Flixborough: Why Temporary Plant Changes Need Full Engineering Control
On 01 Jun 74, a temporary plant modification became central to a disaster that killed 28 people. Flixborough remains a test of whether we manage engineering change, or simply get a workaround running.
At about 1653h on that Saturday, an explosion devastated the Nypro chemical works near Flixborough, England. HSE records 28 workers killed, 36 people injured onsite and 53 reported injuries off site. Eighteen of those killed were in the control room; nobody in that room survived. The main office block was unoccupied, and a weekday incident could have taken still more lives. [1]
Those numbers belong to people, families and a community. They also explain why this case deserves more than a line on a training slide saying “a temporary pipe failed”. The useful questions are how the modification changed the plant, why that change was not properly understood, and what evidence should be required before a similar system is allowed to operate.
The plant before and after
What was the plant doing?
Nypro manufactured caprolactam, a material used to make nylon. In the relevant process section, cyclohexane passed through six reactors in series. Air was introduced to oxidise it, with normal operation around 155°C and roughly 8–9 bar pressure. Large connecting pipes and expansion bellows linked the vessels. The process handled a substantial inventory of hot, flammable liquid. [2]
The temperature matters. Cyclohexane boils at about 81°C at atmospheric pressure. If hot, pressurised liquid escapes, some can flash rapidly into vapour and entrain liquid droplets. A release can therefore create a large flammable cloud before anyone has time to intervene. Ignition of that cloud can produce destructive overpressure across a much larger area than the original leak. [3]
From a cracked reactor to a temporary bypass
In late March 1974, a leak revealed a serious crack in reactor 5. The damaged vessel was removed. To keep the process operating, the gap was bridged by a temporary 20-inch dog-leg pipe connecting reactors 4 and 6 through the existing bellows arrangements. The original interconnecting pipework was 28 inches in diameter. [3, paras 53–73]
The critical change was much more than the pipe diameter. The new assembly spanned a different distance and followed an offset path. That changed the forces and bending effects imposed on the pipe, bellows and supports. A system assembled from familiar components can behave very differently when their arrangement changes.
Bellows accommodate specified movement; they are not universal flexible connectors. Internal pressure creates forces that the whole assembly must resist. The inquiry found that the temporary supports were suitable for taking the assembly’s weight during installation, but wholly inadequate for working conditions. Supporting weight and restraining pressure-induced movement are different engineering tasks. [3, paras 68–72]
The inquiry also found that the Works Engineer position was vacant. Senior managers had chemical engineering expertise, but did not recognise the mechanical engineering problem. This is a lesson about matching competence to the decision: experience in running a process does not automatically qualify someone to approve a changed pressure-piping arrangement. [3, para 210]
The sequence
Late March: reactor 5 was removed after the leak was discovered, and the temporary bypass was fabricated and installed.
1 April: the modified section returned to service. It then operated for approximately two months.
Late May: leaks elsewhere led to a shutdown. The plant was being restarted on 1 June.
1 June, about 1653h: a major cyclohexane release formed a flammable cloud that ignited. The blast devastated the plant and damaged surrounding properties.
Afterwards: fires continued for days. HSE records that fires still hampered rescue work ten days later.
Two months of apparently successful operation did not validate the design. A weakness can remain hidden until a different combination of pressure, temperature, movement or operating conditions exposes it. “It has been running fine” describes experience so far; it does not establish the margin against failure.
What the inquiry found
The 1975 Court of Inquiry concluded that the inadequately supported bypass assembly ruptured under the pressure and temperature conditions present, releasing the cyclohexane. It rejected the alternative theory that an earlier failure in a nearby 8-inch line caused the bypass to fail. Later researchers continued to challenge aspects of the sequence; HSE’s current case summary mentions the possibility of a fire on the nearby line. [3, para 225] [4] [1]
That distinction matters. We can accurately report the official conclusion while acknowledging that the exact initiating sequence has been disputed. The documented deficiencies in the bypass design, restraint, technical review and testing remain serious lessons regardless of that debate.
A correction worth making:
Some short accounts, including HSE’s summary, say no pressure testing was performed. The inquiry gives a more precise account: nitrogen leak tests were carried out at approximately 4 kg/cm² and then 9 kg/cm². It nevertheless criticised the testing regime and the absence of proper design verification; the assembly had not been tested to the safety-valve pressure of 11 kg/cm². [3, paras 69–73]
Leak-tightness is not proof of structural adequacy.
A successful leak check cannot establish that an assembly will withstand all required loads, movements and operating conditions. Nor should the historic numbers above be treated as a modern test specification. Testing itself needs a competent, system-specific plan and appropriate controls.
The control room was part of the hazard
A control room must remain a place from which people can manage the plant safely. Its name does not make it a refuge. Blast resistance, glazing, roof construction, fire exposure, ventilation, access and escape all depend on the credible hazards around it. HSE’s control-room guidance treats structural protection and effective operation as connected design requirements. [5]
The same questions apply to temporary offices, maintenance cabins and buildings that become busier over time. A change in occupancy can change the consequences of an accident even when the process equipment stays the same. An emergency plan also needs to consider the loss of the control room, communications or access routes it relies upon.
What a credible management-of-change process looks like
HSE’s plant-modification guidance calls for a traceable safety, engineering and technical review, considering effects across the plant. The depth of the hazard study should reflect the hazard and the extent of the change. [6]
For a high-hazard temporary arrangement, the following are useful decision gates:
Define the change. Record what is being removed, added, bypassed or operated differently; why it is needed; and the approved operating envelope. Include physical equipment, software, procedures and staffing assumptions.
Establish the design basis. Produce the drawings and calculations needed to assess the complete system: pressure, temperature, materials, loads, supports, movement and credible abnormal conditions. Bring in the disciplines and manufacturer input the question requires.
Review the hazards. Examine startup, shutdown, loss of utilities, blocked flow, leakage, fire and failure of safeguards. Use a HAZOP or another proportionate method where appropriate, and track the actions to closure.
Verify the installation. Inspect the actual arrangement against the approved design. Resolve deviations. Record the required examinations and tests, acceptance criteria, results and competent sign-off.
Authorise restart. Confirm the operating instructions, alarms, trips, relief arrangements, isolations and essential utilities remain valid. Brief every affected shift. Make the authority to stop or refuse restart explicit.
Control its lifetime. Give the temporary change an owner, expiry date, inspection requirements and a removal or replacement plan. Extensions should trigger review rather than silently becoming the new normal.
These gates are a practical framework, not a substitute for the engineering work. A signed form without the supporting evidence can create confidence without creating control.
Look beyond the pipe
Flixborough also helped bring inherently safer design into sharper focus: reducing the quantity of hazardous material, choosing less hazardous routes where practicable, and questioning whether the hazard needs to exist at that scale.
IChemE’s retrospective describes that lasting influence. [7]
There is an organisational lesson here too. The inquiry did not find that Nypro consciously put production ahead of safety, and it explicitly declined to blame the control-room staff or the people who fabricated and installed the assembly. It identified failures in the system of design, responsibility and review. The useful response is to make sound technical decisions easier to obtain and harder to bypass, not to assume the next team will simply be more careful. [3, paras 206–210 and 225]
Five questions for the next site walk
Which temporary modifications are operating today, and can the team show their approved design basis?
Who checked the mechanical and process effects, and did they have the right competence?
What evidence demonstrates readiness for startup beyond a successful leak check?
Would a credible release threaten the control room, temporary buildings or neighbouring community?
Which arrangements have passed their expiry date, and who can require them to be removed?
If the answers depend on one person’s memory, an old email or “we have always done it this way”, that is a reason to investigate further. The condition to verify is the plant as it actually exists today.
The Safety Jon take
“It’s only temporary” tells us how long someone hopes a modification will remain. It tells us nothing about the forces it will carry or the consequences if it fails.
The molecules do not know the bypass is temporary. Pressure does not care that the drawing will be updated later. The lesson from Flixborough is to demand evidence that the changed system is fit for service before people are exposed to it and to keep that evidence valid for as long as the change remains.
Watch: the aftermath and the lasting lessons
Contemporary footage of the chemical works still burning after the explosion. This short archival film shows the aftermath; it is not footage of the initiating failure. Watch for the scale of damage and the difficulty of access for emergency response.
Expert discussion: The Legacy of Flixborough
IChemE’s 50th-anniversary discussion features Dame Judith Hackitt, Ken Rivers, Robin Turney and Ramin Abhari, moderated by Trish Kerin. Use it to extend the discussion from a failed assembly to engineering judgement, leadership and organisational learning. The presenters’ views are their own.
Sources and image credits
BARPI / ARIA: Catastrophic explosion of a cyclohexane cloud, accident 5611.
Department of Employment: The Flixborough Disaster—Report of the Court of Inquiry, HMSO, 1975. Key passages: 53–73, 206–210 and 225. Archival photographs: Plates 1, 2 and 9; page margins trimmed. Originally published under Crown copyright, 1975. Report hosted by IChemE.
J. E. S. Venart: “Flixborough: A final footnote”, Journal of Loss Prevention in the Process Industries (2007). A later interpretation of the initiating sequence.
IChemE: Lasting safety lessons as Flixborough remembered (2014).
Original explanatory diagram: Safety Jon. Videos are embedded from AP Archive and IChemE Safety Centre through YouTube, with the source links provided above.
This article is educational commentary. The practical questions are for discussion and review; engineering and statutory requirements must be established for the particular plant and jurisdiction.
Comments