Aug-2023

Proactively preventing reactor runaway events

A quantitative method for selecting emergency actions could prevent hydrocracker reactor temperature excursion and runaway while avoiding flaring.

Jeff Johns
Becht

Article Summary

Refiners use multiple emergency actions to react to a reactor temperature excursion or reactor runaway in a hydrocracking unit. Automatic depressuring systems (ADS) have become an industry standard for hydrocracking units. However, the choice of other emergency actions taken before or concurrently with depressuring seems to be based on personal experiences and is not consistently applied in the industry.

Autodepressuring alternatives
A quantitative method to rate the effectiveness of other safety actions to prevent a reactor runaway event or actions to be used concurrently with automatic depressuring in hydrocracking units is reviewed. The method is also suitable for rating and selecting appropriate emergency actions to stop a temperature excursion in hydrotreating units.

Appropriate emergency actions taken quickly enough may mitigate the need for a full reactor depressuring. While autodepressuring is an important safety device that must be available and utilised when necessary, it may be possible that the right emergency actions, taken early enough in a reactor temperature excursion event, could negate the need to initiate autodepressuring. In many refineries, flaring has come under intense scrutiny from regulators and communities, so avoiding or reducing flaring events has great value.

Runaway incident
The TOSCO hydrocracker runaway incident in 1997 caused the refining industry to adopt ADS for all hydrocracking units. In this ‘industry-defining’ incident, the outlet pipe of the second-stage hydrocracker reactor overheated and ruptured due to a severe runaway incident in the reactor, resulting in one fatality, 47 injuries, and substantial unit damage.

This incident should be discussed often with personnel new to hydrocracking units to pass on the lessons learned. The official report for this incident can be found here: United States Environmental Protection Agency Chemical Accident Investigation Report – TOSCO Avon Refinery Martinez California, EPA-550-R-98-0094, November 1998, Document Display | NEPIS | US EPA.

ADS systems should be designed to quickly depressure the high-pressure reactor loop of a hydrocracker when any of the following conditions are detected:
• High temperature in the reactor beds
• High temperature at the reactor outlet
• Loss of recycle gas flow to the reactor.

Emergency procedures for hydrocrackers typically call for additional emergency actions to be taken prior to automatic depressuring and additional emergency actions to be taken along with automatic depressuring. Surveys of hydrocracking experts in the industry revealed a wide variety of strategies for these additional emergency actions. In some cases, hydrocrackers within the same company had substantial variances in additional emergency actions required in unit procedures. Therefore, it makes sense to drive more consistency and efficiency in emergency actions for reactor runaway events.

Why reduce the need for automatic depressuring?
The ability to quickly depressure a reactor is a safety device that must be maintained to avoid consequences exemplified in the TOSCO incident. However, regulatory, community, and efficiency pressures on the industry have created a need to reduce flaring where possible and reasonable. Consider the following reasons to reduce flaring:
• Automatic depressuring is reactive
•  It is intended as a backstop when other measures have failed or when operators have not taken actions quickly enough
•  Ideally, operators should initiate depressuring manually before auto-depressuring is activated by the automatic safety system.

The refining industry needs to be more proactive in emergency responses because:
•  Community and regulatory pressure to avoid flaring continues to grow
•  Depressuring typically takes down a unit for 1-2 days, which can be very disruptive and provides the opportunity for additional incidents
•  Operators are sometimes hesitant to depressure but are likely to take other less disruptive actions that may not fully shut down a unit
•  Control systems technology has advanced to allow more abnormal situation detection and automation that can facilitate more proactive actions
•  Additional emergency response measures may make automatic depressuring unnecessary.

What is the difference between a temperature excursion and a runaway?
Temperature excursion is defined as a sudden increase in reactor bed or skin temperatures of 15°F (8°C) or when any reactor temperature exceeds the maximum safe reactor temperature limit. An increase of 15°F corresponds to a doubling of the reaction rate for a zeolitic hydrocracking catalyst system, which has an activation energy of about 50-70 kcal/gmol.

As you can imagine, doubling the amount of hydrocracking reactions in a reactor gives a significant increase in heat release, which requires an immediate response to prevent a temperature excursion from becoming a runaway event.

A reactor runaway is defined as any time reactor bed or skin temperatures climb beyond control. In this case, immediate emergency action is required to prevent loss of containment.