10% are outdoors.
26.8.6 Mitigation of Exposure
The principal mitigations of exposure considered were
evacuation and shelter. For evacuation, the estimate of
the proportion evacuated is taken as a function of the
warning time. In some cases, the proportion is estimated
as 90 100%.
For the effect of shelter from toxic gas, the single-
exponential stage model of ventilation is used.
26.8.7 Individual Assessments
The individual assessments included:
G Acrylonitrile storage (Paktank): The acrylonitrile
(AN) storage is one of a number of storages at the
Botlek terminal of Paktank, a tank storage company
providing bulk storage and associated services to the
oil and chemical industries.
G Ammonia storage (UKF): The ammonia storage is
part of a complex of plants producing ammonia, nitric
acid, ammonium nitrate, urea, and other fertilizers at
the Pernis site of UKF.
G Chlorine storage (AKZO): The chlorine storage
consists of five spheres associated with chlorine cell
rooms at the Botlek site of AKZO.
G LNG storage (Gasunie): The LNG storage consists of
two tanks and associated equipment at the peak shaving
plant of Gasunie.
G Propylene storage (Oxirane): The propylene storage is
associated with the propylene oxide plant of Oxirane at
Seinehaven. There are two spheres, each with a capacity
of 600 te. The ambient temperature was taken in the
study as 15 C, that corresponds to a gauge pressure of
8 bar.
G Hydrodesulfurizer (Shell): The section of the hydrode-
sulfurizer studied is the diethanolamine (DEA) regen-
erator. The latter is part of an absorber regenerator
unit which removes hydrogen sulfide from sour gas.
The hydrogen sulfide is absorbed into DEA in the
absorber and the fat DEA passes to the regenerator
where a reversible reaction occurs releasing the hydro-
gen sulfide again.
Lees’ Process Safety Essentials
26.8.8 Assessed Risks
The results of the assessment include risk contours, risk
to employees, risk to public (individual risk, societal risk,
FN tables, FN curves), and average annual fatalities.
26.8.9 Remedial Measures
For each installation, recommendations were made for
remedial measures to reduce the risks. In accordance with
the remit of the study, the proposals made were illustra-
tive rather than exhaustive and are suggestions for further
evaluation.
For the AN storage, the main measure proposed is
nitrogen blanketing to prevent internal explosion.
For the ammonia storage, the principal measure
suggested is the provision of a bund. Another proposal
made is the provision of an emergency air supply at the
control room to allow the operators time to close emer-
gency isolation valves.
For the chlorine storage, the main recommendations
are directed to reduction of the size of escapes from
pipework by the use of excess flow valves.
For the LNG storage, the main measure proposed is
directed toward the prevention of escalation due to the
brittle fracture of carbon steel from a small release of
cold liquefied gas.
For the propylene storage, the installation of remote
isolation valves is the principal measure proposed. It was
estimated that this would reduce the total risk by half.
Proposals are also made for modifications to the vapor
return system.
For the hydrodesulfurizer the measures proposed are
minor. It is suggested that there should be monitoring
of hydrogen sulfide in the control room and that the
hazard of spread of DEA through the drain system be
investigated.
26.8.10 Critiques
Rijnmond Report itself contains its own critique in the
form of a review by outside consultants and industrial
comment. Much of this relates to the failure and event
data, the hazard models, and the injury relations and
particularly to the models.
26.9. SAN CARLOS DE LA RAPITA
DISASTER
At about 14:30 in the afternoon of July 11, 1978, a road
tanker carrying propylene caught on fire, eventually
leading to a BLEVE. The incident occurred just in front
of Los Alfaques camp site, The Sand Dunes, located in
the municipality of Alcanar (Tarragona, Spain) between
Chapter | 26 Case Histories
Barcelona and Valencia, only 3 km from the village of San
Carlos de la Rapita. As a result, 217 people lost their lives
and approximately 600 were injured (Manich, 2008).
26.9.1 The Camp Site
The camp site was a triangular shaped piece of land
between the coastal road and the sea, some 3 km from the
nearest township, San Carlos de la Rapita, to the north.
It was 200 m in length and 10,000 m2 in area, tapering
from about 100 m wide at the north to 30 m at the south
end and 60 m wide at the point of the accident. There was
a brick wall on a concrete foundation between the road
and the camp.
The legal capacity of the camp site was 260 people;
however, on the day of the accident, the camp site was
fully booked with some 800 people staying on the origi-
nal grounds as well as on the two new undeclared
extensions.
26.9.2 The Road Tanker
The road tanker was manufactured in 1973, designed with
a maximum capacity of 45 m3, and a maximum allowed
mass at 8 bars and 4 C of 19.35 tons. It had no pressure
relief valve and no pressure test certificate.
At 12:05 the tanker took on a load of propylene at the
ENPETROL Tarragona refinery. At the moment when
the vehicle left the refinery (12:35), it was plated as
suitable for a maximum load of 22 tons, and it was
actually weighed out at 23.5 tons. The driver had a
recommended route, which was the motorway, and was
provided with the toll money, but actually took the N340
coast road which went past the Los Alfaques camp.
26.9.3 The Fire and Explosion
The sequence of events at the camp site is not entirely
clear, but several eyewitness accounts are available.
Marshall (1987) quotes the following. A young man serv-
ing a customer in the camp shop off the main site heard
a bang. He got into his car to investigate and 2 min
after the first sound heard a severe explosion. A ‘fireball’
appeared on the site. A tourist in the camp restaurant
heard a ‘pop’ from a tanker on the main road and saw a
milky cloud drifting toward him. He ran to move his car
and seconds later the cloud ignited.
It is reported that until the main ‘fireball’ event, peo-
ple stood around watching the ball of smoke from the
fire. When it did occur, large numbers of people, many
scantily clad, were burned, some running into the sea to
escape or douse the flames.
Over 90% of the camp site was gutted by fire.
483
The tanker vehicle was torn into four main pieces.
Some two-thirds of the tank, landed on the ground about
150 m, about 300 m from the starting point. The middle
section traveled about 100 m to the north-east, into the
camp. The cab unit traveled some 60 m along the line of
the road to the south. The front end cap fetched up about
100 m beyond the cab.
26.9.4 The Emergency and the Aftermath
For about half an hour after the fire, there were some
200 300 people milling around the camp, many seriously
burned and calling for help. Private cars and taxis began
to ferry the injured to a hospital at Amposta 13 km away.
The first ambulance came at 14v45 from the Shell oil
drilling site at San Carlos. The municipal ambulances
came at 15:05 and the fire brigade at about 15:30.
The road was still blocked by the burning cab; victims
had to be rescued from both sides of the camp and taken
north to Barcelona or south to Valencia as circumstances
permitted. Those taken north to Barcelona received
primary medical care at points en route, while those taken
south to Valencia, 165 km away, did not.
Over 100 people died outright. Others died later from
burns. Out of 148 cases, 122 had third degree burns on
50% or more of the body. Either there were fewer people
only slightly burned or they received treatment elsewhere
(Arturson, 1981).
26.9.5 Lessons of San Carlos De La
Rapita Disaster
The most important lessons of Los Alfaques Disaster are:
1. Education on equipment, procedures, supervision, and
training to prevent overfilling of vehicles carrying
hazardous materials.
2. Provision for pressure relief on vehicles carrying
flammable materials.
3. Routing of vehicles carrying hazardous materials away
from populated areas and vulnerable targets.
4. Prompt treatment of burn victims.
26.10. PIPER ALPHA
At 10:00 p.m. on July 6, 1988 an explosion occurred in the
gas compression module of the Piper Alpha oil production
platform in the North Sea. A large pool fire took hold in
the adjacent oil separation module, and a massive plume
of black smoke enveloped the platform at and above the
production deck, including the accommodation. The pool
fire extended to the deck below, where after 20 min it
burned through a gas riser from the pipeline connection
between the Piper and Tartan platforms. The gas from
the riser burned as a huge jet flame. The lifeboats were
484
inaccessible due to the smoke. Some 62 men escaped,
mainly by climbing down knotted ropes or by jumping
from a height, but 167 died, the majority in the quarters.
The Piper Alpha Inquiry has been of crucial impor-
tance in the development of the offshore safety regime in
the UK sector of the North Sea.
26.10.1 The Company
The Piper Alpha oil platform was owned by a consortium
consisting of Occidental Petroleum (Caledonia) Ltd,
Texaco Britain Ltd, International Thomson plc, and Texas
Petroleum Ltd and was operated by Occidental.
26.10.2 The Field and the Platform
The Piper Alpha platform was located in the Piper field
some 110 miles north-east of Aberdeen. The Piper plat-
form separated the fluid produced by the wells into oil,
gas, and condensate. The oil was pumped by pipeline to
the Flotta oil terminal in the Orkneys, the condensate
being injected back into the oil for transport to shore. The
gas was transmitted by pipeline to the manifold compres-
sion platform MCP-01, where it joined the major gas
pipeline from the Frigg Field to St Fergus.
There were two other platforms connected to Piper
Alpha. Oil from the Claymore platform, also operated by
Occidental, was piped to join the Piper oil line at the
‘Claymore T.’ Claymore was short of gas and was there-
fore connected to Piper Alpha by a gas pipeline so that it
could import Piper gas. Oil from Tartan was piped to
Claymore and then to Flotta and gas from Tartan was
piped to Piper and thence to MCP-01.
The production deck level consisted of four modules,
Modules A D. Module A was the wellhead, Module B
the oil separation module, Module C the gas compression
module, and Module D the power generation and utilities
module.
Module A was about 150 ft long east to west, 50 ft
wide north to south, and 24 ft high. The other modules
were of approximately similar size. There were firewalls
between Modules A and B, between Modules B and C,
and between Modules C and D (the A/B, B/C and C/D
firewalls, respectively); these firewalls were not designed
to resist blasts.
The pig traps for the three gas risers from Tartan and
to MCP-01 and Claymore were on the 68 ft level. Also
on this level were the dive complex and the JT flash
drum, the condensate suction vessel and the condensate
injection pumps.
There were four accommodation modules: the East
Replacement Quarters (ERQ), the main quarters module;
the Additional Accommodation East (AAE); the Living
Lees’ Process Safety Essentials
Quarters West (LQW); and the Additional Accommodation
West (AAW).
The control room was in a mezzanine level in the
upper part of D Module. It was located about one quarter
of the way along the C/D firewall from the west face.
There were two flares on the south end of the plat-
form, the east and west flares, and there was a heat shield
around Module A to provide protection against the heat
from the flares.
The main production areas were equipped with a fire
and gas detection system. In C Module the gas detection
system was divided into five zones: Cl and C2 in the west
and east halves of the module and C3, C4, and C5 at the
three compressors, respectively.
The fire water deluge system consisted of ring mains
which delivered foam to Modules A C and part of
Module D and at the Tartan and MCP-01 pig traps and
water at the condensate injection pumps. The fire pumps
were supplied from the main electrical supply, but there
were backup diesel-driven pumps.
26.10.3 Events Prior to the Explosion
On July 6, there was a major work program on the platform.
This included the installation of a new riser for the Chanter
field and work on a prover and metering loop.
The GCM was also out of service for changeout of the
molecular sieve driers. In consequence, the plant opera-
tion had reverted to the phase 1 mode so that the gas was
relatively wet.
The resulting increased potential for hydrate formation
was recognized by management onshore. The increased
methanol injection rates required were calculated, the
methanol injection rates needed were some 12 times
greater than for normal phase 2 operation.
There was an interruption of the methanol supply to
the most critical point, at the JT valve, between 4:00 and
8:00 p.m. that evening.
The operating condensate injection pump was pump
B. Pump A was down for maintenance. There were three
maintenance jobs to be done on this pump: (1) a full
24 month preventive maintenance (PM), (2) repair of
the pump coupling, and (3) recertification of PSV 504.
In order to carry out the 24 month PM, the pump had
been isolated by closing the gas operated valves (GOVs)
on the suction and delivery lines but slip plates had not
been inserted.
With the pump in this state, with the GOVs closed but
without slip plate isolation, access was given to remove
PSV 504 for testing. It was taken off in the morning of
July 6. They were not able to restore the PSV that evening.
The supervisor in this team came back to the control
room sometime before 6:00 p.m. to suspend the permit-to-
work (PTW).
Chapter | 26 Case Histories
At about 4:50 p.m. that day, just at shift changeover,
the maintenance status of the pump underwent a change.
The maintenance superintendent decided that the 24
month PM would not be carried out and that work on the
pump should be restricted to the repair of the pump
coupling.
About 9:50 p.m. that evening pump B tripped out
on the 68 ft level. The lead production operator and
the phase 1 operator attempted to restart it but without
success. The loss of this pump meant that with pump A
also down, condensate would back up in the JT flash
drum and within some 30 min would force a shut-down
of the gas plant.
The lead operator came up to the control room. It was
agreed to attempt to start pump A. The lead maintenance
hand came down to the control room to organize the elec-
tricians to deisolate the pump. They were observed at the
pumps by the phase 2 operator and an instrument fitter,
but the evidence of these witnesses was inconclusive.
There was no doubt that the lead operator intended to
start pump A.
About 9:55 p.m., the signals for the tripping of two of
the centrifugal compressors in Module C came up in the
control room. This was followed by a low gas alarm
in zone C3 on centrifugal compressor C. Then, the third
centrifugal compressor tripped. Before the control room
operator could take any action a further group of alarms
came up: three low gas alarms in zones C2, C4, and C5
and a high gas alarm. The operator had his hand out to
cancel the alarms when he was blown across the room by
the explosion.
Just prior to the explosion, personnel in workshops in
Module D heard a loud screeching sound which lasted for
about 30 s.
26.10.4 The Explosion, the Escalation,
and the Rescue
The initial explosion occurred at 10:00 p.m. It destroyed
most of the B/C and C/D firewalls and blew across the
room the two occupants of the control room, the control
room operator, and the lead maintenance hand.
The explosion was followed almost immediately by a
large fireball which issued from the west side of Module
B and a large oil pool fire at the west end of that module.
The large oil pool fire gave rise to a massive smoke
plume which enveloped the platform from the production
deck at the 84 ft level up.
The offshore installation manager made his way to the
radio room and had a Mayday signal sent.
The Tharos effectively took on the role of On-Scene
Commander. Rescue helicopters and a Nimrod aircraft for
aerial on-scene command were dispatched.
485
Most of the personnel on the platform were in the
accommodation, the majority in the ERQ. Within the first
minute, flames also appeared on the north face of the
module and the module was enveloped in the smoke
plume coming from the south. The escape routes from
were impassable.
At the 68 ft level, divers were working with one man
under water. They followed procedure, got the man up
and briefly through the decompression chamber. They
were unable to reach the lifeboats, which were inaccessi-
ble due to the smoke. They therefore launched life rafts
and climbed down by knotted rope to the lowest level,
the 20 ft level.
The drill crew also followed procedure and secured
the wellhead.
The oil pool in Module B began to spill over onto the
68 ft level where another fire took hold. There were
drums of rigwash stored on that level which may have
fed the fire.
The fire water drench system did not operate. There
was only a trickle of water from the sprinkler heads.
The explosion disabled the main communications sys-
tem which was centered on Piper. The other platforms
were unable to communicate with Piper. They became
aware that there was a fire on Piper, but did not appreci-
ate its scale. They continued for some time in production
and pumping oil.
Some 20 min after the initial explosion, the fire on the
68 ft level led to the rupture of the Tartan riser on the
side outboard of the ESV. This resulted in a massive jet
flame.
The emergency procedure was for personnel to report
to their lifeboat, but in practice, most evacuations would
be by helicopter and personnel would be directed from
the lifeboats to the dining area on the upper deck of the
ERQ and then to the helideck. Personnel in the ERQ
found the escape routes to the lifeboats blocked and
waited in the dining area. The OIM told them that a
Mayday signal had been sent and that he expected heli-
copters to be sent to effect the evacuation. In fact, the
helideck was already inaccessible to helicopters.
Some 33 min into the incident, the Tharos picked up
the signal. ‘People majority in galley. Tharos come.
Gangway. Hoses. Getting bad.’
No escape from the ERQ to the sea was organized by
the senior management. However, as the quarters began
to fill with smoke, people filtered out by various routes
and tried to make their escape.
Some men climbed down knotted ropes to the sea.
Others jumped from various levels, including the helideck
at 174 ft.
The vessels around the platform launched their fast
rescue craft (FRCs). The first man rescued, by the FRC
of the Silver Pit, was the oil laboratory chemist, who, on
486
experiencing the explosion, simply walked down to the
20 ft level. Most survivors, however, were rescued from
the sea.
The FRC of another vessel, the Sandhaven, was
destroyed with only one survivor.
At about 10:50 p.m. the MCP-01 riser ruptured, and
about 11:18 p.m. the Claymore riser ruptured. The pipe
deck collapsed and the ERQ tipped. By 12:15 a.m. on
July 7, the north end of the platform had disappeared. By
the morning only Module A, the wellhead, remained
standing.
26.10.5 Some Lessons of Piper Alpha
A list of some of the lessons is given in Table 26.11.
26.10.6 Recommendations on the Offshore
Safety Regime
The Piper Alpha Report makes recommendations for
fundamental changes in the offshore safety regime.
The basis of the recommendations is that the respon-
sibility for safety should lie with the operator of the
installation and that nothing in the regime should detract
from this.
A central feature of the regime proposed is the safety
case for the installation. In the offshore safety case, it is
required that the operator should demonstrate that the
installation has a TSR in which the personnel on the
TABLE 26.11 Some Lessons of Piper Alpha
Regulatory control of offshore installations Safety Management
System
Documentation of plant
Fallback states in plant operation
Permit-to-work systems
Isolation of plant for maintenance
Training of contractors personnel
Disabling of protective equipment by explosion itself
Offshore installations: control of pressure systems for
hydrocarbons at high pressure, limitation of inventory on
installation, emergency shut-down system, fire and explosion
protection, temporary safe refuge, formal safety, use of wind
tunnel test and explosion simulations in design
The explosion and fire phenomena: explosions in
semi-confined modules, pool fires and jet flames
Publication of reports of accident investigations
Lees’ Process Safety Essentials
installation may shelter while the emergency is brought
under control and evacuation organized.
Further, it is recommended that this demonstration
should be by QRA.
The recommendation on the safety case includes a
requirement that the operator should demonstrate that it
has a safety management system (SMS).
The report considers that the then current regulatory
body, the DoEn, is unsuitable as the body to be charged
with implementing the new regime and recommends the
transfer of responsibility for offshore safety to the HSE.
These recommendations were accepted immediately
by the government and the new regime under the HSE
began in April 1991.
26.11. THREE MILE ISLAND
At 4:00 on March 28, 1979, a transient occurred on Reactor
No. 2 at Three Mile Island, near Harrisburg, Pennsylvania.
A turbine tripped and caused a plant upset. The operators
tried to restore conditions, but misinterpreting the instru-
ment signals, misjudged the situation, and took actions
which resulted in the loss of much of the water in the
reactor and the partial uncovering of the core. Radioactivity
escaped into the containment building. Site and general
emergencies were declared.
The accident at Three Mile Island (TMI) (also referred
to initially as Harrisburg) was the most serious accident
which had occurred in the US nuclear industry.
26.11.1 The Company
The company which operated TMI was Metropolitan
Edison (Met Ed).
26.11.2 The Site and the Works
TMI is situated on the Susquehanna River, some 10 miles
south-east of Harrisburg, Pennsylvania.
26.11.3 The Process and the Plant
The plant consisted of two pressurized water reactors
(PWRs) of approximately 900 MWe each.
The reactor itself is a pressure vessel containing the
reactor core. There are some 37,000 of these fuel pins
arranged in clusters in the core. The core is cooled by
the primary cooling system containing water at a high
pressure (,,15.2 MPa) to prevent it from boiling.
Heat is removed from the reactor in this primary
cooling circuit, the reactor cooling system (RCS), and used
in the steam generators to generate steam to drive a pair
of turbogenerators. The primary cooling system consists of
two independent loops containing water at high pressure.
Chapter | 26 Case Histories
Since the volume of the cooling water changes with
temperature, it is necessary to have some free space or
‘bubble’ in the primary circuit to control the system pres-
sure. This is provided by the pressurizer, which is
equipped with electrical heating to raise steam and thus
increase the pressure, and cold water sprays to condense
steam and thus lower the pressure. Steam can be blown
off through a pilot-operated relief valve (PORV). The tail
pipe from the PORV is run to the reactor coolant drain
tank.
An emergency core cooling system (ECCS) is pro-
vided to give backup cooling. This consists of putting
coolant into the system at a pressure greater than the
normal coolant pressure. Another is the core flooding
system, which automatically injects cold borated water
into the system when the coolant pressure falls below
about 4.1 MPa. The third is the low pressure injection
system which operates at 2.8 MPa. This takes water
either from a large tank of borated water or from the
dump of the containment building and is thus capable of
keeping up recirculation indefinitely.
The reactor, the primary cooling circuit, and the steam
generators are housed in a containment building which is
leak-tight. The containment is designed to retain the
contents of the primary circuit in the event of a major
leak.
The turbogenerator set is housed in a separate building
which also contains the condensate and water treatment
plants. Feedwater for the secondary circuit is from the con-
denser. The condensate water is purified by ion exchange
in a condensate polishing system, a package unit.
The water converted to steam on the secondary side in
the steam generators is supplied to them by the main
feedwater pumps. These are backed up by auxiliary, or
emergency, feedwater pumps. Both sets of feedwater
pumps are housed in the turbine building.
26.11.4 Events Prior to the Excursion
Some 2 days prior to the incident, routine testing was
done on the valves on the auxiliary feedwater pumps.
Two of the valves, the ‘twelve valves’, had inadvertently
been left shut.
For some 11 h before the incident, the operators had
been trying to clear a blockage in the condensate polishing
system. In order to do this, they made use of compressed
air. The service air line used for this purpose was cross-
connected to the instrument air line. The pressure of the air
in the instrument line was less than that of the water in the
units and some water got into the instrument air line,
despite the presence of a non-return valve on that line. This
water found its way to some of the plant instruments.
Another feature was a persistent slight leak from
either the regular safety valves or the PORV.
487
26.11.5 The Excursion 1
At the time of the incident, the reactor was operating under
automatic control at 97% of its rated output. The incident
began when water which had entered the instrument air
line caused the isolation valves on the condensate polishing
system to drift shut and the condensate booster pump to
lose suction pressure and trip out. The main feedwater
pumps in the secondary circuit then tripped and almost
immediately the main turbine tripped. The time was
4:00:37.
Valves allowing steam to be dumped to the con-
denser opened, and the auxiliary feedwater pumps
started up. The removal of heat from the RCS fell, and
the pressure of the RCS rose. Within 3 6 s the PORV
set pressure of 15.5 MPa was reached and the valve
opened, but this was insufficient to relieve the pressure,
and at 8 s in, pressure rose to 16.6 MPa, the set point for
reactor trip. The control rods were driven into the core
to stop the reaction.
The RCS pressure now fell below the PORV set
pressure, but the valve failed to shut. However, the valve
position indicator in the control room, which actually
indicated not the position of the valve but the signal sent
to it, showed the valve as closed.
In the secondary circuit condensate was no longer
being returned to the steam generators. The auxiliary
feedwater pumps were running, but the valves between the
pumps and the steam generators were also, inadvertently,
closed. At 1 min 45 s into the incident the steam generators
boiled dry.
Meanwhile the RCS pressure was dropping. At 2 min
the pressure fell to 11 MPa at which point the first of the
ECCS systems, the HPI system, came on and injected
high pressure water. The liquid level in the pressurizer,
however, was rising.
The display of liquid level was an indicator of the
level of fluid in the pressurizer, but no longer of the mass
of water; the liquid now contained steam bubbles and had
thus been rendered less dense. To this extent the level
display had become misleading.
The operators became concerned that the HPI system
was increasing the inventory of water in the RCS, and
that the circuit would become full of water and thus go
‘solid’. At 4 min 38 s they therefore shut down one of the
HPI pumps and throttled back the other.
With water passing through the PORV, the pressure in
the reactor coolant drain tank built up and at 7 min 45 s
the reactor building sump pump came on, transferring
water to the waste tanks in the auxiliary building.
At 8 min the operators realized that the steam genera-
tors were dry. They found that the auxiliary feedwater
system valves were closed and opened them, thus restor-
ing feedwater to the steam generators.
488
At 60 min the operators found that the RCS pumps
were vibrating. This was due to the presence of steam,
though they did not realize this. At 1 h 14 min they shut
off the two pumps in Loop B to prevent damage to the
pumps and pipework, with possible loss of coolant, and
at 1 h 40 min shut off the two pumps in Loop A.
At 2 h 18 min the PORV block valve was at last shut
off, thus stopping the loss of water from the RCS. The
RCS pressure then began to rise.
In the 2 h since the turbine trip periodic alarms had
warned of low level radiation in the containment building.
At about 2 h in, there was a marked increase in the radia-
tion readings. By 2 h 48 min in, high radiation levels
existed in several areas. At 2 h 55 min a site emergency
was declared.
Attempts were made to restart the RCS pumps. One
pump in Loop B operated for some 19 min but was shut
down again by vibration trips at 3 h 13 min. At 3 h 30 min
a general emergency was declared.
At some point, perhaps about 4 h in, the station man-
ager appears to have realized that the reactor core had
suffered damage.
From 4 h 30 min attempts were made to collapse the
steam bubbles in the RCS loops, but without success and
at 7 h these efforts were abandoned.
The operators then tried to bring in the lower pressure
cooling system by reducing pressure in the RCS. They
began at 7 h 38 min by opening the PORV block valve.
At 8 h 41 min the pressure fell to 4.1 MPa at which point
the core flooding system operated.
One consequence of the exposure of the core was that
a steam-zirconium reaction occurred, generating hydro-
gen. During the depressurization, hydrogen from the RCS
was vented into the containment building. At 9 h 50 min,
there occurred in the containment building what was
apparently a hydrogen explosion. The sprays came on for
some 6 min.
When the significance of the event in the containment
building became appreciated, concern grew about a possible
explosion of a hydrogen bubble there.
26.11.6 The Emergency and the Aftermath
The site emergency was declared at 7:00 on March 28.
At 7:24 a general emergency was declared.
The plant was contacted by the local WKBO radio
station. The radio station asked what kind of emergency
it was. They were told that it was a general emergency, a
‘red-tape’ sort of thing required by the NRC when certain
conditions exist, but that there was no danger to the public.
The emergency did not end with the establishment of
stable operation. The following day, the core damage was
found to be more serious than first thought. The hydrogen
bubble problem persisted over the next 8 days and caused
Lees’ Process Safety Essentials
particular concern. There were also a number of other
problems, mainly associated with the large quantities of
water contaminated with low level radioactivity.
On March 30, a radiation reading outside the plant, later
found to be erroneous, led NRC officials to recommend
evacuation. The local director of emergency preparedness
was notified to stand by for an evacuation; he notified
fire departments and had a warning broadcast that an evacu-
ation might be called. Then the NRC chairman assured the
Governor that an evacuation was not necessary. Later,
the Governor decided that pregnant women and pre-school
children should be evacuated. By April 1, the NRC had
concluded that the hydrogen bubble posed no threat but
failed to announce this properly.
26.11.7 The Excursion 2
The operators in the TMI-2 control room made a number
of errors. Some of these were failures to make a correct
diagnosis of the situation, while others were undesirable
acts of intervention.
The first was the failure to realize that the PORV had
stuck open. There were several central-indications, how-
ever, which pointed to the fact that the PORV was open.
Closely connected with this first diagnostic failure
was the failure to recognize that the mass of primary
coolant water had fallen. Here the operators were misled
by the level measurement.
Another counterproductive action was the shutting
down of the primary coolant pumps. About 60 min into
the incident, the pumps began vibrating.
These failures of diagnosis and the fear of the system
going solid have frequently been characterized as illustra-
tions of mindset.
The operators were poorly served by the displays and
alarms in the control room.
26.11.8 Some Lessons
The Three Mile Island incident yields numerous lessons.
Some of these are listed in Table 26.12.
26.12. CHERNOBYL
On Monday, April 28, 1986, a worker at the Forsmark
nuclear power station in Sweden put his foot in a radia-
tion detector for a routine check and registered a high
reading. The station staff thought they had had a radioac-
tive release from their plant and the alarm was raised.
However, as reports came in of high radioactivity in
Stockholm and Helsinki, the source of the release was
identified as the Soviet Union. In fact, an accident had
occurred on Unit 4 at Chernobyl in the Ukraine some 800
miles from Sweden on Saturday April 26.
Chapter | 26 Case Histories
TABLE 26.12 Some Lessons of Three Mile Island
Regulatory control of major hazard installations
People-related versus equipment-related problems
Formal safety assurance
Relative importance of large and small failures
Influence of operator in an emergency
Fault diagnosis by the process operator
Accident management for major hazard installations
Follow-up of safety issues
Learning from precursor events
Package and other ancillary units
Display of variable of interest
Plant status display and disturbance analysis systems
Abuse of instrument air
Limitations of non-return valves
At 1:24 on that day an experiment to check the use of
the turbine during rundown as an emergency power supply
for the reactor went catastrophically wrong. There was
a power surge in the reactor, the coolant tubes burst and a
series of explosions rent the concrete containment. The
graphite caught fire and burnt, sending out a plume of
radioactive material. Emergency measures to put out the
fire and stop the release were not effective until May 6.
26.12.1 The Site and the Works
The Chernobyl nuclear power station is situated in a
region which at the time was relatively sparsely popu-
lated. There were some 135,000 people within a 30 km
radius. Of these, 49,000 lived in Pripyat to the west of the
plant’s 3 km safety zone and 12,500 in Chernobyl 15 km
to the south-east of the plant.
There were four nuclear reactors on the site.
26.12.2 The Process and the Plant
Unit 4 at Chernobyl was designed to supply steam to two
turbines each with an output of 500 MWe. The reactor
was therefore rated at 1000 MWe or 3200 MWt.
Unit 4 was an RBMK-1000 reactor, a boiling water
pressure tube, graphite moderated reactor. The reactor is
cooled by boiling water, but the water does not double as
the moderator, which is graphite.
The design of the reactor avoided the use of a large
pressure vessel.
489
The reactor contained 192 te of uranium enriched to
2%. The subdivision of the uranium into a large number
of separately cooled fuel channels greatly reduced the
risk of total core meltdown.
The reactor was cooled by water passing through the
pressure tubes. The water was heated to boiling point and
partially vaporized. The steam water mixture with a mass
steam quality of 14% passed to two separators where steam
was flashed off and sent to the turbines, while water was
mixed with the steam condensate and fed through downco-
mers to pumps which pumped it back to the reactor.
There were two separate loops each with four pumps, three
operating and one standby. This system constituted the
multiple forced circulation circuit (MFCC).
The reactor contained a stack of 2488 graphite blocks
with a total mass of 1700 te.
An emergency core cooling system (ECCS) was pro-
vided to remove residual heat from the core in the event
of loss of coolant from the MFCC.
There was a control system which controlled the
power output of the reactor by moving the control rods,
in and out.
The reactor was housed in a containment built to
withstand a pressure of 0.45 MPa. There was a ‘bubble’ con-
denser designed to condense steam entering the containment
from relief valves or from rupture of the MFCC.
An important operating feature of the reactor was its
reactivity margin, or excess reactivity. Below a certain
power level the reaction would be insufficient to avoid
xenon poisoning. It was therefore necessary to operate
with a certain excess reactivity. The operating instructions
stated that a certain excess reactivity was to be main-
tained; the equivalent number of control rods was 30.
Another important operating characteristic was the
reactor’s ‘positive void coefficient’. An increase in heat
from the fuel elements would cause increased vaporiza-
tion of water in the fuel channels and this in turn would
cause increased reaction and heat output. There was
therefore an inherent instability, a positive feedback,
which could be controlled only by manipulation of the
control rods.
26.12.3 Events Prior to the Release
The origin of the accident was the decision to carry out a
test on the reactor. Electrical power for the water pumps
and other auxiliary equipment on the reactor was supplied
by the grid with diesel generators as back-up. However,
in an emergency, there would be a delay of about a min-
ute before power became available from these generators.
The objective of the test was to determine whether during
this period the turbine could be used as it ran down
to provide emergency power to the reactor. A test had
already been carried out without success, so modifications
490
had been made to the system, and the fresh test was to
check whether these had had the desired effect.
The program for the test included provision to switch
off the ECCS to prevent its being triggered during the
test.
At 1:00 on April 25 the reduction of power began.
At 13:05 Turbogenerator 7 was switched off the reactor. At
14:00 the ECCS was disconnected. However, a request was
received to delay shutting down since the power output
was needed. It was not until 23:10 that power reduction was
resumed.
At some stage, the trip causing reactor shut-down on
loss of steam to Turbogenerator 8 was disarmed, apparently
so that if the test did not work the first time, it could be
repeated. This action was not in the experimental program.
The test program specified that rundown of the turbine
and provision of unit power requirements was to be
carried out at a power output of 700 1000 MWt, or 20%
of rated output. The operator switched off the local auto-
matic control, but was unable to eliminate the resultant
imbalance in the measurement function of the overall
automatic controls and had difficulty in controlling the
power output, which fell to 30 MWt. Only at 1:00 on
April 26 was the reactor stabilized at 200 MWt, or 6% of
rated output. Meanwhile the excess reactivity available
had been reduced as a result of xenon poisoning.
It was nevertheless decided to continue with the test.
At 1:03 the fourth, standby pump in one of the loops of
the MFCC was switched on and at 1:07 the standby pump
in the other loop was switched on.
26.12.4 The Release
With the reactor operating at low power, the hydraulic
resistance of the core was less, and this combined with
the use of additional pumps resulted in a high flow of
water through the core. This condition was forbidden
by the operating instructions, because of the danger of
cavitation and vibration. The steam pressure and water
level in the separators fell. In order to avoid triggering,
the trips which would shut-down the reactor, the trips
were disarmed. The reactivity continued to fall, and the
operator saw from a printout of the reactivity evaluation
program that the available excess reactivity had fallen
below a level requiring immediate reactor shut-down.
Despite this, the test was continued.
At 1:23:04 the emergency valves on Turbo generator
8 were closed. The reactor continued to operate at about
200 MWt, but the power soon began to rise. At 1:23:40
the unit shift foreman gave the order to press the scram
button. The rods went down into the core, but within a
few seconds shocks were felt and the operator saw that
the rods had not gone fully in. He cut off the current to
the servo drives to allow the rods to fall in under their
Lees’ Process Safety Essentials
own weight. Within 4 s, by 1:23:44, the reactor power
had risen, according to Soviet estimates, to 100 times the
nominal value.
At about 1:24, there were two explosions, the second
within some 3 s of the first.
It is thought that the fuel fragmented, causing a rapid
rise in steam pressure as the water quenched the fuel ele-
ments, so that there was extensive failure of the pressure
tubes. The explosive release of steam lifted the reactor
top shield, exposing the core. Conditions were created for
a reaction between the zirconium and steam, producing
hydrogen. An explosion involving hydrogen occurred in
and ruptured the containment building, and ejecting
debris and sparks were seen.
The accident was aggravated by the fact that the 200
te loading crane fell onto the core and caused further
bursts of the pressure tubes.
26.12.5 The Emergency and the Immediate
Aftermath
The fire brigades from Pripyat and Chernobyl set out at
1:30. The fires in the machine hall over Turbogenerator 7
were particularly serious, because they threatened Unit 3
also. These therefore received priority. By 5:00 the fires
in the machine hall roof and in the reactor roof had been
extinguished.
However, the heating up of the core and its exposure
to the air caused the graphite to burn. The residual activ-
ity of the radioactive fuel provided another source of
heat. The core therefore became very hot and the site of
raging fire.
During the next few days the fire raged and a radioac-
tive plume rose from the reactor. The accident had
become a major disaster. It was necessary to evacuate the
population from a 30 km radius round the plant and deal
with the casualties and to take a whole range of measures
to dampen and extinguish the fire, to cover and enclose
the core, and to deal with the radioactivity in the sur-
rounding area.
Three evacuation zones were established: a special
zone, a 10 km zone and 30 km zone. A total of 135,000
people were evacuated.
Accounts of the evacuation are incomplete and some-
times contradictory, but what appears to have happened is
as follows. Within a few hours of the accident, an emer-
gency headquarters was set up in Pripyat. About 14:00 on
April 26, there was an evacuation of some 1000 people
from within a 1.6 km zone around the plant. A much
larger evacuation took place about 14:00 the next day,
when about 1000 buses were brought in and within 2 h
had evacuated some 40,000 people. However, it was not
until some 9 days later that the authorities in Moscow
Chapter | 26 Case Histories
ordered complete evacuation from a 30 km zone around
the site.
A medical team was set up within 4 h of the accident,
and within 24 h triage of the 100 most serious cases had
been affected.
A system was set up to control movements between
the zones. People crossing the zone boundaries had to
change clothing and vehicles were decontaminated.
Decontamination of the area outside the site was
complicated by the fact that the distribution of the radio-
nuclides changed with time according to the terrain,
particularly during the first 3 4 months. Hence the full
value of measures to decontaminate a particular area is
generally obtained only temporarily.
The death toll from Chernobyl cannot be known with
certainty, since most deaths are due to excess cancers.
Two men died dealing with the accident itself. By the end
of September the toll of dead in the USSR was 31 with
203 injured. Other European countries were also affected.
Radioactive contamination was measured across Europe.
26.12.6 The Later Aftermath
Of those on site at the time, two died on site and a further
29 in hospital over the next few weeks. A further 17 are
permanent invalids and 57 returned to work but with
seriously affected capacity. The others on site, some 200,
were affected to varying degrees. There is apparently no
detailed information on the effects on the military and
civilian personnel brought in to deal with the accident.
A detailed discussion of such effects from Chernobyl
is given in the Second Watt Committee Report. For
EC countries the estimates of the NRPB in 1986 were
100 fatal thyroid cancers and 2000 fatal general cancers,
or 2100 fatal cancers. For the USSR the situation is much
more complex, but the report quotes an estimate by Ryin
et al. (1990) of 1240 fatal leukemia cases and 38,000 fatal
general cancers.
26.12.7 Some Lessons of Chernobyl
A list of some of the lessons learned from Chernobyl, that
are applicable for process industry is given in Table 26.13.
26.13. HURRICANES KATRINA AND RITA
26.13.1 Introduction
Despite the high hurricane activity throughout the years
in the Gulf of Mexico, 2005 was predominantly active in
the Gulf Coast with 28 tropical storms and 15 hurricanes,
of which seven were category 3 or higher (Blake et al.,
2007). 2005 also registered for the first time two
category-five hurricanes, hurricanes Katrina and Rita,
491
TABLE 26.13 Some Lessons of Chernobyl
Management of, and safety culture in, major hazard
installations
Adherence to safety-related instructions
Inherent safer design of plants
Sensitivity and operability of plants
Design of plant to minimize effect of violations
Disarming of protective systems
Planning and conduct of experimental work on plants
Accidents involving human error and their assessment
Emergency planning for large accidents
Mitigating features of accidents
with disastrous consequences (NOAA, Hurricane Rita—
National Climatic Data Center). Katrina is the costliest
hurricane in the US history.
26.13.2 Hurricane Katrina
On August 23, 2005, a tropical depression developed in
the southeastern Bahamas, upgrading to tropical storm
Katrina the next day. On August 25, Katrina became a
category 1 hurricane and passed by the Southeastern coast
of Florida. Continuing its southwest movement, Katrina
reached its highest intensity on August 28. Katrina made
landfall near Buras, LA on August 29 at 7:10 a.m. EDT
as a category 3 hurricane with winds of 125 mph. Inland,
the hurricane moved near the Louisiana Mississippi bor-
der and through Mississippi, maintaining hurricane inten-
sity for almost 100 miles. Katrina continue to move north
through Tennessee and on August 30, it became a tropical
depression. Katrina developed 62 tornados and produced
rainfalls of up to 15 inches (Johnson, 2006).
Shortly after the hurricane hit Louisiana, the flooding
problems in New Orleans worsened when four levees
breached resulting in floodwaters that covered about 80%
of the city up to 20 feet high. The New Orleans flood-
waters were completely removed 43 days after Katrina
made landfall (Johnson, 2006).
Highways and roads were damaged or flooded, and
many businesses were destroyed causing the loss of tens of
thousands of jobs. Louisiana and Mississippi were signifi-
cantly affected by Hurricane Katrina; Florida, Georgia, and
Alabama to a lesser degree (Knabb et al., 2006).
During Katrina, the evacuation was not very effective,
Federal emergency officials failed to provide ground
492
transportation, and neither buses nor trains were deployed
(Litman, 2006).
Because of the approximately 1800 direct and indirect
fatalities (Knabb et al., 2006), the 275,000 homes
affected, and the nearly 81 billion dollars of property
damage, hurricane Katrina is the costliest and one of the
deadliest hurricanes in the United States (Blake et al.,
2007; Johnson, 2006).
26.13.3 Hurricane Rita
Twenty-six days after Katrina, Hurricane Rita impacted the
Texas Louisiana border. Hurricane Rita developed as a
tropical depression on September 18, 2005. On September
20, Rita became a category-two hurricane and passed by
the Florida Keys. Rita intensified to category five the next
day where a maximum wind speed of 175 mph was
reached. Rita weakened to a category three and made land-
fall on September 24 at 3:40 a.m. EDT with winds that
reached 120 mph. Inland, the winds impacted more than
150 miles causing significant damage. The winds continued
until the Louisiana Texas Arkansas border. Rita became
a tropical depression on September 25. Approximately 90
tornados and rainfall of five to nine inches were reported in
Louisiana, Arkansas, Mississippi, and Alabama (NOAA,
Hurricane Rita—National Climatic Data Center; Knabb
et al., 2006). Texas and the Florida Keys were also affected
by the floods and winds (Knabb et al., 2006).
The damage caused by Rita is estimated at approxi-
mately $10 billion in the United States (Knabb et al., 2006;
Carpenter et al., 2006).
Of the approximately 120 deaths reported during Rita,
only 7 were directly caused by the hurricane (Knabb
et al., 2006; Carpenter et al., 2006). Most of the deaths
occurred during the evacuations (Carpenter et al., 2006).
Due to the massive evacuation, the roadways were highly
congested preventing rapid medical responses to emer-
gencies (Carpenter et al., 2006). Additionally, fuel, food,
and water shortages as well as cars out of gas worsened
the traffic congestion. The evacuation of patients was
inefficient (Carpenter et al., 2006), and Hobby Airport
and Bush Intercontinental Airport suffered delays because
many employees evacuated the area (Litman, 2006). In
Texas, a bus exploded killing 23 passengers, all of them
nursing home evacuees (Carpender, 2006). Because of the
extreme heat and humidity (Sanders, 2008), many people
died due to heat exhaustion (Knabb et al., 2006).
26.13.4 Effect on the Industry
In 2005, hurricanes Katrina and Rita destroyed 109 facilities,
damaged 53 others, and caused a significant amount of oil
and hazardous materials spills, both onshore and offshore
(Kaiser and Pulsipher, 2007; Cruz and Krausmann, 2009).
Lees’ Process Safety Essentials
Over 1070 onshore and offshore releases were reported
to the Incident Reporting Information System (IRIS)
between 2005 and 2008 due to Hurricane Katrina, and
even 2 years later releases were reported due to damaged
or sunk structures and leaks in pipelines (Kessler et al.,
2008; Santella et al., 2010).
26.13.4.1 Offshore Industry
During Katrina and Rita, 113 platforms were destroyed,
457 pipelines were damaged (BOEMRE, 2006a, 2006b),
and 611 releases at offshore facilities were recorded between
2005 and 2006 (Cruz and Krausmann, 2009). Additionally,
the damage, evacuation and loss of production affected the
price of oil (Cruz and Drausmann, 2008).
During Katrina, more than 700 platforms and rigs were
evacuated, 44 platforms were destroyed (mostly in shallow
waters), and 21 were severely damaged (BOEMRE 2006a,
2006b). The major damage occurred in the Shell platform
Mars. Four drilling rigs were destroyed, nine were severely
affected, and six were set adrift (Krausmann and Cruz,
2008); The most severely damage rigs were the Rowan
New Orleans and the Diamond’s Ocean Warwick.
During hurricane Rita, 69 platforms were destroyed
and 32 were severely damaged, mostly in shallow water.
One rig was destroyed, 10 others were severely damaged,
and 13 were set adrift (Krausmann and Cruz, 2008);
MOEMRE 2006a, 2006b. For Mobile Offshore Drilling
Units (MODUs), both hurricanes combined destroyed
5 drilling rigs and damaged 19 (Krausmann and Cruz,
2008).
More releases occurred on platforms during hurricane
Katrina than during Rita, probably due to the preparedness
for Rita or because some of the facilities from Katrina
remained shut-down (Cruz and Krausmann, 2009).
26.13.4.2 Onshore Industry
Numerous onshore facilities were also affected by the
strong winds and the surges of hurricane Katrina and
Rita. Companies with no major damage still required
approximately 2 months to return to normal operating
conditions. Other facilities were severely damage and
remained shut down for long periods of time (Sanders,
2008; Santella et al., 2010). Prior to Katrina, four refin-
eries reduced runs and nine refineries were shutdown,
four of which remained closed for some time due to
the damage from the hurricane (Johnson, 2006; Santella
et al., 2010). Three natural gas facilities, the Dynegy
Plant of Yschoskey, LA, the Dynegy Plant of Venice,
LA, and the BP Plant of Pascagoula, MS, were damaged
by hurricane Katrina, but no releases were reported
(Santella et al., 2010). The most significant spill during
Katrina occurred in the Murphy Oil refinery in the
Chapter | 26 Case Histories
St. Bernard Parish (Meraux) where 25,100 barrels of
mixed crude oil were released when a partially filled stor-
age tank was dislodged and ruptured. The spill affected
approximately 1800 homes (Santella et al., 2010).
During Rita, 15 refineries were taken offline in advance
in Texas and Louisiana, and one of them remained shut
down until 1 month after the hurricane made landfall
(Godoy, 2007).
26.13.5 Lessons Learned
It is important to recognize the devastating power that
hurricanes can have and, even more important, learn
from others that experienced the destruction of hurricanes
Katrina and Rita (Blake et al., 2007; Sanders, 2008;
Keel et al., 2008; Krausmann and Cruz, 2008). Two key
aspects should be considered to avoid the loss of lives
and property and to prevent potential releases: design to
withstand hurricanes and plan in advance to minimize the
damage.
26.13.6 Recommendations
Key factors should be implemented to avoid loss of life
and minimize potential damage caused by hurricanes. The
following lists some practices known to provide effective
protection and response.
Planning: Develop hurricane preparedness plans that
consider the probability of occurrence, the damage
expected from winds and surges, and the vulnerability
of the facility. Then, identify suitable mitigations
options. Provide detailed shutdown and start-up proce-
dures closely related to evacuation plans. Include evac-
uation plans that ensure the transportation of workers
and their families. Ensure the availability of hurricane
shelters and harden buildings, supplies, backup commu-
nication system, and storage of gasoline (Santella et al.,
2010).
Evacuation: Have an accurate weather information
system. For offshore operations, the shutdown and evacu-
ation should start 5 7 days before the hurricane.
Decrease inventory of hazardous materials. Transfer the
material from storage tanks and fill the tanks with water.
Inspect the foundation of tanks to determine the potential
for a storage tank to be moved by the storm (Keel et al.,
2008).
Post-storm: Ensure that post-storm plans are followed.
Assess the damage and report to management, govern-
ment agencies and property insurance carriers accord-
ingly. Share experiences with other industries to develop
best practices and determine the aspects that need to be
improved (Cruz and Krausmann, 2009).
493
26.14. BP AMERICA REFINERY EXPLOSION,
TEXAS CITY, TEXAS, USA
On March 23, 2005, a massive explosion occurred at the
BP Texas City Refinery, in Texas City, Texas, USA. This
accident resulted in 15 fatalities and 180 injuries and was
considered as one of the most catastrophic industrial
accident in the US history. The explosion happened at
approximately 1:20 p.m. during the startup of a hydrocar-
bon isomerization unit when a distillation tower flooded
with hydrocarbons, caused over pressurization and relief
devices to open resulting in a geyser-like release of flam-
mable liquid from the vent stack that was not equipped
with a flare. Most victims at the time of the incident were
located in office trailers located near to the blowdown
vessel. In addition to casualties, houses and buildings
located as far as three quarters of a mile away from the
refinery were significantly damaged. The financial losses
from this accident exceed $1.5 billion.
26.14.1 The Company
Texas City refinery is the company’s largest refinery
worldwide with capacity up to 10 million gallons of
gasoline per day. There are 29 oil refining units and
4 chemical units within its 1200 acre site with approxi-
mately 1800 BP workers. At the time of the incident,
BP was performing a turnaround and there were about
800 contractor workers onsite to support the work.
26.14.2 Incident Description
The incident at the BP refinery in Texas City, Texas,
occurred on March 23, 2005. The incident occurred dur-
ing the restarting of the refinery’s ISOM process unit
after turnaround maintenance. The ISOM unit process
consists of an Ultrafiner desulfurizer, a Penex reactor,
a vapor recovery/liquid recycle unit and a raffinate split-
ter. The incident started at the raffinate splitter section
when the raffinate splitter tower was overfilled with
liquid during the startup. Heavy raffinate was pumped
from the bottom of the splitter tower and circulated
through the reboiler furnace and back to the bottom tray.
Heavy raffinate product was taken of as a side stream and
sent to storage. A level transmitter was installed in the
splitter tower and provided the reading of the liquid level
to the control room. The tower was also equipped with
alarms that indicated high liquid level.
The raffinate splitter tower was protected by three par-
allel safety relief valves located in the overhead vapor
line. The relief valves were designed to open and release
primarily vapor when their set pressures were exceeded.
The vapor was then sent to the disposal header collection
system. The header collection system consisted of a
494
14-inch NPS elevated pipe approximately 270 m away
from the raffinate splitter tower. This section and two
other additional headers from other ISOM unit sections
were connected to the blowdown drum.
Around the time of the incident, two major turn-
arounds were underway in the ultracracker unit (ULC)
and the aromatics recovery unit (ARU).
A month before the incident, the raffinate splitter
section was shut down and the raffinate splitter tower was
drained, purged, and steamed-out to remove residual
hydrocarbons. At the time of the incident, almost all
scheduled maintenance work had been completed except
for the Penex reactor which was awaiting a gasket; how-
ever, BP decided to start up the raffinate splitter section.
During the incident, no pre-startup safety review
(PSSR) procedure were conducted to verify the ade-
quacy of the safety system and equipment in the ISOM
process unit although the company policy required a
formal PSSR prior to startup following a turnaround.
The process safety coordinator responsible for an area of
the refinery including the ISOM unit was not familiar
with the applicability of PSSR, and therefore, the PSSR
was not performed.
During pre-startup equipment checks, the instrumenta-
tion and equipment which was identified as malfunction-
ing were not repaired. During the ISOM turnaround,
operations personnel informed the turnaround supervisor
that the splitter level transmitter and level sight glass
were malfunctioning. When the ISOM unit was operating,
this equipment could not be repaired because the block
valves needed to isolate the level transmitter were
leaking. The isolation valves were replaced during the
turnaround but the BP supervisors decided not to repair
the level transmitter due to insufficient time to com-
plete the job in the existing turnaround schedule. The
supervisors planned to repair the level transmitter after
the startup.
In the days prior to the raffinate splitter startup, one of
the operations personnel found that a pressure control
valve was malfunctioning both during the unit shutdown
and the equipment checks. In addition, the functionality
check of all alarms and instruments required prior to
startup were not completed.
The raffinate section in the ISOM unit was started
during the night shift on March 22, 2005; then it was
stopped to be re-started during the next shift. The Night
Lead Operator did not record the completed steps for the
filling process of the raffinate section, and therefore, the
operators on the next shift did not have any records on
what had been done.
In the early morning on March 23, 2005, the raffinate
splitter tower was filled beyond the set points of both alarms
to a level reading of 99% on the transmitter; however, only
one alarm was activated and sounded at 3:09 a.m.
Lees’ Process Safety Essentials
The splitter tower feed and bottoms pumps were shut
off and the raffinate section was filled and the circulation
was shut down. The level control valve remained in the
‘closed’ position for the following shift to resume the
startup.
At 6:00 a.m. in the morning shift change took place.
The Night Lead Operator had left approximately an hour
before the shift change and left the Night Board Operator
with brief explanation of the actions he had taken. During
the shift change, the Night Board Operator provided only
few details about the night shift’s raffinate section startup
activities to the Day Board Operator. The Day Board
Operator read the logbook, interpreted that the liquid was
only added to the tower and was unaware that the heat
exchangers, the piping, and associated equipment had
also been filled during the previous shift.
On the morning of March 23, a series of mis-
communications took place with regard to whether the
startup could proceed or not. The Day Supervisor did not
have a solid knowledge of what steps the night crew
had completed and did not review the applicable startup
procedure with the crew.
Prior to sending additional liquid hydrocarbons to the
raffinate section, the 8-inch NPS chain-operated valve
was open by outside operators to remove nitrogen from
the splitter tower. A mis-communication occurred regard-
ing how the feed and product would be connected to the
tower. The Day Board Operator believed that the heavy
raffinate product should not be sent to storage; however,
the outside operators believed that they were instructed
not to send the light raffinate product to storage.
At 9:40 a.m. prior to the restart of the splitter tower,
the Day Board Operator opened the level control valve to
70% output and approximately 12,000 barrel per day
(bpd) of heavy raffinate flowed out of the tower for about
3 min. He closed the level control valve to 0% output, but
the flow indication showed that the flow dropped only to
4300 bpd rather than 0 bpd although no heavy raffinate
flowed out of the tower. Then the Day Board Operator
resumed the startup, restarted the circulation and intro-
duced the feed on the splitter tower without considering
the written procedure which indicated the exact stage of
the startup.
The Day Board Operator believed that the verbal
instruction required his action to maintain higher level in
the tower to protect downstream equipment although the
startup procedure called for level control valve to be set
in ‘automatic’ and 50% to establish heavy raffinate flow
to the storage. The Day Board Operator noticed the level
transmitter indicated 97% and thought it was normal.
At around 10:00 a.m., as much as 20,000 bpd of raffinate
feed was pumped into the tower and the output flow
showed to be 4100 bpd although the Day Board Operator
was aware that the level control valve was shut. CSB
Chapter | 26 Case Histories
investigation post-incident concluded that there was likely
no flow leaving the tower at that period.
As the tower was filled, the tower level transmitter
showed the liquid level less than 100%. The level sight
glass was reported nonfunctional for several years.
When the unit was being heated, the Day Supervisor
who had ISOM-experience left the plant due to a family
emergency. The second Day Supervisor had very little
experience with the ISOM unit and therefore did not get
involved in the ISOM startup. At 9:55 a.m. two burners
which pre-heated the feed flowing into the heater were lit
heating the liquid at the bottom of the tower. About an
hour and a half later, two additional burners were lit.
Post-incident analysis by the CSB determined that the
level in the tower was actually 20 ft when the level read-
ing was 93% and when the level decreased to 88% the
level in the tower was actually 30 m.
The pressure inside the tower rose to 33 psig
(228 kPa) because of the compression of the nitrogen by
the liquid in the raffinate section. As a result of this high
pressure, the outside operators opened the 8-inch NPS
chain-operated valve that vented directly to the blowdown
drum in order to reduce the pressure in the tower. During
the startup, the temperature of the reboiler return to the
tower was as high as 307 F (153 C), the temperature
increased at a rate of 73 F (23 C) per hour during the
period 10 a.m. to 1 p.m. The heat to furnace was then
reduced by decreasing the fuel gas flow to the furnace.
At this time, the level transmitter at the raffinate splitter
showed 80% but the tower level was actually 43 m. At
12:42 p.m., the splitter level control was opened to 15%
output. The valve was opened five times but the heavy
raffinate flow had only begun at 12:59 p.m. The heavy
raffinate flowed out the tower at 20,500 bpd at 1:02 p.m
and 2 min later it spiked to 27,500 bpd. The level of
liquid at that time was 48 m but the level transmitter read-
ing continued to decrease up to 78%. The total liquid in
the 52-m tower was decreased due to the opening of the
heavy raffinate control valve; however, the level of the
liquid at the top of the column kept increasing.
Heating from the furnace caused contact between the
bubbles of hot vapor rising through the column and the
cold liquid. The raffinate leaving the bottom of the column
circulated onto the heat exchanger, heated the feed and
resulted in rapid heating of the column section above the
feed inlet. The increase in the overall column temperature
gave rise to the decrease of the liquid hydrocarbon density
and therefore significantly increased the level of the liquid
inside the tower. The entire column was eventually heated
approaching the boiling point of the liquid so that vapor
was accumulated and no longer condensed.
The hydrostatic head in the line increased due to the
entrance of the liquid to the overhead line and exceeded
the set pressures of the safety relief valves. The valves
495
opened and liquid raffinate flowed to the raffinate splitter
disposal header collection system.
The Day Board Operator and the outside operators
noticed that the splitter tower pressure had spiked dramat-
ically so the day board operator tried to troubleshoot the
problem by reducing the fuel gas to feed preheater and
fully opened the level control valve to raffinate storage.
However, data showed that the incoming feed to the
raffinate splitter tower had not been stopped. The data
also indicated that the three safety relief valves remained
fully open for about 6 min. The amount of material and
pressure in the tower overhead reduced due to the heavy
raffinate rundown and raffinate splitter reflux flow and
thus the pressure dropped inside the tower overhead and
the safety relief valves closed. Approximately 196,000
liters of flammable liquid flowed from the overhead
vapor line through the safety relief valves to the collec-
tion header and then discharged to the blowdown drum
during the opening of the safety relief valves. Because the
blowdown drum completely filled, the flammable liquid
flowed into the ISOM unit sewer system.
The geyser-like flammable liquid was discharged from
the stack and fell to the ground. The first notification that
the blowdown was overflowing was sent via radio. In
response to this message, the Board Operator and Lead
Operator used the computerized control system to shut
the flow of the fuel to the heater. Other operators left the
satellite room and ran toward an adjacent road to redirect
the traffic away from the blowdown drum. These actions
were required by the company emergency response proce-
dure. The ISOM operators did not have sufficient time to
sound the emergency alarm before the explosion. When
the explosion occurred, hundreds of alarms registered in
the control room sounded but the operations personnel
did not have sufficient time to assess the situation.
A number of witnesses reported seeing geyser-like liquid
flowing down the 6.1-m stack.
The liquid hydrocarbon was released and a flammable
vapor cloud was formed and reached an estimated area of
200,000 ft2 (18,581 m2). The vapor cloud covered this
area in a very short interval due to the direct dispersion
from evaporation prior to ignition as well as the burning
by the subsonic flames through the flammable cloud. The
impact of the falling liquid through the stack onto process
equipment, structural components, and piping enhanced
the liquid fragmentation into relatively small droplets and
promoted the evaporation and formation of the vapor
cloud.
The wind also contributed in enhancing the mixing
between the flammable vapors with air. The wind at the
time of the incident was reported to be at 5 miles (8 km)
per hour in to the southeast direction.
Several potential ignition sources were identified in
this incident, but the idling diesel pickup truck was
496
suspected to be the most likely ignition point. Once
ignited, the flame rapidly spread through the flammable
vapor cloud pushing the gas ahead of it to create a blast
pressure wave. The flame was accelerated by the combi-
nation of congestion/confinement and the flammable mix
so that intensified the blast pressure in several areas.
26.14.3 Aftermath and Emergency
The explosion killed 15 contract employees who worked in
or near the trailer site between the ISOM and NDU unit.
Sixty-six workers were seriously injured and 114 others
required medical attention. Of those who were seriously
injured, 14 were BP employees and the rest were contrac-
tor employees from 13 different organizations.
The blast caused severe damage within the ISOM unit
and the surrounding parking areas. About 70 vehicles and
40 trailers were damaged; 13 trailers were completely
destroyed. Buildings surrounding the ISOM unit were also
impacted by the blast and were characterized by broken
windows, cracked wall, damaged door, bent metal structure
and dispersal of interior contents.
The actions of the emergency response teams were
fast and effective in helping the victims. Member
companies of Texas City Industrial Aid System (IMAS)
assisted with fire hose line and search-and-rescue of the
victims.
26.15. BUNCEFIELD
26.15.1 Description of the Incident
Buncefield site was collectively operated by a number of
different companies. However, the incident was initiated in
one of the tanks of Hertfordshire Oil Storage Ltd. which
was a COMAH site housing about 200,000 metric tons of
cold gasoline inventory (BMIIB initial report, 2006).
On December 10, 2005 around 7 p.m. in the evening,
one of the tanks entitled Tank 912 began receiving about
296,644 ft3 unleaded gasoline fuel. The tank gauge records
at this point indicated that there was 38,105 ft3 of unleaded
motor fuel. The initial flow rate of the tank was 19,423 ft3/
h. Around 3:00 a.m., the Automated Tank Gauging System
showed that the level of the tank was two-thirds full. By
5:35 a.m. on the same day, the fuel in Tank 912 began to
overflow with an increase in the temperature. Within the
following 20 min, the flow rate to Tank 912 had also
increased to 34,430 ft3/h. Around 6 a.m. about 300 metric
tons of unleaded gasoline had overflowed from Tank 912
resulting in a vapor cloud explosion. The initial explosion
was followed by several other explosions which eventually
engulfed 23 tanks in the tank farm causing a very large
scale fire.
Lees’ Process Safety Essentials
While there were no serious injuries or fatalities
resulting from this incident, 43 people were directly
affected and about 2000 people were evacuated from their
houses (Mannan, 2009; BMIIB, 2006).
The Buncefield incident resulted in significantly dam-
aging many commercial as well as residential properties
close to its vicinity. The Buncefield Depot was close to
the Maylands Industrial Estate having around 630 firms
with 16,500 people. The estimated losses in the Maylands
businesses ranged between $207 270 million.
Significant environmental damages were reported as an
aftermath of the incident in terms of the water pollution
and the decreased air quality in the affected areas to very
high cost of clean-up and environmental remediation.
26.15.2 Causes of the Incident
Lack of learning culture: Following the incident, it was
claimed that cold gasoline had never resulted in a vapor
cloud explosion previously. However, a review of litera-
ture and past incidents (Kletz, 1986) indicate otherwise
that there are many incidents with significant similarities
with the Buncefield incident. According to Kletz (2001c),
similar types of incidents keep occurring. Hence, he
concludes that organizations have no memory and there is
a greater need for digging into the past by performing
incident investigations, root cause analysis of near-misses,
and estimating probabilities of major incident occurrences
(Mannan, 2011).
Inadequate and non-functional equipment: The fuel
level in the tank was monitored by using the servo gauge
technique, which is based on level and temperature mea-
surements. Servo gauges are utilized because they require
less maintenance and it is possible to also monitor the tank
level manually. Additionally, the temperature of the fuel
was measured using a temperature sensor (Powell, 2006).
Human factors: In this incident, actively assessing the
process hazards and analyzing the risks were not priori-
tized (DNV report, 2008). Similarly, the possibility of the
formation of vapor clouds because of overfilling was
never investigated and modeling of the resulting vapor
pressure, heat radiation, and domino effects were also not
considered (DNV report, 2006).
Siting of occupied vehicles and running engines:
Mannan (2009) suggests that based on the accident inves-
tigation, the average height of the vapor cloud would
have been at least 6.6 ft. The footage received from
CCTV and the description of eye witnesses corroborate
that the vapor cloud could be given a conservative
estimate of about 1,610,000 ft2 which would indicate that
the cloud volume could range between 5,650,000 ft3 and
10,590,000 ft3 (Mannan, 2009; Powell, 2006; Gant and
Atkinson Report, 2006).
Chapter | 26 Case Histories
26.15.3 Lessons Learned from the Incident
Lessons from past incidents: In case of the Buncefield
explosion, there was an underlying belief that cold gaso-
line and its vapors could not explode in the open air.
Unfortunately, this was a belief shared by many oil and
gas companies owning tank farms. Authorities and com-
panies alike were unaware of other similar incidents such
as Newark, New Jersey in 1983, Naples, Italy in 1995,
and St. Herblain, France in 1991.
Conducting proper hazard and risk assessments: The
study of the Buncefield incident has indicated that gener-
ally insufficient attention to incident precursors and leading
indicators result in devastating explosions (DNV, 2009;
Mannan et al., 2010). Emphasis is lacking in properly
understanding different processes and their hazards. There
is also a lack of awareness of the properties of chemical
compounds utilized in process operations.
Vapor cloud formation and explosion mechanism: In the
case of the Buncefield incident, the BMIIB Third Progress
Report discusses the spread of the vapor cloud and its depth
of 3.3 ft (1 m) in the area between bund A and the loading
gantry, and 16.4 23 ft down Three Cherry Trees Lane.
Eye witnesses also reported the presence of a gasoline mist
and odor along with automatic revving of cars despite their
ignitions being turned off. Powell (2006) in the third
BMIIB reports that smaller explosions followed one major
explosion, but only the major explosion was recorded
seismically. The delay in subsequent explosions after the
initial explosion could indicate that they were because of an
internal tank explosion and fuel leakage from the pipework
and tank damage.
It is safe to assume that generally, tank farms have
plenty of ignition sources in their surroundings. Ignition
sources might result due to improper procedures in hot
works such as welding and cutting during maintenance
operations. Sometimes, ignition sources are also present
because of smoking near tanks.
High overpressures generation in open air settings:
The preliminary assessment of the blast damage by the
investigation team suggested the generation of large over-
pressures. They found that the overpressure values were of
the range of 10.2 14.5 psi in the car parks of the buildings
in the facility. The car park location most likely was the
area where the gasoline vapors would have ignited.
26.16. SPACE SHUTTLE COLUMBIA
DISASTER
26.16.1 Development of the Space
Shuttle Program
On July 20, 1969, Apollo 11 made the first lunar landing
by a manned space craft. The landing was the culmination
497
of 8 year of preparation following President John F.
Kennedy’s mission statement which ignited the space
race with the Soviet Union. Apollo 11 used a lunar orbit
rendezvous (LOR) to achieve the lunar landing. This
required a rocket to achieve orbit with the moon and a
separate lunar module which would make the trip to the
surface and return the astronauts to the orbiting space-
craft. Early in the space program, most engineers at the
National Aeronautics and Space Administration (NASA)
initially preferred a direct ascent mode of travel. This
would utilize one craft to both reach the moon and land
on its surface. Subsequently, the same craft could return
the astronauts to Earth. This was set aside in favor of
LOR, but would be revived later as the Space Shuttle
Program.
26.16.2 Columbia’s Final Flight
Columbia began its 113th (STS-107) flight on January 16,
2003. There were seven crew members aboard. The mis-
sion consisted of 16 days in orbit around Earth for scien-
tific research in areas including microgravity and various
Earth science disciplines.
During the shuttle’s ascent, a piece of thermal insula-
tion foam separated from the external fuel tank and struck
the left wing. Shuttle fuel tanks contain liquid hydrogen at
2423 F (2 253 C) (also oxygen) for propulsion and are
fitted with insulation to prevent ice formation and melting
of the external tanks. Previous shuttle launches had also
shown foam separation, an event that came to be termed
‘foam shedding’. In these previous missions, the results
had been primarily benign, although the resulting damage
to Atlantis during mission STS-27 was of enough concern
that the mission’s commander, Robert Gibson, expected
the shuttle to be destroyed upon reentry.
Columbia began its scheduled reentry on February 1,
2003 with the expectation that the damage sustained dur-
ing takeoff would not affect the landing. As the shuttle
entered the atmosphere, excessive heating and strain were
observed on the left wing’s leading edge. Heating and
hydraulic sensors began to fail and TPS tiles and other
debris were shed as the shuttle began to break apart over
the southwest United States. Just before 9:00 a.m.,
Mission Control lost contact with the crew. Witnesses to
the crash notified NASA and a recovery team was sent
to find the crew and shuttle remains (CAIB, 2003).
26.16.3 Accident Analysis
Foam shedding became an accepted phenomenon of shuttle
launches by NASA. It was observed on at least 6 prior
missions and yielded no significant accidents, despite the
concerns raised during STS-27. Normalization of deviance
is a term applied to a safety environment in which events
498
initially considered outside the accepted safety standards
occur without serious incident. The events are then viewed
as acceptable and the bounds of safety are expanded to
include this new risk. This type of mentality was applied
to NASA after both the Challenger and Columbia disasters.
After Columbia entered orbit, NASA engineers began
issuing requests to the Department of Defense (DOD) for
imaging to assess the extent of the wing damage as well
as information obtained by the astronauts’ own inspec-
tions. These requests were not met and NASA manage-
ment chose to focus on reentry scenarios rather than a
complete analysis and potential repair of the damage.
In actuality, the foam had significantly damaged the
TPS, leaving the left wing susceptible to the extreme heat
it experiences entering the Earth’s atmosphere (.2800 F).
Hot atmospheric gases were able to penetrate the leading
edge of the wing and damage the internal structure leading
to a loss of hydraulics and failure of the wing’s tempera-
ture sensors. This led directly to the breakup of the shuttle
as it shed various components across Texas and Louisiana.
26.16.4 Other Factors Considered
The CAIB’s report included the immediate foam strike as
the cause of the accident, a detailed analysis of the safety
environment at NASA and the decision-making process
leading up to and during STS-107. The safety culture at
NASA was cited as a significant root cause.
Budgetary problems were also noted. US competition
with the Soviet Union for space supremacy largely ended
with the Cold War, making access to funding and support
for NASA more difficult.
The overall risk management strategy of NASA was
criticized. Reliance on simulation software not pro-
grammed for this specific situation was determined to be
an ineffective method to assess risk.
Many recommendations were generated as a result of
the accident. Some of the most important include:
G Proper camera placement upon shuttle launch.
G Reduction of schedule pressures focusing on available
resources.
G Creation of two independent entities, one for technical
engineering and one for safety.
G Development of the ability to analyze and repair shuttle
wings in space. In Columbia’s case, the crew had
enough oxygen and supplies to last for 30 days, giving
another shuttle time to rendezvous for a repair attempt.
26.16.5 The Accident’s Organizational
Causes
The investigations that followed both the Challenger and
Columbia disasters identified physical (technical) as well
Lees’ Process Safety Essentials
as organizational causes as the foundation for what went
wrong during these missions. Adams (2004) refers to the
‘destructive organizational dynamics’ as root causes that
led to the inevitable accident.
The organizational structure of NASA at the time of
the accident was basically a dependent structure that left
room for potential conflicts of interest. The overlapping
jurisdiction of the safety programs at different levels by
the Division Chief blurred the lines of responsibility and
authority, and instead, produced faulty channels of com-
munications, lack of corporate memory, flawed manage-
ment and hierarchy, and a generally poor safety culture
(CAIB, 2003).
One of the major recommendations by the Rogers
commission was the creation of a Headquarters Office of
Safety, Reliability, and Quality Assurance, which would
fulfill the most significant gaps in the safety culture of
the organization. This shift in activities was believed to
involve an impartial party that would re-establish effec-
tive communication channels and would have authority
over safety, reliability, and quality issues involved in
shuttle missions. However, NASA neglected full imple-
mentation of this change from the beginning as evidenced
when independent power was not provided as specified.
This created a false sense of safety that compromised the
perception of management having a fully operational pro-
gram with a low probability of failure, rather than a pro-
gram in the development stages (CAIB, 2003).
After the Columbia disaster, the commission recom-
mended the establishment of an independent Technical
Engineering Authority to ensure a shift in the organiza-
tion’s pathway to destruction. The objective of this
measure was to guarantee the unbiased supervision of
the division by removing their dependency on program
resources by providing guidance on technical standards,
hazard analysis, and risk assessment (CAIB, 2003).
26.16.6 Implications for the Future of
Human Space Flight
The CAIB noted several faults with actions taken by
NASA officials prior to and during the Columbia
accident. However, it acknowledged that the shuttle is
not inherently unsafe in its current form and sufficient
changes to the safety practices could maintain the
program as safe for flight. Potential causes for future
disasters should be constantly sought out while never
settling for a culture that begins to accept anomalies as
acceptable risk.
26.16.7 Recommendations
The CAIB report (CAIB, 2003) laid out 29 specific
recommendations that addressed many areas, from shuttle
Chapter | 26 Case Histories
operation to safety culture at NASA. In relation to shuttle
operation, they specify the development and implementation
of an inspection plan to be conducted before the shuttle’s
return flight and also call for the ability to image the shuttle’s
exterior in orbit to determine its ability for safe return.
Specific safety environment recommendations were
also included. Shuttle flight schedules should be realistic
and appropriate with available resources and the ability to
alter the schedule as the need arises.
26.17. DEEPWATER HORIZON
At approximately 9:49 p.m. on April 20, 2010, a cloud
of flammable hydrocarbons released from a US Gulf of
Mexico deepwater well encountered an unknown source
of ignition and caused two explosions in rapid succession
and a subsequent fire. The events that even now continue
to unfold uncover many underlying problems in the
process safety considerations for all involved parties.
The incident occurred on the Deepwater Horizon
mobile offshore drilling unit owned and operated by
Transocean located about 48 miles off the coast of
Louisiana. The lease was held by BP who contracted
Transocean to drill the well for their Macondo Prospect.
Eleven workers were killed in the explosion and a further
17 were injured. The fire that was caused by the explo-
sions burned for 36 h before the rig sank on April 22,
2010. The oil spill that resulted from the uncontrolled
wellbore flow incident developed into a matter of world-
wide interest as it became the largest oil spill to originate
in US waters in history.
26.17.1 The Companies
The companies generally considered to be directly
involved in the operations of the well are BP, the lessee
of the drilling area, and Transocean, the owner of
Deepwater Horizon and drilling contractor. Related par-
ties responsible for various parts of the drilling operations
include Halliburton, who was the cementer for the job,
and Cameron, the manufacturer of the blowout preventer.
Numerous other contractors in diverse fields had employ-
ees aboard at the time of the accident, including compa-
nies supporting other drilling operations, administrative
support, and housekeeping (USCG).
The drilling operations were designed by BP, but the
physical work of actually running the well was contracted
to Transocean, as is common practice (Presidential
Commission). These employees worked under the direc-
tion of two ‘Well Site Leaders’ provided by BP for guid-
ance and direction, as well as for communication with
onshore BP engineers.
499
26.17.2 The Site and the Works
The Macondo well was located in Mississippi Canyon
Block 252, about 48 miles off the coast of Louisiana. BP
jointly acquired the 10 year lease to this area in the cen-
tral Gulf of Mexico on March 19, 2008 from the Minerals
Management Service (MMS). BP owned 65% of the
lease, while Anadarko owned 25%, and MOEX Offshore
owned 10%. BP was the lease operator.
The Macondo well was an exploration well, as there
was promise of oil to be found below the surface;
however, BP had limited information about the geology, as
it was its first well on Block 252. The well was designed
to be completed into a production well in the case that
sufficient hydrocarbons were found to justify production.
The exploration plan for the lease was accepted by
MMS on April 6, 2009 and approved in revised form
10 days later. The drilling permit was approved by the
MMS on May 22, 2009. The semi-submersible drilling
unit Marianas was used to begin drilling the well in
October of 2009. In November of 2009, Hurricane Ida
caused extensive damage to Marianas and caused it to go
offline.
Deepwater Horizon was used as the substitute to the
damaged Marianas after the MMS approved a revised
drilling application for the well on January 14, 2010.
Deepwater Horizon had been a familiar drilling unit to
BP, who had leased it from Transocean for 9 years at the
beginning of the Macondo drilling project. It had been
used for approximately 30 drilling projects by BP, the
most recent before Macondo being the Kodiak appraisal
well, also off the coast of Louisiana in Mississippi Block
771 (SubseaIQ).1
26.17.3 Events Prior to the Explosions
BP initially estimated the cost of completion of the
Macondo well to be $96.2 million and the expected time
of completion was 51 days. At the time of the incident,
BP was $58 million over budget and 6 weeks behind
schedule. This situation likely contributed to decisions
made up to the day of the blowout that served to save
time and money perhaps in lieu of safety considerations.
26.17.4 Events Prior to April 19
Events that led to or foreshadowed the blowout began at
the time that Deepwater Horizon arrived at the site to
replace the damaged Marianas unit.
1 Information in sections 26.17.6 and 26.17.7 is primarily taken from the
various reports for the Deepwater Horizon incident; specifically, BP
(2010), Presidential Commission (2011), DNV (2011), and Transocean
(2011).
500
Yellow pod of BOP leaks: Problems with the blowout
preventer (BOP) itself began within the first month of
operation when on February 23 a pilot valve leak of
1 gpm was noticed on the yellow pod of the blowout
preventer. Operation was switched to the blue pod, and
leaking was reduced.
Original drill pipe sheared: A well control event
occurred on March 8 that caused the drill pipe to become
stuck in the formation and subsequently abandoned.
Lost circulation event: On April 9, at 18,198 ft below
sea level, much shallower than the objective depth of
20,200 ft, the pressure exerted by the drilling mud began
to damage the fragile formation.
Selection of long string casing: With the lost circulation
event, it was obvious that the original design objectives
for the casing had to be reevaluated to ensure that the
formation would be able to withstand future production
operations.
Selection of adequate number of centralizers: The
original design of the long-string casing was determined
to require 16 or more centralizers, while only 6 were
available from the supplier at the time. Further calcula-
tions and simulations after the decision between long-
string and liner showed that the well needed more than 6
centralizers and could even need as many as 21.
26.17.5 Events on April 19 and 20
The events beginning with the final casing run, completed
on April 19, and continuing through the cementing
process, pressure tests, and preparations for temporary
abandonment had a direct effect on the incident itself,
as problems began to compound.
Final casing run: The final casing run actually started
early on April 18, and was not completed until mid-
afternoon on April 19. The number of stabilizers used
was the aforementioned 6 as opposed to the recom-
mended 21.
Float collar: The final casing run was completed to a
terminal depth of 18,304 ft and the shoe track was fitted
with the float collar installed at the top and a reamer shoe
at the bottom. After the casing run was installed, nine
attempts were made to establish circulation. The final
attempt at establishing circulation was deemed successful
at a peak pressure of 3142 psi; however, this pressure was
far greater than the expected pressure from the manufac-
turer’s guidelines and BP’s procedures, which specified
500 700 psi at a fluid circulation rate of 5 8 barrels per
minute, which was also not attained.
The cement job: Cementing is figuratively regarded as
a combination of science and engineering with an element
of art. The engineering tells the engineer what properties
are needed for the cement to complete the objective,
while the science allows one to design the cement toward
Lees’ Process Safety Essentials
that end. However, in the end, the process of cementing
comes down to the art of running a blind operation that
depends on the prior science and engineering to succeed.
In cementing, the crew is not able to see the results of
the job, so it must rely upon well-designed procedures,
and testing to ascertain whether the job has been done
properly.
Preparing for temporary abandonment: The final plan
for temporary abandonment was not delivered to the rig
until the morning of the procedure, after it had already
begun. It included an abnormally large amount (425 bar-
rels, or twice the normal amount) of spacer to be used to
complete the displacement, which was formed from two
highly viscous water-based pills so that the pill material
could be discharged overboard legally instead of taken to
shore for disposal. It differed from the previous plans
in the ordering of events and the presence of a negative-
pressure test. As noted by BP, it did not include a formal
risk assessment of the annulus cement barriers, which
did not conform to their own guidelines and may have
identified problems with the cement job.
Pressure tests: Both positive- and negative-pressure
tests were carried out as a part of the procedure for tem-
porary abandonment. The positive-pressure test is meant
to examine the mechanical integrity of the casing under
pressure, while the negative-pressure test is designed to
ensure that the bottom-hole cement job can keep the
hydrocarbons from flowing out of the well.
Between the positive pressure test and the negative
pressure test, the sequence for temporary abandonment
was followed and the drill pipe was run into the ground
and the mud was displaced with seawater to a point
above the BOP. At about 5 p.m. the negative-pressure
test began.
The crew opened the bleed valve to initialize the pres-
sure to 0 psi, measured on the drill pipe. The procedure is
to bleed the line to 0 psi, close the valve, and check that
it stays at zero. However, for the first trial the pressure
normalized at between 240 and 266 psi and, furthermore,
when the crew closed the valve, it shot up to between
1250 and 1262 psi. The annular preventer was tightened
to stop a suspected leak that was causing the fluid level
in the riser to drop. When the line was bled again, 0 psi
was reached; however, when the well was shut in, once
again the pressure spiked, this time to 773 psi. One more
attempt was made, and once again the pressure fell to
zero and spiked when the valve was closed.
The results of these tests may have been explained
incorrectly (though Transocean disputes that this was ever
used as an explanation) by attributing the pressure to the
‘bladder effect’, where mud in the riser exerts pressure on
the annular preventer, which transfers to the drill pipe,
thereby giving incorrect readings. The crew decided to
carry out another negative-pressure test, but this time on
Chapter | 26 Case Histories
the kill-line where, they reasoned, there would be no
bladder effect.
The test was carried out on the kill line. After bleed-
ing the pressure down to 0 psi, the crew closed the valve
and waited for 30 min without observing any flow or
pressure change, though the pressure on the drill pipe was
still 1400 psi. The negative-pressure test was deemed a
success even though the difference in the pressures was
never explained. The validity of using the kill line as the
pressure monitor point is a point of dispute in the reports,
with Transocean saying that it was not valid and BP say-
ing it was valid, but the kill line may have been plugged
or a valve may have been left closed.
Mud displacement: When the negative-pressure test
was accepted, the next step was to displace the rest of the
drilling mud with seawater and then add the cement plug to
block off the well temporarily. The flow of hydrocarbons
into the wellbore was first restricted by the hydrostatic
pressure of the dense drilling mud on the formation,
but would be less restricted by the less dense seawater.
Theoretically, if the negative pressure test is correct, there
should be no flow from the formation into the well at this
point; if there is flow, it is called a kick and it indicates that
there is a serious problem with the integrity of the well.
When displacement activities commenced at about
8 p.m., all signs looked normal. The pressure in the
drill pipe was decreasing, as expected, and the mud was
being redirected to different holding tanks as necessary to
accommodate the volume coming in from the wellbore.
However, according to the Presidential Commission
report, as the operation went on, mud was also directed
from the sand traps and trip tank (though not simulta-
neously) to the holding tanks used for the displaced mud.
Because the holding tanks were being filled from several
locations at the same time, the measurement of the vol-
ume of displaced mud to check for a kick would have
been much more complicated or even impossible.
The well became underbalanced at about 8:52 p.m.,
meaning that the pressure exerted by the seawater and
mud could not balance the pressure of the fluids in the
formation, causing flow of hydrocarbons into the well-
bore. It was estimated that by 9:08, 39 barrels of fluid
from the formation had found its way into the mud being
displaced, but there was no indication that this was recog-
nized by the well crew. This has widely been attributed to
the distraction of preparing the next operation, the surface
plug. But before the addition of the surface plug, a sheen
test was performed.
Sheen test: At 9:08 p.m., the spacer fluid between the
drilling mud and the seawater displacing it was consid-
ered to have come to the top of the riser, and pumping
was shut down to conduct a sheen test, or an inspection
of the fluid to detect any free oil in the spacer before
discharging it to sea. The test itself only took about
501
6 min, but in the time it took to test the fluid, the pressure
in the drill pipe rose by 246 psi, indicating flow from the
underbalanced well. This is because the seawater initially
surrounding the drill pipe was being pushed up from
below by the remaining drilling mud below the pipe,
which, in turn, was being pushed up by the flowing
hydrocarbons from the pay zone.
It is not known why the pressure was not monitored
during the sheen test. At any rate, the pumps were
restarted at 9:14 p.m., obscuring the pressure data from
the well.
Displacement continues: The displacement was con-
tinued after the sheen test was deemed to be acceptable.
Flow was diverted overboard to discard the spacer, and
four pumps were turned on to displace the rest of the
fluid. However, one of the pumps was connected to the
kill line and this happened before the kill line valve was
open; at 9:18 p.m., pressure in the line rose to over
7000 psi and the emergency relief valve opened.
Three of the four pumps were taken off-line in order to
determine which had failed and to subsequently deal with
the repair. When the pump in need of repair had been
ascertained, it began to be repaired while the other two
came back on-line. This caused a normal and expected
increase in pressure, but within the next 5 min an unex-
pected increase in kill line pressure occurred.
Before the blowout: The increase in pressure was
not noticed until about 9:30 p.m., when it had reached
833 psi. The pumps were shut down to investigate this
anomaly, and the pressure fell accordingly. However,
after the initial fall, the pressure began to build back up.
Between 9:31 and 9:34, the pressure on the drill pipe
increased by approximately 560 psi and began to stabilize.
At this point, in an attempt to bleed the excess pressure,
a floorhand opened a drill pipe valve. The pressure was
relieved partially, but only momentarily before it crept up
again and stabilized, though at a slightly lower pressure
than initially. At this point, the well was producing
between 60 and 70 barrels per minute.
At roughly 9:38, the pressure in the drill pipe began to
drop at a constant rate, indicating that the hydrocarbons
were pushing through the annulus past the drilling mud
toward the top of the riser.
Influx of hydrocarbons: After the pressure drop, the
influx of hydrocarbon was just a matter of a short delay.
Between 9:40 and 9:43, the drilling mud displaced by the
hydrocarbons spewed onto the drilling floor. At 9:41 the
annular preventer of the BOP was activated and, though it
closed, failed to fully seal the well. The crew concurrently
decided to reroute the flow to the mud-gas separator to pre-
vent it from spilling on the drilling floor. Another option,
rerouting the fluid overboard, was not chosen.
Unfortunately, the mud-gas separator (MGS) was not
designed for such high flow rates, and was quickly
502
overwhelmed. The fluid being diverted soon began to
pour from its outlet lines. One minute after this event, at
about 9:47, natural gas from the well began to be vented
from the MGS through goosenecked vents that angled
flow back toward the surface of the platform. Gas alarms
sounded, but were not equipped to trip any equipment
that could be a source of ignition. Also at this time, the
crew activated the variable bore ram mechanism of the
BOP, which temporarily sealed the annulus.
This evasive action was too late. At 9:49, main power
generation engines started to overspeed. The rig lost
power. About 5 s later flammable gas ignited and the first
explosion occurred; only 10 s later another explosion
rocked the platform. 11 workers lost their lives in direct
conjunction with the explosions and subsequent fire.
26.17.6 Lessons from the Deepwater
Horizon Incident
Summarized below are a series of Lessons Learned based
on the four incident investigation reports. The incident
reports, in general, found very similar lessons to be
learned from Deepwater Horizon. Management and pro-
cedural problems were commonly cited as underlying
causes, but there were also many circumstantial causes
of the accident to learn from as well. No accident report
attributes the incident to a single root cause. Some causes
from which lessons can be learned developed over
extended amounts of time, such as the failure to update
engineering drawings and maintenance failures, while
other causes developed during a short duration leading up
to incident—for example, the decisions made based upon
test data (Table 26.14).
26.17.7 Impact
The Deepwater Horizon blowout, explosions and fire,
sinking, and oil spill gathered worldwide attention, not
only for the disaster itself, but for the sheer size and dura-
tion of the incident. It was the largest accidental marine
oil spill in the US history with impacts on the environ-
ment, economy, and regulations. Short term environmen-
tal impacts are easily inferred from the many reports and
images of shores and animals covered in oil from the gulf
coast, while various initiatives are assessing the long-term
impact. President Obama insisted that BP set up a $20
billion compensation fund, which was managed by a gov-
ernment official, to compensate those economically
impacted by the spill.
One of the early impacts on regulation was the reorga-
nization of the Minerals Management Service. In the
aftermath of the disaster, this reorganization was put into
Lees’ Process Safety Essentials
TABLE 26.14 Some Lessons from the Deepwater
Horizon Incident
Relative priority of safety and production
Management of change in drilling procedures
Review process
Lost time versus higher risk
Frequent changes
Management splitting and hierarchy in operations with more
than one company
Adequacy of and adherence to company procedures and
guidelines
Planning for an emergency
Training
Lessons learned from similar near-misses
Procedures for maintenance
Update of engineering drawings
Design of blowout preventer and automatic blowout
prevention system
Use of simulation data and other data-at-hand
Interpretation of test results
Identification of hazardous situations in a timely fashion
Design of offshore gas detection systems
Decision-making under stress
action and the MMS was rebranded as BOEMRE. This
reorganization would also lead to the establishment of the
Bureau of Ocean Energy Management, for the manage-
ment of leasing and permitting for energy resources, and
the Bureau of Safety and Environmental Enforcement,
which would be in charge of safety activities such as
inspections. The US government also put a temporary ban
on deepwater drilling, and issued new requirements for
all offshore drillwells. As part of this the voluntary API
SEMP program, is now required for offshore operations.
Yet to be determined are the long-term impacts of
Deepwater Horizon on the regulatory atmosphere of the
gulf and the exact impact that the disaster will have on
the parties in question.
ACRONYMS
ACMH Advisory Committee on Major Hazards
Chapter | 26 Case Histories 503

Amoco American Oil Company VCE vapor cloud explosion

API American Petroleum Institute VGS vent gas scrubber
ATSDR Agency for Toxic Substances and Disease Registry
BG British Gas REFERENCES
BLEVE boiling liquid expanding vapor explosion
BOEMRE Bureau of Ocean Energy Management, Regulation Assheton R., 1930. History of Explosions. Charles L. Storey Company
and Enforcement for Institute of Makers of Explosives, Wilmington, DL.
CAAA Clean Air Act Amendments Assini, J., 1974. Choosing welding fittings and flanges. Chem. Eng. 81
CCPS Center for Chemical Process Safety (September), 90
CIMAH Control of Industrial Major Accident Hazards ten Berge, W.F., 1985. The toxicity of methylisocyanate for rats.
Regulations 1984 J. Hazard. Mater. 12 (3), 309.
CISHC Chemical Industry Safety and Health Council Bhushan, B., Subramanian, A., 1985. Bhopal: what really happened?
CSB Chemical Safety and Hazard Investigation Board Business India February 25 March 10, 102.
DMV diaphragm motor valve Blake, E.S., Rappaport, E.N., Landsea, C.W., 2007. The Deadliest,
DNV Det Norske Veritas Costliest and Most Intense United States Tropical Cyclones from
EC European Community 1851 2006 (and Other Frequently Requested Hurricane Facts).
EIDAS Explosion Incidents Data Service NOAA, Technical Memorandum NWS-TPC-5, 43 pp.
EPA Environmental Protection Agency Bolton, L., 1978. What happened in Seveso. Chem. Eng. 85
HSE Health and Safety Executive (September), 104C.
HSEES Hazardous Substances Emergency Events Braun, R., Frilling, M., Schönbucher, A., 1999. Simulation of a reaction net-
Surveillance work in a semibatch reactor. Chem. Eng. Technol. 22 (11), 919 923.
ICFTU International Confederation of Free Trade Unions Browning, B., Searson, A.H., 1989. The lessons of the Thessaloniki oil
IChemE Institution of Chemical Engineers terminal fire. Loss Prevention and Safety Promotion 6, 39.1.
ICMESA Industrie Chimiche Meda Societa Azionara Buncefield major incident investigation board explosion mechanism
LNG liquefied natural gas advisory group report, 2006.
LPG liquefied petroleum gas Buncefield MIIB—Final Report, 2006. ,http://www.buncefieldinvestiga-
MARS Major Accident Reporting System tion.gov.uk/reports/index.htm#final/.. Access date: October 3, 2013.
MCA Manufacturing Chemists Association Burgess, D.S., Strasser, A., Grumer, J., 1961. Diffusive burning of liquid
MCC methylcarbamoyl chloride fuels in open trays. Fire Res. Abs. Rev. 3, 177.
MHIDAS Major Hazard Incidents Data Service Carpenter, S, Bennett, E, Peterson, G., 2006. Scenarios for ecosystem
MIC methyl isocyanate services: an overview. Ecol. Soc.29.
MMA Methyl Methacrylate Carson, P.A., Mumford, C.J., 1979. Analysis of incidents involving major
MOC Management of change hazards in the chemical industry. J. Hazards Mater. 3, 149 165.
MRS MIC refining still (Bhopal) Carson, P.A., Mumford, C.J., 2002. Hazardous Chemical Handbook. sec-
MSS MIC storage system ond ed. Elsevier, London.
NIHHS Notification of Installations Handling Hazardous Cattabeni, F., Cavallaro, A., Galli, G. (Eds.), 1978. Dioxin, Toxicological
Substances Regulations 1982 and Chemical Aspects. Halsted Press, New York, NY.
NTSB National Transportation Safety Board Comer, P.J., 1977. The dispersion of large-scale accidental releases such
NTSIP National Toxic Substance Incidents Program as Seveso. Royal Meteorological Society Meeting on Atmospheric
OECD Organization for Economic Cooperation and Surface Exchanges of Pollution, London.
Development Cox, R. A., Roe, D. R., 1977. A model of the dispersion of dense vapour
OSD Offshore Safety Division clouds. Loss Prevention and Safety Promotion 2, 359.
OSHA Occupational Safety and Health Administration Cruz, A.M., Krausmann, E, 2009. Hazardous-materials releases from
PHA process hazard analysis offshore oil and gas facilities and emergency response following
PVC polyvinyl chloride hurricanes Katrina and Rita. J. Loss Prev. Process Ind. 22,
PVH process vent header 59 65.
RIDDOR Reporting of Injuries, Diseases and Dangerous Cude, A.L., 1975. The generation, spread and decay of flammable vapour
Occurrences Regulations 1985 clouds. In: Course on Process Safety Theory and Practice,
RVVH relief valve vent header Department of Chemical Engineering, Teesside Polytechnic,
SRD Safety and Reliability Directorate Middlesbrough.
SRV safety relief valve Cullen, J., 1985. What can we learn from Pemex? Chem. Eng. (London).
TCB 1,2,4,5-tetrachlorobenzene 418, 21.
TCDD TCDD 2,3,7,8-tetrachlorodibenzo-p-dioxin Davenport, J.A., 1987. Gas plant and fuel handling facilities: an insurer’s
TCP 2,4,5-trichlorophenol view. Plant/Operations Prog. 6, 199.
TNO Toegepast-Natuurwetenschappelijk Onderzoek Davis, L.N., 1979. Frozen Fire. Friends of the Earth, San Francisco, CA.
TNT trinitrotoluene Doyle, W.H., 1969. Industrial explosions and insurance. Loss Prev. 3, 11.
UCC Union Carbide Corporation Doyle, W.H., 1972a. Instrument connected losses in the CPI. Instrum.
UCIL Union Carbide India Ltd Technol. 19 (10), 38.
504
Doyle, W.H., 1972b. Some major instrument-connected CPI losses.
Instrumentation in the Chemical and Process Industries 8. Instrument
Society of America, Pittsburgh, PA.
Dyfed County Fire Brigade, 1983. Report of the Investigation into the
Fire at Amoco Refinery August 30, Carmarthen, Dyfed.
Eisenberg, N.A., Lynch, C.J., Breeding, R.J., 1975. Vulnerability Model:
A Simulation System for Assessing Damage Resulting from Marine
Spills. Rep. CG-D-136 75. Enviro Control Inc., Rockville, MD.
Fauske, H.K., 1964. The discharge of saturated water through tubes.
Seventh National Heat Transfer Conference. American Institute of
Chemical Engineers, New York, p. 210.
Gant, S., Atkinson, G., 2006. Buncefield Investigation: Dispersion of the
Vapour Cloud Health and Safety Laboratory Report, CM/06/13.
Glasstone, S., 1964. The Effects of Nuclear Weapons. Atomic Energy
Commission, Washington, DC.
Gugan, K., 1979. Unconfined Vapour Cloud Explosions. Institution of
Chemical Engineers, Rugby.
Haastrup, P., Brockhoff, L., 1990. Severity of accidents with hazardous
materials. A comparison between transportation and fixed installa-
tions. J. Loss Prev. Process Ind. 3 (4), 395.
Haastrup, P., Brockhoff, L.H., 1991. Reliability of accident case histories
concerning hazardous chemicals. An analysis of uncertainty and
quality aspects. J. Hazard. Mater. 27, 339.
Hagon, D.O., 1986. Pemex (letter). Chem. Eng. (London). 421, 3.
Ham, B., 2005, A review of spontaneous combustion incidents. In: Aziz, N.
(Ed.), Coal 2005: Coal Operators’ Conference, University of
Wollongong & the Australasian Institute of Mining and Metallurgy, pp.
237 242.
Harvey, B.H., 1976. First Report of the Advisory Committee on Major
Hazards. HM Stationery Office, London.
Harvey, B.H., 1979. Second Report of the Advisory Committee on
Major Hazards. HM Stationery Office, London.
Harvey, B.H., 1984. Third Report of the Advisory Committee on Major
Hazards. HM Stationery Office, London.
Hay, A., 1976a. Seveso: the aftermath. Nature. 263, 537.
Hay, A., 1976b. Seveso: dioxin damage. Nature. 266, 7.
Hay, A., 1976c. Seveso: seven months on. Nature. 265, 490.
Hay, A., 1976d. Seveso: solicitude. Nature. 266, 384.
Hay, A., 1976e. Toxic cloud over Seveso. Nature. 262 (August), 636.
Hay, A., 1981. Seveso: the intrigue and the infighting. Nature. 290
(March), 71.
Hay, A., 1982. The Chemical Scythe. Lessons of 2,4,5-T and Dioxin.
Plenum Press, New York, NY.
Health and Safety Executive (HSE), 1978. Canvey: An Investigation of
Potential Hazards from Operations in the Canvey Island/Thurrock
Area. HM Stationery OfficeHSE), 1978, London.
Health and Safety Executive (HSE), 1981. Canvey: A Second Report.
A Review of the Potential Hazards from Operations in the Canvey
Island/Thurrock Area Three Years After Publication of the Canvey
Report. HM Stationery OfficeHSE), 1981, London.
Health and Safety Executive (HSE), 1989. The Fires and Explosion at
BP Oil (Grangemouth) Refinery Ltd. HM Stationery OfficeHSE),
1989, London.
High, R.W., 1968. The Saturn fireball. Ann. N.Y. Acad. Sci. 152 (Art.
1), 441.
Howard, W.B., 1985. Seveso: cause-prevention. Plant/Operations Prog.
4, 103.
Kaiser, M.J., Pulsipher, A.G., 2007. Generalized functional models
for drilling cost estimation. SPE Drill Compl. 22 (2), 67 73,
SPE-98401-PA.
Lees’ Process Safety Essentials
Kessler, R.C., Galea, S., Gruber, M.J., Sampson, N.A., Ursano, R.J.,
Wessely, S., 2008. Trends in mental illness and suicidality after
Hurricane Katrina. Mol. Psychiatry. 13, 374 384. Available from:
http://dx.doi.org/10.1038/sj.mp.4002119.
Kier, B., Muller, G., 1983. Handbuch Störfalle. Erich Schmidt, Berlin.
Kimbrough, R., Krouskas, C.A., Carson, M.L., Long, T.F., Bevan, C.,
Tardiff, R.G., 2010. Human uptake of persistent chemicals from con-
taminated soil: PCDD/Fs and PCBs. Regul. Toxicol. Pharmacol. 57,
43 54.
Kimmerle, G., Eben, A., 1964. On the toxicity of methyl isocyanate and
its quantitative determination in air. Arch. Toxikol. 29, 235.
Kletz, T., 2003. Still Going Wrong!: Case Histories of Process Plant
Disasters and How They Could Have Been Avoided. Butterworth-
Heinemann publications, Burlington MA 01803, USA.
Kletz, T., 2009. What Went Wrong: Case Histories of Process Plant
Disasters and How They Could Have Been Avoided. fifth ed
Butterworth-Heinemann publications, Burlington MA 01803, USA.
Kletz, T.A., 1986. Accident reports and missing recommendations. Loss
Prev. Safety Promot. 5, 201.
Kletz, T.A., 1988. Learning from Accidents in Industry. Butterworths,
London.
Kletz, T.A., 1990. Critical Aspects of Safety and Loss Prevention.
Butterworth, London.
Kletz, T.A., 1993. Lessons from Disaster: How Organizations Have No
Memory and Accidents Recur. Gulf Professional Publishing, UK.
Kletz, T.A., 2001a. An Engineer’s View of Human Error. third ed.
Institution of Chemical Engineers, Rugby.
Kletz, T.A., 2001b. Learning from Accidents. third ed. Butterworth-
Heinemann, Oxford, UK and Woburn, MA.
Kletz, T.A. 2001c. Some problems and opportunities that have been
overlooked. Proceedings of the Mary Kay O’Connor Process Saf.
Cent. Annu. Symp. College Station,Texas.
Knabb, R.D., Rhome, J.R., Brown, D.P., 2006. Tropical cyclone report,
Hurricane Katrina, 23 30, August 2005. National Hurricane
Center, 43 pp. Available online at http://www.nhc.noaa.gov/pdf/
TCRAL122005_Katrina.pdf.
Krausmann, E., Cruz, A.M., 2008. Natech disaster: when natural
hazards trigger technological accidents. Spec. Issue Nat. Hazards. 46
(2).
Lees, F.P., 1976. The reliability of instrumentation. Chem. Ind. March, 195.
Lees, F.P., 1980. Loss Prevention in the Process Industries, vol. 12.
Butterworths, London.
Lenoir, E.M., Davenport, J.A., 1993. A survey of vapor cloud explo-
sions: second update. Process Saf. Prog. 12 (1), 12-33.
Lewis, D.J., 1980. Unconfined vapour cloud explosions: historical per-
spective and predictive method based on incident record. Prog.
Energy Combust. Sci. 6, 151.
Litman, T., 2006. Lessons from Katrina and Rita: what major disasters
can teach transportation planners. J. Trans. Eng. 132, 11 18.
Available online at: http://scitation.aip.org/teo; http://www.vtpi.org/
katrina.pdf.
Mcguire, J.H., 1953. Heat Transfer by Radiation. Fire Research Special
Report 2. HM Stationery Office, London.
Mahoney, D.G., 1990. Large Property Damage Losses in the
Hydrocarbon-Chemical Industries: A Thirty-Year Review. thirteenth
ed. M&M Protection Consultants, New York, NY.
Manich, O., 2008. Disenö de las bases de una logı́stica aplicada a desas-
tres y catástrofes en el ámbito de la Provincia de Barcelona. Anexo
D. Department de Projected d’Enginyeria. Universitat Politècnica de
Catalunya. Spain.
Chapter | 26 Case Histories
Mannan, M.S., et al., 2009. Analysis of the Buncefield oil depot explo-
sion: explosion modeling and process safety perspective. Proceedings
of the Mary Kay O’Connor 2009 International Symposium.
Mannan, M.S., 2011. The Buncefield explosion and fire lessons learned.
Proc. Safety Prog. 30, 138 142. Available from: http://dx.doi.org/
10.1002/prs.10444.
Mansot, J., 1989. Incendie du Depot Shell du Port Edouard Herriot a’ Lyon
les 2 et 3 Juin 1987. Loss Prevention and Safety Promotion 6, 41.1.
Margerison, T., Wallace, M., Hallenstein, D., 1980. The Superpoison.
Macmillan, London.
Marshall, V.C., 1980. Seveso, an analysis of the official report. Chem.
Eng. (London). 358, 499.
Marshall, V.C., 1987. Major Chemical Hazards. Ellis Horwood,
Chichester.
Nash, J.R., 1976. Darkest Hours. Nelson Hall, Chicago, IL.
Occupational Safety and Health Administration (OSHA), 1990. Phillips
66 Company Houston Chemical Complex Explosion and Fire.
OHSAOSHA), 1990, Washington, DC.
Ooms, G., Mahieu, A.P., Zelis, F., 1974. The plume path of vent gases
heavier than air. Loss Prevention and Safety Promotion 1, 211.
Opschoor, G., 1978. Rep. 78-0834. TNO, Apeldoorn.
Orsini, B., 1977. Parliamentary Commission of Inquiry on the Escape of
Toxic Substances on July 10, 1976 at the ICMESA Establishment
and the Consequent Potential Dangers to Health and the
Environment due to Industrial Activity. Final Report, Rome.
Orsini, B., 1980. Seveso (Translation of Official Italian Report by
Health and Safety Executive). Health and Safety Executive, London.
Parker, R.J., 1975. The Flixborough Disaster. Report of the Court of
Inquiry. HM Stationery Office, London.
Pasquill, F., 1943. Evaporation from a plane free-liquid surface into a
turbulent air stream. Proc. R. Soc. Ser. A 182, 75.
Pesatori, A.C., Baccarelli, A., Consonni, D., Lania, A., Beck-Peccoz, P.,
Bertazzi, P.A., et al., 2008. Aryl hydrocarbon receptor-interacting
protein and pituitary adenomas: a population-based study on subjects
exposed to dioxin after the Seveso, Italy, accident. Eur. J. Endocrinol.
159, 699 703.
Pesatori, A.C., Consonni, D., Bachetti, S., Zocchetti, C., Bonzini, M.,
Baccarelli, A., et al., 2003. Short- and long-term morbidity and
mortality in the population exposed to dioxin after the Seveso
accident. Industrial Health. 41, 127 138.
Pietersen, C.M., 1985. Analysis of the LPG Incident in San Juan
Ixhuatepec, Mexico City, November 19, 1984. Rep. 85-0222. TNO,
Apeldoorn, the Netherlands.
Pietersen, C.M., 1986a. Analysis of the LPG disaster in Mexico City,
November 19, 1984. Gastech. 85, 112.
Pietersen, C.M., 1986b. Analysis of the LPG disaster in Mexico City.
Loss Prevention and Safety Promotion. 5, 21 31.
Pietersen, C.M., 1988. Analysis of the LPG-disaster in Mexico City.
J. Hazard. Mater. 20, 85.
Powell, T. 2006. The Buncefield Investigation: Third Progress Report.
Report prepared for the Buncefield Major Incident Investigation by
the Health and Safety Executive (HSE) and the Environmental
Agency (EA).
Redmond, T.C., 1990. Piper Alpha AU: 176 the cost of the lessons.
Piper Alpha: Lessons for Life Cycle Management. Institution of
Chemical Engineers, Ruby, 113 p.
Rein, R.G., Sliepcevich, C.M., Welker, J.R., 1970. Radiation view fac-
tors for tilted cylinders. J. Fire Flammability 1, 140.
505
Rice, A.P., 1982. Seveso accident: dioxin. In: Hazardous Materials
Spills Handbook, G. F. Bennett, F. S. Feates, and I. Wilder, eds.,
McGraw-Hill, New York, 11 44.
Richardson, J., Ham, B.W., 1996. Incidence of spontaneous combustion
in Queensland underground coal mines. Department of Mines and
Energy Internal Report.
Richardson, T., 1991. Learn from the Phillips explosion. Hydrocarbon
Process. 70 (3), 83.
Rijnmond Public Authority, 1982. Risk Analysis of Six Potentially
Hazardous Industrial Objects in the Rijnmond Area: A Pilot Study.
Springer.
Riley, R.V., 1979. Accidents with pipelines in the USA: selected
case histories and a review of the activities of the National
Transportation Safety Board. Third International Conference
on Internal and External Protection of Pipes. British
Hydromechanics Research Association, Cranfield,
Bedfordshire.
Sambeth, J., 1983. What really happened at Seveso. Chem. Eng. 90
(May), 44.
Sanders, R.E., 2008. Hurricane Rita: an unwelcome visitor to PPG
industries in Lake Charles, Louisiana. J. Hazard. Mater. 159 (1),
58 60.
Santella, N., Steinberg, L.J., Sengul, H., 2010. Petroleum and hazardous
material releases from industrial facilities associated with hurricane
Katrina. Risk Analyis. 30 (4), 635 649, Published Online: March
16, 2010.
Scott, J.N., 1992. Succeeding at emergency response. Chem. Eng. Prog.
88 (12), 62.
Skandia International, 1985. BLEVE! The Tragedy of San Juanico. First
2 (November).
Shaw, P. and Briscoe, F. (1978) Evaporation from spills of hazardous
liquids. UKAEA, SRD R100, Risley, UK, May 1978, p333. In
Marshall, V.C. (1987) Major Chemical Hazards. Ellis Horwood Ltd,
ISBN 085312969X.
Slater, D.H., 1978. Vapour clouds. Chem. Ind. 6 (May), 295.
Theofanous, T.G., 1981. A physicochemical mechanism for the ignition
of the Seveso accident. Nature. 291 (June), 640.
Theofanous, T.G., 1983. The physicochemical origins of the Seveso
accident. Chem. Eng. Sci. 38 (1615), 1631.
Thomas, P.H., 1963. The size of flames from natural fires. Combustion
9, 844.
Thomas, P.H., 1965. Fire Spread in Wooden Cribs, Part III: the Effect
of Wind. Fire Res. Note 600. Fire Research Station,
Borehamwood.
Union Carbide Corporation, 1985. Bhopal methyl isocyanate incident.
Investigation Team Report. Danbury, CT.
University Engineers Inc., 1974. An Experimental Study on the
Mitigation of Flammable Vapor Dispersion and Fire
Hazards Immediately Following LNG Spills on Land. AGA
Proj. IS-100-1
Vervalin, C.H. (Ed.), 1964. Fire Protection Manual for Hydrocarbon
Processing Plants. Gulf, Houston, TX.
Vervalin, C.H., 1973. Fire Protection Manual for Hydrocarbon
Processing Plants. second ed. Gulf, Houston, TX.
Wilkinson, N.B., 1966. Explosions in History. The Hagley Museum,
Wilmington, DE.
Wiekema, B.J., 1980. Vapour cloud explosion model. J. Haz. Materials
3 (3), 221.