Steam reformer explosion at a oil production plant

The incident occurred at the steam methane reformer unit producing hydrogen.

The event occurred just after that start-up steam was introduced into the reformer furnace inlet. At this moment a very high pressure and a single loud bang was reported by the operations personnel on the furnace structure. The investigation concluded that the mechanical failure of the reformer was due to flash evaporation of water still in liquid form, which caused an abnormal pressure peak.

This is therefore an accident involving a hydrogen system, but where hydrogen did not have a role in the accidental sequence. Since the incident occurred at the re-start of the reformer, probably the hydrogen quantities were negligible
An emergency shutdown of the furnace was initiated and the start up aborted. At the time of the incident there were 7 people on the furnace. Four were operations staff plus three maintenance personnel.

The INITIATING CAUSE was accidental injection of remnant water into the furnace.
The ROOT CAUSE was related to organisation aspects such as inappropriate safety design risk, (see lesson learned)

steam reformer, furnace inlet

The event occurred just after that start-up steam was introduced into the reformer furnace inlet.

The plant had been shutdown and the reformer furnace isolated, to perform maintenance work. After the replacement of 6 damaged tubes, the start-up procedure was initiated: it consists in heating furnace up to 350oC (662oF), then introducing 4136 kPa (600 psig) of steam into the radiant tubes, rising the furnace temperature is increased until 500oC (932oF), feeding the methane and finally bringing the unit on line for the production of hydrogen.

A total of 46 reformer tubes were destroyed in the incident. The inlet portions of 5 tube assemblies were ejected from the furnace with sufficient force to severely injure one worker and launch debris beyond the furnace structure.

Under normal operation the loss of the hydrogen from this reformer is estimated to restrict production by 4.5 million barrels of Syncrude Sweet Blend over a 71-day outage. The cost of re-tubing the furnace was approximately $20 million, which does not include other associated shutdown costs. The cost of a new catalyst charge was approximately $1million.

The investigation team condemned the entire reformer radiant tube section as there was no method to prove the integrity of the surviving tubes and there was too much damage to simply conduct repairs.

The reactor was immediately shut-down and could be maintained in a safe shut-down state with adequate sub-criticality at all stages. Crash cool down of the primary heat transport system was done and subsequently fire fighting water was injected into the steam generators for maintaining thermosiphon cooling of the core.

Inadequate Safeguards: The system was designed with low point drains to facilitate water removal. However, these were found to be inadequate in both location and size. The fact that the mixed feed pre-heat coil was not self-draining was unknown prior to the
incident.
A HAZOP (Hazard and Operability Study) revalidation had not been performed on this plant but had been scheduled for 2006.

Inadequate Procedure: the startup procedure did not account for a startup of a cold furnace. Therefore, the time to reach the critical “steam in” temperature of 350 C (662 F) was short as compared to previous startups. Moreover, the procedure did not allow for checking that the reformer furnace feed system was dry.

Lack of Management of Change: several steps I the procedure were not executed, because thought not required or not applying to this specific start-up. Consequently, the heat-up cycle was artificially shortened. This alteration to the startup sequence was not viewed as a change of operations.
However, shutdown and startup procedures are designed to take a unit from safe operation
to a zero-energy state and then return it to safe operation. Changing these sequences by an intentional omission is a change and must be properly assessed for risk.
Moreover, the decision to leave some steam flow in the steam generating system for this winter shutdown was made to keep the system warm and prevent freezing. This decision was seen as a safeguard from the risk of freezing. But no formal risk assessment was done, to identify possible negative effects of this decision, which provided an opportunity for
water to accumulate upstream of the reformer furnace.

Non-essential Personnel: at the time of the incident there were 7 people on
the furnace structure. Only the operations personnel were essential.

Improvements in safeguards: After a thorough review of the entire reformer furnace feed system was completed, existing drains were increased in size and others added to ensure the entire feed system could be drained.

Improvements in procedure and risk assessment: modifications to the procedure were completed that included a longer heat-up period, the addition of more detailed guidance for verifying the feed system is dry and a formal sign off by both operations and engineering personnel.
Also a separate cold eyes review by external experts was completed as part of
the pre-start up safety review.

Improvement on personnel presence: changes have been made to ensure non-essential personnel are cleared from the areas during startup activities.