In the hydrocarbon industrys early days,
processes were relatively simple, and societal expectations
regarding safety were low by current standards. With the
development of newer process technologies, complexity increased
while societal expectations for safety in all industrial
activities also rose. Since accidental loss of containment can
result in unacceptable process safety incidents such as fire,
explosion or toxic release, a robust system for managing safety should be in place. Such a
system should address safety vulnerabilities and employ focused
safety audits that help identify physical conditions in need of
Refining is challenging because of
the large number of processing units at each plant (Fig. 1).
Crude and vacuum distillation units (CDU/VDUs)
require attention, along with a number of complex, secondary
units like fluidized catalytic crackers, delayed cokers and
visbreaking units. Refineries also have to manage hydrogen
allocation and the catalysts used to maximize distillates and
improve stream qualities. Each of these elements intensify
A quality plant safety management
program embraces audits of all stripes. These include
leadership and management evaluation, risk identification, risk
management and monitoring procedures. These evaluations should
determine if management actions prevent human injury, limit
equipment and property damage, protect the environment, comply with legislative
regulations, reduce risk and minimize loss exposure. As a part
of the audits verification phase, the plants
process safety culture should be scrutinized to determine
managements ability to prevent catastrophic accidents,
explosions, fires and toxic releases. Such competence is
verified by auditors through discussions and field
checks/inspections of the facilities, comparisons with best
practices, evaluation of safe design standards, and observation
of operating and maintenance practices.
Risk identification requires the
participation of all employees. Safety committees should be
deployed at every employment level, from the bottom to the top.
Each safety committee needs to carry out internal health,
safety and environment (HSE) audits and
inspections through focused inspection checklists. Each of the
disparate units in a refinery presents its own set of
challenges, but all audits of each unit should focus on
operation control systems, work permit system implementation,
written procedures and standing instructions. Within this
common framework, though, are different audit strategies for
specific units. What follows is an itemization of such
Crude and vacuum distillation units.
CDU/VDUs (Fig. 2) are the primary units in a refinery, and, in
certain facilities, these units are likely
to be the oldest and most debottlenecked. The units, which run
at high temperatures of up to 434°C, have some typical
vulnerabilities. For instance, column operating temperatures
are generally above auto-ignition temperatures for the heavier
product fractions (kerosine, gasoils, reduced crude, vacuum
distillates and all residues including short residues), and any
leak will invariably result in a fire incident.
The plant design must employ the correct metallurgy for the
range of sour and sweet crudes typically processed. Plant
corrosion mitigation programs are essential, along with a good
Small air leaks in VDUs can result
in combustion within a fuel-rich environment. Vacuum-hold testing
during unit commissioning is, therefore, very important to make
sure all eqipment conforms to the stipulated test norms.
Inadequate lockouts, de-energizing and energizing the rotating
equipment provide other possible pitfalls.
Operation of a VDU under abnormal
or emergency conditions, especially during startup, is a
concern. Both rotary and stationary equipment will be under
stress. Clearly written instructions enumerating approved
procedures for unit operation are essential.
A history of incidents at these
units should be compiled. Some common incidents in CDU/VDUs
include explosions inside the furnace during startup, a fire
due to a leak through piping in column bottom pumps, mechanical
seal leaks in pumps and overhead system leakage. The absence of
clear-cut instructions and deviations from written procedures
have also led to accidents.
Catalytic reforming units, naphtha hydrotreaters and
isomerization units all involve the handling of hydrogen under
high pressures and temperatures. Since hydrogen has explosive
limits of 4%74%, very little energy is required to ignite
it. Hydrogen mishaps can stem from procedural deficiencies,
material failures or material incompatibility. Operational and
work area deficiencies and design flaws are other common causes
of trouble. Since these units operate at a high temperature
involving hydrogen and catalysts, the equipment must withstand
mechanical stress from internal pressure and thermal excess.
Policies should be in place, to address hydrogen leaks from
flanges, tube ruptures or process upsets.
Events that contribute to hazardous delayed coker unit (DCU)
operations include coke drum switching, coke drum head removal
and coke cutting. Coke transfer, processing, and storage can
also lead to safety incidents. Because of these factors,
emergency evacuation policies should be reviewed regularly.
Workers at a DCU run the risk of toxic exposures, dust
irritants and burn trauma.
Fluidized catalytic cracker
units (FCCUs). FCCUs upgrade heavy hydrocarbons to
lighter, more valuable products by cracking at high temperature
in the presence of catalysts. Safety vulnerabilities specific
to FCCUs are numerous (Fig. 3). Risk can escalate when the
operation is nonroutine (especially during startup and
shutdown), and when equipment maintenance is taking place or
utility disruption has occurred. There is significantly more
wear and tear on the process equipment during these
Unstable catalyst circulation in FCCUs can lead to surges in
the pressure and temperature balance. During these activities,
a significant amount of expansion and contraction occurs and
excessive stress is placed on the equipment. This can lead to
the opening of process flanges and subsequent hydrocarbon leaks and fires.
The bottom of the main fractionator
is also vulnerable because it handles high temperature oil
above the flash point. Vigilant maintenance is required to
prevent fouling. Yet another high hazard operation involves
changing the reactor vapor blind. Exposure to toxic gases
during deblinding and blinding is a preventable error.
Many refineries employ hydrocracking technology to convert heavy hydrocarbon oils into lighter and more
valuable products. One safety concern with hydrocrackers is the
possibility that the heat generated in the reaction will raise
the temperature of the catalyst bed, leading to increased
reaction rates and more heat generation. This effect can spiral
out of control and result in a potential loss of integrity of
the reactor vessel or piping due to excessive temperature. In
an emergency situation, depressurization can stop the reaction.
When depressurizing, the reactor pressure and partial pressure
of the hydrogen decrease and the reaction rate quickly falls
off. However, a delay in depressurizing the reactor can result
in a temperature excursion leading to a major catastrophe.
Improper reactor pressurization,
heating or cooling can lead to embrittlement in a hydrocracker.
The unit handles large amounts of hydrogen sulfide in its
high-pressure and sour water system and any sour water system
leak can be extremely dangerous.
Offsite storage and
handling. Petroleum products are normally stored above
ground at atmospheric pressure, within low pressure storage
tanks or in underground tanks. Distribution of petroleum
products from storage is executed via truck, pipeline, tanker
or barge. Fire and explosions are a potential danger resulting
from leaks or overflow of the storage tanks. During loading and
unloading activities, these dangers are particularly acute.
Possible ignition sources include sparks associated with the
buildup of static electricity, lightning and open flames. Pipes
and other ancillary equipment are also potential sources for an
Sulfur block. This
section of the refinery usually includes the sulfur
recovery unit, sour water stripper and amine units. One
source of possible trouble here involves the offgas from the
sour water stripper and amine regeneration
unit. This offgas contains a high percentage of toxic hydrogen
sulfide, and any leak from the system can result in toxic
exposure to operating personnel.
The sulfur recovery unit is prone
to chokage. Dechoking can happen by shifting the unit to fuel
gas mode, but this might result in a runaway reaction that
leads to auto-ignition of sulfur deposits which opens process
lines and thus exposes hydrogen sulfide. It should also be
noted that the sour water containing hydrogen sulfide cannot be
released to an open sewer, which otherwise would cause flashing
of dissolved hydrogen sulfide into the atmosphere.
Flaring. A flare
is a pressure safety relief device used to ensure that the
equipment does not exceed the safety limits set to maintain the
process units integrity. A flares function is to
eliminate excess process gas by burning it off. However, a
flare ignition failure may lead to unburned venting of
dangerous gases, creating an explosion hazard. The
effectiveness of flaring is dependent upon one or more
continuously burning pilots for immediate and sustained
ignition of gases exiting the flare burner. Since pilot failure
can compromise safety and effectiveness, it should be detected
quickly and accurately to allow for prompt response from an
Air entry into the flare header
system can be catastrophic. A safety rule of thumb here is to
allow no flow conditions that can lead to a vacuum in the flare
header. Another common malady is the abnormal loading of flare
headers due to the sudden release of a flare discharge during a
Know the vulnerabilities.
Hazard audits and risk
identifications are key to maintaining a safe plant. Process
and personal safety incidents should lead to a variety of
thorough examinations. The work permit system for maintenance activities should
include confined space entry and hot jobs. Standard operating
procedures at the facility must be clearly spelled out,
especially with regard to startups, shutdowns and abnormal
situations. Electrical safety (including static electricity)
should not be overlooked. Ample personal protective equipment
needs to always be available.
Management needs to carry out HSE
reviews at all levels, focusing on agenda items such as
near-miss incidents and root causes. The internal audit
recommendations should assign responsibilities for each action
item. The progress of these HSE reviews should be monitored
through safety meetings. Top management also needs to provide
financial and technical support for risk minimization. By
recognizing vulnerabilities and taking action to address such
weaknesses, management and employees can run a safe and
incident-free plant. HP