Robin Turney says the lessons learned from the disaster are still as relevant now as they were in 1974
FIFTY years ago, at 16:35 on Saturday 1 June 1974, a massive explosion destroyed the Nypro chemical plant at Flixborough, UK. The incident took the lives of 28 operators and injured 36 others. In addition, 53 members of the public were injured and almost 2,000 houses, shops, and factories in the surrounding area were damaged. Had it occurred on a weekday, the toll of deaths and injuries would have been much greater.
The explosion shattered the confidence of the chemical industry. It led to a step change in the way in which hazardous plants were designed, operated, and regulated. How did the accident happen, what were the root causes, what changes were introduced and, most importantly, how relevant is the incident 50 years on? This and a series of future articles and webinars will attempt to answer these questions over the coming months.
The basic details of the plant and the events leading up to the disaster will already be known to many and have been reported in a number of places1,2 including an article in the Loss Prevention Bulletin in 2023 which won the SIESO Medal.3 The events are summarised below:
Immediately after the disaster a Court of Inquiry was established with a remit to “establish the causes and circumstances of the disaster as speedily as possible”. Managers and operators on the plant and technical witnesses were interviewed (173 interviews in total). In addition, research into the failure of the bellows was commissioned.
The Inquiry identified a number of deficiencies in the temporary bypass. Calculations showed that, although the bypass could withstand normal operating conditions, it was highly likely that the bellows would “squirm” and fail at a pressure of 10.3–10.4 barg, below the relief valve setting of 11.0 barg. However, the plant had operated for almost two months without any obvious problems and a large part of the Inquiry was therefore devoted to examining alternative explanations. The Inquiry concluded that the most probable explanation was that “the disaster was caused by the introduction into a well-designed and constructed plant of a modification which destroyed its integrity”.3
After the report was issued, Ralph King, an industrial chemist working at the Health & Safety Laboratory, suggested that the failure could have been initiated by free phase water mixing with hot cyclohexane, vaporising and causing a sudden pressure rise.4 In his graphic novel, Nylon Years, Rahim Abhari5 also supports this theory, suggesting that the decision to stop the stirrers contributed to the disaster. In 2000, the Health and Safety Executive (HSE) commissioned work by Tim Snee at the Health & Safety Laboratory6 to study the “water theory”. This confirmed a sudden pressure rise when water mixed with hot cyclohexane of almost 4 bar which would have been sufficient to exceed the relief valve set pressure under conditions similar to those during startup.
As with most disasters, a number of factors were involved. The water theory could explain why the bypass failed on 1 June having operated for the previous two months without a problem. In his book, Safety in the Process Industries, King states that “The expected pressure rise, while sudden and violent, would probably not have ruptured a well-designed and constructed plant, but was clearly sufficient to destroy the faulty bypass assembly”.
Fifty years on, it is highly unlikely that it will be possible to reach any better conclusions than those of the Inquiry.
Lessons learned from the disaster included:
Implementation of the above measures would have either prevented or reduced the severity of the accident and will be discussed over the following months both in this magazine and the Loss Prevention Bulletin. There is, however, little doubt that the failure to have a competent maintenance organisation was at the heart of the disaster.
Before considering the maintenance organisation, it is important to understand the way in which the work to replace Reactor 5 was undertaken. The decision was made at a meeting of the management team, including the works manager and plant managers, two of whom were qualified chemical engineers. Also at the meeting were maintenance engineers and supervisors, none of whom had attended degree courses or belonged to professional engineering institutions. “The emphasis at the meeting was directed to getting the process on stream again with the minimum possible delay”.1 As noted above, the crack in the reactor was massive and although metallurgists at DSM in Holland had been contacted, no attempt was made to examine the other reactors.
Once the decision had been made to bypass Reactor 5, all further work seems to have been left to the electrical engineer, who was coordinating, the maintenance department, and the other engineers/supervisors. A connecting pipe of 500 mm diameter, which required a dogleg, was fabricated to link the two expansion bellows, Reactor 5 was removed and the new pipe installed, supported on scaffolding. The new pipe was pressure-tested with nitrogen (a more hazardous procedure than the normal hydraulic test). All the work was carried out rapidly, fabrication was completed in about 30 hours and the plant was ready to restart on 1 April, just four days after the decision was made to construct the bypass.
Although the connecting piece, which had been drawn out in chalk on the workshop floor, had the correct dimensions, many critical engineering issues had not been addressed:
The Inquiry concluded that “a competent mechanical engineer would have understood the importance of the above measures”.
How effective would procedures in use today have been in identifying and preventing the incident?
With such a large inventory of cyclohexane above its atmospheric boiling point, integrity of containment was of critical importance. However, at the time of the disaster, process safety was a new concept and the need for comprehensive safety management systems had not been recognised.
Had safety critical roles been identified, for example by following the steps outlined in the EPSC guide Process Safety Competence7 or using the ISC Guidance,8 the need for a qualified mechanical engineer would have been highlighted. This, together with a management of change procedure (which was not used at the time and will be covered by another author), would have required formal approval of the bypass and prompted the management to call on the expertise of a qualified mechanical engineer.
The departure of the mechanical engineer was clearly an organisational change, albeit an enforced one.
The management appreciated that the organisation was weak and a senior engineer at NCB (a co-owner of the plant) had agreed to support the site. However, no contact was made with this engineer while the changes were being made.
The need to examine organisational changes with the same thoroughness as mechanical or process change is now recognised, for example in the Energy Institute guide, Managing major accident hazard risks (people, plant and environment) during organisational change.
The short time taken to complete the modification indicates that the engineers and maintenance supervisors were competent in their day-to-day work. However, it is quite clear that their training did not provide the necessary theoretical knowledge and broader view required to design the bypass or to meet the HSE definition of competence – “the combination of training, skills, experience, and knowledge that a person has and their ability to apply them to perform a task safely”.
This was a management failure and does not assign any blame to those who constructed and installed the connecting piece.
Following the departure of the mechanical engineer, responsibility for the coordination and planning of the maintenance organisation was given to an electrical engineer on a temporary basis. He had an ONC (equivalent to an A-level) in electrical engineering. There is no mention of the technical qualifications of the other engineers, or maintenance supervisors, who responded to the electrical engineer. In relation to the electrical engineer who was coordinating the engineering department at the time, the report states: “In the view of the Inquiry he was not qualified to act as a coordinator of the engineering department and should not have been asked to assume this responsibility.”
More recently, guidance to inspectors issued by the HSE noted that “…a review of major accidents across hazardous industries found a lack of competence contributed to many of those accidents, including; Southall Rail Crash, BP Texas City, Piper Alpha, Esso Longford and Buncefield”.
Responsibility for establishing a competent organisation starts at the top. In its report, Corporate Governance for Process Safety,9 the Organisation for Economic Co-operation and Development (OECD) recommends that “CEOs and leaders assure their organisation’s competence to manage the hazards of its operations and ensure there are competent management, engineering, and operational personnel at all levels”.
Major changes are occurring across a range of industries at present, with many more engineers working in small and medium-sized enterprises (SMEs). In a smaller organisation it may not be possible to hold all the skills needed and in these cases arrangements for external professional assistance, possibly on a “retainer” basis, need to be in place.
Although Nypro was credited as having a good attitude to personal safety, the concept of process safety was relatively new and still developing.
As noted above, the Inquiry concluded that in the meeting which decided to install the bypass “…the emphasis…was directed to getting the oxidation stream back on stream with the minimum possible delay”.
Only one of those at the meeting, the maintenance engineer responsible for the reaction section, is reported to have had concerns about restarting production before the cause of the failure to Reactor 5 was known and the other reactors inspected. There is no record of any action being taken to address these concerns. The Inquiry notes: “We have no doubt, however, that it was this desire (to restart) which led to them overlook…that it was potentially hazardous to resume production…”
There are always pressures to return a plant to production and a good safety culture is essential to ensure all risks are properly assessed. More recently, the Commission investigating the 2010 Deepwater Horizon disaster identified eight critical decisions made by bp and its contractors where a time-saving option was adopted where lower risks options were available.10 The disaster led to the loss of 11 lives and is reported to have cost bp US$40bn.
The Inquiry also noted “none of the senior personnel in the company, who were chemical engineers, were capable of recognising…what is in essence a simple engineering problem”.
We always need to be careful in attempting to apply today’s standards to past situations. The managers 50 years ago were working in a very different environment and the many procedures, guides, and standards in use today were just not available to them.
There is no doubt that the process industry is very much safer than it was 50 years ago. However, serious accidents still occur, sometimes due to failings similar to those which have happened before. Flixborough reminds us of the consequences of failing to have an effective safety management system able to react to both planned and enforced changes and supported by a safety culture which recognises the importance of safety in all aspects of operations.
Following the disaster, the study of Flixborough was included in the training of chemical engineers.
There are two other important lessons which are just as relevant today as they were 50 years ago:
I would like to thank members of the IChemE Safety & Loss Prevention SIG, the Loss Prevention Bulletin, and the Major Hazards Committee for their help in preparing this article.
1. https://www.icheme.org/media/17752/the-flixborough-disaster-report-of-the-court-of-inquiry.pdf
2. RD Turney, Flixborough: Lessons which are still relevant today, LPB 237, p 21, 2014
3. J Carver et al, Flixborough – looking forward, LPB 289, p 24, 2003
4. RW King 1975. A Mechanism for a Transient Pressure Rise, IChemE Symposium, The Technical Lessons of Flixborough, Nottingham, December
5. https://www.icheme.org/media/26138/nylonyearslpbcompletenew.pdf
6. TJ Snee, Interaction between water and hot cyclohexane in a closed vessel, Trans IChemE, Vol 79, part B, 2001
7. Process Safety Competence, How to Set Up a Process Safety Competence Management System, European Process Safety Centre, Report Number 35
8. https://epsc.be/Documents/Reports/EPSC+Reports+Available/_/ReportNo35.pdf
9. Corporate Governance for Process safety: Guidance for senior leaders in high hazard industries, OECD
10. Deepwater Horizon, BP Gulf of Mexico Oil Spill, US Environmental Protection Agency, ISBN 978-0-16-087371-3, 2011
The Loss Prevention Bulletin is running a series of articles in its June issue to mark the 50th anniversary of the Flixborough disaster.
Among them, Andy Brazier looks at the effect of control room location, architectural design, systems configuration and human factors on major accident consequence and likelihood, while IChemE members provide their own personal reflections on Flixborough.
There is also an interview with process engineer Ramin Abhari, author of Nylon Years, a graphic dramatisation of the disaster.
You can find these articles and an archive of previous pieces on Flixborough online at https://www.icheme.org/knowledge-networks/loss-prevention-bulletin/
We think of those who lost their lives in the disaster:
John Barrett, Wayne Bradshaw, Terry Carter, Kenneth Crawford, Michael Clark, Roland Cribb, Thomas Crookes, James Doherty, Stephen Drury, Anthony Freear, Ronald Forester, Stanley Grundy, Mick Hickson, Edwin Holland, Ian Kidner, Allan Lambert, Dennis Lawrence, Thomas Leighton, Geoffrey Marshall, Albert Nutt, John Render, Graham Richards, Rick Simpson, Michael Skelton, Harry Stark, Geoffrey Twiddle, Frederick Watkinson, and Keith Winter.
Catch up on the latest news, views and jobs from The Chemical Engineer. Below are the four latest issues. View a wider selection of the archive from within the Magazine section of this site.