Flixborough revisited30 June 2014

Forty years on from the Flixborough disaster, Brian Tinham looks at the lessons learned then and since – and the repercussions for safety throughout the process industries.

The first day of June 2014 marked the 40th anniversary of the Flixborough disaster – the UK's worst ever mainland process plant explosion, which still influences chemical and process industry safety thinking today. The explosion at the Flixborough Nypro Chemicals site, near Scunthorpe, killed 28 people and injured 36 others on Saturday 1 June 1974. Had it been a weekday, those figures would have been far higher – particularly given the central location of the site offices.

It resulted in the almost complete destruction of the plant. Further afield, the blast injured another 53 people and caused extensive damage to around 2,000 buildings. With the exception of the Buncefield fire in 2005, it remains the biggest explosion in the UK since World War II.

The cause of the disaster, according to the 1974 inquiry, was a poorly designed and installed temporary 20-inch reactor bypass pipe, connected to allow production to continue while a large reactor (the fifth in a six-reactor sequence) was removed for repair. The inquiry determined that rising pressure caused the failure of flexible bellows connecting the temporary line to the reactors, leading to the pipe jackknifing and being ripped off. That, it concluded, resulted in the catastrophic release of 30-50 tons of boiling cyclohexane, followed by instantaneous detonation of the massive and rapidly expanding vapour cloud.

However, that view of events was contradicted seven years ago by experts – Dr John Cox (one of the original inquiry investigators) and Professor Jim Venart, a mechanical engineer from the University of New Brunswick – who respectively offered one radically and one subtly different view of events.
Cox pointed to crucial unexplained evidence. In a forensic exposé for safety professionals in 2007, he postulated that an intense flame jet from a burst elbow on an entirely separate, but nearby, 8-inch banjo line (also carrying cycohexane) was in fact the initial cause.

He did not dispute that the inadequately supported and guided bellows and pipe combination was a serious contributory factor leading to the final devastating explosion. He agreed that it had been designed and constructed without input from a competent engineer. Indeed, the only site mechanical engineer had been the works engineer, who had left five months earlier. Further, once installed, the system was pressure checked using nitrogen, not water, as recommended.

Complex investigation
However, Cox described other relevant factors as the system used to cool the reactors had been shut down for repair, and water containing nitrates was running instead – potentially causing stress corrosion. Also, when the incident happened, the plant was not processing: it had undergone a problematic restart so was recirculating cyclohexane, awaiting delivery of nitrogen – also thought by some to have been leaking.

Evidence that convinced the court at the time that the 20in bypass pipe was to blame, he explained, included the state of the internal baffle and stirrer on the downstream Reactor Six, which had been seriously buckled. The investigators decided that must have been caused by blast damage – meaning that the pipe must have been ripped off at least 20 seconds before the blast to allow enough fluid to discharge to create the scale of explosion witnessed. Hence, they said, it must have been to blame.

But, the 1974 court's own engineering simulation showed inadequate process pressure for the bypass line and its bellows to do anything more than move around. "The mechanical engineering experts said it would have needed another 3.5psi to make that pipe jackknife and the bellows rupture," said Cox. "So, in 1974 I accepted that the bellows failed – but why? Had internal pressure drifted up? Was it some kind of process perturbation? Or was there some other external explosion, too?"

Cox's re-analysis of the explosion's causes demonstrated convincingly that the additional energy required to rupture the bellows actually came from a prior, completely unrelated explosion and a resulting substantial jet of flame from the 8in banjo line, which, crucially, was carrying cyclohexane at 9bar. He cited evidence from several witnesses – misinterpreted or omitted at the time – and insisted that this event was the trigger for the 20in line's demise and, in turn, the massive cyclohexane ejection and the final catastrophic blast.

And he was compelling. Among his most convincing exhibits were photographs of the remains of a fan rotor assembly from a fin-fan cooler originally above the six (then five) reactors. That was found on waste ground 50m away in a direction not consistent with the main blast. Importantly, its flight had been witnessed before the main blast, but coincident with a "loud rumbling" sound, which Cox attributed to the, by then, discharging 28in diameter reactor nozzles left by the departed 20in pipe. Crucially, he said, that fan rotor had also been subject to a brief, but intense, fire. The proof: it was still covered in soot, unlike the rest of the plant, which had been consumed by the intensity of the post-blast flames. This, he said, confirmed that it must have been flying before the main explosion.

Why the flight? That rotor, he explained, had been blown off as a result of a second 'mini-explosion', caused in turn by the fire jet from the ruptured 8in banjo line bathing the fin-fan cooler, with its fans still running. That had caused practically instantaneous zinc embrittlement and failure of all its galvanised finned steel cooling tubes – which were also carrying cyclohexane.

Forensic examination
"At 800-900°C, metallurgical simulation shows that zinc will unzip steel in seconds," he stated. Those cooling tubes, he pointed out, were found in a "neat pile" under the fin-fan cooler, indicating that they fell through the running fans before the main blast, causing cyclohexane to pour down on to the flame jet. Hence that second mini-explosion – and the rotor's flight path.

As for evidence of the initial 8in line explosion and flame jet, he cited: 8mm cine film shot by an amateur after the main blast and showing an ongoing 150ft flame column to one side of the large smoke plume; and witness observations both on- and off-site of a pre-event fire. He also pointed to: detailed metallurgical studies of the failed banjo and associated assemblies; and records of consequential substantial movement of adjacent heavy separator plant that could not have been caused by the final explosion.

What about Venart's version of events? He stuck with the poor temporary 20in pipe design and engineering theory – pointing to a tear found in the bellows at one end as critical evidence. For him, the sequence was failure of that bellows, followed by the pipe jackknife, cyclohexane ejection and explosion. That then ripped off the other bellows, casting the pipe to the ground in the ensuing inferno. No other trigger was involved, he asserted.

Venart's (since disputed) computer simulations suggested that process flows through the bypass line would have forced serious oscillation at or near its resonant frequency. Turbulence caused by the torn bellows slamming between maximum extension and compression would have led to a pulsating vent of cyclohexane. And, importantly, only half the force postulated in the original inquiry would have been required to rip off this one damaged end, which had suffered "megacycle-induced failure". Once off, though, the pipe would have jackknifed within 140msec, he said, causing a massive back-pressure surge in Reactor Six, and hence the damage (as noted by Cox and the inquiry) to its baffle and stirrer.

With cyclohexane pouring from the single exposed orifice and the jackknifed pipe still attached at its other end, the explosion would have followed.

And that, he said, accounts for the evidence of "burning in a carburising atmosphere" at one bellows end, but not the other, as well as the unburned debris pinched in the pipe jacknife. It also accounts for damage photographed on Reactor Six and its concrete plinth caused, he suggested, by the pipe being torn off and hurled to the ground.

Needless to say, we can never be sure of the causes – and it's worth noting that these two theories are not entirely mutually exclusive. Either way, at the time, the incident exposed serious weaknesses in: the understanding of process safety hazards; the design and location of process equipment and buildings; and the management and organisation of people, processes and safety systems. Its scale brought all of that to the public consciousness like nothing before.

And hence the key revisions to legislation, and engineering and materials guidelines in the ensuing years – as since enshrined, for example, in COMAH (Control of Major Accident Hazards).

Commenting on Flixborough a few years ago, celebrated HAZAN/HAZOP author and safety guru Professor Trevor Kletz (who died last year), said: "Flixborough destroyed the confident feeling that we can always keep large quantities of hazardous chemicals under control... Therefore, we should keep the amounts ... as low as reasonably practicable, or use safer materials. Inherently safer design arrived on the chemical industry's agenda."

Although few and far between, major incidents still occur: look at Texaco Milford Haven in 1994, BP Grangemouth in 2000, Conco Humberside in 2001, BP Texas City in 2004, Buncefield in 2005 and BP Deepwater horizon in 2010. There is still absolutely no scope for relaxing our guard.

Lessons learned
The 1974 inquiry concluded: 'Any modification to a plant should be designed, constructed, tested and maintained to the same standard as the original plant.'

Process plant risks
? If a plant leaks, the emission is likely to ignite.
? Ignition can be instantaneous and result in directed and intense flames.
? Cladding and lagging can fail in seconds.
? Creep failure can also follow in seconds.
? Zinc embrittlement will be rapid and so will the failure of steel and associated containment plant.
? Explosions are likely to ensue.

Safety engineering
? Stick to validated testing and maintenance schedules.
? Ensure regular training for all in awareness of hazards.
? Always involve competent engineers, particularly where plant modifications are being considered.
? Use risk assessments during design so that, for example, office blocks are offsite and control rooms blast-protected and windowless.
? Avoid bellows on dangerous service lines.
? Minimise inventories of hazardous materials.
? If you see something that looks unsafe, for safety's sake, speak up.

Brian Tinham

This material is protected by MA Business copyright
See Terms and Conditions.
One-off usage is permitted but bulk copying is not.
For multiple copies contact the sales team.