Refinery units where milliseconds matter: A safety playbook for hydrotreaters and reformers

Hydrotreating (hydrogen-based impurity removal) and catalytic reforming (octane-boosting hydrocarbon rearrangement) are among refining’s highest-energy processes. Loss of containment can turn a pinhole into a fireball in seconds. Hydrogen is especially unforgiving: it is colorless and odorless, burns with an almost-invisible flame, and has a wide flammability range (h2tools.org). H₂ flames emit very little radiation, making them hard to detect by sight (h2tools.org).

Process upsets escalate when instrumentation fails. In the BP Texas City investigation, the U.S. Chemical Safety Board reported that key instrumentation and control (including flow meters and sensors) were offline or known to be unreliable, allowing a minor release to grow unchecked (csb.gov). The statistical backdrop is stark: U.S. oil and gas work exposures have a fatality rate ~25.1 per 100,000 (≈7× the all-industry average of 3.7) (cdc.gov).

These are units where defense-in-depth—the practice of layering independent protections so one failure does not cascade—must be more than a slogan (MDPI) (csb.gov).

Loss-of-containment hazards (hydrogen and H₂S)

Hydrogen and hydrogen sulfide (H₂S, a toxic, flammable gas) ride with hydrocarbons in these units at high pressures and temperatures. A release can create an instant combustible cloud or pool fire. Hydrogen’s nearly invisible flame and low radiative heat make visual detection unreliable (h2tools.org). The operating environment demands rapid detection, automated isolation, and robust fire protection to arrest escalation.

Multi-technology leak detection (ultrasonic/catalytic/flame)

No single sensor covers all leak scenarios. For hydrogen and other light gases under high pressure, ultrasonic acoustic detectors are essential; studies note they can alarm within milliseconds on a high‑pressure hydrogen release (AZoM) (AZoM). They “do not require the transport of gas to the sensor”—they listen for the ultrasonic sound of turbulent gas flow (AZoM).

Smaller leaks are best captured by continuous catalytic‑type or infrared point detectors; one review observes that “continuous hydrogen monitors like catalytic detectors…add to the detection of small leaks, for instance due to a slowly deformed [flange]” (AZoM). Fixed hydrogen flame/UV‑IR (ultraviolet/infrared) detectors provide an area layer, since drifting clouds can ignite remotely; these systems “monitor[ ] entire process areas” against invisible fires (AZoM).

Industry guidance echoes the redundancy principle: API notes refineries “install extensive fire protection equipment” including automated gas detectors and alarms covering all hazards (api.org). Reliability depends on care and feeding: sensors should be bump‑tested and calibrated per manufacturer schedules (typically monthly or quarterly) to maintain sensitivity. Automated pressure‑drop monitors and mass‑balance checks can flag leaks before gas detection. The best practice is overlap—point detectors, acoustic sensors, and area monitors—so a single failure or wind shift does not blind the unit (AZoM) (AZoM).

Emergency shutdown interlocks (IEC 61511/SIL)

When a leak or upset hits, emergency shutdown (ESD) must isolate the source fast. ESDs are fail‑safe interlocks with high safety integrity—typically implemented per IEC 61511 (the functional safety standard for the process sector) and SIL (Safety Integrity Level) targets—to achieve a low probability of failure on demand. Key triggers (pressure, level, gas concentration) automatically trip valves and shut utilities within seconds when limits are exceeded.

On a hydrotreater, a shutdown should simultaneously close feed valves, purge hydrogen lines, and dump the reactor to flare. Mechanical backups—spring‑and‑air‑actuated block valves that close on loss of signal, pressure‑relief vents to flare, and clearly located manual emergency trips—add further layers. This is defense‑in‑depth in practice (MDPI). The CSB’s Texas City findings are a cautionary tale: when instrumentation is “known to be…unreliable,” shutdown barriers are effectively disabled (csb.gov).

Testing matters. OSHA’s Process Safety Management rule (OSHA PSM, 29 CFR 1910.119) mandates quarterly or annual testing of shutdown loops. The payoff shows up in outcomes: Shell reported a record low of just 63 Tier 1+2 process safety events in 2023, attributing improvements partly to data‑driven safety planning and reliable safety systems (reports.shell.com).

Fire protection infrastructure (API/NFPA)

Hydrotreater and reformer fires span hydrocarbon pools and hydrogen jets. Refineries typically deploy firewater ring mains with high‑capacity pumps and hydrants, plus foam systems for flammable pools (api.org). Water deluge or spray systems (NFPA 15/13 compliant; NFPA is the National Fire Protection Association) cool critical equipment such as furnaces and reactors. High‑expansion foam monitors (NFPA 11) blanket spill areas and tank vents. Portable extinguishers—dry chemical and CO₂—cover small and electrical hazards. Many sites staff dedicated fire brigades. Redundancy—multiple monitors and sprinklers around each high‑hazard asset—minimizes heat damage and propagation.

Hydrogen demands different tactics. Its flames are hard to see (h2tools.org) and extinguish only by stopping the leak. The priority is detect and isolate: gas detectors plus swift ESD remove the source. Fire‑water spray can knock down pooling hydrogen and cool structures, but foam is largely ineffective on freely venting hydrogen. Guidelines recommend allowing hydrogen leaks to burn off in a controlled fashion after source isolation (h2tools.org). Safety reviews thus stress robust hose‑in‑hose piping, double block‑and‑bleed valves, and frequent leak patrols on H₂ lines. Performance is gauged by drill metrics (pump start times, foam spread rates) and downtime saved; where systems are well maintained, severity is often dramatically reduced, with adjacent units restarted without damage after a localized event thanks to prompt firewater application.

Safety culture and operator training (HSSE)

Hardware alone is not enough. A strong safety culture—values, attitudes, awareness, and training that shape the safety management system—“guides the making and implementation” of that system; poor culture degrades performance across the board (MDPI) (MDPI). Leadership must visibly prioritize safety “always,” not just during audits; when safety is “relegated to a check‑the‑box exercise, companies are more likely to experience stagnant” results (McKinsey) (MDPI).

Continuous training reinforces that culture. Total Energies conducts safety training on day one for all new hires, with courses tailored to each role (McKinsey). Supervisors and managers retrain regularly—at least biennially—to stay sharp (McKinsey). Curricula cover hazard recognition (including H₂S response and confined‑space entry), emergency drills (ESD response, fire scenarios), and first‑aid/escape procedures. Companies with robust training and engagement report double‑ or triple‑digit improvements in safety metrics over time; one operator saw a large drop in near‑miss reports after instituting a “safety moment” at every meeting (McKinsey) (McKinsey).

In Indonesia, refineries are aligning with these practices. Pertamina’s Plaju Refinery emphasizes an “HSSE generative culture,” adopting Golden Rules and continuous improvement even outside national Safety Weeks (pertamina.com). The regulator (SKK Migas/DGOG) requires life‑saving rules and HSE management systems in permits, aligned with international standards. By tracking leading indicators (training attendance, hazard reports) and lagging indicators (incident rates), companies quantify progress—mirroring the process‑safety reporting referenced by Shell (reports.shell.com).

Sources and standards consulted

This guide draws on authoritative industry and academic sources: Shell’s Sustainability Report 2023 (reports.shell.com), Concawe’s European downstream safety performance 2021 summary (veiligheidvoorop.com), CDC data on industry fatality rates (cdc.gov), AZoM on hydrogen detection (AZoM) (AZoM) (AZoM) (AZoM), H2Tools on flame behavior (h2tools.org) (h2tools.org), CSB’s Texas City investigation (csb.gov), API fire protection practices (api.org), and analyses on safety culture and training (MDPI: link 1, link 2; McKinsey: culture, onboarding, refreshers), with international standards (API RP 2001, NFPA codes) underpinning fire protection design. Pertamina’s HSSE example provides a regional reference (pertamina.com).