Safety Incident Topic: Rupture Disc Leak
Location Of Incident: Whitting USA
Date Of Incident: 30th March 2006
Brief Account Of Incident
At the FCU 500 / 600 Fractionator Towers, the relief valves are protected from the process hydrocarbons by rupture disks.
On Thursday, March 30, 2006, it was discovered that the rupture disks were leaking, with system pressure equalized on both the top and bottom of the rupture disk. Rupture disks may not function as designed if pressure is allowed to build between the disk and the relief valve. This disk back pressure potentially compromises relief system capacity.
Potential Outcome
Potential that the rupture disks and thus relief valve would fail to operate properly in a release scenario, compromising relief system capacity.
Action Taken
- We are removing the rupture disks from the Fractionator RVs at both FCUs. We will work continuously until it is completed.
- We have formed a joint union / management investigation team to understand and determine what processes and management systems were or were not in place that led us to our current situation.
Additional teams will:
- Complete an (Root Cause Failure Analysis) RCFA for the rupture disks at the FCUs.
- Evaluate operation and safety for FCU Fractionator Tower RVs without the use of rupture disks.
- Review all other installations at Whiting where rupture disks are in service with RVs.
- Accelerates a previously scheduled project to upgrade the existing RV metallurgy. This will eliminate the need for rupture disks long term.
30 May 2006
Tank Farm Gas Oil Overflow
Safety Incident Topic: Tank 220x1 Overflow
Location Of Incident: Coryton Refinery, UK
Date Of Incident: 25th April, 2006
Brief Account of Incident
220x1 is a 220,000 barrel tank which is normally used to feed the distillate hydrotreater (CHD) with Atmospheric Gas Oil (AGO). In the period Feb 9th – April 23rd the CHD was shutdown for turnaround maintenance.
At around 01.00 on Monday 24th April the CHD was being commissioned with tank 220x1 designated as the rundown tank. The unit was started up successfully but the gauge on the tank did not register an increase in level. The Product Movement (PM) panelman re-set the gauge which then started to rise steadily consistent with the run-down from the CHD.
At 03.05 the gauge stuck at a reading a reading of 19.7 m. The outside operator, who is responsible for monitoring tank 220x1 failed to recognise that the product had been steadily entering the tank between 01.30 and 03.05 and interpreted from the “flat lining” of the tank gauge that no product was being delivered from the CHD. At the 06.00 shift handover the outside operator advised the on-coming shift that 220x1 was open to the CHD but nothing was coming down from the unit.
During the day shift on Monday 24th April the tank dip in 220x1 remained constant and the outside operator handed back to the on-coming shift (same operator as the previous night) with the same message he had received at the start of the shift i.e. nothing was being rundown into 220x1 from the CHD.
At 02.00 on Tuesday 25th April the PM panelman prepared to deliver a line flush of 100m3 from tank 220x1 to Jetty 5. The panelman noted that although the receiving vessel confirmed receipt of 100m3 of gas-oil from 220x1 the tank gauge had not registered this movement. The PM panelman interrogated the 220x1 gauging system between 02.09 hrs and 03.17 hrs to try and re-establish the level in this tank. After failing to establish the level he decided to wait for the on-coming day shift to take over the investigation of this problem.
At 05.09 hrs tank gauge on 220x1 changed from a reading of 0 m3 and rapidly climbs to a level 21.75m activating both the hi level alarm (set @ 21.5m) and the hi-hi alarm (set @ 21.7m) at 05.15 hrs. The outside operator was alerted and investigated the problem in the field. On seeing the tank over-filling and product entering the North Moat surface water system he closed the North Moat penstock to prevent the spillage entering the River Thames via the Dorr Oliver oil-water separator, switched the CHD run-down into another tank and gravitated tank 220x1 into a 3rd tank.
Potential Outcome(s)
The actual outcomes of the incident was a spill of 918 barrels of AGO into the North Moat system. There was potential for a more extensive environmental incident if the oil had not been isolated from the final surface water clean up system where it is then routed to the River Thames. The cost of the incident was $40K, mainly for the clean up of the spill.
What Went Well
The operator made the right decision in isolating the North Moat system before dealing with the tank spill. Clean up of the spill was started immediately and the majority of the oil recovered into the crude slop system. No oil entered the River Thames.
What Went Wrong (Possible Critical Factors)
The critical factors in this incident were the “sticking” of the gauge, the failure to recognise this, the lack of understanding of PM Operations personnel as to what the status of tank 220x1 was, the failure to manually dip when the gauge was found not to be working, and the failure to alarm at hi-level due to the “sticking” of the gauge. Additionally, after the leak the product was not held in the bund due to a broken penstock valve which allowed gas-oil to transfer into the North Moat.
Immediate Cause(s)
· Defective equipment: tank gauge and penstock valve on 220x1.
· Improper decision making / lack of judgement: improper response to the stuck gauge just prior to the spill occurring.
· Inattention / Lack of awareness: failure of the operator to accurately monitor tank 220x1.
System Cause(s)
The root cause for the “sticking” level gauge has not yet been identified and is still under investigation. The other root causes identified were:
· Inadequate monitoring of operations.
· Inadequate communication between work groups and peers.
· Failure of the hi-level alarms to annunciate due to the sticking” of the gauge.
· Inadequate identification of worksite/job hazard and subsequent poor judgement.
· Inadequate monitoring and repair of the bund penstock valve which was in need of repair.
Corrective Actions (summary only)
1· Tank gauge on 220x1 changed out to aid fault identification.
2· Condition of all penstocks reviewed and work in-progress to repair broken/leaking valves.
3· Independent hi-level alarms are already fitted on crude / gasoline tanks & all floating roof tanks.
4. Develop a plan for extending application of independent tank alarms.
5· Develop PI-data spreadsheets to aid identification of frozen gauges versus static tanks and to assist tank farm operators in monitoring operations.
Location Of Incident: Coryton Refinery, UK
Date Of Incident: 25th April, 2006
Brief Account of Incident
220x1 is a 220,000 barrel tank which is normally used to feed the distillate hydrotreater (CHD) with Atmospheric Gas Oil (AGO). In the period Feb 9th – April 23rd the CHD was shutdown for turnaround maintenance.
At around 01.00 on Monday 24th April the CHD was being commissioned with tank 220x1 designated as the rundown tank. The unit was started up successfully but the gauge on the tank did not register an increase in level. The Product Movement (PM) panelman re-set the gauge which then started to rise steadily consistent with the run-down from the CHD.
At 03.05 the gauge stuck at a reading a reading of 19.7 m. The outside operator, who is responsible for monitoring tank 220x1 failed to recognise that the product had been steadily entering the tank between 01.30 and 03.05 and interpreted from the “flat lining” of the tank gauge that no product was being delivered from the CHD. At the 06.00 shift handover the outside operator advised the on-coming shift that 220x1 was open to the CHD but nothing was coming down from the unit.
During the day shift on Monday 24th April the tank dip in 220x1 remained constant and the outside operator handed back to the on-coming shift (same operator as the previous night) with the same message he had received at the start of the shift i.e. nothing was being rundown into 220x1 from the CHD.
At 02.00 on Tuesday 25th April the PM panelman prepared to deliver a line flush of 100m3 from tank 220x1 to Jetty 5. The panelman noted that although the receiving vessel confirmed receipt of 100m3 of gas-oil from 220x1 the tank gauge had not registered this movement. The PM panelman interrogated the 220x1 gauging system between 02.09 hrs and 03.17 hrs to try and re-establish the level in this tank. After failing to establish the level he decided to wait for the on-coming day shift to take over the investigation of this problem.
At 05.09 hrs tank gauge on 220x1 changed from a reading of 0 m3 and rapidly climbs to a level 21.75m activating both the hi level alarm (set @ 21.5m) and the hi-hi alarm (set @ 21.7m) at 05.15 hrs. The outside operator was alerted and investigated the problem in the field. On seeing the tank over-filling and product entering the North Moat surface water system he closed the North Moat penstock to prevent the spillage entering the River Thames via the Dorr Oliver oil-water separator, switched the CHD run-down into another tank and gravitated tank 220x1 into a 3rd tank.
Potential Outcome(s)
The actual outcomes of the incident was a spill of 918 barrels of AGO into the North Moat system. There was potential for a more extensive environmental incident if the oil had not been isolated from the final surface water clean up system where it is then routed to the River Thames. The cost of the incident was $40K, mainly for the clean up of the spill.
What Went Well
The operator made the right decision in isolating the North Moat system before dealing with the tank spill. Clean up of the spill was started immediately and the majority of the oil recovered into the crude slop system. No oil entered the River Thames.
What Went Wrong (Possible Critical Factors)
The critical factors in this incident were the “sticking” of the gauge, the failure to recognise this, the lack of understanding of PM Operations personnel as to what the status of tank 220x1 was, the failure to manually dip when the gauge was found not to be working, and the failure to alarm at hi-level due to the “sticking” of the gauge. Additionally, after the leak the product was not held in the bund due to a broken penstock valve which allowed gas-oil to transfer into the North Moat.
Immediate Cause(s)
· Defective equipment: tank gauge and penstock valve on 220x1.
· Improper decision making / lack of judgement: improper response to the stuck gauge just prior to the spill occurring.
· Inattention / Lack of awareness: failure of the operator to accurately monitor tank 220x1.
System Cause(s)
The root cause for the “sticking” level gauge has not yet been identified and is still under investigation. The other root causes identified were:
· Inadequate monitoring of operations.
· Inadequate communication between work groups and peers.
· Failure of the hi-level alarms to annunciate due to the sticking” of the gauge.
· Inadequate identification of worksite/job hazard and subsequent poor judgement.
· Inadequate monitoring and repair of the bund penstock valve which was in need of repair.
Corrective Actions (summary only)
1· Tank gauge on 220x1 changed out to aid fault identification.
2· Condition of all penstocks reviewed and work in-progress to repair broken/leaking valves.
3· Independent hi-level alarms are already fitted on crude / gasoline tanks & all floating roof tanks.
4. Develop a plan for extending application of independent tank alarms.
5· Develop PI-data spreadsheets to aid identification of frozen gauges versus static tanks and to assist tank farm operators in monitoring operations.
21 May 2006
Blind Rolled By Mistake
Safety Incident Topic: Blind Rolled By Mistake
Location Of Incident: Texas City
Date Of Incident: 9 May, 2006
Brief Account of Incident
FCCU-3 Operations, with the help of a representative from the turn around group, prepared an authorization to work (ATW) for the overall task of installing blinds and making modifications to the slurry pump suction system. The ATW identified the need for fresh air equipment to mitigate the risk of exposure to a nitrogen rich atmosphere. A representative from operations accompanied the contract pipe fitter foreman to the work site and identified the appropriate location for the installation of a blind flange. The pipe fitter foreman walked two contract employees (pipe fitters) that had been loaned to him from another crew, to the site of the work and identified the flange to be blinded by shining a flashlight on the flange. A job safety analysis (“A.S.A.P. card) was completed by the foreman and the pipe fitters. The pipe fitters set up the fresh air equipment and their foreman acquired two gaskets to use when bolting up the flange. The blind was brought to the job site and left on a pallet at this time. After overcoming some issues with the fresh air system the fitters proceeded to unbolt the flange between vessel 401-E and the valve. By breaking containment on the vessel a large quantity of nitrogen was released into the surrounding atmosphere and the vessel was depressurized. A low pressure alarm in the control room was activated and a board operator responded by alerting an outside operator. The outside operator stopped work.
Potential Outcomes
- Oxygen Deficient Environment possibly resulting in serious injury or fatality.
- What Went Wrong (Critical Factors): Pipe fitters opened the wrong Flange.
Immediate Causes
Ineffective Communication between Supervisor and Employees. The Altair Strickland foreman’s direction to his employees did not accomplish the goal of getting the two pipe fitters to install a 20 inch blind flange in the correct location, downstream of the 401E block valve.
System Causes
1. Inadequate Vertical communication between supervisor and person: The employees and the foreman had different understandings of the task to be completed.
2. Verification/repeat back techniques not used There was no method in place to ensure the fitters understood what they were being asked to do
3. Inadequate Leadership – Inadequate work site walk-through: The fitters reported not seeing the foreman at the job site from the time they were left to do their work until the incident occurred
Corrective Actions/Lessons Learned
- Have a person from operations present at every line break.
- Ensure the employees doing the work understand the risks of the process and area they are working and the task they are to perform explained to them
Location Of Incident: Texas City
Date Of Incident: 9 May, 2006
Brief Account of Incident
FCCU-3 Operations, with the help of a representative from the turn around group, prepared an authorization to work (ATW) for the overall task of installing blinds and making modifications to the slurry pump suction system. The ATW identified the need for fresh air equipment to mitigate the risk of exposure to a nitrogen rich atmosphere. A representative from operations accompanied the contract pipe fitter foreman to the work site and identified the appropriate location for the installation of a blind flange. The pipe fitter foreman walked two contract employees (pipe fitters) that had been loaned to him from another crew, to the site of the work and identified the flange to be blinded by shining a flashlight on the flange. A job safety analysis (“A.S.A.P. card) was completed by the foreman and the pipe fitters. The pipe fitters set up the fresh air equipment and their foreman acquired two gaskets to use when bolting up the flange. The blind was brought to the job site and left on a pallet at this time. After overcoming some issues with the fresh air system the fitters proceeded to unbolt the flange between vessel 401-E and the valve. By breaking containment on the vessel a large quantity of nitrogen was released into the surrounding atmosphere and the vessel was depressurized. A low pressure alarm in the control room was activated and a board operator responded by alerting an outside operator. The outside operator stopped work.
Potential Outcomes
- Oxygen Deficient Environment possibly resulting in serious injury or fatality.
- What Went Wrong (Critical Factors): Pipe fitters opened the wrong Flange.
Immediate Causes
Ineffective Communication between Supervisor and Employees. The Altair Strickland foreman’s direction to his employees did not accomplish the goal of getting the two pipe fitters to install a 20 inch blind flange in the correct location, downstream of the 401E block valve.
System Causes
1. Inadequate Vertical communication between supervisor and person: The employees and the foreman had different understandings of the task to be completed.
2. Verification/repeat back techniques not used There was no method in place to ensure the fitters understood what they were being asked to do
3. Inadequate Leadership – Inadequate work site walk-through: The fitters reported not seeing the foreman at the job site from the time they were left to do their work until the incident occurred
Corrective Actions/Lessons Learned
- Have a person from operations present at every line break.
- Ensure the employees doing the work understand the risks of the process and area they are working and the task they are to perform explained to them
15 May 2006
Explosion Oxygen Injection Line
Safety Incident Topic : Explosion Oxygen Injection Line
Location Of Incident : Netherland
Date Of Incident : 8th March 2006
Brief Account of Incident
A small explosion occured during commissioning of temporary 2" oxygen line in use for catalyst regeneration on catalytic reforming unit. No injuries occured. A part from a total loss of the injection line there was no significant damage but delay in the regeneration process. After safeguarding the unit catalyst regeneration was progressed with air as opposed to pure the oxygen.
Background:
The stainless steel line is only used for catalyst regenerations which are carried out roughly ance every 18 months. In between times the line is fullt segregated from the rest of the unit and spaded off at valve connection at the unit. This to prevent ingress of dirt and/or hydrocarbon. Both precursors for violent reaction with pure oxygen. At the time of the incident one of the connection turned out to be still in place with no spade installed and with the valve closed. This was noted during the unit check up before the regeneration period and was reported but people did not realised the possible consequences. It turned out that the valve had leaked hydrocarbons over 1.5 years after the previous - and had built up in the line, sufficient to cause the explosion upon commission the oxygen flow.
Potential Outcome
Serious injury or fatality as the incident happened close to a unit walkway.
What When Wrong
. Oxygen System connection not segregared from the process line after the previous catalyst regeneration (at the end of a cycle ending turnaround)
. Nobody inticipating the inherent risk of possible hydrocarbon ingress into the oxygen system
Immediate Causes
. Violation by group: the procedure for de-spading was not followed properly.
. Lack of judgement: people did not realised the possible consequences of the connected line
. Routine activity without thought: sign off the spading list assuming the line would have been disconnected and the assumption that the hydrocarbons would never enter the line.
. Inadequate isolation of process: no spool removed / spade present.
. Defective equipment: passing valve
System Caused
. Emotional overload: pressure to immediate start up after turnaround.
. Inadequate identification of critical behaviours doing check ups.
. Inadequate development of PSP's: spading list did not mention the removal of the spool piece.
. Inadequate communication between the people doing the work after the TAR and the acceptors of that work.
Corrective Actions
. Remove the valves at the connection point - this will force removal of the spool piece and spading after regens.
. Improve spading list and procedures for catalyst reformer regenerations.
. Adjust training program contents to make people more sensible for risks that are not so obvious.
Location Of Incident : Netherland
Date Of Incident : 8th March 2006
Brief Account of Incident
A small explosion occured during commissioning of temporary 2" oxygen line in use for catalyst regeneration on catalytic reforming unit. No injuries occured. A part from a total loss of the injection line there was no significant damage but delay in the regeneration process. After safeguarding the unit catalyst regeneration was progressed with air as opposed to pure the oxygen.
Background:
The stainless steel line is only used for catalyst regenerations which are carried out roughly ance every 18 months. In between times the line is fullt segregated from the rest of the unit and spaded off at valve connection at the unit. This to prevent ingress of dirt and/or hydrocarbon. Both precursors for violent reaction with pure oxygen. At the time of the incident one of the connection turned out to be still in place with no spade installed and with the valve closed. This was noted during the unit check up before the regeneration period and was reported but people did not realised the possible consequences. It turned out that the valve had leaked hydrocarbons over 1.5 years after the previous - and had built up in the line, sufficient to cause the explosion upon commission the oxygen flow.
Potential Outcome
Serious injury or fatality as the incident happened close to a unit walkway.
What When Wrong
. Oxygen System connection not segregared from the process line after the previous catalyst regeneration (at the end of a cycle ending turnaround)
. Nobody inticipating the inherent risk of possible hydrocarbon ingress into the oxygen system
Immediate Causes
. Violation by group: the procedure for de-spading was not followed properly.
. Lack of judgement: people did not realised the possible consequences of the connected line
. Routine activity without thought: sign off the spading list assuming the line would have been disconnected and the assumption that the hydrocarbons would never enter the line.
. Inadequate isolation of process: no spool removed / spade present.
. Defective equipment: passing valve
System Caused
. Emotional overload: pressure to immediate start up after turnaround.
. Inadequate identification of critical behaviours doing check ups.
. Inadequate development of PSP's: spading list did not mention the removal of the spool piece.
. Inadequate communication between the people doing the work after the TAR and the acceptors of that work.
Corrective Actions
. Remove the valves at the connection point - this will force removal of the spool piece and spading after regens.
. Improve spading list and procedures for catalyst reformer regenerations.
. Adjust training program contents to make people more sensible for risks that are not so obvious.
Subscribe to:
Posts (Atom)