The Operator Esso Named

After two men died at the Esso gas plant at Longford, the company did something at the royal commission that I still think about. It named one of its own control-room operators, a man named Jim Ward, and handed up his training records to argue he should have stopped this. Two deaths answered with one worker's paperwork.

Here is what that paperwork could never have shown.

Longford is a gas plant in the state of Victoria, in southeastern Australia. It cleaned raw gas piped in from fields under the Bass Strait, the stretch of ocean off the coast, and it supplied most of the natural gas for the whole state, the city of Melbourne and millions of people.

One of its processing units, Gas Plant 1, ran a warm circulating stream called lean oil through a bank of heat exchangers to pull the heavier components out of the gas. The one to watch is a heat exchanger called GP905. The lean oil did a quiet second job nobody was thinking about. As long as it kept flowing, it kept the steel of that exchanger warm and ductile, behaving the way carbon steel is supposed to behave.

Carbon steel has a trap, though. Take it cold enough and it stops stretching under load and starts breaking like glass. Every operator on that unit needed to know where that line was. Almost none of them did.

On the morning of September 25, 1998, a slug of liquid carried over from the gas fields and tripped the pump feeding warm lean oil to GP905. For about four hours the warm flow was gone while cold liquid kept moving through the exchanger. This caused the metal to drop to around 54 degrees below zero, colder than anything the vessel was intended to handle.

The warning was there for anyone to see. A tower on that unit that should have been too hot to touch had iced over.

At 12:26 in the afternoon, working to bring the unit back, they restarted the pump and sent roughly 445 degree oil back into GP905, the heat exchanger that had been chilled brittle. It did not leak. It broke, a full brittle fracture of the vessel, and released a cloud of hydrocarbons that found an ignition source. Two men were killed and eight were injured. Longford supplied most of the natural gas for the state of Victoria, and that supply went down. It was not fully restored until October 14. For nineteen days, about 1.3 million households and 89,000 businesses were left without gas.

Esso's version was clean, and it was useful. The unit was allowed to get cold, the operators put hot oil back in, the metal failed. The last hands on the equipment were theirs. Name the operator, produce his file, close the case.

The surface facts cooperate, and that is what makes the easy story dangerous. The restart did trigger the rupture. But if you stop at the last person who touched something, you will always find an operator, because an operator is always the last person who touched the equipment. That is where the hands are. It is not where the cause is.

Three things were already true before the crew restarted that pump.

First, the knowledge was not in the building. Nobody on that shift, not Ward and not the two men who died, had been trained that cold steel could shatter the way it did. Cold embrittlement was not in their procedures, and it was not understood by their managers either. In the early 1990s Esso had closed its engineering office near the plant and moved its engineers to Melbourne, the state capital, about 125 miles away. The people who understood the metallurgy no longer worked where the metal was.

Second, the safeguard that exists to catch this kind of hazard was never run. A hazard and operability study, called a HAZOP, is a structured review where a team walks through what happens when something changes, like a flow stopping. On Gas Plant 1 it was put off again and again and never done. The hazard was findable. The tool that finds it sat on the calendar.

Third, and this is the one that should sit with you, the plant had already been warned. On August 28, 1998, less than a month before, the same loss of lean oil flow happened. It was not reported the way it should have been. The royal commission found that had it been reported, the danger of equipment reaching dangerously low temperatures on a loss of lean oil flow would in all probability have become known. The warning came and the system that was supposed to catch it let it pass. Then on the morning itself came the ice on a tower that should have been hot to the touch, the accident in miniature, hours ahead, and nobody had been given a way to read it.

This is the part worth stealing, because the commission did not use anything you do not already have at your own site. Take one tool you would reach for in any investigation, a plain Five Whys, and refuse to stop drilling down at the operator.

Why did two men die? A pressure vessel, GP905, broke and released gas that found an ignition source.

Why did GP905 break? Its steel had gone cold and brittle, and hot oil was pumped into it. Brittle steel breaks instead of stretching.

Why was the steel cold and brittle? The warm lean oil flow that kept it warm had been lost for about four hours, and the metal chilled far below its safe range.

Why did the crew put hot oil back into steel that cold? Because they did not know the cold had turned it deadly. It was not in their training or their procedures.

Why was it not in their training or procedures? Because the hazard had never been identified. The HAZOP that would have caught it was never done, and the engineers who understood the metallurgy had been moved to Melbourne years before.

Now read it backwards and say therefore instead of why. The engineers were moved off site and the HAZOP was never done, therefore the hazard was never identified, therefore it never reached the crew's training or procedures, therefore they did not know the cold had turned the steel deadly, therefore they put hot oil back into it, and therefore the vessel broke and two men died. It tracks. And every therefore lands on a decision made above the control room, not in it.

That is the whole discipline, and it does not take a fancy tool. When the chain lands on a person, ask why that person did not know, and keep asking until the answer stops being about them. It almost always ends somewhere quieter than the control room.

Almost every plant has made a version of the move Esso made, pulling technical people off the site to save money. You centralize engineering, you thin the technical depth on site, you tell operators to call someone if it feels wrong, and on paper nothing changed because no equipment moved. What changed is who in the building understands the hazard at 2 a.m. when it starts to show.

The comfortable question after a failure is whether the operator made the right call. The real one is whether you ever gave them what they would need to make it. If the only people who understood the failure mechanism were reorganized off the site years ago, and the review that would have identified the hazard never ran, then the operator was set up to fail before their shift started. Naming them is not an investigation. It is a way of avoiding one.

Esso named the operator. The commission named the company. The distance between those two sentences is the distance between closing a file and preventing the next one. You do not need a better operator on shift. You need the person who understood the metal still in the building, or what they knew built into the training so it never leaves.

What incident do you think most people still remember by the wrong cause? Name it below, I read every one.