In the hydrocarbon industrys early days, processes were relatively simple, and societal expectations regarding safety were low by current standards. With the development of newer process technologies, complexity increased while societal expectations for safety in all industrial activities also rose. Since accidental loss of containment can result in unacceptable process safety incidents such as fire, explosion or toxic release, a robust system for managing safety should be in place. Such a system should address safety vulnerabilities and employ focused safety audits that help identify physical conditions in need of corrective measures.
Refining is challenging because of the large number of processing units at each plant (Fig. 1). Crude and vacuum distillation units (CDU/VDUs) require attention, along with a number of complex, secondary units like fluidized catalytic crackers, delayed cokers and visbreaking units. Refineries also have to manage hydrogen allocation and the catalysts used to maximize distillates and improve stream qualities. Each of these elements intensify potential hazards.
A quality plant safety management program embraces audits of all stripes. These include leadership and management evaluation, risk identification, risk management and monitoring procedures. These evaluations should determine if management actions prevent human injury, limit equipment and property damage, protect the environment, comply with legislative regulations, reduce risk and minimize loss exposure. As a part of the audits verification phase, the plants process safety culture should be scrutinized to determine managements ability to prevent catastrophic accidents, explosions, fires and toxic releases. Such competence is verified by auditors through discussions and field checks/inspections of the facilities, comparisons with best practices, evaluation of safe design standards, and observation of operating and maintenance practices.
Risk identification requires the participation of all employees. Safety committees should be deployed at every employment level, from the bottom to the top. Each safety committee needs to carry out internal health, safety and environment (HSE) audits and inspections through focused inspection checklists. Each of the disparate units in a refinery presents its own set of challenges, but all audits of each unit should focus on operation control systems, work permit system implementation, written procedures and standing instructions. Within this common framework, though, are different audit strategies for specific units. What follows is an itemization of such strategies.
Crude and vacuum distillation units. CDU/VDUs (Fig. 2) are the primary units in a refinery, and, in certain facilities, these units are likely to be the oldest and most debottlenecked. The units, which run at high temperatures of up to 434°C, have some typical vulnerabilities. For instance, column operating temperatures are generally above auto-ignition temperatures for the heavier product fractions (kerosine, gasoils, reduced crude, vacuum distillates and all residues including short residues), and any leak will invariably result in a fire incident.
The plant design must employ the correct metallurgy for the range of sour and sweet crudes typically processed. Plant corrosion mitigation programs are essential, along with a good desalter operation.
Small air leaks in VDUs can result in combustion within a fuel-rich environment. Vacuum-hold testing during unit commissioning is, therefore, very important to make sure all eqipment conforms to the stipulated test norms. Inadequate lockouts, de-energizing and energizing the rotating equipment provide other possible pitfalls.
Operation of a VDU under abnormal or emergency conditions, especially during startup, is a concern. Both rotary and stationary equipment will be under stress. Clearly written instructions enumerating approved procedures for unit operation are essential.
A history of incidents at these units should be compiled. Some common incidents in CDU/VDUs include explosions inside the furnace during startup, a fire due to a leak through piping in column bottom pumps, mechanical seal leaks in pumps and overhead system leakage. The absence of clear-cut instructions and deviations from written procedures have also led to accidents.
Other units. Catalytic reforming units, naphtha hydrotreaters and isomerization units all involve the handling of hydrogen under high pressures and temperatures. Since hydrogen has explosive limits of 4%74%, very little energy is required to ignite it. Hydrogen mishaps can stem from procedural deficiencies, material failures or material incompatibility. Operational and work area deficiencies and design flaws are other common causes of trouble. Since these units operate at a high temperature involving hydrogen and catalysts, the equipment must withstand mechanical stress from internal pressure and thermal excess. Policies should be in place, to address hydrogen leaks from flanges, tube ruptures or process upsets.
Delayed coker. Events that contribute to hazardous delayed coker unit (DCU) operations include coke drum switching, coke drum head removal and coke cutting. Coke transfer, processing, and storage can also lead to safety incidents. Because of these factors, emergency evacuation policies should be reviewed regularly. Workers at a DCU run the risk of toxic exposures, dust irritants and burn trauma.
Fluidized catalytic cracker units (FCCUs). FCCUs upgrade heavy hydrocarbons to lighter, more valuable products by cracking at high temperature in the presence of catalysts. Safety vulnerabilities specific to FCCUs are numerous (Fig. 3). Risk can escalate when the operation is nonroutine (especially during startup and shutdown), and when equipment maintenance is taking place or utility disruption has occurred. There is significantly more wear and tear on the process equipment during these intervals.
Unstable catalyst circulation in FCCUs can lead to surges in the pressure and temperature balance. During these activities, a significant amount of expansion and contraction occurs and excessive stress is placed on the equipment. This can lead to the opening of process flanges and subsequent hydrocarbon leaks and fires.
The bottom of the main fractionator is also vulnerable because it handles high temperature oil above the flash point. Vigilant maintenance is required to prevent fouling. Yet another high hazard operation involves changing the reactor vapor blind. Exposure to toxic gases during deblinding and blinding is a preventable error.
Hydrocracker unit. Many refineries employ hydrocracking technology to convert heavy hydrocarbon oils into lighter and more valuable products. One safety concern with hydrocrackers is the possibility that the heat generated in the reaction will raise the temperature of the catalyst bed, leading to increased reaction rates and more heat generation. This effect can spiral out of control and result in a potential loss of integrity of the reactor vessel or piping due to excessive temperature. In an emergency situation, depressurization can stop the reaction. When depressurizing, the reactor pressure and partial pressure of the hydrogen decrease and the reaction rate quickly falls off. However, a delay in depressurizing the reactor can result in a temperature excursion leading to a major catastrophe.
Improper reactor pressurization, heating or cooling can lead to embrittlement in a hydrocracker. The unit handles large amounts of hydrogen sulfide in its high-pressure and sour water system and any sour water system leak can be extremely dangerous.
Offsite storage and handling. Petroleum products are normally stored above ground at atmospheric pressure, within low pressure storage tanks or in underground tanks. Distribution of petroleum products from storage is executed via truck, pipeline, tanker or barge. Fire and explosions are a potential danger resulting from leaks or overflow of the storage tanks. During loading and unloading activities, these dangers are particularly acute. Possible ignition sources include sparks associated with the buildup of static electricity, lightning and open flames. Pipes and other ancillary equipment are also potential sources for an incident.
Sulfur block. This section of the refinery usually includes the sulfur recovery unit, sour water stripper and amine units. One source of possible trouble here involves the offgas from the sour water stripper and amine regeneration unit. This offgas contains a high percentage of toxic hydrogen sulfide, and any leak from the system can result in toxic exposure to operating personnel.
The sulfur recovery unit is prone to chokage. Dechoking can happen by shifting the unit to fuel gas mode, but this might result in a runaway reaction that leads to auto-ignition of sulfur deposits which opens process lines and thus exposes hydrogen sulfide. It should also be noted that the sour water containing hydrogen sulfide cannot be released to an open sewer, which otherwise would cause flashing of dissolved hydrogen sulfide into the atmosphere.
Flaring. A flare is a pressure safety relief device used to ensure that the equipment does not exceed the safety limits set to maintain the process units integrity. A flares function is to eliminate excess process gas by burning it off. However, a flare ignition failure may lead to unburned venting of dangerous gases, creating an explosion hazard. The effectiveness of flaring is dependent upon one or more continuously burning pilots for immediate and sustained ignition of gases exiting the flare burner. Since pilot failure can compromise safety and effectiveness, it should be detected quickly and accurately to allow for prompt response from an operator.
Air entry into the flare header system can be catastrophic. A safety rule of thumb here is to allow no flow conditions that can lead to a vacuum in the flare header. Another common malady is the abnormal loading of flare headers due to the sudden release of a flare discharge during a plant emergency.
Know the vulnerabilities.
Hazard audits and risk identifications are key to maintaining a safe plant. Process and personal safety incidents should lead to a variety of thorough examinations. The work permit system for maintenance activities should include confined space entry and hot jobs. Standard operating procedures at the facility must be clearly spelled out, especially with regard to startups, shutdowns and abnormal situations. Electrical safety (including static electricity) should not be overlooked. Ample personal protective equipment needs to always be available.
Management needs to carry out HSE reviews at all levels, focusing on agenda items such as near-miss incidents and root causes. The internal audit recommendations should assign responsibilities for each action item. The progress of these HSE reviews should be monitored through safety meetings. Top management also needs to provide financial and technical support for risk minimization. By recognizing vulnerabilities and taking action to address such weaknesses, management and employees can run a safe and incident-free plant. HP