BP issues recommendations to prevent recurrence of fatal explosion

According to the report, the splitter (Fig. 1) is a single fractionating column, 164-ft tall with 70 trays, with a feed surge drum, fired heater reboiler, fin fan overhead condenser, and reflux drum. It has a volume of about 3,700 bbl and processes up to 45,000 b/d of raffinate.

The feed comes from the aromatic recovery unit to the feed surge drum (F-1101). Charge pumps (J-1101/1101A) pump the liquid hydrocarbon to the raffinate splitter feed-bottoms exchangers (C-1104A/B). Feed then flows to the raffinate splitter tower (E-1101).

The reboiler furnace (B-1101) supplies heat to the system. Tower overhead is totally condensed by air in the overhead condenser (C-1101) and then flows to the reflux drum (F-1102).

The blowdown system is designed to receive, quench, and dispose of hot hydrocarbon vapors and minor associated liquids from the isom relief, vent, and pump-out systems during upsets or shutdowns. The blowdown system consists of relief headers, the blowdown drum and stack (F-20), and pump-out pump. F-20 is a vertical drum with a 10-ft diameter with a 113-ft high stack and a volume of about 390 bbls.

Mar. 23 incident

The night shift on Mar. 22-23 packed the splitter with feed and left the column base level at 100% and in high-level alarm mode, according to the report. The day-shift board operator recommenced feeding the tower at 9:52 a.m. at 20,000 b/d.

The heavy raffinate rundown control valve was opened at 12:41 p.m. and a heavy raffinate outflow was registered at 1:00 p.m. During this time, the level transmitter was fully submerged and displayed a signal that slowly drifted down to 80% before any liquid was removed from the splitter.

According to the report, the high-level alarm was left in alarm mode and the tower level control was in manual control when it should have been set at 50% in automatic control.

Until 1:00 p.m., about 2,500 bbls had been added to the column since 9:52 a.m.. By 1:09 p.m., the heavy raffinate outflow of 31,000 b/d exceeded the incoming feed rate, but during this short time would have only reduced the tower volume a small amount. The report says that the difference in outflow vs. feed rate would have reduced the liquid in the tower about 4 in/min, but the liquid level may not have fallen due to increased vaporization of the feed and tower base.

The liquid level in the tower reached Tray 13 (137 ft vs. 6-7 ft of liquid normally) at about 12:45 p.m. At this level, 57 of 70 trays were flooded and the feed inlet at Tray 31 was submerged. The high bottoms temperature caused vaporization that lifted the liquid higher than Tray 13 but lower than the overhead line at the tower’s top.

Temperature indications at several trays within the column confirmed the high level (Fig. 2). They show that the liquid had reached Tray 33 by 11:30 a.m. By noon, the liquid had reached Tray 27.

Fig. 3 shows the pressures in the tower leading up to the incident.

According to the report, the heavy raffinate rundown from the splitter had commenced by 1:00 p.m. At 1:13 p.m., the pressure at the inlet to the overhead condenser was 20.5 psig and starting to increase rapidly.

The pressure increase was likely due to a rapid increase in feed preheat, which vaporized feed at the tower inlet. In conjunction with the vaporization in the tower’s bottom, the vaporized feed lifted the high liquid level into the overhead line. Liquid filled the 24-in. overhead line above the pressure transmitter and relief valves, which were about 150 ft below the tower’s top.

At 1:14 p.m., the operator reduced the fuel gas output to lower the reboiler heater outlet temperature. At 1:15 p.m., the pressure at the overhead condenser inlet peaked at 63 psig and the overhead relief valves had opened to relieve directly into the blowdown drum and stack through a 14-in. header.

At 1:19 p.m., the operators had shut the fuel gas control valves. The reflux drum low-level alarm cleared at this time, which indicated that the vessel was full of liquid. At about this time, according to the report, “there were radio messages from at least two witnesses who saw vapors and liquid emerging [about] 20 ft above the top of the stack ‘like a geyser’ and running down and pooling around the base of the blowdown stack and drum.”

At 1:20 p.m., the F-20 high-level alarm went off for the first time. At least one witness saw a pickup truck parked just north of F-20, but it is not known if this was the ignition source. At 1:20 p.m., several witnesses described two or more explosions, although subsequent modeling suggests that there was only one explosion.

The blast resulted in damage to the isom unit, causing a number of secondary hydrocarbon releases and fires.

The damage from the explosion was covered in a previous article (OGJ Online, Mar. 23, 2005).

Evidence analysis

The final report said that the BP investigation team examined all the evidence collected and commissioned many specialist studies to understand the series of events that occurred on Mar. 23, 2005. The analysis included a detailed examination of the control system instrumentation data; modeling of the process, hydrocarbon release, and explosion; and comparison of the startup to the specified operating procedures and previous unit history.

The explosions were the result of ignition of hydrocarbon vapors released from the blowdown drum and stack. The interim report postulated four potential causes of the excess pressure:

• Vapor pressure of hydrocarbons due to excessive thermal energy coupled with high liquid level in the column.

• Steam generation from the presence of water at high temperatures.

• Noncondensibles remaining from the tightness testing.

• Improper feed to the unit or “foreign materials” in the feed.

• A combination of the four causes.

The final report concluded that the vapor pressure, liquid carryover scenario was the most probable cause, possibly exacerbated by limited quantities of nitrogen and water.

The investigation team first postulated that the high pressure in the raffinate splitter may have been due to the vapor pressure of the column contents at high temperatures. According to the report, immediately before the rapid pressure increase, the column base temperature was stable at 302° F. The high liquid level in the splitter and relatively cold feed at 126° F. could have allowed a high base temperature to be masked by colder hydrocarbon from above.

The investigation team later modified the scenario to a combination of vapor pressure and head of liquid in the overhead line. Dynamic process modeling of the splitter showed that the late intervention of starting heavy raffinate rundown flow exacerbated the incident.

Rapid heat exchange between the tower bottoms and incoming feed resulted in vapor generation around the submerged feed inlet to the tower. When the 8-in. vent valve was opened to reduce the splitter pressure, the high temperature at the reboiler furnace outlet and in the tower’s bottom caused significant vaporization.

The combination of vapor in the feed and tower bottom eventually caused liquid carryover into the tower overhead line. The hydrocarbon vapor pressure coupled with the hydrostatic pressure of the liquid carried over into the overhead pipework system accounted for the high pressure experienced at the inlet to the overhead condensers and relief valves, according to the report.

A mass balance based on flow meter data confirmed that the vessel was substantially overfilled.

According to the report, the main conclusions of the technical analyses were:

• The high peak pressures observed (63 psig) were caused by liquid filling up the 24-in. overhead line off the splitter column.

• Virtually all of the release was subcooled liquid.

• Liquid reached the overhead line by a combination of grossly overfilling the main column with liquid charge and vaporization and expansion of the tower base and feed charge.

• The total release to the blowdown drum was 45,900 gal (1,100 bbl).

Solutions

According to the report, many departures from the start-up procedure occurred. The key step that was instrumental in leading to the March 23 incident, however, was the failure to establish heavy raffinate rundown to tankage while continuing to feed and heat the tower.

The report stated that “if a heavy raffinate rundown flow had been started as soon as the feed was reestablished, the incident would not have occurred. The absence of supervisory presence on the unit probably contributed to the failure to establish rundown.

“By the time the heavy raffinate flow was eventually started, the splitter bottoms temperature was so high, and the liquid level in the tower so high, that this intervention made matters worse by introducing significant additional heat to the feed. At that stage the correct intervention would have been to shut down the reboiler furnace and close the feed valve,” the report said.

In addition to the procedural solution, the BP team investigated the critical or causal factors on why the procedures were not followed.

Causal analysis

The report identified four critical factors that led to the fire, explosion, and subsequent loss of life:

• Loss of containment. Actions taken or not taken led to the overfilling of the raffinate splitter and subsequent overpressurization and pressure relief. Hydrocarbon flow to the blowdown drum and stack resulted in liquids overflowing the stack, causing a vapor cloud, which was ignited by an unknown source.

As previously discussed, stopping the splitter feed, increasing the offtake, or reducing heat input earlier would have probably prevented the incident.

• Raffinate splitter start-up procedures and application of knowledge and skills. Failure to follow the start-up procedure contributed to the loss of process control. Key individuals (operators and management) did not apply their level of skills and knowledge, and there was a lack of supervisory presence and oversight during the start-up.

According to the report, several steps in the start-up procedure were omitted and others deviated from, including overfilling the splitter, overheating the contents, a delay in starting the rundown, and adding heat before starting the rundown. In addition, the maximum temperature was much higher than specified in the procedure.

Supervisory staff did not verify that the correct procedure was being used and were absent from the unit during shift relief, before start-up, and during the start-up. Starting up the unit over two shifts increased the potential risks.

• Control of work and trailer siting. Numerous personnel working elsewhere in the refinery were too close to the hazard at the blowdown drum and stack during the start-up. They were congregated in and around temporary trailers and were neither evacuated nor alerted.

• Design and engineering of the blowdown drum and stack. The blowdown drum and stack were used as part of the relief and venting system for the raffinate splitter after several design and operational changes and close to uncontrolled areas.

Blowdown stacks are potentially hazardous and the industry has moved towards closed relief systems to flare. BP did not tie the splitter relief lines into a flare system when it appears that it could have been efficiently done in 1995, 1997, or 2002.

Design and operational changes to the splitter resulted in increased use of the blowdown drum and stack. Incremental changes to the blowdown system included failing to replace the internal baffles, decommissioning the quench system, and adding more inlets, which possibly reduced its effectiveness.

The use of a flare system or other closed relief system would have probably significantly reduced the impact of the incident, according to the report.

Corrective actions

The report identified a number of proposals for corrective actions. Many of these deal with increasing leadership, supervision, a more safety-conscious workplace environment, better training, better communications, and improved practices for updating and following procedures.

In terms of the unit’s design, the report recommended:

• Redesigning the isom relief and vent system to a closed system, eliminating the use of the blowdown drum and stack as a hydrocarbon relief and venting system to the atmosphere. When designed, BP would conduct an independent third-party process hazards analysis.

• Reevaluating the control and instrumentation system of the raffinate splitter and implement enhancements. In particular, BP would perform a layer of protection analysis to ensure that there are the appropriate levels of process control to prevent a catastrophic incident.

• Evaluating the overall splitter relief system, including the relief valves location and revalidating at a defined frequency.

BP said that it would invest $1 billion in the Texas City site during the next 5 years. Part of this improvement includes removing blowdown stacks (OGJ, Dec. 19, 2005, p. 5). ✦