SAFETY: On 25-Oct-88, at the SRC Pulau Merlimau (island) refinery, 3 floating roof tanks containing a total of 46,820 m3 (294,500 barrels) of naphtha were completely destroyed in a major fire that took 5 days to completely extinguish. Fortunately, no-one was killed but 25 people (mainly firefighters) were injured, 5 of them seriously. The 3 identical tanks were 41 m (135 ft) diameter x 20 m (66 ft) high. They were spaced 21 m (70 ft) apart but within a common bund. Just before the incident, 1 of the tanks had been receiving sour straight run naphtha but the tank filling operation had been stopped after the floating roof of the tank was discovered partially submerged. Attempts to transfer product out of the stricken tank had to be stopped when it was observed that the anti-rotation guide pole attached to the shell had been physically displaced. The refinery fire service began to apply foam but ignition occurred about 10 minutes later and the fire immediately developed to a full surface fire. The 2 adjacent naphtha tanks caught fire a few hours later, initially in the rim seal area and rapidly developed to fully involved fires. The fire was so intense it threatened to involve tanks containing kerosene, reformate, motor gasoline, and diesel in adjacent bunded areas.
The immediate cause of the incident was ignition of naphtha vapour in the first tank by static electricity inadvertently generated by application of foam. Critical factors included deferral of inspection and maintenance (corroded annular pontoons were partially flooded with product), the remote location (a small island) and heavy local rainfall at the time. Root causes included inadequate hazard awareness (static electricity generation from application of foam via jet nozzles), inadequate management of change (deferral of scheduled tank inspection and overhaul), inadequate emergency response planning (logistics of shipping firefighting equipment and personnel from mutual aid partners while evacuating non-essential refinery personnel) and inadequate process safety management (cost reduction prioritised over safety).
A key lesson learned is that application of foam by jet nozzles on firefighter’s appliances or remote fire monitors can generate enough static electricity to ignite a fire in a flammable atmosphere. Recent research carried out by the oil industry has shown that applying large volumes of foam rapidly can extinguish even a fully developed tank fire. However, this requires specialist equipment and high capacity pumps, foam generators and pourers or monitors that are specially designed to avoid buildup of static charges and possible ignition. If a floating roof becomes jammed or sinks, it is important that any transfer of oil into or out of the tank is stopped immediately to mitigate the risk of frictional sparks causing ignition. ... See MoreSee Less
A long time ago I proposed a nitrogen blanket feed at the top of the tanks but it was rejected as if inadvertently it leaked or was misused then a nitrogen filled confined space could be created. Perhaps a dry riser that could be connected to an N2 supply in an emergency might give a safety blanket? Risk v reward I suppose.
INTEGRITY: On 31-Oct-07, a large pool fire developed at the base of a dehexaniser (naphtha splitter) column at the former Petroplus Coryton refinery (UK). Fortunately, there were no injuries but there was significant fire damage to equipment and piping and a substantial opportunity cost (lost production) due to an extended unplanned outage while an investigation and repairs were carried out. The source of the leak was traced to a pipe rupture at the low point at the dead centre of the underside of a short horizontal section of the hydrotreated naphtha feed line close to the dehexaniser feed inlet nozzle.
The immediate cause of the fire was over-pressure and rupture of the dehexaniser feed line at the low point of a short horizontal section due to reduced pipe wall thickness caused by corrosion under insulation (CUI); the leaking preheated sweet naphtha pooled at the base of the column and the resulting vapour cloud found an ignition source.
Critical factors included 1) existence of a clash between the insulated pipe and a structural member supporting an access platform, 2) the dehexaniser column had been delivered to site with the feed piping already installed and insulated but with no access platforms (these had to be installed in the field due to limited headroom beneath elevated piperacks which would have precluded transportation of the column through the refinery on a self-propelled multi-axle trailer), and 3) the affected section of pipe was located in an obscure position (beneath the access platform and approximately 30 m or 98 ft above grade).
Root causes included 1) inadequate design (failure to comply with the project piping standard which required a minimum 25 mm or 1" clearance between the insulated pipe and a structural member), 2) inadequate correction of non-compliant pipe installation (insulation and cladding cut away to address the pipe vs structural member clash), and 3) inadequate inspection and preventative maintenance (weatherproof sealant perished or absent).
For guidance on CUI risk mitigation and management, see the following publication from the UK Health and Safety Executive (HSE):
SAFETY: On 09-Oct-19, Peter Marsh attended the CompEx 25th Year celebration at the Palace of Westminster. Dr Paul Logan (Director of the UK regulator’s Chemicals Explosives and Microbiological Hazards Division) was a guest speaker at the event. He highlighted a worrying rise in the number of explosions, fires and flammable liquid releases over the last 2 or 3 years in major hazard facilities in the UK which are subject to the Control of Major Accident Hazards (COMAH) regulations. He recommended leaders at COMAH sites increase their focus on competence management to help arrest this trend. He has witnessed several examples of unconscious incompetence where individuals participating in process hazard assessment (PHA) studies have been over-confident and unaware of their own limitations and, as a result, been unaware of some potentially low probability, high consequence process safety hazards. Partial competence can be a dangerous thing!
Experience is a key element of competence but many organisations have lost experienced employees through mergers, restructuring and downsizing. The combined effects of voluntary redundancy schemes and limited recruitment have inadvertently created a demographic shift (ie. an ageing workforce) in some organisations, thereby increasing the risk of additional un-managed loss of expertise in future years through a wave of retirements.
Why not share some good practices used by your organisation to assure the competence of its employees and contractors and offset the loss of experience? Your shared knowledge may just help save someone’s life one day. ... See MoreSee Less
SAFETY: Could you pass the “beer truck” test? Who would do your safety-critical work if you were hit by a beer truck? Would your refinery be able to maintain safe, efficient, reliable and compliant operations?
Many refiners have high-level plans in place to deal with business interruptions caused by extreme weather, fire, cyber-attack, etc. But few have detailed plans in place for assuring knowledge retention and transfer for safety-critical roles at all levels of the organisation (manager, engineer, operator, plant inspector, maintenance planner, etc). Engineers have a responsibility to build a legacy of engineering excellence and to document and share their knowledge and experience. Operators have a responsibility to use their knowledge and skill to maintain and enhance procedures to ensure the plant always operates within its safe operating limits.
Refiners are under relentless pressure to reduce costs to maintain or improve margins. Many have already lost experienced employees through mergers, restructuring and downsizing. The combined effects of voluntary redundancy schemes and limited recruitment have inadvertently created a demographic shift (ie. an ageing workforce) in some organisations, thereby increasing the risk of additional un-managed loss of expertise in future years through a wave of retirements. Consequently, organisations are typically running lean with engineering functions having minimal spare capacity to share knowledge and build expertise. Furthermore, many refineries are now achieving longer runs between turnarounds (fewer startups and shutdowns) and better safety and reliability performance (fewer emergency shutdowns). As a result, operations teams have fewer opportunities to learn from abnormal operations where rapid and correct action can be critical for avoiding escalation to a major process safety incident.
These risks can be mitigated by 1) organisational management of change (MoC) reviews and 2) competency assurance management programmes.
A pre-emptive organisational MoC review conducted on all safety-critical roles in an organisation helps identify critical tasks and define clear roles, responsibilities and accountabilities. The review should include mapping of critical tasks to roles to ensure none are overlooked and should formalise what safety-critical information is to be shared and how. It should also include scenario assessments to ensure that abnormal events and emergencies are adequately covered and that individuals are properly qualified and trained. Mapping safety-critical roles to individual incumbents provides a robust basis for succession planning activities designed to maintain and enhance the skillset of the organisation.
Competency of workers in high hazard industries such as oil refining is critical to process safety performance. Personnel in all safety-critical roles should receive plant-specific initial and refresher training on process hazards, their potential consequences and barriers/safeguards for mitigating these risks. Operators should also receive pertinent training on process chemistry, process variables, control schemes, automatic trip systems, emergency procedures as well as “on the job” training in the field to familiarise themselves with the process equipment on the plant they are responsible for. Gun drills and dynamic training simulators are excellent methods for promoting retention and enhancement of operators' knowledge. ... See MoreSee Less
Thanks Sean. I normally manage to limit my work blogs to a max of 2 or 3 paragraphs but failed miserably this time!
Setting aside for a moment how much I miss Adnam’s, I totally agree. Other than my time at Coryton, I’ve never worked for a refiner that valued knowledge retention and organizational MOC
Long post but all important...
INTEGRITY: Corrosion under insulation (CUI) is typically caused when insulation gets wet due to water ingress beneath the weather barrier (jacketing), or moisture condensation from steam tracing leaks, cooling tower drift or ambient air in humid and windy climates. CUI occurs where the underlying metal surfaces are not hot enough to keep insulation dry during normal operation and is therefore most prevalent on equipment with metal skin temperatures in the range -4 to 121 Deg C (25 to 250 Deg F). It can be a particular problem at the top sections of carbon steel distillation columns, particularly if the column has external stiffening or insulation support rings which can provide a collection point for water.
There are a wide range of measures available to mitigate CUI. Stiffening and insulation support rings should incorporate drain holes to prevent water accumulation. Carbon and low alloy steel piping and equipment with metal skin temperatures below 60 Deg C (140 Deg F) should be painted with a shop-applied inorganic zinc (IOZ) primer. Where higher temperatures are expected, more specialised coatings such as epoxies or thermal spray aluminium can be used. Impermeable insulation materials such as closed cell foam glass can be selected rather than the more traditional calcium silicate or mineral wool. Joints in insulation jacketing (typically fabricated from aluminium sheet) should be carefully sealed with caulking or mastic. Steam tracing joints should be located outside the jacketing with tracing pipework entering and leaving at the bottom of the jacket section.
CUI generally occurs as pitting corrosion and can be quite localised. It is difficult to detect as visual inspection of the top sections of distillation columns is typically not included in operator’s daily rounds and, in any case, corrosion damage is hidden by the insulation. Inspection ports can be cut into the insulation to enable periodic on-line inspection, but it is important to ensure repairs to damaged jacketing are made with the same jacketing type and that any perished caulking or mastic sealants are replaced to avoid water ingress (photo). Unfortunately, inspection ports only reveal a tiny fraction of the potentially-affected metal service, so periodic stripping, abrasive blasting, re-painting and re-insulating may also be required. ... See MoreSee Less
SAFETY: Flow-induced vibration can lead to fatigue failures of thermowells. Such failures typically occur at the base of the thermowell stem where it attaches to the mounting flange (photo). Since thermowells are an integral part of the pressure containment envelope for process plants, this type of failure can result in a loss of primary containment (LOPC) and potential fire, explosion or toxic release incident.
Process plant debottleneck projects typically include process system hydraulic checks, equipment rating checks, pressure relief system checks, mechanical design temperature and pressure limit checks, etc. Unfortunately, checks for potential flow-induced vibration of thermowells are sometimes overlooked.
Flow-induced vibration occurs because of vortex-shedding when a process fluid flows past an obstruction in its flow path. Calculation of the natural (resonant) frequency for a thermowell and its vortex-shedding frequency at various operating conditions is complex and requires the process engineer and instrument engineer to work together closely. These calculations should be included in the project work scope for any scenarios that may result in higher process stream velocities where thermowells are present (this applies to transient conditions such as catalyst regeneration as well as steady-state conditions). Refer to ASME PTC 19.3 TW for details of the calculation method.
Best practice requires the vortex shedding frequency to be at least 20% below the resonant frequency for the thermowell to avoid fatigue failure. If the thermowell is found to violate this limit, it should be replaced. Historically, this has meant installing a shorter, heavier (thicker) thermowell as this tends to stiffen the thermowell and increase its resonant frequency. A taper profile results in different vortex shedding frequencies over the immersed length thereby reducing the amplitude of vibration. Note, however, that heavier, tapered thermowells have increased thermal mass which will slow response time and shorter thermowells have lower accuracy. The good news is that new thermowell designs are now available which enable vortices to form on both sides of the thermowell, cancelling each other out and virtually eliminating flow-induced vibration (eg. Rosemount Twisted Square, OMC VortexWell, etc). ... See MoreSee Less
SAFETY: 1966 was a great year for sport; highlights included England winning the soccer world cup and St. Kilda winning the Australian Rules football premiership! But it was a disastrous year for the French oil refining industry. On 04-Jan-66, a major release of propane occurred from a storage sphere at the Total Feyzin refinery during a draining operation. This resulted in a huge fire and 2 explosions (18 people killed, 81 injured plus 5 storage spheres, 2 storage bullets and 4 nearby floating roof fuel tanks destroyed).
An Operator was draining water from a propane storage sphere via a DN 50 (2" NS) vertical drain leg below the sphere. The drain leg had 2 isolation valves in series and both were opened but, contrary to the operating procedure, the lower valve was opened half-way first and then the upper valve was opened even further. When draining was almost complete, the upper valve was closed, then cracked open again. No flow was observed from the cracked open valve, so it was opened fully. A blockage (probably ice or hydrate) suddenly cleared and propane gushed out. The handle came off the upper valve and could not be reinstated. An attempt was made to close the lower valve but it had frozen in the half-open position. A vapour cloud formed and drifted to a nearby road where it found an ignition source at a car and flashed back to the sphere causing a fierce fire beneath it. Around 60 minutes later, a boiling liquid expanding vapour explosion (BLEVE) occurred as the sphere ruptured. Flying shrapnel from the ruptured sphere struck the support legs of an adjacent sphere which then collapsed and toppled over. The PSV on the toppled sphere began discharging liquid which further fed the fire and, some 45 minutes later, this second sphere ruptured in another BLEVE.
The immediate cause of the initiating fire was a loss of primary containment (LOPC) of a large quantity of propane from sphere due to incorrect sequential operation of drain leg isolation valves. Critical factors included 1) Ground under sphere was level and 2) Local fire brigade did not attempt to cool the burning sphere, mistakenly believing it would be protected by its PSV (they directed their hoses to cool 4 adjacent spheres instead). Root causes included 1) Failure to follow operating procedure (valve operating sequence), 2) Inadequate design of drainage system (removable valve handles, drain discharged in immediate vicinity of valves), 3) Inadequate design of sphere support legs (not reinforced), 4) Insufficient active (water spray) and passive (insulation) fire protection, 5) Inadequate overpressure protection (no remote depressuring valve) and 6) Local fire brigade had not been briefed on how to deal with this type of incident.
Lessons learned included: 1) Ground below spheres should be sloped to avoid pooling beneath sphere, 2) Sphere support legs should be protected from shrapnel and fire damage, 3) Fire-resistant insulation should be installed on outer surface of sphere to reduce heat input from external fire, 4) Deluge system should be installed to flood outer surface and further reduce heat input (must be regularly tested and maintained), 5) Remote-operated emergency depressuring valve (discharging to flare) to be installed to reduce stress on sphere walls when exposed to external fire, 6) Remote-operated emergency isolation valve to be installed in drain line and 7) Drain line downstream of second (throttling) isolation valve to be DN 19 (max) with discharge routed either to closed system or to remote location beyond footprint of sphere where it can disperse safely. ... See MoreSee Less
Thanks for sharing
.I wonder if it is one of the key incidents in history which made the industry understand better what a BLEVE is and what it's capable of? The time it took from fire/PSVs lift and BLEVEs strikes me and I wonder had there been personnel still within close proximity all that time.. emergency or operators. Hindsight makes it easier to see what went wrong. But we do need to remember history and not repeat. As well as look forward. Thanks for reminder.
SAFETY: As the northern hemisphere winter approaches, here's a timely reminder for refiners to focus on freeze protection of dead-legs and infrequently-used piping and equipment.
On 16-Feb-07, a leak of high pressure propane on a Propane Deasphalting (PDA) unit at Valero McKee refinery formed a large flammable vapour cloud which found an ignition source causing a series of jet fires and collapse of an elevated pipe rack which further fuelled the fire. 3 employees suffered serious burns and several others suffered minor injuries. The fire was so large that the refinery had to be evacuated and the resulting damage forced the refinery to remain shutdown for just under 2 months. It then operated at reduced capacity for nearly 1 year.
The immediate cause of the propane leak was a freeze-related rupture in an elbow below an isolation valve at a redundant control valve station on 1 of 2 propane feed lines to the Extractor Tower which had been taken out of service some 15 years earlier. Critical factors included 1) passing isolation valve at the control valve station due to piece of metal debris trapped between gate and seat, 2) absence of positive isolation of dead-leg from propane supply system, 3) absence of fireproofing on steel support columns of elevated pipe rack some 23 m (77 ft) away and 4) absence of remote-operated emergency block valves (EBVs) to minimise quantity of flammable hydrocarbons leaking. Root causes included 1) inadequate risk assessment (of plant modification and fire exposure of neighbouring process equipment), 2) inadequate design (absence of remote-operated EBVs and structural steel fireproofing) and 3) inadequate freeze protection practices (including periodic inspection of dead-legs and infrequently-used piping and equipment).
The massive fire in this incident almost had further catastrophic consequences. A jet fire caused a large release of highly toxic chlorine gas stored in pressurised cylinders near the PDA unit (used as biocide in cooling water). Fortunately, first responders and all other refinery personnel had already been evacuated from the refinery by then. The intensity of the fire caused by collapse of the elevated pipe rack resulted in paint on the surface of a neighbouring butane storage sphere blistering. If the wind direction had been different and flames had impinged directly on the sphere, there could easily have been a catastrophic rupture and a major explosion. Lessons learned included switching to inherently safer biocide chemicals and relocating pressurised storage vessel water deluge valves to ensure they are accessible in an emergency. ... See MoreSee Less
One from Coryton before your time. ground level pipe track at back of lube leg was allowed to flood every winter ( probably leading to under lagging corrosion) as temps dropped it iced over. This froze the condensate system from the hp steam traps and led to a condensate slug that “ straightened out” the expansion loop in the steam main.
On a serious, but not quite so severe note is the issue of steam leaks in winter. Prior to moving to the US, I was not aware of this winter problem. During my first New Jersey winter, however, I learned about the hazard of large ice formations caused by steam leaks. Steam leaks can create huge icicles in low ambient temperatures, growing sometimes to 10 or 15 ft long, often in high places, with the potential to break off and fall if disturbed (e.g. by the wind, or vibration). The consequences of falling ice striking people or equipment could obviously be severe. The solutions might entail fixing the leak before it freezes, barricading off risk areas and personnel being extra vigilant in looking out for such hazards.
SAFETY: Flare systems are important safety devices for numerous types of process plant including oil refineries. They are designed to handle emergency process upsets that require release of large volumes of gas and typically achieve > 98% destruction of volatile organic compounds (VOCs). Flaring can produce some undesirable by-products including pollutant (SOx, NOx, CO, etc) emissions, noise, smoke, objectionable odours, light and heat radiation. However these can be minimised through careful design. There are two main categories of flare type; ground flare and elevated flare with subsets in each category. Some sites where flame visibility and smokeless operation are key requirements use open multi-point ground flares for handling operational upsets and (if aircraft flightpath considerations allow) elevated flare(s) for handling very high gas flows in an emergency situation.
Open ground flares comprise a series of staged headers with multiple burner tips spaced across open ground and surrounded by a slatted radiation fence (enables air flow). This arrangement provides almost unlimited turndown capability and helps keep the burners in their optimum operating range and ensures proper mixing with air for complete and smokeless combustion. It also minimises the volume of purge gas required when the load on the flare system is low. Control of the staging can be based on either flare header pressure (preferred) or flare gas flow.
There are occasions, however, when the volume of gas released in a very short period of time is so high that the normal low visibility, low noise, smokeless attributes of the open multi-point ground flare cannot be delivered. The photo shows a ground flare in operation during a site-wide electrical power failure at the Valero Corpus Christi West Plant (Texas, USA). This clearly shows the importance of carefully estimating the maximum flare gas flow and of wind modelling to ensure the flare plume will not dip back towards the ground outside the flare burn area. The exclusion zone around the ground flare radiation fence must be large enough to ensure the hot flare plume does not reach grade or elevated platforms where people may be present. ... See MoreSee Less
The bane of my life on the panel. Never had a good control system for the purge steam, never had reliable pilot lights and ignition systems, never had reliable flame out detection. Lots of good people looked at the problem but we never had a solution that could get through the financial justification.
SAFETY: Catalyst regeneration in catalytic reforming units is a potentially hazardous operation because the reactors normally operate in a hydrogen-rich atmosphere but catalyst regeneration takes place in an oxygen-containing atmosphere. Inadvertent mixing of the two atmospheres could cause a fire or explosion. The safety hazard is mitigated by ensuring that the two atmospheres remain segregated.
Semi-regenerative catalytic reformers use all of the process equipment in the reaction section to conduct in-situ catalyst regenerations. Consequently the unit has to be shut down and the catalyst in all the reactors is regenerated together. Coke burn is initiated by injecting a carefully controlled flow of air or oxygen into a hot nitrogen stream which is circulated around the reaction section. Segregation of atmospheres is achieved by rigorous enforcement of procedures and use of blinds for positive isolation.
Cyclic catalytic reformers are configured to enable catalyst regeneration in any one reactor while the others remain in service. Each reactor has a special valve and manifold system to allow it to be taken out of service and lined up to a dedicated hot nitrogen circulation loop with air injection. Segregation of atmospheres is achieved by sequential operation of a series of remote-operated double block and bleed valves. In early units, valve movement was initiated from a control panel (photo) and a field operator was dispatched to visually verify correct movement of each valve before movement of the next valve in the sequence was initiated. Unfortunately, his/her proximity to the valves at the most hazardous times in the catalyst regeneration operation placed the field operator in a potentially dangerous situation if anything went wrong. Later or revamped units use valve limit switches and a programmable logic controller (PLC) to prevent valves being moved in the wrong sequence and to avoid placing the field operator in the high hazard area.
Moving bed (“continuous”) catalytic reformers circulate catalyst between series reactors and a dedicated catalyst regeneration tower. Early units approximated continuous catalyst flow by regularly transferring batches of catalyst between reactors and the catalyst regeneration system. Segregation of the reducing and the oxidising atmospheres was achieved using a series of small vessels and isolation valves controlled by a PLC-based sequential logic system. Later units use a valveless catalyst transfer system to achieve true continuous catalyst flow and use “nitrogen bubbles” with system pressures controlled by a PLC to keep the atmospheres in the two systems segregated.
This is just one example of how technology advances over the years have improved product yields, plant reliability and process safety. ... See MoreSee Less
INTEGRITY: Internal thinning and subsequent rupture of carbon steel boiler feedwater piping can result in significant plant downtime and can potentially be a serious safety hazard as ruptures can occur unexpectedly and close to work areas and walkways (photo). Boiler feedwater on most process and utility steam generation boilers consists of a mixture of treated makeup water and recovered steam condensate. Both are routed to a deaerator to remove oxygen (O2) and carbon dioxide (CO2) and chemicals are added to adjust pH and remove any residual O2 and CO2.
Carbon steel boiler feedwater piping is normally protected from corrosion by an internal surface layer of iron oxide but thinning can occur where locally corrosive or erosive conditions destroy this normally protective oxide. Typical causes of such thinning are one or more of the following; high concentrations of dissolved oxygen and/or carbon dioxide (CO2), low pH, moderate temperature and localised high velocity (especially in areas of turbulence or high pressure drop). Consequently, boiler feedwater piping located between the preheater (if applicable) and the deaerator is particularly susceptible.
O2 enters with makeup water due to air contact in atmospheric water storage tanks or air leakage on the suction side of pumps. CO2 enters with makeup water either as carbonate alkalinity or dissolved gas (especially if returned condensate from a hydrogen plant is used). The pH of the makeup water depends on its source and the accuracy/effectiveness of water chemistry controls. Note that deaerator efficiency may be adversely affected by inadequate water chemistry control. As a general rule, the pH of the makeup water should be maintained between 8.5 and 9.5. Localised high velocities and turbulence are found in pump internals and downstream of control valves, orifice plates, elbows and other fittings. Excessive localised velocities can lead to flow accelerated corrosion (FAC), particularly at temperatures in the range 120 - 200 Deg. C (250 - 400 Deg. F). ... See MoreSee Less
RELIABILITY: Solid particles and/or water droplets in the motive steam supply to (API 612 or equivalent) special purpose steam turbines driving process gas compressors can cause serious erosion damage or even mechanical failure of rotating and stationary blade sets in the turbine (photo). This typically results in a slowdown (to avoid exceeding vibration limits) or a shutdown (to inspect and repair damage) of the machine with domino impacts for availability (on-stream factor) of the initiating process unit and any other affected process units.
Solid particles (eg. mill scale or corrosion products) in the motive steam supply typically cause erosion of blades at the high pressure (inlet) side of the turbine. Water droplets (eg. carryover or condensation) in the motive steam supply typically cause erosion of blades at the low pressure (exhaust) side of the turbine.
In most refineries, the motive steam supply is superheated so water droplet carryover is relatively rare unless there is problem during commissioning (eg. failure to insulate steam supply piping after steam blowing operation), a startup problem (eg. inadequate warmup of steam mains or blocked drains), an operational problem (eg. steam drum foamover due to inadequate boiler feedwater chemistry control) or a control system failure (eg. steam drum level transmitter failure or desuperheater control valve failure). ... See MoreSee Less
May I ask Pete, was this the old K2 rotor at Coryton?
Hi Jon. As the Black Knight from Monty Python and the Holy Grail once said "Its just a flesh wound" and carried on fighting. Similarly, the implications of erosion damage depend on severity. Erosion of turbine blades creates rough, uneven surfaces which alter the steam paths through the turbine. This reduces the efficiency of the turbine and may limit its power output, but it may still be possible to operate the machine safely. However, failure of one or more rotor blades may create excessive radial vibration leading to bearing failure and possible catastrophic damage to the turbine. Injecting carbon granuals is a carefully controlled short-term procedure whereas solid particle or water droplet entrainment is uncontrolled and may persist for an extended period.
why is this such a problem ( obviously is) whilst ships turbines are cleaned by dry washing ( injecting carbon granuals into gas stream at normal operaring conditions) ?
INTEGRITY: Brittle fracture is a sudden, very rapid, catastrophic failure of a material with little or no evidence of thinning or necking at the fracture face. Carbon steels and low alloy Cr-Mo steels are the most susceptible grades of steel to brittle fracture. Susceptibility to brittle fracture increases if the steel has suffered temper embrittlement. Temper embrittlement causes loss of toughness in low alloy Cr-Mo steels after extended exposure to temperatures in the range 327 - 593 Deg. C (621 - 1100 Deg. F), although the effect is most pronounced in the range 427 - 510 Deg. C (801 - 950 Deg. F). This loss of toughness is only evident when the steel is exposed to relatively low temperatures (eg. during startup, shutdown or hydrostatic testing) and is caused by segregation of tramp elements and alloying elements along the grain boundaries of the steel. The composition of the steel, the metal temperature and exposure time versus temperature (thermal history) are all critical factors affecting the likelihood of temper embrittlement occurring.
The TEMA type BEU exchanger in the photo suffered a catastrophic failure of the channel head during hydrostatic testing at turnaround. The channel head was fabricated from 40 mm (1.57 in) thick 2.25 Cr/0.5 Mo steel plate while the channel flange was fabricated from 195 mm (7.68 in) thick 1.25 Cr/0.5 Mo forged steel. The failure occurred at a pressure well below the specified tubeside hydrotest pressure and the hydrotest water temperature was well above the minimum allowable temperature. Fortunately, no-one was hurt but restart of the unit was delayed by 20 days while the failed exchanger was bypassed and the unit operated at reduced capacity for several months until a replacement exchanger could be installed.
The failed exchanger had been in service for approximately 23 years as a combined feed exchanger (CFE) on a semi-regenerative catalytic reforming unit (CRU). The tubeside fluid was reactor effluent which entered the channel head at approximately 25.5 barg (370 psig) and 480 - 530 Deg. C (896 - 986 Deg. F). The immediate cause of the failure was brittle fracture due to temper embrittlement. Critical factors included the age, composition and thermal history of the channel head and the specified hydrotest pressure which was well above that required to meet the “two thirds design rule” mandated by the prevailing ASME VIII Div. 1 (1977) design code. This rule allowed tube rupture to be exempted as a credible scenario for shell failure if the specified tubeside hydrotest pressure exceeded 150% of the shellside maximum allowable working pressure (MAWP). ... See MoreSee Less
SAFETY: On 18-Feb-15, an explosion occurred in an electrostatic precipitator (ESP) on the Fluid Catalytic Cracking (FCC) unit at the ExxonMobil Torrance refinery (California, USA). The FCC was in “safe park” mode at the time. Shrapnel from the explosion damaged nearby process equipment and came very close to puncturing 2 vessels on the adjacent Modified Hydrofluoric Acid Alkylation (MHFA) unit which contained a large inventory of extremely toxic hydrofluoric (HF) acid. Fortunately there were no fatalities, but 4 contactors suffered minor injuries while fleeing the explosion area and required first aid treatment. (Photo courtesy Reuters).
The immediate cause of the explosion was ignition of a mixture of flammable hydrocarbon vapours from the FCC reaction system and combustion air from the auxiliary air blowers of the CO Boiler in the FCC regenerator flue gas system triggered by sparks generated in the ESP which had remained energised in spite of the FCC being in safe park at the time. Safe park mode includes automatic shutdown of the regenerated and spent catalyst slide valves (RCSV and SCSV), automatic isolation of feed to the reaction system, automatic shutdown of the air blower and flue gas expander, and automatic introduction of steam to the reaction system. Critical factors included erosion of the SCSV internals (resulting in loss of catalyst seal), inadequate steam flow (resulting in an inadequate segregation of hydrocarbon-containing and air-containing atmospheres) and heat exchanger tube failures (resulting in naphtha vapour migrating into the reaction system and ultimately to the regenerator flue gas system). Root causes included inadequate process hazard analysis (PHA) and management of change (MoC), inadequate instrumentation and failure to comply with refinery isolation standards.
It is imperative that safety-critical equipment is properly maintained and that all possible modes of unit operation (including safe park) are considered during PHA studies. Electrical power to ESPs in FCC service should be isolated if there is a risk of a combustible or explosive mixture entering the ESP. ExxonMobil relied on a CO analyser in the flue gas system believing CO can be used as a proxy for hydrocarbon carryover from the reaction system. However this incident showed that hydrocarbon vapours can enter the FCC regenerator flue gas system with no CO present because there may be insufficient heat to initiate combustion in the FCC regenerator with the unit in safe park mode. ... See MoreSee Less
SAFETY: Nickel carbonyl formation can occur when catalysts or adsorbents containing dispersed nickel come into contact with carbon monoxide (CO) at temperatures below 200 Deg. C (392 Deg. F). Nickel carbonyl is a highly toxic colourless or pale yellow liquid at ambient temperature and pressure and is highly volatile. It is an irritant to eyes, skin, nose and throat and is a suspected carcinogen. Exposure through inhalation, ingestion, or skin/eye contact can cause headaches, dizziness, nausea, confusion and can irritate lungs leading to severe shortness of breath. The current 8-hour occupational exposure limit for nickel carbonyl is 0.001 ppm (1 ppb).
Nickel carbonyl formation represents a significant safety hazard to personnel involved in unloading of spent nickel-containing catalysts and adsorbents used in hydrocrackers, hydrotreaters, steam reformers, methanator reactors, sulphur adsorbers, etc. Possible sources of CO include residual CO in hydrogen produced by steam reforming or partial oxidation, trace CO in hydrogen net gas produced from CCR Platformer by reverse methanation, oxygenates in hydrotreater feed or partial combustion of pyrophoric materials (air ingress to system).
Best practice to avoid nickel carbonyl formation is to keep any gas streams (eg. makeup gas, recycle gas, inert gas) containing more than 10 ppmv of CO away from all nickel-containing catalyst and absorbent beds where temperatures are below 200 Deg. C (392 Deg. F). In practical terms this usually means switching from hydrogen sweep to high purity nitrogen purge once bed temperatures approach 200 Deg. C at shutdown. If accidental exposure of the catalyst or adsorbent bed to CO occurs below 200 Deg. C, the bed should be reheated to at least 220 Deg. C (428 Deg. F) and purged with a CO-free gas stream for at least an hour. ... See MoreSee Less
Thanks Ian. Sadly there have been several fatalities resulting from nickel carbonyl exposure over the years but most were several decades ago. Consequently there has been a gradual loss of awareness of this particular hazard in the oil refining industry in recent times.
Thanks, Pete! I'd never even heard of this
SAFETY: Liquid overfill events have caused several major accidents at refineries over the years. Examples include Texaco Pembroke FCC Debutaniser (24-Jul-94) and BP Texas City Raffinate Splitter (23-Mar-05). However, in addition to these high profile accidents, there have been and continue to be many more liquid overfill events which are classed as "near misses" and are not widely reported. A near miss can be defined as an undesirable event which, under different circumstances, could have resulted in a process safety incident.
Displacer (float) and dP cell type instruments are commonly used for level measurement and control in distillation columns. However it is important to recognise that for both of these types of instrument the indicated level is sensitive to the liquid density at the tower operating conditions. Consequently, they should be calibrated on the lowest expected liquid density (which may be at startup or other abnormal conditions). Both these types of instruments are also sensitive to liquid flowing into the level chamber through the upper level tap in the vapour space. Consequently, the elevation and orientation of the level taps relative to the column internals is important (eg. a high level on a chimney tray could cause liquid to flow into the upper level tap and affect the indicated level). Note that if the float is a magnetic type, the indicated level can also be affected by iron scale accumulation around the magnetic rings of the float which increases its weight (photo).
Best practice for level instrument selection is to use diverse instrument types to avoid common mode failures. On standard distillation columns, guided wave radar (GWR) can be used as the primary level control indicator (not sensitive to liquid density) and a long span dP cell (preferably 3 m or more) can be used as the secondary level control indicator (calibrated to the lowest expected liquid density). A level gauge glass with a span exceeding the control range should also be provided. A column material balance and a deviation alarm comparing primary and secondary indicated levels could be provided on the control board. For distillation column applications requiring a higher safety integrity level (SIL), refer to IEC 6511 for safety instrumented system design guidelines. ... See MoreSee Less
SAFETY: On 23-Mar-05 a vapour cloud explosion occurred on the Naphtha Isomerisation unit plot at the BP Texas City refinery. The explosion killed 15 people and injured 180 others. The vapour cloud was formed by vapourisation of light naphtha liquid which had puked from the top of an atmospheric blowdown stack after pressure safety valves (PSVs) on a Raffinate Splitter tower lifted due to liquid overfill as it was being started up. The blowdown stack was not equipped with a flare and it is thought that the vapour cloud may have been ignited by an idling diesel vehicle engine at the perimeter of the unit where several trailers (temporary offices) were sited for use by turnaround contractors working on an adjacent unit.
Critical factors and root causes for this tragic accident are detailed in the US Chemical Safety and Hazard Investigation Board (“CSB”) final report dated March 2007. The immediate cause was a vapour cloud explosion resulting from a loss of primary containment (LOPC) due to liquid overfill of the raffinate splitter and blowdown vent stack. Critical factors included faulty instrumentation (splitter and vent stack high level alarms), blocked outlet (liquid rundown) and inadequate control of work (trailers sited too close to unit). Root causes included inadequate design (blowdown stacks for venting and relief obsolete), failure to conduct a proper risk assessment (trailer siting), inadequate maintenance (instruments), failure to follow the startup procedure, inadequate training (troubleshooting skills), poor communication (shift handover) and inadequate investigation of previous related incidents (hazard awareness).
There are numerous lessons to be learned from this accident, but here are a few generic ones relevant to all refinery process units: Process unit startups are significantly more hazardous than normal operation so non-essential personnel must not be permitted on the unit or adjoining areas during startups. Instruments and alarms must be tested before startup to verify that they are functioning properly. Operating procedures for startup, normal operation and shutdown must be kept up to date and strictly enforced. Deviations from these procedures should be subjected to a formal Management of Change (MoC) review process. Vehicles must not be driven in classified areas (eg. process units, bunds) without first obtaining a hot work permit and vehicles must not be left running unattended anywhere on a refinery. ... See MoreSee Less
I think it was more basic than that. (although I fully agree with what Pete and Jon say) It was not clearly understood by plant Operators the consequences of filling towers above the reboiler outlets and then applying heat. Many did not understand the violent reboiling effect on the bottom trays when there was a liquid level above reboiler return and the potential destruction or damage to internals. It was seen as a bit of "Splashing, just foaming over". It should have preached and drummed into Operators that it is a series of continuous internal explosions! Hydraulic filling was just an annoyance and those towers without pumpout systems, many felt putting a bit of heat on aided pressure increase, and the draining down of towers. The fact that puking over the top happened every time, seemed to be missed, but it would be contained in the closed flare system and recovered by "others" for reprocessing. Well it all went wrong at Texaco Wales and then at Texas City. I put it down to poor quality training on how equipment works, lack of information in manuals and warning about misuse of equipment and the consequences of operating outside the safe envelope.
Hi Jon. In the immediate aftermath of this event, process engineers across the BP network developed a set of spreadsheets which linked to the process information (PI) system to create an "open loop" version of what you describe. The process engineers were asked to be an extra pair of eyes to work with the control board operator and alert him/her of any potential problems. Many sites went on to automate these systems in the DCS as soon as AdCon resources became available.
Let me add one thought...If the plant had adopted mass balance metrics on it's DCS would the accident have been avoided. Put simply by adding software that looks at the amount of hydrocarbon going in to a unit and compares it to what is coming out and what is being stored internally. When a significant discrepancy occurs an alarm sounds prompting the question of "where is it all going?" In extremis an automatic shut down could be initiated.
SAFETY: High pressure (HP) steam can cause severe burns to plant personnel or even fatalities. HP steam leaks are typically invisible to the human eye but are very noisy. Consequently, presence of a pinhole leak in a pipe or fitting in a noisy environment (eg. on the steam supply line to a large steam turbine) may not be obvious to personnel conducting routine activities, especially when wearing ear defenders for hearing protection. But if a persistent high-pitched whistling sound is heard in the vicinity of a large steam turbine, do not approach the machine to try to locate the leak. Instead, use a hand-held thermal imaging or ultrasonic acoustic device to locate the leak and wear appropriate personnel protective equipment (PPE) to inspect the leak location and carry out a repair.
Catastrophic failure of HP steam pipes (photo) can cause personnel injury through hearing damage, burns/scalds, shrapnel wounds and asbestos exposure (if old insulation contains asbestos) as well as unplanned plant shutdowns due to loss of HP steam supply. Typical causes of catastrophic steam pipe ruptures include erosion of pipe walls by condensate droplets, corrosion of pipe walls by acidic contaminants, over-pressure of pipe due to water hammer, and improper operation or inadequate design of steam desuperheaters. These risks can be managed by careful piping design (minimising pockets), careful desuperheater design (geometry, thermal liner), proper steam trap maintenance, careful monitoring and control of boiler feedwater and injected condensate quality, plus regular thorough inspections. ... See MoreSee Less
Target plate is often used to confirm all mill scale and debris has been removed as these could cause erosion or mechanical damage to valve internals or disintegration of turbine blades when propelled at high velocity.
Technical question...for years we would commision an HP steam main after a T/A using a target plate ( and annoying the neighbours) with the noise. Then we switched to a phased warm up. Was target plate OTT. or did we downgrde and take an increase in risk for environmental Reasons?
RELIABILITY: Reciprocating compressor cylinder valve reliability is affected by process and operational factors as well as mechanical failures. Common causes of cylinder valve failure include impact damage by liquids or solid contaminants in the process gas, corrosion of compressor internals, mechanical fatigue of cylinder valves or thermal degradation of thermoplastic valve components. Metallic plate valves (photo) can cause significant collateral damage to pistons, cylinder liners and other valves when they fail but are more tolerant of liquid and solid contaminants in the process gas than non-metallic plate valves.
Liquid contaminants can arise through condensation, droplet entrainment, excessive lube oil injection or seal leakage, gum or green oil formation, etc. Condensation can be caused by increasing molecular weight of the process gas but the effects can be minimised by heat tracing and insulating the suction line and pulsation vessels (check steam traps operational and insulation cladding in good condition to avoid water-logging of insulation) and by maintaining the cylinder coolant supply temperature at least 6 Deg. C (10 Deg. F) hotter than the process gas inlet temperature. Droplet entrainment can be caused by foaming or flooding of the mist eliminator in the suction knockout drum (due to operating at high throughput or low pressure) or liquid accumulation in pockets (due to inadequate piping design, subsidence of pipe supports or drains choked with corrosion products due to infrequent use). Droplet entrainment can cause lube oil to be washed out of the cylinder bore leading to accelerated wear of compressor components. Excessive lube oil injection can cause sticktion (viscous adhesion) of the valves. Gum and green oil formation is promoted by presence of oxygen and organic chlorides in catalytic reforming compressor applications.
Solid contaminants could be debris from a disintegrated suction knockout mist eliminator (due to pressure surge or incompatible mist eliminator materials), corrosion deposits from pipework, inorganic salt deposits such as ammonium chloride or sodium chloride or metallic salt deposits from lube oil additive precipitation or coke/lacquer deposits (due to use of petroleum-based rather than synthetic lube oil).
Corrosion of compressor internals could be due to presence of moisture along with corrosives such as hydrogen sulphide (H2S) or hydrogen chloride (HCl). Mechanical fatigue could be due to plate rigidity, inadequate bolt torque or spring failure. Thermal degradation caused by rising process gas temperature could be due to a change in upstream operating conditions, loss of cylinder coolant supply, cylinder valve leakage or inappropriate material selection for non-metallic valve elements (eg. polyamide has lower melting point than polyether ether ketone “PEEK”). ... See MoreSee Less
SAFETY: Catastrophic failure of reciprocating compressor components can result in a major loss of primary containment (LOPC), a fire or explosion, significant equipment damage and loss of production, and most importantly, potential for serious or fatal injuries to personnel.
Common causes of catastrophic failures include bearing failure due to inadequate lubrication, liquid entrainment due to high level in the suction knockout (KO) drum, foundation damage due to high vibration and stud bolt fatigue due to pulsating gas flow.
The likelihood of reciprocating compressor LOPC incidents occurring can be greatly reduced by provision of safeguarding (automatic shutdown) systems such as low frame lube oil pressure (to avoid bearing failure), high suction KO drum liquid level (to avoid liquid entrainment) and high frame vibration (the last line of defence against imminent catastrophic compressor damage). Careful retorquing and/or replacement of stud bolts at appropriate intervals can reduce the likelihood of stud bolt fatigue failures. Provision of remote-operated emergency isolation valves at the compressor suction and discharge can help reduce the consequences (severity) of an LOPC incident. ... See MoreSee Less
Now - THAT is a Facebook post! No pseudoscience BS, no pictures of food,and NO TRUMP!
Before your time but: One of the old reciprocating vacuum pumps on the MEK had a similar failure. Wax carry over in the slovent train had coated the hi level trip float on the suction KOD. A lliquid carry over of solvent caused the machine to effectively become a fuel driven motor turning an electric motor. The electrical feed back was causing damage in the substation whislt the machine was trying to jump off it's bed. Operations eventually got the suction valve shut, starving the fuel source to the pistons but the electrical damage meant that the electric drive could not be isolated. Fortunately electricians were working on the plant and managed to rack out the panel for the machine finally ending the event. By good luck the machine was repairable and electric tracing around the KOD float switch ensured it stayed above the melt temperature of wax.
SAFETY: Failure in service of rolling ladders on floating roof storage tanks in flammable liquid service can create a significant safety and environmental hazard, especially if the roof deck becomes partially submerged (photo). Such failures can also result in significant financial losses due to sub-optimal blending operations while the tank is taken out of service for repair.
The safety hazard arises because a lightning strike or frictional spark caused by movement of the roof deck during filling or emptying could result in an ignition and rapid escalation to a full surface fire. The environmental hazard arises because volatile organic compound (VOC) emissions produce ozone which is harmful to the troposphere (lower atmosphere) because it contributes to photochemical smog formation. VOC emissions can also lead to odour complaints from neighbouring communities.
The most common immediate causes of floating roof tank ladder failures are wheel bearing failures and impact or corrosion damage to ladder runners. The most common root causes include inadequate engineering design and inadequate inspection and preventative maintenance. ... See MoreSee Less
INTEGRITY: Maintenance and inspection of off-plot infrastructure is just as important for plant availability and personnel safety as it is for on-plot process equipment. Office-based staff as well as operators can help by keeping their eyes open during plant visits and reporting suspected problems to the relevant Operations or Inspection Dept personnel. So don't be a desk jockey, get out there and observe! You'll benefit by becoming more familiar with the plant and its front-line personnel and the refinery will benefit from having an extra pair of eyes watching for early signs of possible problems.
The photo shows severe corrosion under insulation (CUI) at a hydrogen main pressure control valve station. The upstream operating pressure was 10.7 barg (155 psig). Subsequent non-destructive testing (NDT) of the swage revealed that the pipe wall thickness was less than 2 mm (79 thou) in places. Failure of the pipe would have created a significant safety hazard and resulted in a major loss of production since this was the only supply line to multiple hydrogen-consuming units at the refinery. Fortunately, this damage was discovered during a pre-turnaround inspection by a vigilant individual and the corroded pipe was repaired at the turnaround with no loss of production. ... See MoreSee Less
Hi John. As you correctly noted, the fire shown in the photo you attached was caused by a CUI failure which occurred on the feed line to a naphtha splitter. But there were other unique critical factors relating to that event. The failure location was a horizontal section of pipe just below the platform at the feed inlet to the tower. During construction, the angled platform bracing clashed with the insulated piping so a hole had been cut in the insulation cladding to accommodate the bracing and the gap had been sealed with mastic. This arrangement violated the insulation spec which required a physical gap of at least 25 mm (1 inch) between the bracing and the insulation. The feed inlet was around half way up the tower so was not regularly visited and, in any case, the clash between bracing and insulated piping was not easily visible below the platform. When the mastic eventually perished, rainwater ingress initiated the CUI. When the pipe perforated, warm naphtha flowed down the side of the tower, found an ignition source and a pool fire started around the base of the tower. Fortunately, no-one was hurt but the cost of fire-damage repair and lost production was significant.
SAFETY: On 25-Sep-98, 2 employees were killed and 8 more were injured when a rich oil deethaniser reboiler (GP-905) failed catastrophically at Esso Longford Gas Plant 1 (GP1) in Gippsland, Victoria (Australia). The resulting fire burned for more than 2 days. Supplies of natural gas to domestic and industrial users throughout the state were halted for more than 2 weeks causing substantial losses to industry and massive inconvenience to people in their homes.
The immediate cause of the disaster was brittle fracture of GP-905 channel end (photo). Critical factors included loss of lean oil flow for extended duration and absence of remote-operated valves to isolate interconnections with GP2/3. Root causes included inadequate hazard identification (low temperature hazard due to loss of lean oil not known), inadequate operating procedures (due to inadequate hazard identification), inadequate training, inadequate alarm management (poor prioritisation), inadequate monitoring by experienced engineers (located remotely) and inadequate safety management (Safety Case methodology not mandated or adopted).
Cold metal embrittlement (CME) of carbon/low alloy steels is a low probability, high consequence hazard that is sometimes overlooked. Risk assessment can only be conducted against known hazards so it is imperative that comprehensive process hazard analysis studies (eg. Hazop) are conducted on major hazardous facilities. However, even if this is done, some hazards may still be overlooked. Therefore, organisations should ensure their workforces always remain mindful of the possibility of disaster and are diligent in reporting incidents and their root causes (organisational learning). ... See MoreSee Less
I saw something similar during a process start-up of an unsat gas plant. An upsteam unit didn't come back up on time so wasn't available to inventory the downstream column. Instead the decision was made to back-fill from storage via a CW exchanger. The CW was still isolated, not drained so the water froze due to auto-refrigeration of the LPG, rupturing the exchanger tubes. The CW thermal relief lifted, blowing propane all over the unit. Fortunately there was no ignition.
It didn't occur to anybody to do an MOC or PHA to evaluate whether the change in the start-up routine was safe. The pressure of the TAR/start-up schedule had something to do with it, I think.
For anyone too young to have read it,the Longford report makes very interesting reading. Esso tried to blame operator error for this, fortunately the commission disagreed. Relying on operators to overcome failings in design and engineering is never the way forward yet still today it is an easy trap to fall into. How many times are critical trips taken or overriden for maintenance with a risk assessment covering all-with the statement " operator monitor" http://www.futuremedia.com.au/docs/Lessons%20from%20Longford%20by%20Hopkins.PDF
INTEGRITY: Caustic stress corrosion cracking (CSCC) in carbon steel vessels, exchangers and piping can result in a loss of primary containment (LOPC), an unplanned shutdown and/or a significant safety or environmental hazard. There have been several failures affecting caustic-handling equipment in mercaptan oxidation units and chlorided alumina type isomerisation units, and some failures in nominally caustic-free equipment in light ends units (un/saturated gas plants) or hydroisomerisation units which have been accidently exposed to caustic carryover. There have also been failures at caustic injection points in crude preheat exchanger trains where the caustic has been inadequately dispersed due to absence or failure of the caustic injection quill.
Carbon steel exposed to caustic solutions at moderately high temperatures (including steamout) may be susceptible to CSCC, especially if it has not been stress relieved by post-weld heat treatment (PWHT). Carbon steel equipment and piping in contact with caustic solutions below 30 wt% strength below 60 Deg. C is typically not specified as requiring PWHT unless trace heating is present. Similarly, carbon steel equipment and piping which is nominally caustic-free may not have been specified as requiring PWHT even if operated above 60 Deg. C. Hence it is important that careful process monitoring is carried out and any breach of these conditions (eg. caustic carryover or caustic strength too high) are documented and promptly reported to the relevant plant inspector. Steamout of non-PWHT’d equipment exposed to caustic should be avoided if possible. If steamout cannot be avoided, affected equipment should be water-washed before low pressure steam is applied for the shortest acceptable duration.
Wet fluorescent magnetic particle testing (WFMPT) is the most effective inspection technique for identifying CSCC provided the process-side surface of the equipment is accessible. WFMPT is a non-destructive testing technique for detecting surface and sub-surface defects in ferrous materials. It uses fine magnetic particles suspended in a carrier fluid (eg. kerosene). When applied to the process-side surface of the equipment, the particles settle in the cracks and are readily visible in ultraviolet light (see photo). ... See MoreSee Less
OPTIMISATION: Refiners can improve the reliability and efficiency of their steam and electrical power generation systems by replacing ageing direct-fired utility boilers and condensing steam turbine generators with a modern Cogeneration (“Cogen”) plant. Cogeneration is the sequential production of electrical and thermal power from a single fuel source.
The simplest (and most efficient) Cogen plant comprises a gas turbine (GT) with a heat recovery steam generation (HRSG) system coupled to the GT exhaust. Electricity is produced through the GT and steam is exported from the HRSG to refinery steam mains at the required pressure and temperature levels. Duct burners can be installed in the expansion duct between the GT outlet and the HRSG inlet to provide additional fuel source optionality and steam supply security in the event of a GT outage. If the Cogen plant is deliberately over-sized to provide electrical power export capability to the grid (photo), it will also incorporate one or more condensing steam turbines.
If the capital cost of the Cogen plant is too high for the refiner alone, other arrangements such as a joint-venture (JV) or third party owner/operator partnership can be set up in which the refiner avoids capital spend but gains (part of) the benefits of a more energy efficient source of steam, power and demineralised water in exchange for land and/or alternative fuel sources such as refinery fuel gas (RFG). Cogen plants are more thermally efficient than conventional open cycle plants because the duct firing system uses the residual oxygen in the hot turbine exhaust gas (TEG) so 100% of the duct burner’s heat release is available for steam generation. (In conventional utility boilers, a fraction of the burners heat release is used to preheat ambient air to combustion temperature.) Hence the benefits to the refiner include a net reduction in emissions of airborne pollutants (SOx, NOx, CO etc) and a reduction in mass emissions of CO2 per MW of electrical power produced. Transmission losses are minimised if the Cogen plant is located on or adjacent to the refinery. ... See MoreSee Less
Hi Dave. You’re correct. The photo is Intergen’s 800 MW Coryton power station which comprises 2 x Alstom GT26 gas turbines, 2 x HRSG with duct burners and 1 x condensing steam turbine. Primary fuel was natural gas. Coryton refinery owned and operated a small 28.3 MW Cogen plant which comprised 1 x Alstom Frame 5 gas turbine and 1 x HRSG with duct burners. Primary fuel was natural gas but it also fired hydrogen-rich CCR Platformer offgas and was capable of firing diesel if gas supplies were interrupted. Although most of the refinery has now been demolished, I believe the Cogen plant is still there and up for auction soon!
That looks very like the Cogen plant that was built next to the Coryton refinery when it was operational. I don't think any of the utilities were ever used directly by the refineryhowever although Coryton did import electrical power from the grid.I believe steam was never used from the plant.
They did build a gas turbine within the site for steam generation and gas utilisation. The boiler could run on refinery and natural gas which was imported. I think it did generate power also that was used within the refinery and exported to the grid.
Of course it's all gone now...😊
SAFETY: Some catalysts require un/loading under inert conditions in order to exclude air and avoid pyrophoric ignition or catalyst damage. Nitrogen is most commonly used for this purpose but poses an extreme risk of asphyxiation to personnel. Sadly, there have been numerous fatalities by asphyxiation during inert entry activities in the refining industry even when the work is being carried out by specialist inert-entry contractors. Therefore the contractor selection process must ensure the contractor uses highly trained personnel, carefully maintained and tested life support and communications equipment (including lockable helmets requiring assistance for removal), emergency rescue equipment and adheres to rigorously enforced procedures.
After the reactor to be unloaded is cooled, depressured and drained it should be positively isolated from all hydrogen and hydrocarbon sources. All access and entry points around the reactor should be barricaded with warning signs posted to alert personnel to the presence of nitrogen. Set up an access control system to log all personnel entering/leaving the barricaded area and obtain the required confined space entry and catalyst unloading permits. Ensure all personnel entering the barricaded area are wearing a personal gas detector which provides an audible and visible alarm if the oxygen concentration falls below 19%.
The reactor should then be purged to flare with nitrogen until the atmosphere in the reactor is below 10% of the lower explosive limit (LEL). Wear an air-line respirator or self-contained breathing apparatus (SCBA) during gas sampling or working close to open manholes or vents where the atmosphere may be oxygen deficient. Be sure to use a flammable gas detector (“explosimeter”) that is capable of measuring gas in an inert atmosphere (many portable gas detectors used on refineries work by catalytic oxidation and therefore give false readings in oxygen-deficient atmospheres). Once the atmosphere is below 10% LEL the nitrogen purge rate should be adjusted to maintain a slight positive pressure in the reactor while the flare connection is positively isolated and the manway or top elbow is removed in preparation for vessel entry. ... See MoreSee Less
See the 1-Pager at the link below for more information: http://www.xbprefining.co.uk/mdocs-posts/catalyst-handling-inert-entry-hazard-mitigation
Good comments Jon. I agree that an air-line respirator is preferred over SCBA in many cases for working in potentially oxygen-deficient areas outside the reactor. Pyrophoric or self-heating spent catalyst should be unloaded into properly labelled high integrity UN-rated steel drums with a heavy duty plastic liner. A water hose should be on standby to keep dust wetted and to extinguish any smouldering material. A nitrogen blanket should be maintained in the drum liner to exclude air during filling and the liner should be sealed with cable ties when full. The drum lid is then fitted and the clamp ring is bolted closed to seal the drum.
In many sites SCBA is not considered suitable as working BA. It is preferable that gas testing is designed and carried out in such a way that BA is not required. Catalyst handling once it is removed needs careful planning to ensure it does not react with the atmosphere and can be transported / stored safely. Finally plan for what to do with the vessel once unloaded as leaving long term under a Nitrogen purge is not the preferred option. My 1st choice is for the specialist contractor to neutralise any pyrophoric scale so that the vessel can be changed over to an O2 environment.
SAFETY: High to low pressure (HP:LP) interfaces are a significant process safety hazard in many types of refining processes (especially hydrocrackers and high pressure hydrotreaters). Failure to mitigate the risk of gas breakthrough can result in a major process safety incident (photo) and potentially multiple fatalities. Examples of appropriate mitigations follow.
Pressure safety valves (PSVs) for any downstream low pressure equipment should be sized for gas breakthrough from the high pressure circuit. Low level switches should be properly heat-traced, insulated and regularly tested. Check (non-return) valves are not adequate protection against reverse flow for HP:LP interfaces where gas breakthrough can occur (eg. backflow to feed surge drum). High integrity trip systems, if appropriately designed and regularly tested, can be used to reduce the capacity (size) of PSVs required to protect against gas breakthrough.
Trip systems should only be disconnected after careful risk assessment and a rigorous management of change (MOC) review have been completed to verify that alternative means are in place to adequately control the associated hazards. The basis for the risk assessment should be properly documented and should highlight any conditions affecting validity of the change (eg. maximum duration). ... See MoreSee Less
Such versatility and commitment! After delivering his "Catastrophic Heat Exchanger Failures" lecture at Cork Institute of Technology, Peter Marsh travelled directly to The Oliver Plunkett pub where he led a fluid flow seminar using the local Beamish Stout as a test fluid. ... See MoreSee Less
RELIABILITY: Plugging of small bore fuel ports in burner tips (photo) shows up as distorted or unequal flames and an increase in fuel pressure at the burner front without a corresponding increase in flow. This in turn can result in a loss of production if the firing rate becomes limited to avoid hazardous conditions such as poor flame shape and stability on individual burners or flame impingement on radiant tubes.
Plugging problems are usually a consequence of fouling or coking inside the burner tip or its drilled fuel ports. Fouling can be caused by accumulation of construction debris, pipe scale or salt deposits such as iron and ammonium salts. Coking can be caused by thermal cracking of liquid droplets or polymerisation of unsaturated hydrocarbons. Best practice is to clean plugged burners promptly as reduced fuel flow through the tip causes the tip temperature to rise due to loss of cooling effect and results in accelerated coking and scaling.
Mitigations against plugging include: 1) careful operation of the fuel gas scrubber to avoid amine carryover, 2) installation of duplex basket strainer system downstream of the fuel gas knockout drum (or a coalescing filter for ultra-low NOx burners with small very small fuel ports), 3) diligent operation and maintenance of heat tracing systems, 4) on-line injection of chloride scavenger or anti-foulant chemicals and 5) off-line chemical cleaning of fuel gas piping at turnarounds. ... See MoreSee Less
SAFETY: Mercury is present in trace amounts in most crude oils but can be found at elevated concentrations in specific crude oils and at even higher concentrations in certain gas field condensates. Mercury has a relatively high vapour pressure so it tends to concentrate in light hydrocarbon streams such as LPG and naphtha. Elemental (liquid) mercury and/or mercury salts (eg. mercuric sulphide) can accumulate in process equipment (photo) where it creates a risk of toxic exposure by inhalation for maintenance and inspection personnel.
Due to solubility of inorganic mercury salts in water and propensity of suspended mercury compounds to adsorb on solid particles (eg. sand and wax), mercury can also create an environmental hazard if the mercury concentration in wastewater and solid waste streams exceeds regulatory limits. It can also create an equipment integrity risk because it attacks aluminium-based and copper-based alloys causing premature failure due to amalgamation with alloying elements or liquid metal embrittlement.
Precautions to mitigate personnel exposure to mercury include 1) avoiding open steamout of and welding in mercury-contaminated equipment, 2) careful monitoring of mercury vapour concentration in air, 3) wearing of appropriate protective equipment (eg. PVC gloves, disposable overalls, full face respirators with mercury filter cartridge) and 4) regular urine testing of personnel working in high risk areas. Precautions to mitigate environmental exceedances in the event of a mercury spill include 1) use of specially-trained personnel to apply “flowers of sulphur” to contain and adsorb the mercury and 2) disposal of mercury-contaminated waste in a designated hazardous waste landfill site. Careful materials selection will mitigate the risk to equipment integrity. ... See MoreSee Less
RELIABILITY: High liquid levels in the base sumps of distillation towers can lead to flooding, operational instability and poor fractionation performance. These are all short term, transient conditions, but if the high liquid level is not identified and corrected promptly, the reboil return inlet nozzle can become submerged and the resulting vapour slugging can cause the bottom tray to lift (photo). This typically results in a permanent loss of fractionation performance which can only be corrected at turnaround.
The main causes of high liquid levels in the sumps of distillation columns during a typical operating campaign are faulty level measurement or control, a restriction or blockage in the bottoms outlet line or bottoms pump suction strainers, or a utility supply failure resulting in slumping of the column.
Recommendations for avoiding high base sump liquid levels include: 1) provide reliable level monitoring instrumentation with diverse types of sensor (to avoid common mode failures), 2) ensure displacer and dP cell type level sensors are calibrated to the lowest liquid density possible, 3) inspect the bottoms outlet line and nozzle carefully for sludge accumulation or turnaround debris accumulation immediately before the tower is boxed-up and 4) ensure the liquid level is visible and within the control range before introducing reboil heat to the tower. ... See MoreSee Less
.During start up conditions the base pumps can not always handle the heavier product and keep tripping on overload causing high base levels. A design issue that needs ironing out.
It might also be worth having procedural provisions for operators to verify the level, on some frequency, or when there are doubts or conflicting process data. This may entail opening sample taps, where it is safe to do so.
SAFETY: A sudden change in fuel gas composition can create an oxygen deficient atmosphere in a furnace firebox. If this is not corrected quickly, the uncombusted fuel can form an explosive mixture and result in catastrophic failure of the furnace casing (photo).
The correct response to a fuel-rich atmosphere in a furnace is to reduce firing rate until the target excess O2 concentration has been restored. Do not approach the furnace and do not attempt to add air to a fuel-rich firebox.
A continuous flue gas analyser with combustibles and CO sensors can help provide early warning of a hazardous condition arising in the furnace and a mix drum on the refinery fuel gas main can help reduce the rate of change of fuel gas composition. ... See MoreSee Less
RELIABILITY: Coke impregnation of abrasion-resistant refractory linings can cause mechanical damage in FCC reactor cyclones and risers, particularly in units processing feedstocks with high Conradson Carbon (eg. atmospheric or vacuum residue). This can lead to a reduction in reactor cyclone efficiency and increased ash content in decanted oil (DCO) product which reduces its value and precludes its use as carbon black feedstock.
Coke forms in the pores of the FCC riser and reactor cyclone abrasion-resistant internal refractory linings in normal operation. As the reactor cools during a trip or shutdown, the stainless steel riser and cyclone bodies contract much more quickly than the refractory lining, particularly if the refractory is impregnated with hard coke deposits. This differential contraction rate leads to a buildup of hoop stresses in the riser and cyclone body. In the case of the FCC reactor cyclones, this can ultimately lead to a column of refractory “biscuits” popping out of the hexmesh refractory anchors (photo). In the case of the FCC riser, the stainless steel internal portion (which grows vertically during heatup) is unable to contract at shutdown so the top elevation increases and the internal riser wall thickness reduces (ie the riser elongates over time).
Careful inspection is required at shutdowns and turnarounds to identify if these problems are likely to affect the mechanical integrity or operational performance of the reactor over the next operating cycle. Repair or replacement of the affected parts may be required. ... See MoreSee Less
SAFETY: On 11-Feb-2001, a distillation column on a styrene monomer production unit collapsed at the Chevron Phillips Chemical Company St James Plant (Louisiana, USA) as a result of an internal metal packing fire (photo). The fire started while new internal support beams were being welded as part of a column revamp. Fortunately, no-one was injured but the unit remained off-line for approximately 7 months. Similar incidents have occurred on refinery plant (eg. Citgo Petroleum Lemont Refinery crude distillation column collapsed on 17-Aug-01).
The high surface area to volume ratio of random or structured packing materials makes it a very efficient medium for mass and heat transfer but this property also creates an increased risk of fire under certain conditions. If a metal packing fire is not detected and extinguished quickly, it is almost impossible to extinguish it. Water is not always an effective suppressant for metal packing fires because if the fire takes hold it can burn hot enough to decompose water to hydrogen and oxygen. The hydrogen may explode.
Most metal packing fires are caused either by sparks from hot work being carried out in a column (welding, grinding etc) or by autoignition of pyrophoric materials (iron sulphide etc). Careful planning and execution of turnarounds is required to mitigate these risks. This includes strict adherence to shutdown, permitting, cleaning and maintenance procedures. Best practice is to remove packing from a column before commencing hot work if this can be done safely. If this is not possible, physical barriers should be used such as flooding the column with water to just below the hot work area (assuming foundations adequately rated) or sealing the space below the hot work area with metal isolation sheets and fire blankets. Continuous monitoring of the temperature and carbon monoxide levels in the column while it is open to atmosphere can enable early detection of a fire. Firewater at an appropriate pressure should be provided at all manways to enable any fire to be extinguished quickly with copious amounts of water to cool and suffocate the fire before it takes hold. ... See MoreSee Less
RELIABILITY: Inadequate lubrication is a common cause of bearing failure on pumps and drivers so careful design and pre-commissioning is essential to ensure good equipment reliability and plant availability.
The photo shows a failed bearing cage and worn rolling elements from the motor driver of a vertical high-speed process gas compressor assembly. The immediate cause of the failure was inadequate lubrication exacerbated by poor accessibility to the grease nipple on the bearing housing. A critical factor was absence of direct bearing temperature measurement due to absence of thermocouple fittings on the bearing housing (thermocouples had been connected to motor windings instead). Root causes included inadequate design (poor access for basic care activities and failure to provide thermocouple fittings on bearing housing) and inadequate pre-commissioning inspection (incorrectly installed thermocouples). ... See MoreSee Less
RELIABILITY: Erosion of FCC regenerator combustion air distributor nozzles is one of the most common reliability problems affecting FCC unit performance, regardless of distributor type (ring, pipe grid, dome grid, mushroom grid with extended arms, etc). External erosion of the nozzles is caused by recirculating eddies detaching from the expanding air jet and pulling in catalyst particles from the fluidised bed. Internal erosion of the nozzles is caused by catalyst ingress following slumping of the fluidised bed after a trip of the combustion air blower. Damage to the nozzles can cause air flow maldistribution in the bed, resulting in increased afterburn and higher dilute phase temperatures.
There are several ways to reduce the severity of erosion damage to air distributor nozzles. These include 1) designing the number and size of nozzles to ensure exit velocities remain within recommended limits for all expected operating conditions, 2) applying an external abrasion-resistant refractory lining to the nozzles, 3) using fine grained, high density, sintered ceramic nozzle inserts encased in steel enclosures and 4) arranging the majority of nozzles to be downward facing (to minimise catalyst ingress on loss of combustion air supply).
Best practice is to design the air distributor for turn-up and turn-down capability to 120% and 60%, respectively, and to specify two stage nozzles (whether steel or ceramic) with an L/D of > 5/1 such that the venturi created by the first stage orifice dissipates within the nozzle and discharges with a maximum nozzle exit velocity of 65 m/s (213 ft/s). The distributor should be externally lined with a 19 mm (3/4”) thick layer of abrasion-resistant refractory on either rolled hexmesh or S-bar refractory anchors. The nozzles should be recessed into the distributor so that the outer face of the nozzle is flush with the outer surface of the refractory lining (photo). ... See MoreSee Less
SAFETY: A continuous oxygen (O2) and combustibles analyser is a critical instrument for fired heater safety and can provide early warning of a hazardous condition arising. The analyser assembly is close-coupled to the furnace breeching (radiant section outlet) to prevent acid condensation and corrosion and hence eliminate the need for sample conditioning. It therefore reports O2 concentration on a “wet basis” (whereas a standard portable oxygen analyser reports on a “dry basis”). The measured value on a wet basis is always lower than the value on a dry basis and the difference can be significant (eg. 4.6 mol% O2 on wet basis may be equivalent to 5.2 mol% O2 on dry basis, depending on fuel fired). Excess oxygen set points for tuning furnace performance should be quoted on a wet basis.
If the measured O2 concentration reduces slowly and the combustibles concentration rises at the same time, this is probably due to a change of fuel composition (eg. higher molecular weight gases require more O2 for complete combustion). The correct response is to reduce firing rate until the target excess O2 concentration has been restored. Do not attempt to add air to a fuel-rich firebox. If the measured O2 concentration falls rapidly, the combustibles concentration rises rapidly and heavy smoke is seen emitting from the stack, this is probably due to a tube rupture within the furnace. The correct response is to shut down the heater, isolate the process and fuel connections to the heater and introduce steam to the firebox to reduce the amount of O2 present and hence reduce the intensity of combustion. ... See MoreSee Less
SAFETY: Those of you who knew Peter Marsh well when he worked for his former employer (BP) will recall that he used to regularly publish 1-page summaries of significant process safety incidents to help raise awareness of risks and hazards and to highlight lessons learned. This was in no way supposed to devalue the detailed investigation reports on which the summaries were based; rather it was intended to complement those reports by promoting learning across a much broader section of the organisation than a detailed report could ever hope to do.
This message is just to let you know that Peter is continuing that long-standing tradition and will be publishing a select few 1-Pagers on a free-to-view basis on the XBP Refining Consultants Ltd. website which launched just over a week ago. Process safety incident summaries can be found at the following address:
Rupture of vacuum bottoms line on Lithuanian VDU.
They need to put quite a bit of steam on to clean that up!
That's very true.. although hopefully safety culture in different companies can be changed just by focusing more on process safety and being proactive to look for signs/risks like what you share. I remember sharing a catastrophic incident on a rerun unit ( you know the one) with a group who hadn't seen the video before (I had to talk through as volume didn't work!) and after they all pushed more to ask about similar instruments they know that are as critical or faulty and what could happen. I was pleased they became more engaged with a safety presentation. That's the right time for management and engineers to take notice :)
Hi Jade. I'm glad you find my 1-Pagers useful. My hope is that they help jog peoples' memories about some important issues that may have significant consequences and therefore contribute in a small way to helping refiners avoid similar incidents at their own plant. Although some of the incidents are well-known, I've presented them in an anonymous way so readers focus on the issues (which they may be able to influence) rather than the company and its culture (which they may not be able to influence).
Whose Refinery was that?
This is great Peter Marsh thanks! Always liked the wealth of detail and key lessons in the 1 pagers. And I'm in process safety now :)
SAFETY: The most common design of external floating roof tank is a single deck construction with a series of pontoons attached around its periphery. The diameter of the tank is the same as or larger than the height of the tank so a rolling ladder can be used to access the roof for inspection and maintenance activities. The roof structure has a central open deck with one or more centrally-located drains. The outer edge of the roof is fitted with at least one seal (“rim seal”) to minimise odours and avoid excessive evaporative losses. The rim seal area is provided with fixed foam pourers and a foam dam to retain the foam in the seal area.
A tilting or sinking roof can lead to a loss of primary containment (LOPC) which has the potential to lead to a major incident ether by evaporation and ignition of hydrocarbons or by pollution to ground via open roof drains. Possible causes of a tilting or sinking roof include 1) high product vapour pressure (rundown cooler failure or operational upset), 2) rainwater accumulation on the tank roof (roof drain blocked), 3) rolling ladder derailed (wheel bearing failure), 4) one or more pontoons flooded (rainwater or product ingress due to perforation by corrosion), etc.
Minor fires can quickly escalate to full surface fires (photo) if pontoons and are not well maintained as product ingress to pontoons can create an explosive mixture. Therefore, regular (at least 6 monthly) inspections should be carried out on all pontoons including explosimeter testing to determine if any of them contain a flammable atmosphere. Rim seal fixed foam pourers should also be regularly tested to verify they produce a good quality foam. Ineffective foam application can significantly extend the duration and increase the severity of a fire. ... See MoreSee Less
Hi Trev. No this wasn't Coryton. It was an Eastern European refinery. The tank had been filled with very high RVP naphtha following a CDU shutdown. Mechanical damage to the rolling ladder caused the floating roof to hang up as the naphtha was pumped out. When the roof eventually released itself it created a spark which caused a rim seal fire. Unfortunately the pontoons had not been well-maintained and leaked, creating an explosive mixture inside. A couple of the pontoons near the source of the fire exploded, causing the roof to sink and the fire to rapidly escalate to a full surface fire.
Was that 80X1? It did not have that much H/C at the time. Big Flames!
with over 30 years service in one refinery I can say that this is one of the real weak spots in terms of major incident risk. For example..during a major plant failure an experienced operator opened a by pass valve on a unit in order to stop a vessel overfill. A couple of hours later the vessel emptied allowing high pressure hydrogen to be routed to a floating roof tank. The tank lid lifted and the sites emergency procedures cut in ..pump out the tank and put a fire fighting foam seal on top of any liquid hydrocarbons remaining. Unfortunately applying the foam caused an electrostatic spark and a major fire that destroyed the tank. Such an easy action with such major consequeces.. The learning exercise was to re hazop sections of the plants connected to similar tanks and install key locked valve management systems. Unfortunately this was not the last time I saw tank roof damage due to similar causes although the root cause was always plant operating modifications without peproper Management of change control.
INTEGRITY: Pressure vessels in high temperature applications are sometimes designed with an internal refractory lining to reduce the shell temperature to a level that permits use of less expensive low alloy steels (“cold wall” construction). However, poor installation or failure of the lining can cause hot spots on the shell leading to metallurgical damage and potentially to catastrophic failure of the vessel shell.
Common methods for on-line detection of hot spots on vessel shells include use of skin thermocouples, temperature-sensitive paint and thermal imaging. Each of these has advantages and disadvantages. Skin thermocouples provide continuous, accurate measurements, but at only at pre-defined, discrete locations. Temperature-sensitive paint provides continuous, full coverage of the shell but limited temperature differentiation. Thermal imaging provides full coverage of the shell and is capable of accurately recording average and peak temperatures, but it is carried out only intermittently. So a combination of all 3 methods is often used.
If on-line monitoring reveals a hot spot which is deteriorating, a series of temporary surface temperature sensors can be installed at or around the hot spot to continuously monitor the shell temperature to ensure it does not exceed the maximum metal temperature limit. For carbon steel and C-0.5 Mo vessels, temporary surface temperature sensors can be attached to the vessel wall with magnets and wired to a local wireless temperature transmitter to send measurements back to the control board (photo). Note that a high temperature thermally conductive grease should be applied to the vessel wall beneath the sensor to overcome inaccuracies caused by surface roughness. ... See MoreSee Less
SAFETY: On 24-Jul-94, a lightning strike on the crude distillation unit (CDU) at the Texaco Milford Haven refinery caused a fire which triggered a shutdown of all process units except the fluid catalytic cracker (FCC). Approximately 5 hours later, the FCC flare knockout drum outlet line ruptured, releasing 20 tonnes of flammable hydrocarbons which found an ignition source and subsequently exploded. A major fire ensued at the FCC flare knockout drum and a number of secondary fires erupted in adjacent plant. The explosion had incapacitated the flare system so the fires were allowed to burn themselves out. The last of the fires was extinguished some 2½ days later. Luckily, no-one was killed but 26 were injured. The refinery suffered severe damage to process plant, storage tanks and buildings. It remained shut down for some 9 weeks and took a further 9 weeks to reach full capacity.
The immediate cause of the explosion was loss of primary containment (LOPC) due to rupture of a DN 750 (30" NS) elbow on the FCC flare knockout drum outlet line. Critical factors were failure of the FCC debutaniser level control valve and inability of the board operator to diagnose liquid overfill due to inadequate or faulty instrumentation and lack of situational awareness due to "alarm flood". Root causes included failures of management, equipment and control systems during the plant disruption.
So what lessons should we learn from this? Control panel graphics should provide a process overview including mass and heat balance data. Operators should be trained to properly interpret anomalous or inconsistent data. The number of alarms should be limited to a quantity that the operator can effectively monitor. Critical alarms should be highlighted and the required operator responses should be documented for each. All plant modifications (including emergency modifications) should undergo a formal hazard analysis. ... See MoreSee Less
Needless to say I have studied the HSE report and findings on this one. A critical factor was the push to restart before a real understanding of the plant situation was established. This was also a factor in an incident at Grangemouth which led to BP adopting an abnormal shutdown procedure. This was a simple risk based questionnaire that made sure you knew why you had shut down and the steps necessary to get the plant into a safe start up condition. The HSE also recomended that mass balance software and automatic shutdown systems be put in place. Basicly if you do not know where the hydrocarbons are the stop what you are doing. Amazing the number of incidents that could have been prevented if more weight had been put into implementing it.
INTEGRITY: Process units which pass a tightness test when pressured up with nitrogen may still suffer leakage when hydrogen is introduced to a system due to the smaller molecular size. In the case of flange leaks, it may be possible to seal the leak by simply applying more torque to the stud bolts (up to the recommended gasket compression limit). But in the case of an air-cooled heat exchanger (ACHE) header box plug leak, additional torque should not be applied unless assurance can be given that the threaded joint has not suffered mechanical or corrosion damage.
The leaking ACHE header box plugs may have been examined as part of a planned inspection if the leak occurred at startup from turnaround. If so, the condition of the plugs and sealing surface are known and a temporary on-line repair may be considered feasible. A specialist contractor should be appointed to design a suitable clamp. The clamp design must be approved by the refiner and a full risk assessment should be carried out before installation of the clamp is attempted.
A typical installation procedure involves the following steps; 1) clean the ACHE plugsheet and the sealing surface of the clamp cap, 2) drill and tap the leaking plug and screw in a stud bolt, 3) slide the clamp cap over the stud bolt and push up to the plugsheet, 4) slide a washer over the stud bolt and push up to the clamp cap and 5) thread a nut onto the stud bolt and apply torque to the nut to tighten the cap and seal the leak. ... See MoreSee Less
I always felt this type of clamp on a header box of an air cooled exchanger was very, very clever, but had limited use. As stated it should only be used as a TEMPORARY on-line repair to prevent the condition worsening while preparation was made to remove the ACHE from service.........While working on one production unit a few leakers, after an inspection, became evident. These ACHE were seeing some serious HCl in Hydrocarbon plus a Hydrogen carrier gas in the overhead fluids at around 30barg pressure. As soon as the HCl escaped from the newly reinstated plugs, it became acidic on contact with the air and the acidic corrosion began eating back into the header box from the outside. Action needed to be taken quickly, and this cup device was employed with much success. But nobody knew how much damage had been done to the threads and how long they would last or what was the maximum pressure they could now withstand. I did wonder what was happening, as none appeared to be cross threaded or lose, and only the disturbed plugs began to leak one after another. Nearly all had to be capped both ends of the header box You can't keep radiographing every minute of the day ......I always suspected that the Contractor had used the wrong thread lubricant on the plug, and suspected he may have started to use a copper based lubricant (Coppercoat). This started an electrolytic reaction between the metals and the HCL (acidic) and may have initiated the leaks ......... The use of suitable thread lubricants was not widely known or publicised. The Craftsman may never have known what products were in the overhead streams or realised the consequences of the wrong use thread lubricant......The planning Engineer, the Inspection department, the Mechanical Engineer and the Chemical Engineer should have discussed this, and made sure the Contractor did not use any unauthorised lubricants and fully understood why it should not be used, and the possible consequences of using it........The other theory was that as all treads were cleaned by re-tapping, had the Craftsman used a poor quality "Tap" or slightly oversized "Tap" and therefore damaged the the header box internal threads inadvertently? ...........There were no catastrophic failures on any of the ACHE's So all I can say they do work as a temporary measure.
SAFETY: On 06-Aug-12, the light gas oil (LGO) sidedraw from a crude distillation unit (CDU) at Chevron Richmond refinery failed catastrophically, releasing a large volume of hot LGO to grade. The leaked material formed a large vapour cloud which engulfed 19 company employees. 2 minutes later, the hot fluid ignited. 18 employees escaped from the vapour cloud before it ignited; the other was engulfed in the fireball but was wearing full-body firefighting protective equipment and managed to escape. 6 employees suffered minor injuries during the incident and, over the next few weeks, some 15,000 people from the local community sought medical treatment for the effects of smoke inhalation.
The immediate cause of the fire was rupture of an un-monitored section of low silicon-content carbon steel piping in the LGO sidedraw as a result of wall thinning caused by high temperature sulphidation corrosion (HTSC). HTSC causes thinning over a relatively large area so failures tend to involve ruptures or large leaks rather than pinhole leaks. It can be insidious in that moderately high corrosion rates can go undetected for years before failure. Process changes that result in higher temperatures or sulphur content can creep up over time and multiply corrosion rates so that systems which historically had low corrosion rates can become corrosive enough to fail before the increased corrosion rate is recognised. Low silicon-content carbon steels such as ASTM A53 are especially susceptible to HTSC.
It is critically important that all high temperature carbon steel piping susceptible to HTSC (especially low silicon-content steels) undergoes 100% component inspection or is replaced with inherently safer materials of construction such as high chrome alloys (5 Cr/0.5 Mo or higher). ... See MoreSee Less
Yep, the industry and many refiners BP included, do survey for correct metallurgy. The approach, otherwise known as PMI (Positive Material Identification) includes testing to show up Low Si Vs normal A53B spec material. The most important thing to consider is that the corrossion will be 100% reliable at finding "rogue" materials, your inspection better be that good!
Until I read the full investigation report I hadn’t realised that carbon steel pipe and fittings manufactured before the mid 1980s (eg. ASTM A53) did not have a minimum silicon content specification. (The addition of silicon reduces the amount of oxygen in the steel and provides an indication of the steel’s resistance to HTSC.) I also hadn’t realised that due to peculiarities of the manufacturing process, elbows and fittings generally contain higher levels of silicon than straight-run pipe manufactured to the same specification. This is a key learning as elbows and fittings are typically selected as Corrosion Measurement Locations (CMLs) because turbulence in these areas usually results in the fastest metal loss. An unintended consequence of this is that measurements taken at high silicon fittings could lead to a significant under-estimation of sulphidation corrosion rates at low silicon straight-run pipe (as happened in this case).
SAFETY: Draining hot or volatile hydrocarbons from process equipment to oily water sewer systems during maintenance or turnaround activity can have a number of unintended safety, health and environmental impacts. If the hydrocarbons are highly volatile and/or come into contact with hot condensate from steamout, a vapour cloud could be created at any open drains connected to the system even at locations some distance away from the equipment being drained. This creates a safety risk for any hot work being carried out in the immediate vicinity and potential health risks for personnel (toxicity). These risks are normally managed via a control of work (CoW) process involving a formal risk assessment.
Even when the hydrocarbons are safely drained to the unit sump or wastewater treatment plant (WWTP), there is still the issue of volatile organic compound (VOC) emissions. VOCs have a public health impact because they form ozone in the lower atmosphere (respiratory problems) and an environmental impact because ozone is a precursor to photochemical smog formation (air pollution). VOC emissions from unit sumps and WWTPs can be controlled by enclosing the sumps and WWTP influent system, adding a nitrogen blanket system to control the pressure and oxygen concentration in the enclosure and installing activated carbon canisters on the enclosure vents to adsorb the VOCs. However this type of arrangement can create its own safety-related risks and there have been several incidents throughout the refining industry involving carbon canisters exploding (the photo shows a deformed carbon canister which overpressured but did not explode). Critical factors include low moisture content of activated carbon charge, high vent gas hydrocarbon concentration, high vent gas inlet temperature and/or high hydrocarbon heat of adsorption, low vent gas flow and high vent gas oxygen concentration. ... See MoreSee Less
It's good practice to cover drains in the vicinity of hot work to reduce the potential for flammables escaping and teaching an ignition source caused by the work.
Good comment Jon. Also note that if the equipment being drained contains benzene (highly carcinogenic), a cold water flush should be applied before steamout. Benzene is highly volatile and will vapourise easily on contact with steam or hot condensate and could result in exceedance of safe exposure limits for personnel working near open drains across the unit. Benzene is much more soluble in cold water than in hydrocarbons so a cold water flush will remove most of the benzene in the liquid phase, thereby minimising the risk of airborne benzene vapour exposure to on-plot personnel and enabling the benzene to be safely treated at the Wastewater Treatment Plant (WWTP).
When draining large amounts of volatile hydrocarbons ensure that the route to the sump or collected on system remains cold. During a turnaround one operator started steaming out to drain at one end of the plant whilst another was draining down at the other end of the area. When hot steam condensate met volatile hydrocarbon the rapid expansion in the drains caused several manhole covers and a very large concrete interceptor lid to blow up into the air.
This looks very similar to the carbon canisters on the SHU unit at Coryton Refiney. The use of these canisters (twined) was widely misunderstood at Coryton. As one of the training and commissioning technicians I should have amended the manuals on the correct use of the canisters and sump, and then had the unit drawings updated. It wasn’t until I distorted one canister myself, that I realised the original design notes were nebulous to say the least.
This unit was built with an enclosed sump in the form of a Drum with a dedicated automatic pump. All drainings being pumped away to another tank. Any vapours produced would vent through the carbon canister to atmosphere without pollution. (Not to flare)
Coryton was panicking about a no flaring policy and was trying to comply with requirement of not building production units that had vessels floating on the flare system. Usual safety relief valves also operated for fire conditions etc through out the unit separate from the sump, but SRV would always remain closed in normal operation. Coryton also wanted any release of hydrocarbons though draining etc. to be contained and not released to atmosphere from draining, but sent direct to a drum for recovery or safe disposal. No VOCs to atmosphere.
The sump was designed for very limited sample draining, small spillages, washing down the unit or other water (rain) designed to go to sewer when the units was under normal operating conditions.
There was a hard piped dedicated vent line off the drum to flare, and the normal in use line to the carbon canisters. In steady normal and non-draining or deliberate flaring conditions ONLY the line to the canister should have been open with the line direct to flare always shut.
If a vessel or pump or any equipment that was to be drained or vented deliberately, then the flare line should have been opened and the line to the carbon canisters shut to protect the fragile canister.
This was not normally done at Coryton. And the reason why this wasn’t done was very simple to understand. The unit P and ID’s showed the sump drum flare line with a double block valve and bleed system with a spectacle blind in the closed position and marked normally closed (NC)
The misunderstanding was that draining and venting of vessels was not a normal condition, and this was not clearly understood by all. A large quantity of hydrocarbon could not vent through the canisters, as they were there as breathers only. The sump should have been vented to flare when this was happening.
To get permission to swing the spectacle blind, on a running unit, to the open position required something that was tantamount to an act of parliament or blessing from the Pope. So the manual flare valve was seldom opened.
To have unit P and ID’s changed was almost impossible. It was probably easier to build a nuclear reactor in the dark, using second hand watch parts, with both hands tied behind your back using only your teeth!
The design should have shown the flare line from the sump drum having the double block valves in the closed position and the SPECTACLE BLIND IN THE OPEN POSITION when the unit was running. This would make it easier and safer to use the sump drum dedicated flare line, and allow the carbon canisters to be isolated and to perform their designed function on normal conditions.
Then rewrite the venting and draining procedures for the SHU and make sure every Production Operator understood this.
We never had a carbon canister rupture at Coryton, but that was pure luck.
INTEGRITY: Deterioration of above-ground atmospheric storage tanks can lead to major leakage resulting in significant safety hazards, environmental pollution, reputational damage and loss of production. Refineries typically incorporate tank farms with numerous tanks in a variety of different services spread over a wide geographical area. It is therefore essential that a formal inspection programme is applied by the Inspection Department in addition to the routine visual inspections carried out by Operators on their daily rounds.
One of the key inspection areas for above-ground atmospheric storage tanks in any service is the “rim angle” (see photo). This is generally considered to be the critical area of the tank since it is a load-bearing joint which must support the weight of the tank walls as well as hoop stresses generated by the weight of the liquid product and the tank roof. It is formed by welding the lower course of the tank to an annular plate running round the entire periphery of the tank. The tanks are typically fabricated from carbon steel plate and are subject to both internal and external corrosion.
Inspection Department should carry out regular on-line inspection of the rim angle to revalidate the scope and frequency of subsequent inspections and to provide assurance that the planned interval between thorough off-line internal inspections is appropriate and achievable. ... See MoreSee Less
RELIABILITY: Pump reliability is critically dependent on careful design and operation of the pump and driver lubrication systems. Loss of lubrication can lead to catastrophic bearing failure and subsequent seal failure which renders the pump inoperable (see photo). In the case of process pumps, a pump seal failure causing a loss of primary containment (LOPC) may also result in a significant spill of product (environmental damage) or a fire (property damage and risk of injury).
For pumps fitted with a constant level oiler (Denco or equivalent), regular inspection is required to ensure oil levels are correct and the air holes in the adapter are physically proven to be clear using a clean piece of wire or welding rod.
For pumps lubricated by an oil mist system (in which compressed air is used to transport atomised lubricating oil to multiple bearing housings), regular checking of oil levels, temperatures and mist header pressure at the oil mist generator is required in addition to regular inspection of the oil mist tubing at the pumps and drivers. Regular checks should also be made for excessive oil accumulation at low point drains in the oil mist header. ... See MoreSee Less
SAFETY: On 02-Apr-10, the shell of a Feed/Effluent Exchanger on a Naphtha Hydrotreater (NHT) at Tesoro Anacortes refinery failed catastrophically resulting in a fire, explosion and 7 fatalities. The Feed/Effluent Exchanger train was configured with 2 identical parallel sets of 3 shells in series with reactor feed on the tubeside and reactor effluent on the shellside. The hot shells were C-0.5 Mo lined with 304 SS, the middle shells were carbon steel partially lined with 316 SS and the cold shells were unlined carbon steel. The immediate cause of the fire was loss of primary containment due to high temperature hydrogen attack (HTHA) of the carbon steel shell of one of the middle exchangers at a point just downstream of the 316 SS partial lining.
HTHA occurs when carbon and low alloy steels are exposed to high hydrogen partial pressures at high operating temperatures (service exposure time is cumulative). The hydrogen reacts with carbides in the steel to form methane which cannot diffuse through the steel. The loss of carbide weakens the steel and the accumulation of methane pressure creates cavities and fissures in the steel which eventually combine to form cracks. HTHA damage is most likely to occur in highly stressed areas and heat-affected zones around welds.
It is critically important for new and existing units in hydrogen service that equipment is checked against the relevant Nelson Curve for startup, shutdown and transient conditions to identify appropriate mitigation strategies against HTHA. Mitigations may include 1) appropriate material selection, 2) imposition of strict operating limits, 3) provision of appropriate instrumentation to enable proper monitoring and 4) rigorous enforcement of startup, shutdown and emergency procedures. Note that transient conditions might include gradual changes to operating conditions due to fouling of equipment or deactivation of catalysts. ... See MoreSee Less
A big problem is drastic feed stock changes that really should have an MOC rather than just being passed through a quick engineering review. A distressed cargo may look cheap and time to say yes/no is short but long term costs can be dramatic.
Thanks for posting this! Always worth looking at composition vs materials of construction during the PHA, especially on repurposed equipment or if feedstocks and operating conditions have changed.
RELIABILITY: Naphtha hydrotreaters (NHTs) are typically configured with parallel trains of 2 or more feed/effluent exchangers in series. The exchangers typically incorporate U-tube bundles (TEMA type CFU or similar) with feed on the shell side and reactor effluent on the tube side. This arrangement can result in severe fouling and under-deposit corrosion of the cold-end bundles requiring frequent outages for off-line cleaning and inspection. The fouling deposits are mostly corrosion products (eg. iron sulphide, iron chloride, iron oxide) derived from corrosion of the crude distillation unit (CDU) overhead system and/or unblanketted or unlined intermediate storage tanks. The under-deposit corrosion is exacerbated by presence of ammonium chloride salts and free water. In extreme cases, retubing can be more cost effective than cleaning the tube bundles (photo).
The preferred method for reducing the risk of accelerated fouling of these exchangers is to mitigate CDU overhead system corrosion (eg. improve washwater system design, optimise use of filming and neutralising amines, upgrade metallurgy, etc) and intermediate storage tank corrosion (eg. corrosion-resistant lining, nitrogen blanketing, etc). Other options include installing a floating suction in the intermediate storage tank, installing filters upstream of the exchangers, using twisted tube bundles which require no shellside baffles, or switching feed to the tubeside of the exchangers. The latter two solutions would also require use of high voidage topping layers in the NHT reactor if CDU and tank corrosion had not been addressed. ... See MoreSee Less
ENVIRONMENTAL: The Wastewater Treatment Plant (WWTP) at a typical refinery comprises several sections; a series of coarse (“bar”) screens (debris removal), an API Separator (primary oil/water/solids separation), Surge and Equalisation Tanks (influent flow and pollutant concentration control), a Dissolved Air Flotation (DAF) system (secondary oil/water/solids separation), and an activated sludge process (microbiological treatment). WWTP’s with stringent discharge consent limits may also incorporate a mixed media filter system (aqueous effluent polishing).
The activated sludge process is the heart of the WWTP and the upstream sections essentially serve as feed preparation steps (pretreatment). Their function is to remove oil and suspended solids to a level that the biomass (“bugs”) in the activated sludge process can cope with. The activated sludge process essentially comprises Biox Reactors and Clarifiers. The pretreated influent water enters the Biox Reactor and air is added to oxidise the dissolved pollutants and convert them from toxic compounds to benign compounds such as CO2, NO3 or SO4. The treated water flows by gravity to the clarifier where the biomass is separated from the treated water. A small quantity of biomass (equivalent to the amount of generated by bug multiplication) is purged from the system and the rest is recycled back to the Biox Reactor.
The photo below shows foaming of a typical Biox Reactor. This is a serious operational upset which must be tackled promptly to avoid a breech of the WWTP discharge consent limits. The most likely causes of foaming are maloperation of the API and/or DAF sections or unplanned ("shock") loading of the wastewater influent with high levels of oil/surfactants generated by draining/washing of process equipment at turnaround. Careful monitoring and good communication are essential to avoid this problem. ... See MoreSee Less
RELIABILITY: Catalytic reformer net gas chloride treater adsorbents should be changed out at 60 – 80% of theoretical capacity (depending on site-specific factors such as reforming reactor operating conditions, gas purity, piping layout, vessel geometry, adsorbent loaded density, etc). In order to track approach to saturation (HCl capacity limit), the HCl loading on the adsorbent (estimated from gas flow and HCl inlet/outlet concentrations) should be carefully monitored. Do not consider deferring spent adsorbent changeout for budget reasons – it is a false economy and will incur costs 1 – 2 orders of magnitude higher than the value gained by deferring this vital expenditure.
A European refiner facing cost pressures decided to defer changeout of spent chloride adsorbent on a CCR Platformer net gas chloride treater containing a soda-promoted alumina adsorbent. The CCR Platformer had operated at relatively low pressure and high temperature (severity) so the net gas contained traces of isobutylenes. Deferring changeout of the net gas chloride treater adsorbent allowed it to become saturated with HCl which subsequently promoted formation of organic chlorides in the treated gas. The organic chloride-contaminated net gas was routed to a number of hydrogen-consuming units including naphtha and gas oil hydrotreaters and was used as a low-carbon fuel source to keep a sulphur recovery unit on hot standby. The organic chlorides thermally decomposed in these downstream units, causing ammonium chloride salt deposition and a reduction in throughput at the hydrotreaters and accelerated acid dew point corrosion and an unplanned shutdown of the sulphur recovery unit. ... See MoreSee Less
RELIABILITY: Steam turbine blades should be regularly inspected during planned outages or turnarounds to check for erosion, corrosion, stress corrosion cracking and mechanical/thermal fatigue because any of these damage mechanisms can lead to turbine failure if overlooked or neglected.
Erosion can be caused by solid particles (eg. pipe scale) or water droplets (eg. condensation). Corrosion can be caused by corrosive contaminants in the steam supply. Stress corrosion cracking can be caused by combined presence of corrosive contaminants in the steam and high stress concentrations on highly loaded turbine components. Mechanical fatigue can be caused by loss of blade tie wires/covers or by components operating at their natural harmonic frequency. Thermal fatigue can be caused by components experiencing rapidly changing temperatures (eg. during warmups and cooldowns or when inadvertent water ingress quenches hot turbine components). ... See MoreSee Less
DESIGN: Air-cooled steam condensers for large, special purpose steam turbines driving refinery compressors are typically supplied in an A-frame configuration. The inclined single-pass tube bundle arrangement facilitates condensate drainage and collection and reduces the footprint of the condenser. Condensate, residual steam and non-condensibles flow concurrently down the tubes to a collection header. The condensate drains to a hotwell and non-condensables (eg. air) are removed via a two-stage ejector system.
A windwall is typically provided around the condenser to reduce recirculation of hot air and to prevent crosswinds impinging directly on the outer surfaces of the inclined tube bundles, thereby opposing the flow of cooling air. Recirculation is a major problem because the hotter the recirculating air, the higher the turbine back-pressure and hence the lower the power output of the turbine and the lower the capacity of the associated compressor. The higher the turbine back-pressure, the higher the steam inlet temperature to the condenser and the higher the air outlet temperature … and so on. For example, at a vacuum of 200 mbara the steam temperature would be about 60 Deg. C while at a vacuum of 250 mbara the steam temperature would be about 65 Deg. C. The resulting higher air outlet temperature exacerbates the performance debit caused by hot air recirculation - a “double whammy” impact! ... See MoreSee Less
An unintended consequence of installing a windwall around the condenser is that a portion of the crosswind is deflected under the windwall. This creates a jet stream which causes flow maldistribution as it shears across the fan ring (intake). The stronger the wind, the stronger the jet stream. In very high winds, turning losses at the ring can cause a partial vacuum to form below the fan and distortion of the velocity profile on the leading edge of the fan blades can result in a stall condition over part or all of the fan. These problems can cause a large and sudden reduction in airflow (particularly across upwind fans) which can significantly affect condenser performance and/or cause mechanical damage to the fan and gearbox.
Remember that wind speed at the elevation of the fan ring is typically 3 or 4 times higher than the wind speed at ground level (where it usually measured). A wind speed of 10 m/s could lead to a loss of fan performance sufficient to cause a turbine back-pressure increase of up to 10 mbara. If this is a persistent problem, one way to address it is to install a high strength fabric mesh wind screen (skirt) below the solid windwall. The wind screen blocks and decelerates the flow of wind as it approaches the screen and results in an increase in the static pressure below the fan.
That's my E-22-16's from Corytons FCC unit (that used to be) :-(
RELIABILITY: Take care to ensure continuity of service when changing corrosion management system (CMS) providers. The photo below shows extreme fouling at the inlet of a typical 2-pass tube bundle from a seawater-cooled product rundown cooler at a coastal refinery. The regular monitoring and biocide injection programme at this refinery had inadvertently been omitted for several weeks during the transition between two CMS providers. When continuous biocide injection was reinstated, mussels which had grown in the interim died and dislodged from the cooling water system and became trapped in the tubesheets of numerous coolers throughout the refinery. This resulted in several million dollars of lost production due to a significant loss of product cooling capacity. ... See MoreSee Less
The diving oil price will naturally lead to cost cutting efforts in maintenance and reliability budgets and this is a classic example of the disproportionate costs that can be incurred when the process is not fully thought through. I experienced a similar failure when the checking of boiler feed water quality was taken from an outside contractor and placed (temporarily) in the hands of the process operators using a plant testing facility. This was meant to be a short term fix pending a replacement contractor being put in place. However time went by and the temporary became the norm. What had been overlooked was the the operators were not trained chemist, had far inferior testing equipment and naturally put the testing as a low priority when the plant made other demands on their time. Hence a spate of corrosion failures occured and the money saved was lost many times over. Post failure review pionted out that the change of responsiblity should have undergone a management of change process. Lesson to learn is that small changes to reliability programmes may not be as simple as they first appear and we sholud avoid being penny wise but pound foolish.
RELIABILITY: Careful selection and storage of lube oils is a key requirement for reliable rotating machinery operation. The attached photo is not a piece of abstract art. It shows sediment discovered in the bottom of a 1000 litre intermediate bulk container (IBC or “lube cube”) which had been used to top up the lube oil reservoir of a process-critical compressor which subsequently suffered a gearbox failure and an unplanned shutdown.
The lube oil was a mineral oil supplied by a leading manufacturer and met all the required specifications at the time of sale. However an investigation revealed that the lube cube had been stored outdoors in the stores yard for an extended period where it had been exposed to sunlight which is believed to have promoted deposition of some of the lube oil additives. The cause of the gearbox failure was loss of lubrication at the radial bearings due to sediment blocking the very small holes in the lube oil spray nozzles. ... See MoreSee Less
RELIABILITY: Have you considered upgrading your traditional FCC air blower discharge check valve from a conventional counter-weighted swing-type valve with an oil dashpot and closure-assist air cylinder to an axial flow non-slam check valve? Non-slam check valves typically offer lower pressure drop, quicker reaction and closure time following a blower trip (due to shorter valve travel) and reduced maintenance requirements (due to absence of external control components). The lower pressure drop can be exploited either by an incremental increase in blower capacity or decrease in utility consumption for the blower driver. The quicker closure time provides additional protection for the blower which is very sensitive to pressure surges because of tight clearances between the rotor and stator blades (particularly for axial-type air blowers). ... See MoreSee Less
I'm aware of at least one FCC unit at which an under-sized counterweight and inadequate preventative maintenance of the closure-assist system caused a slower-than-design reaction and closure time for the check valve. This was a known problem for some time but was assigned a low priority for remedial repair as there had been no consequential damage to the air blower. However, this eventually became a critical factor in a safety near-miss incident when a concurrent failure of the low air flow trip system resulted in hot catalyst being discharged to atmosphere via the air blower anti-surge blowoff valve. Fortunately there was no injury to personnel and no damage to the air blower.
RELIABILITY: Continuing on the theme of technology advances, perhaps the biggest change in steam turbines has been development of digital electronic speed control and trip systems.
The photo below shows the control and trip systems for a condensing turbine driving an FCC air blower. An electronic speed control signal is converted locally to a pneumatic control signal which is fed to a pressure regulator where the signal is converted to mechanical movement. This mechanical movement is transmitted to a pilot valve through a series of linkages and levers. The pilot valve diverts high pressure control oil to one side or other of a rotary vane inside a servo-motor which opens or closes steam admission valves on the turbine steam chest.
What a dog's dinner! With so many moving and contacting parts, a high level of wear and maintenance are inevitable. Retrofitting an electro-mechanical, direct-coupled actuator eliminates the servo-motor, hydraulic subsystem and mechanical linkages and improves the reliability of the system. ... See MoreSee Less
HAPPY NEW YEAR: As an exciting new year dawns, its interesting to reflect on some of the technology advances that have taken place over the last few decades. For example, how many of you remember the days when detailed design of refinery plant involved construction of a scale model to check for pipe clashes and access for equipment maintenance? 3D-CAD has largely superceded this now and is a very versatile tool but there's something about the scale model that brings a project to life for everyone in the project team, regardless of discipline, in a way that a computer screen cannot match.
What are your favourite or least-liked technology developments? ... See MoreSee Less
Port Reading had one too - awesome piece of work. Ahh, the good old days lol
There have been lots of fantastic technology developments over the last couple of decades that have contributed to improvements in plant safety and availability. But perhaps one of the most versatile, low cost items applicable across many different process technologies is the humble thermal imaging camera (portable optical pyrometer). It is easy to use and can enable early identification of hot spots (refractory failures) and potential equipment design temperature exceedances through measurement and recording of peak external surface temperatures on furnace casings, flue gas ductwork, cold wall reactor/regenerator vessels etc. It can also be used to highlight the extent of internal fouling of air-cooled exchanger tubes and external scaling of furnace radiant tubes.
Isolation of panelmen only occurred when the DCS was centralised, (in the case of Coryton anyway). My favourite technology, (becuase I was involved with it in my last years working) is Advanced Process Control, APC. More commonly known as DMC. However, the instrumentation needs to be reliable and maintained in top order with appropriate backups in case of failure for it to work reliably. Inapproriate cost cutting was my chief dislike. Not a technology as such but it leads to decreases in plant reliability over time. Remember; for 24 hours a day, 7 days a week, 365 days a year, the plant is slowly, (or quickly) rotting itself away. You cant get away from eyes on the ground to coin a phrase from the military to spot potential plant problems.
That's right Dave. Coryton owned an FLIR "AGEMA 550 PAL" portable thermal imaging camera and employed an inspection contractor to conduct regular surveys of furnace radiant tubes across the site to verify tube metal temperature. The data generated could be used to estimate the scale thickness on the tube surface which is helpful for turnaround planning and evaluating potential benefits of applying a ceramic coating to the external surface of the tubes in certain furnaces (eg. CCR Platformer). I think the AGEMA 550 has now been superceded by the FLIR "P-Series" range of hand-held thermal imaging cameras.
Used to love these models. As a plant operator it was great for following line-ups and looking for how we were going to run the plant. DCS is my least favourite development. I know it allows for better ontrol of the plant but is has led to panel operators becoming isolated from the crew and alarm flooding that is in some cases so bad it worsens the situation. Bring back proper panels
I remember seeing those in use at Coryton. Very useful equipment. I think 3rd party contractors used them for heater tube analysis prior to turnarounds.
SAFETY REFRESHER: Liquid overfill of process equipment can result in extremely hazardous situations. A well-known and particularly severe example from recent history was the BP Texas City Raffinate Splitter overfill incident on 23-Mar-05 (15 people killed, 170+ injured).
Historically, displacers and dP cells were selected for level measurement but these are liquid density-dependent. More recently, guided wave radar (GWR) and nuclear level instruments are being used as they are not affected by liquid density. It is strongly recommended that diverse types of level instrumentation are used to avoid common mode failures.
Best practice for distillation column base level control is to use GWR for primary level control indication, a dP cell for secondary (backup) level control indication and a displacer for tertiary level control indication (if required). The dP cell and displacer should be calibrated for the LOWEST liquid density the instrument will encounter during startup, normal operation or shutdown. A deviation alarm should be provided on the distributed control system (DCS) comparing all the level indications. ... See MoreSee Less
SAFETY REFRESHER: Burners on fired heaters and boilers require more than the stoichiometric amount of air for combustion to compensate for imperfect fuel/air mixing. Hence burners are designed for specific "excess air" levels. If low excess air is suspected at the burners (eg. hazy flames), the safest way to correct the situation is to place the fuel controller on manual and reduce firing rate until proper excess air levels are restored. Do not respond by suddenly increasing air flow into the fuel-rich firebox as this may cause explosive detonation of unburned fuel. Unfortunately this has happened many times in the refining industry and there have been several fatalities. ... See MoreSee Less
ENVIRONMENT: China gets a lot of bad press about air pollution caused by heavy industry and motor vehicle emissions in and around its cities. So you may be surprised to learn that Belco Technologies (acquired by DuPont in 2006) have sold 49 EDV Wet Scrubbing systems to Chinese refiners to remove SO2 and particulates from FCC regenerator flue gases. 31 of the 49 systems were sold in the period 2013 - 2015. Its likely that other competing technologies (eg. ExxonMobil Wet Gas Scubber offered by Hamon Research-Cottrell) are having similar success. Maybe the Chinese government's rhetoric is beginning to have a tangible impact on refinery investment in pollution control measures? ... See MoreSee Less
Problem is that these contaminants have to end up somewhere. One recovery route is liquid sulphur and the market for that product is variable.So where do we put these captured pollutants?
The FCC regenerator is typically the single largest point source of SOx, NOx and particulate emissions in a refinery and is therefore an obvious target for pollution control legislation. The first applications of the Belco EDV Wet Scrubbing System on FCC units in China were at refineries operated by state-owned refiners PetroChina and Sinopec in 2007 and 2008. The success of these installations gave smaller privately-owned refineries the confidence to invest in this technology to meet increasingly stringent air emissions limits and avoid increasingly stiff penalties for non-compliance.
Technology is a key enabler for business improvement and sustainable competitive advantage. But the range of technologies available sometimes exceeds an organisation's ability to apply them. Perhaps XBP Refining Consultants Ltd. can help your organisation focus on the most appropriate technologies to meet your goals? ... See MoreSee Less
Two of the leading temperature sensor suppliers (Daily Thermetrics and Wika-Gayesco) were represented at the ERTC Conference. Both agree that best practice for refinery process heater tubeskin measurement in high temperature applications is to use shielded thermocouple designs as these limit the impact of direct radiation on the thermocouple and hence provide more accurate measurement and longer life than unshielded thermocouples. Best practice for tubeskin thermocouple installation includes maintaining the thermocouple sheath in contact with the tube as much as possible using sheath guide clips (heat sink), avoiding tight-radius bending of the sheath (thermocouple damage), placing thermocouple leads in the fire shadow of the tube and away from burners (avoid flame impingement) and exiting the heater casing as soon as possible (minimise length exposed to high temperatures). ... See MoreSee Less
The ERTC Conference is a great opportunity for refiners to catch up on industry news and technology developments as well as meeting up with friends, colleagues and new contacts. The Rome Cavalieri Hotel was a great venue and the partner's programme included walking tours around the city's most famous landmarks. Shell Global Solutions and Criterion Catalysts sponsored the gala dinner which included some excellent entertainment from three tenors who took turns to sing well known arias such as "Nessun Dorma" (Paul Potts' audition song on Britain's Got Talent) and "'O Sole Mio" (the Cornetto advert song). So it wasn't all hard yakka! ... See MoreSee Less
Its great to see there are refiners out there with deep pockets and long arms, but unfortunately not in Europe. At the ERTC Conference last week, Antony Francis of Reliance Industries (VP – Refining and Marketing Business) presented an overview of the aggressive and ongoing expansion of the Jamnagar refining hub. Their high level refining strategy is to minimise feed costs, maximise product revenues and minimise operating costs (opex). The Jamnagar hub currently has a crude capacity of 1.4 million bbls/d (more than 8 times what Coryton used to process!) and is capable of processing high acid crudes (up to 5.3 TAN). These factors give Reliance the flexibility to purchase VLCCs of poor quality crude oil at distressed prices and manage their impact on the refineries by dilution. The Jamnagar hub also incorporates a large petrochemical complex which enables Reliance to fully exploit the polyester value chain (naphtha > paraxylene (PX) > purified terephthalic acid (PTA) > polyester). Reliance are also investing in a 10.3 million te/yr petroleum coke gasification complex (10 gasifiers!) to produce syngas for power, steam and hydrogen production and a refinery offgas cracker to expand ethylene production. The gasifiers greatly reduce Reliance's dependence on expensive imported liquefied natural gas (LNG). ... See MoreSee Less
Peter Marsh has just returned from a very well-attended ERTC Conference at which Stephen Wright of Solomon Associates (VP - Europe, Middle East, Africa Operations) presented an overview of refinery performance data. This confirmed Peter's long-held belief that high reliability is the key to sustainable competitive advantage. First quartile performers exist in all regions of the world and may be single-train or multi-train refineries. So refinery configuration and turnaround interval and duration are not the dominant factors for refinery availability. Elimination of unplanned slowdowns and shutdowns through improved basic care and preventative maintenance programmes coupled with root cause analysis of equipment/procedural failures and effective communication of lessons learned are key drivers for performance improvement. ... See MoreSee Less
In August 2015, Peter Marsh elected to retire from BP after more than 30 years service. He set up a new technical consulting business to provide process technology training to oil refining and engineering contracting businesses. See his LinkedIn profile at the link below for more details of his diverse range of experience and specialist technical expertise: (uk.linkedin.com/in/peter-marsh-03292529). ... See MoreSee Less