The Repository Root Cause

Flixborough: The Pipe Was Strong Enough

September 20, 2026 · Runtime 16:48 · Watch on YouTube

The story everyone tells about Flixborough is a temporary pipe drawn in chalk on a workshop floor. That is in the report. So is this: the pipe was made properly and could stand pressures above the safety valve setting. What failed was two bellows loaded sideways by 38 tonnes of thrust, on a job the meeting had classed as routine plumbing.

Chapters

Transcript

The pipe did not fail 0:00

In the photograph the pipe is folded almost in half, lying on a concrete plinth, with a length of scaffold tube still across it. It is twenty inches across, and it was made in a hurry. The story everyone tells about this pipe is that the only drawing of it was done in chalk, on the floor of the workshop. That is true. It is in the report. Here is the part of the same report that nobody repeats. The men who made this pipe made it properly. The dimensions were accurate and the welding was sound. Tested afterwards, the pipe on its own stood pressures well above the setting of the safety valves. The pipe did not fail. Two parts at either end of it did, in a way that nobody had calculated, because nobody had classed what they were doing as engineering.

A rush job, and what that explains 0:51

At seven minutes to five on the afternoon of Saturday the first of June, 1974, the Nypro chemical works at Flixborough, in Lincolnshire, was destroyed by a single explosion. Twenty-eight people were killed. Eighteen of them were in the control room, and nobody in that room got out. The version that survives is a rush job. A cracked reactor lifted out, its two neighbours joined by a temporary pipe, no drawing, no calculation, no proper test, in a company whose works engineer had left and not been replaced. Every one of those things is in the Court of Inquiry's report. And if you stop there you learn nothing, because a rushed pipe that ran for two months without trouble is not a story about rushing. It is a story about what the rush was allowed to skip, and why skipping it looked reasonable to everyone in the room.

Six reactors, each fourteen inches lower 1:45

Flixborough made caprolactam, the raw material for nylon. The step that matters is the oxidation of cyclohexane, a liquid the report compares to petrol. It was done in six reactors standing in a line, each one fourteen inches lower than the one before, so that the liquid flowed from reactor to reactor by gravity. Inside them the cyclohexane sat at a hundred and fifty-five degrees Celsius and about eight point eight kilograms per square centimetre of pressure. At atmospheric pressure it would boil at eighty-one. Any escape from that system was a cloud of vapour waiting for a spark. The reactors were joined by short pipes twenty-eight inches across, and each of those pipes contained a bellows. Remember the bellows.

The crack, and the word plumbing 2:33

On the evening of the twenty-seventh of March, cyclohexane was found leaking from reactor five. The next morning the crack in its outer shell measured about six feet. A meeting was held that same morning, and the decision was to lift reactor five out, connect four straight to six, and restart. Nobody except one engineer was seriously concerned about restarting before the cause of the crack was known, or before the other five reactors were checked for the same thing. And in the Court's words, nobody appears to have appreciated that connecting reactor four to reactor six involved any major technical problem, or was anything other than a routine plumbing job. Even the fact that the inlet and the outlet were at different levels was not appreciated at the meeting. Remember that too. The word was plumbing.

Twenty inches, three lengths, two bends 3:24

The openings to be joined were twenty-eight inches across. The largest pipe on site was twenty. They checked that a twenty-inch pipe would carry the flow, and they checked that it would stand the working pressure. Both checks were for a straight pipe. But the two openings were not level with each other. One reactor sat fourteen inches lower than the other. So the pipe became a dog-leg: three lengths welded together with a bend at each end, a flange at either end bolted to the existing stub pipes, and the existing bellows left in place. No calculation was ever made for that shape, because when the calculations were done the shape was not yet known. The pipe was finished by the evening of the twenty-ninth. Reactor five came out at two in the morning of the thirtieth. By four in the morning of the first of April the plant was back on stream.

What a bellows is for 4:20

A bellows is a corrugated sleeve of thin metal built into a pipe. When the pipe heats up and grows, the bellows squeezes and the pipe does not fight its supports. That is the whole job. It takes movement along its own axis, and it is built to take nothing sideways. The British Standard said so. Piping with bellows must be guided to keep the bellows straight, and anchored so that fluid pressure cannot load them. The bellows maker said so too. Its designer's guide stated that two bellows must not be used out of line in the same pipe without adequate support. The Court called those instructions clear and explicit, with helpful diagrams. Nobody at Nypro read them. Not because they disagreed with them. Because you do not consult the British Standard for a plumbing job.

Thirty-eight tonnes, offset 5:13

Now the mechanism, and it fits on one sheet of paper. Pressure pushes on the inside of each bellows across its whole area. At working pressure, on a twenty-eight inch bellows, that push is about thirty-eight tonnes at each end of the pipe. In a straight run the two pushes cancel. In a dog-leg they are still parallel, but they are no longer in line. One sits fourteen inches above the other. Two equal forces, offset, make a turning moment, and something has to resist it. The only things available were the bellows themselves. The report puts the sideways load on each bellows at about two point eight tonnes. The load a bellows is designed for, sideways, is nothing. And the thirty-eight tonne end loads did something else on the way through: they tried to fold the pipe at its two bends. Neither of these things was calculated. Neither was appreciated.

Four scaffold poles 6:13

So what held the pipe up? Four scaffold poles. They had been put there to carry the weight of the assembly while it was bolted up, so that the bellows would not be strained by the pipe's own mass. For that, the report says, they were probably adequate. For working conditions they were wholly inadequate. Nothing held the pipe down. Nothing stopped it moving sideways. Under pressure, in the Court's phrase, the assembly was wholly unrestrained in an upward direction. One engineer had sketched proper supports, bolted to the flanges and fixed to the reactor plinth, and handed the sketch to his assistant. They were never built, and he did not insist. During the two months it ran, one witness noticed that under pressure the pipe seemed to lift slightly off its poles. Nobody thought anything was wrong.

A leak test is not a strength test 7:08

The assembly was tested. It is worth being exact about what for. It was pressurised with nitrogen to four kilograms per square centimetre and checked for leaks. A leak was found, the pipe came out, was re-welded and went back. Then to nine, and checked for leaks again. None. That was a leak test. It says nothing about strength. The British Standard required something different: a hydraulic test, with water, to one point three times the design pressure. For this system that is over eleven kilograms per square centimetre, which is above the setting of the safety valves. The Court's finding on that test is one sentence. It would almost certainly have caused failure of the pipe and bellows assembly, and the disaster would have been averted. The test that existed would have broken this pipe in the yard, with water in it, and no one hurt. It was never considered.

Two months, then June 1st 8:10

From the first of April to the twenty-ninth of May the plant ran and the pipe gave no trouble. On the twenty-ninth it was shut down for a small leak elsewhere, and in the early hours of Saturday the first of June the start-up began. Pressure rose faster than anyone expected, reaching eight point five while the first reactor was only at a hundred and ten degrees. The report never found out why. Nitrogen was short, so the plant would sit at full temperature and pressure for hours before oxidation could begin. Around midday the pressure reached nine point one or nine point two, and the technician vented it down. The Court was asked to say he had done something wrong. It refused. The safety valves were set at eleven. The afternoon shift took over at three. The instruments and the records died with them. What can be said is this. Warm-up was still going, so the pressure would rise again, and this time reactors four and six were near a hundred and fifty-five degrees, with the pipe now lagged and hot. The same pressure as the morning, at a higher temperature. Conditions, the report says, more conducive to failure than had ever occurred before, and no higher than careful operators could be expected to permit.

Squirm, then jack-knife 9:30

The investigators built the assembly again. A replica pipe with new bellows was fitted between two of the surviving reactors, on scaffold poles, heated to a hundred and fifty-five degrees and pressurised with nitrogen. At nine point eight kilograms per square centimetre the lower bellows suddenly went. Not burst. The convolutions pulled out and stayed out, a permanent distortion the engineers called squirm, and the upper bellows followed almost at once. Both bellows were ruined, the pipe was tilted, and the assembly was still gas-tight. It did not burst until fourteen point six. So a soft bellows squirms and survives. The analysis that tied all the tests together found that a stiff bellows does something worse. When it squirms, the vapour in the reactors does work on it, and that energy goes into swinging the pipe. The lower bend folds, the bellows stretch, and the two flanges are driven towards each other at something like forty miles an hour. The bellows tear off, and there are now two twenty-eight inch holes in the side of a system full of cyclohexane at a hundred and fifty-five degrees. The Court's table puts that sequence between working pressure and safety valve pressure. The one thing that decided which way this assembly would go, the stiffness of its bellows, was never measured, and can never be known.

The cloud 10:57

Cyclohexane leaving a twenty-eight inch hole at that temperature flashes to vapour as it goes. The Court found that the two openings alone could form a cloud large enough for the main explosion in less than two minutes, and that it may have found its ignition at the hydrogen plant. The blast was measured from the ionosphere, from a glider's barograph, and from the damage on the ground. The estimate is fifteen to forty-five tons of TNT. Seventy-two of the seventy-nine houses in Flixborough were damaged, and across the river in Amcotts, seventy-three of seventy-seven. The works were surrounded by fields. The report says plainly that in a populated area the toll would have been far worse.

Ten billiard balls 11:42

There was another theory, and it was not a fringe one. Advisers to Nypro and to its insurers, all highly qualified, argued that the by-pass did not fail on its own. In their version an eight-inch pipe nearby had split first, its escaping vapour had caught fire and exploded, and that smaller blast had knocked the by-pass down. The whole of it rested on two loose bolts found on a valve after the disaster, and from there it needed a chain of thirteen steps, each improbable, each depending on the last. A flame that cracked a pipe but never set off the sprinkler sensor eighteen inches away. The Court compared it to balancing billiard balls one on top of another. Two can just be done. Ten is the word impossible. The by-pass failed in one stage, by itself.

Nobody who could see it 12:34

So who should have caught it? The works engineer, a chartered mechanical engineer, had left the company early in 1974. He had not been replaced. The man co-ordinating the engineering department in the meantime was the services engineer, an electrical man. The Court said plainly that he was not qualified for it and should not have been asked. The managing director and the general works manager were both chemical engineers, with no mechanical engineering training. The Court's sentence about all of them is this. None of the senior personnel were capable of recognising the existence of what is in essence a simple engineering problem, let alone solving it. An outside engineer from the Coal Board was on call. He was never asked, and he told the Court he would have stopped the restart. And the report absolves everyone of knowingly taking a risk. What it finds is that the wish to get back into production made the problem invisible.

What the label decided 13:35

Here is the root cause, and it is a word. The job was classed as plumbing. Once it was plumbing, everything else followed without anyone deciding it. A plumbing job does not get a design calculation. It does not get the British Standard opened. It does not get the manufacturer's guide read. It does not get permanent supports, and it does not get a strength test. Each of those absences was found by the Court, and not one of them was a choice. They were the ordinary consequences of the category. And the law had the same category. Regulations existed for modifying a steam boiler. They did not apply to a pressure system full of cyclohexane. The rule sorted by what was inside the vessel, not by what the vessel could do. The Court's first recommendation is one line, and the industry has spent fifty years building a discipline around it. Any modification should be designed, constructed, tested and maintained to the same standards as the original plant.

What changed 14:42

The rest of the recommendations read like the episode in reverse. Any significant modification to a pressure system holding hazardous material to be inspected and tested by a recognised competent person before it goes back into use. The hydraulic test made obligatory, and the standard's wording clarified so that the test pressure is always above the safety valve setting. A plant whose safety depends on nitrogen to hold enough nitrogen for every contingency. Vital plant data recorded in a form that survives fire and explosion, like an aircraft's black box. And a committee, already announced on the day the Court was appointed, to look at where such plants are sited, where their control rooms stand, and what protects the people inside them.

Four cases, one shape 15:29

Four cases now, and the same shape in each. A cracked flange with no category to be reported under. A bracket with no category to be analysed under. Three defences that were hardware and never became procedure. And here, a modification with no category at all, filed under plumbing, so that the calculation, the standard, the guide, the supports and the test all vanished together, without a single decision to skip any of them. The pipe was strong. The welds were good. The operators did nothing wrong. What failed was the label on the job. Next case stays in the North Sea. The sixth of July, 1988. An oil platform called Piper Alpha, a hundred and twenty miles off Aberdeen. On the day shift, a pressure safety valve is taken off a condensate pump for recertification, and the open pipe is closed with a metal disc, hand-tightened. The permit that recorded it did not reach the night shift. At ten that evening, the other pump tripped, and they started this one. A hundred and sixty-seven men were killed. The public inquiry took thirteen months.

Description and sources

At 16:53 on Saturday June 1st, 1974, the Nypro works at Flixborough, Lincolnshire, was destroyed by the explosion of a cyclohexane vapour cloud estimated at 15 to 45 tons of TNT. Twenty-eight people were killed, eighteen of them in the control room, from which no one escaped.

Two months earlier a six-foot crack had been found in reactor five, one of six reactors oxidising cyclohexane at 155 C and 8.8 kg/cm2. A meeting decided to lift it out, join reactors four and six with a temporary by-pass, and restart. The Court of Inquiry found that nobody at that meeting appreciated that the connection was anything other than a routine plumbing job. The largest pipe on site was 20 inches, and because one reactor sat 14 inches lower the pipe became a dog-leg between the existing 28-inch bellows.

The pipe was calculated for flow and pressure as a straight pipe, and properly made. What was never calculated was the assembly: pressure on each bellows produced about 38 tonnes of thrust at each end; offset in a dog-leg, the two forces made a turning moment resisted by roughly 2.8 tonnes of shear on each bellows, a part designed to carry none. The British Standard and the bellows maker's guide required support; neither was consulted. The assembly rested on four scaffold poles and was leak-tested to 9 kg/cm2, never strength-tested. The hydraulic test the standard required, at over 11 kg/cm2, would almost certainly have caused failure of the assembly and the disaster would have been averted. The Court's first recommendation: any modification is to be designed, constructed, tested and maintained to the same standards as the original plant.

PRINT-READY, FROM THIS CHANNEL

The Failure Atlas, Vol. 01 — Tacoma Narrows · Citicorp Center · Millennium Bridge · Apollo 13 · the 2003 blackout · Hyatt Regency

https://therepository.gumroad.com/l/failure-atlas

PRIMARY SOURCES

The Flixborough Disaster: Report of the Court of Inquiry, Department of Employment, HMSO, London, 1975. Read in full: https://www.icheme.org/media/17752/the-flixborough-disaster-report-of-the-court-of-inquiry.pdf
Plates 7-11 and 14 and Figs. 1-4 and 6 are reproduced from that report (Crown copyright 1975, expired after 50 years: CDPA 1988, Sch. 1 para 41).

ARCHIVE PHOTOGRAPHS — the real structure, with title, author, date, archive and licence. All public-domain.

Plate 9 — HMFI / SMRE | Court of Inquiry report, HMSO 1975 | Public domain
Plate 10 — HMFI / SMRE | Court of Inquiry report, HMSO 1975 | Public domain
Fig. 4 — Court of Inquiry | Court of Inquiry report, HMSO 1975 | Public domain
Fig. 1 — Court of Inquiry | Court of Inquiry report, HMSO 1975 | Public domain
Plate 8 — HMFI / SMRE | Court of Inquiry report, HMSO 1975 | Public domain
Fig. 2 — Court of Inquiry | Court of Inquiry report, HMSO 1975 | Public domain
Plate 7 — HMFI / SMRE | Court of Inquiry report, HMSO 1975 | Public domain
Fig. 3 — Court of Inquiry | Court of Inquiry report, HMSO 1975 | Public domain
Fig. 6 — Court of Inquiry | Court of Inquiry report, HMSO 1975 | Public domain
Plate 11 — Safety in Mines Research Establishment | Court of Inquiry report, HMSO 1975 | Public domain
Plate 14 — HMFI / SMRE | Court of Inquiry report, HMSO 1975 | Public domain

The 29 technical plates in this video are illustrations generated for the channel by a diffusion image model, styled to match its cyanotype identity. They are diagrams of the system — the photographs above are the archive, the drawings are ours, not photographs of the hardware, and no person is depicted in any of them.

Root Cause investigates why engineered systems fail, using official investigation reports and primary technical literature. Sources for this episode are linked above.

Charts and dimensioned comparisons are drawn from the sources listed above; photographs and figures of the Flixborough plant are reproduced from the Court of Inquiry's report, credited on screen and above.

#engineering #processsafety #rootcause