Flixborough revisited01 June 2007

At about 5.00pm on Saturday 1 June 1974, the Nypro plant at Flixborough near Scunthorpe, manufacturing caprolactam for nylon, exploded. 28 people lost their lives, 53 workers were hospitalised, and 1,821 houses and 167 shops and factories were damaged as the blast wave, felt more than four miles away, ripped through the community. Had the plant office block been occupied, the figures for deaths and injuries would have been far, far worse. The ensuing fires burned for 10 days and £250 million of plant assets (in today's terms) were reduced to twisted metal.

There have been several unofficial investigations into the cause of the explosion since the original inquiry - whose findings observers branded everything from fundamentally flawed to a cover-up. Why the detective work? Primarily because the court findings contributed so much less than they should have to the knowledge required for safe plant operations and maintenance.

The 1974 inquiry ruled that the explosion was caused by a 20 inch reactor bypass pipe jacknifing and being ripped off by rising pressure, resulting in a catastrophic release of 30?50 tons of cyclohexane and a massive vapour cloud detonation. Summing up, the court described 'an otherwise well-designed and well-maintained chemical plant' that had been compromised by a poorly designed temporary 20 inch dogleg line.

And there it might have rested - with limited lessons available to plant engineers and the potential for similar disasters - had it not been for the dissenters, who pointed to crucial evidence either ignored or unexplained. Several well-aired theories have since been proposed, contesting everything from the rising plant pressure (for which there was no evidence) to the destruction of the bypass line as the initial event.

But last month, 33 years after the catastrophe, two of the world's leading protagonists came together for the first time at a conference at University College London, not only to air their considerable research, but to expose ongoing flaws in plant design, operation and maintenance. The two were Dr John Cox, one of the original investigators, and professor Jim Venart, a mechanical engineer from the University of New Brunswick - both with the benefits of modern forensic science and technology at their disposal.

First, a little background. The 20 inch dogleg line had been installed, with bellows at either end and supporting scaffolding, to bypass the fifth of a six-reactor chain on the section of plant processing superheated, pressurised cyclohexane. Reactor Five had been removed two months earlier in a plant shutdown, because of cracks found leaking cyclohexane. Astonishingly, no investigation was apparently performed on the other five reactors.

Other salient factors include that the system used to cool the reactors had been shut down for repair, and water containing nitrates was running instead - potentially causing stress corrosion. The temporary bypass line was designed and constructed without input from a competent engineer - indeed, the only site mechanical engineer had been the works engineer, who had left five months earlier. Once installed, the system was pressure checked using nitrogen, not water, as recommended. At the time of the incident, the plant was not processing. It had undergone a problematic restart and was recirculating cyclohexane, awaiting delivery of nitrogen - also thought by some to have been leaking.

Cox doesn't doubt the significance of the 20 inch line. "It was wrong in every way in terms of design and construction," he says. Evidence that convinced him and the court at the time includes the internal baffle and stirrer on the downstream Reactor Six, which had been seriously buckled. The investigators decided that must have been caused by blast damage - meaning that the 20 inch line must have been ripped off at least 20 seconds earlier to allow enough fluid to discharge before the blast. Ergo: that was the cause.

Something didn't fit
But something else must have been wrong because the court's own engineering simulation showed inadequate process pressure for the bypass line and its bellows to do anything more than 'squirm'. "The mechanical engineering experts said it would have needed another 3.5psi to make that pipe jacknife and the bellows rupture," says Cox. "So in 1974, I accepted that the bellows failed - but why? Had internal pressure drifted up? Was it some kind of process perturbation? Or was there some other external explosion?"

Cox believes the additional energy came from a prior unrelated explosion and intense flame jet from a burst elbow on a nearby eight-inch banjo line also carrying cycohexane, but at 9bar. And he cites evidence for that pre-event from several witnesses - misinterpreted or omitted at the time, but confirmed by one at last month's conference. That event was the trigger, he says, for the 20 inch line's demise, the massive fuel ejection, rapidly expanding vapour cloud and consequent catastrophic blast.

So what's the evidence for his sequence of events? Among the most convincing is the remains of a fan rotor assembly from a fin-fan cooler originally above the reactors. That was found on waste ground 50m away in a direction not consistent with the main blast. Its flight had been witnessed before the main blast, but coincident with a "loud rumbling" sound, which Cox attributes to the by then discharging 28 inch diameter reactor nozzles left by the departed 20 inch pipe. Crucially, the fan rotor had been subject to a brief but intense fire and was still covered in soot - unlike the rest of the plant consumed in flames - confirming that it must have been flying before the main blast.

That rotor, he insists, was blown off as a result of a second 'mini-explosion' caused by a fire jet from the eight-inch line bathing the fin fan cooler, with its fans still running, and causing practically instantaneous zinc embrittlement and failure of all its galvanised finned steel cooling tubes, which were also carrying cyclohexane. "At 800?900oC, metallurgical simulation shows that zinc will unzip steel in seconds," he explains. Those tubes, he points out, were found in a "neat pile" under the fin fan cooler, indicating that they fell through the running fans before the main blast, causing cyclohexane to pour down onto the flames, and hence that mini-explosion.

As for evidence of the initial eight-inch line explosion and flame jet, he cites: 8mm cine film shot by an amateur after the main blast and showing an ongoing 150ft flame column to one side of the large smoke plume; witness observations both on- and off-site of a pre-event fire; detailed metallurgical studies of the failed banjo and associated assemblies; and consequential movement of adjacent heavy separator plant.

Metallurgical forensics
The metallurgical studies show rapid creep failure at the pipe elbow, which had happened without torsion (so before being twisted by the main blast), along with swelling - resulting in a 50 inch split. It was consistent with that elbow being subjected to a localised pre-event intense flame. But from where? From the bolt cage and intrados to which the banjo was connected - that was found with bolts loose and gaskets missing. Says Cox: "The investigators at the time recorded: 'There is some evidence that the [pipe] assembly and maintenance of its joints had not been good.' But Nypro had asked me not to pursue evidence that made it appear that the company was shifting the blame."

So it was left. But the lessons - that if you get a leak on plant it's likely to ignite; that ignition can be instantaneous and result in a directed flame; that cladding and lagging can fail in seconds; that creep failure can follow in seconds; ditto zinc embrittlement and failure of steel and associated containment plant; and that explosions are likely to ensue - were nevertheless taken up by the HSE. "The HSE banned even zinc-based paint on plant. That was one of the good outcomes from Flixborough, despite the court inquiry," says Cox.

Venart's view of events is quite different, focusing on an internal tear in the bellows at the Reactor Four end of the 20 inch dogleg line as the key to the event. He insists that poor design and mechanical engineering ignorance led directly to failure of first this bellows, then the pipe jacknife, cyclohexane eruption and explosion, and then the other bellows - with no other trigger involved.

His computer simulations demonstrate that process fluid flowing at critical velocity through the bypass line resulted in the dogleg becoming a spring mass system vibrating at, or near, its resonant frequency (difficult to prove, and disputed by the bellows manufacturer, now called Teddington Engineered Solutions). Turbulence in the flow caused the bellows' internal tear, and a pulsating vent of cyclohexane would have followed as the bellows oscillated from extension to compression - weakening through "megacycle-induced failure" till it parted company with Reactor Four.

The thinking here hinges on the unstable, inadequately guided bellows and pipe, which, he says, would have been locking down and extending either bellows end alternately - meaning that only half the force calculated at the original inquiry was required to rip off the already damaged end. Also, once torn off that reactor, the pipe, being forced upwards, would have jacknifed within 140msec, causing an immediate surge in Reactor Six, similar to huge water hammer - so accounting for the recorded baffle and stirrer damage.

Then, with cyclohexane spewing from the single exposed orifice, but the jacknifed pipe still attached at its other end (insufficient force to eject it), the explosion would have occurred. That, he says, would account for the evidence of burning in a carburising atmosphere at one bellows end, but not the other. Now the blast would tear off the Reactor Six end and propel it to the ground, hitting Reactor Six on the way (damage possibly attributable to that event was photographed) and impacting with the concrete reactor plinth below (ditto).

What does it mean?
The truth is we can never be certain of the precise chain of events in all their minutiae. It's also the case that Cox's and Venart's theories need not be entirely mutually exclusive: although they diverge on the detail of causation and sequence, it's likely that both describe elements of what happened on that dreadful day. Both agree that, in any event, the design of the 20 inch bypass line, and its resulting failure, was the ultimate cause of the deadly blast.

In the end though, the real value that both these gentlemen bring to plant engineering today is not closure. It's about drawing much needed attention to the reasons for today's hazard mitigation and avoidance regulations, as since enshrined, for example, in CIMAH and subsequently COMAH, following the Bhopal and Mexico City disasters.

It's also about reminding operations engineers across different industry sectors of the importance of good plant practice, adherence to standard operating procedures, competent engineering, hazard awareness and strict change management.

As David Dale, from the IChemE's Loss Prevention Bulletin, said at the event: "Prior to Flixborough, a safety culture in the UK was somewhat lacking. Safety was the province of relatively junior members of staff. So one of the lessons was that safety had to be top-down and central? The inquiry concluded that 'Any modification to a plant should be designed, constructed, tested and maintained to the same standard as the original plant.' Maybe it was, but change control was a big, big lesson."

Other lessons included the importance of: sticking to validated testing and maintenance schedules; ensuring regular training for all in awareness of hazards; involving competent engineers; using risk assessments; avoiding bellows on dangerous service lines; and minimising inventories of hazardous materials.

Professor Trevor Kletz, HAZAN/HAZOP author and safety guru, also at last month's event, added other observations. "You've got to take all the possible causes of Flixborough into account if they're plausible, and guard against them. That's what today's regulations should ensure. But some chemical engineers I've spoken to say that, although they think they would have noticed something wrong at Flixborough, they might not have said anything for fear of treading on others' toes. If you see something that looks unsafe, for safety's sake, you have to say something."

If you take nothing else away from this, remember that advice. Dale cites incidents such as Texaco Milford Haven in 1994, BP Grangemouth in 2000, Conoco Humberside in 2001, BP Texas City in 2004 and Buncefield in December 2005 as evidence of ongoing avoidable failures. And Kletz warns: "A process with hundreds of tonnes of flammable fluid under pressure and yielding only 6% conversion per pass is bad engineering... But all new capacity [for caprolactam] has since been built in the Far East and Eastern Europe using virtually the same process - not to the great credit of the chemical industry."

As the original court inquiry concluded: 'They did not know what they did not know.' We know now. There is no excuse.

SOE

Related Downloads
23846\flixborough.pdf

This material is protected by MA Business copyright
See Terms and Conditions.
One-off usage is permitted but bulk copying is not.
For multiple copies contact the sales team.