🛡️ Safety: The Sayano-Shushenskaya Dam Disaster Through the Lens of Process Safety

Applying Process Safety Management (PSM) is an essential part of ensuring industrial safety at hazardous production facilities, above all those in hazard classes I and II.

The core principles of PSM are universal. They can be applied successfully not only in the chemical industry, for which they were created, but in any other sector as well.

PSM is an organisational system made up of management and control instruments: standards, procedures, programmes, inspections, tests, assessments and audits.

Conceptually, PSM consists of 14 interrelated elements (OSHA 29 CFR 1910.119), which can be broadly grouped into three blocks:

1. People: employee participation; personnel training; contractor management; hot work permits; incident and accident investigation; emergency planning and response; compliance audits; protection of trade secrets.
2. Technology: process safety information; process hazard analysis; operating standards and procedures; management of change.
3. Equipment: pre-startup safety reviews; mechanical integrity of equipment.

As an analytical tool, PSM makes it possible to detect far more than the obvious breaches of existing industrial safety requirements.

The main strength of PSM is that it allows systemic weaknesses — the ones that create the preconditions for serious and catastrophic accidents — to be identified and eliminated well in advance.

In this context it is worth recalling the largest accident in the history of Russian hydropower, which occurred on 17 August 2009 at the Sayano-Shushenskaya hydroelectric power plant.

The accident claimed the lives of 75 people. Another 13 workers were injured. The economic damage exceeded 7 billion roubles. Subsequent costs of rebuilding the plant exceeded 40 billion roubles.

What happened

1. During a routine controlled reduction of output, hydro unit No. 2 (HU-2) moved beyond its normal operating range into a zone of elevated vibration.
2. Under the pressure of the incoming water, the rotor of HU-2 began to move upwards, which caused the turbine cover studs to fail and the unit to lose its containment.
3. The pressurised water rushing in caused rapid flooding and destruction of the turbine hall, as well as other buildings and structures of the plant.

The investigation established that the immediate cause of the accident was the failure of the turbine cover studs on HU-2 as the unit was once again taken into an operating mode that was not recommended because of elevated vibration.

If we analyse the circumstances and causes of the accident from a PSM perspective, we find a whole set of systemic weaknesses in the management of process safety. For brevity, I will list only some of the most important ones here, following the classic PSM elements.

Element “Process safety information”

Such information did exist at the plant, but it was clearly incomplete and did not reflect the actual situation that had developed long before the accident.

• No safe operating limits had been defined for turbine HU-2 that would rule out pressure pulsation and elevated vibration of the unit caused by hydrodynamic processes.
• The continuous vibration monitoring system (safety-critical equipment) had not been commissioned on HU-2 and was not taken into account when decisions were made about regulating the unit’s output.
• No requirements had been set for checking the tightness of the hydraulic turbine and of its fastening assemblies.
• Nor was any regular non-destructive testing of the studs and other fastening components provided for.

Element “Process hazard analysis”

It follows from the above that this analysis did not properly cover safety-critical equipment, controls and safety monitoring. As a result, the set of protective measures in use ceased to match the real situation at the plant and the risks that were emerging.

Element “Emergency planning and response”

• The plan for preventing and responding to emergencies did not include a scenario in which the plant buildings were flooded.
• Consequently, no corresponding drills were held, and no evacuation of contractors was foreseen, including from floors of the building below the water level mark.
• The means of operational communication and emergency alerting were knocked out in the very first moments of the accident.

Element “Operating standards and procedures”

• The operating documentation set no requirements for monitoring the condition and service life of the fastening assemblies that maintained the containment of HU-2.
• Such checks were carried out visually only, during routine maintenance, without any non-destructive flaw detection methods.
• Tellingly, mandatory locking of the nuts on the studs was not required by the working documentation for the unit.

Elements “Contractor management” and “Management of change”

• The maintenance units that had previously existed at the plant were disbanded, and their personnel were transferred to subsidiaries (outsourcing).
• The question of organising mandatory regular monitoring of the technical condition of the plant’s equipment was left unaddressed.

Element “Mechanical integrity of equipment”

• The preconditions for the sudden loss of containment of hydro unit No. 2 had existed for a long time. This is evident from the fatigue damage in the turbine cover fastening assemblies, caused by vibration and increased loads on the unit during repeated transits through a zone of the operating characteristic that was not recommended for use.
• When these fastening assemblies were examined after the accident, some studs showed no traces of nuts having been torn off. This indicates that the nuts were simply not there when HU-2 lost its containment.

📌 Conclusion

1. As so often happens, the preconditions for the catastrophe built up gradually and long before it began. One after another they appeared in plain sight of technical managers and staff, but no significance was attached to them. At a certain point the accident became inevitable and was merely “waiting” for its moment.
2. All the weaknesses listed above can be classified as systemic causes of the Sayano-Shushenskaya accident.
3. Its root cause is the absence of a considered, systemic approach to managing process safety.
4. Timely and competent application of PSM principles could have prevented this catastrophe.
5. One of the most important lessons: at facilities like this and at other hazardous production sites, the PSM approach cannot be ignored. It can and must become part of everyday management practice.

💬 Colleagues, please feel free to share your thoughts in the comments! 👇