The document provides a case study and analysis of a fatal explosion that occurred at a Total Petrochemicals site in Carling, France in July 2009. The explosion occurred during the restart of a furnace after a shutdown and killed two operators. A judicial investigation found that Total had bypassed or disabled multiple safety systems on the furnace, including the burner safety locks and general safety interlocks. They also did not follow proper startup procedures. The root causes were found to be organizational factors like deficient process safety management and a lack of respect for operating procedures, as well as technical deficiencies in the furnace design and multiple human errors.

1. by Fernand Jacques Guillou,
Judicial Expert @ Appeal Court of Lyon
Revision May 2020
Explosion Fatalities @ Total Petrochemicals
Carling site Moselle ,France , july 2009
Olefins Cracker furnace
Process Safety & Assets Integrity Report
A Case Study

2. Explosion and Fire @ Total Carling , Moselle 15 juillet
2009 of a dry steam super heater furnace
HSEQIMPS Integrity report

3. The two Total Carling
Olefins crackers
# 570Kt /y Ethylène
C2H4 ) in 1990
to convert a light naphtha
into lighter molecules such
as ethylene, propylene and
methane, which are then
used to make polyethylene
polystyrene and
polypropylene.

4. The
Permanent
Duality of
Risk

5. Explosion Furnace Carling july 2009
• 15 july 2009 at 3pm, during a (re) start up after a big storm
• 2 fatalities , 6 injuries
• Pénal Court , TGI of Sarreguemines Alsace in march 2016 ,
Judgment without Appeal of june 2016
• Civil prosecution in progress
Judgment :
• 200,000 € fine for Total Petrochemicals SA
• 1 year in jail et 20,000€ fine for the site manager

6. The Explosion Conditions

7. The Process in Cause
• 2 steam super heaters from T°380c to 525c @ 110 bars eff
supplied dry steam to the gas cracked compressor steam turbine
from the 6 cracker furnaces ( naphta et steam feed stock )
• A Mov gate valve is balancing the steam flowrate from each super
heater to the dowstream compressor inlet
• The Mov valve unreliability (see infra) induced an increase of
furnace outlet steam temperature Tc by lack of flowrate with safety
interlock actions : Tsh 542°, Tshh 545°, Tshhh 600°, by
sequential shut down of the seven burners , but immediate shut
down for Tshhh , followed by the down stream gas cracked compressor
by lack of flow rate
• Total production of gas cracked is then sent to the emergency flare
system ( loss of production during hours or days …)
• The manual (re) start/ light up of a furnace is a dangerous opération

8. Pid of the superheater furnace concerned by the explosion

9. Zoom on the dry steam outlet 525°c , 110bars
The unreliable gate valve concerned is noted MV 6101
Safety high température Tsh 542°, Tshh 545°

10. PID Zoom on fuel gas inlet of each furnace
Nota bene : no safety valve exists for burners n° 4 et 7.
in consequence a start up sequence must be implemented .

11. • 2 steam superheaters in parallel and common to the 6 (six) cracking
furnaces for each olefins crackers , 7 flat burners for each super
heater , dry steam from Tc 380 à 525°c @110 bars tofeedthe HPturbine
of thegas cracked compressor ( hottrain C1aC8+)
• The BSL burner safety low , the safety device which forbid the gas feed
of the burner without any pilot flame was not working. the pilot flame
presence détection of all burners are by passed ( shunt officially from
1995 ) because of unreliability , too close from the trap steam of
decoking pyrolysis tubes
• Among the four superhaters availables for both olefins crackers, it was
the only one non equipped with a lighting automate prom ( again
steam of decoking trap too close) which reduced the presence of
operators around the superheater during the startup.
The furnace explosion conditions

12. • Total, actually, had to review the starting sequences to include all these
safety paths. hazard non evaluated in the PHA with only
compensating mean : « increased visual inspection »
• Both the MOV flow rate balancing gate valves had not been
overhauled during the last turnaround in 2008 , one year before
• Several interlocks @ TSH 542°, had already occured due to the gate
valve deficience , since the last turnaround 2008
• Injuries and medical center visits were registered and 5 minor back
draft explosions occured during the last 36 hours before the accident
The furnace explosion conditions

13. 300,00
350,00
400,00
450,00
500,00
550,00
600,00
14:16:48 14:24:00 14:31:12 14:38:24 14:45:36 14:52:48 15:00:00
Température(°C)vapeur110b
15 juillet (heures IMAC)
SteamTempérature 110 b outlet super heater BF 601A
T vapeur 110 b BF601A
1TSH6101
1TSHH6101
1TSH6184R
1TSHH6184R
1TSHH6184R
1TSH6184R
542°C
545°C
Graph N°12/2 (15/7)
13
Interlock shut down of gas cracked turbo compressor @ Tc < 400°
here around 14h 50
Temporisation of linked températures to alarms TSH6101/TSHH6101, TSH6182/TSHH6182 and
TSH6183/TSHH6183

14. Example : Olefins cracker
emergency flaring of gas
cracked following a shut
down of the steam turbo
compressor @ P < 100 b or T<
400°c

15. Exemple of Gas cracked compressor (olefins cracker)
in green the steam turbine 110 bars @ T=525°c, 15 MW
Gas cracked compressor of
olefins cracker
During a 6 years Turnaround
maintenance

16. • Interlock shutdown by Tshh , one more time
• Burners stop in sequence but not for the pilots flames
(veilleuses) , instead of for Tshhh
• All pilots extinction made by misunderstanding procedure
• Difficulty to rearm (lighting ) pilots (cause supra)
• BSL device was supposed to turn off the gas inlet if no pilot flame
was detected on the burner for 10 seconds and it regularly shut down
the superheater without any reason so it was by passed or shunt.
• Hence, decision to bypass the procedure of flushing/purging the
superheater floor with steam
• No efficient measure of the explosive limit ( % LLE) before lighting
the pilot.
• Décision ( cause furnace still hot ) to light up burners directly ,
to avoid downstream compressor shut down
1 / Opérations séquence before explosion

17. • Shunt or bypass action of central control room to open interlock
XV safety valve ( global furnace BSL or safety by lack of pilot
flame presence )
• Opening of gas manual valve to one burner ( last barrier)
• One opérator is on the first level platform looking inside the
furnace , one is under the floor furnace , a third is outside , the
1er is guiding the second who held a long piézo electric lighter ,
passing through air inlet fans of one burner
• preventive gaz detection ( in % of gas LLE) was unefficient
• blindness opération because of lack of visibility inside the furnace
through visual inspection holes
• 1ère expérience of furnace start up for the two young operators
2 / Opérations séquence before explosion

18. • Deflagration gas explosion of around 12 kgs (25 pounds eq a
domestic gas bottle ) with internal blast pressure in radiation zone
@ 200 to 300 mbars )
• explosion hatches opened but non sized to eliminate the blast
pressure
• The heavy floor furnace ( pressure force # 50 t) is frangible and got
down onto the opérator located just below , killed immediatly
(autopsy)
• The explosion killed another : the side opérator is « lighted as a
flare » , run away and is killed due to blast and burns effects
(autopsy)
• Debris ( wall bricks réfractory ) rocketed to half a mile
• 6 injuries by hit debris ( with permanent physical damages )
The furnace explosion

19. Cracker one
the furnace
just after the
explosion
steam from
decoking trap

20. • Methane gas is heavier than air ; ventilation / air blow up is not
sufficient : all burners air inlet (vantelles and stack butterfly
register ) must be fully opened ,to avoid gas accumulation in
radiation zone ( hence steam purging is necessary )
• Explosion déflagration with internal pressure in radiation zone #
300 mbars , propagation speed V # 300m / sec)
• Static and dynamic Pressures of the blast wave Pd= av²/2g et
Ps=b/V , v propagation speed , V volume of methane gas inside
the furnace before explosion
• σa axial stress ( bottom effect ) and shell hoop stress σt as
σt = 2 σa should have made the shell rupture and not the floor
one
• Safety Barriers of protection : Frangible shell furnace , explosions
hatches /rupture disks, safey relief valves , stack butterfly register
• The bottom floor broke (semi fragile rupture) under dynamic
pressure + its own weight
Elements of explosion mecanism

21. The explosion effects Carling furnace in 2009
Left bottom floor and right ground 0 furnace , just after explosion

22. The furnace floor anchors frangible ruptured by
shearing stress under 200 mbars blast pressure

23. The cause analysis

24. • Un industrial area in hard recession , olefins cracker with old facilities (40y
) , low competitivity , strategic units shut downed and mothballed before ,
maintenance costs and budgets under pressure , unions on the forefront
• IT computer opérations data informations were unsaved ( 72h before the
explosion (volontary or accident ?) following a magnetic storm with
lightning and heavy rainfalls occured in the control room , 14 july 2009)
• No answers of site mid management to investigation audits questions of
the 4 team judicial experts ( mid management mutism required by top
management ) , idem during contradictory questions to witness hearing
during the trial at Court in march 2016
• Strong traumatism of employees during judicial investigation audits
• No délégation of power from the site manager to the mid management
• The site management tried to report the accident responsability to the
operators by human errors
• Strong shift between engineers and operators making uneasy
investigation to root causes analysis
Environment and Judicial Expertise difficulties

25. Safety Barriers Analysis and the Tripod beta model

26. Prevention Barriers , upstream explosion
1. Shunt /By passed volontary and organized of safety BSL 7 burners
2. Unrespect of the furnace operating start up procedure :
a. volontary extinction of all the pilots burners
b. Supervision décision to directly light the burners without pilots
flames
c. Opening manual valve to one burner without pilot flame
d. No safety steam purge of the floor ( procedure), before lighting
e. Gaz detection test ineffective before and during lighting
f. Blind Opération (ref risk mitigation mean: visual inspection
improvement )
3. Volontary shunt / bypass of general safety interlock ( in control room )
and of local inhibition to open the XV (gaz inlet interlock valve )
( safety by lack of pilot flame detection/presence )
Protection Barriers , downstream explosion
1. Déficiency of furnace design , explosion relief hatches
2. Frangibility of the bottom floor , instead of radiation shell
10 Safety Barriers in cause : 8 transgressed, 2 failed

27. Organizationnal Factors
• Process Safety management ( Seveso) unreliable and no updating :
MOC,PHA,HAZID ,HAZOP, HIRARC , etc…Total, actually had to
review all the starting sequences to include all these safety paths.
• Non Respect of operating procedures , check lists and work orders
• Organized and voluntary Shunt/by pass of all the 7 BSL of the furnace
burners ( root cause )
Technical Factors
• Unreliability of safety barriers ( BSL SIL/SIF )
• Design Déficiency of the Furnace , explosion Hatches , etc …
• Floor bottom Frangibility ( not Shell in radiation zone )
• Maintenance degradation of safety équipments
• Lack of gaz detection , Gad , inadequat tests, no automatisms
Humans Factors
• Lack of Skills / expérience / Training of operators and foremen
• Human Errors ( slips/lapses + voluntary and violations )
• Incompatibles Goals ( safety ,costs, production )
• Errors enforcing conditions ( stress ,schedules ,precipitations ,etc..)
• When subject to an increasing pressure ,we must stay and remain
welded to better resist to any test , cold blood ( fjguillou)
Explosion an Fire @Carling en 2009, Latent causes :

28. Basic Risk Factors

29. BRF of latent causes

30. Basic Risk Factors BRF Tripod Beta (1 to 11)
Except house keeping , the others 10 BRF were nominated several times
Several alarms for similar incidents occured just before the accident ( Back
Drafts déflagrations ) they were not registered and not Pha analized as required
by Seveso Directive SGS ( safety management system ) for classified sites
A strong gap was observed in communications between officers/engineers and
field operators and control room as well
Errors enforcing conditions and incompatibles goals played a premier role on
human behavior factor , before the accident
A safety culture deficient with strong impact on field opérations although ISRS
and directive SEVESO in place , in other words a table desk safety culture …
Explosion @ Carling in 2009, latent causes :

31. Some relative accidents in the Usa for major petrochemicals
companies
31
Occurrence Root Causes
Olefins
cracker
Date Start-
up?
Fatality Procédures/
training
Bypass shunt ./
Insuff. safety
PHA, lack
,Moc
measure O2 /
CO mètre
Morris 2002 Yes NO Procédures Bypass XVs
Canada
Chemicals
2003 NO NO Procédures No BSLs PHA
déficient
no CO/O2
meter
Congrès
ASME
2009 Yes NO Presentation
feed back
Design of
safety
No PHA
Houston Tx 2008 Yes NO Respect
procédures
Bypass safety
BSLs
Mississipi 2013 Yes 1 training no CO meter
New Jersey 2016 NO NO training No CO, meter
Corpus
Christi
2017 Yes No Respect
procédures
Bypass safety
XVs
Carling total 2009 Yes 2 Procédures
& training
Bypass safety
XVs + BSLs
PHA
déficient
No steam
purge
- Often during pendant un (re) start up
- Training /procédures/ personal always in cause

32. Some solutions , risk prévention
samples

33. 1- Explosion furnace with shell vertical welds frangible , floor
intact , blast directed , double safety protection barrier

34. 2- Explosion furnace with shell frangibility , floor intact ,
directed blast , few debris

35. Example of Olefins Cracker 1> Million t/y C2H4,
feed stock upgrading project and Turnaround
Process Safety PHA Fully Implemented ,HIRARC
HAZOP,LOPA, RBI, FMECA, with MOC, etc …

36. Integrity
HSEQIM/AIPS RM
Assets integrity
process safety risk
management
implemented with
management of
change ,MOC
Copyright fjguillou

37. Brave far away
from Danger

38. « When we are subject to increasing
pressure , we must know and remain
welded , to better resist to any tests »…
a devise of way of life , stress and risks ,
by analogy to inspection/safety in Pétrochemical
industry , (i.e. pressure directive & NDT ) par
fjguillou
corollary :
« over all after being rolled », by « serial cost
killers », an inextinguishable race who put
pressure , fiever and stress , on facilities safety … ,
in addition to NDT we need as well safety relief
valve ,résilience , stress relieve and cold blood to
resist at all kind of tests …