Safety First

Allyson Woodford shares her personal journey with process safety

I REMEMBER attending my first technical team meeting at the refinery. I was a fresh-faced vacation student, ready to take on all the interesting challenges the world of oil refining had to offer. Reaction engineering, unit operations, distillation – I was so excited. I was going to help change the world, one molecule at a time. 

Almost immediately I’m thrust into a state of confusion. Nearly the entire meeting is taken up with talk on safety? I looked around me attempting to understand why these amazingly talented engineers were talking about safety? To be perfectly honest, I felt a bit embarrassed. Why weren’t they talking about efficiency, margins – engineering stuff? Looking back on my 20-year-old self, if I was the teacher filling out the safety report card, I would generously give myself a 1/10: “Safety seems to be important”.

Another technical meeting rolled around, and this time the VHS player was wheeled out – we were going to watch a movie. “Great,” I thought, “this will be the one on distillation theory for sure”. It wasn’t. It was much more impactful than my beloved distillation. That afternoon, after watching a video on the Piper Alpha tragedy, I finally ‘got it’. I now knew why the engineers talked about safety. So much was at stake. Report card 3/10: “It has happened”.

Getting real

Fast forward to March 2005. Sitting in my supervisor’s office watching a tragedy unfold in real time. A major explosion had occurred at a refinery in Texas City, US. So many people were injured, some suspected to be dead, they hadn’t confirmed numbers. The footage made me hold my breath. My report card shot up to 4/10: “This could happen to us”.   Not long after, we suffered an emergency of our own. A hydrofluoric acid leak had occurred and people (my friends) were taken to hospital as a precaution. They were all ok but, as the incident investigation later uncovered, it highlighted the importance of management of change – the material selection of a simple steel plug could become a life-or-death decision. Report card status 5/10: “It can happen here”.

One afternoon years later I was in the emergency operations centre (EOC) at work, listening to a presentation when I heard interesting noises outside on the plant. I wanted to know more but was reassured that there was nothing to worry about. 

Then, in a minute, everything changed. The emergency evacuation alarm sounded – a World War II air raid siren (still makes my heart skip a beat when I hear one). My engineering colleagues left the room. I stayed, turned on the emergency radio and took up my post as the trained emergency radio operator. My role was to provide communications between the Emergency Controller and the incident team in the field led by the On-Scene Commander (our shift manager). 

“EOC to On-Scene Commander. On-Scene Commander please give a status report on the nature of the incident.” 

“On-Scene Commander to EOC. We have tripped the cracker, just getting it under control now.”

Cracking 101

The “cracker”, as it is fondly referred to, is one of the largest units in a refinery. The fluidised catalytic cracking unit (FCCU) uses high temperatures and a zeolite catalyst to crack large, low-value hydrocarbon molecules into smaller higher-value ones for use in transport fuels. A cracking engineer will tell you the cracker is the heart of the refinery, so let me give you Cracking 101. 

There are three main components in a cracker – the reactor, the regenerator, and the fractionator. The reactor takes hot heavy hydrocarbon feed and exposes it to very hot regenerated catalyst. The reaction is very quick and endothermic. The catalyst/hydrocarbon mixture travels up a standpipe into a large vessel where cyclones are employed to remove the now-spent catalyst from the products. The products are swept overhead into a large fractionating column. The colder catalyst meanwhile is now spent (deactivated), coated in the byproduct of the reaction, a fine layer of carbon. This catalyst travels to the regenerator, a large vessel in which air is introduced to burn the carbon from the surface of the sand-like catalyst. The burn-off process is hugely exothermic, not only cleaning the surface of the catalyst for another round of reaction but also providing the much-needed heat to atomise the heavy hydrocarbon feed. Uninterrupted, this process could almost continue on forever. 

Cracking is a risky business... When the pressure balance is lost and the flow direction changes the situation is termed “a reversal” and can result in process conditions that can end in fire or explosion – or both

Cracking is a risky business. You must keep the high fuel side completely separated from the high oxygen side. Hydrocarbon must only ever flow in one direction. A fine pressure balance, managed by two large valves, maintains this separation. When the pressure balance is lost and the flow direction changes (oxygen into the reactor or hydrocarbon into the regenerator) the situation is termed “a reversal” and can result in process conditions that can end in fire or explosion – or both.

It happened here

Now, back to the incident. A cracker shutdown, while not ideal, was not something new. We had experienced them previously, and the operators knew what to do. I sat there, radio in hand, talking to the emergency controller, when the most almighty sound I had ever heard in my life rolled across the refinery: BOOOOOOOMMMMMMM!

We felt the ceiling lift momentarily and slam back down, the pressure wave pushing through us. Such an incredible noise followed by silence. Everyone in the room was ok but in shock. I reverted to my training, pressing the button on the radio.

“On-Scene Commander this is the EOC. Come back.”

Nothing. I tried again.

“On-Scene Commander this is the EOC. Come back.”

Still nothing. I tried many times in the ensuing minute. It felt like a lifetime. 

So many questions that I never thought I’d ask. Is he alive? Are the guys ok? Are there fatalities? Are we too close to the plant? Should we move?

“On-Scene Commander this is the EOC. Please come back.”

Finally: “EOC this is the On-Scene commander we have just had a cracker reversal. Everyone is ok and accounted for, there’s no debris or major damage, we are working on getting the plant back into control.”

Relief.

By this point the decision had been taken to move the EOC closer to the main muster point. Walking there, I saw an image that will stay with me forever. People were visibly distressed, some in tears. The muster point’s occupants had watched the entire situation unfold, including the moment of deflagration, flames licking from the top of the regenerator’s stack. I felt their fear and then remembered that some of them had loved-ones who worked in the plant, maybe on shift that day? They had no idea if their friends and family were safe.

We assured the entire site that everyone was accounted for and collectively we all breathed a little easier

It was three hours later when we finally shut the EOC that I myself shed a few tears, supported by my friends around me. That was the day my report card shot up to 8/10: “This has happened to me and to people I care about.”   

Always more to learn

The root cause of the cracker incident was complicated, as they so often are. However, human factors played a key role. We had one of the best operators I have ever met on the cracker panel that day. We had a very good shutdown procedure too. But we let him down. He was expected, amongst a number of alarms and noise, to manually initiate a number of critical shutdown steps. One valve was missed due to the distracting nature of the environment he was in. Following the incident, one of a number of changes we made was to automate the shutdown steps to ensure we never asked the impossible again.

I am now the Operations Manager at a different site. I have responsibility to provide a safe working environment to more than 500 people every day. I hold a sense of chronic unease in my chest, relying on the systems, experience and leadership of my teams to keep everyone safe. Our safety leadership principles of “Care, Lead, Learn, Verify and Recognise” are close to my heart and ones I strive to live with every decision I make.

With respect to my safety report card, these days I’m a 9/10, I’ll never be a 10/10 – there will always be more to learn. Every day I focus on what’s most important to me - keeping the plant safe for my people and keeping my people safe for the plant.