The BP Grangemouth explosion: when an audit identifies the danger, but nobody makes sure it is fixed.
At approximately 07:00 on Sunday 22 March 1987, an explosion tore through the hydrocracker unit at BP's Grangemouth refinery in Scotland.
A low-pressure separator vessel, V306, ruptured violently. A major fire followed. One contractor was killed, the refinery sustained extensive damage and fragments of the vessel were propelled up to a kilometre away.
The immediate cause was hydrogen breaking through from a high-pressure separator into a vessel that wasn't designed to withstand it. The pressure relief valve couldn't cope with the incoming gas.
But this wasn't an unknown failure mode. Twelve years earlier, a safety audit had identified the danger.
The audit had got it right. The organisation had failed to act.
The warning was already on file
In 1975, a safety audit examined the hydrocracker's protection systems.
It identified operational problems with controlling the liquid level in the high-pressure separator, V305. It recommended duplicate instrument connections, or tappings, to improve level detection.
That recommendation wasn't implemented.
Instead, a nucleonic level gauge operating over a restricted range was fitted.
The audit also recognised something more serious. It confirmed that the pressure relief valve on V306 could not cope with gas breakthrough from V305. It specifically identified the extra-low-level trip on V305 as critical to preventing overpressure in V306.
The logic was straightforward.
If the liquid level in V305 fell too low, the protection system should close the flow control valves and prevent high-pressure gas entering the low-pressure separator.
Without that protection, V306 was vulnerable to a potentially catastrophic pressure increase.
The danger had been identified. The necessary protection was understood. The audit had documented it.
Twelve years later, the vessel exploded.
The protection had quietly disappeared
The investigation found that the safety trip system had been progressively rendered ineffective.
The electrical wiring to the trip solenoid on the LIC 3-22 control valve had been deliberately disconnected, around five years before the explosion. The trip solenoid on the second control valve, HIC 3-22, had been removed and bypassed in 1986 after being damaged in a fire.
Neither valve could therefore close automatically when the liquid level in V305 fell below the extra-low threshold.
The reasons were revealing.
The trip was associated with equipment that had been removed years earlier. Liquid in V305 vortexed and often caused the extra-low level trip to operate spuriously. Operators also wanted the valve to open below the extra-low trip level, giving them more flexibility to drain the vessel during certain operating conditions.
Rather than resolving the underlying problems with the protection system, the organisation had effectively accepted its absence.
Many operators knew the trip was inoperative. No assessment of the potential consequences had been carried out before it was disconnected.
A 1985 memorandum from the refinery's senior instrument engineer noted that the LIC 3-22 trip solenoid had been disconnected. It was not followed up.
The investigation also found that routine procedures for checking interlocks, alarms and trips had omitted some of the relevant equipment.
The protection system had not simply failed on the morning of the explosion. Its absence had become an accepted feature of operating the plant.
The near-miss nobody learned from
There was another warning.
An operator recalled that approximately two years before the explosion, gas had surged into V306 and its pressure relief valve had operated.
That should have been an important indication that the very scenario identified in the 1975 audit was possible.
But the event did not become an effective management warning.
The investigation also found that new operators were trained by experienced colleagues who had come to believe that the disconnected protection systems were no longer required.
The misunderstanding was passed on.
By the time of the explosion, the refinery had a dangerous combination: an identified process hazard, inoperative safety devices, inadequate monitoring and operators who did not fully appreciate the consequences of gas breakthrough.
The 1975 audit had identified the problem. Subsequent audits and reviews had not ensured that the risk was properly controlled.
What happened on 22 March?
During recommissioning, the hydrocracker had been left on standby following a plant trip.
The investigation found that the LIC 3-22 valve had been opened and closed manually at least three times after the shift changeover. As liquid drained from V305, the valve was opened again and the remaining liquid passed into V306.
High-pressure hydrogen then broke through.
The pressure relief valve on V306 had been sized to cope with overpressure from fire engulfment, not the maximum potential flow of high-pressure gas entering from V305. It could not discharge the incoming gas quickly enough.
V306 experienced an internal pressure of approximately 50 bar and ruptured.
The protection that should have prevented gas breakthrough was inoperative. The relief system could not cope with the resulting overpressure.
The HSE investigation concluded that the refinery had been aware of the potential for gas breakthrough following audits in 1975 and 1980.
It also identified excessive reliance on operators to control the flow of material from high-pressure equipment into a low-pressure system.
This was not simply an equipment failure. It was a failure to maintain the integrity of the safeguards that the original audit had identified as essential.
Five things to check tomorrow
- Are old audit findings genuinely closed? Take a sample of recommendations from previous audits and establish whether the work was actually completed, rather than simply marked as accepted or closed.
- Are safety-critical trips and interlocks still doing their job? Identify disconnected, bypassed or inhibited protection systems. Establish why they were disabled, who authorised it and whether the risk was properly assessed.
- Have warning signs been followed up? Look for historical instrument defects, near-misses, repeated alarms and occasions when safety devices operated unexpectedly. Are these being treated as evidence of a potentially serious failure?
- What are experienced operators teaching new starters? Informal knowledge can be valuable, but it can also perpetuate unsafe assumptions. Are people being taught why a protection system exists, or simply which parts of it can be ignored?
- Who checks that recommendations remain implemented? An audit finding resolved five years ago is not necessarily still resolved today. Modifications, maintenance practices and operating conditions can quietly undermine previous improvements.
An audit is the beginning, not the end
There is a tendency in organisations to measure audit activity: how many audits were completed, how many findings were raised, how quickly actions were closed and how many recommendations were accepted.
Those figures can create an impressive picture of safety management.
But they tell us very little about whether the original hazards are actually controlled.
At Grangemouth, the 1975 audit identified a critical weakness. The refinery knew that the relief valve could not cope with gas breakthrough and that the low-level trip was essential to preventing it.
Yet the trip was disconnected, the warning was not followed up, and the knowledge of why the protection mattered gradually disappeared.
The audit report existed. The safety protection did not.
The next time someone tells you an area has passed its safety audit, ask a different question:
What did the last audit identify, and who has checked that those findings are still properly controlled today?
Sources
- Health and Safety Executive, The Fires and Explosion at BP Oil (Grangemouth) Refinery Ltd, investigation report, published 1989. Hydrocracker explosion, particularly paragraphs 42–53, 64–71, 76–90.