BP Oil Grangemouth
Events at this location
Audits & Reviews
Commitment & Culture
Compliance with Standards
Control of Work
Management of Change
MONITORING & IMPROVEMENT
PROCESS SAFETY MANAGEMENT
Food & Drink
Onshore Oil & Gas
Plastics & Polymers
Pulp & Paper
Papua New Guinea
Fluid release to ground
Fluid release to water
Gas/vapour/mist/etc release to air
Rapid phase-transition explosion
Runaway reaction explosion
Solid release to air
Solid release to ground
Solid release to water
Design of Plant
Loss of Process Control
Physical Security Breach
COST (On Site)
ENVIRONMENTAL (On Site)
HUMAN (Offsite At Risk)
HUMAN (Offsite Fatalities)
HUMAN (Offsite Injuries)
HUMAN (On Site At Risk)
HUMAN (On Site Fatalities)
HUMAN (On Site Injuries)
> 100 Fatalities
< 100 Injuries
11 - 100 Fatalities
11 – 100 Fatalities
≥ 100 Injuries
PSV – Pilot Operated
Safety & Control
Shell & Tube
Valves - Safety
Methyl Ethyl Ketone
Oil based solvent
Urea Ammonium Nitrate
Vinyl Chloride Monomer
Live Event Type
Quantitative Risk Assessment
Dust Safety Science
Dutch Safety Board
New Zealand Government
Process Safety Integrity
Step Change in Safety
Corrosion Under Insulation
High Pressure Water
Loss of Utilities
Low Temperature Embrittlement
Normalization of Deviance
Safe Operating Limits
Stress Corrosion Cracking
Permit To Work
Learning from Incidents
Floating Roof Tanks
Minute To Learn
Safety Critical Decisions
202313MarAll DayBP (Grangemouth) Refinery Fire 1987BP Oil Grangemouth (GB)Lessons:Asset integrity,Control of Work,Operational IntegrityIndustry:RefiningCountry:United KingdomLanguage:ENLoC:Maintenance error Origin: HSE Incident:Flash fireHazards:FlammableImpact:HUMAN (On Site Fatalities)Effects:1-10 FatalitiesMaterial:Hydrocarbons
Fifteen months before the incident occurred it had been noticed that the flare line isolation valve V17 was passing. It was decided however to wait for a scheduled shutdown of
Fifteen months before the incident occurred it had been noticed that the flare line isolation valve V17 was passing. It was decided however to wait for a scheduled shutdown of the catalytic cracker unit and No 1 flare before commencing work on the valve. Gases from the remaining operating units were re-routed to No 2 and No 3 flares. This flare arrangement would allow the pipelines at V17 to be isolated.
When senior refinery staff prepared a plan for the isolation of the flare system, they concentrated on the operational and safety requirements of the flare system, making sure that no operational areas of the plant were inadvertently isolated. The details of the removal of V17 were not considered and left to those who would be responsible for the work.
Four workers were involved with the removal of the valve. When the majority of the bolts were undone the joint opened slightly and liquid dripped from a small gap between the flanges. The workers sought advice. The valve was checked and it was concluded that it was safe to carry on. Non ferrous hammers were provided before continuing with the removal. All the bolts were removed and the crane took the weight of a spacer and started to remove it, at which point gallons of liquid poured from the valve. A flammable vapour cloud formed from the rapidly spreading pool. The cloud reached the nearby air compressor, ignited and flashed back around the working area.
Two workers managed to escape the fire but a fitter and a rigger were engulfed by the flames and killed. The fire was allowed to burn in a controlled manner for almost two days while the rest of the refinery was shut down and the flare system purged with nitrogen
• DESIGN CODES – PIPEWORK
• MAINTENANCE PROCEDURES
Image Credit: HSE
202329May00:0023:59BP (Grangemouth) Power Distribution Failure 2000BP Oil Grangemouth (GB)Lessons:Contractor Management,Control of WorkIndustry:RefiningCountry:United KingdomLanguage:ENLoC:Impact Origin: HSE Incident:IMPACTHazards:ElectricalImpact:COST (On Site)Effects:Financial
On 29th May 2000 at 18:07 p.m. all power was lost to No. 1, 5 & 10 electrical substations that supply electrical power to the North Side of the Complex
On 29th May 2000 at 18:07 p.m. all power was lost to No. 1, 5 & 10 electrical substations that supply electrical power to the North Side of the Complex which contains the Oil Refinery, various chemical plants, utility plants and logistics facilities.
As a result, emergency shutdown of the Oil Refinery and the chemical plants on the North Side occurred and the utility plants were also affected due to a loss of power to the main cooling water pump systems. (There was some smoky flaring visible as a result of the emergency shutdown.)
In addition because of the duration of the power failure, a controlled shutdown of some other facilities elsewhere on-site (some chemical plants on the South Side and the Kinneil operations) was also necessary because the supply of steam for the correct operation of the flare system could not be maintained.
The HSE concluded that the power loss which occurred on the 29th May 2000 was caused by an earth fault on a 33kV underground power cable between No.1 and No.5 sub-station and the failure of the 33kV circuit breaker in No.1 sub-station to trip and clear the fault.
The source of the earth failure was not immediately apparent. The cable which failed was situated in the bottom part of the excavated trench, almost in the side wall of the trench and only protruded from its protective cable tile over a short length.
The fault was ultimately cleared by two 33kV circuit breakers in No.2 electrical sub-station resulting in power loss to No.1, No.5 and No.10 electrical sub-stations.
The immediate cause of the power distribution failure was a combination of two direct causes:
The Earth Fault
Forensic evidence indicated that the earth fault was caused by physical damage to the cable from an air powered tool known as a clayspade.The
clayspade equipment was operated by a number of different personnel during the construction of the trench and the cable was protected over the majority of its length, except in the location where the damage occurred, by the protective cable tile system. All personnel were aware of the responsibility to report any problems during the construction of the trench but none were reported. As a result of the damage the integrity of the lead sheath on the cable was breached, allowing water ingress, weakening of the cable’s insulation and the resultant earth fault.
Circuit Breaker Failure
The cable fault described above should have caused the 33kV circuit breaker in No.1 electrical sub-station to operate and clear the fault. However it failed to operate because its earth protection relay had been disabled by two small sections of plastic (cable ties with the ends cut-off) inserted in the connections between the relay and its current transformer. This meant that the earth fault protection relay was disabled and would not operate.
The power distribution failure had the potential to cause fatal injury and environmental impact, although no serious injury occurred, and there was only short term impact on the environment.
• Systems of work;
• The clarity and adequacy of instructions;
• The adequacy of supervision;
• Operatives behaviour;
• BP planning processes;
• Risk assessments carried out by the contractors;
• Details in the method statements;
• Inconsistent and different methods of application of the permit-to-work (PTW) system;
• Procedures, systems of work and test equipment for the testing of the 33kV circuit breaker;
• Implementation of maintenance policies.
Image Credit: HSE
202307JunAll DayBP (Grangemouth) Steam Release 2000BP Oil Grangemouth (GB)Lessons:Asset integrity,Commitment & Culture,Compliance with Standards,Incident Investigation,Management of ChangeIndustry:RefiningCountry:United KingdomLanguage:ENLoC:Overpressure Origin: HSE Incident:Pressure burstHazards:Mechanical/Kinetic/PotentialImpact:HUMAN (On Site At Risk)Effects:EnvironmentalMaterial:SteamTopics:Ageing
An 18″ medium pressure (MP) steam main located near to the A904 Boness road ruptured at 23:18 p.m. on 7th June 2000 resulting in a significant loss of MP steam
An 18″ medium pressure (MP) steam main located near to the A904 Boness road ruptured at 23:18 p.m. on 7th June 2000 resulting in a significant loss of MP steam directly into the atmosphere. The steam leak damaged fencing immediately adjacent to the ruptured pipework. Debris and steam was blown across the road until the leak was isolated. The leak also caused significant noise (similar to a jet engine) being heard in the Grangemouth area. A member of the public walking the dog 300 metres away sustained rib injuries from tripping over the dog.
There was significant disruption to the steam supply system for the Complex for approximately one hour until the steam leak could be isolated and as a result of the incident the A904 Boness road was closed for public access until 22nd June whilst repairs were carried out.
The medium pressure (MP) steam main rupture had the potential to cause fatal injury and environmental impact, although no serious injury occurred, and there was only short term impact on the environment.
The critical factors that led to the incident were created a week earlier. Significant levels of condensate built up in the steam line following isolation of a steam trap to gain access for inspection of the tunnel, after the culvert was flooded following the power distribution failure.
The immediate cause of the catastrophic failure of an MP steam distribution pipeline was “condensation induced water hammer” which caused gross overpressure.
• Management of change (change control procedures);
• Failure to adequately investigate significant plant upsets and to carry out risk assessments;
• Operating regimes and lack of certain site standards;
• Inspection and maintenance of equipment;
• Management structure and organisation;
• Failure to learn lessons from previous incidents/events on-site.
Image Credit: HSE
202310JunAll DayBP (Grangemouth) FCCU Fire 2000BP Oil Grangemouth (GB)Lessons:Asset integrity,Operational Integrity,Risk AssessmentIndustry:RefiningCountry:United KingdomLanguage:EN Origin: HSE Incident:FireballHazards:FlammableImpact:HUMAN (On Site At Risk)Effects:EnvironmentalMaterial:HydrocarbonsTopics:Ageing,Alarm Management,Human Factors
The Fluidised Catalytic Cracker Unit situated on the Oil Refinery had been shut down on 29th May 2000 following the power distribution failure. On 10th June 2000 at approximately 03:20
The Fluidised Catalytic Cracker Unit situated on the Oil Refinery had been shut down on 29th May 2000 following the power distribution failure. On 10th June 2000 at approximately 03:20 a.m. during start up procedures which commenced on 9th June there was a significant leak of hydrocarbons from the Fluidised Catalytic Cracker Unit (FCCU or Cat Cracker) creating a vapour cloud which ignited resulting in a serious fire. On and off-site emergency services were mobilised, the BP Incident Management Team (IMT) were called in and the Grangemouth Petrochemicals Complex Major Incident Control Committee (MICC) was convened. The fire was brought under control in approximately 90 minutes and totally extinguished by 10:30
During the fire and in the fire-fighting efforts some damage resulted to asbestos cladding surrounding pipework and vessels. Some hydrocarbons in the contaminated firewater run-off were discharged directly into the River Forth.
No injuries occurred to the workers in the vicinity. They followed the emergency response procedures. However, there was the potential for injury to people and greater damage to equipment.
1. The primary immediate cause of the FCCU incident was the fracture of an unsupported 6×3″ reducing tee branch pipe to the main transfer line between the Debutaniser column (E5) and the Re-run column (E6) due to fatigue failure. This resulted in the release of highly flammable liquid/vapour at elevated temperature and pressure, which subsequently ignited.
2. It was fortunate that no fatal or serious injury occurred to the four or five workplace members in the immediate vicinity. This was due to a combination of the way the fire started and progressed, and the workers positioning at the time of the incident and presence of mind to move to safe positions. Weather conditions assisted and the vapour did not accumulate in and around the buildings or in the plant. Under different circumstances this could have led to a vapour cloud explosion, (a scenario envisaged in the CIMAH safety report), which would have increased the likelihood of fatal injuries and further escalation of the incident.
3. There were serious operational problems associated with the FCCU stage two modifications in 1997/98 which were a relevant underlying cause of the major accident on 10th June. These were inadequately dealt with by BP despite recommendations in writing from the HSE to review the process after the torch oil explosion late in 1999.
4. BP reviewed the FCCU earlier in 2000, partly to try to determine why it was not operating properly (eventually traced to a blocked cyclone dip leg) and to compare it with BP FCCU world standards. The review findings were not implemented or communicated properly.
The Fluidised Catalytic Cracker Unit (FCCU) fire had the potential to cause fatal injury and environmental impact, although no serious injury occurred, and there was only short term impact on the environment.
• Organisational structure – the HSE accept that these were historic and had been identified by BP who were taking steps to address the issue when the incidents occurred;
• Operational review system;
• Maintenance of integrity of pipework to avoid loss of containment scenarios;
• Risk assessment procedures;
• Consideration of Human Factors issues.
Image Credit: HSE