A hydrogen reformer furnace at a refinery was shutdown for maintenance to remove and cap the inlet and outlet headers of some radiant tubes that had previously developed hot spots and been isolated by externally pinching them off at the inlet. A decision was made to leave steam in the steam-generating circuit during this maintenance operation to prevent freezing. After maintenance was complete, the startup procedure required the furnace to be first heated up to 350°C (662°F) prior to introducing 4136 kPa (600 psig) steam into the radiant tubes. Just after the 4136 kPa (600 psig) startup steam was introduced into the reformer furnace inlet, the control room alarm journal reported an extreme positive pressure spike at the same time a single loud bang was reported by the operations personnel on the furnace structure. An emergency shutdown of the furnace was initiated and the startup aborted. At the time of the incident, there were seven people on the furnace. Four were operations staff and three were maintenance personnel. One serious injury was sustained to an operator by flying shrapnel. There was no hydrogen leak or explosion related to this incident; the startup failure occurred prior to the introduction of methane for the hydrogen-generation step.
The cause of this incident was determined to be the initial steam flow picking up some remnant water and carrying it into the furnace. Under the conditions present, the water underwent an instantaneous phase change and the energy release was sufficient to rupture the hydrogen reformer furnace radiant tubes. The entire event was calculated to have taken only a few milliseconds, but involved extremely high-energy release rates. This high-energy impulse caused the simultaneous rupture of five tubes with sufficient force to eject portions of the tubes out through the roof of the furnace as shrapnel. All of the failures occurred near the inlet of the tubes in the headspace above the catalyst, and the five tubes were clustered toward the center of the furnace in four rows. Approximately 41 additional radiant tubes were destroyed as a result of impacts from ejected tube segments and the subsequent pressure wave. Extensive damage to the refractory also occurred. As a result, the furnace internal structure was condemned and a complete re-tubing was required. Broken light fixtures, insulation, and walkway gratings damaged by shrapnel impacts were found above the furnace and on a west-side furnace platform.
More details about this incident can be found in the attached files. The background and details text file includes appropriate references to the attached figures and photos.
- Heating Equipment
Inadequate Safeguards - The system was designed with low-point drains to facilitate water removal, however, these were found to be inadequate in both location and size. The fact that the mixed feed pre-heat coil was not self-draining was unknown prior to the incident. After a thorough review of the entire reformer furnace feed system was completed, existing drains were increased in size and others added to ensure that the entire feed system could be drained.
Inadequate Procedure - The startup procedure did not account for a startup of a cold furnace with no hold points for catalyst reduction or refractory dry out. As a result, the time to reach the critical "steam in" temperature of 350°C (662°F) was short as compared to previous startups. Also, the procedure provides little direction for confirming that the reformer furnace feed system is dry. Modifications to the procedure were completed that included a longer heat-up period, the addition of more detailed guidance for verifying that the feed system is dry, and a formal sign-off by both operations and engineering personnel. Also, a separate cold-eyes review by external experts was completed as part of the pre-startup safety review.
Lack of Change Management - a. The startup procedure had two hold points for refractory dry out and new catalyst reduction during the heat-up phase prior to introducing the 4.1 mPa (600 psig) startup steam. These hold points were not utilized, since it appeared that neither was required. Consequently, the heat-up cycle was artificially shortened. It became apparent that this alteration to the startup sequence was not viewed as a change by operations. Several sections of the procedure were not performed, since they did not apply to this startup. b. Shutdown and startup procedures are designed to take a unit from safe operation to a zero energy state and then return it to safe operation. Changing these sequences by an intentional omission is a change and must be properly assessed for risk. The decision to leave some steam flow in the steam-generating system for this winter shutdown was made to keep the system warm and prevent freezing. However, no formal risk assessment was performed and no management of change (MOC) was generated. A risk assessment was performed prior to the startup, but the change in status of the steam system was not evaluated. In fact, the decision to leave steam in was seen as a safeguard from the risk of freezing. This provided an opportunity for water to accumulate upstream of the reformer furnace.
Non-essential Personnel - At the time of the incident, there were seven people on the furnace structure. Only the operations personnel were essential. Changes have been made to ensure that non-essential personnel are cleared from the area during startup activities.
More information on management of change can be found in the Lessons Learned Corner and also in the Hydrogen Safety Best Practices Manual.