ROBERTSON (AFPM) 

This is a question that was asked in 1974. During the review process in June, we decided to bring back a couple of questions. This group was intrigued by this question and thought it would be interesting to put it up as the first one for this session. So, we will just go down the line to get responses from each panelist. 

 

AGGUS (Becht Engineering Co., Inc.) 

I think the 1974 question was: What is an automatic control system? I believe that everyone, or at least most of us, has a common view on this one. If we are talking about a runaway, then I can say that in 2014, a refinery with which I am familiar carried out a replacement project. Per licensure’s requirements, they had a cause-and-effect diagram that required them to do a 300-pound dump if the reactor skin TIs (temperature indicators) got to the design temperature. They had a little bit of heartburn with that requirement and said, “Look, if one of the skin TIs is already that high, then the horse is already out of the barn, so to speak.” So, all they did differently was dump on one out of however many bed TIs hit the design temperature. To get around the spurious trips and flaring potential from this 300-pound dump, they set them all up to fail in the low range, which took care of the spurious issues. They felt like this protected them from spurious trips. 

 

AL-FUDHAIL (Saudi Aramco) 

My take on that question is that it there to be a clear distinction between excursion and runaways. For excursion, small temperature increases here and there would be acceptable. I would like to have the operator be able to control the temperature back instead of there being automatic dumping set up within an automatic control system.  

As for the excursion, definitely the runaway. There are multiple ways of doing it. Checking skin TIs is one method. You can configure it so that the rate of increase on the temperatures is an indication; you can trip and dump on that as well. From my perspective, I think a combination of both is best solution; again, with the understanding of the distinction between an excursion and a runaway. So, I think automatic control is a way to go for those runaways that are beyond control and increasing rapidly. Before the runaways reach the design temperature, dump it.  

 

JOHNSON (Motiva Enterprises LLC) 

I agree with Brant and Noaman. At Motiva, we elect to use rate of rise over a period to auto-depressure within our procedures. We do look at temperature rise itself and whether we need to proactively drop pressure to prevent further runaway reactions from occurring. We do elect to use an automatic depressuring system, but it is dependent upon rate of rise. 

 

LONG (HollyFrontier Corp - Navajo) 

I agree with the previous responses. The true 1974 response was from a former Navajo employee. The answer stated in the 1974 Answer Book response was that he preferred “manual controls with a well-trained operator”. Best Practice has changed. Automatic control systems are the best for handling temperature excursions in the hydrocracker but still with a well-trained operator overview.  

 

PAPPAL (Valero) 

Our system has a hydrocracker standard with specific guidelines on thermocouple density for bed outlet temperature measurement in cracking beds. Auto-depressing on high temperature is triggered within the safety system. 

 

RAMACHANDRAN (Bharat Petroleum Corporation Limited) 

When we started the first hydrocracker, our approach was to control with human intervention. With time, I think we realized that automatic control could do “all the time” what a good operator could do. So, we switched to automatic sequencing, and it has been there ever since. I think we have been very successful with it. 

 SCHOELLKOPF (Advanced Refining Technologies) 

Definitely automatic controls. It just depends on whether it is a retrofit-type unit or an older unit. It also depends on your thermocouple density – as Dave mentioned, whether it is two-out-of-three or two-out-of-two voting, etc. Then, of course, you must define the meaning of ‘excursion’ and ‘runaway’. But yes, automatic controls are the Best Practice.  

 

BLAKE MYRICK (Haldor Topsoe, Inc.) 

I want to echo what everyone else is saying: That for an excursion, an operator response should be sufficient to bring the temperature back within control. But for a true runaway, a safety instrumented system should trigger an automatic high rate depressure based on the rate of change of temperature or an exceedance of the safe operating limit.  

 

SALVATORETORRISI (Criterion Catalysts & Technologies L.P.) 

This is a pitch for our P&P (Principles and Practices). The subject of reactor safety in hydrocrackers is our third section of the P&P tomorrow morning. So, come here more from some of the panelist experts when we dive into this a little more deeply.  

 

ANDREW MORELAND (Valero) 

Does anyone have any experience with something in between these two; in other words, beyond board operator control but before depressuring, such as an automated system that is not necessarily depressure but takes temperature control away from the operator? Does anyone have any experience with that type of system? 

 

RICHARD TODD (Norton Engineering Consultants, Inc.) 

Automatic depressuring on a “defined” temperature excursion is the procedure considered to be Best Practice and can be used to prevent the potential failure of the reactor outlet elbow or line. Automatic depressuring retrofits to existing units continues in industry. An industry standard LOPA (Layers of Protection Analysis) will identify that all hydroprocessing units with cracking function on their catalysts can have a temperature excursion and will need auto-depressuring. In fact, in many cases, the automatic depressuring of the reactors lends itself to earlier intervention by operators, potentially decreasing the number of events that require depressuring.