BP Grangemouth

Three major incidents occurred at the BP Grangemouth petrochemical complex during May-June 2000. This was a 24/7/365 facility and at the time employed around 2,000 people. The Complex handled a wide range of chemicals that are hazardous to human health (toxic, explosive, fire hazard etc) and dangerous to the environment if released from containment.

At the time of the events, the BP Grangemouth complex was one of the largest Major Accident Hazard sites in the UK, of which there were around 950. Therefore, this facility was subject to the Control of Major Accident Hazard Regulations (1999), known as COMAH, which implement the Seveso II Directive in the UK.

A UK HSE senior manager stated in the investigation report that:

“Only good fortune prevented workplace and public casualties from the Grangemouth incidents. Industry must not become complacent about the risks posed by major accident hazards”.

HSE, 2003

This was one of the first major investigations that involved the newly-formed Human Factors Team based in the UK HSE’s Hazardous Installations Directorate; and so the investigation considered human factors and safety culture issues in some detail, as well as engineering and technical failures.

Three major incidents in May-June 2000

Power distribution failure, 29th May 2000

All power was lost to three electrical substations that supply electrical power to the North Side of the Complex which contains the oil refinery, various chemical plants, utility plants and logistics facilities. This led to emergency shutdown of these units, along with the need for a controlled shutdown of some other facilities elsewhere on-site.

The power failure was due to damage caused to an underground electrical cable during excavation of a trench, sometime before the incident, most probably around 18th April 2000.

Steam main rupture, 7th June 2000

An 18-inch medium pressure (MP) steam main located near to a main road ruptured resulting in a significant loss of MP steam directly into the atmosphere. The steam leak damaged fencing immediately adjacent to the ruptured pipework. Debris and steam was blown across the road until the leak was isolated. There was significant disruption to the steam supply system for the Complex for approximately one hour until the steam leak could be isolated and as a result of the incident the main road was closed to the public for two weeks whilst repairs were carried out.

The catastrophic failure of this pipeline was due to an earlier human failure to re-open a “steam trap” after it had been closed for inspection, in order to investigate the flooding following the power distribution failure incident above. This enabled steam to build up in the pipework (trapped between hot condensate and closed isolation valves); this eventually led to gross over-pressure in the pipeline, significantly in excess of the design pressure of the pipework.

Fluidised Catalytic Cracker Unit (FCCU) fire, 10th June 2000

Fluidised Catalytic Cracker Units (FCCU or Cat Cracker) are widely used on refineries around the world, to convert (or ‘crack’) heavy crude oil into lighter products such as motor fuels.

The FCCU situated on the Oil Refinery had been shut down on 29th May 2000 following the power distribution failure described above. On 10th June 2000 at 03:20 there was a significant leak of hydrocarbons from the Unit during start up procedures, creating a vapour cloud which ignited, resulting in a serious fire. The fire was brought under control in approximately 90 minutes and totally extinguished by 10:30.

During the fire and in the fire-fighting efforts some damage resulted to asbestos cladding surrounding pipework and vessels. Some hydrocarbons in the contaminated firewater run-off were discharged directly into the River Forth. No injuries occurred; however, there was the potential for injury to people and greater damage to equipment. There was potential for fatal and serious injury off-site had passers-by been in the vicinity when the pipe failed.

A ‘tee’ connection on an 18-inch section of pipeline that had been incorrectly fitted in the 1950’s was the source of the leak. Following modifications carried out in the 1980’s, nearby pipework was inadequately supported. There was a significant load placed on the support connections when the pipework was full of liquid.

The FCCU plant was difficult to operate due various modifications, and this led to an increase in shutdown/start-up cycles for the plant. This combination of an incorrectly-fitted tee-piece, the inadequately-supported pipework and the cyclic stresses and vibration caused by increased shutdown/start-up activity led to the failure of the tee connection.

Investigation approach

In view of the short period of time between the three incidents, the HSE decided that a major incident investigation would examine them together. BP also ran its own investigation under a BP Task Force. Throughout the investigation, BP was open and engaged in a constructive dialogue with the HSE.

HSE recommendations were made on specific issues identified, as well as recommendations for improvements across the whole Complex.

Human factors issues

A decision was made to involve human factors specialists early in the investigations, in order to consider whether underlying human and managerial factors provided a possible explanation for the incidents. I have outlined below the main human factors issues identified.

Organisational structure

Historically there were three business streams operating at the Complex acting in a loose federation: Oils, Chemicals and the Forties Pipeline System (“FPS”: Exploration). Strong differences in systems, style and culture persisted across the Complex. This was also a barrier to cross-site communication and sharing of learnings. HSE concluded that this organisational structure “provided a compelling explanation of the incidents which occurred” (HSE, 2003).

It had been recognised by BP prior to November 1999 that the historical management and business structure at the Complex required to be changed. As a result a new Complex Director was appointed in November 1999 with specific responsibility for integrating and unifying the management structure. A new single site health and safety management system and standard was also introduced as an integral part of the new unified management structure.

Implementation of these initiatives had not been fully completed by the time of the incidents. Although a unified management and health and safety management structure had been introduced there remained significant differences in both culture and management systems.

The investigation found that there were deficiencies in management style and culture in the former Oils business, these shortcomings were not replicated in other parts of the Complex. The FPS was, in particular, found to have a more careful and considered approach to management and general health and safety issues. There were also many examples of good practice in the Chemicals business at the Complex.

Supervision

As part of the construction of a new facility (an ethanol plant) in early 2000, trenches were excavated in order to lay new high voltage cables. The Refinery engaged an electrical sub contractor, who sub-contracted the laying of the cable. The excavation itself was undertaken by an excavation company, sub-contracted to a groundworks contractor.

Supervision during the period of the excavation was limited, as the supervisor from the excavation contractor was overseeing other works. Similarly the supervisor from the groundwork contractor and the BP construction supervisor had other commitments.

Safety culture

The HSE’s Human Factors team interviewed a sample of people from all levels across the Complex either individually or in groups. The questions were aimed at looking for behaviours that were known from published research to be indicators of safety culture, such as visible leadership and employee involvement. Questions were also asked on more specific issues such as management of change, staffing and commercial pressures.

In the Oils business, the investigation found a tendency to place relatively high emphasis on short-term benefits and to be readier to make compromises over longer-term issues such as plant reliability.

Alarm management

There was clear evidence from both the FCCU fire and the MP steam main rupture of operators in the control room experiencing significant alarm flooding during the incidents. The key findings from the investigation by HSE’s Human Factors Team were as follows:

“BP did not have adequate arrangements for alarm handling. Although the management understood the nature and broad extent of the problem, projects were stalled or solutions had not been implemented. Although BP reviewed the HSE Texaco major incident report in 1997-98 which made recommendations on alarm handling, the actions from this review had not been completed”.

“BP had not allocated sufficient priority or resources to plan, and because of the organisation structure at the Complex, coordination and direction was poor and tracking progress and tackling alarm handling issues was limited”. 

The HSE recommended that prior to restart of the FCCU:

“Demonstration that adequate arrangements have been identified to ensure a timely and effective response by Central Control Building operators to those alarms necessary for the prevention and mitigation of major accidents, taking due account of the number, presentation and rate of presentation of alarms during plant start up, or other upset conditions, and any relevant factors set out in industry best practice guidelines (the EEMUA guidelines)” (HSE, 2003).

Situational awareness

As all the instrument readings for the steam lines on the Complex had been affected by the rupture in the steam incident, the technicians were unable to immediately identify the specific line that had ruptured. Identification was further hindered by the fact that the steam line that ruptured was not shown on the new control system in the main control room. Due to the lack of knowledge on the current status of the system and the lack of information available a process of elimination was used by the technicians to identify and isolate the leak. This delayed their effective response and increased the duration of the incident.

The damage to instrumentation during the FCCU fire also meant that the control room operator was unable to view the condition of parts of the process through the control system.

Competence

In relation to the FCCU incident, the HSE investigation recommended that “Process technicians should receive additional training and instructions to enable them to recognise situations where there may be serious implications for process plant” (HSE, 2003).

Learning organisation

Many of the recommendations made following a failure of the same Medium Pressure (MP) steam line due to severe water hammer in 1975 were relevant to the June 2000 incident. However, these lessons appeared not to have been addressed.

Evidence was obtained from the operators that the pipework at the base of the Debutaniser column had been subject to vibration over the previous two years and that this had occurred on two occasions during previous start-ups. This information, however, had not been communicated widely and no investigations had taken place. Environmental lessons learned from previous incidents were not adequately communicated across the Complex.

Although significant structural changes were made by BP several months prior to the incidents, these did not have sufficient time to fully effect a significant improvement in culture and performance prior to the incidents.

“BP Group & Complex Management did not detect and intervene early enough on deteriorating performance”.

HSE, 2003

The company did not adequately measure the major accident hazard potential, for example:

• Inadequate performance measurement and audit systems
• Poor root cause analysis of incidents
• Incorrect assumptions about performance based on lost time accident frequencies (DAFWCF –- Days Away From Work Case Frequencies), and
• A lack of key performance indicators for loss of containment incidents.

Organisational change

The BP Task Force audit identified initiative overload which caused a prioritisation problem for managers. HSE concluded that:

“Specific consideration should be given to adopting robust management of change procedures with all changes including organisational changes being fully evaluated before implementation to ensure that all potential hazards associated with the change have been identified” (HSE, 2003).

Following the incidents, BP developed and implemented a rigorous management of change process. The primary focus of this process was to address the safety critical aspects of the organisational change, including human factors.

Staffing levels

Public speculation in the aftermath of the three incidents was that reductions in staffing levels may have been a cause. No evidence was found of this. Maintenance spending and staffing was well above par for the BP Group. However, demands on maintenance resource were high, largely due to the unreliability of the plant.

“Safety”

The investigation found that there was an optimistic perception of safety performance due to real and commendable success in managing personal injury rates down to a very low level. However, there was a failure to adequately distinguish these successes from process safety management. This imbalance between the effort put into personal injury versus major accident prevention was by no means unique to BP – similar tendencies have been found in other comparable businesses. However, this was one of the first major investigations to highlight this issue.

The investigation report states that:

“Conventional indicators of safety performance such as days away from work (which are high frequency/low consequence events) do not give a measure of process safety relevant to the control of major accidents (which are low frequency/high consequence events) and may give a false impression of process safety performance” (HSE, 2003).

Safety report

The Complex was subject to the COMAH Regulations; which is a ‘permissioning’ regime designed to ensure high standards on sites with a major accident potential. The COMAH regime requires the company to document the hazards, risks and measures to eliminate or control them. This “Safety Report” is evidence that it has carefully scrutinised the preventative and control measures.

The latest revision of the Fluidised Catalytic Cracker Unit (FCCU) safety report concluded that controls in place were adequate to prevent the occurrence of a major accident which could affect the general public, the personnel working on-site or the environment around it.

The HSE concluded that this was partly unjustified even in 1997 when it was submitted, and certainly did not reflect reality by 10th June 2000 – when the cumulative effects of unreliability, numerous plant start-ups, vibration and unsupported pipework factors came together. The safety report for the FCCU installation claimed a higher level of reliability and safety performance than was actually present. The safety report did not reflect the reality of the plant operations and maintenance.

Legal action: £1 million fine

The details above present a picture of the Complex at the time of the incidents, which fell short of BP Group’s expectations for the management of safety and environmental performance. BP Chemicals Limited was fined £250,000 for the Steam Main offence and BP Grangemouth Oil Refinery Limited was fined £750,000 for the FCCU/Cat Cracker offence.

Three enforcement actions have been taken for the BP Oil Grangemouth Refinery Limited between 1988 and the incidents in 2000. In a prosecution in 1988, the Oil Refinery was fined £250,000 for a fatal incident in connection with a flare line and £500,000 for a fatal incident following an explosion in a hydrocracker. In December 1994, the Company was prosecuted for a fire in a crude oil distillation unit and fined £50,000.

Key lessons for Major Accident Hazard sites

These three lessons summarise the recommendations from the HSE investigation:

Lesson 1: Major accident hazards should be actively managed to allow control and reduction of risks. Control of major accident hazards requires a specific focus on process safety management over and above conventional safety management.

Lesson 2: Companies should develop key performance indicators (KPIs) for major hazards and ensure process safety performance is monitored and reported against these parameters.

Lesson 3: Disruption to utility supply systems (steam, electricity etc.) on a major hazard site can cause significant problems and have the potential to result in a major accident.

Wider messages for industry

The investigation report was published at a time when the UK HSE launched its “Revitalising Health and Safety strategy”, therefore the opportunity was taken to remind industry of its responsibilities with three key messages:

Message 1: Major hazard industries should ensure that the knowledge available from previous incidents both within their own organisation and externally are incorporated into current safety management systems.

Message 2: Operators should give increased focus to major accident prevention into order to ensure serious business risk is controlled and to ensure effective Corporate Governance.

Message 3: The COMAH safety regime is a living process and should be used as a management tool to assist in process safety management.

Finally, the investigation report concludes with some commentary on human factors, particularly in relation to safety reports (broadly equivalent to safety cases elsewhere). Given the significant involvement of the HSE Human Factors Team, it was pleasing that the report ended with the following statement:

“The Competent Authority (a combination of the HSE and the Environment Agencies) require consideration to be given to human factors issues in process safety management and in COMAH safety reports. The Competent Authority has identified inadequate consideration of human factors issues as one of the main causes for the rejection of COMAH safety reports” (HSE, 2003).