"The explosion of No. 5 Blast Furnace, Corus UK Ltd, Port Talbot", 2001.
An interesting industrial disaster: an iron smelter which killed 3 workers when hydrogen exploded molten metal through the facility. It seems to follow the almost stereotypical pattern: a large dangerous system with complex internal dynamics is run successfully for many years, while minor faults begin to accumulate and suboptimal safety is tolerated as 'normal' (taken as strong evidence of safety), until a cascade of errors begin which fall through multiple safeguards which should have prevented it from escalating but didn't (and illustrated the limitations of what one might call 'negative' controls and violations of the 'principle of least privilege') and the control systems actively contributed to the problems\* until finally the system fails spectacularly. (I also didn't know how iron smelters worked - the smelting process is not, as I assumed, endothermic but exothermic; if there's one thing that terrifies me more than 200+ tons of molten metal, it's 200+ tons of molten metal generating its own heat which you can't easily shut off.)
* see also http://www.ctlab.org/documents/How%20Complex%20Systems%20Fail.pdf / https://news.ycombinator.com/item?id=8282923 , and http://blogs.msdn.com/b/oldnewthing/archive/2008/04/16/8398400.aspx
One lesson here is that when something goes wrong, the root-cause is not the immediate cause, and a solution should attack multiple factors (a very common idea in aviation but one I don't seem to see much outside of it, even though disciplines like programming could benefit from this attitude).
An example: a full root-cause fix to OpenSSL's Heartbleed is not merely patching the length check, but patching the length check, removing the custom memory management which blocked analysis tools from spotting it, simplifying the codebase, including static analysis tools as part of the default development process, and more broadly, switching as much as possible to memory-safe languages and formal methods.
A personal example: for spidering/crawling/mirroring the blackmarkets, I have a Frankenstein setup where I log in using my regular Firefox browser, export all Firefox cookies to a 'cookies.txt', and then run 'wget' using a copy of the cookies.txt for access, proxied through Privoxy to implement a blacklist (since wget's blacklist functionality is completely broken). This leaves a 'cookies.txt' in each mirror directory, with active cookies for all the sites I use. I periodically compress mirrors into tarballs to save space & for redistribution over Amazon S3 after manually deleting the cookies.txt, and after emailing a list of my available mirrors to some other researchers, I discovered 2 of the tarballs had a cookies.txt in them. Oops. I immediately revoked public access to them and began generating edited tarballs to upload, and cleared cookies in FF & re-loggedin to the most important websites to invalidate the old cookies.txt as much as possible. But this was not a full solution: why was I manually deleting the cookies files? Why did my little archive script not automatically exclude them? Why did the cookies.txt contain cookies for all my websites rather than solely the blackmarkets? For that matter, why were there any cookies.txt on disk after mirroring had finished? So a full solution went like this: a cron job periodically deletes all cookies.txt in the uncompressed mirrors; the archive script was modified to delete any cookies.txt in the directory being archived; and each wget script was modified so that it didn't copy the full cookies.txt but grepped it for only the lines with '*.onion' and stored only those lines in the mirrors' cookies.txt. So the file is now harmless; while harmless, it's occasionally deleted anyway; and it's deleted, but also to be safe, deleted before archiving again. I expect this to prevent any recurrence of the problem.
"The explosion of No. 5 Blast Furnace, Corus UK Ltd, Port Talbot", 2001 http://www.hse.gov.uk/pubns/web34.pdf ; excerpts:
"3 At the premises of Corus UK Ltd, Port Talbot, No. 5 Blast Furnace exploded at approximately 17.13 pm on 8 November 2001. The entire furnace, which with its contents weighed approximately 5000 tonnes, lifted bodily at the lap joint, rising some 0.75 m from its supporting structures, leading to the explosive release of hot materials (an estimated 200 tonnes in total, comprising largely solids and semi solids, with a little molten metal) and gases into the cast house. Three employees died: Andrew Hutin, Stephen Galsworthy and Len Radford. A further 12 employees and contractors sustained severe injuries. Many more suffered minor injuries and shock.
4 The outcome of the explosion was unprecedented in the steel-making industry, but was the result of many failings in safety management by the company over an extended period. The explosion occurred after a prolonged attempt - over two days - to recover the furnace from a chilled-hearth situation caused by cooling water ingress. The immediate cause was the mixing of water and hot materials within the lower part of the furnace; the precise mechanism remains a matter that is not fully resolved.
...The water had entered the furnace from its cooling system following a chain of events initiated by the failure of safety-critical water cooling systems. At the time of the explosion, attempts were continuing to rectify the abnormal operating conditions that this had created and to recover the furnace.
Lesson 5 Closed systems for furnace cooling water, or systems with equal or better reliability, should be provided wherever reasonably practicable. Leak detection
137 Closed system cooling arrangements offer considerable advantages over 'open' systems for rapid leak detection and are much more amenable to the fitting of diagnostic tools such as flow meters, make-up water determination etc. They are more reliable in terms of keeping the cooling circuits free from contaminants etc and are therefore an aid to better cooler maintenance, reducing scaling and fouling of the circuits.
138 The use of open-system cooling is historical, and lent itself to fairly accurate leak identification, monitoring etc, assuming the existence of long-serving, experienced watermen. Even with this proviso, however, all the evidence is that open systems are fundamentally much more vulnerable to fouling, corrosion and associated problems. With the advent of more modern technology for monitoring, and the possible lack of very experienced operators, closed systems will almost certainly prove far superior and reliable if properly designed, installed and maintained.
Lesson 6 Speed in locating furnace cooling water leaks is essential. Rapid leak detection relies on good engineering, adequate detection protocols and suitably trained and competent operators. All operators of water-cooled furnaces should ensure that there are adequate measures in place for prompt leak detection.
139 The extent to which the delay in locating the various leaks into the furnace was crucial to the eventual extent of the furnace 'chill' and the final event of free water interacting with molten materials was substantial. Earlier leak detection on 7 November would have greatly reduced the risk of a severe furnace chill developing. There were significant predisposing features to the delay in finding the water leaks. Questionable training, experience and competencies, poor layout of pipework, inadequate cooler identification, and lack of easily implemented, systematic leak detection procedures all caused significant delays in dealing with a rapidly worsening situation. The fact that watermen working above tuyère level have to wear breathing apparatus to deal with the risk of carbon monoxide poisoning was also a significant addition to the physical difficulties involved in leak detection.
140 The provision of all reasonably practicable instrumentation and monitoring equipment, plus high levels of training and competencies among the operators should be paramount if water leakage is to be quickly identified and stopped. There should be clear leak-detection protocols for the actual process of leak detection, such that it can be carried out in an efficient and effective manner.
Lesson 7 On water-cooled metallurgical furnaces, where it is reasonably practicable, appropriate instrumentation, specifically designed for leak identification, should be installed to give earlier and more precise detection of leaking cooler elements.
141 There is little evidence that sufficient thought had been given to additional safety-related instrumentation for cooling water monitoring since the original build of the furnace. Although such instrumentation might have been of only limited accuracy, it may have been sufficient to attain some substantial risk reduction. Retrofitting modern diagnostic technology had not been sufficiently considered; instead, reliance had been placed upon experienced and competent individual employees - employees who at the crucial time were, in some cases, not available.
Design issues
Lesson 14 Opportunities to achieve risk reductions by radical design improvements on blast furnaces are very infrequent. The design of new or extensively rebuilt furnaces should take into account the need to improve the reliability of cooling water supplies and to have suitable pipework layout, valve arrangements and water monitoring systems so as to facilitate prompt leak detection and remedial action.
Lesson 17 The awareness of the danger of water/metal and water/slag explosions should be raised among all employees engaged in processes where this is a risk. The degree of risk presented by molten materials coming into contact with water continues to be not fully appreciated.
Lesson 18 The process risks associated with safety-critical plant, especially ageing plant, should be thoroughly understood through rigorous assessment processes, with these being subject to regular review. Specifically, with water systems on blast furnaces, a 'leakage tolerant' attitude should not be allowed especially with older furnaces. Such raised acceptance of water leaks increases the risks of an adverse event occurring at some point.
Port Talbot is an integrated steelworks manufacturing flat steel products for a very extensive range of industries. Iron is made on site from basic raw materials in two blast furnaces (designated No. 4 and No. 5 for historical reasons); this is then converted into steel. The two furnaces at Port Talbot at the time of the explosion were fundamentally different: No. 5 was to a 1950s design, albeit much modified over the years; No. 4 was constructed in the early 1990s to a much more recent Japanese design.
No5 Blast Furnace at Port Talbot was a conventional 'column-supported' furnace of a type in use worldwide. It consists of a large (circa 90 m) vessel supported on heavy steel columns.
...The purpose of a blast furnace is to produce iron by chemical reactions on iron oxides (iron ores) and convert them into liquid iron. This is achieved by 'charging' iron ore, coke, sinter (a product of iron ore fines and coke), and limestone into the top of the furnace and subjecting these materials to a series of complex chemical reactions within the furnace. The charge materials (or 'burden') gradually works its way down the furnace vessel, reacting chemically and thermally as it does so. At any given time the furnace burden can amount to around 1800-2000 tonnes of materials. Preheated air or 'hot blast' is blown into the furnace via nozzles known as 'tuyères'. This blast air is an essential part of the process - typically it will be heated up to 1100 °C. The raw materials introduced into the top of the furnace take some six to eight hours to descend to the bottom of the furnace where their conversion into liquid iron and slag (ie molten waste material from the furnace) is completed. The liquid iron and slag is then drained or 'tapped off' at regular intervals from the furnace.
20 In addition to liquid iron and slag, large quantities of hot gases are produced in this process. The gases exit the furnace through 'uptakes' which merge into the 'downcomer', the large gas offtake running from the top of the furnace to the gas plant. On exiting the downcomer the gases are cleaned and cooled to allow them to be used for combustion purposes. Some of the cleaned gas is directed to 'stoves' where the gas is burned to produce further hot blast air for the furnace. 21 An essential feature of the iron-making process is that, due to the chemical reactions taking place, the whole process is intensely exothermic, ie it generates considerable heat. Therefore there is an essential requirement for cooling of the furnace shell and lining.
...23 The shell was heavily lined internally with refractory material. The shell was also fitted with numerous cooling elements intended to allow a constant flow of circulating cooling water. Cooling elements were located within the refractory lining to convey away thermal energy and hence prolong the life of the lining. Although coolers were located throughout the shell there was a greater concentration in the lower areas where the greatest heat was generated.
24 Starting in the early 1970s, the original shell and cooling elements had been subject to extensive replacement and modification. This was to be expected as inevitably the refractories, and eventually the shell, will deteriorate with time. The replacement of the shell at this time allowed the fitting of coolers of high-purity copper. At the time of the accident the majority of coolers in No. 5 Blast Furnace were constructed from this material, although there were also a lesser number of cast-iron coolers.
It is a feature of blast furnace practice that the furnace lining will inevitably deteriorate during the operating period of the furnace. This gives rise to each such operating period being known as a 'campaign'...At the time of the explosion, No. 5 Blast Furnace had produced over 14 million tonnes of iron during the campaign since the 1989 rebuild.
35 The process of iron production is extremely exothermic, generating temperatures of over 2000 °C within the furnace, and the provision and maintenance of adequate supplies of cooling water is essential. The normal requirement on No. 5 Blast Furnace cooling system was for circa 80-90 thousand litres of cooling water per minute.
36 A complex cooling water system was provided to accomplish this, and basically comprised two main systems: the distribution system actually on the furnace and that supplying water to the furnace distribution system.
37 There are two basic types of furnace cooling water systems used on blast furnaces: they are described as 'open' or 'closed' systems.
38 In an open system water is drawn from a supply source, pumped through individual cooling circuits, returned via open-topped troughs known as 'launders' and then, by gravity, to open collection ponds and cooling towers. In closed water systems the various individual supply systems are self-contained and pump and recirculate the same water over and over again. Crucially, this type of system is not open to atmosphere at any point on the furnace, unlike an open system.
39 There was an open system on No. 5 Blast Furnace. The system was largely as it was originally installed. This design of system is commonly used on furnaces of this age throughout the world.
...43 The continued efficiency and integrity of coolers is entirely dependent upon a constant flow of cool water through their internal channels and labyrinths. If the supply of water to a cooler is interrupted, any residual water within the coolers will boil and evaporate. This in turn can rapidly cause the cooler to melt or 'burn out'; copper has a melting point of circa 1083 °C, much less than the temperatures encountered in parts of the furnace. Coolers can also fail through other mechanisms such as, for instance, mechanical abrasion.
...50 The normal practice at No. 5 Blast Furnace was to run one electric Sulzer pump and steam-driven turbo pump T1, each delivering 45 000 litres per minute.
51 Normally, the second Sulzer pump would be on automatic standby. Any loss of pressure would be detected by pressure switches set to automatically call for the standby unit to start should water pressure fall below a predetermined level.
52 There was instrumentation at the plant which allowed the monitoring of the total flow of water and water pressure and individual header flows and pressures. Temperatures were also monitored at several points including the launders, hot well and main manifold. Crucially, there was no instrumentation (such as flow meters) provided on the system to measure the quantity of any water loss from the system into the furnace.
[Difference in knowledge between closed systems and open systems: in closed systems, it is known to be working; in open, it is not known to be not working]
55 The accident event began with a rapid over-pressurisation of the furnace contents in the bosh area due to the interaction of water and hot molten materials. The immediate effect of this furnace over-pressure was to lift that part of the structure above the lap joint upwards, the furnace lintel rising up off the column heads normally supporting the furnace. It is estimated that the structure above the lap joint rose by some 0.75 m. This structure, with its associated burden, was estimated to weigh around 5000 tonnes. The lifting of the upper part of the furnace left an opening of approximately 400-600 mm around the entire circumference at lap joint level. Gases and hot materials were ejected horizontally from this opening. During the period that this gap remained open, some 200 tonnes of liquid, solid, and semi-solid material were ejected onto the cast house floor. Gaseous material and dust rose into the cast house, exited through various openings in the building and into the atmosphere, where much of it ignited. A cloud of ignited dust and gaseous material was thrown several hundred feet into the air above the furnace. The furnace-top 'bleeder' valves also opened and discharged into the atmosphere. Gases from these valves also ignited.
...58 There were three deaths. One employee died at the scene, another in hospital shortly after. The body of a missing third employee was recovered from the slag pit area the following day. A dozen or more employees and contractors were admitted to hospital, with some of these remaining in intensive care for several months. Their injuries included burns of varying severity and other injuries including serious fractures and lung damage from the inhalation of hot gases and dust. Several individuals had very serious burns and multiple injuries of a life-threatening nature. The injuries arose from blast effects, burns from the hot gases and dust ejected, and burns from hot water and steam. A number of personnel present were subsequently also diagnosed with post-traumatic stress disorder.
...62 The profiled steel cladding of the building was severely damaged in several areas, with some sheets being projected in excess of 40 m. Molten slag was thrown over most of the cast house floor and flowed as far as the entrance ramp to an estimated depth of between 300 and 600 mm. There was no penetration of solid material into the control room, although there was impact damage to its front. The lights in the cast house roof were undamaged.
...64 Subsequent engineering evaluation by Corus engineering personnel deemed the furnace to be beyond repair; the decision was taken to demolish and rebuild, and this work was put in hand within weeks of the accident.
...68 The furnace was largely sealed in preparation for 'quenching'. This involved the carefully controlled addition of thousands of tonnes of water to the furnace contents over a period of weeks to halt the internal reactions, stop gas generation, and put the furnace into a safe condition for demolition. Once necessary forensic examinations had been completed, the 'quenched' burden and the refractory materials within the furnace body were removed. The furnace shell was cut into sections and dismantled. The lower bosh and hearth material was essentially solidified and was not finally removed until most of the furnace structure had been dismantled.
84 Between 30 September and 5 November 2001 there had been a substantial number of problems with the No. 5 Blast Furnace water pumps. During this period, for example, there had been six pump breakdowns and six serious faults reported. Pumps had failed on auto start on a number of occasions - among a range of other defects recorded. The situation was that during this period the overall pumping system had shown a significant lack of reliability.
85 For some time prior to the incident, routinely, the water supply to the No. 5 furnace had been provided by the two electric Sulzer pumps. Steam turbo pump T1 had been out of commission since early October 2001 awaiting the return of a refurbished gearbox. T1 was, significantly, still not available for use in the days leading up to the accident.
86 The provision of full furnace cooling water delivery relied upon the two electric Sulzer pumps. The standby pump was steam turbo pump T2, having the smaller capacity of the two turbo pumps at approximately 34 000 litres per minute.
87 In 1996 the motor for the Sulzer 1 pump was replaced. Because the manufacturers were unable to supply a motor to the specification required, the motor that was available was de-rated. The consequence of this was that it became necessary to operate the motor at circa 98-99% full load current (FLC), not 90% as originally planned.
88 The Sulzer motors were of the induction type. Induction motors are designed toe maintain a constant power output. If the voltage falls, the motor draws more current to maintain, in this case, the required pump water pressure and flow. Consequently, if the supply voltage falls, the current increases.
89 When the new motor was installed the thermal overload protector was note altered or adjusted to reflect operation of the motor at 98-99% FLC rather than the original specification. Instead it was set to operate at 110% FLC.
90 The failure to adjust the thermal overload protector reduced the margin of spare capacity from 22.2% to 11.7% - a 47.3% reduction, which was highly significant and crucial.
91 In simple terms the thermal overload protector on Sulzer 1 had not been adjusted to accommodate the higher kilowatt rating of the new motor when fitted. This meant that, on 7 November, it tripped too soon.
...97 At this time, around 09.16, the smaller of the two turbo pumps (T2) automatically came on to compensate when number 1 Sulzer pump tripped out. This pump (T2) also tripped out (on its over-speed protection) within seconds, probably because a steam governor setting was too high, allowing the ultimate (safety) trip speed to be reached quickly (due to speed 'surge') after start up. The ultimate trip speed device operated, 'de-latching' the pump from its steam supply valve, and shutting down the pump. (The important fact here is that T2 standby failed to come online as it was required to do.)
98 As a consequence the furnace was, for a period of some 10-12 minutes, receiving only approximately 55% of the required cooling water supply.
99 The emergency water tower did not come online as the reduction in water pressure was insufficient to cause this to operate.
100 At around 09.25 the electrical supply to number 1 Sulzer pump was restored. On noticing the initial reduction in the flow of cooling water, the furnace crew, in accordance with established procedures, had 'dropped the wind' to reduce the flow of hot air from the tuyères. With the water flow to the furnace restored, the furnace was gradually put back 'on wind'. A search for leaking coolers was initiated when elevated hydrogen readings were later detected, indicating a water leak into the furnace. The immediate assumption, subsequently proved to have been correct, was that coolers had burnt out because of the reduction in cooling water supply.
Leak detection
101 The detection of leaking coolers on the furnace was the duty of technicians among the furnace crew known as 'watermen'. In any furnace design, but especially one with open-circuit cooling arrangements, the job of detecting leaks was known to be difficult.
102 There were a number of additional factors with No. 5 Blast Furnace which made the task of detecting water leaks even more difficult. They included:
- the multiplicity of pipework, described by some as being 'like spaghetti'. This was caused as a consequence of installation of Sorrelor coolers to provide additional cooling at places where the refractory lining had become thin and at other hot spots;
- open launders into which water from the coolers was discharged had been covered to keep out debris. This hindered and obscured visibility and accessibility in checking for leaks;
- some water discharge pipes were slipping into the launders and were preventing visibility of outlets;
- some water discharge pipes had additional flexible hoses attached which ended up at the base of the launders and totally submerged;
- water outlets were on different landings from the coolers;
- there were valves provided which, when turned off, would shut off large numbers of coolers at a time. The ability to do this would have speeded up the detection of water leaks. The valves were in poor condition, were not working on 7 November and could not, therefore, be used to isolate banks of coolers at a time. There had been a programme to have the valves repaired in the summer but this was not implemented for budgetary reasons.
...Detection of water leaks at furnace No. 5 was, therefore, a difficult task in any event. For it to be done properly it required experienced watermen and an effective system, including labelling and tagging, to identify which coolers had been switched off, checked and switched on again. This was particularly important in the light of the multiplicity of pipework.
On bringing the furnace back on to normal operational wind rate, a rise in hydrogen levels in the analysis of the top gas had been noted, indicating the ingress of water into the furnace (the elevated hydrogen readings being due to dissociation of water into its component oxygen and hydrogen molecules inside the furnace). The monitoring screen alarms at 10.11 indicated that the increased percentage of hydrogen was significant (this would normally run at below 2%). Despite attempts by the watermen no leaks could be found. Sometime after 11.30 a decision was made to take the furnace off wind. Subsequently the furnace shutdown was postponed until 14.30 because some molten iron and slag was still being run off the furnace.
At 12.50 on 8 November, monitored hydrogen levels increased to more than 7%, indicating significant further water ingress to the furnace. At 13.00 hydrogen levels were seen to be still rising, again indicating further water ingress. The furnace remained on wind while watermen on the furnace stack tried to locate the leak.
...At approximately 17.12 an employee working close to the tap hole saw something at the lap joint which he believed was possibly an indication of an imminent breakout of slag. He shouted 'run'. Almost immediately thereafter, the explosion and rupture of the furnace occurred.
This event was brought about by:
- a failure of two of the three available 'safety-critical' cooling water pumps, at approximately 09.13 and 09.15, respectively on 7 November 2001;
- the operation of the furnace on blast for 10-12 minutes with only 55% of its water cooling needs, leading to the overheating of some furnace coolers (circa 09.15-09.26, 7 November 2001);
- the consequential failure of perhaps three Sorrelor-type coolers, leading to serious water leaks into the furnace (beginning at about 10.00 on 7 November);
- a prolonged delay in the furnace watermen detecting and dealing with the source of this water ingress; as much as 50-80 tonnes of water entered the furnace by the time the source of the leakage was located and sealed at about 18.30-19.00 on 7 November;
- the furnace was put into a 'chilled hearth', and thereby a 'recovery' situation by these events, ie the large amount of water in the lower areas of the furnace had the effect of significantly lowering thermal activity;
- in the process of attempting to recover the furnace, and following additional leaks on 8 November 2001, a quantity of water came into intimate contact with, and reacted with, hot molten metal and/or hot molten slag, resulting in a massive release of energy leading to an over-pressure of the furnace interior;
- the furnace lifted some 0.75 m off its column heads. The large bolts between the furnace supporting columns and its circumferential lintel had been fractured some significant amount of time before the explosion and offered no impediment to this motion.
Lesson 17 The awareness of the danger of water/metal and water/slag explosions should be raised among all employees engaged in processes where this is a risk. The degree of risk presented by molten materials coming into contact with water continues to be not fully appreciated.
163 The assertion was made by some experienced employees that water on metal was somehow relatively 'safe' and that water 'under' metal (or slag) was the danger to be avoided. This is not always true: water and molten metal/slag contact of any sort should always be regarded as potentially very hazardous. Generally, water lying undisturbed on top of molten metal or slag will merely boil off to steam. However, there are foreseeable conditions where water on top of molten metal can still be extremely dangerous. This point was made following the Appleby-Frodingham Inquiry in 1975 (British Steel, 1976): 'It was a known fact that it was extremely hazardous to pour hot metal or slag onto water and it was relatively safe to pour water on to hot metal/slag in situations where little danger of entrapment of the water by hot metal existed. However the incident has highlighted a third situation, namely where water comes into contact with hot metal in a confined space, such as a torpedo ladle, or in any other situations where the possibility of entrapment exists...'.
164 There needs still to be a re-evaluation of the collective experience on this subject. The received wisdom on this matter within the molten metals industries is not necessarily always accurate and can lead to failure to correctly evaluate the risk presented by water and metal contact.
165 HSE has investigated a number of serious molten metal/water explosions that have occurred subsequent to water being initially on the surface of the metal and safely boiling off. Almost any physical disruption of this relatively stable state can lead to catastrophic consequences. This disruption can come from simple movement of the system, breakdown of the water/metal interface, or the inability of the steam generated to have sufficient room to escape. All water/metal interactions should be considered as potentially very hazardous.
166 There is a need for a perception-shift within the industry on this matter, and it should be brought about through the risk assessments and training processes for all jobs and tasks involving molten materials were there is possible water interaction.
Lesson 18 The process risks associated with safety-critical plant, especially ageing plant, should be thoroughly understood through rigorous assessment processes, with these being subject to regular review. Specifically, with water systems on blast furnaces, a 'leakage tolerant' attitude should not be allowed - especially with older furnaces. Such raised acceptance of water leaks increases the risks of an adverse event occurring at some point.
167 The investigation showed that there was a substantial difference in the occurrence of water leak events, on a routine basis, over a long period of time, between the older No. 5 furnace and its newer neighbour, No. 4 Blast Furnace. This may have been indicative of a 'leak tolerant' culture developing at No. 5 Blast Furnace because of its history and age. This was potentially a serious development as it invoked a mindset of accepting leaks as inevitable on the older furnace. Water leaks had clearly been identified by senior managers as being the potential determining feature for the final conclusion of the operation of the No. 5 furnace - there is little evidence that this had actually led to better leak prevention and detection on this furnace.
[appendixes: cool photos]"
#accident #security
An interesting industrial disaster: an iron smelter which killed 3 workers when hydrogen exploded molten metal through the facility. It seems to follow the almost stereotypical pattern: a large dangerous system with complex internal dynamics is run successfully for many years, while minor faults begin to accumulate and suboptimal safety is tolerated as 'normal' (taken as strong evidence of safety), until a cascade of errors begin which fall through multiple safeguards which should have prevented it from escalating but didn't (and illustrated the limitations of what one might call 'negative' controls and violations of the 'principle of least privilege') and the control systems actively contributed to the problems\* until finally the system fails spectacularly. (I also didn't know how iron smelters worked - the smelting process is not, as I assumed, endothermic but exothermic; if there's one thing that terrifies me more than 200+ tons of molten metal, it's 200+ tons of molten metal generating its own heat which you can't easily shut off.)
* see also http://www.ctlab.org/documents/How%20Complex%20Systems%20Fail.pdf / https://news.ycombinator.com/item?id=8282923 , and http://blogs.msdn.com/b/oldnewthing/archive/2008/04/16/8398400.aspx
One lesson here is that when something goes wrong, the root-cause is not the immediate cause, and a solution should attack multiple factors (a very common idea in aviation but one I don't seem to see much outside of it, even though disciplines like programming could benefit from this attitude).
An example: a full root-cause fix to OpenSSL's Heartbleed is not merely patching the length check, but patching the length check, removing the custom memory management which blocked analysis tools from spotting it, simplifying the codebase, including static analysis tools as part of the default development process, and more broadly, switching as much as possible to memory-safe languages and formal methods.
A personal example: for spidering/crawling/mirroring the blackmarkets, I have a Frankenstein setup where I log in using my regular Firefox browser, export all Firefox cookies to a 'cookies.txt', and then run 'wget' using a copy of the cookies.txt for access, proxied through Privoxy to implement a blacklist (since wget's blacklist functionality is completely broken). This leaves a 'cookies.txt' in each mirror directory, with active cookies for all the sites I use. I periodically compress mirrors into tarballs to save space & for redistribution over Amazon S3 after manually deleting the cookies.txt, and after emailing a list of my available mirrors to some other researchers, I discovered 2 of the tarballs had a cookies.txt in them. Oops. I immediately revoked public access to them and began generating edited tarballs to upload, and cleared cookies in FF & re-loggedin to the most important websites to invalidate the old cookies.txt as much as possible. But this was not a full solution: why was I manually deleting the cookies files? Why did my little archive script not automatically exclude them? Why did the cookies.txt contain cookies for all my websites rather than solely the blackmarkets? For that matter, why were there any cookies.txt on disk after mirroring had finished? So a full solution went like this: a cron job periodically deletes all cookies.txt in the uncompressed mirrors; the archive script was modified to delete any cookies.txt in the directory being archived; and each wget script was modified so that it didn't copy the full cookies.txt but grepped it for only the lines with '*.onion' and stored only those lines in the mirrors' cookies.txt. So the file is now harmless; while harmless, it's occasionally deleted anyway; and it's deleted, but also to be safe, deleted before archiving again. I expect this to prevent any recurrence of the problem.
"The explosion of No. 5 Blast Furnace, Corus UK Ltd, Port Talbot", 2001 http://www.hse.gov.uk/pubns/web34.pdf ; excerpts:
"3 At the premises of Corus UK Ltd, Port Talbot, No. 5 Blast Furnace exploded at approximately 17.13 pm on 8 November 2001. The entire furnace, which with its contents weighed approximately 5000 tonnes, lifted bodily at the lap joint, rising some 0.75 m from its supporting structures, leading to the explosive release of hot materials (an estimated 200 tonnes in total, comprising largely solids and semi solids, with a little molten metal) and gases into the cast house. Three employees died: Andrew Hutin, Stephen Galsworthy and Len Radford. A further 12 employees and contractors sustained severe injuries. Many more suffered minor injuries and shock.
4 The outcome of the explosion was unprecedented in the steel-making industry, but was the result of many failings in safety management by the company over an extended period. The explosion occurred after a prolonged attempt - over two days - to recover the furnace from a chilled-hearth situation caused by cooling water ingress. The immediate cause was the mixing of water and hot materials within the lower part of the furnace; the precise mechanism remains a matter that is not fully resolved.
...The water had entered the furnace from its cooling system following a chain of events initiated by the failure of safety-critical water cooling systems. At the time of the explosion, attempts were continuing to rectify the abnormal operating conditions that this had created and to recover the furnace.
Lesson 5 Closed systems for furnace cooling water, or systems with equal or better reliability, should be provided wherever reasonably practicable. Leak detection
137 Closed system cooling arrangements offer considerable advantages over 'open' systems for rapid leak detection and are much more amenable to the fitting of diagnostic tools such as flow meters, make-up water determination etc. They are more reliable in terms of keeping the cooling circuits free from contaminants etc and are therefore an aid to better cooler maintenance, reducing scaling and fouling of the circuits.
138 The use of open-system cooling is historical, and lent itself to fairly accurate leak identification, monitoring etc, assuming the existence of long-serving, experienced watermen. Even with this proviso, however, all the evidence is that open systems are fundamentally much more vulnerable to fouling, corrosion and associated problems. With the advent of more modern technology for monitoring, and the possible lack of very experienced operators, closed systems will almost certainly prove far superior and reliable if properly designed, installed and maintained.
Lesson 6 Speed in locating furnace cooling water leaks is essential. Rapid leak detection relies on good engineering, adequate detection protocols and suitably trained and competent operators. All operators of water-cooled furnaces should ensure that there are adequate measures in place for prompt leak detection.
139 The extent to which the delay in locating the various leaks into the furnace was crucial to the eventual extent of the furnace 'chill' and the final event of free water interacting with molten materials was substantial. Earlier leak detection on 7 November would have greatly reduced the risk of a severe furnace chill developing. There were significant predisposing features to the delay in finding the water leaks. Questionable training, experience and competencies, poor layout of pipework, inadequate cooler identification, and lack of easily implemented, systematic leak detection procedures all caused significant delays in dealing with a rapidly worsening situation. The fact that watermen working above tuyère level have to wear breathing apparatus to deal with the risk of carbon monoxide poisoning was also a significant addition to the physical difficulties involved in leak detection.
140 The provision of all reasonably practicable instrumentation and monitoring equipment, plus high levels of training and competencies among the operators should be paramount if water leakage is to be quickly identified and stopped. There should be clear leak-detection protocols for the actual process of leak detection, such that it can be carried out in an efficient and effective manner.
Lesson 7 On water-cooled metallurgical furnaces, where it is reasonably practicable, appropriate instrumentation, specifically designed for leak identification, should be installed to give earlier and more precise detection of leaking cooler elements.
141 There is little evidence that sufficient thought had been given to additional safety-related instrumentation for cooling water monitoring since the original build of the furnace. Although such instrumentation might have been of only limited accuracy, it may have been sufficient to attain some substantial risk reduction. Retrofitting modern diagnostic technology had not been sufficiently considered; instead, reliance had been placed upon experienced and competent individual employees - employees who at the crucial time were, in some cases, not available.
Design issues
Lesson 14 Opportunities to achieve risk reductions by radical design improvements on blast furnaces are very infrequent. The design of new or extensively rebuilt furnaces should take into account the need to improve the reliability of cooling water supplies and to have suitable pipework layout, valve arrangements and water monitoring systems so as to facilitate prompt leak detection and remedial action.
Lesson 17 The awareness of the danger of water/metal and water/slag explosions should be raised among all employees engaged in processes where this is a risk. The degree of risk presented by molten materials coming into contact with water continues to be not fully appreciated.
Lesson 18 The process risks associated with safety-critical plant, especially ageing plant, should be thoroughly understood through rigorous assessment processes, with these being subject to regular review. Specifically, with water systems on blast furnaces, a 'leakage tolerant' attitude should not be allowed especially with older furnaces. Such raised acceptance of water leaks increases the risks of an adverse event occurring at some point.
Port Talbot is an integrated steelworks manufacturing flat steel products for a very extensive range of industries. Iron is made on site from basic raw materials in two blast furnaces (designated No. 4 and No. 5 for historical reasons); this is then converted into steel. The two furnaces at Port Talbot at the time of the explosion were fundamentally different: No. 5 was to a 1950s design, albeit much modified over the years; No. 4 was constructed in the early 1990s to a much more recent Japanese design.
No5 Blast Furnace at Port Talbot was a conventional 'column-supported' furnace of a type in use worldwide. It consists of a large (circa 90 m) vessel supported on heavy steel columns.
...The purpose of a blast furnace is to produce iron by chemical reactions on iron oxides (iron ores) and convert them into liquid iron. This is achieved by 'charging' iron ore, coke, sinter (a product of iron ore fines and coke), and limestone into the top of the furnace and subjecting these materials to a series of complex chemical reactions within the furnace. The charge materials (or 'burden') gradually works its way down the furnace vessel, reacting chemically and thermally as it does so. At any given time the furnace burden can amount to around 1800-2000 tonnes of materials. Preheated air or 'hot blast' is blown into the furnace via nozzles known as 'tuyères'. This blast air is an essential part of the process - typically it will be heated up to 1100 °C. The raw materials introduced into the top of the furnace take some six to eight hours to descend to the bottom of the furnace where their conversion into liquid iron and slag (ie molten waste material from the furnace) is completed. The liquid iron and slag is then drained or 'tapped off' at regular intervals from the furnace.
20 In addition to liquid iron and slag, large quantities of hot gases are produced in this process. The gases exit the furnace through 'uptakes' which merge into the 'downcomer', the large gas offtake running from the top of the furnace to the gas plant. On exiting the downcomer the gases are cleaned and cooled to allow them to be used for combustion purposes. Some of the cleaned gas is directed to 'stoves' where the gas is burned to produce further hot blast air for the furnace. 21 An essential feature of the iron-making process is that, due to the chemical reactions taking place, the whole process is intensely exothermic, ie it generates considerable heat. Therefore there is an essential requirement for cooling of the furnace shell and lining.
...23 The shell was heavily lined internally with refractory material. The shell was also fitted with numerous cooling elements intended to allow a constant flow of circulating cooling water. Cooling elements were located within the refractory lining to convey away thermal energy and hence prolong the life of the lining. Although coolers were located throughout the shell there was a greater concentration in the lower areas where the greatest heat was generated.
24 Starting in the early 1970s, the original shell and cooling elements had been subject to extensive replacement and modification. This was to be expected as inevitably the refractories, and eventually the shell, will deteriorate with time. The replacement of the shell at this time allowed the fitting of coolers of high-purity copper. At the time of the accident the majority of coolers in No. 5 Blast Furnace were constructed from this material, although there were also a lesser number of cast-iron coolers.
It is a feature of blast furnace practice that the furnace lining will inevitably deteriorate during the operating period of the furnace. This gives rise to each such operating period being known as a 'campaign'...At the time of the explosion, No. 5 Blast Furnace had produced over 14 million tonnes of iron during the campaign since the 1989 rebuild.
35 The process of iron production is extremely exothermic, generating temperatures of over 2000 °C within the furnace, and the provision and maintenance of adequate supplies of cooling water is essential. The normal requirement on No. 5 Blast Furnace cooling system was for circa 80-90 thousand litres of cooling water per minute.
36 A complex cooling water system was provided to accomplish this, and basically comprised two main systems: the distribution system actually on the furnace and that supplying water to the furnace distribution system.
37 There are two basic types of furnace cooling water systems used on blast furnaces: they are described as 'open' or 'closed' systems.
38 In an open system water is drawn from a supply source, pumped through individual cooling circuits, returned via open-topped troughs known as 'launders' and then, by gravity, to open collection ponds and cooling towers. In closed water systems the various individual supply systems are self-contained and pump and recirculate the same water over and over again. Crucially, this type of system is not open to atmosphere at any point on the furnace, unlike an open system.
39 There was an open system on No. 5 Blast Furnace. The system was largely as it was originally installed. This design of system is commonly used on furnaces of this age throughout the world.
...43 The continued efficiency and integrity of coolers is entirely dependent upon a constant flow of cool water through their internal channels and labyrinths. If the supply of water to a cooler is interrupted, any residual water within the coolers will boil and evaporate. This in turn can rapidly cause the cooler to melt or 'burn out'; copper has a melting point of circa 1083 °C, much less than the temperatures encountered in parts of the furnace. Coolers can also fail through other mechanisms such as, for instance, mechanical abrasion.
...50 The normal practice at No. 5 Blast Furnace was to run one electric Sulzer pump and steam-driven turbo pump T1, each delivering 45 000 litres per minute.
51 Normally, the second Sulzer pump would be on automatic standby. Any loss of pressure would be detected by pressure switches set to automatically call for the standby unit to start should water pressure fall below a predetermined level.
52 There was instrumentation at the plant which allowed the monitoring of the total flow of water and water pressure and individual header flows and pressures. Temperatures were also monitored at several points including the launders, hot well and main manifold. Crucially, there was no instrumentation (such as flow meters) provided on the system to measure the quantity of any water loss from the system into the furnace.
[Difference in knowledge between closed systems and open systems: in closed systems, it is known to be working; in open, it is not known to be not working]
55 The accident event began with a rapid over-pressurisation of the furnace contents in the bosh area due to the interaction of water and hot molten materials. The immediate effect of this furnace over-pressure was to lift that part of the structure above the lap joint upwards, the furnace lintel rising up off the column heads normally supporting the furnace. It is estimated that the structure above the lap joint rose by some 0.75 m. This structure, with its associated burden, was estimated to weigh around 5000 tonnes. The lifting of the upper part of the furnace left an opening of approximately 400-600 mm around the entire circumference at lap joint level. Gases and hot materials were ejected horizontally from this opening. During the period that this gap remained open, some 200 tonnes of liquid, solid, and semi-solid material were ejected onto the cast house floor. Gaseous material and dust rose into the cast house, exited through various openings in the building and into the atmosphere, where much of it ignited. A cloud of ignited dust and gaseous material was thrown several hundred feet into the air above the furnace. The furnace-top 'bleeder' valves also opened and discharged into the atmosphere. Gases from these valves also ignited.
...58 There were three deaths. One employee died at the scene, another in hospital shortly after. The body of a missing third employee was recovered from the slag pit area the following day. A dozen or more employees and contractors were admitted to hospital, with some of these remaining in intensive care for several months. Their injuries included burns of varying severity and other injuries including serious fractures and lung damage from the inhalation of hot gases and dust. Several individuals had very serious burns and multiple injuries of a life-threatening nature. The injuries arose from blast effects, burns from the hot gases and dust ejected, and burns from hot water and steam. A number of personnel present were subsequently also diagnosed with post-traumatic stress disorder.
...62 The profiled steel cladding of the building was severely damaged in several areas, with some sheets being projected in excess of 40 m. Molten slag was thrown over most of the cast house floor and flowed as far as the entrance ramp to an estimated depth of between 300 and 600 mm. There was no penetration of solid material into the control room, although there was impact damage to its front. The lights in the cast house roof were undamaged.
...64 Subsequent engineering evaluation by Corus engineering personnel deemed the furnace to be beyond repair; the decision was taken to demolish and rebuild, and this work was put in hand within weeks of the accident.
...68 The furnace was largely sealed in preparation for 'quenching'. This involved the carefully controlled addition of thousands of tonnes of water to the furnace contents over a period of weeks to halt the internal reactions, stop gas generation, and put the furnace into a safe condition for demolition. Once necessary forensic examinations had been completed, the 'quenched' burden and the refractory materials within the furnace body were removed. The furnace shell was cut into sections and dismantled. The lower bosh and hearth material was essentially solidified and was not finally removed until most of the furnace structure had been dismantled.
84 Between 30 September and 5 November 2001 there had been a substantial number of problems with the No. 5 Blast Furnace water pumps. During this period, for example, there had been six pump breakdowns and six serious faults reported. Pumps had failed on auto start on a number of occasions - among a range of other defects recorded. The situation was that during this period the overall pumping system had shown a significant lack of reliability.
85 For some time prior to the incident, routinely, the water supply to the No. 5 furnace had been provided by the two electric Sulzer pumps. Steam turbo pump T1 had been out of commission since early October 2001 awaiting the return of a refurbished gearbox. T1 was, significantly, still not available for use in the days leading up to the accident.
86 The provision of full furnace cooling water delivery relied upon the two electric Sulzer pumps. The standby pump was steam turbo pump T2, having the smaller capacity of the two turbo pumps at approximately 34 000 litres per minute.
87 In 1996 the motor for the Sulzer 1 pump was replaced. Because the manufacturers were unable to supply a motor to the specification required, the motor that was available was de-rated. The consequence of this was that it became necessary to operate the motor at circa 98-99% full load current (FLC), not 90% as originally planned.
88 The Sulzer motors were of the induction type. Induction motors are designed toe maintain a constant power output. If the voltage falls, the motor draws more current to maintain, in this case, the required pump water pressure and flow. Consequently, if the supply voltage falls, the current increases.
89 When the new motor was installed the thermal overload protector was note altered or adjusted to reflect operation of the motor at 98-99% FLC rather than the original specification. Instead it was set to operate at 110% FLC.
90 The failure to adjust the thermal overload protector reduced the margin of spare capacity from 22.2% to 11.7% - a 47.3% reduction, which was highly significant and crucial.
91 In simple terms the thermal overload protector on Sulzer 1 had not been adjusted to accommodate the higher kilowatt rating of the new motor when fitted. This meant that, on 7 November, it tripped too soon.
...97 At this time, around 09.16, the smaller of the two turbo pumps (T2) automatically came on to compensate when number 1 Sulzer pump tripped out. This pump (T2) also tripped out (on its over-speed protection) within seconds, probably because a steam governor setting was too high, allowing the ultimate (safety) trip speed to be reached quickly (due to speed 'surge') after start up. The ultimate trip speed device operated, 'de-latching' the pump from its steam supply valve, and shutting down the pump. (The important fact here is that T2 standby failed to come online as it was required to do.)
98 As a consequence the furnace was, for a period of some 10-12 minutes, receiving only approximately 55% of the required cooling water supply.
99 The emergency water tower did not come online as the reduction in water pressure was insufficient to cause this to operate.
100 At around 09.25 the electrical supply to number 1 Sulzer pump was restored. On noticing the initial reduction in the flow of cooling water, the furnace crew, in accordance with established procedures, had 'dropped the wind' to reduce the flow of hot air from the tuyères. With the water flow to the furnace restored, the furnace was gradually put back 'on wind'. A search for leaking coolers was initiated when elevated hydrogen readings were later detected, indicating a water leak into the furnace. The immediate assumption, subsequently proved to have been correct, was that coolers had burnt out because of the reduction in cooling water supply.
Leak detection
101 The detection of leaking coolers on the furnace was the duty of technicians among the furnace crew known as 'watermen'. In any furnace design, but especially one with open-circuit cooling arrangements, the job of detecting leaks was known to be difficult.
102 There were a number of additional factors with No. 5 Blast Furnace which made the task of detecting water leaks even more difficult. They included:
- the multiplicity of pipework, described by some as being 'like spaghetti'. This was caused as a consequence of installation of Sorrelor coolers to provide additional cooling at places where the refractory lining had become thin and at other hot spots;
- open launders into which water from the coolers was discharged had been covered to keep out debris. This hindered and obscured visibility and accessibility in checking for leaks;
- some water discharge pipes were slipping into the launders and were preventing visibility of outlets;
- some water discharge pipes had additional flexible hoses attached which ended up at the base of the launders and totally submerged;
- water outlets were on different landings from the coolers;
- there were valves provided which, when turned off, would shut off large numbers of coolers at a time. The ability to do this would have speeded up the detection of water leaks. The valves were in poor condition, were not working on 7 November and could not, therefore, be used to isolate banks of coolers at a time. There had been a programme to have the valves repaired in the summer but this was not implemented for budgetary reasons.
...Detection of water leaks at furnace No. 5 was, therefore, a difficult task in any event. For it to be done properly it required experienced watermen and an effective system, including labelling and tagging, to identify which coolers had been switched off, checked and switched on again. This was particularly important in the light of the multiplicity of pipework.
On bringing the furnace back on to normal operational wind rate, a rise in hydrogen levels in the analysis of the top gas had been noted, indicating the ingress of water into the furnace (the elevated hydrogen readings being due to dissociation of water into its component oxygen and hydrogen molecules inside the furnace). The monitoring screen alarms at 10.11 indicated that the increased percentage of hydrogen was significant (this would normally run at below 2%). Despite attempts by the watermen no leaks could be found. Sometime after 11.30 a decision was made to take the furnace off wind. Subsequently the furnace shutdown was postponed until 14.30 because some molten iron and slag was still being run off the furnace.
At 12.50 on 8 November, monitored hydrogen levels increased to more than 7%, indicating significant further water ingress to the furnace. At 13.00 hydrogen levels were seen to be still rising, again indicating further water ingress. The furnace remained on wind while watermen on the furnace stack tried to locate the leak.
...At approximately 17.12 an employee working close to the tap hole saw something at the lap joint which he believed was possibly an indication of an imminent breakout of slag. He shouted 'run'. Almost immediately thereafter, the explosion and rupture of the furnace occurred.
This event was brought about by:
- a failure of two of the three available 'safety-critical' cooling water pumps, at approximately 09.13 and 09.15, respectively on 7 November 2001;
- the operation of the furnace on blast for 10-12 minutes with only 55% of its water cooling needs, leading to the overheating of some furnace coolers (circa 09.15-09.26, 7 November 2001);
- the consequential failure of perhaps three Sorrelor-type coolers, leading to serious water leaks into the furnace (beginning at about 10.00 on 7 November);
- a prolonged delay in the furnace watermen detecting and dealing with the source of this water ingress; as much as 50-80 tonnes of water entered the furnace by the time the source of the leakage was located and sealed at about 18.30-19.00 on 7 November;
- the furnace was put into a 'chilled hearth', and thereby a 'recovery' situation by these events, ie the large amount of water in the lower areas of the furnace had the effect of significantly lowering thermal activity;
- in the process of attempting to recover the furnace, and following additional leaks on 8 November 2001, a quantity of water came into intimate contact with, and reacted with, hot molten metal and/or hot molten slag, resulting in a massive release of energy leading to an over-pressure of the furnace interior;
- the furnace lifted some 0.75 m off its column heads. The large bolts between the furnace supporting columns and its circumferential lintel had been fractured some significant amount of time before the explosion and offered no impediment to this motion.
Lesson 17 The awareness of the danger of water/metal and water/slag explosions should be raised among all employees engaged in processes where this is a risk. The degree of risk presented by molten materials coming into contact with water continues to be not fully appreciated.
163 The assertion was made by some experienced employees that water on metal was somehow relatively 'safe' and that water 'under' metal (or slag) was the danger to be avoided. This is not always true: water and molten metal/slag contact of any sort should always be regarded as potentially very hazardous. Generally, water lying undisturbed on top of molten metal or slag will merely boil off to steam. However, there are foreseeable conditions where water on top of molten metal can still be extremely dangerous. This point was made following the Appleby-Frodingham Inquiry in 1975 (British Steel, 1976): 'It was a known fact that it was extremely hazardous to pour hot metal or slag onto water and it was relatively safe to pour water on to hot metal/slag in situations where little danger of entrapment of the water by hot metal existed. However the incident has highlighted a third situation, namely where water comes into contact with hot metal in a confined space, such as a torpedo ladle, or in any other situations where the possibility of entrapment exists...'.
164 There needs still to be a re-evaluation of the collective experience on this subject. The received wisdom on this matter within the molten metals industries is not necessarily always accurate and can lead to failure to correctly evaluate the risk presented by water and metal contact.
165 HSE has investigated a number of serious molten metal/water explosions that have occurred subsequent to water being initially on the surface of the metal and safely boiling off. Almost any physical disruption of this relatively stable state can lead to catastrophic consequences. This disruption can come from simple movement of the system, breakdown of the water/metal interface, or the inability of the steam generated to have sufficient room to escape. All water/metal interactions should be considered as potentially very hazardous.
166 There is a need for a perception-shift within the industry on this matter, and it should be brought about through the risk assessments and training processes for all jobs and tasks involving molten materials were there is possible water interaction.
Lesson 18 The process risks associated with safety-critical plant, especially ageing plant, should be thoroughly understood through rigorous assessment processes, with these being subject to regular review. Specifically, with water systems on blast furnaces, a 'leakage tolerant' attitude should not be allowed - especially with older furnaces. Such raised acceptance of water leaks increases the risks of an adverse event occurring at some point.
167 The investigation showed that there was a substantial difference in the occurrence of water leak events, on a routine basis, over a long period of time, between the older No. 5 furnace and its newer neighbour, No. 4 Blast Furnace. This may have been indicative of a 'leak tolerant' culture developing at No. 5 Blast Furnace because of its history and age. This was potentially a serious development as it invoked a mindset of accepting leaks as inevitable on the older furnace. Water leaks had clearly been identified by senior managers as being the potential determining feature for the final conclusion of the operation of the No. 5 furnace - there is little evidence that this had actually led to better leak prevention and detection on this furnace.
[appendixes: cool photos]"
#accident #security
Its crazy that it took WEEKS to cool that thing down enough to dismantle it. I also can't believe I just read this entire post!Jan 8, 2015
