Inadequate Safeguards - The system was designed with low-point drains to facilitate water removal, however, these were found to be inadequate in both location and size. The fact that the mixed feed pre-heat coil was not self-draining was unknown prior to the incident. After a thorough review of the entire reformer furnace feed system was completed, existing drains were increased in size and others added to ensure that the entire feed system could be drained.
Inadequate Procedure - The startup procedure did not account for a startup of a cold furnace with no hold points for catalyst reduction or refractory dry out. As a result, the time to reach the critical "steam in" temperature of 350°C (662°F) was short as compared to previous startups. Also, the procedure provides little direction for confirming that the reformer furnace feed system is dry. Modifications to the procedure were completed that included a longer heat-up period, the addition of more detailed guidance for verifying that the feed system is dry, and a formal sign-off by both operations and engineering personnel. Also, a separate cold-eyes review by external experts was completed as part of the pre-startup safety review.
Lack of Change Management - a. The startup procedure had two hold points for refractory dry out and new catalyst reduction during the heat-up phase prior to introducing the 4.1 mPa (600 psig) startup steam. These hold points were not utilized, since it appeared that neither was required. Consequently, the heat-up cycle was artificially shortened. It became apparent that this alteration to the startup sequence was not viewed as a change by operations. Several sections of the procedure were not performed, since they did not apply to this startup. b. Shutdown and startup procedures are designed to take a unit from safe operation to a zero energy state and then return it to safe operation. Changing these sequences by an intentional omission is a change and must be properly assessed for risk. The decision to leave some steam flow in the steam-generating system for this winter shutdown was made to keep the system warm and prevent freezing. However, no formal risk assessment was performed and no management of change (MOC) was generated. A risk assessment was performed prior to the startup, but the change in status of the steam system was not evaluated. In fact, the decision to leave steam in was seen as a safeguard from the risk of freezing. This provided an opportunity for water to accumulate upstream of the reformer furnace.
Non-essential Personnel - At the time of the incident, there were seven people on the furnace structure. Only the operations personnel were essential. Changes have been made to ensure that non-essential personnel are cleared from the area during startup activities.
More information on management of change can be found in the Lessons Learned Corner and also in the Hydrogen Safety Best Practices Manual.