In August 2017, a major fire occurred at a refinery in the Netherlands when a furnace tube ruptured. The furnace overheated when the process flow through it stopped, but the burners kept firing. With no flow, the tubes overheated and failed (Figure 1). Over 100 m.t. (110 tons) of flammable liquid was released and burned in the furnace. The furnace had to be replaced, which shut the unit down for about a year. Fortunately, no one was hurt.
鈻�Figure 1. In 2017, operators at a refinery used field bypass switches to stop process flow through a furnace (left) as part of their operating procedure, leading to the furnace overheating and rupturing a furnace tube (right) (1). The operators felt that the integrated low-flow interlock bypass with a five-minute shutoff timer did not allow them enough time to complete their work, which led them to routinely use the manual field bypass switches, skirting the company鈥檚 bypass management procedure and opening up the process to human error and uncontrolled overheating. Source: Adapted from (1).
Several things went wrong. One of the errors that led to this incident was the availability and use of interlock bypass switches as part of operating procedures without following the bypass management procedure.
The company had recognized the hazard associated with the low-flow interlock bypass several years before and had programmed timers in their safety systems to remove the bypasses after being at low flow for five minutes. However, the company didn鈥檛 remove the field bypass switches. Operators felt that five minutes was too short, so they continued to use the field-mounted bypass switches without using the company鈥檚 bypass management procedure. The system was in manual bypass when the incident occurred.
After the accident, the refinery technical staff studied the timers and concluded that five minutes was, in fact, sufficient. They also changed all their non-timed bypass switches to require supervisor keys.
Did You Know?
- Bypass switches on safety interlocks are occasionally needed. In this case, a low-flow interlock stopped the burner gas. If an interlock bypass is needed for start-up, an interlock timer can ensure that the interlock isn鈥檛 left in bypass longer than needed.
- Another key interlock on gas-fired equipment is the pre-ignition purge timer. Bypassing this timer has caused many firebox explosions and fatalities.
- Many companies use a bypass permit or a temporary management of change (MOC) process to manage bypassing controls. These systems require a hazard review and approval by an authorized person.
- Many events have been caused by improper use of interlock bypasses and were featured in past Beacons, including June 2003, June 2013, and February 2019.
What Can You Do?
Systems in bypass should be noted in the unit logbook and discussed during shift handover.
When participating in hazard reviews:
- Point out where interlock bypasses are used to get the unit started or for any other purposes.
- In particular, discuss interlocks that can be manually bypassed.
- If bypass timers are used, ask, 鈥淎re the time limits reasonable?鈥� They should be long enough to get the process started without being so long that an incident could happen.
A safety device can鈥檛 protect you if it is bypassed!
- The Dutch Safety Board, 鈥淔ire at Esso,鈥� The Hague, The Netherlands (Aug. 21, 2017).
漏AIChE 2025. All rights reserved. Reproduction for non-commercial, educational purposes is encouraged. However, reproduction for any commercial purpose without express written consent of AIChE is strictly prohibited. Contact us at ccps_beacon@aiche.org or 646-495-1371.
Copyright Permissions
Would you like to reuse content from CEP Magazine? It鈥檚 easy to request permission to reuse content. Simply to connect instantly to licensing services, where you can choose from a list of options regarding how you would like to reuse the desired content and complete the transaction.