Flixborough disaster

thumb|right|300px|Memorial to those who died in the disaster

The Flixborough disaster was an explosion at a chemical plant close to the village of Flixborough, North Lincolnshire, England, on Saturday, 1 June 1974. It killed 28 and seriously injured 36 of the 72 people on site at the time. The casualty figures could have been much higher if the explosion had occurred on a weekday, when the main office area would have been occupied. A contemporary campaigner on process safety wrote "the shock waves rattled the confidence of every chemical engineer in the country".

It was decided to build the plant in July 1964. The plant would cost £5.5m.

Nypro was formed in December 1964; Fisons, of Suffolk, owned 24%, with Dutch State Mines the rest.

The plant was built by Simon Carves from early 1965 to 1967, with Stamicarbon, of the Netherlands, a subsidiary of DSM, and Humphreys & Glasgow (which went into liquidation in January 1990), run by Ambrose Congreve. Simon Carves, Humphreys & Glasgow and the Power-Gas Corporation had formed the joint-company Chemical Works Projects Ltd, in 1961, to make large nitrogen plants. Humphreys & Glasgow also worked with Sofregaz, of France, in the late 1960s.

It had several miles of aluminium piping. The plant opened in early November 1967. It sold products in conjunction with Société Nationale des Pétroles d'Aquitaine (SNPA) of France. The chemical plant was built next door to a nitrogen plant, of Fisons, built from 1938, which opened around 1939, and employed 300 men. Products were shipped from Gunness on the Trent.

Another similar nitrogen fertiliser plant opened in Immingham in 1951.The Nypro plant was built at Flixborough, due to the neighbouring nitrogen plant. The nitrogen plant itself had a fire on 30 July 1966. The chemical plant had a multi-million-pound expansion from 1970.

The chemical works were owned by Nypro UK (later a joint venture between DSM and the British National Coal Board (NCB)) had originally produced fertiliser from by-products of the coke ovens of a nearby steelworks.

Background

thumb|right|200px|Another view of the memorial

Since 1967, the plant had instead produced caprolactam, a chemical used in the manufacture of nylon 6. The caprolactam was produced from cyclohexanone. This was originally produced by hydrogenation of phenol, but in 1972 additional capacity was added, built to a DSM design in which hot liquid cyclohexane was partially oxidised by compressed air. The plant was intended to produce 70,000 tons per annum (tpa) of caprolactam but was reaching a rate of only 47,000 tpa in early 1974. Government controls on the price of caprolactam put further financial pressure on the plant. in the absence of timely advice from the Health and Safety Executive (HSE) planning permission for storage of 1,200 te LPG at Flixborough was initially granted subject to HSE approval, but HSE objected); as a result of a subsequent collapse in the price of nylon it closed down a few years later. The site was demolished in 1981, although the administration block still remains. The site today is home to the Flixborough Industrial Estate, occupied by various businesses and Glanford Power Station.

The foundations of properties severely damaged by the blast and subsequently demolished can be found on land between the estate and the village, on the route known as Stather Road. A memorial to those who died was erected in front of offices at the rebuilt site in 1977. Cast in bronze, it showed mallards alighting on water. When the plant was closed, the statue was moved to the pond at the parish church in Flixborough. During the early hours of New Year's Day 1984, the sculpture was stolen. It has never been recovered but the plinth it stood on, with a plaque listing all those who died that day, can still be found outside the church.

The cyclohexane oxidation process is still operated in much the same plant design in the Far East. – the gist of their paper is given in the Second Report of the Advisory Committee on Major Hazards. gives a graphical presentation of the raw data (overpressure inferred from damage vs distance from explosion source) for Flixborough (Fig 3.1.2) (in which the data is bounded by TNT equivalent curves for 11.2 t and 60t) and for the Buncefield fire (Fig 3.4.1). Flixborough gives a higher estimated over-pressure than Buncefield. in the plant. The explosion virtually demolished the site. As it was a weekend, there were relatively few people on site: of the 72 people on-site at the time, 28 were killed and 36 injured. Fires burned on-site for more than ten days. Off-site there were no fatalities, but 50 injuries were reported and about 2,000 properties damaged.

The occupants of the works laboratory had seen the release and evacuated the building before the release ignited; most survived. None of the 18 occupants of the plant control room survived, nor did any records of plant readings. The explosion appeared to have been in the general area of the reactors and after the accident only two possible sites for leaks before the explosion were identified: "the 20 inch bypass assembly with the bellows at both ends torn asunder was found jack-knifed on the plinth beneath" and there was a 50-inch long split in nearby 8-inch nominal bore stainless steel pipework".

Court of Inquiry

Immediately after the accident, New Scientist commented presciently on the normal official response to such events, but hoped that the opportunity would be taken to introduce effective government regulation of hazardous process plants.

The inquiry conclusion

The 8-inch hypothesis was claimed to be supported by eyewitness accounts and by the apparently anomalous position of some debris post-disaster. The inquiry report took the view that explosions frequently throw debris in unexpected directions and eyewitnesses often have confused recollections. The inquiry identified difficulties at various stages of the accident development in the 8-inch hypothesis, their cumulative effect being considered to be such that the report concluded that overall the 20-inch hypothesis involving 'a single event of low probability' was more credible than the 8-inch hypothesis depending upon 'a succession of events, most of which are improbable'.

Lessons to be learned

The inquiry report identified 'lessons to be learned' which it presented under various headings; 'General observation' (relating to cultural issues underlying the disaster), 'specific lessons' (directly relevant to the disaster, but of general applicability) are reported below; there were also 'general' and 'miscellaneous lessons' of less relevance to the disaster. The report also commented on matters to be covered by the Advisory Committee on Major Hazards.

General observation

• Plant – where possible – should be designed so that failure does not lead to disaster on a timescale too short to permit corrective action.
• Plant should be designed and run to minimise the rate at which critical management decisions arise (particularly those in which production and safety conflict).
• Feedback within the management structure should ensure that top management understand the responsibilities of individuals and can ensure that their workload, capacity and competence allow them to effectively deal with those responsibilities

Specific lessons

The disaster was caused by 'a well designed and constructed plant' undergoing a modification that destroyed its mechanical integrity.

• Modifications should be designed, constructed, tested and maintained to the same standards as the original plant

When the bypass was installed, there was no works engineer in post and company senior personnel (all chemical engineers) were incapable of recognising the existence of a simple engineering problem, let alone solving it

• When an important post is vacant, special care should be taken when decisions have to be taken which would normally be taken by or on the advice of the holder of the vacant post
• All engineers should learn at least the elements of branches of engineering other than their own

Matters to be referred to the Advisory Committee

No one concerned in the design or construction of the plant envisaged the possibility of a major disaster happening instantaneously. It was now apparent that such a possibility exists where large amounts of potentially explosive material are processed or stored. It was 'of the greatest importance that plants at which there is a risk of instant as opposed to escalating disaster be identified. Once identified measures should be taken both to prevent such a disaster so far as is possible and to minimise its consequences should it occur despite all precautions.' There should be coordination between planning authorities and the Health and Safety Executive, so that planning authorities could be advised on safety issues before granting planning permission; similarly the emergency services should have information to draw up a disaster plan.

Conclusion

The inquiry summarised its findings as follows:

Response to Inquiry Report

Controversy as to immediate cause

Nypro's advisers had put considerable effort into the 8-inch hypothesis, and the inquiry report put considerable effort into discounting it. The critique of the hypothesis spilled over into criticism of its advocates: 'the enthusiasm for the 8-inch hypothesis felt by its proponents has led them to overlook obvious defects which in other circumstances they would not have failed to realise'. Of one proponent the report noted gratuitously that his examination by the court 'was directed to ensuring that we had correctly appreciated the main steps in the hypothesis some of which appeared to us in conflict with facts which were beyond dispute'. The report thanked him for his work in assembling eyewitness evidence but said his use of it showed 'an approach to the evidence which is wholly unsound'.

The proponent of the 8-inch gasket failure hypothesis responded by arguing that the 20-inch hypothesis had its share of defects which the inquiry report had chosen to overlook, that the 8-inch hypothesis had more in its favour than the report suggested, and that there were important lessons that the inquiry had failed to identify:

The HSE website as of 2014 said that "During the late afternoon on 1 June 1974 a 20 inch bypass system ruptured, which may have been caused by a fire on a nearby 8-inch pipe". In the absence of a strong consensus for either hypothesis other possible immediate causes have been suggested.

Post-enquiry forensic engineering – two-stage rupture of bypass

The enquiry noted the existence of a small tear in a bellows fragment, and therefore considered the possibility of a small leak from the bypass having led to an explosion bringing the bypass down. It noted this to be not inconsistent with eyewitness evidence, but ruled out the scenario because pressure tests showed the bellows did not develop tears until well above the safety valve pressure. This hypothesis has however been revived, with the tears being caused by fatigue failure at the top of the reactor 4 outlet bellows because of flow-induced vibration of the unsupported bypass line. Finite element analysis has been carried out (and suitable eyewitness evidence adduced) to support this hypothesis.

Post-enquiry forensic engineering – the 'water hypothesis'

The reactors were normally mechanically stirred but reactor 4 had operated without a working stirrer since November 1973; free phase water could have settled out in unstirred reactor 4 and the bottom of reactor 4 would reach operating temperature more slowly than the stirred reactors. It was postulated that there had been bulk water in reactor 4 and a disruptive boiling event had occurred when the interface between it and the reaction mixture reached operating temperature. Abnormal pressures and liquor displacement resulting from this (it was argued) could have triggered failure of the 20-inch bypass.

Dissatisfaction with other aspects of the Inquiry Report

The plant design had assumed that the worst consequence of a major leak would be a plant fire and to protect against this a fire detection system had been installed. Tests by the Fire Research Establishment had shown this to be less effective than intended. to have claimed an HSE source had told him that the reactors had been designed against a 9 t thrust upon these branches, not the 38t thrust the inquiry noted the bypass 'design' to have ignored) The HSE (through the Department of Employment) had come up with a 'shopping list' of about 30 recommendations on plant design,

If the UK public were largely reassured to be told the accident was a one-off and should never happen again, some UK process safety practitioners were less confident. Critics felt that the Flixborough explosion was not the result of multiple basic engineering design errors unlikely to coincide again; the errors were rather multiple instances of one underlying cause: a complete breakdown of plant safety procedures (exacerbated by a lack of relevant engineering expertise, but that lack was also a procedural shortcoming).

ICI Petrochemicals response

The Petrochemicals Division of Imperial Chemical Industries (ICI) operated many plants with large inventories of flammable chemicals at its Wilton site (including one in which cyclohexane was oxidised to cyclohexanone and cyclohexanol). Historically good process safety performance at Wilton had been marred in the late 1960s by a spate of fatal fires caused by faulty isolations/handovers for maintenance work. The more onerous requirements were justified as follows:

In accordance with this view, post-Flixborough (and without waiting for the Inquiry Report), ICI Petrochemicals instituted a review of how it controlled modifications. It found that major projects requiring financial sanction at a high level were generally well-controlled, but for more (financially) minor modifications there was less control and this had resulted in a past history of 'near-misses' and small-scale accidents, few of which could be blamed on chemical engineers.