Warm Diesel Spill

Safety Incident Topic: Warm Diesel Spill When Loosening Plug
Location of Incident: Refinery, Australia
Date of Incident: 12 June, 2007

Brief Account of Incident
The Distillate Ultrafiner was being shut down for maintenance. Part of the procedure called for soda ash washing of a heat exchanger bank. Temporary fittings were required to enable the soda ash wash. Work to prepare for blinding was being conducted by fitters while operators progressed the draining and depressuring of the unit. A plug on a heat exchanger was loosened to check if the heat exchanger was empty and depressured in preparation to installing a soda ash wash fitting. Upon the initial loosening some diesel came out of the tapered plug, but this stopped. Upon further loosening, the plug came out of the socket and ~400L of warm diesel flowed out of the exchanger under pressure. The diesel stream hit a concrete pillar, forming fine droplets. The diesel pooled and ran towards the vacuum distillation charge furnace. The diesel did not ignite. With an operator directing, the fitters responded in running out and manning fire hoses. The supervising operator isolated the heat exchanger bank from the source of pressure. The control room was contacted and instructed to sound the active aid alarm. Emergency responders arrived at the incident scene, relieved the fitters and mitigated escalation. The supervising operator installed the soda ash wash fitting when the system was depressured to re-establish containment. After securing the site, the diesel spill was removed by vacum truck.

Investigation Findings
The work was being done following an operations procedure with a blind list under the supervision of an operator. The supervising operator asked the fitters to second bolt a number of heat exchanger flanges to prepare for blinding. The operator and the fitters talked about the step of pulling a plug to install the soda ash wash fitting. The operator thought that he clearly communicated that the step of pulling the plug was not to be done until the blind was in place, after completely draining the heat exchanger bank and isolating it from the stabiliser.The fitters’ understanding was that the operator had instructed them to pull the plug and install the soda ash wash fitting. It was believed that the heat exchanger bank was open to drain to the pump out system. After initially loosening the plug, the fitters checked and confirmed that the figure 8 blind had been swung to the open position and the valves were lined up to the pump out drum. Subsequent checks confirmed that the pump out line was not blocked. The level in the pump out drum remained constant while the heat exchanger was thought to be draining (this is the subject of ongoing investigation). The fitters had conducted a personal job safety analysis (PJSA). The hazard of breaking containment on live equipment was not raised on the PJSA. The procedure had not been progressed to the stage where breaking containment was called for.

What Went Wrong (critical factors)
1. Containment was broken when it was not safe to do so. The plug was loosened based on the fitter’s understanding of the operator’s verbal instruction. The operator and the fitter did not have a common understanding of how far the procedure had progressed and whether or not it was safe to break containment.
2. Containment was broken by loosening a plug. Once the plug came out of the socket, it was impossible to control the outflow of diesel until the system could be isolated from fuel gas pressure.
3. There was no valve or flange on the plug hole to allow a safer means of checking the pressure and liquid level. Verification that the system was drained and depressured was by loosening the plug. This method was not appropriate.

Immediate Causes
1. Servicing of energised equipment. The heat exchanger bank was at stabiliser pressure using fuel gas, let down to flare. The heat exchanger bank had not completely drained when the plug was loosened.
2. Inadequate isolation of process or equipment. The plug was not a suitable form of isolation from the process to break containment because once the plug was removed from the socket the plug could not be replaced until the system had depressurised.
3. Inadequate equipment. The heat exchanger bank did not have an adequate or obvious means of determining that the shell side of the heat exchanger was fully drained and depressurised

System Causes
1. Human factors consideration. Verbal communications in the plant are susceptible to misunderstanding.
2. Inadequate implementation of policy / standards / procedures. In the procedure the step for isolating the heat exchangers from the stabilizer appears after the step to install the temporary fittings.The operating procedure was ambiguous on when to install the isolating blind on the shell side inlet of the heat exchanger. The step to install the blind appeared twice in steps K11 and L21. Step L21 appeared after the step (L13) calling for the installation of the soda ash wash fitting.
3. Inadequate assessment of needs and risks the plug was loosened without positive confirmation that the shell side of the exchanger was drained of liquid and depressurised.
4. Inadequate technical design. The heat exchanger bank requires periodic repair and maintenance. To prepare for this maintenance, the heat exchanger must be drained, gas freed and opened. The lack of an appropriate facility for checking that the heat exchanger is empty and depressurized represents and inadequate design.
5. Inadequate correction of prior hazard /incident. The hazard of the plug without an isolation valve was recognised and had been raised at previous turnarounds, but had not been corrected.

Summary of The Local Actions
1. As an additional safeguard, fitters are requested to only loosen and remove plugs,which do not have an isolating valve, in the immediate presence of the supervising operator.
2. Implement site measures/procedures on verifying depressurization / isolation prior to breaking containment, checking that they are in line with the new group isolation standard.
3. Consider implementing a process for unit shutdown where the state of each section between isolations is shown as they progress (e.g. on the process flow diagram).
4. Revise the Ultrafiner shutdown procedures, including; nitrogen purging and closure of valve to stabiliser to occur prior to breaking containment and connections of the soda ash wash fitting; and remove ambiguity about when to install blinds on heat exchangers.
5. Revise the breaking of containment procedure to include the hazards of pressure (hydraulic / pneumatic) and how to verify that something is depressurized. Develop a breaking of containment training module.
6. Assess the need, develop a plan and implement the plan for fitting isolation valves to plugs in the older units. Alternatively, replace them with nozzles and blank flanges. Back weld plugs that do not need to be removed.
7. Address the training of fitters in the appropriate level of emergency response, considering the possibility of them being first responders.
8. Communicate the findings of this incident refinery wide to raise awareness.

What Went Well
1. The fitters assisted the operators with the first response.
2. The emergency responders reacted quickly, providing more than the required resources to avert escalation of the incident.
3. The fitters and operators openly contributed to the investigation.