At 7:41 p.m. a section of effluent piping ruptured on the Hydrocracker Reactor of a Refinery. A mixture of light gases (methane, butane ), light and heavy gasoline, gas oil and hydrogen was released from the pipe and instantly ignited upon contact with air, causing an explosion and fire. An operator who was checking a field temperature panel at the base of the reactor was killed; 46 employees or contractors were injured, 13 hospitalised.
The effluent pipe ruptured because of excessively high temperature (over 760°C) stemming from catalyst bed. The excessive heat generated in Bed 5 was initiated by a reactor temperature excursion that began with a hot spot in Bed 4 of Reactor 3 (most likely caused by poor flow and heat distribution within the catalyst bed) and spread through Bed 5. The excursion was not brought under control because the Stage 2 reactors were not depressured and shut down as required when the reactor temperatures exceeded the 426°C temperature limit specified in the written operating procedures. Operators did not activate the emergency procedure because they were confused about whether a temperature excursion was actually occurring due to poor alarms (no additional audible high temperature alarm), fluctuating readings that obliged an operator to go read the temperature under the reactor etc.
The environmental protection agency investigated the case and pointed out poor safety design and lacks in management such as :
- Inadequate operating conditions : management did not recognize or address the conflict between acceptable performance goals and risks. Negative consequences from the past instances of use of the depressuring system may have contributed to operators’ reluctance to implement depressuring when required.
- Poor design of the Reactor Temperature Monitoring System : 3 different instrumentation systems were used to obtain temperature data, access to the most critical monitoring points located underneath the reactors (and not from the control room), alarm system allowing one alarm to be received at a time, no distinction between emergency alarms and other operating alarms Hydrogen purity analysis data available to operators lagged seven minutes behind the actual time of the analysis and provided misleading information to the operators.
- inadequate supervisory Management. Problem incidents were not always properly communicated to management and inconsistent application of emergency procedures was tolerated by management. No comprehensive operator training, including refresher training, had been implemented to address all hazards associated with Hydrocracker Unit operations. No management of change program was implemented to address mechanical changes or operational changes such as those needed for the change in catalyst.
- inadequate Operational Readiness and Maintenance : the temperature monitor (data logger) in the control room was unreliable and out of service sometimes, Radio communications needed to relay temperature data from outside panels to the control room were unreliable and did not function during the incident, emergency depressuring system was not tested to ensure its reliability when needed
- inadequate operator training : out of date training materials, no specific training (on temperature instrumentation or abnormal operating situations ).
- outdated or incomplete procedures. Recommendations from several incidents were not incorporated into procedures. Procedures were not developed for many operations, including obtaining temperature data from outside field panels underneath the reactors.
- poor Process Hazard Analysis, that did not even reflect the actual equipment and instrumentation used in the process.
