IOSH forums home
»
Our public forums
»
OSH discussion forum
»
Major chemical accidents - open vs. suppressed discussion
Rank: Guest 
|
Posted By jom
In 2005 we saw the Texas City refinery explosion and the Buncefield fuel depot explosion. A bad year for process safety.
What an amazing contrast between the way each accident has been processed by authorities and discussed in professional arenas such as this forum.
Reporting and discussion of the TC accident was very fast and public, while with the B accident, it was along the line of "we musn't talk about it - there are legal processes afoot."
I like the American model. I think it produced useable learnings quicker.
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By Mike Draper
Am I missing something?
17.07.07
Buncefield Major Incident Investigation Board publishes recommendations on emergency preparedness, response and recovery
29.03.07
Buncefield Major Incident Investigation Board Publish Recommendations on the Design and Operation of Fuel Storage Sites
11.12.06
The Buncefield Investigation Board focuses on recommendations for the future
22.08.06
Buncefield Investigation Board announces changes to investigation work at the Buncefield site
09.05.06
Buncefield investigation board – Statement on publication of third progress report
11.04.06
Buncefield investigation board – Statement on publication of second report
21.02.06
Buncefield investigation board publishes progress report
Perhaps you could enlighten us as to how much faster and better the TC investigation was handled, but bear in mind that in our current understanding Buncefield was outside of the limits of our knowledge of such events.
|
|
|
|
|
|
Rank: Guest
|
Posted By peter gotch
Hi Jom
....and there is quite a lot of commonality between the findings
Regards, Peter
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Sorry, Mike, I never meant to impugn the competence of the investigation authorities or the quality of their output. You're right to highlight the list of reports. They must be useful to many parties worldwide and were timely. They cover important aspects of the accident. The substantial work behind them means they must come out in the their own proper time and not rushed. I'm not suggesting they should have been quicker.
I also didn't mean to imply the TC investigation was "handled better". Neither the TC nor the Buncefield authorities need my advice.
What I was thinking about (but didn't say) was the difference between the revelations about technical causes. Very little about how the Buncefield accident came about has been publicly revealed, although much must be known to invetsigators. With TC, BP itself made public much of the technical details within 2 months of the event. That's a startling difference.
How do you think 8,000 m3 of petrol could be sent cross country by pipeline and no checks be made that it is being received and is going to where it should?
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By Robert K Lewis
jom
One of the early action points released was on the checking and maintenance of level sensors and it seems apparent for me that the manufacturers guidance manual was being ignored and short cuts had been created when checking the action of the level sensors.
The material has however been spread across numerous documents as highlighted above and this has dissipated the effectiveness of the information and lost focus on the narrative of events. I think the last recommendations also have not brought together all the various lessons because of this "barrage" of documents.
Bob
|
|
|
|
|
|
Rank: Guest
|
Posted By Darren J Fraser
Not involved in the Buncefield Investigation, but have followed it with interest.
The reason for the apparent lack of technical causes is, as stated in some of the reports already mentioned and by various other media, due to the fact that all the models / simulations conducted prior to the incident and as part of the investigation indicate a far less catastrophic outcome than that which occurred.
Some of the areas have only very recently been made safe and therefore available, and some evidence has been destroyed and is unrecoverable.
Therefore the specialists involved are unsure why it failed in the manner it did.
The cause of the spillage has been determined in that a high level sensor failed.
The cause of the explosion has been determined to a high degree, the issue is why the level of destruction that occurred, is far greater than any model / simulation predicted.
Therefore, has it been suppressed, IMHO no, an investigation is being conducted in a meticulous manner to ensure that all possible lessons are learned, and therefore by that very nature it cannot be rushed.
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
>Therefore, has it been suppressed,
I said "suppressed discussion". I didn't say there was suppression of the invetsigation reporting.
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Process Safety.
It's about containing dangerous chemicals.
Process Safety failed at Buncefield when the petrol overflowed the tank.
Why did that come about?
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By peter gotch
Hi John
The problem is that the investigators are not confident as to the mechanism. From Consultative Document CD211.
Buncefield proved that a major release of unleaded petrol can result in a violent
explosion. Further scientific research is required to investigate this VCE
phenomenon - without it there will continue to be uncertainty about how VCEs might
occur and what effects they may have. However it would take a number of years to
do all the necessary work and clearly it would be imprudent to delay making changes
to HSE’s advice on LUP pending the outcome of the research.
P
|
|
|
|
|
|
Rank: Guest
|
Posted By Robert K Lewis
The mechanism for the explosion itself is very much open to debate but the reasons for the failure to identify overflow conditions even with the non-operable sensors is actually not related to the explosion itself. The evidence for the failures behind the release almost certainly still exists in the maintenance records, management systems and statements from the maintenance staff. The post incident actions issued by the HSE showed that they had certain issues in mind when the information and action points were released.
As for the explosion mechanism I think the problem of vapour cloud explosions were well seen in the Flixboro inquiry. The science of how they occur is very interesting; but what is certain is that a cloud of volatile organic vapour will almost certainly encounter an ignition source at some point when the oxygen content is sufficient to bring it into the explosive range. It happened at Flixboro, it happened at Buncefield and will happen again if there is another major release of such materials.
Bob
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
I was thinking about the steps behind the overflow, rather than the mechanism behind the explosion.
The high level shutdown mechanism that did not operate had to be the last defence against overflow.
Is it known if the control room survived the event?
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By Pete48
Jom, clearly the "social outrage" aspect has drawn a lot of work and media and public speculation. I agree with your point that it is the failures in process controls that are apparently taking longer than I might have expected. Whilst it seems clear to me that there must have been some pretty simple failures in the operating and maintenance activities that allowed the initial overfill to occur, this is not an explicit statement that I have picked anywhere in the report. (not saying it isn't there of someone has found it, it is just not as explicit as all the other recommendations.
I agree that it is interesting to speculate about why such detail has not been published yet and why there has not been more open debate about the background to this part of the incident. It is after all the area that is the starting point of this incident. If the failures had not occurred here then the incident would not have happened!
Why exactly did the transfer into the tank continue for a number of hours with apparently no overarching control, whether human or electronic systems? The report has yet to confirm that some considerable time after the event. I think that is where you are as well John??
|
|
|
|
|
|
Rank: Guest
|
Posted By Ian Waldram
I think all the comments to date have missed some other factors in the reporting/ discussion of these events. BP openly published its own internal report long before the external authorities (CPSB and OSHA). It also commissioned and published an independent report into US refinery process safety management before the CPSB report was published (arguably they did this under pressure from the authorities, so it maybe wasn't just internal culture that influenced this). CPSB report wasn't published until 2 years after the event, and it was all in one document.
Another key difference was the ratio of on-site to off-site damage and disruption, with Buncefield being much higher (and of course still continuing). I suggest that also influenced reporting and discussion.
So I suggest it's not a simple UK vs US culture difference. In my general experience of this sector, EU-based organisations are usually more willing to publish as much as they feel able to compared to US-based, some of whom invoke legal privilege which then has the effect of limiting open reporting and discussion.
Also the Buncefield reports have been pretty speedy, as noted above, with the exception of anything relating to details of site management before and at the time of the release, which would of course be absolutely core to any prosecution, so cannot be publicised at this stage. Compare the depth of these reports with the OSHA fines on BP (and reasons for them - many were about violations of detailed prescribed paperwork requirements, almost none dealt with root causes in the way the BP, Baker Panel and CPSB reports all did).
Happy to hear other views about this, so please continue the debate!
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Pete,
"Why exactly did the transfer into the tank continue for a number of hours with apparently no overarching control, whether human or electronic systems? The report has yet to confirm that some considerable time after the event. I think that is where you are as well John??"
Yes.
That is the striking difference between the Buncefield and TC investigations.
It does seem to be legal considerations that are inhibiting release of an explanation.
I don't know that this really matters. Any failings will have been technically simple, I feel. I imagine every operator of a depot or pipeline has since speculated to the nth degree on how they might lose containment. Many sites must now be just that much safer as a result.
Accidents in the rail industry sometimes occur at the interface between controlling companies. There can be uncertainty about where one company's responsiblities cease and the other's start. I wonder about the contract details between the despatching company and the Buncefield operator. I wonder if the despatching company has invoiced the Buncefield operator for the delivery of the 8,000 m3 of petrol?
Scope for years of litigation there perhaps.
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Ian,
The CSB and Baker report were both huge documents. That makes them hard to read and understand, don't you think? The Buncefield investigators have broken their reports down into specific, tight topics, directed at particular parties. That aspect of the Buncefield invetsigation is good.
I'm not pushing a US v UK argument here. I think we should examine the investigation reports into both these extraordinary events and see what worked well and what didn't. We don't have to be a passive audience. We can and should give feedback to investigators.
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By Jay Joshi
It is very evident from the published reports that the primary containment was lost as the high and extra high level alarms/automatic shut-down system did function as expected.
Also, the control room operator(s) did not identify that something was wrong with the level indication/alarm and associated trip systems as fuel was being received in the tank, yet it indicated a "static" level.
The only thing that is a matter for the investigation to maintain as previlged information may be the degree of evidence of the audit trail for the maintainance and upkeep of what would be termed as integrity of "safety critical systems"
The very fact is that the system failed and there are recommendations in various reports pertaining to "protecting against loss of primary containment using high integrity systems" etc. This includes human factors such as training, competence, proper assessment of amnning levels(fatigue) and shift hand-over
No doubt other matters such as land use planning and secondary/tertiary containment are important too
I do not think that anything of learning value for others has been surpressed, albeit some specifics pertaining to the evidence found is not publicised due to potentail prosecution etc.
I feel that in case of the BP TC disaster, BP had no choice but to do all it did to maintain credibility and to demosntrate that it there was going to be a change. The OSHA fines for violations are pitiful in context of fines from HSE prosecutions for major disasters.
OSHA has said it will fine BP $92,000 (£44,700) for breaches for TC. On the otherhand, BP has faced legal suits from workers and their families and paid millions in settlements!
There is a lot to learn from both!
|
|
|
|
|
|
Rank: Guest
|
Posted By Pete48
I wonder whether another significant difference between TC and Buncefield is that in the former it is clearly BP who managed the site. At Buncefield there were a number of operators involved. That must make it almost impossible to get to a situation where anyone other than the investigators would say very much at all in public, or am I beginning to get cynical in my old age?
And maybe it also holds the key to some of the primary causes??
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
"OSHA has said it will fine BP $92,000 (£44,700) for breaches for TC."
Jay, didn't OSHA fine BP $21million?
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Does anyone know if the Buncefield investigation had coercive powers - i.e., the power to subpoena evidence and witnesses?
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
I've always assumed that the full details behind the Buncefield failure would be publicly disclosed. Eventually, perhaps after judicial processes are complete.
Is it possible this won't happen?
The Maryhill building collapse in Glasgow (Stockline) lead to a judicial process that came to an end. The subsequent bulletin from HSE was scant in detail about the circumstances behind the accident.
Is that to be expected with respect to Buncefield? To put it another way, do people expect a complete report of all findings of causal factors to be made public?
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By Phillip
In my opinion there has been ample open discussion, papers & reports on Buncefield.
For me the main common factor between BP & TC is the failure of safety management systems more that the technical issues.
Why are major chemical hazardous sites allowed to operate without employing chemical engineers and process safety specialists. After all to run a pharmacy shop you need a qualified pharmacist.
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Phillip,
"Why are major chemical hazardous sites allowed to operate without employing chemical engineers and process safety specialists"
They do. Buncefield was a COMAH site, so safety specialists would have been involved - employees or consultants.
Texas City had stacks of engineering expertise on site.
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Phil,
"In my opinion there has been ample open discussion, papers & reports on Buncefield."
But what caused the overflow? Does anyone know?
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By peter gotch
Jom.
There is commentary on what caused the overflow on the Buncefield website.
Regards, Peter
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Peter,
Correct me if I'm wrong, but I feel that not all detail has been disclosed (regarding how the tank came to be overfilled).
It has been disclosed that the high level switch was not functional. Perhaps the authorities thought that piece of info needed to get out to industry asap.
It has also been disclosed that the level indication to the panel operator was static, when in fact the tank was overflowing. Has anything being disclosed explaining that?
There are lots of other questions left hanging. In particular, it will be important to know if control software was implicated.
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By Phillip
Perhaps the report to date can only publicly state what has happened. The why and who to blame (and sue) left to the courts
|
|
|
|
|
|
Rank: Guest
|
Posted By Mike Charleston
John
Speaking as a CEng as well as CMIOSH, the link between two failures of level control has been explained to my satisfaction.
Normal level control in the tank consisted of high and low level switches to shut off or open the incoming flow. In case of system failure, a separate ultimate high level switch was available to shut off supply if necessary. That was the system which had operated satisfactorily for years.
The incident occurred as a result of an earlier failure of the ultimate high level switch, which could have happened at any time since the previous functional test (perhaps weeks before - I am not aware of the duration). Once that had failed, level control was completely dependent on a single line of defence - the routine high/low level control system.
The rest, as they say, is history - the second, routine control system failed and there was nothing further installed on the tank that could detect an overfilling incident.
As a hidden failure, ultimate level switches are not always recognised as high priorities for inspection - and are often not tested enough because their chosen frequency of test bears no relation to the desirable level of confidence that it will work when needed.
However frequently a hidden failure is inspected for correct operation, it could fail immediately afterwards, or at any time up to the next inspection. Thats a basic tenet of a logical methodology for assessing such conditions, known as Reliability Centred Maintenance.
In this particular case, I don't know enough to comment on the site's maintenance schedule or their actual performance at the time - I merely reflect what is established wisdom. Hidden failures require close and frequent inspection if their level of reliability must be high (that's why dual and triple safety devices are often specified these days, to reduce the chances of multiple failure to tolerable levels).
In case you haven't guessed, the RCM technique is a particular speciality of mine when I am not acting as a Safety Adviser - contact me direct if you want to know more.
Mike
|
|
|
|
|
|
Rank: Guest
|
Posted By garyh
Another related issue - as a higher tier COMAH site their safety report would have been accepted by the joint competent authority or JCA (ie HSE & EA). So how did they miss (whatever went wrong). You don't get a disaster due to a single causation factor, so how come the shortcomings weren't recognised?
Top and bottom of my point is that the "JCA" has power, but, if it goes wrong' no responsibility. I understand that the buck stops with the site operator, but doesn't some responsibility lie with the JCA?
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Phillip,
"Perhaps the report to date can only publicly state what has happened. The why and who to blame (and sue) left to the courts"
It seems that this is the case. Legal processes are inhibiting full disclosure of the causal factors.
With Texas City, full disclosure of causal factors was rapid, coming first from the company itself, and then from the CSB.
That didn't seem to impede the process of massive penalty from the regulator and civil litigation by victims.
Will all causal factors behind the Buncefield overfill be publicly disclosed one day in the future? Perhaps they won't.
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Mike,
What do you think would have been the trigger to switch incoming flow from the tank to another at the appropriate moment, if everything worked as it should?
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By Robert K Lewis
Philip
Flixboro was being run by purely chemical and process engineers at the time of the disaster!!
Mike
You are indeed correct but we should also bear in mind the maintenance reminder sent out by the HSE regarding the level trip alarms/switches. Apparently the test levers were not padlocked back into place in accordance with manufacturers recommendations. This seems to indicate both a potential design weakness and a loss of information by the system leading to a fail to danger situation.
Bob
|
|
|
|
|
|
Rank: Guest
|
Posted By Phillip
Bob,
As you know one lesson (hopefully) learnt from Flixboro is to work within your area of competence. I think knowing your limits this comes with experience / chartership. I still stand by my opinion COMAH sites should be staffed by competent professional staff(chemical engineers & others). buying in expertise on an ad hoc basis is no substitute.
|
|
|
|
|
|
Rank: Guest
|
Posted By Pete48
Guys, I think John(JOM) has a point that we do not yet have any information on the other contributing factors to the overspill. Whilst I accept the comments about RCM and how it fits into the overall safety profile: the tank level alarms are not the only part of a safe operating system for a long distance transfer operation via a multi-product pipeline.
I could speculate as to the what and where but do not feel it would add anything to the debate at this stage. We have to wait for the official conclusions; if only because we have even less information than I suspect the investaigation team have.
|
|
|
|
|
|
Rank: Guest
|
Posted By Mike Charleston
John: I'm not a competent designer; I have no knowledge beyond what is in the public arena. You have digested all of that and seem to want more.
When it comes to "the trigger to switch incoming flow from the tank to another at the appropriate moment, if everything worked as it should", I really don't have the right knowledge, training or experience to comment - in other words I am not competent. Until more details are available I shall leave speculation or trying to lay blame to others.
Bob: Yes - the classic problem with hidden failures - if anything is disturbed to inspect/verify their capability to respond, that simply adds an extra layer of potential failure(s) to what previously existed.
Mike
|
|
|
|
|
|
Rank: Guest
|
Posted By Pete48
Mike, I do have experience in this specific area and that is why, like John, I am still waiting for some more answers from the investigation team.
Your comments about RCM are both valid and relevant to the later stages of why the overspill eventually happened. Your comments remind us of the fallibility of things mech and elec; and the problems associated with the testing of such safety critical devices. We end up relying upon predictive data.
But we also have to look at the overall design of a safe operating system in which this single component is used. And that involves a whole load else of controlling elements including that fallible machine, the human being.
The key question that I have yet to see answered to my satisfaction is- just how did the fuel terminal get to such a super-critical situation (in operational terms)before the failure of the emergency level alarm occurred and the tank continued to be filled for some time until it overflowed.
I can only speculate that the investigation is covering ground that needs careful technical attention in very difficult circumstances, perhaps with little or no primary data available, and where immense pressures, (social, political and legal) will clearly exist.
Not a task I would accept easily. They deserve our patience; I am sure they are publishing critical information as soon as it is available.
|
|
|
|
|
|
Rank: Guest
|
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Does anyone have knowledge of how the 8,000 m3 cargo of petrol would be switched from the first receival tank to another, once the first tank was full?
I mean in terms of procedures and computer control.
Does anyone have knowledge of how this is typically done?
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By Jay Joshi
The first tank can have "high level" sensing calibrated in volume with relevant "redundancy" so that the failure of one sensor will not cause loss of sensing.
In terms of computer control, it will be subject to hazop and fail safe shut down modes.
I am not an expert, but this is the job of process/chemical/instrument engineers.
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Thankyou Jay,
I understand what you say. What I don't understand is the plan for the cargo of 8000 m3 of petrol to be delivered to a tank that cannot contain that amount.
There must have been a plan.
The investigators must know the detail of that plan.
Nothing has been released to the public.
John.
|
|
|
|
|
|
Rank: Guest
|
Posted By jom
Jay,
What question would you put to the investigators?
John.
|
|
|
|
|
|
IOSH forums home
»
Our public forums
»
OSH discussion forum
»
Major chemical accidents - open vs. suppressed discussion
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.