IN 1976, I was the supervisor of the world’s largest alkylation unit. My plant, No. 2 alky in Texas City, had a capacity of 26,000 bbl/d. In mid-June, an explosion that originated on my unit, badly damaged both No. 2 alky and No. 3 FCU (the world’s’ largest, 120,000 bbl/d fluid catalytic cracking Unit). Fortunately, no-one was hurt. Given the argument that we all are obliged to share our safety-related experiences, 42 years on, let me describe what caused this costly incident, and how proper design could have prevented this explosion.
Safety – attitude or engineering
There is a misconception in the process and refining industry that the key to safety is:
- awareness
- alertness
- attitude
Safety meetings often do not deal with actual safety issues on refinery units. Everyone I have ever met in a refinery wants the facility to operate without death and disaster. But only too often, this desire is frustrated by engineering design errors. The 1976 propane explosion at the Amoco Refinery in Texas City, US is an illustration of a failure in applied technology.
Sulfuric acid alkylation
The Stratco Alkylation process (licensed by DuPont) was developed during World War II by CW Stratford and Ward Graham. Butylene and isobutane are reacted to make iso-octane at a temperature of about 10°C. The exothermic heat of reaction is removed by an effluent refrigeration loop with a typical composition of:
- 80% Isobutane
- 10% normal butane
- 10% propane
The propane is continuously purged from the circulating refrigerant in a depropaniser tower. The overhead propane product from this tower contains an acid ester – a hydrocarbon molecule combined with a sulfur trioxide group (SO3). This acid ester is entirely non-corrosive as long as it is water free or dry. But, if it accidentally gets wet, then the acid ester will dissociate into hydrocarbon and weak sulfuric acid. Strong sulfuric acid (90%+) is not corrosive to carbon steel. Weak sulfuric acid (10–20%) is tremendously corrosive to carbon steel piping. I have personally seen weak acid eat through welds of 6” piping over a weekend.
Wet vs dry
According to my Alky mentor, Ward Graham (who passed away in 1980), corrosion in an alkylation unit depropaniser may be entirely suppressed if the depropaniser feed is kept dry (free of both dissolved and entrained water). During normal operations, this would be the case – except on startup of the depropaniser.
I was in charge of the operation of No. 2 Alky from April 1974 through mid-1976. During this period, the alkylation reaction section was operated without interruption. After all, we produced 0.6% of the total gasoline consumed in the US. But, the unit’s depropanizer was shut down on several occasions to fix tube leaks in the water-cooled overhead condensers. To operate without the depropaniser for a few days was not a problem. Propane accumulated in the circulating isobutane refrigerant stream. After a few days, we could then vent off non-condensables from the refrigerant accumulator drum to fuel gas. The vent gas had 50% butane, as compared to 2% butane in the depropaniser overhead LPG product. So, isobutane consumption was high while the depropaniser was out of service. But, that was the normal operating procedure followed while the depropaniser was off-line for condenser tube repairs. However, on re-commissioning the depropaniser, this practice had the potential to introduce corrosive moisture into the tower.
Depropaniser startup procedure
A leaking tube in the depropaniser overhead water-cooled condensers could not introduce water into the tower. The depropaniser operated at 20 bar. Cooling water pressure was 2 bar. The problem of moisture introduction into the tower occurred after we shut the tower down to repair or replace the leaking tube bundle in the overhead condenser. Moisture could then be introduced into the depropaniser in a variety of ways:
- The tower was steamed-out to hydrocarbon free it prior to blinding-off (ie, “spading”) the shell side of the condenser;
- The tower was depressured below the circulating cooling water supply pressure; or
- When the tower was re-streamed, wet field butanes (which contained about 2–5% propane) was used to start-up the tower to establish a reflux flow at normal 300 psig (20 BAR) operating pressure.
A design error
The Alky Unit had not been designed to start-up the depropaniser separately, while the rest of the unit was in operation. As it was possible to operate the unit without the depropaniser running, this should have been considered during the design phase of the project. As a consequence of this omission, in practice, refrigerant isobutane, that contained acid esters, was introduced into the depropaniser while the tower’s reflux was saturated with water. The acidic water circulated with the reflux. A rapid rate of corrosion, due to weak sulfuric acid, caused the 4” elbow on the suction of the reflux pump to fail. I climbed up to inspect the elbow a week after the failure. It looked like an evil person had taken a can opener, and peeled back the elbow, which was no thicker than a lid on a soup can.
The entire contents of the 4’-0” ID x 15’-0” T-T reflux drum had emptied. A huge white cloud of LGP vapours drifted across No. 2 alky, over to the No. 3 FCU. The cloud ignited off of the CO boiler on the FCU and detonated, blowing in the roof of the FCU control room. The shift foreman had everyone take cover beneath desks and tables, and thankfully, no one was injured. However, the entire East Plant of the world’s largest refinery was shut down for several months.
Corrective design change
After this incident, the unit was retrofitted with a caustic wash (10% NaOH) upstream of the depropaniser, to remove all traces of acid esters from the tower’s feed. This, I believe was a correct decision by the Amoco management. However, in the interval before the new caustic wash was installed, I instituted an alternate mode of operations. That was:
- Step 1 – steam-out tower prior to start-up.
- Step 2 – bring in mixed butane feed for a few hours to establish a reflux drum level and reflux flow using the tower reboiler to vaporize the reflux.
- Step 3 – stop bringing in all the wet feed and run only on total reflux for X-hours.
By X-hours, I mean until I personally checked to see that the water draw-off boot on the depropaniser reflux drum was utterly free of water. Then, I would wait another shift, before allowing the acidic isobutane refrigerant recycle to be reintroduced to the alky depropaniser.
Summary
The original design error assumed that someone would use a significant degree of engineering insight to realise that the depropaniser must be completely dehydrated before the refrigerant recycle was reintroduced back into the tower. That, I believe, was an unreasonable expectation. Especially, since this requirement was never specified in the unit’s original operating instructions.
The management decision to install the 10% caustic wash on the depropaniser feed, which I did not consider necessary at that time, (because with proper operation, the depropaniser on startup would preclude corrosive moisture) was, I now believe in retrospect, the correct engineering decision.
As long as the alkylation unit was operated in a normal, steady state mode of operation, the depropaniser would remain in a dry, and hence a non-corrosive state. However, there were in practice, a number of circumstances that could inadvertently introduce moisture into the tower. The caustic wash was a relatively inexpensive option to enhance the unit safety by extracting acid esters from the depropaniser feed.
My own attitude towards safe plant design was greatly influenced by this incident. I now try to include provisions in my process design work for safe shutdowns, startups, and response to upsets and equipment failures. Especially if water can mix with acidic components.
The lesson to be learned from this incident is that process operations of refinery units are inherently hazardous. That just because correct operating instructions, to avoid a dangerous situation exist on paper, does not preclude the potential hazard. The use of a caustic wash on the feed to the depropaniser tower would have added to the intrinsic safety of the Alkylation Unit.
After reading this article, ask yourself this question: "Is my unit intrinsically safe, or am I relying on my field operators to always exercise good judgement, and invariably follow written procedures?"
