© Institution of Chemical Engineers0260-9576/12/$17.63 + 0.00

4 | Loss Prevention Bulletin 228 December 2012

Explosion at the Sayano-Shushenskaya hydro-electricity power stationBunn, A.R.* and Carson, P.A. ***Kellogg, Brown and Root KBR , **Consultant

Incident

Summary

The Sayano-Shushenskaya hydro-electricity plant in Russia experienced large and rapid fluctuations in load and later a load rejection causing a catastrophic failure resulting in 75 fatalities, injuries, serious disruption to production at local industries, more than $1 billion damage to plant/equipment, expensive compensations, adverse environmental impact, and a 17% reduction in the company’s share price. Causes of the accident included technical and organisational shortcomings and negligence.

The official report into the accident blamed a failure of the turbine anchoring system resulting from heavy vibration. However, alternative hypotheses have been advanced, including the collapse of two water ducts, the presence of debris, the collapse of tube piers, seizure of the turbine bearing, water hammer, and water column separation. The true technical root cause may never be known, but the plant is now under reconstruction.

There are relevant lessons for the chemical and process industries from this incident.

Keywords: Power station; hydropower; Russia; ageing plant; safety; communication; emergency procedures.

The accident

The East Siberian grid was served by several large power stations, including one at Bratskaya and one at Sayano-Shushenskaya. The latter (built in 1978)1 was Russia’s largest hydropower plant and the sixth largest in the world2,3. Both Siberian stations had been fitted with automated joint frequency load controls. Due to a fire at the Bratskaya station on 16 August 2009 all its load was transferred to the Sayano-Shushenskaya plant4. During the night of 16/17 August the Sayano-Shushenskaya plant experienced large and rapid fluctuations in load varying between 2800 and 4400 MW. On the 17 August it suffered a load rejection on Unit 2. This was followed immediately by a loud bang heard in the administration and control building adjacent to the power house4. The rejection caused a catastrophic failure involving the lifting of runner, shaft, head cover, turbine and generator bearings vertically upward into, and destroying, the generator rotor spider. Water flooded into the engine room and turbine pit, causing a transformer explosion which blew the roof

away. This was accompanied by another loud bang. Figure 1 depicts a generator, Figure 2 Unit 2 after the accident, and Figure 3 the plant after the accident4. (Figures are reproduced with kind permission from International Water Power & Dam Construction magazine). Additional photographs are provided elsewhere3,5.

Units 2, 7 and 9 were totally destroyed and the rest of the units severely damaged, with the exception of one unit which was under refurbishment and out of operation. Seventy five workers lost their lives and scores were injured1,6. Some of the dead had drowned whilst others were crushed by debris. Power generation at the plant was halted. The surrounding highly-industrialised area was forced to source power from other locations, including four local aluminium smelters which cut production1,7,8. Power shortages were reported as far away as 1000 km5. An 80-kilometre-long spill of 40 tons of transformer oil polluted the River Yenisei, which flows into the Arctic Ocean, damaging many fish farms along the river and killing 400 tons of trout9. Fortunately, the plant’s towering arch-gravity dam structure allegedly remained undamaged1 and the dam’s reliability was confirmed daily by automatic monitoring systems and other measurements and inspections10. News of the explosion caused the company’s shares to drop by 17% on the London Stock Exchange, while trading was suspended in Moscow1. Rostekhnadzor, the Russian industrial agency, mounted an investigation to determine the cause. Estimates

Figure 1: Generating unit

Generator Bearing Housing

Generator Rotor

Generator Stator

Head cover studs

Spiral Case

Runner

Flow

Wicket Gates

Head Cover

Gate Levers

Draft Tube

Shaft

© Institution of Chemical Engineers0260-9576/12/$17.63 + 0.00

Loss Prevention Bulletin 228 December 2012 | 5

Terrorist attack and hydraulic pressure surge were ruled out early in the investigation1,6.

Rostekhnadzor attributed the cause to heavy vibration of Unit 2 which, in combination with lax maintenance and inspection, resulted in fatigue failure of many of the 80 x 8cm turbine head cover retaining studs4,11. At least six bolts were missing after the accident and 41 of the 49 bolts recovered from Unit 2 had fatigue cracks. Forensic evidence suggested that some of the bolts had never had nuts installed. All the bolts were located at the extreme outer edge of the head cover, and both mating flanges were narrow and relatively thin; at full strength, the studs could be subjected to a substantial load. The unit had been long plagued by large vibrations and, at the time of failure, vibration levels were 840 µm whereas the maximum acceptable vibration level was 160 µm. (Vibration after maintenance should have been 38% of the limit but after 2009 maintenance it was 93% of limit). The vibration control system for Unit 2 was apparently online and functioning but had not been formally accepted for continuous operation and so operating staff were not allowed to rely on its data.

Runner repairs in 2009 were undertaken in situ without removal of the head cover, and the studs therefore would not have been replaced. This low-quality maintenance was considered a significant factor in the cause of the accident. Logs indicated that at the time of the accident output power of Unit 2 was in the ‘not recommended’ zone in order to meet increased grid demands and with no objection from operational staff. The plant had a long history of ignoring operating and maintenance deficiencies and obvious fatigue cracks. It is significant that previous repairs had detected cavities up to 12 mm deep and cracks up to 130 mm long on

suggest reconstruction will take four years and cost $1.23 billion with replacement equipment costs alone at $390 million. More than $4.8 million was paid by the company to the bereaved with additional government top-up funds for families that lost both parents.

The cause

One report claims that the true cause has never been revealed4. The following summarises accounts from sources listed in the Reference section.

Official report

Rostekhnadzor issued an extensive report (in Russian) as early as 3 October 20094,11. Failure of the turbine anchoring system initiated a sequence of events. The turbine cover was blown off leaving Unit 2 turbine in its pit with no turbine mountings, but with its wicket gate and head gate opened. The 212m water-head pressure from the dam immediately ejected from the pit the 900 ton turbine rotor, which continued to spin as it flew across the gallery destroying everything in its path. The force of the water caused damage to structural steel and concrete, and the gallery roof collapsed. Further pits became flooded causing more turbine failures. The machinery hall was flooded within one minute. All units were forced to emergency shutdown by electrical short circuits and explosions. Power outages occurred, controls were disabled, and communication systems failed12. Wicket gates were closed manually. Some employees were washed away from the turbine halls into the river. Within 24 hours, more than 1500 rescue workers arrived and 14 survivors were rescued.

Figure 2: Unit 2 after the accident once water was removed

© Institution of Chemical Engineers0260-9576/12/$17.63 + 0.00

6 | Loss Prevention Bulletin 228 December 2012

the turbine wheel, but findings had been ignored.It would appear that the main purpose of the studs was

primarily to obtain a seal with the main structural support of the head cover; resistance to upward forces was provided by the conical structure connecting the head cover to the generator bearing housing above it weighing ca 1500 tonnes. Thus the entire weight of rotating parts and the hydraulic thrust on the runner were supported by the turbine head cover, which would resist hydraulic uplift. The report apparently failed to identify the source of the large upward force, nor did it address the failure of the other units or identify any other contributory factors. The manufacturer of Unit 2 claimed a design life of 30 years, and on the date of the accident its age was 29 years and 10 months5.

Normally, only 12 operators were present in the turbine gallery, but on the day of the accident, 100 workers were on site performing maintenance to ensure the work could be completed quickly. The official report11,13 claimed that negligence was a major factor in the accident, and partially blamed the conditions on the Deputy Energy Minister, several company directors, a member of the Russian Academy of Sciences who headed the commission that gave the approval in 2000 for the plant to be put into service (some 20 years after production had commenced) and a previous Energy Minister. The report also named 18 members of the plant’s staff with responsibilities for accident prevention. In December 2011 the former director of the hydro power station was charged with violating safety rules14. The report highlighted previous major accidents that had occurred at the plant including floods in 1979, 1985 and 19886. Whilst a report by the Russian Emergency Situations Ministry in 1998 warned that the dam walls may be incapable of withstanding cyclical pressures resulting from spring floods, no control structures were ever introduced and the plant continued in operation.

Company focus was on making money at the expense of technical considerations12. In 2007 the company underwent a reorganisation leading to a doubling of profit1. Because of budget constraints there was a lack of investment to replace obsolete plant and worn out components, and safety was compromised by staff reductions at regional and local levels by over-simplification of systems and documentation and by cut-backs on maintenance, education and efficiency of communication both inside the companies and with contractors. Employees were reluctant to complain or raise

concerns because they believed work was being done as could be afforded.5

Alternative technical hypotheses

Soon after the accident, several alternative theses for the cause were advanced4 but since complete and detailed technical data and drawings were unavailable, many conclusions are somewhat speculative. Theories proposed ranged from:• The collapse of two water ducts resulting in flooding.

• The presence of debris and a broken governor oil pipe, but this is inconsistent with later photographic evidence.

• Collapse of a tube piers causing blockage of the draft tube. This would have left clear evidence, and no mention to this appeared in the Rostekhnadzor report.

• Large twisting transmitted to the head cover caused by seizure of the turbine bearing or upper tunnel seals. However this is inconsistent with the bolts failing under tension not shear.

• Water Hammer4,15: The official report’s conclusion that the accident resulted from fatigue failure of the head cover studs does not explain the large upward force necessary to cause the explosion and the damage evident in the photographs. Taking account of the weight of the entire assemblies, the downward hydraulic thrust, mechanical resistance etc, it has been suggested sufficient upward thrust could not have occurred under normal operation. A more recent hypothesis invokes a water-hammer pressure rise on full shutdown due to reduction in velocity giving an upward force sufficient to lift the assemblies. Photographs suggest the head cover lifted unmarked as a unit, indicating all studs failed simultaneously, whereas it is more likely that the studs would have failed sequentially under water-hammer conditions, lifting part of the head and relieving flow into the turbine pit and tilting the shaft and bearings thus causing the generator rotor to collide with stator windings. Photographs also show the head cover flange was undistorted.

• Yet another theory is that the explosion was caused on rapid load rejection by water-column separation in the draft tubes of the destroyed units, followed by extremely violent pressure rise as the water column rejoined under the head cover4. This condition can be readily caused by a too-rapid wicket gate closure during unit load rejection. Adjustment of governor times to unsafe values to achieve fast response to operating load changes may have occurred in recent times in response to a need to improve grid efficiency control. Although this is somewhat speculative, observations at hydroelectric installations over the last 40 years indicate4 that plant operators sometimes try to improve the responsiveness of their generating units by various adjustments to the equipment, including modification to the orifice control of the wicket gate servomotor oil-pressure system in order to speed up the wicket gate movement. Occasionally, this has resulted in cases where draft tube column separation has occurred causing loud banging sounds, pressure spikes, and sometimes damage to the machines. Normally, governors are designed with considerable margin allowance in the sizing of oil piping, leaving the speed control up to the

Figure 3: A view of the plant after the accident

© Institution of Chemical Engineers0260-9576/12/$17.63 + 0.00

Loss Prevention Bulletin 228 December 2012 | 7

orifice plates that are installed to limit the velocity of oil flow. The magnitude of this margin is determined by the governor designer, but since oil piping is normally a tiny portion of the cost of a governor, designers can be conservative with piping sizes and remain competitive. Thus, it is often possible for governor speeds of response to be changed significantly by replacing orifice plates with larger ones. It is possible that the governor had been adjusted to increase the speed of wicket gate movement, which would have been expected to improve the machine’s load-following capability. This would have been consistent with the very fast load-changing capabilities of the joint load control system installed in June. It has been reported that at Sayano-Shushenskaya the joint load control system was set to change at the rate of 30MW/sec. It is likely that the governors were set at an even faster rate. If the governor gate speed was too fast, the transient pressure drop in the draft tube accompanying a load rejection would have caused water column separation. This, combined with compromised stud connections due to poor maintenance, could explain the extreme violence of this accident.

Lessons learned and relevance to chemical and process industries

From the references reviewed no clear conclusion as to the true technical cause of this serious accident can be drawn. Nevertheless, some lessons can be learned for the chemical and process industries, especially with regards to ageing plant16, communication17, safety culture18 and emergency procedures.

• It would appear that the Rostekhnadzor report was thorough but of limited scope and was published in haste (less than three months after the accident); it did not consider all possible alternative scenarios in formulating recommendations. Without detailed and full investigations, the opportunity to learn for the future can be lost or not fully realised. This raises questions about implications for the safety – both of existing hydro-electricity plants and reconstructed plants. It emphasises the need for comprehensive accident investigations to consider all the facts and possible scenarios prior to rebuilding/re-commissioning plant or processes, in order to minimise the possibility of a recurrence (c.f. competing theories for technical causes of Flixborough explosion19). In the latter example the plant was never rebuilt and the process is not in operation elsewhere, whereas in the present case, the plant is under reconstruction20 and should a repeat accident occur due to incorrect technical assumptions or neglect of administrative/managerial lessons, the consequences could be severe. Furthermore, questions had been raised about the dam’s integrity before the accident, and if the dam had been sufficiently weakened by this, or by a repeat accident, to cause catastrophic failure then significant risk to workers, the environment, neighbouring communities, the economy, and company/country reputation could result.

• The case study also highlights the need to stress both model and field testing of hydraulic turbomachinery.

• Maintenance and inspections at Sayano-Shushenskaya were not conducted correctly, and both operators and management allowed equipment to run routinely outside design intent. Whilst cracks and cavities had been detected during repairs in 2009, the findings appear to have been ignored5. Clearly, those involved had not foreseen the consequences of these actions. Plant designers typically prepare Operating and Maintenance (O&M) Manuals as part of the design documentation4. These manuals are for the use of operations personnel, and they include recommendations and limitations by both equipment manufacturer and by the overall plant designers. A vital responsibility of the designers of these plants is to state clearly in the O&M Manuals the design limitations inherent in the plant and its equipment. Clear warnings should be stated about such matters as deviating from normal practice (e.g. in the present case the speeding-up of governor times without allowing for the hydraulic transient effects thereof). Operators may not be trained in intricate technical considerations (such as in this case, the mechanics of hydraulic transients), and their understanding of these phenomena must not be taken for granted. They must be warned what not to attempt and why, as well as what good practices to follow. It must be kept in mind that operators may be widely separated from designers by distance, time, and in technical knowledge. Quality control checks must be built into maintenance schedules. These must stipulate what checks are to be undertaken together with the action needed if defects are detected.

• When monitoring of safety critical features does not result in automatic action (e.g. shutdown), then clear instructions must be available to indicate what action should be taken if excursions occur, and at what level of excursion. Thus, excursions above ‘normally-accepted values’ does not mean that processes can continue long-term even if ‘within specification’.

• Impact of ageing plant must be fully appreciated.

• Risk assessment must assess implications of increased demand for productivity and of budgetary constraints.

• Scope of emergency plans should include catastrophic failure and continuity of operation to minimise impact on customers, surviving employees, and adverse company reputation. They should address all foreseeable contingencies, and they must be rehearsed. At Sayano-Shushenskaya flooding disabled controls and protections of units (including access to Unit 2); there was neither normal nor emergency electricity supply (including emergency lighting)5. There were no signs to indicate emergency escape routes, and there had been no drills to assess preparedness.

• Systems must ensure organisations learn from previous past lessons.

• ‘Blame culture’ within a company must be avoided and organisations must contain sufficient levels of appropriately skilled staff.

Glossary

Load rejection – the sudden loss of electrical load on a generator

© Institution of Chemical Engineers0260-9576/12/$17.63 + 0.00

8 | Loss Prevention Bulletin 228 December 2012

Runner – the rotating element of a turbineGenerator rotor spider – structure supporting the core or poles of a rotor from the shaftWicket gate – device by which water is directed tangentially and spirals on to a propeller shaped runner, causing it to spin.

References

1. Green, N., http://www.wsws.org/articles/2009/aug2009/russ-a24.shtml

2. Anon, http://en.wikipedia.org/wiki/Sayano%E2%80%93Shushenskaya_Dam

3. Cruz, E. And Cesario, R., http://www.slideshare.net/vtsiri/accident-at-russias-biggest-hydroelectric-rev-00-1967885

4. Hamill, F.A., http://www.waterpowermagazine.com/story.asp?sectionCode=46&storyCode=2058518

5. Anon, http://www.hss.doe.gov/sesa/analysis/oec/docs/LL_from_Accident_at_Russia’s_Hydroelectric_Plant.pdf

6. Okulor, V.L.. http://ing.dk/modules/fsArticle/download.php?fileid=281

7. Walsh, L., http://www.edie.net/news/news_story.asp?id=16854

8. Anon, http://rianovosti.com/trend/dam/?id=

9. Anon, http://www.boston.com/bigpicture/2009/09/the_sayanoshushenskaya_dam_acc.html

10. Ray, R.W., http://www.hydroworld.com/articles/print/volume-18/issue-1/Articles/Refurbishment/restoring-

sayano-shushenskaya.html

11. a) Rostekhnadzor, “Technical Investigation Report: Causes of the August 17, 2009 Accident at the Sayano-Shushenskaya Hydroelectric Power Station (the P.S. Neporozhnij Sayano-Shushenskaya Hydro-Power Plant, an Affiliate of RusHydro, Inc.),“ in Russian, 3 October 2009, posted at: http://www.gosnadzor.ru/news/aktSSG___bak.doc. b) Anon, http://www.rt.com/news/power-plant-disaster-causes/

12. Hasler, J.P., http://www.popularmechanics.com/technology/engineering/gonzo/4344681

13. Harris, M., http://www.renewableenergyworld.com/rea/news/article/2012/02/sayano-shushenskaya-defendants-face-new-charges

14. Anon, http://www.homelandsecuritynewswire.com/negligence-factor-hydropower-plant-disaster-killed-75

15. Nolan, J., http://jeffnolan.com/wp/2009/09/26/disaster-at-sayano-shushenskaya-dam/

16. Anon, Loss Prevention Bulletin, 2012 (225), 3

17. Carson, P.A. and Mumford, C.J., Loss Prevention Bulletin, 2011(218), 5

18. Carson, P.A. and Snowden, D., Loss Prevention Bulletin, 2011(221), 12

19. Kletz, T., The Chem. Engineer, 2007 (May), 50

20. Anon, http://english.ruvr.ru/tag_4768765/

HAZARDSAP HAZARDSAP HAZARDSAP

The second Hazards Asia Pacific Symposium, organised by IChemE and the Chemical Industries Council of Malaysia (CICM), provides an essential forum for international experts and process safety professionals to discuss operational excellence in a competitive environment.

Visit www.icheme.org/safety for more details on the safety training and events taking place in 2013.

C0042_12

ADVANCINGCHEMICALENGINEERINGWORLDWIDE

Hazards AP, 16–18 April 2013, Kuala Lumpur, Malaysia

IChemE safety training and events in 2013Our annual process safety training programme will help you, your staff and your organisation, as a whole, to improve safety, reduce risk and control hazards. Courses cover the following areas:

Fundamentals of Process Safety

Gas Explosion Hazards

HAZOP Study

Human Factors

Introduction to Process Safety

Layer of Protection Analysis (LOPA)

C0042_12 LPB_Hazards AP advert.indd 1 28/11/2012 14:13