San Juanico disaster

San Juanico disaster

The PEMEX terminal after the accident, with the two surviving LPG spheres. In the foreground, part of the totally destroyed housing area.
San Juanico Toluca Mexico City class=notpageimage| Location of San Juan Ixhuatepec in the State of Mexico
Date	19 November 1984 (1984-11-19)
Venue	Pemex LPG storage plant in San Juan Ixhuatepec
Location	Tlalnepantla de Baz municipality, State of Mexico, Mexico
Type	Multiple boiling liquid expanding vapor explosions
Deaths	500+
Non-fatal injuries	5000–7000

The San Juanico disaster involved a series of fires and explosions at a liquefied petroleum gas (LPG) tank farm in the settlement of San Juan Ixhuatepec (popularly known as San Juanico), a municipality of Tlalnepantla de Baz, State of Mexico, Mexico, on 19 November 1984. The facility and the settlement, part of Greater Mexico City, were devastated, with 500–600 victims killed, and 5000–7000 suffering severe burns. It is one of the deadliest industrial disasters in world history, and the deadliest industrial accident involving fires and/or explosions from hazardous materials in a process or storage plant since the Oppau explosion in 1921.

Background

Liquefied gas Horton tanks similar to the six spherical tanks involved in the San Juanico disaster

LPG bullet tanks. There were 48 tanks of this type in the Pemex plant. Note how this modern installation incorporates some of the lessons learned from San Juanico: an uncongested, well ventilated area, with the horizontal tanks in a parallel cluster configuration, which minimizes the effects of missiles arising from BLEVEs.

The incident took place at a storage and distribution terminal for liquified petroleum gas (LPG) belonging to the state-owned oil company Pemex. The facility consisted of 54 LPG storage tanks: six large spherical tanks, of which four had a capacity of 1,600 cubic metres (57,000 cu ft) and two with capacity of 2,400 cubic metres (85,000 cu ft), as well as 48 smaller horizontal bullet-shaped tanks of various sizes, for a total plant capacity of 16,000 cubic metres (570,000 cu ft), representing one third of Mexico City's entire liquid petroleum gas supply. Contrary to good practice, the sphere support legs were not fireproofed. Tanks were divided into several clusters by concrete walls about 1 metre (3.3 ft) tall. It received LPG through three underground pipelines from remote sites: a 12-inch (305 mm) pipeline from Minatitlán (576 km; 358 mi), a 4-inch (102 mm) pipeline from Poza Rica (235 km; 146 mi) and another 4-inch (102 mm) line from the Azcapotzalco refinery (8 km; 5 mi).

There were two ground flare pits and a fire protection system including a pond, fire pumps and firewater spray distribution. The plant was said to have been built in conformance to API standards, but this was later put into question. In the two months leading up to the incident, local plant safety committee inspections revealed that: 30–40% of safety devices (including firewater spray) were bypassed or non-operational; housekeeping was substandard; pressure gauges were in bad shape and inaccurate; a relief valve on an LPG-receiving manifold was missing; an additional relief valve was needed for the Minatitlán pipeline, after operational flowrate had been increased to 11,900 cubic meters/day (75,000 barrels/day).

Adjoining the terminal to the east, there was a Unigas plant with further LPG storage and distribution capacity. Immediately further east was a Gasomático facility for bottling the LPG and dispatch it by truck. The Pemex terminal distributed LPG to these two plants via underground pipelines. Further away from this cluster, five more gas distribution companies imported gas from the Pemex terminal using tank trucks and bottles.

The town of San Juanico surrounded the site and consisted of 40,000 residents, with an additional 60,000 more living in nearby communities. The settlement of San Juan Ixhuatepec long predated the disaster, but housing surrounding the facility itself began to materialize only after the construction of the installation started in 1962, although this is disputed. However, at least the two largest spheres were added to the plant only recently, when the plant was already surrounded by the densely populated neighborhood. The closest houses were at a distance of 130 metres (430 ft) from the storage tanks. Most of the houses were simple brick or wooden buildings.

Fire and explosions

In the early hours of 19 November 1984, the plant was being filled from a refinery 400 kilometres (250 miles) away. At that moment, two of the spheres and the 48 cylindrical vessels were filled at 90% of their capacity and the rest of the spheres at 50%. Overall, the plant held about 11,000–12,000 cubic metres (390,000–420,000 cu ft) of LPG, i.e., in excess of 300 TJ of energy equivalent or roughly five times the energy released by the atomic bomb of Hiroshima. Shortly before 5:40 a.m., the control room operators and those at the pipeline pumping station, sited 40 kilometres (25 miles) away, noticed a decrease in pressure. A pipe between a sphere and the cylinders had ruptured, resulting in a continuous release of LPG. For 5–10 minutes, with the cause of the leak not identified, the resulting gas cloud built up, reaching an estimated size of 200 × 150 × 2 metres (660 × 490 × 7 ft). The cloud eventually reached one of the waste-gas flare pits at 5:45 a.m, and ignited.

A flash fire ensued, which immediately transitioned to a violent vapor cloud explosion (VCE), likely due to its flame front acceleration being enhanced by the especially congested geometry of the plant. The blast (like the ensuing boiling liquid expanding vapor explosions (BLEVEs)) was felt and recorded by a seismometer at a National Autonomous University of Mexico lab located some 32 km (20 mi) away in Mexico City. In a textbook case of the domino effect accident, the explosion damaged further piping and storage tanks, which resulted in a massive conflagration fed by multiple LPG leaks.

About 90 seconds after the VCE blast, the first tank BLEVE occurred. The explosion was witnessed by the pilot of a Pan Am flight on approach to the airport, who communicated to air traffic control that he believed a nuclear bomb may have exploded in the city. Eight separate BLEVEs were recorded by the seismometer, with the last one at 7:01 a.m. The first and sixth registered the highest strength, at 0.5 on the Richter scale. The BLEVE fireballs were up to 300 metres (980 ft) in diameter, and they had a duration of some 20 seconds. Smaller explosions continued until 11 a.m., while the flames on the last large sphere was extinguished at 11 p.m.

The four smaller spheres were completely destroyed, with fragments propelled around the plant, some at a distance of 350 metres (1,150 ft) in public areas. The larger spheres collapsed to the ground, with their legs buckled due to the heat radiation they received. Only four of the bullet tanks survived. Twelve of those that failed were launched from their supports with the furthest landing at 1,200 metres (3,900 ft). Missile fragments ejected weighed up to 30 tons. Gas explosions also occurred inside the plant buildings and the surrounding houses. At the Gasomático site, 100 parked trucks loaded with LPG household cylinders weighing 20–40 kilograms (44–88 lb) were completely burned out and hundreds of secondary explosions took place.

An area of a few square kilometers was affected, with varying degrees of damage from the fires and the missiles. Around 150 homes were estimated completely destroyed, with a few hundred sustaining lesser damage. It is estimated that the thermal radiation produced by the BLEVEs was in excess of the threshold of pain (4.0 kW/m²) within a radius of 1,850 metres (1.15 mi).

Five plant workers perished, but the majority of the victims died in the housing area surrounding the plant, mostly within 300 metres (980 ft) of the centre of the storage area. Most of the casualties were surprised in their sleep. The disaster resulted in 500 to 600 deaths, and 5000–7000 severe injuries. Radiant heat generated by the fire incinerated most corpses to ashes, with only 2% of the recovered remains left in recognizable condition.

Emergency response

The first call to the emergency services was made at 5:45. More than 200 firemen were deployed to the affected area in the six hours after the first explosion. Fire-fighting water was provided to the site by tank trucks normally used for domestic potable water distribution. A major rescue operation mounted, which reached its climax between 8:00 a.m. and 10:00 a.m. Around 4000 people participated in rescue and medical activities, including 985 medics, 1780 paramedics, and 1332 volunteers. 363 ambulances and five helicopters were involved. After the last BLEVE, the firemen kept cooling the two larger, unexploded spheres. While this was undoubtedly an act of bravery, they were exposing themselves to further potential BLEVEs that would have surely killed them. The metro system and public buses were commandeered to transport the wounded to hospitals and the evacuees to evacuation centers. 200,000 people were evacuated from the area.

Investigation

Initially, director-general of Pemex Mario Ramón Beteta and government officials attempted to shift the responsibility for the accident onto the gas-distributing businesses adjoining the terminal. No results from a public inquiry or a Pemex investigation have ever been made available, except for a declaration of the Attorney General released on 22 December 1984, which pointed to the gas escape having occurred at the row of bullet tanks next to the spheres. In this press release, it was also stated that the responsibilities were not to be sought in the lack of plant maintenance. The Attorney found Pemex ultimately responsible for the disaster and summoned the company to provide to the government funds necessary for the indemnifications.

On TNO's initiative and through mediation of the local Netherlands embassy, a Dutch team reached the accident site two weeks after the facts. This investigation was not instigated by the Mexican authorities or Pemex, but rather was a scientific mission whose purpose was testing physical models used in safety studies for the prediction of damage from industrial explosions, and examining the emergency response to the accident. The investigation was also participated by the Mexican Petroleum Institute (IMP). IMP stated that the cause of the accident was already known, pointing to a disgruntled employee that had allegedly sabotaged the plant. They also added that further investigation would not necessarily be useful.

The TNO report was issued in May 1985. Although the Dutch team did not primarily focus on the causes of the accident, the final report hypothesizes that the initial leak may have been caused by overpressure and rupture of a pipe to one of the cylindrical vessels (possibly due to the high discharge pressure (> 60 bars (870 psi)) of a booster pump in one of the underground pipelines), likely combined with a tank overfill and the consequent opening of a tank relief valve discharging to atmosphere. The report also stresses how it was the fires that brought about most of the destruction, with blast overpressures playing only a secondary role. It further calls attention to the congested plant layout as a factor that greatly contributed to the rapid escalation of the accident, and to the fact that poor land-use planning led to housing built within the credible damage radius from accidents originating from the plant. It also commends the work of the emergency services.

An informal investigation was conducted by the U.S. Department of Transportation, which corroborated the TNO's findings on the cause of the accident, additionally pointing out that the overpressure should have been prevented by relief valves placed on the receiving pipelines, but these had not been installed. Their report also called attention to an earlier statement by Pemex that the pipelines were not isolated, with LPG being pumped into the terminal at the usual rate until 6:40 a.m., long after the onset of the accident. This further aggravated the fire, with an estimated additional fuel inventory of roughly 500 cubic meters (18,000 cu ft). The USDOT concluded that the main causal factors were "the human element, maintenance problems, and inadequate relief capacity and pressure control." They also identified two more contributing factors: multiple tanks being lined up (i.e., not isolated from) a common header, which increased the effectiveness of the chain reaction; and the failure of piping underneath the spheres as a consequence of the initial vapor cloud explosion, which meant that the consequent tank heating ultimately escalated to the BLEVEs.

A team from KAMEDO (Katastrofmedicinska organisationskommittén, or Disaster Medicine Organization Committee) of the Swedish National Defence Research Institute were sent to Mexico for an ex-post evaluation of the medical emergency management. Members of the team were experienced in BLEVE accidents, having already conducted a similar onsite inquiry in the aftermath of the Los Alfaques disaster of 1978. They found that the response in treating the burns of the injured from San Juanico had been effective and supported by considerable local medical resources and experience.

Aftermath

"SHOCK": The November 21 cover of La Prensa

President of Mexico Miguel de la Madrid and other high-ranking government officials drew criticism for not attending either the funeral ceremony or the mass burial of 272 of the victims. Some sources point to Pemex officials and public authorities potentially hampering the relief and investigation efforts. The parish priest of San Juan Ixhuatepec may have been removed to elsewhere in the State of Mexico by church authorities, after complaining that much of the financial aid allocated to the affected families was quickly disappearing. In a speech in Guadalajara, head of Pemex Mario Ramón Beteta likened criticism directed at the company to cannibalism, declaring that Pemex's tax money was key in keeping Mexico afloat. Barely six weeks after the events, with no official investigation results, the government started payment of indemnifications to those affected by the disaster. Loss of life was indemnified "at a flat rate", without considering the different ages, family situations and employment conditions. Indemnification amounted to US$10,400 per fatality. The state of Mexico gave 167 families new homes in the complex of Valle de Anáhuac, each being valued at around US$8,000. A park was quickly built south of the accident site, where most of the destroyed houses used to be.

The disaster was detrimental to the ruling Institutional Revolutionary Party (PRI), as – official reports notwithstanding – inadequately maintained Pemex infrastructure was generally seen as responsible for the explosions, which were soon overshadowed by the 1985 Mexico City earthquake. In the years following the accident, the government's actions (or lack thereof) were criticized in several respects. For example, concerns were raised on the uncontrolled growth of the housing areas immediately adjoining the LPG terminal, which was against the Ley del petróleo (Petroleum Act), establishing minimum safety distances and mandating approvals from the Secretariat of Health and Assistance. While the government made an official communication to the effect that all gas plants in San Juan Ixhuatepec should be shut down, as of 2020 six out of twelve were still in operation.

Although the accident became well known worldwide in the technical domain of process safety, it had relatively little mainstream resonance outside of Mexico (e.g., as opposed to the Bhopal tragedy, which followed it by merely two weeks), likely due to the fact that no non-Mexican companies were involved.

Legacy in process safety

San Juanico had a notable impact on process safety. TNO's contributions were used by the American Petroleum Institute to support their standards on Design and Construction of LPG Installations and fire protection of the same. Some of the lessons learned, or in certain cases re-learned, were:

• It appears that the San Juanico plant was not formally reviewed by hazard and operability analysis (HAZOP). Failure to HAZOP the design probably caused the design flaw that, upon tank overfilling, allowed the booster pump to pressurize the tanks being filled, which was not fitted with a relief capacity able to cope with the incoming liquid pressure. Additionally, and for the same lack of design safety analysis, an automatic tank overfill protection was probably lacking, which meant the incoming flow was not automatically stopped upon the level reaching a preset high value. These arrangements, as well as a thorough plant HAZOP and a functional safety review to allocate sufficient safety integrity levels (SIL) to critical instrumentation and actuated valves, are a must nowadays.
• Gas plant layout design should be based on inherent safety principles to minimize escalation effects:
  • A significant factor was the tight clustering of the tanks, especially the horizontal ones. This contributed to concentrate the gas cloud and, once ignition took place, to accelerate the flame front of the initial flash fire, resulting in a violent vapor cloud explosion that caused multiple pipes to fail, which ultimately led to the conflagration that heated the tanks until they BLEVE'd. API 2510 now incorporates a requirement to limit the grouping of tanks to six per cluster. Further, in order to minimize the chance of escalation due to fragments, the horizontal tanks longitudinal axis should not be in the way of sensitive targets (such as other tanks). In San Juanico, the horizontal tanks were grouped in such a way that, upon BLEVE, fragments hit other tanks placed directly in the line of fire.
  • The layout congestion, caused by tight tank clustering, was exacerbated by the relatively high (1 meter; 3.3 ft) bund walls, which also contributed to limiting the dispersion of the gas cloud and the acceleration of the flame front. This lesson was implemented in the API Standard 2510, which states that an open area around the tanks is required, with a slope away from the tanks. Dikes and bunds are still permitted in the standard, but there is an explicit requirement for the diking "to permit [...] free ventilation."
  • Nowadays, certain companies prefer to place LPG tanks underground, in order to prevent any chance of BLEVE.
• Key change management processes were not applied: The recently increased flowrate from the Minatitlán pipeline would have warranted improved pressure relief arrangements; and additional tankage was added without assessing the need for correct tank spacing. Management of change is nowadays a key element of process safety management systems, like the one promulgated by OSHA in 1992, which recognize that changes that are not thoroughly risk-assessed and communicated can and do lead to serious accidents.
• The plant did not have an effective gas detection system. This prevented early detection of the leak and safe isolation of the plant, thus contributing to a much greater inventory being available to the raging fires.
• Another barrier that failed was the means for emergency isolation. This greatly contributed to the escalation of the accident due to the contiguity of inventories that should have become segregated by isolation valves, as well as the failure to stop the incoming pipeline flow, which continued to feed the fire.
• The lack of fireproofing on the spherical tank legs may have contributed to the BLEVEs of the smaller spheres, since tank wall failure may have been triggered by the tanks collapse as a consequence of the weakening of the structural steel supporting them. API 2510 mandates application of suitable passive fire protection means on the aboveground portions of LPG tanks' supporting structures.
• The fire extinguishing/cooling system was inadequate. Apart from likely being partially not operational, it had a cooling spray rate much lower than the minimum of 10 liter/minute/square meter (0.25 gal/min/ft²) advised in API 2510A for LPG tanks where "there is concern or risk of a vessel being fully engulfed by flame because of its location, piping configuration, or impounding or drainage design."
• On the same note, the firewater distribution at San Juanico failed due to the effects of the initial explosion. In particular the firewater main line was installed aboveground, which made it liable to rupture when exposed to blast. Means to apply firewater should be designed to survive the effects of credible explosion scenarios.
• Firemen exposed themselves futilely and at great risk to BLEVEs when trying to cool the unexploded sphere. It is important that emergency services be aware of the dangers of liquefied gas vessels exposed to impinging fires.
• The fundamental role of land-use planning and its rigorous enforcement became all too apparent after the disaster. Planning must be supported by robust risk assessment and accident models. Based on models that did in part benefit from validation provided by the accident itself, safety distances of 300 metres (980 ft) have been proposed between an LPG plant the size of San Juanico's and the nearest houses.

The San Juanico tragedy, which followed other destructive BLEVE events such as those of Feyzin and Los Alfaques, resulted in higher awareness of the destructive potential of BLEVEs and the necessity to manage effectively the risk associated to these phenomena.

Later accident

In 1996 another Pemex site in San Juan Ixhuatepec suffered a serious accident, this time involving a petrol tank, which led to the death of a fireman and the evacuation of around 5000 people from their homes.

See also

Other notable BLEVE accidents:

• Feyzin disaster (France, 1966)
• Kingman explosion (Arizona, 1973)
• Los Alfaques disaster (Spain, 1978)
• Waverly tank car explosion (Tennessee, 1978)
• Memphis tanker truck disaster (Tennessee, 1988)

Further reading

• "PEMEX LPG Terminal, Mexico City, Mexico. 19th November 1984". Health and Safety Executive. Archived from the original on 27 March 2023. Retrieved 13 August 2023.
• Aparicio Florido, José Antonio (2004). "La explosión de gases de San Juanico" [The Gas Explosion at San Juanico]. Protección Civil en Andalucía (in Spanish). Archived from the original on 6 April 2008. Retrieved 12 August 2023.
• Carrión Velázquez, Alejandra (2002). "San Juan Ixhuatepec: una historia de violencia e impunidad. ¿Cuántos más debemos morir para que se den cuenta que estamos en peligro?" [San Juan Ixhuatepec: A History of Violence and Impunity. How Many More Have to Die for Them to Realize We Are in Danger?]. El Cotidiano (in Spanish). 18 (111): 58–63.
• CCPS (2014). "Thirty Years Ago – An LPG Tragedy" (PDF). Process Safety Beacon (November 2014). Archived (PDF) from the original on 19 August 2023.
• Gobierno del Estado de México (1985). San Juan Ixhuatepec: memoria de una emergencia [San Juan Ixhuatepec: Memory of an Emergency] (in Spanish). Toluca de Lerdo: Gobierno del Estado de México. Archived from the original on 17 March 2008.
• Marsh, Peter (2022). Learning Lessons from Major Incidents: Improving Process Safety by Sharing Experience. Rugby: Institution of Chemical Engineers. p. 32. ISBN 978-1-911446-77-4.
• Ortega Celene, Íñiguez (2006). San Juan Ixhuatepec: las dos visiones. Análisis fotográfico de las imágenes de La Prensa y del Uno Más Uno [San Juan Ixhuatepec: The Two Visions. Photographic Analysis of Images from La Prensa and Uno Más Uno] (PDF). Graduate dissertation (in Spanish). San Juan de Aragón: Universidad Nacional Autónoma de México. Archived (PDF) from the original on 19 August 2023. Retrieved 20 August 2023.

External links

• Disaster Area – Episode 202: The San Juanico Disaster: podcast
• Explosiones en San Juanico: YouTube video (in Spanish)