Explosion and fire in a refinery

The incident occurred in the hydrocracker unit of a refinery, specifically at its liquid-gas separators of the unit. The unit was in shutdown mode, due to an automatic trip triggered by a high-temperature alarm signal on one of the unit reactors. Several pumps and compressors shut down automatically and feed to the reactors was interrupted. The system was starting to depressurise, but hydrogen was still circulating through the unit. The process fluid flow to the separators was regulated by two control valves.

When the valves were put in manual modes, one valve between the high-pressure (HP) and the low-pressure (LP) separator was erroneously opened, and the liquid was allowed to drain. High pressure hydrogen at 155 bar passed uncontrolled from the HP into the LP separator, which had limited pressure relief capacity. The separator over-pressurised rupturing at a pressure estimated around 50 bar. The explosion was equivalent to that of 90 kg of TNT and disintegrated the separator and damaged other vessels and pipes. Released flammable substances were ignited resulting in jet-fires. Leaking petroleum spirit spread on a large area and caused flash fires.

The INITIATING CAUSE was the wrong manual operation if a control, which started a series of event which first brought to the failure of the separator due to over-pressure, and then to the escalation to other equipment containing flammable substances.

The operator which opened the valve by mistake did not realise that the liquid contents in the high-pressure vessel was draining away. Monitoring systems were not trusted or not calibrated. The plant had been built in the 60’s, and the monitor and control system and devices were not providing a clear picture of the situation in the field. The operation was more relaying on the manual adjustments of control parameters than on written procedures. The operator did not have sufficient training for managing the transient/emergency which occurred seldom.

According to the IChemE summary, this incident was affected by the thee critical technical factors:
(1) The alarms on the HP separator extra-low level detection system failed,
(2) The alarm of low-level liquid on the HP separator had been deliberately taken out of service, depriving the unit id an automatic shutoff action.
(3) The gas outlet line on the HP separator was isolated because its valve was closed, while the hydrocracking unit was on standby with no feed to unit. The was no route for gas disposal.

ROOT CAUSES included an inadequate (safety) design a failure to conduct a Management of Change (MoC), inadequate startup procedures and training, inadequate safety management system and failure to learn from previous near miss events.

hydrocracker, valve, LP separator, adjacent factory

According to the ARIA report, the accident occurred during a restart procedure subsequent to a routine shutdown of the hydrocracker. This abnormal condition is not mentioned by the eMARS report, but confirmed by HSE summary (see references).

The hydrocracker unit was commissioned in the early 1970's. According to the eMARS report (see references) the potential for high pressure gas breakthrough into the low pressure (LP) separator had already been recognized in the design phase and an automatic prevention system had been provided.
Later, due to operational difficulties (too frequent spurious trips), the control valve alarm and trip was removed and not replaced. One of the reasons was that the system was unreliable and therefore distrusted. After the removal of the alarm system It was left to the operators to detect dangerous low levels and close the valves when they judged it appropriate. The removal of the safety system was authorized at operations supervisor level. Maintenance and instrument engineering managers were aware of the situations and turned a blind eye to it.

DESCRIPTION OF THE HYDROCRACKING UNIT
The basic process was an exothermic reaction breaking down low-grade waxy products and thick viscous oils by subjecting them to hydrogen gas at high temperatures and pressures in the presence of a catalyst. The final products were high-grade light oils, petroleum spirits and liquid petroleum gas (LPG).
The hydrocracker unit consisted of a series of 4 fixed bed vertical reactors, operating in an atmosphere of hydrogen at 155 bar and 350°C.
The hydrogen make-up feed gas for the reactors came mainly from a hydrogen production unit supplemented by a hydrogen as by-product from the catalytic reformer.
From the reactors the hydrogenated liquid-gas mixture moved to a series of heat exchangers and a fin fan cooler into a vertical high-pressure (HP) separator at a temperature of about 50°C, still at 155 bar. Here the hydrogen and light gases were separated from the liquid and passed to the inlet of a centrifugal compressor to be recycled to the reactors. The liquid component (the ‘liquor’) was then passed via control valves to a horizontal low pressure separator where more hydrogen and light hydrocarbon gases separated from the liquor as the pressure dropped to about 9 bar.

The de-gassed liquor passed through heat exchangers into the fractionation unit where products such as kerosene, gasoline, naphtha and petroleum gases were separated from the uncracked residue.

The temperatures of the reactor beds were monitored and at 425 C temperature cutouts would operate to stop the input of wax feed and hydrogen. This was the system which started the automatic shutdown of the unit just before the start of this incident.
The shut down consisted in a sequenced depressurisation through blow down valves into the flare system. Hydrogen recycle would however continue through the reactors to assist cooling during depressurisation.

A contract crane operator who was in the nearby was killed. [Note of HIAD event validator: ARIA reports 7 injuries, a number partially confirmed by the post-accident inspection results. The IChemE summary reports 0 injuries].
The failure of the LP separator caused the release of 1 t of H2, 3 t of petroleum gases and 10 tonnes of hydrocarbon liquids in the form of aerosols. The incident escalation to nearby pipework and vessels caused a further release of 190 of light petroleum s and 220 t of heavy hydrocarbons liquids.

The missile-like effects of the explosion had threatened the safety of 200 people. Property damage was extensive, estimated at €7 million inside the site ((the cost of rebuilding of the hydrocracker) and another €7,000 outside (broken window panes, damaged roofs, etc.).

The accident caused extensive damages to vessels, pipework and buildings within the hydrocracker complex. Outside the establishment, damages occurred in an adjacent factory (rupture of a steam line and damages to a building caused by a large fragment of metal through the roof). The approximate extent of broken windows and cladding and the points were the missiles had thrown are shown on a map attached to the HSE Report.

The operator made a plant shutdown and searched for the cause of the vent.

This event was characterised by a combination of operative errors and lack of properly designed and functioning devices with critical safety functions.
On the background, there were two additional factors: a vintage control system which made difficult for operators to make a diagnosis and understand the effect of their actions, and an overall emergency, a shutdown triggered by a possibly spurious high-temperature signal. The operators were focussed to understand how to react to the shutdown and to guarantee functioning of critical operative components such as the reactors and process gas compressor.

This highlights the importance of training personnel on in-depth technical aspects and components behaviours under transient conditions. This should be go together with clear, complete and effective operative procedures and checklists.

Another lesson from this event, is that interlock systems should only be disconnected after careful risk assessment and a Management of Change review have been completed to verify that alternative means are in place to adequately control the associated hazards. Also, the basis for the risk assessment should be properly documented and should highlight any conditions affecting validity of the change.

According to eMARS, the company took these measures:

(1) Review of all HP/LP interfaces on worldwide assets and rectified deficiencies in overpressure protection, by installing properly designed pressure relief valves on the low-pressure separator.
(2) Improved instrumentation and fail-safe shut-off valves in series with level-control valves to be included when rebuilding of the hydrocracker.
(3) Adoption of strict procedures to drain liquid from the high-pressure separator when in shutdown.
(4) Improvement of the systems for reporting plant defects, testing interlocks and trips, authorising equipment changes and training operators.
(5) More rigorous routine audits. Senior management had to take a much closer interest in the safety performance of refinery departments.