--- - - XII HSE Health C Safety Executive l%e &es and explmi at BP Oil (Gm$emouuth) Rehery Ltd A report of the investigations by the Health and Safety Executive into the fires and explosion at Grangemouth and Dalmeny, Scotland, 13 March, 22 March and 11. June l987 @ Crown copyright 1989 First published 1989 Any enquiries regarding the content of this publication should be addressed to: HSE Area Office Belford House 59 Belford Road Edinburgh EH4 3UE tel031-225 1313 The fires and explosion at BP Oil (Grangemouth) Refinery Ltd A report of the investigations by the Health and Safety Executive into the fires and explosion at Grangemouth and Dalmeny, Scotland, 13 March, 22 March and 11 June 1987 Contents Introduction 1 Action taken 1 Description of the sites 1 The refinery flare line incident: 13 March 1987 2 The flare line system 2 Events leading to incident 4 The permit to work 8 The incident 11 lnvestigation by HSE 12 Preventive measures to avoid the incident 13 The hydrocracker explosion and fire: 22 March 1987 15 The hydrocracker unit 15 Events leading to incident 17 The explosion and fire 17 lnvestigation by HSE 19 Causes 28 Conclusions 33 Preventive measures to avoid the incident 34 Fire in crude oil storage tank at Dalmeny: 11 June 1987 36 The site 36 Events leading to the incident 36 The incident 38 lnvestigation by HSE 38 Conclusions 42 Bibliography 44 London: Her Majesty's Stationery Office Introduction Regulations 1984 (CIMAH). The process of producing and periodically reviewing 1 This booklet describes the safety reports should lead to the investigations made of three separate identification and elimination of maintenance related incidents within a deficiencies in plant and systems of work major British Company in 1987. The four such as are illustrated by these case deaths caused were all of contractors' studies. HSE emphasise that safety men. The second incident, which invites reports for existing plant must reflect comparison with the Flixborough disaster, actual conditions and be based on could have had serious consequences for appraisal of the plant as it is functioning the public. The case studies here at the time. A management view of how it presented illustrate further the lessons should ideally be will not suffice - HSE drawn by the HSE publication Dangerous hope that study of these incidents will Maintenance: A study of maintenance demonstrate to companies undertaking accidents in the Chemical Industry and hazardous operations the need for how to prevent them (Ref 1). continuing self appraisal and constant vigilance. 2 Firstly, a fire of flammable liquids, unexpectedly (although foreseeably) Action taken present and released during maintenance of a refinery flare system, killed two men 6 Following investigations into the and seriously injured two more. Potential incidents at the refinery, the HSE ignition sources had not rigorously been recommended to the Procurator Fiscal at excluded, means of escape were Falkirk that two cases be taken against inadequate, and permit-to-work procedures the operating company for breaches of had been devised and were being Sections 2 and 3 of the Health and Safety implemented without sufficient awareness at Work etc Act 1974. These were heard of potential hazards. in the High Court in Edinburgh on 21 March 1988 when a fine of £250 000 was 3 Secondly, one man was killed and imposed for the charge relating to the extensive damage was caused by a major circumstances of the flare line incident explosion with consequent fire while the and E500 000 for the second charge refinery hydrocracker plant was being arising out of the hydrocracker explosion. recommissioned after repairs. Debris 7 The circumstances of the fire at weighing several tonnes was propelled up Dalmeny were reported to the Procurator to 1 km, in some instances off-site. Fiscal at Edinburgh and a Fatal Accident Rupture of a vessel occurred following Inquiry was held from 10-16 March 1988. breakthrough of high pressure hydrogen, probably caused by less than perfect Description of the sites operating practices and made possible by the disconnection of safety devices. 8 BP Oil (Grangemouth) Refinery Ltd is part of BP Oil International. Their refinery 4 Lastly, a fire within a storage tank at site, situated on the outskirts of the refinery's crude oil terminal killed one Grangemouth close to the River Forth, of a contractor's team removing sludge. has been there since the early 1920s. Smoking caused ignition. There had been Eight million tons of crude oil are persistent deliberate evasion of safety processed per annum. There are 1200 full rules by some of that team - equally, time employees and up to 1000 those rules had not been effectively contractors may be employed on enforced by either the site occupier or the maintenance. Crude oil is received by contractor. pipeline from the ocean terminal at Finnart and from the North Sea Forties 5 Both refinery and terminal are subject Field. End products, exported by road, to the Control of Industrial Major Hazard rail, sea and pipeline, are kerosene, gas oil, propane, butane, naphtha, motor spirit through the refinery is shown in Fig 1. and fuel oil. The dotted lines represent pipework which 9 The oil storage terminal at Dalmeny should have been isolated to enable the near Edinburgh has the capacity to store cross-over valve V17 (with which this up to 490 000 tonnes of stabilised crude incident is concerned) to be removed oil prior to export by ship. Forties crude safely. Vented hydrocarbon gases from is piped 20 km to the terminal after being production units can be flared in three degassed at the refinery's Kinneil plant. 91 m high flare stacks or recovered for fuel gas. Much of the flare system pipework is suspended on gantries about 4.6 m above The Refinery Flare Line Incident: ground. Sections can be isolated for maintenance by operating cross-over 13 March 1987 valves allowing vented gases from operating units to be re-routed. As gases The flare line system pass through the extensive pipework 10 The flare line system comprising a system entrained liquids condense out on complex of pipework which passes the unlagged cold surfaces. isolated - Live --W-- Openvalve ++ Shutvalve Kodrurn Knock~ouldrurn Photograph l Cross-over valve area on 14 March. Flare No 1 and knock-out drum No 1 in background. Courtesy of British Petroleum Photograph 2 Cross-over valve V17. Courtesy of British Petroleum 11 Pipelines slope down to knock-out 15 About March 1986, senior refinery drums which collect the condensate for operations and engineering staff held transfer to the refinery slops system for discussions to preplan a scheme for the reclamation. At certain locations pipelines isolation of the flare system at V17. They slope down in both directions, one such concentrated on the operational and being at point A on Fig 1 which is 25 m safety requirements of the refinery and to the north of V17. The 760 mm diameter the flare system. It was very important for lines slope down towards No 1 knock-out safety reasons that the flare lines from drum and down towards No 2 knock-out operational units should not be drum, via V17 and V6. The directions of inadvertently isolated. A system for flare slope are not marked and at gradients of alignment was drawn up. The procedures 1 in 400 are not obvious. At V17 the and safety precautions necessary for the direction of liquid flow could only be removal of V17 were not considered. The established by knowledge of the flare detail was left to those who would system or by survey. eventually be responsible for the work. 12 Fig 2a shows a knock-out drum. As 16 In late January 1987 crude oil incoming gases and entrained liquids distillation unit 3 (COD3) was shut down pass over the vertical loop into the upper for routine overhaul. In early February the part of the drum, the consequent loss of operations department staff who were to velocity causes liquids to separate out. oversee the removal of V17 held a Liquids already in the line by-pass the meeting to discuss and agree the flare loop by means of a liquid take off. Gas is alignment outlined in Fig 1. Again the taken from the top of the drum to flare actual work methods were not considered, possibly via further knock-out drums, and these being left to the two process the liquid which collects is pumped to the supervisors responsible for general work slops system. activities on the flare system. About 22 February the catalytic cracker and 13 Most of the flare system valves, alkylation units were shut down. The flare including V17 consist simply of a movable lines from each of these units were wedge gate which can pass across the 'spaded' to provide effective isolation. valve bore. An external gear wheel causes Preparatory to its overhaul the No 1 flare a threaded spindle to push the wedge was also isolated and 'spaded'. 'Spading' gate into a guide to create a seal across is a common refinery practice by which a the internal diameter. (Fig 3). section of pipe is positively isolated by the insertion of a blank flange. (Fig 4). On Events leading to the incident 9 March COD3 was ready to be started. 14 Some 15 months earlier losses had Its line to flare No 1 was isolated by been noted on the flare gas recovery closing gate valve V10 and the operators system and gas from the alkylation unit had great difficulty turning the normally routed to No 1 flare was passing handwheel. Once they could turn it no to No 2.