The Hazard Nobody Identified

What happened?

On 21 March 1987, a hydrocracker unit at the Grangemouth refinery in Scotland was being recommissioned following a routine shutdown. The following morning, a violent explosion tore through a low-pressure separator vessel. The blast was heard and felt up to 30 kilometres away.

The explosion resulted in significant structural damage to the unit and surrounding equipment. Although there were no fatalities in this incident, the scale of destruction and the financial impact were severe, and the root cause would go on to reshape industry practice around pressure system design for decades.

“The blast was heard 30 kilometres away. The cause was an overpressure scenario that nobody had identified — and nobody had thought to ask about.”

What caused it?

The root cause was straightforward but devastating: an overpressure scenario that had never been identified during the design and hazard review of the system.

The system involved a high-pressure vessel feeding a lower-pressure separator through a level-control valve (LCV). During design, engineers assessed common overpressure scenarios — external fire, tube rupture, valve failures — and sized the LP relief valve based on fire relief as the worst case.

What had not been recognised was gas blowby: the scenario where the LCV fails fully open with simultaneous loss of liquid level in the HP vessel. Under these conditions, the valve passes gas rather than liquid — and the gas flow rate far exceeds the fire-case relief load. When blowby developed during start-up, the LP relief system was overwhelmed and the separator failed.

• The overpressure scenario was not included in the hazard identification study
• The relief valve was sized on fire relief — correct for the scenarios considered, but fatally undersized for the actual limiting case
• HP/LP boundary controls were not systematically reviewed during the design phase
• Start-up conditions, which often produce transient flow behaviours not being present during normal operation, were not adequately assessed

Lessons learnt

Grangemouth became a defining incident for the process safety discipline. It demonstrated that the real skill in relief system design is not sizing the relief device — it is identifying the true worst-case scenario in the first place.

• Gas blowby must always be considered at HP/LP interfaces: wherever a high-pressure vessel feeds a lower-pressure system through a level-control valve, gas blowby is a credible overpressure scenario that must be quantified.
• HAZOP and PHA studies must explicitly address HP/LP boundaries: a systematic review of all pressure boundaries on P&IDs — including blowby scenarios — must form part of every hazard identification study.
• Start-up and shutdown transients carry higher risk than steady-state operation: infrequent operating modes must be given dedicated hazard assessment, not treated as minor variations on normal operation.
• Relief valve location matters, not just sizing: the relief device must protect all LP-rated equipment in the envelope — not just the vessel it is mounted on.

“If you do not identify the risk, you cannot manage the hazard. Anyone can size a relief valve. The real skill is identifying the true limiting case.”