This 13th issue of the Lessons Learned Bulletin (LLB) accompanies the publication of the JRC’s Good Practice Report on Risk Management and Enforcement on Liquefied Petroleum Gas (LPG) and Liquefied Natural Gas (LNG) Sites. The Good Practice Report provides an extensive description of the properties of LNG and typical risks associated with LNG production, storage and handling.  This issue focuses on incidents on fixed sites although some of the lessons may also be applicable to LNG transported on land and sea. The next issue of the LLB will cover lessons learned from incidents involving LPG storage.

Please note:

The accident descriptions and lessons learned are reconstructed from accident reports submitted to the EU’s Major Accident Reporting System

https://emars.jrc.ec.europa.eu

as well as other open sources. EMARS consists of over 1000 reports of chemical accidents contributed by EU Member States and OECD Countries.

The cases selected for this bulletin also generated a number of lessons learned, not all of which are detailed in this bulletin. The bulletin highlights those lessons learned that the authors consider of most interest for this topic, with the limitation that full details of the accident are often not available and the lessons learned are based on what can be deduced from the description provided. The authors thank the country representatives who provided advice to improve the descriptions of the cases selected.

Accident 1

Cryogenic damage from leak at LNG liquefaction facility

Sequences of the event
On Monday, 31 March 2014 an LNG peak shaving plant experienced a catastrophic failure resulting in an explosion on a portion of the facility’s LNG purification and regeneration system.
The failure occurred during routine annual liquefaction startup operations. The failure initiated in the piping between the adsorber vessel D20A and the salt bath heater D-40 used to heat the gas for adsorber regeneration. Five employees were injured and treated on site and one employee was flown to the hospital for additional treatment with burns. An emergency shutdown was activated and plant personnel were evacuated.

Figure 1: . One of the twin adsorbers lying on its side. Compressor building in center-back. Refrigerant tower top-left. (PHMSA, 2016)

Debris from adsorber D20A and the associated piping caused extensive damages to the surrounding plant facilities, including penetration of the outer shell of the LNG- 1 storage tank, a significant number of process units, plus the plant communication systems, the backup generator, and surrounding buildings and structures including the control room. Furthermore, railroad tracks outside plant grounds were damaged by ejected debris.
It was unknown at the time of the incident whether the inner tank shell of LNG-1 had been penetrated by debris. Hence, a decision was made to evacuate the town and the surrounding communities within a two-mile radius.. Additionally, an instrumentation pipe located near the bottom of the LNG-1 tank was damaged, allowing LNG to release in a spray and vaporise. There was no pooling of the LNG and there was no resulting vapour (methane) cloud that left the plant. As soon as the plant was made safe, personnel wearing cryogenic suits, entered the facility and closed the valve between the damaged pipe and LNG-1 tank wall, shutting off the LNG release at the tank. The release continued for approximately 25 hours. A total of 234 barrels was released.

Important findings
The apparent cause of the failure was determined to be the auto-ignition of a gas-air mixture left in the piping after the pack and purge that was conducted on March 18, 2014. This pack and purge occurred 13 days prior to liquefaction start-up. The following are considered contributing factors:

· The start-up sequence in the written procedure contributed to the event. The start-up of the salt bath heater combined with the rapid pressurization of the gas-air mixture in the system from 53 psig to 685 psig allowed conditions to exist that were within the temperature and pressure range for auto-ignition to occur. The start-up procedure was subsequently modified so that the process heater would only be started after the system had been brought up to pressure and normal flow had been established.
· The purge and pack procedure utilised by the employees did not provide a sufficient amount of detail to assure successful and repeatable results. Previous purge and pack operations may have at times utilized additional purge points at or near the adsorbers. Following the incident, procedures were clarified and improved. The purge process was modified to include piping and purge points with the view to remove all possible dead-legs.
· The low toughness of the adsorber metal allowed it to fail in a brittle manner causing fragmentation and creating the potential for serious domino impacts. The exploded equipment generated debris that acted as high velocity projectiles. The debris penetrated the outer shell of the LNG-1 storage tank and nearly penetrated the inner shell. Rupture of the LNG-1 storage tank would have released. The control room was also severely damaged and after the incident, it was relocated.

U.S. Department of Transportation. 2016. Failure Investigation Report – Liquefied Natural Gas (LNG) Peak Shaving Plant, Plymouth, Washington. Pipeline and Hazardous Materials Safety Administration. https://www.phmsa.dot.gov 

Figure 2. Aerial view taken shortly after the failure. Fires still burning. Perlite insulation leakage from the penetrated outer LNG-1 storage tank. Control room lower left. (PHMSA, 2016)

Accident 2

Explosion and fire-ball in a peak shaving station
for natural gas during a routine exercise

Sequence of events
The accident occurred in a peak shaving station used to store liquefied natural-gas (LNG). The station included a natural gas liquefaction unit, an LNG storage and an LNG vaporisation unit including vaporisers, compressor

and a water bath. During peak demands, LNG was pumped up to 82 barg to 8 vaporisers from which the gas was injected into the transmission line at 72 barg. As a routine exercise, to verify the availability of the site to export gas, the equipment had to be brought to a 1-hour stand-by condition and LNG was used to cool down pipes and pumps between the storage tanks and vaporisers. Each vaporiser consisted of a large steel water tank, the water being heated by 6 gas burners. The air supply for the burners was coming from a single local fan via ductwork (up to 24”, or 61 cm, diameter). The LNG passed through tubes inside the water bath, evaporating and warming up to 20°C. The LNG inlet to the vaporiser was controlled by a motorised hand-indicated control (HIC) valve from the control room. An additional emergency shut-down (ESD) valve could be operated locally or remotely. Between these valves there were four drain valves and a relief valve. The drain valves were 0.5 m and 1.5 m above the ground level. The lower level drain valves were the ones normally used.

On December 5, an availability exercise was carried out and five of the 8 vaporisers had to be brought to a "1- hour" stand-by condition. Two operators were working on A, B and C vaporisers and another two on E and F vaporisers. The shift engineer was present to start-up the LNG pumps and open the main valve. Vaporisers A, B and C were cooled down according to the normal procedure (admission of small amounts of LNG and low level drain valves opened to accelerate the cooling) and vaporisers E and F were being closed when the pumps were started, resulting in a jet of LNG from one of the open drain valves. 30 seconds later there was an explosion and fire-ball. Two operators received burns to their hands and face. The fire-ball was approximately 40m x 25m.

Important findings and lessons learned
· The LNG jet occurred because the drain lines were opened and venting when the pump was started. The operators did not make sure that the valves were closed. The released natural gas was drawn into one of the air intakes to a vaporiser burner and was ignited by a pilot flame, flashing back and igniting the gas that was present in the area following the cooling down exercise. Even if it was not known, due to an inadequate process analysis, the cooling down exercise involving the release of LNG from 5 vaporisers resulted in the presence of sufficient gas in the area to cause an explosion when ignited.
· The process was not adequately analysed because it was not known that, following the cooling down procedure, in the area there was the presence of sufficient gas to cause an explosion if ignited. Also, the air intake was too close to the vaporiser burners.
· Several incidents have occurred in the past at LNG sites due to a failure to sufficiently evaluate potential accident scenarios that begin with a vapour release. Sometimes it results from an optimistic assumption that the vapour released would not be sufficient to cause a serious fire or explosion. LNG sites should generally use appropriate layers of protection to prevent ignition of natural gas vapours caused by equipment failures, process design weaknesses, or poor safety management. Active measures such as pressure relief systems, gas sensors, alarms and automatic shut-off valves, can be combined with passive measures, such as building distances and isolation mechanisms.

eMARS Date of accident:  12/05/1989

Accident 3

Leak at refuelling station during LNG reconditioning process

Sequence of events
In a refueling station liquefied natural gas fuel (Liquid to Compressed Natural Gas refueling or LCNG), a leak is triggered at the start of the piston pump to supply the compressed natural gas (CNG) circuit. This automatic start occurs when the level of gas stored in the CNG cylinders reaches a trigger point after refueling several vehicles in the evening. The leak is detected by a sensor that prevents escalation by triggering the shutdown of the pump. Once the gas pocket was evaporated, the sensor stopped detecting gas and allowed the pump to resume operation. Gas escaped again. In the meantime, an employee from a nearby company heard the noise from the fitting that dropped and saw a cloud forming (due to the condensation of humidity in the air when the gas was released). This person alerted the fire department and on-call staff at the station. Upon arrival, firefighters set up an exclusion zone with a security perimeter and blocked access to the site. Together the station manager and the fire brigade verified that the station was safe and secure, closing all the automatic valves. Half an hour later, maintenance personnel implemented a second layer of security by closing the manually operated valves.

Fig. 3: Scenarios for a leak from an LNG loading and unloading associated with the arm or hose (JRC Handbook of Scenarios for Assessing Major Accident Risks,2017.www.minerva.jrc.ec.europa.eu) 

Important findings and lessons learned
The leak was due to the breakage of a damaged break-away type connection at the high-pressure LNG-C pump. The damage seems to have been caused by mechanical stress resulting from repeated thermal loads imposed on the connection through which the cryogenic fluid passes. The fitting supplier also stated that the initial assembly was poorly executed. The investigation resulted in the following findings and recommendations:
• The original coupling did not adequately take account of repetitive stress on the pump connection from thermal expansion and contraction caused by repeated and extreme changes in temperature.

It was recommended that the connection should be fitted with anti-vibration parts and procedures would be modified to ensure enhanced verification of tightness and locking of equipment fittings during monthly preventive maintenance.

• Since there had been a leak, the pump should not have been allowed to restart. Hence, it was recommended that the programmable logic controller (PLC) should be modified so that there could be no possibility of automatic restart, requiring human intervention on site to restart the installation.
• Moreover, without the intervention of the nearby employee, the fire service would not have known about the gas release. Thus, it was proposed to establish an automatic alarm via mobile phone text (SMS) on different numbers for faster intervention.

Moreover, LNG refueling sites are a relatively new phenomenon for many localities. This incident showed that it is necessary to update training and procedures of local fire departments to ensure effective emergency response to incidents at these locations. For this reason, it was also concluded that there should be increased awareness of site users, on-call staff and fire departments regarding the appropriate response to similar incidents.

Accident 4

Embrittlement and cracking of tank outer shell from LNG leak
at liquefaction facility

Sequence of events
On 2 January 2018, workers discovered a release of LNG into the annulus (i.e., the space between the inner and outer tank walls) of Tank S-103, which eventually caused cracks in the outer tank wall and the pooling of LNG in the secondary containment area surrounding the tank. Exposure of LNG to the carbon steel outer tank resulted in the cooling of the outer tank wall to a temperature far below its design temperature of -32°C and the formation of four separately-identifiable cracks. These cracks propagated to a length of approximately 300 to 2700mm in length in a short amount of time.

However, the cause of the release of LNG into the annulus remained unknown. No external cracking was observed on any other tanks. The operator investigation report documented 11 past upsets (dating from 2008 to 2016) on Tank S-103 and surmised that under certain flow conditions, when using the bottom fill line, LNG might splash over the top of the inner tank into the annular space ("geyser-type effect"). The operator indicated that this geyser-type effect may have also occurred on Tank S-101, as both tanks were designed and operated in the same manner.

The Incident occurred in Tank S-103, one of the five on-site storage tanks that each have 3.4 billion cubic feet (~96 million cubic metres) equivalent capacity (Bcfe) for LNG. PHMSA was notified of the release of LNG from Tank S-103 via NRC Report No. 1202595, but only after PHMSA initiated its investigation into the release did PHMSA learn that Tank S-101 had also experienced releases of LNG into its annular space, and was actively leaking natural gas vapours at 14 sites along the base of the tank.

Upon discovery of the Incident, the operator isolated Tank S-103, commenced taking a vast portion of the LNG from the tank, and lowered the pressure in the tank annulus and boil-off gas system. The level of LNG in the inner tank was allowed to oscillate between 300mm to 1 metre to maintain the thermal condition needed for the inner    

Motto of the semester
______________________

“Many people mistakenly think a new technology cancels out an old one.”
 

MAHBulletin

ContACt

For more information related to this bulletin on lessons learned from major industrial accidents, or If your organisation is not already receiving the MAHB Bulletin, and would like to request to be placed on the distribution list, please contact

MINERVA-Info@ec.europa.eu

Technology Innovation in Security Unit
European Commission
Joint Research Centre
Directorate E - Space, Security
and Migration
Via E. Fermi, 2749
21027 Ispra (VA) Italy

https://minerva.jrc.ec.europa.eu

Please include your name and email address of your organisation’s focal point for the bulletin.

All MAHB publications can be found at Minerva Portal.

Continuation from of Case 4

 nickel steel tank which contains the LNG. The operator's Emergency Management Team (EMT) was deployed to control the access point to Tank S-103 around the clock. The EMT had real-time monitoring and reporting for gas emissions, and maintained 24-hour coverage around the containment dike. The area around Tank S-103 was roped-off to limit potential ignition sources. The road closest to the tank was closed to vehicle traffic. The operator also notified the occupants of the adjacent property of the situation.  The operator then issued "hot work" permits so that personnel could enter the area where there were gas vapours to better assess the tank.

There were no injuries or fatalities as a result of the incident, and there were no reported fires or explosions. However, after reviewing the situation, the regulator ordered the operator to purge and take the tanks offline and to continue the investigation to identify the definitive root cause prior to commencing repair and modification.  The regulator noted the presence of approximately 500 employees and contractors onsite, the potential for disruption to major transportation modes (including highways and waterways), the hazardous nature of the product being stored, the unpredictability of brittle failures and ignition sources, and the uncertainties as to the cause of the Incident.

Important findings and lessons learned
When steel fails at low temperatures, it fails in a brittle manner. Brittle failures do not leak before failing so there is no warning before failure. Hence, once discovered it requires immediate attention to control and eliminate the hazard.
While cracks were caused by an initial spill (or spills) of LNG, they became a source of new risk of LNG releases and potential formation of gas vapours.  For this reason, the site initially took precautions to isolate the tanks and limit exposure of persons and  activities activities in the vicinity both on   and off-site.
However, these actions did not convince the regulator that risks were sufficiently reduced, and the site was ordered to take the vessels out of operation.

U.S. Department of Transportation. 2018 Corrective Order CPF No. 4-2018-3001. Sabine Pass Liquefaction, LLC.. Dated 9 February 2018. https://www.phmsa.dot.gov

The Esso Longford Gas Explosion

There have been past accidents involving cryogenic substances with very serious consequences, most notably, the Esso natural gas plant in Longford, Australia in 1998.  In this instance, due to the failure of the lean oil pump, a heat exchanger experienced temperatures as low as −48 °C. Ice formed on the unit, and it was decided to resume pumping heated lean oil into the exchanger at 230 °C. The temperature differential caused a brittle fracture in the exchanger and the immediate release of 10 metric tonnes of hydrocarbon vapour that eventually ignited, killing two people and injuring 8 others on site. The tremendous fire that resulted killed two people and injured 8 others on site. The fire lasted two days and the gas supply to the State of Victoria was shut down for several weeks.  The resulting gas supply shortage was devastating to Victoria's economy, crippling industry and the commercial sector One of the important findings of the subsequent investigation was that the company had neglected to commission a HAZOP analysis of the heat exchange system, which would almost certainly have highlighted the risk of tank rupture caused by sudden temperature change. [Source: Wikipedia]