Esso Longford: They Fixed the Wrong Exchanger

Chapters

1. 0:00 A very cold exchanger
2. 0:32 The story everyone tells
3. 1:04 How the plant actually works
4. 1:43 How the oil stopped moving
5. 2:17 Minus forty-eight
6. 2:53 The exchanger everyone watched
7. 3:22 The end tears open
8. 3:53 Slow crack, fast fracture
9. 4:26 The cloud finds the heaters
10. 5:03 Two and a half days to isolate
11. 5:39 What no program ever covered
12. 6:12 Two hundred years, and no one knew
13. 6:44 The study that stayed budgeted
14. 7:15 No engineers on site
15. 7:47 The warning four weeks earlier
16. 8:16 What actually needed fixing

Transcript

A very cold exchanger 0:00

On the morning of September 25th, 1998, inside a gas plant in Gippsland, Australia, one heat exchanger got very cold. Simulations later put the temperature at minus forty-eight degrees Celsius, in a piece of equipment never meant to see anything close to that. Nobody in the control room thought that number was dangerous, because nobody had ever been told it could be. By early afternoon, two workers were dead, eight more injured, and the whole state was running out of gas.

The story everyone tells 0:32

The story that spread afterward is the story that always spreads: an old plant, corners cut, an explosion waiting to happen. Gas Plant One had been running since 1969, the oldest of three on the site -- and old plants failing writes its own headline. The Royal Commission that investigated read it differently. The steel did exactly what steel does at that temperature. What failed was something nobody could see: a piece of knowledge that had simply never been written down.

How the plant actually works 1:04

Here is what the plant actually does. Chilled natural gas enters a set of vessels called Absorbers, where a stream of lean oil, at about minus twenty Celsius, pulls the heavier components out of it. The oil that has done its job is called rich oil, and it rises into a fractionating tower, reboiled by an exchanger named G-P-nine-oh-five. Downstream of that tower, a second exchanger, G-P-nine-twenty-two, does further heating before the oil, now lean again, returns to the Absorbers in a closed loop. Both of those exchangers were about to become the two most important objects in this story.

How the oil stopped moving 1:43

It starts with a disturbance in that fractionating tower. Liquid carries over into a line meant only for vapour, and ends up at the discharge of a set of pumps. That raises the level in a holding tank downstream. A level controller reads the rise and closes a valve regulating flow from those pumps. Reduced flow trips a low-flow shutdown, built to protect the pumps from running dry. The pumps shut down. The oil that was supposed to be circulating through the whole loop had simply stopped moving.

Minus forty-eight 2:17

With lean oil no longer flowing, condensate still coming down from the Absorbers kept flashing to lower and lower pressure, and lower and lower temperature, with nothing left to warm it. The plant's own simulation, run afterward, shows that section reaching minus forty-eight degrees Celsius -- against an absorber that runs, normally, at about minus twenty. Ice began forming on the uninsulated metal outside both exchangers, and on the pipework running to and from them. Shortly after eleven that morning, the decision was made to shut the plant down.

The exchanger everyone watched 2:53

The exchanger everyone in the control room was actually looking at that morning was not the one going dangerously cold. It was G-P-nine-twenty-two, further downstream -- and it was leaking. To try and stop that leak, the decision was made to reintroduce lean oil flow into it. Hot oil, sent back into a system that had just spent hours getting extremely cold. The fix everyone was watching was aimed at the exchanger with the visible problem.

The end tears open 3:22

The hot oil moved through the system, and reached G-P-nine-oh-five first -- the reboiler nobody was watching, because it wasn't leaking, it was only getting colder. Its steel shell had already been embrittled by the cold. When the hot oil hit it, the tubesheet inside expanded outward, adding a stress the metal could no longer absorb. The end of the vessel tore open -- essentially the entire end, releasing everything inside it, and everything connected to it, in one motion.

Slow crack, fast fracture 3:53

The metallurgical report that followed is precise about what kind of failure this was. The fracture surface shows a crack that propagated slowly while it was still inside the weld. Then it stopped being slow. The finding: fast brittle fracture. Not a slow leak, not a gradual failure -- steel that had lost, at that temperature, its ability to bend instead of shatter. A vapour cloud came out of that tear, and began drifting toward the one part of the plant that could set it alight.

The cloud finds the heaters 4:26

The cloud drifted south-southeast, toward a bank of gas-fired heaters about a hundred and seventy metres away -- thirty to sixty seconds of drift, at most. It ignited when its leading edge reached them, at twelve twenty-six. The flame front then travelled back along its own path, to the source, and settled into a sustained fire beneath a pipe-rack junction the crews nicknamed King's Cross. Over the next half hour, flames on that junction triggered three more sudden releases of flammable inventory -- reported as explosions, more precisely fireballs from ruptured pipe.

Two and a half days to isolate 5:03

Here is a second gap the fire exposed. The plant's emergency shutdown system was built only to isolate the site from the offshore pipelines feeding it -- not to isolate anything inside the plant itself. A risk assessment in 1994 had already flagged that weakness. Nothing changed. When a fire officer asked for a plan of the site's piping to guide the isolation, he was told none reliably existed -- the plant had been modified too many times. Fully isolating the fuel took almost two and a half days.

What no program ever covered 5:39

So why didn't anyone in that control room know the cold itself was the danger? This is where the Commission's own words matter more than any summary of them. “At no relevant time did any programme include training with respect to the hazards associated with the loss of lean oil flow... the critical operating temperatures for G-P-nine-twenty-two and G-P-nine-oh-five, [or] the circumstances in which brittle fracture might occur.” Not a gap in one operator's memory. A gap in what the plant had ever told any of them.

Two hundred years, and no one knew 6:12

The Commission counted the experience in that room the morning of the accident: more than two hundred years, combined, working at that plant. And still, in its own words, “no one recognised the hazards associated with the plant conditions which culminated in the explosion and fire.” The plant's own operations manager said afterward that he had no idea, before that day, that this could happen at all. Losing lean oil flow, for any length of time, had never been flagged to him as a danger.

The study that stayed budgeted 6:44

There was a process meant to catch exactly this. A hazard and operability study -- a HAZOP -- for Gas Plant One had been budgeted every year from 1995 through 1998. It never happened. No satisfactory reason was ever given for why it kept being deferred. The Commission's verdict: “it is inconceivable that a HAZOP study of G-P-one would not have revealed factors which contributed to the accident” -- including the exact hazard that killed two people that day.

No engineers on site 7:15

Until 1991, the plant's engineers worked on site, daily. In 1992, as part of a company restructuring, all of them were moved to an office in Melbourne, hours away. Operations knowledge stayed local. Materials and process engineering expertise did not. The Commission's conclusion is blunt: “there were no experienced engineers on site at the time of the accident.” Nobody in the room that morning had the training to read what the cold meant.

The warning four weeks earlier 7:47

Four weeks earlier, on the 28th of August, 1998, an unrelated incident at the same plant showed many of the same characteristics as this loss of lean oil circulation. It was never investigated, and never reported the way it should have been. Had it been, the Commission found, the danger of equipment reaching dangerously low temperatures -- and the steps available to avoid it -- would, in all probability, already have been known.

What actually needed fixing 8:16

Two people died. Eight were injured. A state went weeks without gas in its homes. Esso was later convicted on eleven counts and fined a record two million dollars. None of it came from a part that couldn't handle its job. It came from two hundred years of experience in one room that had never been told what it needed to know. Next case leaves the ground entirely. A passenger jet in 1989, coming down over a motorway, on an engine that was still running fine -- because the crew had just shut down the wrong one, and the instruments in front of them had never been built to make that mistake obvious.

Description and sources

Gas Plant One at Esso's Longford site in Gippsland, Australia, had run since 1969. Chilled natural gas entered a set of Absorbers, where lean oil at about -20C pulled the heavier components out of it; the saturated oil, now rich oil, rose into a fractionating tower reboiled by an exchanger named GP905, then passed through a second exchanger, GP922, before returning to the loop.

A disturbance in the tower carried liquid into a line meant only for vapour. The rise in tank level that followed closed a valve, which tripped a low-flow shutdown built to protect a set of pumps -- and lean oil circulation stopped. With nothing left to warm it, condensate kept flashing to lower temperature; simulation put it at -48C. Ice formed on both exchangers, and shortly after 11:00 the plant was shut down.

GP922 was leaking, separately and visibly. To stop it, hot lean oil was reintroduced into the system. It reached GP905 first -- the exchanger nobody was watching, only getting colder. Its steel had already been embrittled by the cold; the hot oil added a stress it could no longer absorb, and the vessel's end tore open in fast brittle fracture.

The vapour cloud drifted toward fired heaters roughly 170 metres away and ignited within a minute. Flame travelled back to the source, settling beneath a pipe-rack junction crews called King's Cross, and triggered three further fireball releases over the next half hour. The plant's shutdown system could isolate it from offshore pipelines, but not from itself -- flagged by a 1994 risk assessment and never fixed. Fully isolating the fuel took almost two and a half days.

The Royal Commission's finding was not about the metal. No training program had ever covered the hazard of losing lean oil flow or the conditions for brittle fracture. More than two hundred years of combined experience were in that room, and no one recognised the hazard. A HAZOP study had been budgeted every year since 1995 and never carried out. Engineers had been moved to Melbourne in 1992, and none with the right expertise were on site that day. A near-identical incident four weeks earlier had gone uninvestigated.

PRINT-READY, FROM THIS CHANNEL

The Failure Atlas, Vol. 01 — Tacoma Narrows · Citicorp Center · Millennium Bridge · Apollo 13 · the 2003 blackout · Hyatt Regency

https://therepository.gumroad.com/l/failure-atlas

PRIMARY SOURCES

• Hutchison, R. B., Boult, D. M., Pitblado, R. M. & Kenny, G. D. (Det Norske Veritas, technical adviser to the Royal Commission), "Lessons from the Longford Gas Explosion and Fire" -- read in full, direct quotations from the Commission's own report are marked in the source as italic text.
• Government of Victoria (1999), The Esso Longford Gas Plant Accident: Report of the Longford Royal Commission (Dawson & Brooks), Government Printer, State of Victoria.
• 1998 Esso Longford fire: https://en.wikipedia.org/wiki/1998_Esso_Longford_fire
• Oil & Gas Journal, "Commission blames Esso for Longford disaster": https://www.ogj.com/home/article/17230804/commission-blames-esso-for-longford-disaster

The 12 technical plates in this video are illustrations generated for the channel by a diffusion image model, styled to match its cyanotype identity. They are diagrams of the system, not photographs of the hardware, and no person is depicted in any of them.

Root Cause investigates why engineered systems fail, using official investigation findings and primary technical literature. Sources for this episode are linked above.

This episode uses no archival photography: no image of the Longford plant or its equipment was found under an accepted licence. Every plate is a synthetic cyanotype drawing, generated for this episode and declared as such by its own style -- no archival claim is made.

#engineering #processsafety #rootcause