Plant Safety: Leaks Don't Lie

On August 6, 2012, firemen and a work crew were investigating a leak in the light-gas-oil side-cut line of the crude atmospheric tower at Chevron's Richmond, Calif., refinery. An operator suggested shutting down the unit for repairs but was over-ruled. Firemen were instructed to pinpoint the leak under the insulation, which they proceeded to do — with a fire hook. The firemen smashed a hole in the thinned pipe and then blasted the pipe with cold water to break loose the insulation. The pipe burst and 640°F oil spilled and ignited. This accident nearly incinerated a fireman and has cost Chevron $12 million so far.
[pullquote]
Chevron had been replacing this corroded line and others connected to it but, obviously, not fast enough. Leaks were evident. During an inspection after the accident, Cal-OSHA found nine clamps to stop leaks.

Unfortunately, Chevron isn't alone in such misfortune. On December 7, 2009, a high-pressure reactor at NDK Crystal's plant in Belvedere, Ill., ruptured, killing a truck driver 650 feet away. In this case, nearby reactors had leaked before — in 2003, 2006 and 2009. NDK was convinced that a protective coating formed inside the 8-in.-thick reactor walls protected these vessels. NDK never qualified this "theory" or inspected vessel interiors. Neither the state of Illinois nor the company's insurer challenged the theory, though. Illinois granted NDK a waiver from complying with the ASME code: the thickness of the wall made inspection and fabrication problematic. The Belvedere site remains closed.

What links these two accidents together? Leaks provided adequate warning that something was very wrong.

So, what's the best way to approach a leak? Obviously, the first line of defense is vigorous inspection. Chevron, to its credit, did that; NDK did not. (The fatal 2010 fire and explosion at Tesoro's Anacortes, Wash., refinery also was linked to poor inspection.)

Second, always evaluate whether to continue operating once a leak is detected. Who at Chevron and NDK decided to keep the units running?

Chevron had more warning, but slapping a clamp on a leak is a common practice at most refineries. Chevron had used clamps before, building confidence that this approach was sound. (For more on the perils of stopgap repairs, see "Fear Ad Hoc Fixes.") Let's hope regulators and operating companies are doing some soul-searching to understand the risks of temporary solutions.

Now, imagine you were the maintenance manager at Richmond assigned to seal the leak. Assume you can't shut down the refinery, because that's normally the case. Perhaps operations can do something such as cut the tower rate, or cool or heat the tower temporarily to reduce the side draw. Ask. Work out a cooperative plan.

Start by reviewing the work done recently and in the past on the pipe and vessel: look at the inspection reports, marked-up isometrics, hazard and operability studies, etc. Talk with the inspectors and include them in the preparation. You now know this pipe is fragile. The process and instrumentation drawings don't show isolation valves; besides, even if they did, you don't know when these valves were operated last.

So, you have a delicate pipe and must remove the insulation to inspect it. How will you pull the insulation off without endangering your crew? Involve them in developing the job plan. What is your backup plan if the leak gets worse? How will the crew egress? What other equipment will be affected? What will you do if insulation removal doesn't expose the leak point? Who is qualified to do the job? Consider how the crew's actions could affect their safety and the success of job. Finish the draft and review it. Ask the inspectors to look over the job plan, too.

Ideally, you should have written a template for this plan months ahead as a maintenance standard operating procedure. This is a common practice at Dow Chemical and elsewhere.

Before work begins, brief your crew: no heroics, and no deviations from the plan. Establish a rapport with operations — what are they expected to do to support the crew? If the job goes sour, what will operations do to shut down the tower and reduce pipe flow? Do they have enough people to quickly isolate the tower? Are refinery safety and communications people in the loop on the work? Are nearby units aware of and prepared for what's going on? What about contractors and others off the refinery radio network?