When all the dominos fall against you

The 2015 Unipetrol Litvínov ethylene unit incident

It is nine years since the explosion and fires at the Unipetrol Litvínov ethylene unit at Chempark Zaluzi in the Czech Republic on 13 August 2015.? It was a telling example of a ‘chain reaction’ or ‘domino effect’ incident, where the initial incident caused a second incident, which caused a third incident, and beyond.

Two operators went to changeover the cooling water supply to the Light Ends of the ethylene unit, switching from the normally operating pipeline (3) to the parallel spare pipeline (4), in order to perform a regular calibration of the flowmeter on line 3.? To do so the flow on 4 would be established by opening the inlet and outlet block valves around its flowmeter, before shutting off the flow on 3.? Well, you can probably guess where this is heading.??

As is often the case with identical process equipment, a simple mistake was made.? After opening the outlet block valve on 4, the Operator closed the outlet block valve on 3, rather than opening the inlet on 4, thus stopping the cooling water flow to the Light Ends.? This set off a pretty remarkable chain of events;

• With the loss of overhead cooling, the C3 Splitter Column overheads pressure relief valves (PRVs) lifted to prevent column overpressure,
• One of the PRVs began to vibrate - later determined to be acoustic-induced vibration (AIV) - so badly that it loosened the bolts on the inlet flange, resulting in a high pressure propylene leak,
• The resulting vapour cloud eventually contacted a high temperature steam line and ignited, causing a jet fire which impinged onto one of the other PRVs.? The thermal stress eventually ruptured the inlet pipe to that PRV, causing a small propylene explosion,
• Despite the overpressure being relatively low, the explosion occurred in close proximity to the two steam boilers which supplied the ethylene unit, causing them to trip on high firebox pressure.? The explosion also damaged the instrument air supply lines, which ran close to the PRVs,
• The loss of all steam supply caused a crash shutdown of the cracking furnaces, which - as is so often the case - caused a crack in one of the furnace coils, which leaked out charge gas that immediately ignited,
• An operator was able to reach the isolation valve for the charge gas to that furnace, stopping its flow, but in the chaos no-one realised that the gas pressure was preventing something much worse from flowing into the cracked coil…..highly combustible wash oil,
• With the gas flow halted, wash oil immediately filled up the furnace coil and began pouring out of the crack, causing a pool fire on the furnace floor and then eventually beneath four of the nine furnaces that made up the cracking section,
• The wash oil flow could normally be stopped by remotely closing some valves from the control room, but as there was no instrument air these were inoperable.? The wash oil pumps were located near to the furnace and were inaccessible due to smoke and fire, so the local shut-off button was out of reach.? And operators couldn’t even shut off the wash oil pump power supply because the unit electricians had been evacuated from the site - along with everyone else - and only they had keys to the substation,
• Eventually the Shift Supervisor donned some breathing apparatus and headed into the smoke to power down the wash oil pumps, stopping the escalation sequence.

They say that from tiny seeds grow mighty trees.? Unfortunately, massive incidents sometimes arise from the smallest error.? The fires took almost 24 hours to put out, with 499 firefighters attending the site.? This incident kept the ethylene unit offline for just over 14 months whilst four furnaces were fully replaced and a major repairs were made to much of the rest of the unit.

Fault tolerant systems are designed with the presumption that humans will make mistakes.? Even the most experienced operator is fallible.? Valve switchover procedures are notorious for being done incorrectly and leading to major incidents (Williams Geismar 2013, Jaipur 2009).? Trapped key interlocking systems (e.g. Castell Interlock) are one way to prevent this by making valves physically inoperable unless manipulated in the correct sequence.??

At the time I remember it reignited a periodic debate amongst Energy Risk Professionals about the concept of double jeopardy i.e. should the scenarios used for loss estimates consider secondary (and even tertiary) knock-on incidents.? That old chestnut will be argued forever without resolution, but what the Litvínov incident did contribute to the debate was the fact that hidden within the sprawling oil, gas and petrochemical facilities that we survey are many ‘nodes’ where an escalation vector is baked in.??

We can’t identify them all, and the Insured can’t realistically be expected to engineer them all away.? But one thing which Energy Risk Professionals excel at is identifying under-appreciated exposures that create major risks, and then providing practical recommendations for how to remove those gaps.? There were four open insurance survey recommendations at Unipetrol Litvínov prior to the incident which - if they had been resolved - may have stopped the escalation sequence...

An overview video summarising the incident was made by Unipetrol and is available here.