European Commission
eNatech - Natural-Hazard Triggered Technological Accidents Database
Natech Accident
DISCLAIMER: The Joint Research Centre does not guarantee the accuracy and completeness of the data in eNatech. It also reserves the right to cancel or change records without prior notification.
Natech Accident
1994/07/24
13:23
Lightning, United Kingdom, 1994
Pembroke Refinery, United Kingdom
Published

Units Involved

  1. CDU (Crude distillation unit)
    Process: Separator
    Crude oil delivered to the refinery was separated in the CDU by fractional distillation into intermediate products, including naphtha and gas, kerosene, light diesel, heavy diesel, and heavier components. These heavy fractions (vacuum gas oil - VGO) formed the feed for the vacuum distillation unit which in turn fed the FCCU. Additional VGO was imported from Gulf Oil's refinery on the north side of the Milford Haven waterway.
  2. FCCU (Fluidised catalytic cracking unit)
    Process: Other
    The FCCU, where the incident occurred, was a continuous process unit converting ('cracking') long chain and cyclic hydrocarbons into smaller hydrocarbon products used mainly in fuels.

    The FCCU comprised:
    * feed and catalytic sections, where the cracking reactions took place;
    * regenerator, for regenerating the catalyst;
    * fractionation, where the product streams were separated;
    * recovery section, for further purifying the light fractions;
    * absorption, for recovering LPG from the fuel gas stream.

    All the gas oils were used widely in the FCCU to transfer heat to other parts of the process; although energy-efficient this inevitably meant that the process controls and inter-relationships were complex.
  3. Flare system
    Other: Waste disposal
    The purpose of the flare system was to dispose safely of waste gases and liquids discharged from process units and storage areas, by separating liquids from gas and vapour which are then burned at the top of the flare stacks.

    The flare system at the refinery was a pipe system collecting discharges from all over the plant. The pipes were connected directly to pressure relief valves, pumps and other vents, and manifolded into flare subheaders on each process unit. Within each unit an on-plot flare drum removed any entrained liquid before the subheader joined the main flare header.

    In normal operation, the flare header operated at near ambient temperatures and pressures. During plant upsets, due to the discharge from relief valves on the plant, the flare line would experience locally elevated pressures, temperatures above or below ambient, and rapid flows of liquid and gas.

Event Sequences

  1. CDU fire
    1. CDU (Crude distillation unit)
    Power dips due to a thunderstorm caused release which was ignited by lightning
    Initiating EventCritical EventMajor Event
    Lifeline: Loss of electrical power / short circuit
    Between 7:20 and 9:00 a.m. a thunderstorm passed over the refinery. Lightning strikes caused a 0.4s power loss and subsequent power dips throughout the refinery. This caused the repeated tripping of pumps and coolers and consequently led to the lifting of the crude column pressure safety valves.
    Release: Gas, vapour, mist, or smoke release to air
    Flammable vapours were released from the crude column safety valves.
    Fire: Unknown
    The released vapours were ignited by a lightning strike.
  2. FCCU feed disturbance due to process upset
    2. FCCU (Fluidised catalytic cracking unit)
    Feed fluctuations in FCCU
    Equipment: Component malfunction:
    The debutaniser outlet valve was stuck closed, a fact unknown to the operators.
    Measure: Instrument / control / monitoring devices: Inadequate
    The configuration of the display screens of the operator control system made it difficult for the operators to understand the cause of the incident.
    Measure: Alarm systems: Unclear
    The operators were overwhelmed by too many alarms that were triggered by the process upset.
    Organisational: Training / instructions: Inadequate
    Training of the operators to handle a sustained process upset was found to have been inadequate.
    Organisational: Maintenance: Inadequate
    Post-accident tests on instruments whose incorrect behaviour contributed to the accident showed that several of these instruments were in need of maintenance.
    Initiating EventCritical EventMajor Event
    Lifeline: Loss of electrical power / short circuit
    Due to process upsets caused by the power dips the FCCU briefly lost and then regained VGO feed between 7:47 and 8:00 a.m., leading to feed level fluctuations. This, together with valve problems that were not recognised, eventually caused the FCCU's wet gas compressor to shut down, resulting in a large vapour load on the FCCU's flare system. This led to a high liquid level in the on-plot flare drum, exceeding its design capacity and forcing the liquid hydrocarbon into the drum's outlet line.
    Contributing Factors
    Equipment: Power interruption:
    The process upset was exacerbated by additional power interruptions at 8:27 and 8:29 a.m.
    		-
    Event Sequence: Release of flammable materials
    This flare drum outlet line was not designed to take liquid, and it ruptured due to mechanical shock at an elbow bend.
  3. Release of flammable materials
    3. Flare system
    Hydrocarbon release from flare drum outlet line
    1. Hydrocarbons
      20 ton
    Initiating EventCritical EventMajor Event
    Event Sequence: FCCU feed disturbance due to process upset
    Rupture of the flare drum's outlet line.
    Contributing Factors
    Equipment: Corrosion / fatigue:
    The flare drum's outlet line was known to be corroded.
    Organisational: Design of plant / equipment / system: Inadequate
    Modifications on the flare-drum's pump-out system resulted in a reduced liquid handling capacity. No recorded safety assessment of this modification was available.
    Release: Gas, vapour, mist, or smoke release to air
    As a result of the rupture at the flare drum's outlet line a pulsing leak appeared. The released hydrocarbon liquid and vapour mixture reached explosive levels and drifted within the process area.
    Explosion: Vapour cloud explosion
    The drifting hydrocarbon cloud was ignited by a heater. The explosion occurred 30s after the outlet line break, ca. 110m from the on-plot flare drum.
    Fire: Unknown
    After the explosion, several isolated fires continued to burn within the process area.

Emergency Response

The control and protection of the facilities was supported by a distributed control system that provided the primary control and alarm system for the FCCU, and a critical process controller that provided alarms and automatic shutdown on three areas of the plant which had been identified as being critical to plant safety: the main FCCU reaction system, the wet gas compressor and the power recovery train.

The company had prepared an on- and off-site emergency plan which did, however, not consider the possibility of a fire burning for more than 24 hours. It was not considered necessary to active the off-site plan.
Insufficient personnel and equipment to respond to both emergencies: No
Damage to lifelines (e.g. water, power, communication, transportation): No
  • On-site fire fighting team
  • Local fire fighting team
The plant personnel shut down and isolated process equipment when two out of the plant's three flare systems were disabled as a result of the explosion and fires.

Plant personnel worked with the on-site and the county fire brigades to bring the fires under control. With the flare system being inoperative, the fires were allowed to burn until the hydrocarbon source was exhausted. In parallel, the fire fighters cooled vessels and other equipment. The fires were extinguished 2.5 days after the explosion.

Consequences

26
26 people non-serious injuries occurred on-site.

The HSE investigation identified two factors that helped prevent a disaster:

1) The incident happened on a weekend when only a low number of employees were on the site.

2) The most hazardous installation on site, the alkylation unit, was built and operated to high safety standards to minimise the risk of hydrogen fluoride releases. It withstood the explosion in the adjacent FCCU and was shut down according to planned procedure.
3240 hour(s)
As a result of the accident, ca. 10% of the UK's refining capacity in 1994 was lost during the refinery's downtime (4.5 months). The monetary losses due to business interruption amount to US$ 70,500,000 (in 1994 monetary value). The cost related to property damage, debris removal and cleanup costs amount to US$ 77,500,000 (in 1994 monetary value).

Large areas of the refinery suffered severe structural damage due to the explosion and the fires on-site. The blast caused damage to buildings, vessels, columns, tanks, pipework and pipe racks. Block wall buildings near the blast location were completely destroyed. The control room suffered internal damage because the door had been open at the time of the explosion (the earlier power interruptions had rendered the air conditioning control inoperative).
The off-site damage was very limited due the refinery's location away from populated centres. Properties in the town of Milford Haven, which is located at ca. 3km distance, sustained some glass damage.

Lessons Learned

The HSE investigation into the accident identified a significant number of lessons learned:

- There should be an effective removal of slops from a flare knock-out drum to prevent drum overfilling.
- A formal and controlled HAZOP procedure is necessary for modifications. This procedure should make sure that the construction and use of the modification includes all safety issues identified at the design stage.

- Safety-critical process control elements should be identified and designed based on an appropriate hazard and risk analysis.

- Staff should be trained to carry out simple volumetric and mass balance checks when flow level problems are experienced in a unit. Training of staff should also include an assessment of their competences and qualifications for their actual operational roles under high stress conditions, guidance on when to initiate controlled or emergency shutdowns, and how to manage unplanned events.

- Safety management systems should include a mechanism to monitor their own effectiveness.
- Display systems should include an overview of the condition of the process including, where appropriate, mass and volumetric balance summaries.

- The use and configuration of alarms should be such that safety critical alarms are distinguishable from other operational alarms and the alarms are limited to a number that an operator can monitor.

- All safety critical parts of the plant should be included in comprehensive inspection programmes. Inspection programmes for corrosion should err on the side of caution.

- All foreseeable operational conditions should be taken into account when defining the minimum acceptable thickness for pipes and vessels.
- Emergency plans should consider the availability of adequate water supplies for fire fighting and vessel cooling, in particular for worst-case scenarios with prolonged fires.
ID: 47, Created: Elisabeth KRAUSMANN, 2014-07-03 17:11:19 – Last Updated: Elisabeth KRAUSMANN, 2015-08-14 16:35:56

Attachments

NoDescriptionFile Size
1.HSE Investigation Report7.33MB
2.Marsh Consulting: The 100 Largest Losses 1972-2001555.53KB