01/11/2011

Flixborough (UK) 1974

David Slater

Overview
The Events The Explosions The Sequence Bow Ties External influences Underlying Causes Lessons Phenomenology and Institutional
Flixborough 2

11/1/2011

01/11/2011

The Event
June 1st 1974, a major explosion and fire destroyed the Nypro Plant at Flixborough. On site 28 were killed and 36 injured. Offsite, 53 casualties, ~2000 houses, ~200 shops and factories damaged- 100 million bill) Court of Inquiry, Factory Inspectorate conflicted, Cremer and Warner led Investigation for the Court. Led directly to the development and application of Risk Analysis as a formal procedure for Major Hazard Installations(by Dutch and Norwegians)
11/1/2011 Flixborough 3

The NYPRO Plant

11/1/2011

Flixborough

01/11/2011

The Process
Dutch State Mines and the Coal Board built a Nylon 66 Plant on the site of an old fertiliser complex at Flixborough. Designed and built by Simon Carves. Conventional low temperature, liquid, catalytic oxidation of cyclohexane to cyclohexanone, which was further processed to caprolactam, the Nylon 66 monomer. Relatively inefficient conversion meant a continuous circulation of some 200 tons of C6 thro 6 cascade reactors of ~25 tons in a stepped sequential arrangement
11/1/2011 Flixborough 5

Bowtie
Everything leading up to the accident Everything following the Accident

Accident Causes

Fault-tree
11/1/2011 Flixborough

Event-tree
6

Damage

01/11/2011

Time Line 1
March 27th Cracks discovered in the mild steel casing of Reactor 5. Construction of mild steel outer with bonded stainless steel inner meant integrity was possibly impaired and reactor lifted out of the line. A temporary connection (dog legged to allow for step change) was fabricated to enable the circulation to continue. Tested cold to process, but not relief valve pressure. April 1st, plant restarted normally and dog leg subsequently lagged. Mid May Plant Inspected

11/1/2011

Flixborough

Missing Reactor
Bridged by by-pass

11/1/2011

Flixborough

01/11/2011

Time Line 2
May 29th more leaks caused the plant to be shut down for repair and maintenance. Preparations for restart over coming weekend modified as there is insufficient Nitrogen supplies to use as inerting medium. Water alternative adopted, not unusual. June 1st Plant loop now charged with C6 being warmed up to process Temperature(160 C) and pressure (120 psi).
11/1/2011 Flixborough 9

Consequences Site wide Fire many days duration Excavation of debris to recover casualties Factory Inspectorate not formally involved (post Aberfan,Robens,etc) Unsecured site briefly, expert free access, contaminated? Dog leg connection found ruptured Widespread evidence of low overpressure as well as fire damage.
11/1/2011

The Event

Flixborough

10

01/11/2011

Explosion(s)
Major overpressure event recorded by glider altimeter, ionospheric layer monitoring, surrounding property damage, smashed windows etc. TNT equivalent model not useful, particularly near field. Dog leg consequences estimated by simulation(wind tunnel and modelling). Two offset, opposed 28 jets of some 200tons of 2 phase, flashing superheated cyclohexane. Predicts highly turbulent vapour cloud with some 10-20 tons of hydrocarbon in the flammable range. A credible ignition source identified as the nearby Hydrogen Reformer. 11/1/2011 Flixborough

11

Reconstruction
Laboratory set up based on this Geometry Heated to Process Temperatures

Hydraulically pressurised Strain and displacement monitored.

01/11/2011

The Failure
The temporary dogleg by-pass was reconstructed in laboratory conditions, instrumented and tested to destruction; using water for safety considerations. At process parameters it was borderline stable/ unstable. A small increase in pressure caused explosive geometric change and hydraulic failure (Squirming) Full of superheated fluid, a rupturing bellows would have caused an explosive release of PV energy. (Explosion 2) Identified in both glider and scattering records
11/1/2011 Flixborough 13

Ionospheric Disturbances

11/1/2011

Flixborough

14

01/11/2011

Causes
Explosion 1/Fire destroyed control room logs Previous start up logs using water inerting show significant sharp pressure surges on approaching start up conditions. As immiscible liquids, water could form pools in the bottom of the lager process vessels. On bump boiling, these would cause the overpressure events seen in the historical logs. (cf aged LNG, BLEVES etc.) Excess Enthalpy Explosion 3 -always assumed in the investigation, not emphasised in the report as the court felt the instability was such as actual initiation was speculative and inevitable.
11/1/2011 Flixborough 15

Buckling Forces

Bellows will squirm even if linear

11/1/2011

Flixborough

16

01/11/2011

Accident Sequence

Accident Causes

Fault-tree
11/1/2011

Event-tree
Flixborough 17

Analysis
Temporary by pass was unstable unrevealed fatal condition 1. (Aneurism) Using water in start up would provide pressure surges above normal parameters. (unappreciated fatal condition 2) Timing of failure to coincide with critical process temperature and pressure (Fatal precondition 3) Expected bump boiling phase reached in start up is independent corroboration of likely initiating mechanism (Trigger Event). Damage and dispersion patterns confirm the consequences as a large Unconfined Vapour Cloud Explosion.
11/1/2011 Flixborough 18

Damage

01/11/2011

ICAM2
Basic Causes Barriers

External

Accimap

Failure

Defences

INCIDENT

Recovery

Market pressure for Production

Professional Bodies aquiescent

Risk Analysis not available

No Requirements

No previous records of UCVEs

Salvation Army fed the troops!

Regulatory

Plant passed inspection

Factory Inspectors hard hats and toetectors

Optional

No requirement other than Fire Site exceeded storage Licence

No experience of assessing these types of Risks

Emergency Services no Knowledge of Plant

Organisational

Pressure to show plant performance Maintenance complete

Management of Resources

Coal Industry Management unaware

Company relying on Designers

Weekend

No emergy evacuation procedures or exercises

Conscientious, tight knit artisan workforce happy to proceed

No Qualified Ch.Engineers

Practical confident workforce

Not expecting problems

Control Room destroyed

Unprepared for this Event all on site resource destroyed

Environmental Individual/Task

Team

Plant Restart

Floating Bellows

Water Purge

Design check/ Hazop of change

By Pass Failure

Supervion Procedures

Plant Layout

Fire sup pres sion

15 t UVCE

Uncontrolled Plant Fire 28 dead 98 injured 100m Damage

Previous Success

No N2 for inerting

Glider/ Scatter record

TV Soccer Weekend Shifts

11/1/2011

Flixborough

Glider/ Scatter record

19

Lessons
Competences of Operators Design and Layout of Hazardous Plant Management of Change Specialist Inspectors Science of UCVEs including Flame acceleration models,turbulence, 2 phase, effect of obstacles, semi confinement.overpressure prediction, etc.. 11/1/2011 Flixborough

20

10

01/11/2011

Other Theories
Inquiry findings have potentially damaging and liability considerations for involved parties. 6 sets of QC/ Counsel/ Experts/ Consultants arraigned in adversarial setting to protect owners, designers, operators, etc. Overriding imperative to find alternative user friendly scenarios. Many still rumbling, although some of the wilder overpressure analyses have quietly been dropped. In a legal world ,Occams Razor is a powerful way of distinguishing between convoluted options But the other branches of the event Bow Ties can and should legitimately be added in a complete risk analysis.
11/1/2011 Flixborough 21

Insights
Pragmatic definition of VulnerabilityPropensity to loss of control (i.e. Left Hand Side of Bow Tie) And Resilience Effectiveness and depth of Defences (i.e. Right Hand Side of Bow Tie) 11/1/2011

Cause Cause Cause Cause Cause

Consequence Consequence Consequence Consequence Consequence Primary Barriers Consequence

Loss of Control

Secondary Barriers Threat Threat Threat

Flixborough

22

11

01/11/2011

Insight/Hindsight -An Integrated Safety Management System?

11/1/2011

Flixborough

23

Hindsight
Flashing champagne jets plus Joule Thompson adiabatic cooling meant Two phase cloud. At the time all models assumed gaseous phase propagation If droplets analogous to particles (miniature Bleves i.e.- fuel rich) cyclic -C6 combustion- ideal for soot formation) Incandescent soot particles act as Dust Cloud not Gas cloud Radiative Flame accelerations now possible Likely Flixborough was a two phase 11/1/2011 Flixborough explosion?

What could we have done better?- Explosion

24

12

01/11/2011

Hindsight/ What did we learn?

Never Again?

11/1/2011

Flixborough

26

13