An explosion occurred on a water tube type steam generator in a dairy at around 7 p.m. The explosion deformed the boiler’s structure, generating leaks. As the steam generator was out of order, it was shut down and isolated from the steam network. The back-up emergency boiler, in operation at the time of the explosion, was able to meet the site’s needs. No injuries were reported, despite the presence of two people nearby at the time of the explosion.

Circumstances

The explosion occurred when the pressure equipment was restarted following maintenance. The work, conducted by a subcontracting company, concerned:

• periodic requalification of the equipment (carried out in June 2016);
• installation of a new natural gas supply system;
• installation of a new control cabinet to operate the equipment in the 72-hour mode without permanent human presence;
• replacement of the burner to comply with the NOx emissions prescribed in the site’s authorisation order.

The work took place from April 25 to July 8, 2016. A body authorised to inspect pressure equipment had also supervised the various stages by issuing several certificates (inspection after significant intervention, commissioning inspection, report specifying the presence of safety components and the transfer of alarms to the automatic control system, etc.).

The boiler was put back online on July 6 after the technicians had been trained in the new operating mode. The programming of the PLC controlling the burner was changed from non-permanent to permanent mode in order to keep up with site developments.

Typical “low steam demand”, “level control” faults occurred and required intervention by the subcontractor during the months of July and August.

Causes

The subcontractor in charge of the work performed causal analysis of the accident. Findings:

• The accident was caused by an incompatibility between the wiring of the burner’s safety chain (probes and sensors) and its operating mode due to a loss of control during programming of the PLC;
• an excessive amount of air in the gas/air mixture would have resulted in burner flame blow-off in the combustion chamber;
• the flame blow-off signal had been masked due to improper wiring of the safety chain components;
• a volume of natural gas entered the combustion chamber and exploded when the flame was relit.

An engineer from the company that manufactured the PLC was designated by the subcontractor to recover the device’s black box. This company confirmed that the manner in which the wiring had been installed did not allow the flame blow-off to be detected.