In the hydrocarbon industrys
early days, processes were relatively simple, and societal
expectations regarding safety were low by current standards.
With the development of newer process technologies, complexity
increased while societal expectations for safety in all
industrial activities also rose. Since accidental loss of
containment can result in unacceptable process safety incidents
such as fire, explosion or toxic release, a robust system for
managing safety should be in
place. Such a system should address safety vulnerabilities and
employ focused safety audits that help identify physical
conditions in need of corrective measures.
Refining is challenging because of
the large number of processing units at each plant (Fig. 1).
Crude and vacuum distillation units (CDU/VDUs)
require attention, along with a number of complex, secondary
units like fluidized catalytic crackers, delayed cokers and
visbreaking units. Refineries also have to manage hydrogen
allocation and the catalysts used to maximize distillates and
improve stream qualities. Each of these elements intensify
A quality plant safety management
program embraces audits of all stripes. These include
leadership and management evaluation, risk identification, risk
management and monitoring procedures. These evaluations should
determine if management actions prevent human injury, limit
equipment and property damage, protect the environment, comply
with legislative regulations, reduce risk and minimize loss
exposure. As a part of the audits verification phase, the
plants process safety culture should be scrutinized to
determine managements ability to prevent catastrophic
accidents, explosions, fires and toxic releases. Such
competence is verified by auditors through discussions and
field checks/inspections of the facilities, comparisons with best
practices, evaluation of safe design standards, and observation
of operating and maintenance practices.
Risk identification requires the
participation of all employees. Safety committees should be
deployed at every employment level, from the bottom to the top.
Each safety committee needs to carry out internal health,
safety and environment (HSE) audits and inspections through
focused inspection checklists. Each of the disparate units in a
refinery presents its own set of challenges, but all audits of
each unit should focus on operation control systems, work
permit system implementation, written procedures and standing
instructions. Within this common framework, though, are
different audit strategies for specific units. What follows is
an itemization of such strategies.
Crude and vacuum distillation units.
CDU/VDUs (Fig. 2) are the primary units in a refinery, and, in
certain facilities, these units are likely
to be the oldest and most debottlenecked. The units, which run
at high temperatures of up to 434°C, have some typical
vulnerabilities. For instance, column operating temperatures
are generally above auto-ignition temperatures for the heavier
product fractions (kerosine, gasoils, reduced crude, vacuum
distillates and all residues including short residues), and any
leak will invariably result in a fire incident.
The plant design must employ the correct metallurgy for the
range of sour and sweet crudes typically processed. Plant
corrosion mitigation programs are essential, along with a good
Small air leaks in VDUs can result
in combustion within a fuel-rich environment. Vacuum-hold
testing during unit commissioning is, therefore, very important
to make sure all eqipment conforms to the stipulated test
norms. Inadequate lockouts, de-energizing and energizing the
rotating equipment provide other possible pitfalls.
Operation of a VDU under abnormal
or emergency conditions, especially during startup, is a
concern. Both rotary and stationary equipment will be under
stress. Clearly written instructions enumerating approved
procedures for unit operation are essential.
A history of incidents at these
units should be compiled. Some common incidents in CDU/VDUs
include explosions inside the furnace during startup, a fire
due to a leak through piping in column bottom pumps, mechanical
seal leaks in pumps and overhead system leakage. The absence of
clear-cut instructions and deviations from written procedures
have also led to accidents.
Catalytic reforming units, naphtha hydrotreaters and
isomerization units all involve the handling of hydrogen under
high pressures and temperatures. Since hydrogen has explosive
limits of 4%74%, very little energy is required to ignite
it. Hydrogen mishaps can stem from procedural deficiencies,
material failures or material incompatibility. Operational and
work area deficiencies and design flaws are other common causes
of trouble. Since these units operate at a high temperature
involving hydrogen and catalysts, the equipment must withstand
mechanical stress from internal pressure and thermal excess.
Policies should be in place, to address hydrogen leaks from
flanges, tube ruptures or process upsets.
Events that contribute to hazardous delayed coker unit (DCU)
operations include coke drum switching, coke drum head removal
and coke cutting. Coke transfer, processing, and storage can
also lead to safety incidents. Because of these factors,
emergency evacuation policies should be reviewed regularly.
Workers at a DCU run the risk of toxic exposures, dust
irritants and burn trauma.
Fluidized catalytic cracker
units (FCCUs). FCCUs upgrade heavy hydrocarbons to
lighter, more valuable products by cracking at high temperature
in the presence of catalysts. Safety vulnerabilities specific
to FCCUs are numerous (Fig. 3). Risk can escalate when the
operation is nonroutine (especially during startup and
shutdown), and when equipment maintenance is taking place or
utility disruption has occurred. There is significantly more
wear and tear on the process equipment during these
Unstable catalyst circulation in FCCUs can lead to surges in
the pressure and temperature balance. During these activities,
a significant amount of expansion and contraction occurs and
excessive stress is placed on the equipment. This can lead to
the opening of process flanges and subsequent hydrocarbon leaks
The bottom of the main fractionator
is also vulnerable because it handles high temperature oil
above the flash point. Vigilant maintenance is required to
prevent fouling. Yet another high hazard operation involves
changing the reactor vapor blind. Exposure to toxic gases
during deblinding and blinding is a preventable error.
Many refineries employ hydrocracking technology to convert heavy
hydrocarbon oils into lighter and more valuable products. One
safety concern with hydrocrackers is the possibility that the
heat generated in the reaction will raise the temperature of
the catalyst bed, leading to increased reaction rates and more
heat generation. This effect can spiral out of control and
result in a potential loss of integrity of the reactor vessel
or piping due to excessive temperature. In an emergency
situation, depressurization can stop the reaction. When
depressurizing, the reactor pressure and partial pressure of
the hydrogen decrease and the reaction rate quickly falls off.
However, a delay in depressurizing the reactor can result in a
temperature excursion leading to a major catastrophe.
Improper reactor pressurization,
heating or cooling can lead to embrittlement in a hydrocracker.
The unit handles large amounts of hydrogen sulfide in its
high-pressure and sour water system and any sour water system
leak can be extremely dangerous.
Offsite storage and
handling. Petroleum products are normally stored above
ground at atmospheric pressure, within low pressure storage
tanks or in underground tanks. Distribution of petroleum
products from storage is executed via truck, pipeline, tanker
or barge. Fire and explosions are a potential danger resulting
from leaks or overflow of the storage tanks. During loading and
unloading activities, these dangers are particularly acute.
Possible ignition sources include sparks associated with the
buildup of static electricity, lightning and open flames. Pipes
and other ancillary equipment are also potential sources for an
Sulfur block. This
section of the refinery usually includes the sulfur
recovery unit, sour water stripper and amine units. One source
of possible trouble here involves the offgas from the sour
water stripper and amine regeneration unit. This offgas
contains a high percentage of toxic hydrogen sulfide, and any
leak from the system can result in toxic exposure to operating
The sulfur recovery unit is prone
to chokage. Dechoking can happen by shifting the unit to fuel
gas mode, but this might result in a runaway reaction that
leads to auto-ignition of sulfur deposits which opens process
lines and thus exposes hydrogen sulfide. It should also be
noted that the sour water containing hydrogen sulfide cannot be
released to an open sewer, which otherwise would cause flashing
of dissolved hydrogen sulfide into the atmosphere.
Flaring. A flare
is a pressure safety relief device used to ensure that the
equipment does not exceed the safety limits set to maintain the
process units integrity. A flares function is to
eliminate excess process gas by burning it off. However, a
flare ignition failure may lead to unburned venting of
dangerous gases, creating an explosion hazard. The
effectiveness of flaring is dependent upon one or more
continuously burning pilots for immediate and sustained
ignition of gases exiting the flare burner. Since pilot failure
can compromise safety and effectiveness, it should be detected
quickly and accurately to allow for prompt response from an
Air entry into the flare header
system can be catastrophic. A safety rule of thumb here is to
allow no flow conditions that can lead to a vacuum in the flare
header. Another common malady is the abnormal loading of flare
headers due to the sudden release of a flare discharge during a
Know the vulnerabilities.
Hazard audits and risk
identifications are key to maintaining a safe plant. Process
and personal safety incidents should lead to a variety of
thorough examinations. The work permit system for maintenance activities should
include confined space entry and hot jobs. Standard operating
procedures at the facility must be clearly spelled out,
especially with regard to startups, shutdowns and abnormal
situations. Electrical safety (including static electricity)
should not be overlooked. Ample personal protective equipment
needs to always be available.
Management needs to carry out HSE
reviews at all levels, focusing on agenda items such as
near-miss incidents and root causes. The internal audit
recommendations should assign responsibilities for each action
item. The progress of these HSE reviews should be monitored
through safety meetings. Top management also needs to provide
financial and technical support for risk minimization. By
recognizing vulnerabilities and taking action to address such
weaknesses, management and employees can run a safe and
incident-free plant. HP