Flixborough 50 Years On: Lessons for Managers and Engineers Today

Robin Turney says the lessons learned from the disaster are still as relevant now as they were in 1974.

FIFTY years ago, at 16:35 on Saturday 1 June 1974, a massive explosion destroyed the Nypro chemical plant at Flixborough, UK. The incident took the lives of 28 operators and injured 36 others. In addition, 53 members of the public were injured and almost 2,000 houses, shops, and factories in the surrounding area were damaged. Had it occurred on a weekday, the toll of deaths and injuries would have been much greater.

The explosion shattered the confidence of the chemical industry. It led to a step change in the way in which hazardous plants were designed, operated, and regulated. How did the accident happen, what were the root causes, what changes were introduced and, most importantly, how relevant is the incident 50 years on? This and a series of future articles and webinars will attempt to answer these questions over the coming months.

The basic details of the plant and the events leading up to the disaster will already be known to many and have been reported in a number of places^1,2 including an article in the Loss Prevention Bulletin in 2023 which won the SIESO Medal.³ The events are summarised below:

• The process involved the oxidation of cyclohexane in six stirred reaction vessels in series operating at 8.6 barg and 155°C. To allow for thermal expansion, the vessels were linked together by 28 in (700 mm) diameter expansion bellows
• Late in 1973, during a miners’ overtime ban, the reactor stirrers were switched off to save power. No reduction in process efficiency was noted and the plant continued to be operated without the stirrers
• At some stage, a leak occurred on Reactor 5 and cooling water was sprayed on the reactor to dilute the leak
• Early in 1974, the site mechanical engineer left for another job
• On 27 March a leak occurred on Reactor 5. Following shutdown, a massive 2 m crack was found in the 13 mm thick mild steel vessel which had a stainless steel liner
• To restore production, it was decided to continue without Reactor 5 and construct a dogleg piece to connect Reactors 4 and 6, with expansion bellows at each end
• After the modifications were completed, the plant was back on stream on 1 April and operating without any problems
• On 29 May the plant was shut down again to repair a leak on a sight glass
• Following the repair there were problems in establishing the temperature/pressure conditions normally required for startup, with some pressure surges
• At 15:00 on 1 June the shift changed. It is impossible to recreate exactly what happened over the next 90 minutes since the control room was destroyed and nearly all those operating the plant at the time were killed by the explosion
• At 16:35 the bellows and the connecting piece failed. This resulted in two 700 mm openings and the rapid release of 10–15 t of cyclohexane – 75°C degrees above its atmospheric boiling point – which vaporised immediately
• The vapour cloud spread across the plant, quickly reaching a fired heater and igniting
• The resulting explosion destroyed the plant including the control room. Its power was estimated to be equivalent to 15–45 t of TNT
• All 18 people in the control room died instantly together with another ten operators

Immediately after the disaster a Court of Inquiry was established with a remit to “establish the causes and circumstances of the disaster as speedily as possible”. Managers and operators on the plant and technical witnesses were interviewed (173 interviews in total). In addition, research into the failure of the bellows was commissioned.

The Inquiry identified a number of deficiencies in the temporary bypass. Calculations showed that, although the bypass could withstand normal operating conditions, it was highly likely that the bellows would “squirm” and fail at a pressure of 10.3–10.4 barg, below the relief valve setting of 11.0 barg. However, the plant had operated for almost two months without any obvious problems and a large part of the Inquiry was therefore devoted to examining alternative explanations. The Inquiry concluded that the most probable explanation was that “the disaster was caused by the introduction into a well-designed and constructed plant of a modification which destroyed its integrity”.³

After the report was issued, Ralph King, an industrial chemist working at the Health & Safety Laboratory, suggested that the failure could have been initiated by free phase water mixing with hot cyclohexane, vaporising and causing a sudden pressure rise.⁴ In his graphic novel, Nylon Years, Rahim Abhari⁵ also supports this theory, suggesting that the decision to stop the stirrers contributed to the disaster. In 2000, the Health and Safety Executive (HSE) commissioned work by Tim Snee at the Health & Safety Laboratory⁶ to study the “water theory”. This confirmed a sudden pressure rise when water mixed with hot cyclohexane of almost 4 bar which would have been sufficient to exceed the relief valve set pressure under conditions similar to those during startup.

As with most disasters, a number of factors were involved. The water theory could explain why the bypass failed on 1 June having operated for the previous two months without a problem. In his book, Safety in the Process Industries, King states that “The expected pressure rise, while sudden and violent, would probably not have ruptured a well-designed and constructed plant, but was clearly sufficient to destroy the faulty bypass assembly”.  

Fifty years on, it is highly unlikely that it will be possible to reach any better conclusions than those of the Inquiry.
Lessons learned from the disaster included:

• the need for “management of change” procedures
• minimisation of large inventories of hazardous materials (inherent safety)
• a need for an improved understanding of vapour cloud explosions
• siting occupied buildings away from hazardous operations
• improved regulation of high-hazard operations, implemented through COMAH/Seveso regulations
• recognition of the importance of having a good “safety culture”, which values safety

Implementation of the above measures would have either prevented or reduced the severity of the accident and will be discussed over the following months both in this magazine and the Loss Prevention Bulletin. There is, however, little doubt that the failure to have a competent maintenance organisation was at the heart of the disaster. 

The bypass

Before considering the maintenance organisation, it is important to understand the way in which the work to replace Reactor 5 was undertaken. The decision was made at a meeting of the management team, including the works manager and plant managers, two of whom were qualified chemical engineers. Also at the meeting were maintenance engineers and supervisors, none of whom had attended degree courses or belonged to professional engineering institutions. “The emphasis at the meeting was directed to getting the process on stream again with the minimum possible delay”.¹ As noted above, the crack in the reactor was massive and although metallurgists at DSM in Holland had been contacted, no attempt was made to examine the other reactors.

Once the decision had been made to bypass Reactor 5, all further work seems to have been left to the electrical engineer, who was coordinating, the maintenance department, and the other engineers/supervisors. A connecting pipe of 500 mm diameter, which required a dogleg, was fabricated to link the two expansion bellows, Reactor 5 was removed and the new pipe installed, supported on scaffolding. The new pipe was pressure-tested with nitrogen (a more hazardous procedure than the normal hydraulic test). All the work was carried out rapidly, fabrication was completed in about 30 hours and the plant was ready to restart on 1 April, just four days after the decision was made to construct the bypass.

Although the connecting piece, which had been drawn out in chalk on the workshop floor, had the correct dimensions, many critical engineering issues had not been addressed:

• There was no appreciation of the fact that the offset coupled with the pressure within the system placed a turning moment on the pipe, later calculated to be 38 t
• The mitre joint in the pipe was not designed for this load
• The assembly was only supported on a scaffold with no assessment of the load placed on it
• No reference was made to the British Standard (BS) on bellows which stated “the advice of the manufacturer must be sought…with regard to the support of adjacent pipework”
• No contact was made with the bellows manufacturer, or their guidance consulted
• A nitrogen pressure test at 9 barg was carried out but there was no hydraulic test of the complete assembly as required by BS. This should have been at 1.3 times the maximum operating pressure or 14.3 barg
• The results of the metallurgical examination of Reactor 5, and the cause of the original failure, were still unknown when the plant was restarted (failure was later confirmed as stress corrosion-cracking due to nitrate-treated cooling water having been sprayed on the reactor to dilute a leak)
• None of the other reactors had been inspected

The Inquiry concluded that “a competent mechanical engineer would have understood the importance of the above measures”.

Benefits of hindsight

How effective would procedures in use today have been in identifying and preventing the incident?

Safety critical roles

With such a large inventory of cyclohexane above its atmospheric boiling point, integrity of containment was of critical importance. However, at the time of the disaster, process safety was a new concept and the need for comprehensive safety management systems had not been recognised.
Had safety critical roles been identified, for example by following the steps outlined in the EPSC guide Process Safety Competence⁷ or using the ISC Guidance,⁸ the need for a qualified mechanical engineer would have been highlighted. This, together with a management of change procedure (which was not used at the time and will be covered by another author), would have required formal approval of the bypass and prompted the management to call on the expertise of a qualified mechanical engineer.

Temporary organisational change

The departure of the mechanical engineer was clearly an organisational change, albeit an enforced one.

The management appreciated that the organisation was weak and a senior engineer at NCB (a co-owner of the plant) had agreed to support the site. However, no contact was made with this engineer while the changes were being made.

The need to examine organisational changes with the same thoroughness as mechanical or process change is now recognised, for example in the Energy Institute guide, Managing major accident hazard risks (people, plant and environment) during organisational change.

Staff being asked to carry out work outside their area of competence

The short time taken to complete the modification indicates that the engineers and maintenance supervisors were competent in their day-to-day work. However, it is quite clear that their training did not provide the necessary theoretical knowledge and broader view required to design the bypass or to meet the HSE definition of competence – “the combination of training, skills, experience, and knowledge that a person has and their ability to apply them to perform a task safely”.

This was a management failure and does not assign any blame to those who constructed and installed the connecting piece.

Following the departure of the mechanical engineer, responsibility for the coordination and planning of the maintenance organisation was given to an electrical engineer on a temporary basis. He had an ONC (equivalent to an A-level) in electrical engineering. There is no mention of the technical qualifications of the other engineers, or maintenance supervisors, who responded to the electrical engineer. In relation to the electrical engineer who was coordinating the engineering department at the time, the report states: “In the view of the Inquiry he was not qualified to act as a coordinator of the engineering department and should not have been asked to assume this responsibility.”

More recently, guidance to inspectors issued by the HSE noted that “…a review of major accidents across hazardous industries found a lack of competence contributed to many of those accidents, including; Southall Rail Crash, BP Texas City, Piper Alpha, Esso Longford and Buncefield”.

Responsibility for establishing a competent organisation starts at the top. In its report, Corporate Governance for Process Safety,⁹ the Organisation for Economic Co-operation and Development (OECD) recommends that “CEOs and leaders assure their organisation’s competence to manage the hazards of its operations and ensure there are competent management, engineering, and operational personnel at all levels”.

Major changes are occurring across a range of industries at present, with many more engineers working in small and medium-sized enterprises (SMEs). In a smaller organisation it may not be possible to hold all the skills needed and in these cases arrangements for external professional assistance, possibly on a “retainer” basis, need to be in place.

The drive to restart production

Although Nypro was credited as having a good attitude to personal safety, the concept of process safety was relatively new and still developing.

As noted above, the Inquiry concluded that in the meeting which decided to install the bypass “…the emphasis…was directed to getting the oxidation stream back on stream with the minimum possible delay”.

Only one of those at the meeting, the maintenance engineer responsible for the reaction section, is reported to have had concerns about restarting production before the cause of the failure to Reactor 5 was known and the other reactors inspected. There is no record of any action being taken to address these concerns. The Inquiry notes: “We have no doubt, however, that it was this desire (to restart) which led to them overlook…that it was potentially hazardous to resume production…”

There are always pressures to return a plant to production and a good safety culture is essential to ensure all risks are properly assessed. More recently, the Commission investigating the 2010 Deepwater Horizon disaster identified eight critical decisions made by bp and its contractors where a time-saving option was adopted where lower risks options were available.¹⁰ The disaster led to the loss of 11 lives and is reported to have cost bp US$40bn.

Training of engineers

The Inquiry also noted “none of the senior personnel in the company, who were chemical engineers, were capable of recognising…what is in essence a simple engineering problem”.

Ongoing lessons

We always need to be careful in attempting to apply today’s standards to past situations. The managers 50 years ago were working in a very different environment and the many procedures, guides, and standards in use today were just not available to them.

There is no doubt that the process industry is very much safer than it was 50 years ago. However, serious accidents still occur, sometimes due to failings similar to those which have happened before. Flixborough reminds us of the consequences of failing to have an effective safety management system able to react to both planned and enforced changes and supported by a safety culture which recognises the importance of safety in all aspects of operations.

Following the disaster, the study of Flixborough was included in the training of chemical engineers.

There are two other important lessons which are just as relevant today as they were 50 years ago:

• The safe construction and operation of a process plant requires many skills. CEOs and managers at all levels need to ensure the organisation has access to all the skills and knowledge needed for safe operation
• As engineers and scientists, each of us has an individual responsibility to assess our own competence, always being prepared to recognise our limitations and call on the expertise of others when necessary.

Acknowledgement

I would like to thank members of the IChemE Safety & Loss Prevention SIG, the Loss Prevention Bulletin, and the Major Hazards Committee for their help in preparing this article.

References

1. https://www.icheme.org/media/17752/the-flixborough-disaster-report-of-the-court-of-inquiry.pdf
2. RD Turney, Flixborough: Lessons which are still relevant today, LPB 237, p 21, 2014
3. J Carver et al, Flixborough – looking forward, LPB 289, p 24, 2003
4. RW King 1975. A Mechanism for a Transient Pressure Rise, IChemE Symposium, The Technical Lessons of Flixborough, Nottingham, December
5. https://www.icheme.org/media/26138/nylonyearslpbcompletenew.pdf
6. TJ Snee, Interaction between water and hot cyclohexane in a closed vessel, Trans IChemE, Vol 79, part B, 2001
7. Process Safety Competence, How to Set Up a Process Safety Competence Management System, European Process Safety Centre, Report Number 35
8. https://epsc.be/Documents/Reports/EPSC+Reports+Available/_/ReportNo35.pdf
9. Corporate Governance for Process safety: Guidance for senior leaders in high hazard industries, OECD
10. Deepwater Horizon, BP Gulf of Mexico Oil Spill, US Environmental Protection Agency, ISBN 978-0-16-087371-3, 2011

Further reading

The Loss Prevention Bulletin is running a series of articles in its June issue to mark the 50th anniversary of the Flixborough disaster.

Among them, Andy Brazier looks at the effect of control room location, architectural design, systems configuration and human factors on major accident consequence and likelihood, while IChemE members provide their own personal reflections on Flixborough.

There is also an interview with process engineer Ramin Abhari, author of Nylon Years, a graphic dramatisation of the disaster.

You can find these articles and an archive of previous pieces on Flixborough online at https://www.icheme.org/knowledge-networks/loss-prevention-bulletin/

Remembrance

We think of those who lost their lives in the disaster:

John Barrett, Wayne Bradshaw, Terry Carter, Kenneth Crawford, Michael Clark, Roland Cribb, Thomas Crookes, James Doherty, Stephen Drury, Anthony Freear, Ronald Forester, Stanley Grundy, Mick Hickson, Edwin Holland, Ian Kidner, Allan Lambert, Dennis Lawrence, Thomas Leighton, Geoffrey Marshall, Albert Nutt, John Render, Graham Richards, Rick Simpson, Michael Skelton, Harry Stark, Geoffrey Twiddle, Frederick Watkinson, and Keith Winter.

Article by Robin Turney

Now retired (formerly technical director of the European Process Safety Centre), member of the Health and Safety Commission and chair of the Institution’s LPB editorial panel

https://www.thechemicalengineer.com/features/flixborough-50-years-on-lessons-for-managers-and-engineers-today