Fire at a renewable fuels plant

The explosion occurred at the hydro-deoxygenation unit of a renewable fuels facility. Part of this unit is a furnace aiming at pre-heating renewable feedstock, recycled renewable diesel, and hydrogen before subsequent processing in the reactor.
The incident occurred during the unit start-up. The furnace reached a temperature much higher than the normal operation, and a metal tube ruptured within the furnace, releasing hot renewable diesel and hydrogen and resulting in a fire and injuring a worker.
The investigation revealed that the overheating was probably caused by a bypass valve was partially open, diverting part of the feedstock and thus reducing the flow through the furnace.
DETAILED TIMELINE
(1) On the night of the incident, personnel had established renewable diesel and hydrogen circulation in the unit and had begun using the furnace to heat up the process materials.
(2) During the hour leading up to the incident, personnel temperature instruments inside the furnace indicated excessive temperatures on the furnace tube surfaces, triggering audio and visual high temperature alarms at 1,100 °F (590 °C) inside the control room.
(3) Minutes before the rupture, all tube temperature indicators were in excess of the high-temperature alarm set points, with 8 out of 10 instruments indicating temperatures ranging from approximately 1,490 °F (810 °C) to 1,710 °F (930 °C).
(4) To reduce temperatures within the furnace, personnel increased the flow of material through the furnace and sent a field operator to turn off two of the furnace burners.
(5) At the furnace, the field operator closed manual fuel gas valves to turn off two of the four burners that were lit at the time.
(6) Just after the field operator had completed this action, a tube ruptured within the furnace, releasing hot renewable diesel and hydrogen. The materials released from the furnace and ignited, causing a fire, injuring the field operator.

The INITIAL CAUSE was the overheating and failure of a furnace tube.
The ROOT CAUSE was due to severe design deficiencies of the facility, with safety interlocks unable to detect and activate anomalous process parameters.
Moreover, the overall risk assessment was probably incomplete (of example, one of the mitigating measure consisted in sending an operator to manually switch off burners).
Finally, the assessment of the situation during the emergency brought to wrong conclusion on the cause of the high temperature and to an ineffective measure (increasing the feedstock flow).

DETAILED PRELIMINARY ANALYSIS by CBS
• After the incident, personnel discovered that a normally closed manual bypass valve upstream of the furnace was open (misaligned), which created a potential flow path around the furnace and reduced the flow through the furnace.
• Although a safety interlock existed to automatically shut down the furnace during low renewable diesel flow, this low flow condition could not be detected, because the flowmeter intended to monitor diesel flow through the furnace was located upstream of the open bypass valve and was indicating a normal flow at the time of the incident.
• Moreover, although a safety interlock existed to automatically shut down the furnace at high temperatures downstream of the furnace, the real temperature inside the furnace could not be detected, because the temperature was measured downstream o the flow bypass, and was measuring the temperature of the flow around the furnace).

tube, furnace

DESCRIPTION OF THE FACILITY
The facility had been previously operated as a petroleum refinery for more than 100 years under various owners until 2020. In 2020, the owner converted the site to a renewable fuels facility, which began production in early 2023 with plans to increase
operation to full design capacity by the end of 2023.
The hydrodeoxygenation unit affected was designed with a furnace to pre-heat renewable feedstock, recycled renewable diesel, and hydrogen before subsequent processing.
Renewable diesel is a biomass-based diesel made from plant oils and animal fats.
Within the furnace, up to eleven fuel-gas fired burners heated the process materials, which flowed through stainless steel tubes inside the furnace. During the conversion project, the owner installed new, reconfigured tubes in the furnace. Documentation indicates that the new tubes were constructed of ASTM A312 Grade 321 stainless steel.

One injure worker. Property loss unknown

In the diesel process unit affected by the fire, at least two safety measures were in place, to monitor important parameter of the process: the flow and temperature of the feedstock through the unit. These measures were integrated in automatic shutdown procedures (interlocks) in case critical values of the two parameters were reached. However, in the case of this incident, they were unable to detect anomalies and did not activate the shutdown.
The reason was that they were installed in places which was not able to assess well process variations. The flow was measured upstream of the valve determining the flow to the furnace. Due to valve malfunctioning (or due to its wrong operation), the flow to the furnace was reduced, but not detected. The temperature in the furnace increased to low flow, and the temperature measures in the furnaces were giving alarm on high temperature in the operation room, but these alarms were not part of the interlock, which was placed downstream of the furnace, measuring also the temperature of the flow which had bypassed the furnace.
On high-temperature alarms, the operators decided to increase the flow. This was a logic measure, but based on wrong analysis of the situation. They did not considered the possibility of a diverted flow. The second decision, aiming at reducing the heat flow in the furnace by shutting down some of the burners, was taken too late and implied the manual intervention with the presence of a worker near the furnace.
Although the CSB investigation is still ongoing, the following LESSSONS LEARNT could be already proposed:
(1) The importance of a thorough and detailed risk assessment, which takes into account several different accidental scenarios and their consequences.
(2) The need to execute a proper safety design of the facility (identification of the critical parameters of the process, their robust measurements and their use in automatic shutdown procedures).
(3) The need to train workers on the process and its safety–related aspects, so that they are able to interpret correctly the signals during an emergency and take corrective (mitigating) measures considering as well the consequence of these decision on their safety.