Oil Refinery Integrity Related Incidents • 3 separate maintenance related incidents occurred at a UK Oil Refinery and Terminal during a 3-month period in 1987: 1. Flammable liquids released unexpectedly during maintenance of a refinery flare system, resulted in a fire which killed 2 men and seriously injured 2 more 2. One man was killed and extensive damage was caused by an explosion with fire while the refinery Hydrocracker Unit was being recommissioned after repairs 3. A fire within a storage tank at the refinery’s crude oil terminal killed one of a contractor’s team removing sludge. Smoking caused ignition • Were these 3 tragic accidents coincidence or the result of systemic safety management failures? Hydrocracker Unit Explosion - Summary Hydrocracker Unit involves an exothermic process involving the break down of low grade waxy and viscous feedstock oils by mixing them with hydrogen gas at high temperature and pressure in the presence of a catalyst to convert them to high grade light oils, petroleum and LPG
• Hydrocracker unit was being recommissioned
following a routine shutdown • During recommissioning, a plant trip occurred • This was thought to be a spurious trip and the operators started to bring up the unit to normal operating conditions • The plant was held in standby condition overnight with no fresh feed • At 07:00 hrs the following morning there was a violent explosion and subsequent fire • One man was killed on site • The explosion caused extensive damage and could be heard 30 km away • Debris weighing several tonnes was propelled up to 1 km, in some instances off-site What Happened (1)? Part of the HC process involves passing hydrogenated liquid/gas mixture into a vertical high pressure (HP) separator (V305) where hydrogen and light gases are separated from the liquid. From V305, liquid at 155 bar passed via control valves to a horizontal low pressure (LP) separator (V306) where more hydrogen and light gases were separated from the liquid at 9 bar
• During recommissioning the HC
Unit was put on standby following a plant trip • Air operated CV LIC 3-22 between 155 bar the HP and LP separators was opened and closed on manually at least 3 times while on standby • Fluid level in the HP separator fell resulting in HP gas breakthrough into the LP separator • LIC 3-22 did not close automatically because its trip solenoid had been 9 bar disconnected a year earlier What Happened (2)? • The pressure relief on the LP separator had been designed for a fire relief case not for gas breakthrough 155 bar • LP vessel subsequently exploded • Control valve LIC 3-22 did not close automatically because the low low level trip on the HP separator had been disconnected • The operators did not trust the main level control reading and assumed that the level in the HP 9 bar
separator was normal
Preventive Measures (1) 1. There should have been a high integrity automatic safety system to protect against gas breakthrough: a. Pressure relief for maximum anticipated gas flow rates b. Safety shut off system should have included a secondary shut off valve in the line from V305, in addition to the control valves c. Independent extra-low level detection / trip should have been fitted on V305 This was a classic HP-LP Interface. Do you have similar on your facilities? Do you have adequate overpressure protection? Preventive Measures (2) 2. Control room practices should have been monitored to detect possibilities for malpractice or error: 3. A full analysis of the dangers and potential consequences inherent in the operation of the HC Unit should have been carried out and documented: a.Adequate safeguards provided b.Communication of potential dangers and precautions to all concerned parties Preventive Measures (3) 4. The trip systems and alarms as installed should have been connected and in full operational order: a. Comprehensive testing schedules b. Defects should have been reported, recorded and actioned Key Messages (1) • There have been many improvements and advances in process and technical safety since 1987 e.g. Technology / Automation / Distributed Control Systems (DCS) • Regulations / standards for Process Safety Management (PSM) e.g. COMAH / OSHA • Identification and Assessment of Major Accident Hazards (MAHs) is now more systematic e.g. Hazard Operability (HAZOP) / Process Hazard Analysis (PHA) (Retrospective / Revalidation) Layers of Protection Analysis (LOPA) Safety Integrity Level (SIL) assessment QRA HP-LP Interface reviews / register Interlock and LO / LC Valve Register Register of Safety Critical Equipment (SCE) etc. Key Messages (2) • Management of Change (MoC) process with Risk Assessment • Effective Maintenance Management System (MMS) • Competence Assurance for operations and maintenance Safety Critical Positions • Consideration to be given to the effective management of Human Factors in safety and integrity • Process / Integrity Leading and Lagging Indicators
At least 64 people died at US refineries in 10 years before 2005