Process Safety Management in Transfer and Stockpiling Operations of the Downstream Industry

The stockpiling assets deal with great amount of energy with are stored in tanks and pipes, due this reason, the most adverse scenarios related to process safety can occur in the transfer and stockpiling area.

??????????? Unfortunately, due to operate normally under low pressure and temperature, there is a trend of underestimate the process safety risks in stockpiling operations by operators, managers and engineers and this needs to be adequately managed aiming to minimize the risks of accidents with great impact like fire in hydrocarbon storage tanks or contention loss in pipelines.

??????????? Fortunately, the process safety management in the crude oil refining industry present great advances in the last decades, but the cost of this development was the loss of human life in process safety accidents that have marked the downstream industry like Texas City refinery in 2005 and the Formosa plastics petrochemical plant in 2004. A series of process safety accidents even without cause loss of human life caused serious damages to the installations and, in some cases, the process plant was definitively closed impacting several lives and local economies, like the case of Philadelphia Energy Solutions (PES) refinery in 2019.

??????????? An adequate process safety management system is responsible for keeping under control the inherent risks associated with the petroleum refining process. The successful of any process safety management system depends on all the elements of the productive chain from the material suppliers, engineers, operators, managers, etc. Once each one is responsible or your activities are related to at least one of the process safety barriers.

??????????? Along the years, the process industries advanced in their approach related to the process safety from a reactive approach based on rules and standards to risk based strategy.

The standard based approach was developed considering the lessons learned from process safety accidents to develop safer procedures, standards and rules aiming to minimize the risk of recurrence of process safety incidents, the evolution to risk based strategies allow the organization to follow the regulatory requirements and keep learning from past accidents, but the approach allows the organization to anticipate management actions to avoid process safety accidents considering information which describe which point of the process is under higher risk. With this information the organization can take the actions capable to eliminate or put under control the process safety risk before an incident or accident. According the CCPS (Center for Chemical Process Safety) the risk based process safety is based on for pillars as presented in Figure 1.

Figure 1 – Pillars of Risk Based Process Safety

Still according to CCPS, the process safety commitment of an organization is translated into five elements:

·?????? Process safety culture;

·?????? Compliance with regulatory requirements;

·?????? Process safety competency;

·?????? Work force engagement;

·?????? Stakeholders outreach;

A process safety culture can be resumed as a synergy between behaviors and values which determines how the process safety will be managed in the organization (CCPS, 2014). An adequate process safety culture will lead the work force and managers to be intolerant to deviations and risks of process safety preventing the organization from considering coexistence with process safety deviations and risks.

The compliance with regulatory requirements is a fundamental part of the process safety commitment by the organizations and this is even more important to the downstream industry which is highly regulated due to the inherent risks associated to the crude oil refining and petrochemical production. The refiners need to keep up to date with regulations through the continuous capital investments in operational improvements aiming to keep the refining assets in compliance with the last revision of standards like API and NFPA requirements.

The development of process safety competency is related to improve continuously the knowledge in process safety, ensure that relevant information will be available to the stakeholders and apply in appropriate manner the lessons learned with the experience during the development of process safety competency. This is strictly related to training and knowledge, especially the operating and maintenance personnel which are directly involved with the process safety risks.

The work force engagement is another essential part of the culture of process safety in the organization. The engagement process involves the active participation of the whole work force in the development of a process safety culture and not only the compliance with rules imposed by the management team, but this is also translated by the search of an interdependent behavior as described by the Bradley Curve? proposed by Dupont Company in 1995. In this stage, the organization faces the process safety as a collective responsibility and the rules are accomplished because the persons trust in the process not by obligation.

The stakeholders outreach is related to the transparency of the organization in relation to the inherent risks of their operations as well as emergency scenarios and de adequate communication to these stakeholders.

??????????? The second pillar of the risk based process safety is understand the risks and hazards of the operations. This pillar is based in two critical elements:

·?????? Hazard identification and risk analysis – The conscience of hazards and risks based on adequate analysis allows the organization to prioritize projects, investments, inspections, and maintenance aiming to minimize the most severe risks and hazards;

·?????? Process knowledge management – It’s fundamental that the employes knows the inherent risks of the process as well as the emergency scenarios and how the mitigate these risks;

The risk management pillar is sustained by nine elements, which are dedicated to ensuring stable and safe operations aiming to control the inherent risks of the operation (for example, respecting the operation limits and restrictions), manage adequately the changes in order to keep the risks under control and offer adequate response in case of accidents or incidents. The nine elements of the risk management of risk based process safety are presented below:

·?????? Operating procedures;

·?????? Safe work practices;

·?????? Asset integrity and reliability;

·?????? Contractor management;

·?????? Training and performance assurance;

·?????? Management of change;

·?????? Operational readiness;

·?????? Conduct of operations;

·?????? Emergency management;

The last pillar of the risk based process safety is learning from the experience, this pillar involves actions thar ensures that the organization is under constant learning and development in process safety with their own occurrences or from other companies accidents. The elements which sustain the learning from experience pillar are:

·?????? Incident investigation – Each occurrence needs to be deeply and adequately analyzed aiming to determine the root causes and produce effective knowledge and actions which will avoid similar events in the future;

·?????? Measurement and metrics – Develop and monitoring adequate KPIs aiming to allow an effective follow-up of the process safety deviations;

·?????? Auditing – Periodic verification of how effective the process safety management of the organization is;

·?????? Management review and continuous improvement – Closing the PDCA cycle with the verification of the process effectiveness and proposing revisions for improvements.

One of the key factors of the process safety in crude oil refineries is how the operation team know process safety management, the main process safety risks, and the key safety elements. After the identification of the key safety elements, it’s necessary to define the mitigation and prevention barriers capable to prevent the risk scenario or process safety accident, this can be made using one of the traditional hazard identification techniques described below:

1.???? Semi-quantitative techniques: In this category the most common technique is the Layer of Protection Analysis (LOPA), this technique helps to identify the frequency of events occurrence which can cause a determined hazard, the probability of failure of the protection layers and the consequences, leading to an estimative of the risk associated with the studied scenario;

2.???? Quantitative techniques: The most applied quantitative technique in the crude oil refineries is the Quantitative Risk Analysis (QRA) which involves data collection and analysis to estimate the risks of hazardous events helping to understand the outcomes of different scenarios and then facilitating the decision making process;

3.???? Qualitative techniques: In this category of risk studies there is a series of techniques capable to help the refinery management to better understand the process safety barriers which are:

·?????? Hazard and Operability Study (HAZOP) – This is the most common risk assessment technique applied in the refining industry. In the HAZOP technique is carried out a structured analysis of existing or future process in order to identify and evaluate the associated risks which can affect the people, process and installation proposing actions to mitigate the risks;

·?????? Hazard Identification Studies (HAZID) – This technique is applied systematically aiming to identify potential hazards and their consequences over the process asset which can involves hazards nonrelated to the process;

·?????? Control Hazardous Studies (CHAZOP) – This technique is a systematic risk assessment approach focused to identify hazards and operability issues associated with a control system;

·?????? Simultaneous Operation Studies (SIMOPS) – This technique is dedicated to identifying hazards and operability issues in simultaneous operations, this technique is especially important to identify process safety risks in stockpiling and transfer operations which normally involves at least two different operating areas;

The hazards identified by SIMOP studies are normally not considered by the other risk assessment techniques which are dedicated to analyzing individual process operation scenarios. Considering the characteristics of the stockpiling operations, the SIMOP study it’s fundamental to help to identify hazards related to interdependent actions.

A very good example of the applicability of SIMOP studies is the operation of filling a storage tank which is one of the most common operations in stockpiling area. There are several risks associated with this operation like overfill, overpressure or the reception of contaminated stream in the tank which can lead to process safety risks like the mixture of naphtha and LPG in an atmospheric tank due to the operational instability in a processing unit like distillation or FCC. The SIMOP study is a fundamental tool to identify hazards in transfer and stockpiling operations of a crude oil refinery, mainly related to the lack of integration between the operating teams involved in the operation.

The main steps of a typical SIMOP study are summarized below:

·?????? Identify activities – In this step are identified and listed the activities or tasks needed to reach a specific objective like fill a storage tank. All needed activities in all involved areas should be identified even the related with the adjacent facilities;

·?????? Collect information about the activities – This step aims to collect the maximum information in order to identify potential conflicts between the operating steps and associated hazards;

·?????? Identify possible interactions - This step is dedicated to identifying adverse interactions between the activities like process connections, disabled safeguards, and communications failure;

·?????? Identify possible consequences – This step aims to identify the potential impacts of the adverse interactions;

·?????? Identify existing safeguards – A deep analysis is carried out aiming to identify the existing safeguards to the impacts of the adverse interactions identified in the previous steps as well as identify the required new safeguards which need to be implemented to avoid the identified hazards;

·?????? Identify recommendations for any necessary risks controls – Are made recommendations to control the identified risks considering the hierarchy of hazards.

Based on the concepts of risk based process safety (RBPS), it’s possible to propose an approach to the process safety management in stockpiling operations based on three main pillars: asset management, discipline, and integration between the stockpiling area with another operational areas as presented in Figure 2.

Figure 2 – Pillars of Process Safety Management in Stockpiling operations

?Asset Management

??????????? Unfortunately, the obvious needs to be said! It’s impossible to ensure process safety without an adequate asset management strategy, mainly in transfer and stockpiling operations. As previously mentioned, the asset management is related to the pillar of risk management of the risk based process safety methodology proposed by the CCPS, the asset management policy adopted by a refinery revels the maturity of the process safety culture and the commitment of this refinery with the process safety.

??????????? The contention loss in a simple equipment like a tank mixer can lead to a severe process safety accident. Due to the characteristics of the stockpiling area, an inadequate asset management policy will not cause an immediate impact over the production and this fact can lead the maintenance team to reduce the urgence sense to deal with the reliability and maintenance issues of stockpiling assets.

??????????? The stockpiling manager should be able to use their knowledge of the refinery process chain to calls the attention to the stockpiling assets aiming to avoid that the asset degradation.

According to the literature (CHANG & LIN, 2006), great part of the accidents occurred in storage tanks between 1960 and 2003 was caused by maintenance errors or equipment failure, the main cause of accidents in storage tanks was caused by lightening. This is an interesting data once the lightening accidents can be related to ground system failure which is also related to asset management issues.

Failures in asset management policy can be the cause of process safety accidents which are initially attributed to human error, still according to CHANG & LIN, 2006 the most part of process safety accidents occurred between 1960 and 2003 attribute to operational error is related to tank overfilling which again can be related to asset management issues, especially related to tank gauging system failures. The stockpiling operating team should be trained to understand that without adequate asset, the operations can’t be carried out, for example a transfer operation should not be started if the tank gauging system ins unavailable and should be stopped if the gauging system fail during the transfer operation.

The asset management in stockpiling assets is a special challenge in a crude oil refinery due to the number of equipment and the dimensions involved in this system. We dedicate a chapter exclusively to this topic in this book, but we understand that it’s impossible to talk about process safety management in stockpiling operations without adequate asset management policy.

Stockpiling managers should be able to attract maintenance resources for achieve the best availability and reliability of the stockpiling assets aiming to offer to the refinery the maximum operational flexibility which will led for maximum profitability. Unfortunately, this is not an easy task, the common mind map of the maintenance managers is to deserve less attention to stockpiling assets than deserved to processing units assets. One of the main roles of the stockpiling managers is find creative ways to force the maintenance team to understand the real impact of stockpiling assets over the results of the refinery, for achieve this it’s fundamental to develop in the operation team an intolerance culture with the operation of poor reliability equipment or even broken equipment and instruments.

The operating team needs to help the refinery to develop the asset management policy in order the avoid sudden failures which raises the safety risks. The adequate evolutionary path of asset management is shown in Figure 3.

Figure 3 – Evolutionary path of asset management

In Figure 3, the accidental maintenance is characterized by a reactive maintenance where the approach is just to fix failures. In this approach there is the higher process safety risks once occurs sudden failures which normally depend on the operators skills to avoid impacts over the process.

The scheduled maintenance is an evolution of the accidental maintenance once there is an attempt to anticipate the failure, reducing the dependence of operators skills to avoid process safety risks and the impact over the production.? The improvement maintenance aims to eliminate the failure through the action in the process, especially those with chronical failures.

The final of the evolutionary process of maintenance in a crude oil refinery is the real asset management policy. In this step the resources and management actions aim to keep and extend the lifecycle of operating assets as well as improve the asset performance leading to lower risks of sudden failures and process safety risks.

To improve the asset management performance, the stockpiling managers needs to sponsor and organize reliability meeting to discuss the chronical failures in equipment and systems, especially those considered critical to the process safety like the tank gauging systems.

The protection layers of the tank farm should be completely available and reliable in order to minimize process safety risks. As described above, great part of process safety accidents involving storage tanks is related to overfill occurrence, this data reinforces the relevance of these systems to process safety requirements of tank farms once demands continuous monitoring with adequate accuracy and reliability.

According to the API 2350 (Overfill Prevention for Storage Tanks in Petroleum Facilities) the storage tanks of a crude oil refinery can be classified according to their installed level monitoring system, this classification is summarized below:

·?????? Category 0 – In this case de overfill prevention system (OPS) is totally manual and there aren’t instrumentation systems capable to transmit alarms or liquid level information. In this case, the overfill control is totally dependent of the operator. The API allows that these facilities can operate under continuous monitoring during the first hour of the receipt, every hour during the receipt, and again continuously during the last hour of the receipt, despite this this author simple understand which is not acceptable to operate hydrocarbon storage tanks under this way;

·?????? Category 1 – This category is related to storage tanks which have only local liquid level information, without information transmission to the panel operator;

·?????? Category 2 – This category involves the storage tanks which have automatic gauging systems (ATGs) with High-High level alarm (LAHH) based in the ATG information. The level and alarms information are continuously transmitted to the panel operator, this system is commonly found in crude oil refineries but there is a fragility once the High-High level alarm depends on the ATG information. In other words, there is no redundancy in the level control;

·?????? Category 3 – In this case the storage tank relies on an automatic tank gauging (ATG) with independent High-High level alarm with information transmission to the panel operator. This category is safer once eliminate the dependence of the High-High level alarm from the ATG, establishing a redundancy in the level control.

As presented above, each facility category presents a overfill risk level which demands different response time. The response time is defined as the demanded time necessary to end a receipt in the safest way, this time is calculated based on the tank levels of concern (LOCs) as defined according to the API 2350 criteria. Table 1 presents the typical response times according to the storage tanks category.

Normally, the overfill systems applied in crude oil refineries storage tanks should present at least Safety Integrity Level (SIL) at 2, in other words, a frequency of dangerous failures per hour between 10-7 to 10-6. This can be applied using a redundant system allying a level switch and a radar gauge integrated by an PLC. Figure 4 presents an example of safety interlock structure applied in tank farms of crude oil refineries (Category 3 facilities).

Figure 4 – Typical Interlock structure of overfill system of tank farms of crude oil refineries. Where: TAS – Terminal Automation System; ESD – Emergency Shutdown; PLC – Programable Logical Computer

?The ESD PLC is dedicated to act in emergency scenarios, applying at least SIL 2 gauging devices and the radar gauges should present a minimum accuracy of ± 1,0 mm. The strategy proposed in Figure 4 presents redundant level control aiming to avoid overfill accidents which can lead to great emergency scenarios like occurred in Buncefield terminal accident in 2005 (United Kingdon) that led to the destruction of the asset.

The operation team should be the most critical as possible with the performance of the stockpiling assets never accepting to operate pumps under vibration or leaking, tanks without gauging system, grounding, or systems under hydrocarbon leakage as example. The development of adequate KPIs related to the availability of the stockpiling assets should be encouraged and supported by the refinery management team aiming to achieve a sustainable, safe, and reliable operation of stockpiling assets.

Again, it’s important to remember that the worst emergency scenarios of a crude oil refinery can occur in stockpiling assets, especially in crude oil storage tanks and LPG tank farms.

Discipline

??????????? Operational discipline is another key pillar of the process safety in stockpiling operations. As well as any operating area of the crude oil refinery the stockpiling operations have a series of procedures to ensure safety to the routine operations.

One of the main safety factors in stockpiling operation is the communication quality between the operators involved in the operations. Before starting a transfer operation between tanks, the panel operators should confirm by radio the valves and equipment involved the in the operation aiming to ensure that the planned operation will occurs without mistakes.

The communication is only one of a series of procedures and standards which drives the stockpiling operations, and the managers and operation team needs to be adequately trained in each procedure and have adequate discipline to comply with the standards without deviations. Figure 5 shows what happen when there is a managing drift between the planning and like the work is really done.

The model proposed by DEKKER, 2014 says that the deviations in relation to the procedures and standards.

Figure 5 – Effect of management drift between the planning and execution (The Human Diver based on DEKKER, 2014)

To avoid the drift management along the time it’s necessary constant training aiming to keep the operators awarded regarding the risks associated with their day by day operations. Unfortunately, the greater the familiarity with the asset, the greater the risks associated with human error in the operation of this asset once the “familiarity” with a refining asset tends to lead to attention lack, or in the extreme side, negligence with the risks associated with the operations and the tendency of the team to neglect the procedures and operational discipline. Figure 6 presents an overview of the human error classification based on the concept developed by James Reason.

Figure 6 – Classification of Human Error (Based on REASON, 1990)

Based on the classification presented in Figure 6.3, it’s possible to understand that there is a natural evolutive cycle which demands management actions aiming to Prevent excessive skill from becoming negligence and operational indiscipline as presented in Figure 7.

Figure 7 – Natural evolutive cycle between Mindful behavior and Automatic behavior (Based on REASON, 1997)

??????????? The management actions described in Figure 7.4 can be related to constant training of the operating team as well as an adequate periodic audit planning aiming to ensure that the operating team is trained and following the procedures without or with minimum deviations. The audit is also an opportunity to identify lack of knowledge which can support a training plan.

??????????? The audits carried out should cover all the aspects of the operational routine of the stockpiling operators not in order to just find errors and mistakes but identify procedures deviations which will reveal the necessity to more and better training programs. Under any circumstances the audits should be a punitive nature, the refinery should look to learn from the deviations and take adequate management actions to promote a real just culture in the organization in order to ensure a confidence relationship between the management and operation teams.

??????????? As described above one of the key processes related to the operational discipline in stockpiling operations is the adequate communication between operators during the transfer of hydrocarbons. An example of how this topic is essential in stockpiling operations is the change of storage tank, which is receiving production from a processing unit, this scenario is special critical when involving the production of liquified gases like LPG or propylene.

??????????? In a crude oil refinery, during the change of the LPG production stream from a delayed coking unit from the LPG sphere A to the LPG sphere B the operator closed the admission valve in the sphere A and some minutes before open the admission valve in the sphere B. During this time of interval, the LPG stream alignment was totally blocked and the process safety valve of the production vessel in the delayed coking unit open to the flaring system charactering a significant process safety incident.

??????????? The correct operation in this scenario should be the adequate communication between the panel and field operators of stockpiling area by radio confirming the valve involved in the LPG sphere change and, after the alignment confirmation and valve identification, the field operator should open the admission valve in sphere B followed by the closing of the admission valve to the sphere A. After the confirmation from the field operator related the adequate sequence of the valves manipulations, the panel operator should confirm that the LPG production is feeding the sphere B through the signal of the gauging system.

??????????? In another operational incident, during the change of spheres that received propylene production (from sphere B to sphere A), the panel operator requested the field operator to align the valves of the sphere A. The field operator back to the panel operator informing that the production valve of the sphere A is opened, but they do not make the operation they only saw that the valve seems opened, and this was informed to the panel operator, in the sequence the production valve of the sphere B is closed. After around 40 minutes where the gauge system of the sphere A does not indicate flow or level raising, the supervisor of the propylene production unit demands the stockpiling supervisor to check the propylene alignment once the pressure in the propylene production vessel is close to the limit, two minutes after, the pressure safety valve of the propylene production vessel is opened to the flare system.

??????????? The correct operation should be the conference of the alignment by the field operator to confirm that the valve is really opened in the field as well as the panel operator should monitor the gauging system of the new receiving sphere aiming to ensure that the alignment is correct through the response of the gauging system few minutes after the alignment confirmation from the field operator.

??????????? These are brief example of how critical the operational discipline in stockpiling operations is, again the focus should be ever into identify deviations aiming to ensure the learning opportunities in lower impact events and not under near accidents or in emergency situations.

The transfer operations are among the critical operations in a crude oil refinery and can be responsible for the worst emergency scenarios in a crude oil refinery, by this reason the transfer operations should be carried out under constant monitoring and adequate procedures like presented below:

·?????? Before starting a hydrocarbon transfer:

Check the hydrocarbon level of the receiving tank to determine how much product it can take. It is important to determine a SAFE GAUGE HEIGHT (SGH), that is, how much fuel the tank can safely hold, allowing for expansion due to temperature variations. The field operator should walk the pipeline to check for visible leaks or any irregularity in the pipeline as well as to check the valves position. It is important to make sure valves are in the proper position so that product will only go to the targeted tank.

Determine how much hydrocarbon is above the receiving pipe inside the receiving tank. If there is less than one foot of hydrocarbon above the receiving pipe, transfer should be carried out at a reduced rate until at least a foot of product is covering the pipe. This will reduce the potential for explosions caused by static electricity when fuel is pumped into the tank at a high rate.

This point is especially relevant for filling tanks backing from maintenance which needs to be ballasting where the risk of explosions is even more severe. According to the diameter of the receiving pipe it’s possible to determine the maximum ballasting flow rate as presented in Table 2.

If a transfer is made for outside of the refinery (for local terminal clients), the stockpiling operator should request an alignment inspection document from the terminal team which can be sent by e-mail or communicated through the radio ensuring that the receiving alignment is correct and there is sufficient space in the receiving tank to hold the planned transfer volume. During all the time the operation teams should made contact by radio to check the transfer conditions, but this is especially critical during start and stop of the transfer, due to the process transients.

·?????? During the transfer:

The transfer should start under reduced flow rate until the operation team ensure that the receiving tank is receiving the transfer without leakages or any deviations, the operation should be accompanied by the operation team all the time checking the expending and the receiving tanks levels periodically.

The transfer flow rate should be reduced when the safe gauge height is nearing, avoiding overfill risks and allowing sufficient time to operation team to close valves and another procedure.

·?????? End of the transfer:

Close the valves of the receiving tank first to avoid hydraulic hammer in the transfer pipe and make the communications to end the transfer operation checking the valves position.

After adequate time interval (normally 24 hours), the receiving tank can be dipped to check the water level accumulated at the bottom and then the water can be drained for appropriate system.

As described above the operational discipline is fundamental to ensure the adequate adherence between how the operations is planned and how they are really carried out by the operating personnel. Again, it’s necessary to deal with the deviations in a just way in order to promote a safe environment where the employes trust the management team allowing that the failures and mistakes will be applied to promote the development of the team and not to look for culprits and generate punishments which lead to a psychologically unsafe work environment. It’s impossible to create real process safety culture in any company without psychological safety, especially in crude oil refineries.

Integration

??????????? The third pillar of the tripod proposed for the process safety in stockpiling operations in the integration. The term integration is related with a closer relation between the stockpiling operation team with another operating areas of the refinery, it’s not uncommon to heard from the stockpiling teams that they were not informed about some operations and that the stockpiling is not adequately involved in the refinery operations planning, mainly in maintenance shutdowns.

??????????? This is a serious mistake which can have severe consequences, during planned shutdowns it’s necessary to define the required space to storage intermediates and final products from the process units which will be kept in operation and only the stockpiling team have sufficient knowledge about the risks and availability of storage tanks capable to allow the safe shutdown and start-up of the processing units, including the risks associated with the hydrocarbon stream transfers during these steps once the processing units are in the transient operation regime and the process safety risks are higher.

Another key aspect is the impact of the maintenance shutdown of processing units over the stockpiling area is the discharge to the flare system, once the system has a limited capacity which can bottleneck the processing units shutdown without an adequate planning and shutdown sequence. This is especially relevant for refineries located in regions with high population density once the flare noise, odor, and emissions can lead to reclaims from the society in contrast with the current ESG policies from the companies.

??????????? It’s not uncommon to heard from the processing units team that the “culture” of the stockpiling area is much different leading the stockpiling team to present a kind of “distance” from the other operating areas of the refinery. This must be severely combated by the stockpiling manager, the stockpiling area have specificities but, in any moment, should be created barriers between the stockpiling area and the processing units operation, the management team should create, incentive, and developed a total integrated environment between the whole refinery, especially the stockpiling which affects and coordinate any relevant operation in the crude oil refinery.

??????????? The stockpiling operation team should be capable do describe which stream is filling and emptying each tank or each pipeline and this is only possible under the perfect integration with the whole refinery.

??????????? To promote a closer integration between stockpiling and other operating areas of the refinery, the managers can apply some proven integration models like FSPNA and the Lencioni models aiming to troubleshoot the scenario and build alignment leading to a better integration. The framework of the Lencioni model is presented in Figure 8.

Figure 8 – Framework of Lencioni Model (Adapted from LENCIONI, 2005)

????? The model proposed by Lencioni stablish the key factor which led to the team failure as described below:

·?????? Absence of trust – This is special dangerous for operating teams of crude oil refineries which deal with process safety risks in day by day activities which demands high confidence environment, the absence of trust can lead the operating teams to hide and not share information, raising the process safety risks;

·?????? Fear of conflict – Teams without confidence cannot find adequate environment to honest and direct communications explaining their limitations and restrictions avoiding discussions which normally are necessary to a deep understanding of the scenarios involved in the refinery operations;

·?????? Lack of commitment – The operation teams do not have the complete understanding of their roles leading to a poor engagement to the team and to the whole business, creating a culture of individuality which can be severely dangerous for the process safety requirements;

·?????? Avoidance of accountability – The team do not develop a team spirit, creating gaps between the positions, creating or worsening risks to the operations and process safety;

·?????? Inattention to results – There a complete lack of understanding of how the teams role in the crude oil refinery is creating knowledge “islands” between the different areas.

The main role of the Lencioni model is the managers to understand the weak points of the teams and how to overcome these issues. Considering the context o a crude oil refinery, it’s fundamental to promote closer integration and cooperation between operating teams to minimize the impact of a non-integrated actions.

The absence of trust is one of the most prejudicial and dangerous characteristics to deal between personnel teams. This characteristic will lead the operation teams of different areas (mainly the stockpiling team) to adopt a defensive positioning aiming to protect their own operations and team, creating then non-integrated operating teams concerned only with their own results and not with the whole results.

The fear of conflict is another dangerous characteristic for stockpiling and refinery operation team. Conflict it’s not a bad thing if the people are discussing how to developed safer operations in a critical and respectful way, the fear of conflict can lead some operators to not discuss some procedures considering unsafe leading to opportunity losses to team improvement and learning, the operation team should have confidence to say when they understand that the procedures and operations needs to be reviewed or discuss how an operation can be carried out in a safer or optimized way.

The lack of commitment is caused by the absence of clarity of the role of the team in the business. It’s fundamental to create opportunities and forums by the management to clearly describe what are the roles of the operation teams to the success of the refinery, the operators need to clearly understand their impact over the business and how their performance can add or destroy value to the business. This will help to develop the commitment in the team, minimizing the risks associated of non-integrated actions.

The avoidance of accountability is a side effect of absence of trust, leading to a each on for himself profile, this will lead to a dangerous scenario where each one will try to protect themselves which will raise the process safety risks once each operator will be concerned with their own safety and not with the whole operation.

Finally, the consequence of all quoted characteristics is the inattention to results once each one is only concerned with to protect themselves against failures and mistakes, prejudicing the results and worsening the process safety risks. To overcome these threats, the complete integration of the crude oil refinery operation teams is essential once will allow the adequate information flow and better decision-making processes capable to anticipate actions and procedures capable to put under control the inherent risks associated with the refinery operations.

These recommendations are especially applied to stockpiling operating personnel once they will be affected by each mistake of the refining units processing teams leading to severe risks to the stockpiling assets like receiving gaseous streams in atmospheric tanks, streams with temperature above the design temperature of thank, etc. The stockpiling panel operator and the supervisor should know each stream is sending for each tank and the operation should be continuously monitored through the alarm system and a non-identified stream flow to a storage tank should be immediately communicated to the shift coordinator and deeply investigated.

The stopped tank alarm is very helpful in this sense, the panel operator of stockpiling area should be aware to any changes in the gauge status of the storage tanks which can indicate unprogrammable transfer between tanks or from processing units to the storage tanks. The philosophy of typical storage tanks automation is presented below.

Figure 9 – Typical arrangement for storage tanks receiving and transferring systems.

Table 3 summarizes the storage tanks operation status and the correspondent intrinsic risks and protection layer.

High and low level alarm:

At the end of product movement (receipt or transferring), the level is expected to remain unchanged until the next operation.

The level reference is then changed to the first level value after termination.

2 level difference alarms are created, high and low, taking the previous value as a reference.

High and low level alarm:

When starting a receiving or shipping operation, the operator defines the volume to be pumped.

Based on the diameter of the tank, it is calculated how much the level will change.

The high level (for receiving) or low level (for transferring) alarm is then changed automatically.

Dynamic high or low level alarm:

During receiving or transferring operations, as the level rises or falls, the low level (for receiving) or high level (for transferring) alarm is dynamically modified every defined time interval in seconds, equal to the last read value of the level, in order to that, if any abnormality occurs in the operation, the alarm is triggered immediately.

This is very important to detect leaks and dangerous transfer for the storage tanks which can lead to sever process safety incidents or accidents as described by the following examples.

During an operational instability occurred in the crude oil distillation unit of a crude oil refinery, the debutanizer column which is responsible to separate the LPG from the straight run naphtha, as presented in Figure 10, loss performance and the high vapor pressure naphtha (naphtha with high LPG concentration) was kept aligned to the naphtha hydrotreating unit storage tank.

Figure 10 – Process arrangement for straight run naphtha system of a crude oil refinery.

The stockpiling operation team personnel was not communicated, and the mixture of naphtha and LPG was kept aligned to the Tank A (naphtha hydrotreating feed tank). After approximately 30 minutes, the feed pump of the naphtha hydrotreating unit suffers cavitation leading to the emergency shutdown of the processing unit.

At a first moment, this incident can be faced as a simply emergency shutdown of a processing unit but it’s necessary to understand that nothing is simple in a crude oil refinery, fortunately the pump stopped under cavitation and the only consequence was the shutdown of the processing unit. The pump seal could have failed and led to contention loss of LPG and naphtha with great potential of fire, furthermore the start-up of a hydrotreating unit is not a simple task and exposes the operators to risks, it’s important to understand that the most severe risks scenarios in a crude oil refinery is during the transient moments like shutting down and startup of processing units and other operational systems.

??????????? Another example of integration failure between processing units and stockpiling operation teams occurred in a crude oil refinery during the start-up of the fluid catalytic cracking unit (FCCU).

??????????? During the operational routine by the stockpiling field operator was identified the crude oil projection over the floating roof, the tank was receiving improperly the high vapor pressure naphtha from the FCC unit which are under starting up procedure. The crude oil storage tank doesn’t have sufficient hydrocarbon level to absorb the LPG leading to the crude oil projection over the roof through the roof seal.

??????????? During the root cause analysis was discovered that the FCC operation team was facing difficulties to heat the bottom of the debutanizer column of the processing unit leading to the production of high vapor pressure cracked naphtha (cracked naphtha with high LPG concentration), again this was not informed to the stockpiling operation team and the stream was kept to a crude oil storage tank with low hydrocarbon level. The contention loss of the crude oil could lead to fire and to one of the most severe emergency scenarios of a crude oil refinery which is fire in crude oil storage tanks, another consequence could be the loss of the crude oil storage tank due to the roof sink once the buoyance density limit should be reached.

??????????? These examples revel the severity of the integration between the operating teams in a crude oil refinery to the process safety requirements of the stockpiling area. Any changes in the process should be communicated to the stockpiling team aiming to allow operating procedures to mitigate the risks and minimize the impact of the instability leading to safer operations.

??????????? The adequate integration between the operation teams of a crude oil refinery depends of the construction of a safe and just culture environment where the team can develop confidence in the management team and between each team member, as presented above this can be reached through an adequate integration management policy which must be encouraged and led by the stockpiling manager once they have (or should) the adequate view of all processing units and the complete understanding that any change in the processing units will impact the stockpiling assets under your management. As previously mentioned, the most part of the stockpiling and hydrocarbon transfer operations involves simultaneous operation between at least two different operation areas and should be conducted a Simultaneous Operation Studies (SIMOPS) for each operation characterized as critical by the stockpiling operation team, mainly those associated with the start-up and shutdown of processing units which will lead to transient flow to storage tanks.

Bibliography

American Petroleum Institute, API Standard 2350, Overfill Protection for Storage Tanks in Petroleum Facilities, API Standard 2350, Draft 5th Ed., April. 2021.

American Petroleum Institute, API Standard 537, Flare Details for General Refinery and Petrochemical Service, API Standard 537, Draft 3rd Ed., Sept. 2001.

American Petroleum Institute, Guide for Pressure-relieving and Depressing Systems, API Recommended Practice 521, 6th Ed., January 2014.

BAYBUTT, P. Simultaneous Operation (SIMOP) Review: An Important Hazard Analysis Tool. Process Safety Progress, Volume 36 - Issue 1, Wiley, 2017.

Center for Chemical Process Safety (CCPS), Guidelines for Risk Based Process Safety.1st ed. Wiley, 2007.

? ????????? CHANG, J. I.; LIN, C.C. A Study of Storage Tanks Accidents, Journal of Loss Prevention in the Process Industries, Elsevier, 2006.

DEKKER, S. Just Culture – Restoring Trust and Accountability in your Organization. 3rd ed. CRC Press, 2017.

DEKKER, S. The Field Guide to Understanding “Human Error”. 3rd ed. CRC Press, 2014.

Energy Transitions Comission (ETC) – Making the Hydrogen Economy Possible: Accelerating Clean Hydrogen in an Electrified Economy, 2021

????????? John Zink Co., The John Zink Hamworthy Combustion Handbook, Vol.3, Applications, Chapter 11: Flares, CRC Press LLC, 2001.

LENCIONI, P. The Five Disfunctions of a Team. 1st ed. Wiley, 2005.

REASON, J. Human Error. 1st ed. Cambridge University Press, 1990.

REASON, J. Managing the Risks of Organizational Accidents. 1st ed. Routledge Press, 1997.

Dr. Marcio Wagner da Silva is Process Engineering and Optimization Manager at a Crude Oil Refinery based in S?o José dos Campos, Brazil. He earned a bachelor’s in chemical engineering from the University of Maringa (UEM), Brazil and a PhD. in Chemical Engineering from the University of Campinas (UNICAMP), Brazil. He has extensive experience in research, design and construction in the oil and gas industry, including developing and coordinating projects for operational improvements and debottlenecking to bottom barrel units, moreover Dr. Marcio Wagner earned an MBA in Project Management from the Federal University of Rio de Janeiro (UFRJ), and in Digital Transformation at Pontifical Catholic University of Rio Grande do Sul (PUC/RS), and is certified in Business from Getulio Vargas Foundation (FGV).