Industrial Accidents 2.1 Accidents
2.4 The Importance of Accidents
2.4.3 Flixborough Disaster
cannot be considered as the root cause for them. The acknowledge of the principles of loss prevention, reversely of what happened in this case, would certainly avoid the occurrence of such a sad event.
The necessity to have a coordinated emergency plan between the company and the local authorities is another issue, showing the necessity for a better management of those services, as well as
encouraging the local legislator in promoting regulations to favour the cooperation, the identification of hazards and their possible
consequences.
The Bhopal incident has been an occasion to rethink about the safety measures too. The ones put in place at the Bhopal plant (like the
scrubber and the flare system) were too near the top event. This means that if they fail (as they actually did), there is nothing to fall back on.
To prevent the recurrence of a similar incident, safety measures need to be taken starting from the bottom of the chain, that is to say from the root causes which are apparently far too close to the top event like managerial decisions.
pipe. Consequentially, a significant quantity of cyclohexane leaked and formed a flammable mixture which then found a source of ignition. At 16:53, an enormous VCE (Vapor Cloud Explosion) occurred, causing significant damages and starting several other fires on the site. The serious structural damages in the control room caused the death of 18 people. After ten days, some fires were still active, impeding the rescue activities.
Figure 2.35 Arrangement of reactors and temporary bypass.
Source: Adapted from [37]. Reproduced with permission.
The incident investigation showed a series of failings in technical measures [42]:
The integrity of the bypass line was evaluated on the basis of limited calculations;
no drawings of the proposed modification were produced;
the installed pipework modification was not tested to pressure;
the position of occupied buildings did not consider the consequence of a major instantaneous disaster;
the structural design of the control room was not robust enough to resist against major events; and
the incident happened during the startup phase, in a stressful context with a high number of critical decisions to be made.
The UK government, as usually happens for those major events, set up not only an investigation to understand the immediate causes, but also
a special committee to discover the deeper causes of the explosion [37], in order to avoid the recurrence of similar major incidents.
The main reaction in the Flixborough plant, during the normal process, was the oxidisation of cyclohexane with air to a
ketone/alcohol mixture. In order to avoid the production of unwanted products, the reaction was slow, so a high quantity of cyclohexane was stored in the plant (about 400 tons). The reaction took place in six reactors, each containing 20 tons.
The bypass pipe was not straight, but it had two bends to allow the overflowing of the liquid from one reactor to another (for the same reason, reactors were placed at a different height). The bypass pipe was 20 inches diameter while the bellows were 28 inches. The design, construction and installation of the bypass were carried out by two men charged with these tasks. They were men of great experience, but not professionally qualified to design a bypass pipeline and its
supports. Two months after their installation, a slight increase in pressure occurred, causing the temporary pipe to twist. However, the increased pressure was too low to activate the relief valve. There are still different hypotheses about the triggering event that produced the small increase in pressure [37], like the stop in the agitation of reactor no. 4 causing a layer of water to vaporise during the heating startup phase. The resulting bending moment tore the bellows, creating two 28 inch holes. The cyclohexane, at a pressure of 10 bar, was at the temperature of 150°C, above its boiling point (81°C). Consequentially, a massive leak occurred as the pressure was reduced. About 30–50 tons leaked in 50 seconds, then a source of ignition (probably a furnace) was reached and the explosion occurred (Figure 2.36).
Figure 2.36 The chemical plant in Flixborough after the incident.
This incident has great lessons to provide. The most important one concerns the reduction of inventory. The smaller the inventory, the less the leakage. This observation, so simple, was ignored in the
official report and in the majority of the papers that were produced on the subject. It repeats the concept already expressed in the previous Paragraph: what you do not have, cannot leak. Reducing inventory is a design approach that results in cheaper as well as safer plants. They are cheaper because less protective equipment is needed, with lower direct (purchase) and indirect (test and maintenance) costs.
Flixborough incident shows how the inventory reduction is desirable, especially for flashing flammable or toxic liquids. It is an approach guiding towards inherently safer plants, even if it consumes more time during the early stages of the design, in parallel with HAZOP sessions involving Health Safety and Environment experts since the conceptual stage. Several papers demonstrate that at Flixborough, the inventory reduction was possible. The interested reader may find additional information on [37].
The control of the process and the plant modifications are other key lessons. No changes should be made without the formal authorization of a professionally qualified manager who can help in identifying all the possible consequences of the proposed modification. Moreover, an inspection should be carried out once the modification is complete, to check its technical compliance with state of the art. In addition, a checklist should also be provided to help the identification of the possible consequences and a training program needed to educate people to the Management Of Change (MOC).
Flixborough shows us also the importance of qualifications.
Undoubtedly, having practical experience is highly desirable but it is not sufficient to ensure a proper design of the bypass pipeline.
Obviously, this book does not intend to find culprits, but also to understand how to prevent the recurrence of similar events. Having this concept always in mind, this lesson learnt can be summarised as an invitation to look at your own capabilities and check if they cover the task you have been charged for.
Also, the preference for robust equipment clearly emerges from the lessons learnt from this incident: flexible hoses and bellows are inevitably a weak link and they should be avoided when hazardous materials are used.
Some considerations about the plant layout and locations can be also made. Even if it is highly probable that a leakage of the size of the one occurred at Flixborough ignites, there is a chance to prevent it if the plant layout is designed so as to minimise the chance of reaching a source of ignition. Moreover, other aspects of design concern also the structural design of the control room and, in general, of the buildings occupied by people. Indeed, the risk level of an event depends also on its magnitude and the number of people potentially affected by the incident is a key parameter in this context. Basically, following the principles that “what you do not have, cannot leak”, the best solution is to not have people within the boundaries of a potential incident. No people, no victims. Also, emergency operations should be performed remotely, in a safe location. This concept also applies outside the
boundaries of the plant site. It therefore becomes important to provide proper tools to govern the territory nearby a chemical plant handling
hazardous materials, in cooperation with the local authorities having jurisdiction (as Seveso Directive imposes). It is a preventive strategy and it should be preferred. If, for space availability or control
necessity, it is a requirement to have people nearby the potential
incidental area, then a robust structural design needs to be pursued. It is a protective strategy.
After the Flixborough events, a number of papers were written about the behavior of large leaks, under various wind and weather
conditions. Only a few papers were written on the reasons for large leaks and the actions required to prevent them. This happened
because large leaks, being also occasional, were considered inevitable.
We know that this is not true. Having observed how large leaks are caused by pipe failures, the most effective action to prevent them is to follow the piping design strictly, and to test and maintain them after construction.
Just like the Bhopal plant, the Flixborough plant was also jointly owned. It becomes therefore crucial to clarify the responsibilities of the joint venture's members, regarding safety, design and operations, to avoid a misleading tasks assignment.
The plant was then rebuilt, with a different process to manufacture cyclohexanol: it was made by the hydrogenation of phenol instead of oxidizing the cyclohexane. The process, however, is as hazardous as the previous one and it was not carried out in Flixborough but
elsewhere: the risks were only exported, not really diminished. The rebuilt plant was then closed after a few years for commercial reasons.