Aug-2019

Fundamentals of refinery safety

A study of process safety considerations arising from a raffinate splitter explosion.

NORMAN LIEBERMAN
Process Improvement Engineering

Article Summary

Refinery safety relies upon two questions:
1. Is the process design intrinsically dangerous?
2. Do shift operators understand how their instruments function?

Safety in refineries is not a matter of attitude. Safety is a product of the knowledge of process engineer and console operators. The explosion at Texas City was related to three factors: relief valve location, level indication, and flow measurement.

Location of relief valve
Referring to Figure 1, we have shown two possible locations for the tower pressure relief valve. Which is correct?

The correct choice is position 1. If the tower floods, the liquid head pressure in the vapour line will cause the relief valve at position 2 to open, due to the static head of liquid in the vapour line, even though tower pressure is not excessive. Large volumes of liquid will then flow into the relief valve header system, which hopefully is connected to the flare and not to an atmospheric vent, as discussed below.

Level indication
Liquid levels are not measured directly. They are indirectly measured by means of a ‘level-trol’ (see Figure 2). The pressure difference (DP) between P1 and P2 (psi) is measured, and then converted into inches of level (DH) by use of Equation 1:

DH = (DP) (28) ÷ (SG)          (1)

where SG = specific gravity of the liquid
The specific gravity used is called the ‘calibration specific gravity’. It is not typically adjusted for months or years, that is, until the instrument technician recalibrates the level-trol. If the fluid in the level-trol becomes less dense than normal, the indicated level on the panel, relative to the real level in the vessel, will decline, as  discussed.

Flow measurement
Flows are indirectly measured by use of a flow orifice plate. The DP across the orifice plate is measured and then converted to flow using Equation 2 (see Figure 2):

Flow µ (K • ∆P)½                 (2)

where K = orifice coefficient
The factor that many operators do not know is how to correct a flow for a meter being off-zero. Let us say the meter on the instrument is reading a flow of A. The meter is then bypassed so that the observed flow should drop to zero, but it only drops to B. To calculate the correct flow, use Equation 3:

Corrected Flow = [(A2 – B2)]½              (3)

In the 1960s, when flows were indicated on a strip chart recorder, we made this correction with a pencil, as the paper strip was already calibrated for the square root function. With a digital display, this correction must be made with Equation 3.

Raffinate splitter explosion
 – Texas City

The following story relates to an incident that was a combination of operators not understanding how level and flow instruments worked, and process engineers not adhering to good design practices.

In 1974, I was waiting for the elevator in the Amoco Oil Building in Chicago with Gary Elmer. “Norm,” Gary said, “if Amoco is in such a rush to get the xylene splitter at Texas City built, they should pay me overtime. How about filling out some data sheets to help me for a few days?”
So, to a minor extent, I participated in the design of the xylene splitter. After the isomerisation unit at Texas City was built, the tower was transformed into a raffinate splitter, which became the most famous distillation tower in America.

In 2005, the tower’s relief valve opened as a consequence of a high liquid level. A cloud of naphtha vapour formed because the relief valve was not connected to the flare. It vented indirectly to the atmosphere. The naphtha vapours were ignited by a truck engine and exploded. Fifteen contractors were crushed to death in a trailer and 180 injured. The price of gasoline rose by 10 cents a gallon in the US, as the refinery was the largest producer of gasoline in America.

The understanding in the industry is that this was a consequence of connecting the relief valve vent to the atmosphere, rather than to the refinery flare. The real story is more complex.

Background
The author worked as an operating supervisor in Texas City, and as a process engineer in Chicago for Amoco Oil between 1965 and 1981, and designed 7% of the process equipment in Texas City (cokers, sulphur recovery, light ends fractionation, amine system, fuel gas treating). For the distillation towers, the author supervised the debutaniser, butane splitter, depropaniser and butane-pentane splitter. All the relief valves were located at the top of the towers. All relieved directly to the atmosphere. The reason the author did not object to this design was because it was that way when he had assumed supervision of the process. Also, the towers had been commissioned in 1958 and nothing had happened yet. What would result if a tower flooded due to a high liquid level, and the relief valve opened, was not a question that was considered.

Fundamental causes of raffinate splitter explosion
The documented, industry-accepted causes of the raffinate splitter failure are:
•    Relief valve not connected to plant flare
•    Operator laxity.

However, there are a number of other errors that have not been fully explained (see Figure 3):
1.    Design of the loop seal draining the blowdown tower to the three psig (3#) condensate collection system
2.    Elevation of the splitter relief valves relative to the top of the tower
3.    Lack of technical support during start-up operations
4.    Operators not understanding the relationship between tower bottom  temperature and tower bottoms indicated level
5.    Operators not understanding the concept of a level-trol being ‘tapped-out’.
6.    Failure to check liquid head pressure at the bottom of the tower.