3. The Need for Process Safety
3.5 Hazard Identification and Risk Assessment: Esso Longford Gas Plant
3.4.4 Key Lessons
Process Knowledge Management (Section 2.7). Although management in CSI learned of the hazards of HA during pilot plant operation, the knowledge was not used in the design of the process, or in the hazard reviews that were conducted.
CSI also did not review available literature about HA, which also would have shown that HA is subject to exothermic decomposition and had an explosive force equivalent to TNT. Nor did CSI attempt to do any testing to define the magnitude of the hazard of HA. Finally, CSI did not create engineering drawings or detailed operating procedures.
Hazard Identification and Risk Analysis (Section 2.8). Hazard review methodologies need to be appropriate to the hazards being managed. CSI used a
“What-If” review which was reported in a one page document. The hazard review did not address the “prevention or consequences of events that could have triggered an explosion of high concentrations of HA”. (CSB, 2002). CSI did not implement any of the recommendations from the hazard review they did conduct.
Post-Script. In June 2010 an explosion occurred in a Nissin Chemical Company plant that produced 50 wt. % HA. That explosion destroyed the distillation tower, killed four people and injured 58. The HA concentration at the time was 85 wt. %.
3.4.5 References and links to Investigation Reports
U.S. Chemical Safety and Hazard Investigation Board, Case Study, Report No. 1999-13-C-PA, The Explosion at Concept Sciences: Hazards of Hydroxylamine, Concept Sciences, Hanover Township, PA. February 19, 1999. (http://www.csb.gov/investigations).
3.5 Hazard Identification and Risk Assessment: Esso
3.5.2 Detailed Description
The plant involved, Plant No. 1, was a lean oil absorption plant, which separated methane from LPG by stripping the incoming gas with a hydrocarbon stream called “lean oil”. Methane rises to the top of the towers, with heavier hydrocarbons dissolving in the liquid hydrocarbon condensate, see Figure 3.10.
Plant No. 1 had a pair of absorbers operating in parallel. Each absorber had a gas/liquid disengaging region at the base where a mixture of gas and liquid hydrocarbons entered the absorbers. During the previous night shift, the hydrocarbon condensate level had started to increase in the base of Absorber B. As the normal disposal of condensate to Gas Plant No. 2 was not available, the alternative condensate disposal route was to a Condensate Flash Tank, see Figure 3.11. Under this set of circumstances, it was normal to increase the temperature at the base of the absorber, but this was not done. The inlet to the Condensate Flash Tank was protected against excessively low temperatures by an override on the absorber level controllers. The consequence, therefore, was that the disposal rate of condensate from the absorber became less than the inlet flow, resulting in a buildup of liquid condensate in the absorber base.
Figure 3.10. Simplified schematic of absorber, (CCPS, 2008).
Figure 3.11. Simplified schematic of the gas plant (CCPS, 2008).
The condensate level rose in the absorber to a point where it mixed with the exiting rich stripping oil stream. Condensate mixed with rich oil flashed over the rich oil level control valve resulting in a much reduced temperature in the downstream Rich Oil Flash Tank. This caused temperatures to drop across the plant as rich oil flowed through the recovery process where hydrocarbons were stripped from the rich oil before returning it to the absorbers as lean oil.
Eventually, the lean oil pumps tripped out, causing major thermal excursions on a plant with a high degree of process and thermal integration. Loss of lean oil was a critical event, but was not communicated to the supervisor until he returned from the morning production meeting one hour after the pumps had tripped.
Temperatures in parts of the plant fell to -48°C. At 08:30 AM, a condensate leak occurred on heat exchanger GP922. The absence of lean oil flow meant that the condensate flowing through the rich oil system was not warmed as it entered the recovery section. The reason for the leak was probably due an extreme thermal gradient created while attempts were being made to re-establish the process. Other parts of the process showed signs of extreme cold with ice forming on uninsulated parts of heat exchangers and pipework.
At 10:50 AM, the leak from GP922 was getting worse, and the Supervisor decided to shut down Gas Plant No: 1. By 12:15 PM, two maintenance technicians
had completed retightening of the bolts on GP922 without making any appreciable difference to the leak. It was decided that the only way to stop the leak was to slowly warm GP922 by starting a flow of warm lean oil through it. However, initial attempts to restart the lean oil pumps were unsuccessful. Ten minutes later, after operating a hand switch to minimize flow through another heat exchanger, GP905, that heat exchanger ruptured, releasing a cloud of gas and oil.
It is estimated that the cloud traveled 170 meters before reaching fired heaters where ignition occurred. After flashing back to the point of release flames impinged on piping, which started to fail within minutes. A large fireball was created when a major pressure vessel failed one hour after the fire had started. It took more than two days to isolate all hydrocarbon streams and finally extinguish the fire (CCPS, 2008).
3.5.3 Cause
The investigation concluded that the immediate cause of the incident was loss of lean oil flow leading to a major reduction in temperature of GP905, resulting in embrittlement of the steel shell. This was followed by introduction of hot lean oil in an attempt to stop the hydrocarbon leak in GP922. Throughout the whole sequence of events, operators and supervisors had not understood the consequences of their actions to re-establish the plant. Esso and the Government were desperate not to shut down the plant, as it supplied all the gas to the State of Victoria. They found their drawings were out of date as they walked the lines to discover what to isolate. In the end they had to shut down the plant and that left the state without power or gas for over ten days, causing major industrial disruption and job losses.
3.5.4 Key Lessons
Hazard Identification and Risk Analysis (Section 2.8). Gas plant #1 had not been subject to a hazard identification study as had been done for the other two gas plants at the site. A Hazard and Operability review, HAZOP, had been planned in 1995, but never carried out. Flow and temperature deviations, like those that occurred at Longford Plant No. 1, are systematically reviewed as part of a HAZOP study. Therefore, the hazardous consequences of these deviations were never identified. This leads to other management safety issues. Procedures and training will be incomplete or inadequate; hence operators will have no knowledge of the seriousness of the deviation. They will not know what to do, and, as in this case, can take the wrong action.
Management of Change (Section 2.14). All of the plant’s engineers were relocated to the head office in Melbourne, Australia in 1992. There was no Management of Change review about the effect of removing the process safety
tasks that the engineers fulfilled. As a result, their critical roles with respect to process safety were not replaced. The subject of Management of Organizational Change (CCPS, 2013) has been frequently overlooked in the past.
Process Safety Competency (Section 2.4). Supervisors and operators were given greater responsibility for operating the plant, including troubleshooting, for which they were not properly prepared. They were not competent to perform the functions the engineers served.
3.5.5 References and Links to Investigation Reports
CCPS, “Incidents That Define Process Safety”, American Institute of Chemical Engineers, Center for Chemical Process Safety, New York, NY, 2008.
CCPS 2013, Guidelines for Managing Process Safety Risks During Organizational Change, American Institute of Chemical Engineers, Center for Chemical Process safety, New York, NY, 2013.