Explosion in a power plant

A steam turbine/generator tripped due to an unknown hydraulic control oil system failure. The generator breaker opened, but the emergency valve (throttle valve) did not closed completely. Within 30 seconds of the generator circuit breaker opening, the turbine accelerated from 3600 rpm to an estimated over-speed of 6000 rpm, resulting in the catastrophic failure of multiple components of the turbine.
Seal and bearing lube oil were released under pressure, because the emergency battery-powered lube-oil pumps continued operating. The leaking lube-oil ignited, causing an intense fire around and below the damaged machine.
The exciter and bearings were ripped from their mountings, causing total destruction of the generator. The generator shell was punctured, releasing hydrogen coolant which accumulated in the roof space of the turbine hall before exploding a few seconds later. The blast blew out ~ 30% of the turbine hall exterior block wall. Falling masonry damaged 3 outdoor transformers, rupturing associated oil coolers and initiating an oil fire.

Fortunately, the incident occurred on a Saturday evening with few employees on site. On a weekday, 14 people would have been in imminent danger as they normally work in a nearby electrical workshop where a wall collapsed.

INITIATING CAUSE of turbo-generator set disintegration was turbine over-speed caused by a unclear malfunctioning of the control system.
CONTRIBUTING CAUSES to the events escalation were:
(i) The malfunctioning of the trip and throttle valve of the turbine: when the generator breaker opened, they kept feeding steam to the turbine, causing over-speed
(ii) The continuous release of lube oil, feeding the oil fire
(iii) The release of hydrogen and accumulation into a confined room, increasing the severity of the explosion.
(iv) The damage to the hall structure due to the explosion, with consequent masonry falling on external transformers and initiating a transformer insulating oil fire.
ROOT CAUSES included:
1) Inadequate preventative maintenance (the T&T valves had been affected in the past by several malfunctioning),
2) There were deviations from the operations prescribed,
3) The critical equipment of the systems had not been safe-tested.

oil system,
steam valve,
turbine-generator system,
hydrogen coolant system,
turbine hall

The T&T valves had been regularly affected in the past by several malfunctioning. The main function of the Trip and Throttle valve is stopping the steam flow to the turbine to discontinue operation in emergency situations.

DESCRIPTION OF THE FACILITY
The power plant consisted in 3 steam turbine/generator units of 78 MWe. The unit had different age. The older one, affected by this incident, was dating back to 1968. . The second went online in 1972 with a the same power. I third one of 192 MW was added later.

No injury. Fortunately, the incident occurred on a Saturday evening with few employees on site. On a weekday, 14 people would have been in imminent danger as they normally work in a nearby electrical workshop where a wall collapsed.

The damage was US$ 45 M (2012)
Repair and re-commissioning of the damaged machine took approximately 17 months.

none (the incident occurred on a week end, and nobody was in the hall). Probably the incident occurred so quickly (it took 30 seconds for the turbine to achieve over-speed) that an emergency action was not possible.

(1) Maintenance of components and subcomponents shall be performed according to the original manufacturer requirements/guidelines (specifically for this incident, trip & throttle the valves and the over-speed protection systems).
(2) Deviations from the prescribed operations of safety-critical equipment shall not be allowed. It happens very often that ad-hoc solution of malfunctioning are adopted under time pressure. These solutions end up then as part of the maintenance/operation routine, but have never been tested against the original safety design and operational guidelines.
(3) The risk assessment should be regularly reviewed and the preventive/mitigating measures adapted: this case showed that steam turbine/generator units should have automatic fire suppression systems.