On a hydroprocessing unit the detection layer is specified for the wrong gas

A high-pressure cold separator ruptured on a coker gas oil hydrotreater at a coastal refinery in southern India on 30 September, killing one worker and leaving another with serious burns. The gas in that circuit is hydrogen-rich, and the two detection technologies most widely installed across process plant — infrared point gas detection, and flame detection that confirms on the signature of a burning hydrocarbon — cannot see hydrogen gas at all and barely see a hydrogen flame. Detection is the protection that matters on these units, and it is routinely specified for the wrong gas.

What happened

The fire began at about 12:20 local time in the delayed coker gas oil hydrotreater, at a high-pressure cold separator, and was extinguished at 14:47 after the unit’s battery limits were isolated and emergency response and firefighting teams were deployed. One contractor died and one employee was taken to intensive care with burns. The operator did not state a cause. The refinery continued to run, with a reported reduction in throughput on one crude unit.

What is not in doubt is the service. A gas oil hydrotreater runs a hydrogen recycle loop at high pressure, and the vessel that failed sits at the cold end of the reactor effluent circuit.

The cold end is where the metal goes

Desulphurisation and denitrification in the reactor produce hydrogen sulphide and ammonia. As the effluent cools on its way to separation, those products deposit as ammonium bisulphide and ammonium chloride salts, and where water is present the bisulphide goes into solution. Aqueous ammonium bisulphide is among the more aggressive corrosion mechanisms in a refinery, and it is velocity-sensitive: it thins metal fastest where flow is highest and most turbulent. The damage concentrates in the reactor effluent air cooler and in the piping and vessels immediately downstream — precisely the cold, high-pressure part of the loop. API maintains a recommended practice for corrosion control in hydroprocessing reactor effluent air cooler systems, API RP 932-B. It exists because this circuit fails often enough to need one.

That asymmetry matters for fire protection. Inspection budget and passive fire protection concentrate on the reactor, the furnace and the hot section, because that is where the temperature is. The cold separator holds the same pressure and the same hydrogen, plus a corrosion mechanism the hot section does not have. When it fails it releases a large inventory of light, high-pressure, hydrogen-rich gas at low elevation.

To a detector, hydrogen is not a hydrocarbon

Infrared point gas detectors work by absorption: the target gas absorbs at a known wavelength and the instrument measures the loss. Hydrogen, a symmetric diatomic molecule, does not absorb infrared. Detector manufacturers state the consequence plainly — infrared gas detectors will not detect hydrogen and are not recommended for it. An infrared detector in hydrogen service is not a degraded detector. It is an indicator lamp.

The usual answer is the catalytic bead, used in hydrogen service for decades and responding at lower explosive limit concentrations within seconds. It carries two liabilities, and both change the maintenance regime rather than the design: it can be poisoned by silicones, common on industrial sites, and it does not announce its own failure. A poisoned bead reads clean air. That puts proof-test interval and poisoning survey inside the safety case rather than maintenance housekeeping.

Flame detection has the same problem in a different band. A hydrogen flame produces no carbon dioxide, emits little visible light, and radiates mainly in the ultraviolet and in the water bands. A detector that confirms fire by looking for the carbon dioxide emission of a burning hydrocarbon has nothing to confirm. Ultraviolet detectors see hydrogen flames quickly, but they also see welding arcs, sparks and lightning, so they are rarely left to act alone on a working plant. Multispectrum infrared has become the usual recommendation, with solar and artificial-light rejection and usable detection distances for a small hydrogen plume.

Placement is the third trap. Hydrogen is the lightest gas there is, so a release rises fast, and a grid laid out for heavier-than-air vapours is in the wrong place by the time the cloud exists. Published minimum ignition energy is on the order of 0.2 mJ, low enough that a release should be assumed to find an ignition source.

Where the specification fails

Three things go wrong, and none of them are detector problems.

The fire and gas philosophy is written once for the whole plant. One document sets detector technology, coverage and voting for every unit on site, and the hydroprocessing unit inherits an infrared scheme written around hydrocarbon vapour.

The detector schedule is priced as a line item. On a bid comparison, “point gas detector” favours infrared: longer life, lower maintenance, self-checking optics, no poisoning. Each of those advantages is real. None apply to a gas the detector cannot see.

Coverage is assessed for the hydrocarbon release. Where a coverage study exists at all, its release cases are usually liquid or heavy vapour. A buoyant, high-momentum hydrogen jet produces a different cloud and a different ignited geometry, and the detectors that would catch it are above it, not around it.

What to check now

On any hydrotreater, hydrocracker, reformer or hydrogen plant package, in design or operation:

For every gas detector in hydrogen-rich service, what is the sensing technology? If any are infrared point detectors, they are not detecting hydrogen, and the coverage claim resting on them is void.
Are the catalytic bead detectors on a proof-test and poisoning-survey regime that reflects their silent failure mode?
What do the flame detectors respond to, and does the voting logic require a carbon dioxide-band confirmation that a hydrogen fire will never provide?
Was the detector layout derived from hydrogen release cases with buoyant dispersion or inherited from the plant-wide grid, and are detectors above the credible leak points?
Does the cause-and-effect matrix isolate the circuit and start depressurisation on gas detection alone, or only on confirmed flame? Where flame confirmation is the weak link, that choice decides the outcome.
Is the cold end of the reactor effluent circuit in the inspection plan at the same priority as the hot section, and is the fire protection scope drawn around it?

The rupture last week was a mechanical failure and its cause is not yet public. The detection question is separate and does not wait for the investigation. On most units it can be answered from the detector schedule in an afternoon, and the answer is often that the first line of protection cannot detect what the unit contains.

Mainstream Petrochemical Instruments FZE provides fire safety engineering for high-hazard industrial facilities. This article is general technical commentary and is not a design recommendation for any specific facility.