Disasters

Published on January 2017 | Categories: Documents | Downloads: 52 | Comments: 0 | Views: 292
of 12
Download PDF   Embed   Report

Comments

Content

Disasters Database
CONTENTS
Page
2.

Kegworth

3.

Moorgate Underground

4.

Piper Alpha

5.

Three Mile Island

6.

Chernobyl

7.

Kings Cross

8.

Herald of Free Enterprise

9.

Clapham Junction

10.

Grangemouth

11.

Flixborough

12.

Seveso

Bhopal

Kegworth Air Disaster
A Boeing 737 Airliner had taken off on a routine flight from London to Belfast. There had previously
been a problem with vibration in the right-hand engine, and the maintenance log showed that this
had been attended to. The pilot had read the maintenance log prior to take off. The air conditioning
on a 737 is driven mainly from the right-hand engine. During the flight the pilot detected vibration
and an excess of smoke and fumes, and he throttled back the right hand engine. At the same time
the left hand engine throttled back automatically. There is some suggestion that a warning light
showed that there was a fire in the right hand engine. The pilot obtained permission to land at East
Midlands Airport near Nottingham and Derby. It was then found that the signal had been incorrect
and that the wrong engine had stopped; the problem was in the opposite side engine. The pilot
would have had little difficulty landing the plane with one engine, but now had to attempt to land it
without an engine. He landed a few miles short of the runway on the M1 motorway near the village
of Kegworth. There were fatalities and injuries.

Moorgate Underground Accident
The accident happened at Moorgate underground station. Train no. 272 consisting of 2 x 3 car
units of 1938 tube stock were coupled together to give a total length of 316ft 6in and 151 tonnes.
The passenger train was carrying 300 passengers. The train overshot the station platform, at a
speed estimated at 30 or 40 miles per hour, knocked down a warning light on the track, dispersed
a sand drag, and hit the hydraulic buffers at speed. The leading car reared up and impacted with
the tunnel roof. The second carriage ploughed into this and the third carriage was concertinaed.
The final two carriages were undamaged.
The driver and 42 passengers were killed and 74 passengers were injured.
The investigation was unable to find a conclusive cause for the incident. The driver was
experienced, but the guard had limited training, and had only been put with the driver for this shift
because of staff shortages.
The train maintenance and the driver’s brake and control checks seem to have been in order.
There were Westinghouse brakes on each car, which the driver has to check before taking the train
on passenger duty. The train had made a number of runs that morning without any problems.
A number of employees spoke to the driver that morning and reported that they had no reason to
suspect anything abnormal. The accident enquiry found no evidence for faulty controls, since all
damage appeared to have been caused by the impact. The train uses a “dead mans handle” as the
control. The driver appears to have taken no action to slow the train. The post mortem revealed no
evidence of heart failure or stroke, but there was some evidence of alcohol. This was not
conclusive, because it could have been produced by a fermentation process after death. The driver
only occasionally drank and in moderation. The level found was below that permitted for car drivers
in any case.
A verdict of accidental death was recorded.
The report criticises the safety systems used. Technology was available to automatically slow down
a train which was going too fast. The sand drag would only have been effective if the train had
been almost stationary. The buffers also would only cushion a minor impact.

Piper Alpha
On 6th July 1988 there was a disastrous fire on the Piper Alpha oil rig in the North Sea. 167 men
were killed and many who survived were injured and traumatised.
The rig was operated by Occidental Petroleum (Caledonian) Limited. Piper Alpha was part of a
linked operation involving four rigs. The operation involved gas, compressed gases and crude oil.
The various operations on Piper Alpha were in modules which were stacked on top of each other.
The helicopter landing pad was on the highest level, and on top of the main accommodation
module.
226 men were on the platform; 62 were working the night shift, and the majority of the others were
in the accommodation modules.
At 22.00 hours there was an explosion followed by a fireball which started from the west end of B
module. This was quickly followed by a series of smaller explosions. The emergency systems,
including fire water systems, failed to operate. Three may day calls were sent out, and the
personnel assembled on D deck. The radio system and the lighting then failed.
At 22.20 hours there was a rupture of the gas riser of the Tartan supply (another rig – but the
pipeline was connected to Piper Alpha), and this was followed by another major explosion, with
ignition of gas and crude oil.
At 22.50 there was a further explosion with a collapse of much of the structure.
There is a mass of photographic evidence, taken from the other rigs and ships in the area, but
some problem in fixing the exact time of each. The enquiry is very thorough, but unable to come up
with clear conclusions. Gas detection equipment was working, but some water systems had been
turned off, and some welding operations were in progress. The report criticises the platform design,
and the lack of safety systems. It called for major changes in disaster planning and auditing, and
most of these recommendations are now in place.

Three Mile Island
An explosion took place which involved a pressurised water nuclear reactor. In this type of reactor,
heat is removed from the core by a pressurised water circuit which prevents the water from boiling.
The primary water circuit heats up a secondary water circuit via a heat exchanger. The boiling
water in the secondary circuit is used to drive a steam turbine. The radioactive parts are enclosed
in a containment building.
A fault occurred in the secondary steam circuit, which resulted in the steam turbine tripping out. It
had the effect of preventing heat removal from the reactor core. The heat produced in the core was
stopped automatically by the lowering of the absorption rods. The reduction was not instantaneous,
so some heat was still generated by radioactive decay and the primary water boiled. This is not a
serious fault. A relief valve lifted and the make-up water pumps operated automatically to replace
water which had evaporated. The relief valve stuck open, but the control room light indicated that it
was closed. The operators should have realised what was actually happening by comparison with
other readings. The actual situation was that the valve was open and the primary water was
boiling, but the pumps were replacing the water. If the operators had done nothing, the system
would have cooled naturally and safely.
However, they shut down the pumps because they had been warned of the danger of too much
water in the primary circuit. The water level fell and temperature damage occurred, resulting in the
release of radioactive material when the containment enclosure ruptured. A major factor was that
the operators did not understand the relationship between pressure and temperature in the primary
circuit. The boiling point of water depends upon the pressure, a fact which the qualified operators
were unaware of.
Modern training takes place in a simulated control room. The operator is presented with readings
and is expected to diagnose faults and suggest remedial action. All foreseeable scenarios are
learned. Inherently safer designs are now proposed and in use.

Chernobyl
This was another boiling water nuclear reactor incident, but involving a design (RBMK) used only in
former Soviet countries.
One design fault is that the reactor is unstable at outputs below 20%. Any rise in temperature
creates an increase in power output, which causes a rapid temperature increase. (Other
commercial designs give a fall in heat output if there is a temperature rise).
The operators were told not to go below 20% output but there was nothing to prevent them from
doing so.
An experiment was being conducted. It would be another year before it could be tried again if the
opportunity was missed. The objective was to see if the reactor developed enough power during
shutdown to operate auxiliary equipment during the minute before the emergency diesel
generators started. The reactor was operated at below 20% output, with the automatic shutdown
equipment isolated. The temperature rose by 100% in one second. He nuclear core melted and
went through the bottom of the structure and into the bedrock below. The nuclear fallout was
detected in Sweden and the UK before there was an official report from the Ukraine.

King’s Cross Railway Station
In 1987, 31 people were killed and many more injured in an Underground station fire. The
immediate cause was a lighted match, dropped by a passenger on an escalator, which set fire to
grease and dust. A metal cleat which should have prevented the match falling through was
missing. The running tracks were not cleaned regularly. Rubbish and other materials collected in
the space below the escalator and were not systematically cleared up. The fire spread rapidly to
the wooden treads, skirting boards and balustrades. The automatic sprinkler system did not
operate. The water valves were not marked. Employees had no training in emergency procedures.
About twenty fires per year had occurred, but lessons had not been learned. The fire could have
been prevented by:
 Replacement of wooden escalators
 Installation of smoke detectors
 Automatic sprinkler system
 Better training of staff
 Early call out of the fire brigade
The official report said there was no clear definition of responsibility, no auditing and no interest at
senior levels. It also said there was “little exchange of information or ideas between departments
and still less cross-fertilisation with other industries and outside organisations”.

Herald of Free Enterprise
Also in 1987, a cross-Channel ferry sank with the loss of 186 passengers and crew just after
leaving Zeebrugge in Belgium. The bow doors had been left open because the assistant bosun,
who should have closed them, was asleep in his cabin and did not hear the announcement that the
ship was ready to sail. The underlying problems were:
 Poor ship design; and
 Poor management.
The cargo deck of a “ro-ro” ferry is close to the water level. If the cargo deck floods and the ship
lists, sea water runs to one side of the ship and makes it unstable.
Officers and crew worked different shift patterns. It was not usual for the captain to be told
everything was in order before sailing. If no defects were reported he assumed all was in order
(managing by exception?). There was no monitoring system. Responsibility for safety was unclear.
Senior management in the company were not qualified in nautical matters and did not listen to
those who were. The Board of Directors were not aware of their responsibilities for the safe
management of their ships. The Chairman, who had spent most of his career in property
development, was quoted as saying: “Shore-based management could not be blamed for duties
not carried out at sea”, yet it is easy to audit a ferry as a fixed plant.
A request for some method of confirmation that the bow doors were closed had been requested by
the ferry captains after previous incidents, but had been refused by senior management.

Clapham Junction
This railway accident in 1989 caused 35 fatalities and about 500 other injuries. A signalling
technician did not deal correctly with disused wires which were being renewed. The method he
used, although against the rules, had become standard practice and was not corrected by
management. He disconnected a wire at one end only and did not insulate the other bare end.
Because of this, a slip occurred and a wrong connection was made; The signals gave a wrong
indication. The slip could have been the result of the electrician working many weeks without a
break, but it could also have been made in normal circumstances. His work was not supervised
since the supervisor was also too busy. The “safe” system of work, which involved checks at three
levels (installer, supervisor, tester) was not followed.
Other errors were:
 Failure in communicating instructions
 Failure to learn from past incidents
 Failure to employ suitable staff
 Failure to follow up problems
 Failure by senior management to be aware of what was going on
The effect was that the signalling system was faulty and two trains collided.

Grangemouth Refinery
Three separate incidents in which there were 4 fatalities, all to contractors, and there could have been
serious consequences for the general public.
INCIDENT 1
A fire involving flammable liquids took place on 13th March 1987. This incident occurred during a repair to a
pipeline carrying a flammable gas and liquid/ Valve 17 was not closing properly and was sending usable gas
to the flare stack. The problem was diagnosed as caused by scale in the valve. Valve 17 was isolated and
was being blocked off. The system was regarded as being safe but in fact it was not. Another valve and
testing point was also blocked by scale.
Tests had involved a pressure gauge reading (which indicated zero) and a check for liquid in the pipeline.
Only a small amount of gas and no liquid passed out, so it was assumed that the pipeline to valve 17 was
empty. In fact it contained a large quantity of flammable liquid. A permit to work was issued which suggested
there was a risk of ignition from pyrophoric scale in the pipeline; so some positive gas pressure in the pipe
was desirable. When the pipeline was opened there was a release of gas and flammable liquid under
pressure. The fitters expressed concern but the “authorised person”, even though he noted gas and liquid
escaping, pronounced the situation safe. When the spacer was removed a large quantity of liquid was
released, which formed a cloud of flammable vapour and was ignited from a nearby compressor.
Two men were killed and two others were seriously injured in the fire. The report suggests that the incident,
while unusual, was foreseeable. There was no attempt to exclude all ignition sources. There were poor
escape routes and the permit-to-work system was not suitable for the risks involved.
INCIDENT 2
Later in March there was a major explosion at the hydrocracker plant during recommissioning after repair.
The process involved is “cracking” low-grade wax and thick oils, using hydrogen gas at temperature, to form
petrol, light oils and gas. Hydrogen is explosive.
When the hydrocracker was being recommissioned after service, there was an automatic shutdown after
restarting. The temperature cut-out, which should operate at 425 oC, had initiated the alarm and shut down
the process. It was assumed the safety device was faulty and so it was short-circuited.
There were no problems on start-up except for some unusual vibration at a compressor. It was held on
standby, with no feedstock, until a supervisor arrived.
There was a violent explosion in which one man was killed. Fortunately it was a Sunday and there were few
people on site. The vessel of the hydrocracker weighed 20 tonnes. Parts of the vessel were found at great
distances. One piece, which weighed 3 tonnes, was found on a beach 1 km from the site.
The usual pressure was 9 bar, but the test pressure was 21.6 bar. It was assumed that the real pressure had
been about 50 bar. Because some of the safety trips were not operational, high-pressure gas from some
other part of the plant had pressurised the vessel.
INCIDENT 3
A fire occurred in a crude oil storage tank at Dalmeny Oil Storage Terminal on 11th June 1987, when
contractors were slearing sludge from a crude oil storage tank. Such tanks are large structures with a floating
roof held on pillars. There were large open manhole type entrances near ground level. The men were
wearing breathing apparatus of the piped air type. They were working in teams of four. Three men were in
the tank, operating a hydraulically powered scraper, like a small bulldozer. One man was outside. The sludge
gave off a heavy flammable vapour and there was a small amount of liquid on top of the sludge.
The man outside noticed flames inside and raised the alarm. Two men escaped, but the driver of the scraper
ran in the opposite direction and was trapped. He died of burns and asphyxiation. The enquiry could not find
a cause of ignition, until one of the survivors admitted to smoking and dropping a cigarette end. Two other
workers, on other shifts, also admitted to smoking. They took off the breathing apparatus to smoke. The man
who died was a non-smoker. Smoking was forbidden under the terms of the contract, but the dangers and
conditions were not explained to the workers. There was no ventilation of the tanks.
You would expect that one incident of this nature would concentrate thinking and concern, but the three
incidents happened over a very short period. There has also been a more recent event involving the same
plant.

Flixborough
At 4.53 pm on 1 June 1974 there was an explosion at a chemical factory owned by Nypro (UK) Ltd at Flixborough on
Humberside. It was equivalent to between 15 and 45 tonnes of TNT; 26 employees were killed and 36 injured. There
were 53 reported injuries to people outside the plant and many unreported.
Smoke rose to a height of over 6,000 feet so aircraft had to be diverted; some debris was found 12 miles away and many
fires were started within a radius of 3 miles. The 60 acres site was devastated, together with over 2000 houses, factories
and shops around the plant.
The plant oxidised cyclohexane which, when heated to 155oC at a pressure of 126 psi (8.8 bar) produced caprolactan, a
substance used in the manufacture of nylon. According to the chemical inventory the plant stored large quantities of
benzene, toluene, naptha and gasoline, all of which are very highly flammable materials.
The process consisted of six reactors in series containing a total of 120 tonnes of cyclohexane and a small amount of
cyclohexanone. The final reactor in the process contained 94% cyclohexane. There was a massive leak followed by a
large unconfined vapour cloud explosion and fire. It was estimated that 30 tonnes of cyclohexane was involved in the
explosion. The accident occurred on Saturday; on a working day casualties would have been much higher.
The chain of 6 reactors (retorts), each lined with stainless steel, were linked to each other by a 28 inch diameter pipe,
and there was a set of bellows at each end of the pipe to allow for expansion. No. 5 retort had developed a 6-ft crack and
in order to take it out of use a bypass pipe 20 inches in diameter had been fitted between Nos. 4 and 6 retorts. As each
retort was 14 inches below the next, a “dog’s hind leg” had to be welded into the pipe; this pipe was fabricated from
material on the site and not from the same material as specified by the original manufacturers.
The use of expansion joints (bellows, in this case) which were improperly installed may have been a principal reason for
the accident. This provides additional reasons not to use expansion joints (except in special exceptional circumstances).
When re-commissioning the modified plant it was considered that the working pressure on the pipe and bellows would
have been 38 tonnes; a straight pipe would have withstood this pressure but the dogleg did not.
During the inquiry it was observed that the post of Works Manager was vacant and that the other chemical engineers on
site were not capable of solving engineering problems. The replacement pipe was not to the standards laid down in BS
3511:1971; also the instructions as to how to fit the bellows had not been read. The chemical inventory exceeded the
quantities allowed by the licence by 51 times.
Several new metallurgical observations were made during the enquiry. First, that in the presence of zinc, stainless steel
can become embrittled and suffer cracking when under heat and stress. Only small quantities of zinc are necessary and
they could be found in the galvanised platings on walkways, sheets of galvanised iron and fittings; the zinc need only be
near the stainless steel. When nitrates are added to the cooling water it can cause nitrate stress corrosion in the steel of
the reactors. A third observation was that the stainless steel can produce creep cavitation when subjected to small fierce
fire, which can cause a fracture in the pipe within a matter of minutes.
CAUSES OF THE ACCIDENT
The immediate cause was determined as failure of a pipe which was replacing a failed reactor, leading to the release of a
large vapour cloud of cyclohexane that ignited. There were however, many contributory factors:
(a) The reactor failed without an adequate check on why (metallurgical failure)
(b) The pipe was connected without an adequate check on its strength, and on inadequate supports
(c) Expansion joints (bellows) were used on each end of pipe in a dog-leg without adequate support, contrary to the
recommendations of the manufacturer
(d) There was a large inventory of hot cyclohexane under pressure
(e) The accident occurred during start-up
(f) The control room was not built with adequate strength, and was poorly sited
(g) The previous works engineer had left and had not been replaced. According to the Flixborough report, “There was
no mechanical engineer on site of sufficient qualification, status or authority to deal with complex and novel
engineering problems and insist on necessary measures being taken”
(h) The plant did not have a sufficient complement of experienced people, and individuals tended to be overworked and
liable to error.
Management deficiencies:

A lack of experienced and qualified people

Inadequate procedures involving plant modifications

Regulations on pressure vessels that dealt mainly with steam and air did not adequately address hazardous
materials

A process with a very large amount of hot hydrocarbons under pressure and well above its flashpoint installed in an
area that could expose many people to a severe hazard.
The cost of this disaster is estimated to have been in the order of £27 million for damage to the factory and £1.6 million
for the repair of shops and houses, at 1975 prices. It is a typical example of the causes and subcauses all adding up to a
major accident.

Seveso
In July 1976 a bursting disc ruptured on a reactor in a factory near Milan. The reactor was used to
manufacture trichlorophenol at a temperature of 170oC to 185oC and it was heated by steam at
190oC. It had been assumed that the reactants could not attain the runaway temperature of 200oC,
at which the hyper-poison TCDD (tetra-chlorodibenzo dioxin) would be produced as a by-product.
The reactor was listed as working at atmospheric pressure.
The bursting disc, rated at 3.5 bar, was to protect it from over-pressure during transfer of the
contents using air pressure. It vented directly to atmosphere above the roof of the single-storey
building.
At about 6 am on the day of the accident the reactor was shut down before the aciduration stage,
which released the trichlorophenol product. All external power was shut off including the
temperature recorder, which indicated 160oC. The cause of an ensuing exothermic reaction was
not proved but the reactor contents probably reached 300oC before the disc ruptured.
Approximately half the reactor contents escaped in 20 minutes. Estimates of the amount of TCDD
released vary from 0.25 kg to 3.0 kg.
There were provisions for cooling, using steam coils, for dumping 3,000 litres of cold water into the
reactor, and for using the reflux condenser. These all required manual actuation. Had they been
automatic they would have remained inoperative with the power off!
Several people died and nearly 100 people were treated for skin burns and other ailments. Two
men were treated in hospital for poisoning. Heavy rains bought the cloud to earth, killing livestock
and defoliating vegetation. At least 250 had to be evacuated and all the couples in the outer area
were advised to avoid sexual relationships for some time; women were advised to avoid
contraception for at least 3 years. Motorists driving near the area were advised to keep car
windows closed. Orders were given to troops to shoot anyone trying to enter the fenced zone
where farm animals and pets were continuing to die. There is no knowledge as to how long the
land will be contaminated.

Sponsor Documents

Or use your account on DocShare.tips

Hide

Forgot your password?

Or register your new account on DocShare.tips

Hide

Lost your password? Please enter your email address. You will receive a link to create a new password.

Back to log-in

Close