The incidents
Fluidised Catalytic Cracker Unit (FCCU) Fire - 10th June 2000

Competent Authority investigation

Key Findings - Cause and Effects

The primary immediate cause of the FCCU incident was the fracture of an unsupported 6x3" reducing tee branch pipe to the main transfer line between the Debutaniser column (E5) and the Re-run column (E6) due to fatigue failure. This resulted in the release of highly flammable liquid/vapour at elevated temperature and pressure, which subsequently ignited.
It was fortunate that no fatal or serious injury occurred to the four or five workplace members in the immediate vicinity. This was due to a combination of the way the fire started and progressed, and the workers positioning at the time of the incident and presence of mind to move to safe positions. Weather conditions assisted and the vapour did not accumulate in and around the buildings or in the plant. Under different circumstances this could have led to a vapour cloud explosion, (a scenario envisaged in the CIMAH safety report), which would have increased the likelihood of fatal injuries and further escalation of the incident.
There were serious operational problems associated with the FCCU stage two modifications in 1997/98 which were a relevant underlying cause of the major accident on 10^th June. These were inadequately dealt with by BP despite recommendations in writing from the HSE to review the process after the torch oil explosion late in 1999.
BP reviewed the FCCU earlier in 2000, partly to try to determine why it was not operating properly (eventually traced to a blocked cyclone dip leg) and to compare it with BP FCCU world standards. The review findings were not implemented or communicated properly.

Findings of the Competent Authority Investigation

The findings of the Competent Authority investigation in relation to the five themes identified earlier are given below.

Legislative Compliance

This was a major accident as defined under the COMAH Regulations that could have resulted in multiple fatalities under different circumstances. It was identified that there were a series of deficiencies which resulted in BP being prosecuted under the Health and Safety at Work Act 1974.

Best Practice/Guidance

Comparison of the organisational set-up with the "POPMAR" safety management system model in HSE Booklet HSG65 "Successful Health and Safety Management" suggested major weaknesses in failing to organise to meet the high standards required in the Major Accident Prevention Policy (required by COMAH) and in planning and implementing and in monitoring, audit and review. Underlying problems were identified in the following areas:

Organisational structure – the HSE accept that these were historic and had been identified by BP who were taking steps to address the issue when the incidents occurred;
Operational review system;
Maintenance of integrity of pipework to avoid loss of containment scenarios;
Risk assessment procedures;
Consideration of Human Factors issues.

BP Grangemouth Safety Reports

The CIMAH FCCU installation safety report 1997/98 revision claims and concludes that – "hardware and software controls in place on the FCCU are adequate to prevent the occurrence of a major accident which could affect the general public, the personnel working on-site or the environment around it." Based on investigation findings, this was partly unjustified even in 1997 when it was submitted, and certainly did not reflect the reality by 10^th June 2000 when the cumulative effects of unreliability, numerous plant start-ups, vibration and unsupported pipework factors came together. The safety report was not proactively used as a management standard for reviewing continued safe operation, nor used as an audit tool to verify the claims made for safe operation. There were serious deficiencies in the COMAH compliance regime and the safety report did not reflect the reality of the plant operations and maintenance.

BP Group objectives

BP failed to fully meet their own high performance standards in "Getting HSE Right (GHSER)".

Previous Incidents/Recent History of Operation

Between spring 1998 and June 2000 there was an increased number of start ups and shut downs on the Vapour Recovery Unit. Further, a number of incidents had occurred over the previous two years in which vibration was a relevant issue. A summary list of these previous incidents is given below:

1998 - Two incidents occurred which involved vibration of the transfer line between E5/E6. The problem was resolved by adjusting the flow between the columns;
March 1999 - Vibration of the transfer line between E5/E6 caused failure at a screwed connection for a flow transmitter impulse line. The impulse line was repaired and back-welded. The origin of the vibration was not ascertained;
December 1999 - On starting up the "light ends" section, a leak was noted at a vent stub on a slurry circuit common header. This header was linked to circulation pumps and contained hot slurry i.e. hydrocarbons at or above their auto-ignition temperature. The cause of failure was attributed to transmitted vibration due to cavitation from the pumps. This vent stub had not been used since the header was installed two years previously and the line was unsupported 1" carbon steel piping with two manual valves attached;
May 2000 - A plant operator noted significant vibration, or shock-loading, of the transfer line E5/E6 on two occasions. Both occurred shortly after start-up. The information was not passed onto the BP’s Asset Technical Support or BP’s Plant Integrity Branch;
May 2000 - A plant operator noted violent movement of the slurry return circuit shortly after start-up. This is located adjacent to the E5 column. The line contains hydrocarbons above the auto-ignition temperature. The information was not passed onto the relevant persons;
May 2000 – Leak of propane from a screwed coupling on a 1" drain line on the Depropaniser overheads line. The screwed plug leaked due to transmitted vibration when a high pressure in E7 during start-up caused relief valves on the column to lift. The drain line was only supported at the welded joint to the overhead line. At the time of the release, the drain line was at a pressure of approximately 23 barg and there was no means of isolating this section of line. Operator’s by-passed the E7 column to prevent further inventory from entering the column, but could do little other than wait for the line to depressurise (over two hours). Light winds at the time meant that propane gas did not accumulate on the plant and no ignition resulted. The cause of failure i.e. vibration due to a process upset and RV’s lifted, was not passed onto BP’s Plant Integrity Branch.

In addition to the incidents identified above there had been another incident in November 1999 when a prolonged start-up attempt on the FCCU resulted in an ignition of a torch oil vapour cloud within the ductwork of the CO boiler. Contrary to plant operating instructions in the master operating manual (1997), the torch oil had been admitted to the Regenerator when the unit was at too low a temperature. As a result ignition of the torch oil did not occur in the Regenerator. Although ignition had not been verified, a considerable further quantity of torch oil was injected and it is believed that hot spots in the slumped catalyst bed vapourised the torch oil. The provision of a temperature interlock had previously been considered and discounted, as it was decided that operating procedures alone were a sufficient control.

As a result of the torch oil incident the HSE issued an improvement notice to BP requiring an abnormal operations risk assessment procedure to be developed and recommended review of the operation of the FCCU to be undertaken. BP complied with the terms of the improvement notice.