Start-Up Should Have Been Routine. It Was Not.

What happened?

In 2010, BG Tunisia’s Hasdrubal Terminal experienced a Category 1 process safety incident during a routine plant start-up sequence. Hot oil migrated into the low-temperature (LT) flare header through a failed bursting disc. The accumulated liquid triggered an automatic Emergency Shutdown (ESD 2), which diverted high-pressure gas from the export compressor suction directly into the flare system at the point where the hot oil had entered.

The sudden interaction between the accumulated hot liquid and the incoming high-pressure gas created an intense hydraulic shock — a liquid hammer event. The resulting transient forces far exceeded the design pressure of the flare header, causing multiple pipe ruptures, deformation of pipework and supports, and widespread structural damage across the flare system.

• No personnel were injured
• Significant piping damage including puncture holes in the LT flare header
• Minor hydrocarbon release to atmosphere
• Full plant shutdown, lengthy engineering investigation, and extensive system redesign required

“The scale of mechanical damage exposed deeper weaknesses in design assumptions, start-up preparedness, and barrier management that went far beyond the immediate failure.”

What caused it?

The investigation identified a combination of design gaps, procedural weaknesses, and management of change failures that aligned to produce the event.

• Design weakness: The flare header design had not considered scenarios involving concurrent hot oil ingress and high-pressure gas flow — the exact combination that produced the liquid hammer.
• Failed bursting disc: The bursting disc protecting the LT flare header failed prematurely, allowing hot oil to enter a system not designed to handle it. Cyclic fatigue of the disc was identified as a probable contributing mechanism.
• Management of Change failure: MoC processes had not adequately scrutinised the bursting disc design or its potential failure modes under service conditions.
• Inadequate start-up procedures: Start-up procedures did not clearly differentiate between hot and cold start-up conditions, and mandatory checklists were absent.
• Emergency response gaps: Delays in emergency actions during the ESD event highlighted that critical responsibilities were not clearly assigned or rehearsed for this scenario.

Lessons learnt

The Hasdrubal incident demonstrates how multiple small gaps — unexamined design assumptions, ambiguous procedures, and weak barrier performance — can align to produce significant consequences, even when no one is injured.

• Flare systems must be assessed for realistic multiphase flow scenarios: design reviews must consider transient conditions — especially during start-up — not only steady-state operation.
• Start-up is a high-risk activity that requires dedicated procedural control: infrequent operating modes carry disproportionate risk and must have structured, checklist-driven procedures with supervisory sign-off.
• Bursting disc limitations must be understood and documented: service conditions, cyclic fatigue, and potential failure modes must be formally assessed and included in inspection programmes.
• Barrier layers are interdependent: mechanical, procedural, and organisational safeguards must be reviewed together — weakness in any one layer elevates risk across the system.
• Major equipment damage without injury still demands full investigation: the absence of casualties does not reduce the obligation to understand and address the systemic weaknesses exposed.

“High-impact equipment failures, even without injuries, reveal systemic weaknesses that demand attention. Treat near-misses as the incidents they nearly were.”

How does your facility manage start-up risk? Do your start-up procedures include mandatory supervisor sign-off for high-hazard evolutions?