HSE slams Chevron over deaths

WAITING TO HAPPEN

ACCIDENT REPORT • SAFETY MANAGEMENT FAILINGS WERE AT THE ROOT OF THE FATAL EXPLOSION AT CHEVRON’S PEMBROKE REFINERY IN JUNE 2011, HSE’S FINAL REPORT CONCLUDES

JUNE 2011 MAY be nine years ago now, but the deaths of four workers at Chevron’s Pembrokeshire refinery do not deserve to be forgotten. The UK Health & Safety Executive (HSE) has published a full report on that incident, which highlights the various safety failings and management shortcomings that led inevitably to the fatalities.

Shortly after the explosion on 2 June 2011, HSE issued a safety alert to inform industry of the preventative measures required to avert a similar occurrence. “The investigation was complex and we can now share further information about the underlying causes, so that everyone in major hazard industries (not just those involved in tank storage or tank cleaning) can learn from this incident, understand what went wrong, and apply lessons to their own organisations,” says Jane Lassey, director of HSE’s Chemicals, Explosives and Microbiological Hazards Division, in her introduction to the report. “Although a number of years have elapsed since the incident, the information contained within this report remains highly relevant today.”

HSE is quite clear about the causes of the incident. The report states: “The investigation revealed a longstanding and widespread failure to understand and control risks posed by the flammable atmosphere inside the tank. The explosion and the resulting fatalities were therefore avoidable. The incident was not merely the consequence of errors by individual employees, but because of the failure of safety management systems to ensure a safe place and safe systems of work.”

TANKS IN QUESTION During what should have been a routine cleaning operation on an atmospheric storage tank within the amine regeneration unit (ARU) of the refinery, an explosion split the tank open, killing four workers on the spot and severely injuring a fifth; the force of the blast ejected the 5-tonne steel tank roof more than 55 metres through the air. It narrowly missed a pipe rack and landed on a pressurised storage sphere containing butane – luckily the sphere was not punctured.

The ARU was fitted with two breathable tanks, one used for the separation of waste streams and the second acting as the reservoir for lean diethanolamine, used in the scrubber to strip hydrogen sulphide from petroleum. The stripping process also caused some light hydrocarbons to become entrained in the amine solution; this was designed to be skimmed off in a surge drum. Both storage tanks included a 300-mm blanket of diesel to inhibit oxygen ingress.

The HSE report details how changes had been made to the system over the years. Indeed, the two tanks, designed for different purposes, had been used interchangeably. HSE also notes how a proportion of the light hydrocarbons, designed to be skimmed off in the surge drum, accumulated over time in the amine running tank and were taken up by the diesel blanket. This had, over time, expanded in size to 900 mm deep and could no longer be regarded as diesel due to the change in composition. This blanket therefore needed to be siphoned off at intervals.

This was not a normal design process and HSE states: “Looking back, HSE believes there were a number of significant events that should have alerted the refinery management team to the presence of light hydrocarbon within the running tank. These events presented several opportunities to reduce risk and prevent the incident, through the critical review and refreshing of risk assessments, training and maintenance arrangements. Regrettably, the significance of these opportunities went unrecognised.”

THE TRAGEDY UNFOLDS Some weeks before the explosion, the tank was drained; however, the plant operator who undertook the task was unfamiliar with the valve manifold and was unaware of the internal sump and drain equipment, which was necessary to empty the tank completely. As a result, there was liquid left in the tank when it was described as ‘empty’. Similarly, when the tank was then isolated from the rest of the process unit with ‘spades’, the Chevron employee responsible for the work was unaware of the presence of diesel, light hydrocarbons or potentially pyrophoric material in the tank.

The contractors fitting the spades did encounter a significant flow of liquid gushing from the tank when isolating the inlet and outlet lines at the bottom of the tank and further spills took place when the contractors removed a shell manway to ventilate the tank. It was erroneously believed that diethanolamine had leaked back into the tank through the process lines after being emptied.

It was decided that the cleaning contractor, B&A Contracts, should remove the remaining liquid by sucking through the roof manway using a vacuum tanker. This was to be done without ventilating the tank. This modified system of work was decided on verbally and, HSE says, “insufficient consideration was given to the application of safer, alternative systems of work”.

Before this work was done, the plant operator was asked to carry out a gas test and manual dip test. The dip test recorded a liquid depth of 36 cm but the operator was unaware that there was a dip plate fitted near the base of the tank to protect against impact damage from repeated dip testing; as a result, the true liquid depth was closer to 46 cm. Further, the plant operator had no previous experience of carrying out a gas test and took only one measurement, whereas the requirement is for several measurements to be taken in different parts of the tank.

Furthermore, while B&A Contractors had a four-year contract with the refinery for the cleaning of storage vessels, it had only worked on those containing diesel, kerosene, gasoline, slop fuel oil and water. Both Chevron and B&A staff proceeded on the basis that the amine tank was equivalent to the normal work under the contract.

The planning team had, HSE says, “an incomplete understanding of what was in the tank, including the potentially flammable atmosphere resulting from light hydrocarbon contamination of the running tank”. In addition, HSE says, “generally there was insufficient evaluation of the risk posed by static ignition sources, particularly B&A’s work equipment”.

CAUSES AND FAILURES On the day of the explosion, B&A staff were on site along with employees of Hertel, who acted as fireguards. Two people were on top of the tank, feeding a two-inch non-conductive hose through the manway; the vacuum tanker was parked nearby, with the hose connected to its rear inlet. This was a four-inch fitting and a non-standard adapter had been fitted to attach the smaller hose. HSE notes that this reduction in diameter would have significantly increased the linear velocity of the liquid being drawn into the tanker and increased the extent of static charging.

The explosion ripped the tank shell away from the floor, emitting a fireball that engulfed the vacuum tanker and three people nearby; the roof was blow off, killing the two people stood on top. HSE has identified two potential sources of ignition: either the discharge of static electricity from a scaffolding pole attached to the end of the hose inside the tank to weigh it down (apparently common practice), or the spontaneous ignition of iron sulphides present in the tank. Neither can be shown definitively to be the cause.

More fundamentally, HSE found a long list of safety management failings on the part of both Chevron and B&A. In particular, procedures developed by Chevron were often inadequate and/or overlooked or ignored; the site’s permitting system was not linked to hazardous area classification; the contracting process was inadequate; site risk assessments were too generic and failed to take account of specific hazards; there was no meaningful risk assessment of tank cleaning operations; refinery personnel engaged in safety-critical tasks lacked the knowledge or experience to carry out those tasks adequately; and B&A employees were not properly trained.

HSE highlights some broader lessons to be drawn from the incident. The law requires that companies should possess clear and accurate information regarding hazardous material

THE DEATHS OF FOUR WORKERS AT THE CHEVRON

REFINERY IN PEMBROKE WERE AVOIDABLE BUT,

HSE SAYS, GIVEN SAFETY MANAGEMENT FAILINGS,

stored within tanks. Furthermore, all employees and contractors involved in planning and maintenance activities on tanks should know and understand the dangers presented by the materials inside. This should include rigorous analysis (including sampling when appropriate) of the hazards of all constituents remaining within the tank prior to starting removal work. Section 2.5 of the Energy Institute’s Model Code of Safe Practice Part 16: Guidance on Tank Cleaning contains detailed information regarding pre-cleaning checks and inspections.

A risk assessment and the establishment of clear work instructions for any tank cleaning operation should be conducted by trained and competent staff. To organise the work as safely as possible, the planning and preparation work should be based on knowledge of the hazardous tank contents, combined with a good understanding of and adherence to the published HSE guidance and specifi c tank cleaning standards, for example the Energy Institute’s Model Code of Safe Practice. CASE CLOSED HSE believes that the four deaths were preventable. The fact that the tank contained fl ammable material emerged several times, but Chevron did not take the opportunity to train staff and update its systems. Any change of plant operation should be critically risk assessed, adequately controlled and relevant systems updated accordingly, to ensure the signifi cance of a newly generated hazard is not lost over time. This is particularly important where hazardous waste streams are recycled back into the process.

Other opportunities to prevent the explosion were also missed. Two days before the incident, a gas test indicated a potentially explosive atmosphere within the tank, but this information was either not shared or acted upon by those planning or carrying out the job. Companies should refl ect upon this failure and review their own systems to ensure that they provide training and arrangements for the recording and communication of important safety-critical information.

This incident clearly demonstrates that safety management systems are only effective when robustly audited, monitored and enforced. Safety arrangements that have been allowed to degrade over time become weak and ineffective. Whilst providing an illusion of safety and risk control, as seen in this case, ineffective systems do not remain strong enough to prevent real harm occurring.

Charges were laid against Valero Energy UK Ltd, which had acquired the refi nery from Chevron, and against B&A Contracts Ltd, both under the Health & Safety at Work etc Act 1974. Valero pleaded guilty and was fi ned £5m with £1m costs; B&A also pleaded guilty and was fi ned £120,000 with £40,000 costs. HSE’s report includes the sentencing remarks of the Hon Mr Justice Lewis, which explain the judgment in greater detail. The full report can be accessed via the HSE website at www.hse.gov.uk/comah/chevronpembroke-report-2020.pdf.

SUBSCRIBE TODAY

• HCB Monthly delivered directly to your door

• The Digital E-zine accessible on all devices

• A round up of all the latest developments & news in our weekly newscast

• Instant access to an immersive, interactive experience, from insightful news articles to video highlights on HCBlive.com

www.hcblive.com/subscribe/