41

Plant Safety Fundamentals

Refinery safety relies upon two questions:

1. Is the process design intrinsically dangerous?
2. Do shift operators understand how their instruments function?
Safety in refineries is not a matter of attitude. Safety is a product of the knowledge of pro-
cess engineer and console operators.

Location of Relief Valve

Referring to Fig. 41.1, I have shown two possible locations for the tower pressure relief
valve. Which is correct?
The correct choice is position One. If the tower floods, the liquid head pressure in the
vapor line will cause the relief valve at position Two to open, due to the static head of liquid
in the vapor line, even though tower pressure is not excessive. Large volumes of liquid will
then flow into the relief valve header system which hopefully is connected to the flare, and
not to an atmospheric vent, as discussed later.

Level Indication
Liquid levels are not measured directly. They are indirectly measured by means of a
“Level-Trol” (see Fig. 41.2). The pressure difference (DP) between P1 and P2 (psi) is mea-
sured and then converted into inches of level (DH) by use of Eq. (41.1):
DH ¼ ðDPÞ ð28Þ  ðSGÞ (41.1)

where SG ¼ Specific gravity of liquid.

The SG used is called the “Calibration Specific Gravity.” It is not typically adjusted for
months or years. That is, until the instrument technician recalibrates the level-trol. If the
fluid in the level-trol becomes less dense than normal, the indicated level on the panel,
relative to the real level in the vessel, will decline, as I’ve discussed.

Flow Measurement
Flows are indirectly measured by use of a flow orifice plate. The DP across the orifice plate
is measured and then converted to flow using Eq. (41.2) (see Fig. 41.2).

Understanding Process Equipment for Operators and Engineers. https://doi.org/10.1016/B978-0-12-816161-6.00041-2 323

© 2019 Elsevier Inc. All rights reserved.
324 UNDERSTANDING PROCESS EQUIPMENT FOR OPERATORS AND ENGINEERS

Flare

Flare

CW

FIG. 41.1 Correct location for relief valve is position #1.

Level
trol

Level
output

FIG. 41.2 Level is indicated by SG and differential pressure.

Flow ¼ ðK  4P Þ½ (41.2)

where K ¼Orifice coefficient.

The factor that many operators do not know is how to correct a flow for a meter being
off-zero.
Let’s say the meter on the instrument is reading a flow of “A.” The meter is then
bypassed, so that the observed flow should drop to zero, but it only drops to “B.” To
calculate the correct flow, use Eq. (41.3):

½
Corrected flow ¼ A2  B2 (41.3)

In the 1960s, when flows were indicated on a strip chart recorder, we made this correc-
tion with a pencil, as the paper strip was already calibrated for the square root function.
With a digital display, this correction must be made with Eq. (41.3).
 Chapter 41 • Plant Safety Fundamentals 325

BP 2005—Raffinate Splitter Explosion—Texas City

The following story relates an incident that was a combination of operators not under-
standing how level and flow instruments worked. And, process engineers not adhering
to good design practices.
In 1974 I was waiting for the elevator in the Amoco Oil Building in Chicago, with Gary
Elmer. “Norm,” Gary said, “if Amoco is in such a rush to get the Xylene Splitter at Texas City
built, they should pay me overtime. How about filling out some data sheets to help me for
a few days?”
So, to a minor extent, I participated in the design of the Xylene Splitter. After the Isom-
erization Unit at Texas City was built, the tower was transformed into a Raffinate Splitter
which became the most famous distillation tower in America.
You may recall the incident. In 2005 the tower’s relief valve opened, as a consequence of
a high liquid level. A cloud of naphtha vapor formed because the relief valve was not con-
nected to the flare. It vented indirectly to the atmosphere. The naphtha vapors ignited
from a truck engine and exploded. Fifteen contractors were crushed to death in a trailer
and 180 injured. BP settled for $10,000,000 per fatality. The price of gasoline rose by
10 cents, as the refinery was the largest producer of gasoline in America.
The understanding in the industry is that this was a consequence of Gary Elmer and me
connecting the relief valve vent to the atmosphere, rather than to the refinery flare. The real
story is more complex.

Background
I worked as an operating supervisor in Texas City, and as a process engineer in Chicago for
Amoco Oil between 1965 and 1981. I designed 7% of the process equipment in Texas City
(Cokers, Sulfur Recovery, Light Ends Fractionation, Amine System, Fuel Gas Treating). For
the distillation towers I supervised (Debutanizer, Butane Splitter, Depropanizer, Butane-
Pentane Splitter), all relief valves were located at the top of the towers. All relieved directly
to the atmosphere. The reason I did not object to this design was because it was that way
when I had assumed supervision of the process. Also, the towers had been commissioned
in 1958 and nothing had happened “YET.” What would result if a tower flooded due to a
high liquid level was not a question that I considered.

Fundamental Causes of Raffinate Splitter Explosion

The documented causes of the Raffinate Splitter failure are as follows:
• Relief valve not connected to plant flare.
• Operator laxity.
However, there are a number of other errors that have not been fully explained (see
Fig. 41.3):
326 UNDERSTANDING PROCESS EQUIPMENT FOR OPERATORS AND ENGINEERS

50 psig
vapor line

Blowdown Raffinate
splitter

Loop FD
Relief
seal flow
valve

To
condenser
No
flow

3 psig
FIG. 41.3 Raffinate splitter—Texas City.

1. Design of the loop seal draining the Blowdown Tower to the 3# condensate collection
system.
2. Elevation of the splitter relief valves relative to the top of the tower.
3. Lack of technical support during start-up operations.
4. Operators not understanding the relationship between tower bottom temperature and
tower bottoms indicated level.
5. Operators not understanding the concept of a level-trol being “Tapped-Out.”
6. Failure to check liquid head pressure at the bottom of the tower.

How Levels Are Measured

We do not directly measure levels in process units. We measure the pressure difference
between the top and bottom level taps (Fig. 41.2). To convert from a differential pressure,
to level, we use the specific gravity of the liquid (Eq. 41.2). For a given differential pressure,
the indicated level that operators observe on the control panel will:
• Go down, as the liquid becomes less dense.
• Go up, as the liquid becomes more dense.
Even though the actual liquid level in the tower has never changed.
 Chapter 41 • Plant Safety Fundamentals 327

During the Raffinate Splitter start-up, the liquid in the bottom of the tower was less dense
than normal. Thus, the indicated level observed on the control panel was lower than the
actual level. Unfortunately, when the liquid fills the space between the lower and upper
level taps, the differential pressure measured between the level taps remains constant,
regardless of how high the liquid level becomes (Fig. 41.2). This is called being
“Tapped-Out.” If the specific gravity of the liquid is 10% higher than normal, the indicated
level on the panel will read 110%. But, if the specific gravity of the liquid is 10% lower than
normal, the indicated level on the panel will read 90%. As the level rises by 10 ft, or 100 ft,
above the top level connection, the indicated level will remain at 90%. Which is exactly
what happened at Texas City.

Temperature vs Specific Gravity

The operators did suspect that they had a high level. However, they then commissioned
the splitter feed heater. This resulted in tower bottom’s temperature increasing. This
reduced the specific gravity of the liquid; which reduced the indicated level; which caused
operators to draw the false conclusion that their tower’s bottom level, which they had
begun to suspect was too high, was actually okay.
The hourly operators, who were terminated by BP, testified to the above, as the reason
they allowed the tower to overflow. They testified that this was proof that the cause of over-
filling the tower was not their negligence, but a faulty level indicator.
The operators were victorious in their litigation against BP (likely because the previous
principle was not explained during the proceedings).

Was the Splitter Pressure Excessive

Apparently, the tower pressure itself never became excessive. The operators were bringing
in more feed to the splitter than they were drawing off of the bottoms product outlet.
It wasn’t that the tower overpressured, it was that it overflowed. If the pressure relief
valve had been located at the top of the splitter (as was the case in the towers
I operated in Texas City in the 1970s), the overfilling would not necessarily have caused
the relief valve to open. But, if the relief valve is located, as in the case of the Raffinate Split-
ter, many feet beneath the top of the tower (Fig. 41.3), then a head of liquid could exert a
head pressure on the relief valve which then may cause the relief valve to open.
Certainly, it was a large volume of saturated liquid, and not just vapor, that blew out of
the relief valve, and into the blowdown tower.

False Bottom Flow Indication

The operators had closed off the normal bottoms product outlet level control valve. But
why? Because they thought it was leaking. The valve was likely not leaking. But, the flow