Process-safety accidents can be prevented if hazards are recognised and appropriately managed. This article is intended to raise awareness of some less-common hazards. It describes three incidents involving temperature related, catastrophic failures of shell and tube heat exchangers in the gas processing and oil-refining industries.
It also examines their root causes and highlights lessons to be learned. Company names have been omitted from the main text because the focus is intended to be on the respective hazards and their mitigation methods. The organisational failings that created the conditions in which these incidents occurred are widely applicable to numerous organisations.
Incident #1 – cold metal embrittlement
An operational upset on a gas-processing plant receiving natural gas from offshore gas fields resulted in loss of warm lean flow to the rich oil de-ethaniser (ROD) reboiler in the lean oil absorption section of the plant.
The absence of warm lean oilflow resulted in chilling of equipment to abnormally low temperatures in that section of the plant. When warm lean oilflow was re-started, the ROD reboiler failed catastrophically, releasing more than 10 tonnes of hydrocarbon vapour to atmosphere.
The vapour cloud was ignited by a fired heater some 170m away. The flame front from the resulting deflagration burned through the cloud and, when it reached the ruptured exchanger, a fierce jet fire developed beneath an elevated piperack junction where flame impingement caused three more leaks.
The resulting fire burned for more than two days. Two employees were killed and eight more were injured. Supplies of natural gas to domestic and industrial users were halted for more than two weeks causing substantial losses to industry and massive inconvenience to people in their homes.
The immediate cause of the initial fire was a loss of primary containment (LOPC) due to cold metal embrittlement, which led to brittle fracture of the ROD reboiler channel end. Critical factors included loss of lean oilflow for an extended period and absence of remote-operated valves to isolate interconnected process units.
Root causes included inadequate hazard identification (low temperature hazard not known), inadequate operating procedures (due to inadequate hazard identification), inadequate training (how to respond to loss of lean oil), inadequate alarm management (poor prioritisation), inadequate monitoring by experienced engineers (located remotely) and inadequate safety management (Safety Case methodology not mandated or adopted).
Cold metal embrittlement of carbon/low alloy steels is a low probability, high consequence hazard that is sometimes overlooked. Risk assessment can only be conducted against known hazards, so it is imperative that comprehensive process hazard analysis studies (e.g. Hazop) are conducted on major hazardous facilities.
However, even if this is done, some hazards may still be overlooked. Therefore, organisations should ensure their workforces always remain mindful of the possibility of disaster and are diligent in reporting incidents and their root causes (organisational learning)
(2).
Incident #2 – high temperature hydrogen attack
Incident
The middle shell in one of two parallel trains of three feed/effluent exchangers on a naphtha hydrotreating unit failed catastrophically, resulting in an explosion and intense fire which burned for more than three hours. Seven employees working in the immediate vicinity of the ruptured exchanger at the time of the incident were killed.
The failed shell was fabricated from carbon steel and partially clad with 316 stainless steel (316 SS) liner. It had been in service approximately 38 years. The shellside fluid was reactor effluent (a relatively clean service) while the tubeside fluid was reactor feed (prone to fouling by corrosion deposits).
The immediate cause of the explosion and fire was an LOPC due to high temperature hydrogen attack (HTHA) of the carbon steel shell at a point just downstream of the 316 SS partial lining. Critical factors were high residual stresses in shell seam welds due to lack of post-weld heat treatment and presence of additional personnel assisting with restreaming the exchanger train after off-line cleaning.
Root causes included inaccurate Nelson Curve
(3) for carbon steel (this empirical curve predicts susceptibility to HTHA as a function of process temperature and hydrogen partial pressure), ineffective hazard identification (HTHA susceptibility assessed using design rather than actual conditions) and failure to apply inherently safer design principles.
HTHA occurs when carbon and low alloy steels are exposed to high hydrogen partial pressures at high temperature (service exposure time is cumulative). The hydrogen reacts with carbides in the steel to form methane which cannot diffuse through the steel. The loss of carbide weakens the steel and accumulation of methane pressure in the steel creates cavities and fissures which eventually combine to form cracks. HTHA damage is most likely to occur in highly stressed areas and heat-affected zones around welds.
It is critically important for new and existing units in hydrogen service that equipment is checked against the relevant Nelson Curve for startup, shutdown and transient conditions to identify appropriate mitigation strategies against HTHA.
Mitigations may include 1) selection of inherently safer (more HTHA-resistant) materials such as Cr-Mo steels, 2) imposition of strict operating limits, 3) provision of appropriate instrumentation to enable proper monitoring and 4) rigorous enforcement of startup, shutdown and emergency procedures. Note that transient conditions include gradual changes to operating conditions due to fouling of equipment or deactivation of catalysts.
Incident #3 – temper embrittlement
Incident
The 40mm-thick 2.25 Cr/1.0 Mo channel head of a combined feed exchanger on a semi-regenerative catalytic reforming unit failed catastrophically whilst undergoing hydrostatic testing (‘hydrotesting’) during turnaround.
The exchanger had been in service for approximately 23 years and had strength-welded tube-to-tubesheet joints. The tubeside fluid was reactor effluent and service conditions were typically 25.5 barg and 480-530 oC. The intended hydrotest pressure was 140 barg, but the rupture occurred at approximately 93.0 barg even though the hydrotest water temperature was well above the minimum allowable 6°C.
Fortunately, no one was injured, but the turnaround duration was extended by 20 days while the plant was modified to allow startup of the unit with this exchanger bypassed (the original exchanger train had no bypasses on either shellside or tubeside).
The immediate cause of the channel head failure was brittle fracture due to temper embrittlement. Critical factors included the age, composition and thermal history of the steel (susceptibility to temper embrittlement) and inappropriate selection of the hydrotest pressure (too high for intended purpose). The root cause was inadequate job knowledge (full hydrotest pressure not required to comply with design codes and verify integrity of tube-to-tubesheet joints and external pressure envelope).
Temper embrittlement is a degradation mechanism that causes a loss of toughness in low alloy Cr-Mo steels after extended exposure to temperatures in the range 327-593 °C. The effect is most pronounced in the range 427-510 °C and most common in 2.25 Cr/1.0 Mo steels. It is caused by segregation of tramp elements (P, Sn, Sb and As) and alloying elements (Mn and Si) along grain boundaries in the steel.
The loss of toughness is not evident at operating temperature and only affects the material when exposed to relatively low temperatures (e.g. startup and shutdown). It can cause catastrophic brittle fracture.
Temper embrittlement cannot by detected by normal non-destructive testing (NDT) inspection techniques so it should be assumed that all low alloy Cr-Mo equipment is at risk of brittle fracture until the ductile-to-brittle transition temperature has been exceeded. Internal pressures in susceptible equipment should not be allowed to exceed 25% of design pressure until the metal temperature exceeds the Minimum Pressurisation Temperature (MPT) for that equipment (MPT is a function of metal composition and service history).
Summary
- Most pressure equipment in gas processing/oil refining is constructed from carbon or low alloy steels.
- Carbon and low alloy steels are susceptible to cold metal embrittlement when exposed to low temperatures (depressurisation/auto-refrigeration).
- Carbon and low alloy steels lose strength when exposed to hydrogen at elevated temperatures and pressures (high temperature hydrogen attack).
- Some low alloy Cr/Mo steels are susceptible to temper embrittlement after extended exposure to high temperatures but the effect is only evident when cool (startup, shutdown or hydrotest conditions).
- Gradual changes to operating conditions due to equipment fouling or catalyst deactivation may lead to accidental breach of operating limits.
References
1) ‘The Esso Longford Gas Plant Accident’, Report of the Longford Royal Commission, Parliament of Victoria (1999)
2) 'Lessons from Esso’s Gas Plant Explosion at Longford', Andrew Hopkins PhD, CCH Australia (2000)
3) 'API RP 941 Steels for Hydrogen Service at Elevated Temperatures and Pressures in Petroleum Refineries and Petrochemical Plants” (2016)
4) 'Catastrophic Rupture of Heat Exchanger (Tesoro Anacortes Refinery)', Report of the US Chemical Safety and Hazard Investigation Board (2014)
Peter Marsh, director of XBP Refining Consultants Ltd, is a consultant process engineer working in the oil refining industry. He has experience in process technology training, process safety, process reliability, process optimisation, process troubleshooting, project development and turnaround planning. He has over 30 years’ experience working in senior technical roles with BP. He also spent three years with Davy McKee Pacific Pty Ltd. He founded XBP Refining Consultants Ltd in 2015.