Process Safety · Lesson 52 · 9 min read

Keep Air and Hydrocarbons Separated During Transient Operations

Shutdown, maintenance and startup change the process faster than normal-operation assumptions can follow. Equipment may contain air after opening, hydrocarbons after draining, or an uncertain mixture while valves, blinds and purge systems are being repositioned. If air and fuel meet inside connected equipment, one ignition source can turn a routine transition into an internal explosion.

The hazard mechanism: the atmosphere is changing

A hydrocarbon system can be safe from combustion while oxygen is excluded, but opening it for maintenance admits air. Purging may then move the atmosphere through a flammable range. The same risk returns when hydrocarbons are introduced into equipment that still contains air. A closed valve is not automatically a gas-tight boundary, and stagnant branches or connected vessels may retain a different atmosphere from the main line.

HSE describes inerting as replacing air or a flammable atmosphere with inert gas. It also treats reliability of the inert-gas supply, backup arrangements, inspection, maintenance and monitoring of oxygen and flammable vapour as important parts of the protection. Inerting therefore is a safety function, not simply a timed utility step.

Official investigation: transient safeguards were ineffective

The U.S. Chemical Safety and Hazard Investigation Board investigated the 26 April 2018 explosion and fire at the Husky Superior Refinery in Wisconsin. The refinery was shutting down its fluid catalytic cracking unit for a turnaround. Two vessels exploded, debris punctured a nearby asphalt tank, 36 workers were injured, and the surrounding community faced evacuation and shelter-in-place actions.

The CSB found that air entered hydrocarbon-filled equipment through an eroded catalyst slide valve even though operators had closed it. The shutdown did not establish or maintain an effective reactor steam barrier, and an overhead receiver was not properly purged to remove oxygen. The report emphasised that the slide valves were not positive isolation devices and that the required FCC-specific safeguards were not effective.

Official CSB video, “Transient Hazards: Explosion at the Husky Superior Refinery.” It documents an actual incident; the conceptual training images in this article do not.

Operational analysis: control the whole connected volume

A purge plan must follow the real flow path from the verified source to the designated safe outlet. The team needs to understand every connected vessel, branch, bypass, instrument connection and temporary hose that can admit air, retain hydrocarbons or prevent displacement. Purging a convenient sample point does not prove the atmosphere at a remote high point, dead leg or isolated pocket.

Sequence matters. Opening a hydrocarbon valve before the approved atmosphere has been confirmed can introduce fuel into air. Removing purge too early can allow air ingress. Closing the outlet before displacement is complete can pressurise equipment. Temporary connections can create reverse-flow paths, and a weak or contaminated inert-gas supply can defeat the intended barrier.

Hypothetical FPSO example: returning a separator to service

Hypothetical example—not a documented incident: An FPSO production separator has been drained, positively isolated, opened and ventilated for internal inspection. The maintenance team has completed the work, but the vessel and several connected branches contain air.

Before hydrocarbon feed is restored, operations and maintenance jointly confirm closure, internal clearance, blind and valve status, reinstated relief and instrument connections, and the approved vent destination. The team establishes the specified inert-gas flow through the complete volume, samples at procedure-defined representative points, and records the acceptance evidence. A formal hold point prevents feed introduction until the responsible authority confirms that the approved atmosphere and configuration are achieved. The example does not prescribe a universal purge volume, duration, oxygen limit or valve arrangement.

Critical controls

Verified isolation and configuration: prove the boundary that separates air, hydrocarbons, utilities and adjacent equipment. Use the installation's approved isolation standard, and reconcile the field condition with the current drawing and reinstatement record.

Engineered purge route: define the purge source, flow direction, displacement method, safe outlet and how trapped volumes will be addressed. Confirm supply quality, capacity, alarms and backup needed for the operation.

Atmosphere evidence: use suitable, calibrated instruments and representative sampling locations. The acceptance criteria must come from the approved procedure and competent technical assessment; elapsed time or a calculated number of volume changes is not evidence by itself.

Controlled sequence and hold points: identify who may move each boundary, what must be verified before the next step, how communication is maintained, and which deviation requires stopping or returning to a safe state.

Leadership actions

Leaders should treat transient operations as planned major-hazard work. Procedures need to reflect the current plant, credible leakage paths and the actual safeguards available. Operators, maintainers, control-room staff and technical authorities should review the sequence together when the activity is unusual, modified or follows intrusive maintenance.

Supervision must protect time for field verification and independent checks. Schedule pressure must not compress purge duration, skip remote sampling or turn an incomplete reinstatement into an operating problem. Lessons from deviations and difficult purges should feed the process hazard analysis, procedures and training.

Three practical actions

• Walk the boundary: trace one planned return-to-service path from inert-gas source to safe outlet and identify every connected volume, leak path and temporary connection.
• Test the proof: confirm where the atmosphere will be sampled, which instruments will be used, who accepts the result and what prevents premature hydrocarbon introduction.
• Rehearse the deviation: agree the response to loss of purge, unexpected pressure, failed sampling, wrong valve position or a result outside the approved criterion.

Takeaway and team discussion

Key takeaway: during a transition, air–hydrocarbon separation is a verified process condition maintained by isolation, purging, monitoring and disciplined sequence.

Discussion question: where could air remain or re-enter during our next startup or return to service, and what evidence will prove that hydrocarbons cannot meet it?

Continue in the Process Safety hub, and connect this lesson with controlled startup, verified isolation and nitrogen asphyxiation control.

Verified primary references

1. U.S. CSB: Husky Energy Superior Refinery Explosion and Fire investigation.
2. U.S. CSB: FCC Unit Explosion and Asphalt Fire final investigation report.
3. U.S. CSB: official Transient Hazards safety video page.
4. UK HSE: Inerting technical measures guidance.
5. UK HSE: Inspection of Loss of Containment—offshore inspection guide.

Published and sources checked 3 November 2026. Educational discussion only: apply the installation's approved safety case, operating procedures, isolation standard, purge design, gas-testing criteria and return-to-service controls. No universal purge volume, duration, oxygen limit or valve arrangement is supplied.

Discuss this article in the comments →

Register interest in future HSSE email updates