From three incidents noted here, culled from inquiry reports, it is clear that both the human factor and equipment reliability call for close examination in anticipation of the next disaster.

Milford Haven UK Refinery. In a previous column, I referred to an electrical storm in 1994 at the Milford Haven U.K. refinery that severely crippled the plant instrumentation. Among the large number of displays that swamped the operators was one that wrongly indicated that a vessel outlet valve was open. Five hours later, 20 metric tons of trapped liquid hydrocarbon were released and turned into a fireball. Knowledge that the valve was stuck closed could have helped to avert this disaster. No casualties were reported.

BP’s Texas City Refinery. On March 23, 2005, an explosion at BP’s Texas City refinery killed 15 workers and injured 180 others in the worst U.S. industrial accident in more than a decade.

The accident occurred during the startup of the refinery’s octane-boosting isomerization (ISOM) unit, when a distillation tower and attached blowdown drum were overfilled with highly flammable liquid hydrocarbons. Because the blowdown drum vented directly to the atmosphere, there was a geyser-like release of highly flammable liquid and vapor onto the grounds of the refinery, causing a series of explosions and fires. Fatalities and injuries occurred in and around work trailers that were placed too near the ISOM unit and were not evacuated prior to the startup. Alarms and gauges that should have warned of the overfilling failed to operate properly on the day of the accident.

Don Holmstrom, the CSB supervisory investigator who is heading the inquiry, said that since last October, the Board has uncovered additional previous incidents involving the same ISOM unit blowdown drum, which was designed in the 1950s.

He said that his team has now documented the occurrence of eight previous instances where flammable hydrocarbon vapors were discharged from the same blowdown drum between 1994 and 2004. In two of these incidents, the blowdown system caught fire. The eight previous incidents were not properly investigated, and appropriate corrective actions were not implemented. The investigation of a 1994 incident resulted in an action item to analyze the adequacy of the blowdown drum. The area superintendent was responsible for the completion of this item. However, the item was never finished, and management officials did not follow up to ensure completion.

Earlier, a 2003 external BP audit referred to the Texas City refinery’s infrastructure and assets as “poor” and found what it termed a “checkbook mentality.” Budgets were not large enough to manage all the risks, but rather than expanding the budget, expenditures were restricted to the money on hand, in the opinion of the BP auditors.

Hemel Hempstead, UK Oil Storage Terminal. Generally known as the Buncefield Depot, a fire began here after a series of explosions early on the morning of December 11, 2005. These were some of the largest explosions ever to occur in the United Kingdom, and the incident has been described as the biggest of its kind in peacetime Europe. The tank fires were extinguished by the afternoon of December 13, 2005. One storage tank re-ignited in the evening, and the firefighters left it to burn rather than attempting to re-extinguish it.

A Closer Look at Buncefield

The Buncefield Depot was the fifth largest oil-products storage depot in the United Kingdom, with a capacity of approximately 60 million gal (273 million liters) of fuel.

Starting at 19:00 on the evening of December 10, tank 912 was filled with unleaded gasoline. At midnight, the terminal closed, and a check was made of the contents of tanks, which found everything normal. From approximately 03:00 the level gauge for Tank 912 began indicating an unchanging level reading, despite filling continuing at 550 m3/hr. Calculations show that the tank would have begun to overflow at about 05:20. Approximately, 40 minutes later (at 06:00), an estimated 300 tons of gasoline would have spilled down the side of the tank onto the ground inside Bund A, a semi-enclosed compound surrounding several tanks. Evidence suggests that a high level switch that should have shut off the supply failed to operate. Closed caption television footage footage shows a cloud of vapor approximately 1 to 2 meters deep flowing away from the tank. By 06:01, when the first explosion occurred, the cloud had spread beyond the boundaries of the site. The explosion could be heard 100 miles away and as far away as France and The Netherlands.

Damage occurred well off the site, as far as 5 miles away where a window was blown out at St Albans Abbey. Around 2,000 people from the Hemel Hempstead area were evacuated from their homes. Several nearby office blocks were hit so badly that almost every window, front and back, was blown in as the explosion ripped through them. Had this happened during the working day, these offices would have been full of people; there is no doubt that this would have caused dozens of deaths.

There were 43 reported injuries; two people were deemed to be seriously injured enough to be kept in hospital. All members of staff from the terminal were accounted for.

The Buncefield Depot was the fifth largest oil-products storage depot in the United Kingdom, with a capacity of approximately 60 million gal (273 million liters) of fuel. It was some 5 percent of U.K.’s oil storage capacity.

What can we learn from incidents such as these? I’ll continue my series on hazards to people and plants next month.