A hydrocracker unit (HCU) was being restarted after a spurious high reactor temperature trip. Hydrogen was circulating through the reaction section with hydrogen leak-off from the high pressure (HP)
A hydrocracker unit (HCU) was being restarted after a spurious high reactor temperature trip. Hydrogen was circulating through the reaction section with hydrogen leak-off from the high pressure (HP) separator liquid outlet to the low pressure (LP) separator being regulated by 2 control valves. When the control valves were placed in manual mode, they opened fully and overpressured the LP separator. The vessel suffered an explosive failure, releasing its contents to atmosphere as a cloud or mist which subsequently ignited. The force generated by the explosion was equivalent to 90 kg (198 lb) of TNT and large fragments from the disintegrated vessel were projected over 1 km (0.6 miles) away. A contract crane driver in the vicinity was killed. Fortunately, the incident occurred on a Sunday morning when there were far fewer personnel on site than a normal weekday and none of the fragments hit any personnel or vulnerable plant. Surface water drains partially blocked with waxy material were overwhelmed by the volume of firewater used to tackle the blaze, resulting in flooding of the area. Leaking petroleum spirit spread over a large area of the pooled water and several flash fires erupted in locations where the foam blanket was not complete or had separated.
Basic cause was overpressure and catastrophic failure of the LP separator vessel due to gas breakthrough from the upstream HP separator.
Critical factors included:
1) The alarms on the HP separator extra-low level detection system failed (operators not alerted to imminent danger),
2) The low level trip system on the HP separator had been deliberately taken out of service (no automatic shutoff capability on liquid outlet),
3) The gas outlet line on the HP separator was isolated (valved closed) while the HCU was on standby with no feed to unit (PSV was only available route for gas disposal).
Root causes included:
1) Inadequate design of HP separator liquid shutoff system (independent extra-low level detection and secondary shutoff valve) and LP separator PSV (not sized for gas breakthrough),
2) Inadequate heat tracing and insulation (extra-low level switches),
3) Failure to conduct a Management of Change (MoC) review (removal of HP separator low level trip),
4) Inadequate startup procedures and training (warmup and blowthrough of inter-connecting pipework between HP and LP separators),
5) Inadequate safety management system (failure to ensure protective systems are maintained and tested),
6) Failure to learn (previous near miss incident).
1) The company urgently reviewed all HP/LP interfaces on worldwide assets and rectified deficiencies in overpressure protection,
2) Trip systems should only be disconnected after careful risk assessment and an MOC review have been completed to verify that alternative means are in place to adequately control the associated hazards. Also, the basis for the risk assessment should be properly documented and should highlight any conditions affecting validity of the change (e.g. maximum duration).
IChemE SLPSafety & Loss Prevention Special Interest Group