XBP Refining Consultants Ltd., 146 New London Road, Chelmsford (2026)

12/04/2021

SAFETY: On 25-Oct-88, at the SRC Pulau Merlimau (island) refinery, 3 floating roof tanks containing a total of 46,820 m3 (294,500 barrels) of naphtha were completely destroyed in a major fire that took 5 days to completely extinguish. Fortunately, no-one was killed but 25 people (mainly firefighters) were injured, 5 of them seriously. The 3 identical tanks were 41 m (135 ft) diameter x 20 m (66 ft) high. They were spaced 21 m (70 ft) apart but within a common bund. Just before the incident, 1 of the tanks had been receiving sour straight run naphtha but the tank filling operation had been stopped after the floating roof of the tank was discovered partially submerged. Attempts to transfer product out of the stricken tank had to be stopped when it was observed that the anti-rotation guide pole attached to the shell had been physically displaced. The refinery fire service began to apply foam but ignition occurred about 10 minutes later and the fire immediately developed to a full surface fire. The 2 adjacent naphtha tanks caught fire a few hours later, initially in the rim seal area and rapidly developed to fully involved fires. The fire was so intense it threatened to involve tanks containing kerosene, reformate, motor gasoline, and diesel in adjacent bunded areas.

The immediate cause of the incident was ignition of naphtha vapour in the first tank by static electricity inadvertently generated by application of foam. Critical factors included deferral of inspection and maintenance (corroded annular pontoons were partially flooded with product), the remote location (a small island) and heavy local rainfall at the time. Root causes included inadequate hazard awareness (static electricity generation from application of foam via jet nozzles), inadequate management of change (deferral of scheduled tank inspection and overhaul), inadequate emergency response planning (logistics of shipping firefighting equipment and personnel from mutual aid partners while evacuating non-essential refinery personnel) and inadequate process safety management (cost reduction prioritised over safety).

A key lesson learned is that application of foam by jet nozzles on firefighter’s appliances or remote fire monitors can generate enough static electricity to ignite a fire in a flammable atmosphere. Recent research carried out by the oil industry has shown that applying large volumes of foam rapidly can extinguish even a fully developed tank fire. However, this requires specialist equipment and high capacity pumps, foam generators and pourers or monitors that are specially designed to avoid buildup of static charges and possible ignition. If a floating roof becomes jammed or sinks, it is important that any transfer of oil into or out of the tank is stopped immediately to mitigate the risk of frictional sparks causing ignition.

22/03/2020

INTEGRITY: On 31-Oct-07, a large pool fire developed at the base of a dehexaniser (naphtha splitter) column at the former Petroplus Coryton refinery (UK). Fortunately, there were no injuries but there was significant fire damage to equipment and piping and a substantial opportunity cost (lost production) due to an extended unplanned outage while an investigation and repairs were carried out. The source of the leak was traced to a pipe rupture at the low point at the dead centre of the underside of a short horizontal section of the hydrotreated naphtha feed line close to the dehexaniser feed inlet nozzle.

The immediate cause of the fire was over-pressure and rupture of the dehexaniser feed line at the low point of a short horizontal section due to reduced pipe wall thickness caused by corrosion under insulation (CUI); the leaking preheated sweet naphtha pooled at the base of the column and the resulting vapour cloud found an ignition source.

Critical factors included 1) existence of a clash between the insulated pipe and a structural member supporting an access platform, 2) the dehexaniser column had been delivered to site with the feed piping already installed and insulated but with no access platforms (these had to be installed in the field due to limited headroom beneath elevated piperacks which would have precluded transportation of the column through the refinery on a self-propelled multi-axle trailer), and 3) the affected section of pipe was located in an obscure position (beneath the access platform and approximately 30 m or 98 ft above grade).

Root causes included 1) inadequate design (failure to comply with the project piping standard which required a minimum 25 mm or 1" clearance between the insulated pipe and a structural member), 2) inadequate correction of non-compliant pipe installation (insulation and cladding cut away to address the pipe vs structural member clash), and 3) inadequate inspection and preventative maintenance (weatherproof sealant perished or absent).

For guidance on CUI risk mitigation and management, see the following publication from the UK Health and Safety Executive (HSE):

https://www.hse.gov.uk/foi/internalops/hid_circs/technical_general/spc_tech_gen_18.htm

29/12/2019

SAFETY: On 09-Oct-19, Peter Marsh attended the CompEx 25th Year celebration at the Palace of Westminster. Dr Paul Logan (Director of the UK regulator’s Chemicals Explosives and Microbiological Hazards Division) was a guest speaker at the event. He highlighted a worrying rise in the number of explosions, fires and flammable liquid releases over the last 2 or 3 years in major hazard facilities in the UK which are subject to the Control of Major Accident Hazards (COMAH) regulations. He recommended leaders at COMAH sites increase their focus on competence management to help arrest this trend. He has witnessed several examples of unconscious incompetence where individuals participating in process hazard assessment (PHA) studies have been over-confident and unaware of their own limitations and, as a result, been unaware of some potentially low probability, high consequence process safety hazards. Partial competence can be a dangerous thing!

Experience is a key element of competence but many organisations have lost experienced employees through mergers, restructuring and downsizing. The combined effects of voluntary redundancy schemes and limited recruitment have inadvertently created a demographic shift (ie. an ageing workforce) in some organisations, thereby increasing the risk of additional un-managed loss of expertise in future years through a wave of retirements.

Why not share some good practices used by your organisation to assure the competence of its employees and contractors and offset the loss of experience? Your shared knowledge may just help save someone’s life one day.

22/09/2019

SAFETY: Could you pass the “beer truck” test? Who would do your safety-critical work if you were hit by a beer truck? Would your refinery be able to maintain safe, efficient, reliable and compliant operations?

Many refiners have high-level plans in place to deal with business interruptions caused by extreme weather, fire, cyber-attack, etc. But few have detailed plans in place for assuring knowledge retention and transfer for safety-critical roles at all levels of the organisation (manager, engineer, operator, plant inspector, maintenance planner, etc). Engineers have a responsibility to build a legacy of engineering excellence and to document and share their knowledge and experience. Operators have a responsibility to use their knowledge and skill to maintain and enhance procedures to ensure the plant always operates within its safe operating limits.

Refiners are under relentless pressure to reduce costs to maintain or improve margins. Many have already lost experienced employees through mergers, restructuring and downsizing. The combined effects of voluntary redundancy schemes and limited recruitment have inadvertently created a demographic shift (ie. an ageing workforce) in some organisations, thereby increasing the risk of additional un-managed loss of expertise in future years through a wave of retirements. Consequently, organisations are typically running lean with engineering functions having minimal spare capacity to share knowledge and build expertise. Furthermore, many refineries are now achieving longer runs between turnarounds (fewer startups and shutdowns) and better safety and reliability performance (fewer emergency shutdowns). As a result, operations teams have fewer opportunities to learn from abnormal operations where rapid and correct action can be critical for avoiding escalation to a major process safety incident.

These risks can be mitigated by 1) organisational management of change (MoC) reviews and 2) competency assurance management programmes.

A pre-emptive organisational MoC review conducted on all safety-critical roles in an organisation helps identify critical tasks and define clear roles, responsibilities and accountabilities. The review should include mapping of critical tasks to roles to ensure none are overlooked and should formalise what safety-critical information is to be shared and how. It should also include scenario assessments to ensure that abnormal events and emergencies are adequately covered and that individuals are properly qualified and trained. Mapping safety-critical roles to individual incumbents provides a robust basis for succession planning activities designed to maintain and enhance the skillset of the organisation.

Competency of workers in high hazard industries such as oil refining is critical to process safety performance. Personnel in all safety-critical roles should receive plant-specific initial and refresher training on process hazards, their potential consequences and barriers/safeguards for mitigating these risks. Operators should also receive pertinent training on process chemistry, process variables, control schemes, automatic trip systems, emergency procedures as well as “on the job” training in the field to familiarise themselves with the process equipment on the plant they are responsible for. Gun drills and dynamic training simulators are excellent methods for promoting retention and enhancement of operators' knowledge.

19/02/2019

INTEGRITY: Corrosion under insulation (CUI) is typically caused when insulation gets wet due to water ingress beneath the weather barrier (jacketing), or moisture condensation from steam tracing leaks, cooling tower drift or ambient air in humid and windy climates. CUI occurs where the underlying metal surfaces are not hot enough to keep insulation dry during normal operation and is therefore most prevalent on equipment with metal skin temperatures in the range -4 to 121 Deg C (25 to 250 Deg F). It can be a particular problem at the top sections of carbon steel distillation columns, particularly if the column has external stiffening or insulation support rings which can provide a collection point for water.

There are a wide range of measures available to mitigate CUI. Stiffening and insulation support rings should incorporate drain holes to prevent water accumulation. Carbon and low alloy steel piping and equipment with metal skin temperatures below 60 Deg C (140 Deg F) should be painted with a shop-applied inorganic zinc (IOZ) primer. Where higher temperatures are expected, more specialised coatings such as epoxies or thermal spray aluminium can be used. Impermeable insulation materials such as closed cell foam glass can be selected rather than the more traditional calcium silicate or mineral wool. Joints in insulation jacketing (typically fabricated from aluminium sheet) should be carefully sealed with caulking or mastic. Steam tracing joints should be located outside the jacketing with tracing pipework entering and leaving at the bottom of the jacket section.

CUI generally occurs as pitting corrosion and can be quite localised. It is difficult to detect as visual inspection of the top sections of distillation columns is typically not included in operator’s daily rounds and, in any case, corrosion damage is hidden by the insulation. Inspection ports can be cut into the insulation to enable periodic on-line inspection, but it is important to ensure repairs to damaged jacketing are made with the same jacketing type and that any perished caulking or mastic sealants are replaced to avoid water ingress (photo). Unfortunately, inspection ports only reveal a tiny fraction of the potentially-affected metal service, so periodic stripping, abrasive blasting, re-painting and re-insulating may also be required.

27/01/2019

SAFETY: Flow-induced vibration can lead to fatigue failures of thermowells. Such failures typically occur at the base of the thermowell stem where it attaches to the mounting fl**ge (photo). Since thermowells are an integral part of the pressure containment envelope for process plants, this type of failure can result in a loss of primary containment (LOPC) and potential fire, explosion or toxic release incident.

Process plant debottleneck projects typically include process system hydraulic checks, equipment rating checks, pressure relief system checks, mechanical design temperature and pressure limit checks, etc. Unfortunately, checks for potential flow-induced vibration of thermowells are sometimes overlooked.

Flow-induced vibration occurs because of vortex-shedding when a process fluid flows past an obstruction in its flow path. Calculation of the natural (resonant) frequency for a thermowell and its vortex-shedding frequency at various operating conditions is complex and requires the process engineer and instrument engineer to work together closely. These calculations should be included in the project work scope for any scenarios that may result in higher process stream velocities where thermowells are present (this applies to transient conditions such as catalyst regeneration as well as steady-state conditions). Refer to ASME PTC 19.3 TW for details of the calculation method.

Best practice requires the vortex shedding frequency to be at least 20% below the resonant frequency for the thermowell to avoid fatigue failure. If the thermowell is found to violate this limit, it should be replaced. Historically, this has meant installing a shorter, heavier (thicker) thermowell as this tends to stiffen the thermowell and increase its resonant frequency. A taper profile results in different vortex shedding frequencies over the immersed length thereby reducing the amplitude of vibration. Note, however, that heavier, tapered thermowells have increased thermal mass which will slow response time and shorter thermowells have lower accuracy. The good news is that new thermowell designs are now available which enable vortices to form on both sides of the thermowell, cancelling each other out and virtually eliminating flow-induced vibration (eg. Rosemount Twisted Square, OMC VortexWell, etc).

15/10/2018

SAFETY: 1966 was a great year for sport; highlights included England winning the soccer world cup and St. Kilda winning the Australian Rules football premiership! But it was a disastrous year for the French oil refining industry. On 04-Jan-66, a major release of propane occurred from a storage sphere at the Total Feyzin refinery during a draining operation. This resulted in a huge fire and 2 explosions (18 people killed, 81 injured plus 5 storage spheres, 2 storage bullets and 4 nearby floating roof fuel tanks destroyed).

An Operator was draining water from a propane storage sphere via a DN 50 (2" NS) vertical drain leg below the sphere. The drain leg had 2 isolation valves in series and both were opened but, contrary to the operating procedure, the lower valve was opened half-way first and then the upper valve was opened even further. When draining was almost complete, the upper valve was closed, then cracked open again. No flow was observed from the cracked open valve, so it was opened fully. A blockage (probably ice or hydrate) suddenly cleared and propane gushed out. The handle came off the upper valve and could not be reinstated. An attempt was made to close the lower valve but it had frozen in the half-open position. A vapour cloud formed and drifted to a nearby road where it found an ignition source at a car and flashed back to the sphere causing a fierce fire beneath it. Around 60 minutes later, a boiling liquid expanding vapour explosion (BLEVE) occurred as the sphere ruptured. Flying shrapnel from the ruptured sphere struck the support legs of an adjacent sphere which then collapsed and toppled over. The PSV on the toppled sphere began discharging liquid which further fed the fire and, some 45 minutes later, this second sphere ruptured in another BLEVE.

The immediate cause of the initiating fire was a loss of primary containment (LOPC) of a large quantity of propane from sphere due to incorrect sequential operation of drain leg isolation valves. Critical factors included 1) Ground under sphere was level and 2) Local fire brigade did not attempt to cool the burning sphere, mistakenly believing it would be protected by its PSV (they directed their hoses to cool 4 adjacent spheres instead). Root causes included 1) Failure to follow operating procedure (valve operating sequence), 2) Inadequate design of drainage system (removable valve handles, drain discharged in immediate vicinity of valves), 3) Inadequate design of sphere support legs (not reinforced), 4) Insufficient active (water spray) and passive (insulation) fire protection, 5) Inadequate overpressure protection (no remote depressuring valve) and 6) Local fire brigade had not been briefed on how to deal with this type of incident.

Lessons learned included: 1) Ground below spheres should be sloped to avoid pooling beneath sphere, 2) Sphere support legs should be protected from shrapnel and fire damage, 3) Fire-resistant insulation should be installed on outer surface of sphere to reduce heat input from external fire, 4) Deluge system should be installed to flood outer surface and further reduce heat input (must be regularly tested and maintained), 5) Remote-operated emergency depressuring valve (discharging to flare) to be installed to reduce stress on sphere walls when exposed to external fire, 6) Remote-operated emergency isolation valve to be installed in drain line and 7) Drain line downstream of second (throttling) isolation valve to be DN 19 (max) with discharge routed either to closed system or to remote location beyond footprint of sphere where it can disperse safely.

29/11/2017

SAFETY: As the northern hemisphere winter approaches, here's a timely reminder for refiners to focus on freeze protection of dead-legs and infrequently-used piping and equipment.

On 16-Feb-07, a leak of high pressure propane on a Propane Deasphalting (PDA) unit at Valero McKee refinery formed a large flammable vapour cloud which found an ignition source causing a series of jet fires and collapse of an elevated pipe rack which further fuelled the fire. 3 employees suffered serious burns and several others suffered minor injuries. The fire was so large that the refinery had to be evacuated and the resulting damage forced the refinery to remain shutdown for just under 2 months. It then operated at reduced capacity for nearly 1 year.

The immediate cause of the propane leak was a freeze-related rupture in an elbow below an isolation valve at a redundant control valve station on 1 of 2 propane feed lines to the Extractor Tower which had been taken out of service some 15 years earlier. Critical factors included 1) passing isolation valve at the control valve station due to piece of metal debris trapped between gate and seat, 2) absence of positive isolation of dead-leg from propane supply system, 3) absence of fireproofing on steel support columns of elevated pipe rack some 23 m (77 ft) away and 4) absence of remote-operated emergency block valves (EBVs) to minimise quantity of flammable hydrocarbons leaking. Root causes included 1) inadequate risk assessment (of plant modification and fire exposure of neighbouring process equipment), 2) inadequate design (absence of remote-operated EBVs and structural steel fireproofing) and 3) inadequate freeze protection practices (including periodic inspection of dead-legs and infrequently-used piping and equipment).

The massive fire in this incident almost had further catastrophic consequences. A jet fire caused a large release of highly toxic chlorine gas stored in pressurised cylinders near the PDA unit (used as biocide in cooling water). Fortunately, first responders and all other refinery personnel had already been evacuated from the refinery by then. The intensity of the fire caused by collapse of the elevated pipe rack resulted in paint on the surface of a neighbouring butane storage sphere blistering. If the wind direction had been different and flames had impinged directly on the sphere, there could easily have been a catastrophic rupture and a major explosion. Lessons learned included switching to inherently safer biocide chemicals and relocating pressurised storage vessel water deluge valves to ensure they are accessible in an emergency.

20/10/2017

SAFETY: Flare systems are important safety devices for numerous types of process plant including oil refineries. They are designed to handle emergency process upsets that require release of large volumes of gas and typically achieve > 98% destruction of volatile organic compounds (VOCs). Flaring can produce some undesirable by-products including pollutant (SOx, NOx, CO, etc) emissions, noise, smoke, objectionable odours, light and heat radiation. However these can be minimised through careful design. There are two main categories of flare type; ground flare and elevated flare with subsets in each category. Some sites where flame visibility and smokeless operation are key requirements use open multi-point ground flares for handling operational upsets and (if aircraft flightpath considerations allow) elevated flare(s) for handling very high gas flows in an emergency situation.

Open ground flares comprise a series of staged headers with multiple burner tips spaced across open ground and surrounded by a slatted radiation fence (enables air flow). This arrangement provides almost unlimited turndown capability and helps keep the burners in their optimum operating range and ensures proper mixing with air for complete and smokeless combustion. It also minimises the volume of purge gas required when the load on the flare system is low. Control of the staging can be based on either flare header pressure (preferred) or flare gas flow.

There are occasions, however, when the volume of gas released in a very short period of time is so high that the normal low visibility, low noise, smokeless attributes of the open multi-point ground flare cannot be delivered. The photo shows a ground flare in operation during a site-wide electrical power failure at the Valero Corpus Christi West Plant (Texas, USA). This clearly shows the importance of carefully estimating the maximum flare gas flow and of wind modelling to ensure the flare plume will not dip back towards the ground outside the flare burn area. The exclusion zone around the ground flare radiation fence must be large enough to ensure the hot flare plume does not reach grade or elevated platforms where people may be present.

11/09/2017

SAFETY: Catalyst regeneration in catalytic reforming units is a potentially hazardous operation because the reactors normally operate in a hydrogen-rich atmosphere but catalyst regeneration takes place in an oxygen-containing atmosphere. Inadvertent mixing of the two atmospheres could cause a fire or explosion. The safety hazard is mitigated by ensuring that the two atmospheres remain segregated.

Semi-regenerative catalytic reformers use all of the process equipment in the reaction section to conduct in-situ catalyst regenerations. Consequently the unit has to be shut down and the catalyst in all the reactors is regenerated together. Coke burn is initiated by injecting a carefully controlled flow of air or oxygen into a hot nitrogen stream which is circulated around the reaction section. Segregation of atmospheres is achieved by rigorous enforcement of procedures and use of blinds for positive isolation.

Cyclic catalytic reformers are configured to enable catalyst regeneration in any one reactor while the others remain in service. Each reactor has a special valve and manifold system to allow it to be taken out of service and lined up to a dedicated hot nitrogen circulation loop with air injection. Segregation of atmospheres is achieved by sequential operation of a series of remote-operated double block and bleed valves. In early units, valve movement was initiated from a control panel (photo) and a field operator was dispatched to visually verify correct movement of each valve before movement of the next valve in the sequence was initiated. Unfortunately, his/her proximity to the valves at the most hazardous times in the catalyst regeneration operation placed the field operator in a potentially dangerous situation if anything went wrong. Later or revamped units use valve limit switches and a programmable logic controller (PLC) to prevent valves being moved in the wrong sequence and to avoid placing the field operator in the high hazard area.

Moving bed (“continuous”) catalytic reformers circulate catalyst between series reactors and a dedicated catalyst regeneration tower. Early units approximated continuous catalyst flow by regularly transferring batches of catalyst between reactors and the catalyst regeneration system. Segregation of the reducing and the oxidising atmospheres was achieved using a series of small vessels and isolation valves controlled by a PLC-based sequential logic system. Later units use a valveless catalyst transfer system to achieve true continuous catalyst flow and use “nitrogen bubbles” with system pressures controlled by a PLC to keep the atmospheres in the two systems segregated.

This is just one example of how technology advances over the years have improved product yields, plant reliability and process safety.

02/08/2017

INTEGRITY: Internal thinning and subsequent rupture of carbon steel boiler feedwater piping can result in significant plant downtime and can potentially be a serious safety hazard as ruptures can occur unexpectedly and close to work areas and walkways (photo). Boiler feedwater on most process and utility steam generation boilers consists of a mixture of treated makeup water and recovered steam condensate. Both are routed to a deaerator to remove oxygen (O2) and carbon dioxide (CO2) and chemicals are added to adjust pH and remove any residual O2 and CO2.

Carbon steel boiler feedwater piping is normally protected from corrosion by an internal surface layer of iron oxide but thinning can occur where locally corrosive or erosive conditions destroy this normally protective oxide. Typical causes of such thinning are one or more of the following; high concentrations of dissolved oxygen and/or carbon dioxide (CO2), low pH, moderate temperature and localised high velocity (especially in areas of turbulence or high pressure drop). Consequently, boiler feedwater piping located between the preheater (if applicable) and the deaerator is particularly susceptible.

O2 enters with makeup water due to air contact in atmospheric water storage tanks or air leakage on the suction side of pumps. CO2 enters with makeup water either as carbonate alkalinity or dissolved gas (especially if returned condensate from a hydrogen plant is used). The pH of the makeup water depends on its source and the accuracy/effectiveness of water chemistry controls. Note that deaerator efficiency may be adversely affected by inadequate water chemistry control. As a general rule, the pH of the makeup water should be maintained between 8.5 and 9.5. Localised high velocities and turbulence are found in pump internals and downstream of control valves, or***ce plates, elbows and other fittings. Excessive localised velocities can lead to flow accelerated corrosion (FAC), particularly at temperatures in the range 120 - 200 Deg. C (250 - 400 Deg. F).

XBP Refining Consultants Ltd.

12/04/2021

22/03/2020

29/12/2019

22/09/2019

19/02/2019

27/01/2019

15/10/2018

29/11/2017

20/10/2017

11/09/2017

02/08/2017

Address

Telephone

Website

Alerts

Contact The Business

Shortcuts

Share

Category