Podcast: Corroded Pipe Elbow Sparks Explosion, Launches 38,000-lb Shrapnel

Welcome to Process Safety with Trish and Traci, the podcast that aims to share insights from past incidents to help avoid future events. Please subscribe to this free podcast on your favorite platform so you can continue learning with Trish and me in this series. I'm Traci Purdum, editor-in-chief of Chemical Processing, and as always, I'm joined by Trish Kerin, the director of the IChemE Safety Centre. Guess what, Trish?

Trish: What?

Traci: We've reached a milestone. This is our 75th episode, so kudos to us for taking process safety on a journey. Hopefully, here's to another 75 episodes.

Trish: Wow, 75. That is huge. I did not know we'd done that many. That's cool.

Traci: Yeah, I thought I was, too. I was prepping for today's podcast, and I said, "Wow, we're getting close to a good marker." And I counted them, and we're up to 75, so good for us.

Trish: Wow. Bring on the 100.

Traci: Exactly. Hey, I saw you recently participated in the IChemE International Women in Engineering Day. Can you tell us a little bit about that before we jump into our topic?

Trish: Yeah. It's a great opportunity to get together. So we hosted a high tea, which is a very civilized thing to do, where we sat around and ate canapes and petit fours for the afternoon, which was lovely. But it was really about bringing a whole lot of people together, not only women but also men, to talk about how we can continue to advance women in engineering around the world. The fact is 50% of the population are women. We need to have a part in designing the environment around us. Because we have lived experience in what works for women, men have lived experience in what works for men, and sometimes, when we design for the other without consideration, we get it wrong. It was really important to engage women, encourage them, and support them, and it was a fantastic networking event.

Traci: That sounds wonderful. Well, in today's episode, as I say at the beginning of this, we look back at past incidents to help avoid future events. And today, we will be looking back on the fifth anniversary of the Philadelphia Energy Solutions Refinery fire and explosions. Those occurred very early on June 21st, 2019. We did a podcast episode a few months after the incident, but more has been learned since then. So, can you give us just a little overview of what happened that day?

Trish: First of all, to set the scene, this was a refinery that had been around for a very, very long period of time, quite an old refinery. And it had an alkylation unit. Alkylation units are used to make alkylate, and that is used in things like gasoline and also in av gas, aviation gasoline as well. So it's a very high octane fuel component made in a refinery.

The refinery in Philadelphia used the hydrofluoric acid method to make alkylate. Hydrofluoric acid is a particularly hazardous substance to be using on release; it will vaporize, and so that means that you can have a vapor cloud that can be breathed in by people, and that will cause severe lung damage and potentially death. The other issue with it, called HF or hydrofluoric acid, is that if it gets on your skin, it decalcifies your body. It can cause severe chemical burns, and it damages your bones. It's a particularly hazardous substance that we do deal with. And so this was an HF alkylation unit, which made the release on the unit slightly more concerning.

Now, what had occurred was a corroded pipe elbow had given way, so it had corroded beyond its minimum wall thickness, and it had cracked open and released a substantial volume of mostly propane at that time because that propane is one of the feedstocks into an alkylation unit. But the propane did have trace amounts of hydrofluoric acid in it as well. That caused a large vapor cloud of propane and hydrofluoric acid, which then found an ignition source, and there was a fire and subsequent explosion. Some of the most interesting things is that there was actually a jet fire coming out of the corroded pipe that was impinging on one of the tanks in the alkylation unit; it caused basically a boiling liquid expanding vapor explosion, or a BLEVE of that particular vessel. When that vessel then catastrophically failed, it projected three massive pieces of shrapnel away from that vessel. One of them weighed 38,000 pounds, and it was projected on the other side of the Schuylkill River. There were two other significantly large fragments that landed within the refinery space.

This is a massive piece of metal flying through the air over a river to the other side when that explosion happened. It was a really interesting event in terms of how it played out. There's something to be said for the operators on the day did an excellent job in doing what they were meant to do, following their procedures in an emergency situation. Because they had a way to de-inventory the remainder of the hydrofluoric acid out of the unit to try and protect it so it didn't end up catastrophically released into the environment and potentially harming people. And so they were able to de-inventory the hydrofluoric acid into its recovery drum so that it didn't get released. There was thought about 5,000 pounds of HF were released into the atmosphere that day. No one was seriously injured as a result, and there were no fatalities, fortunately.

Traci: It amazes me that there were no fatalities, nobody really got hurt. And can you imagine witnessing those projectiles, especially the one that came out of the facility across the river? Can you imagine witnessing that and wondering if you're going crazy?

Trish: Yeah. It would've been literally a flaming piece of enormous metal flying through the sky at low altitude. So it's not like you're looking up into the sky thinking, "It's a plane up there." It would've been at low altitude as well as it flew across the river. I can't imagine what that would've been like, to be honest. It would've been terrifying to witness that.

Mechanical Integrity Issues

Traci: Yeah, definitely terrifying. The U.S. Chemical Safety Board found five issues. They've done their studies on this, and they found five main issues, and what I wanted to do today was examine each of these issues and extract the lessons learned in how facilities can avoid similar incidents. So, I'm going to toss out these five issues to you and let you do your magic on that. The first one that they found was mechanical integrity. Can you talk a little bit about that?

Trish: Yeah, so that's all around how the corrosion occurred on that pipe elbow. This is a very complex form of corrosion that can occur. The challenge in understanding this is certain types of carbon steel work really well with hydrofluoric acid, because it builds up a layer on the steel that protects it from corrosion. So, you think, "Okay, carbon steel is good for hydrofluoric acid." But if that carbon steel contains high levels of impurities of things such as copper or zinc, I think it was zinc, then the issue you've got is that coating doesn't build up, and you can get a somewhat accelerated corrosion occurring in that carbon steel.

And at that particular elbow, that point was an older piece of pipework in the refinery that was not being adequately monitored for its corrosion because if it had have been, they would've seen it was spinning faster than they anticipated. It was found that it did have a higher level of copper in it, a high level of those impurities. So basically, not monitoring the most significant parts of a plant where corrosion is likely to occur means that we don't see it happening ahead of time, so we can intervene and replace sections when needed.

And this is a classic. We often do a lot of thickness measuring on pipes, but are we doing it in the right spot? I was walking through a facility recently, and there was a whole lot of thickness measuring on the pipe, and it all looked great. Then, there was an elbow, and the elbow was insulated. It had cladding on it. My question was, "When was that tested for thickness? That elbow at that point, because of the product flow and because of the nature of your substance, is where your thinning is. It's not in the straight wall pipe that you've been doing all the testing on, but you haven't taken the cladding off. So I can only assume you haven't tested that piece of pipe." We've got to make sure we have robust processes to test in the most likely areas of corrosion to make sure that we're checking those so that we can take preventative action to replace pipe work as needed.

Traci: Forgive my ignorance, but how do they test for thickness and make sure that corrosion is not happening at a rapid pace?

Trish: One of the most common ways is ultrasound. So, just like you go to the doctor to have an ultrasound on something, they ultrasound the pipe, and they measure the wall thickness of the pipe externally. So, it's completely what we call non-destructive testing so there's no damage done to the pipe at all. They just basically use a little ultrasound device that measures the wall thickness at various points. In a larger pipeline that, say, is running miles through a field or something, they can typically also do something that we call intelligent pigging. So that's where they can put a device down the inside of the pipe, and that device moves along with the flow of the fluid in the pipe, and it basically does continual either ultrasound or X-ray as it goes all the way through the pipe, so you can get full circumference, full-length measurement of wall thickness using intelligent pigging. Not every pipeline can be pigged. It's not practical for everything. So, in other instances, we use spot ultrasonic testing.

Traci: Thanks for clearing that up for me.

Trish: No worries.

Verifying Safety of Equipment After Changes to Good Practice Guidelines

Traci: The second thing that the CSB found was verifying safety of equipment after changes to good practice guidelines. Let's talk a little bit about that.

Trish: Yeah. So this is where we get into that concept of grandfathering something. So we built a plant 50 years ago, and at the time, we built it to all the standards that existed. But as our knowledge has improved, as the plant has changed, as things have evolved, as we've learned new mechanisms of failure, standards change, and they have improved, and also our risk tolerance has changed. So, the things that we accept now are less than what we would've accepted perhaps 50 years ago. And so what they're talking about here was the plant was built to its standards, but the standards changed. And the standards called for different sorts of piping and different sorts of materials. The plant was not updated because was relied on, "Well, it was okay when it was built."

And so that's one of the challenges we have with grandfathering. It assumes that we don't need to worry about it because it was okay when it was built. So we just let it be rather than upgrade to our current standards. Upgrading to our current standards can be expensive at times, but there are reasons why we do it. If you think about it in terms of driving a car, you might have a 1970s wreck of a car that you drive along, that it doesn't have seat belts, and it doesn't have airbags, and it doesn't have ABS in it, and there's all these things that it doesn't have, it doesn't have crumple zones to protect you, versus a new car that has all of those protective systems to protect you in the event of a crash. If we just go out and drive that wreck of a car 70 miles an hour down the highway and we're in a crash, there's not a great survival chance of what's going on there.

We've improved the standards. So, it's actually around, "Well, should we be driving a safer car where we can, should we be upgrading maybe not all the way to the top-of-the-line safety that exists today, but at least seat belts, airbags, perhaps, these sorts of things, so that we start to actually put in place some of the safety requirements?" So we really need to think about not just saying, "Well, it was okay when we built it." We need to seriously understand what the implications are of why the standard changed and what risk that exposes us to now that we know about that we didn't know about then. Just because we didn't know about it at the time doesn't mean it's not a risk. We need to make sure we continue to move along and upgrade our systems and our equipment so that it does remain as safe as practical for us.

Traci: That's an excellent visualization that you gave. And yes, there are cars out there from the '70s that we can still drive on the road, but the world has forced us into these new standards. So how can facilities stay up on those new standards? Is it something that they're constantly looking for? Is someone assigned that job to make sure that they're up to standards?

Trish: So, you should have in your facilities or in your organization more broadly, at least, if you don't have them on staff, then they should be available to you as consultants, subject matter experts on key critical safety factors. So for example, if it is mechanical integrity, then you should have a mechanical engineer somewhere that is looking at what the latest mechanical engineering standards are to make sure that it matches what's going on in your facility.

So, in the U.S., obviously, you've got the OSHA PSM and the EPA RMP standards and legislation. In say, Europe, UK, Australia, New Zealand, Singapore, the laws are structured differently. We actually, in those countries, the legislation actually says, "You have to provide a safe place of work so far as is reasonably practicable." And that means that you need to be constantly aware of the changing standards and justify why you're not going to upgrade to them because reasonably practicable, this concept changes over time because part of it is around what's known about the hazard, what the consequence would be, what's the likelihood of it, and then what's known about ways to treat or prevent that hazard?

When you look at it in that way, you're constantly having to look at, "Do I need to make an improvement to my system? Because the means of control has improved. We know there are better ways to do this." We cannot grandfather in a lot of those countries I mentioned, it just would not meet the reasonably practicable standard to grandfather and accept it was built that way when it was built. We just have to accept it.

So, there's different legislative frameworks that drive different actions there, but you need your subject matter experts who are staying on top of what the standards are and making sure that you do, at least if you're not going to upgrade, understand what the difference is, because that may highlight for you that not upgrading is not a good idea. You do need to do it from a risk perspective because if you have an incident, it causes an enormous impact and has the potential to kill a lot of people. It damages a lot of equipment, it puts you out of business at least for a period of time, and it's very expensive to fix, and it can destroy your business. So there can be good economic reasons obviously to get this right, too.

Remotely Operated Emergency Isolation Valves

Traci: Good points there. Number three on the list of five was remotely operated emergency isolation valves.

Trish: They weren't able to remotely operate some of their isolation valves, and that meant that it actually took almost 20 minutes for them to put the jet fire out. Now, that jet fire was what caused the shrapnel to fly over the river. What happened was because they couldn't isolate sections of the plant remotely, they couldn't get to them in the incident because of the fire that was occurring, so they couldn't mitigate what was going on. And so the idea of having valves that can remotely shut down in the event of a fire to isolate sections so you don't physically have to put a person in there to isolate something is critically important. And sometimes, it's around making the system fire-safe or explosion safe, so it will continue to function. And there are different sorts of fire valves that when they're exposed to heat, they actually automatically shut. So they release things they automatically shut.

It can also be done pneumatically as well. Often, you'll see in some plants small plastic tubes, which provide instrument air to valves, and if in a fire because it's a plastic tube, the tube melts, the air stops flowing, and when the air is not received by the valve, it shuts. So there's a whole range of different ways to do it, such as trying to ensure that you have emergency shutdown valves that will operate remotely. In this instance, they did not have the ability during the incident to emerge and to isolate the inventories.

Safeguard Reliability in Hydrofluoric Alkylation Units

Traci: Number four, safeguard reliability in HF alkylation units.

Trish: This one was around, they had a control that if a vapor release of HF occurred, they would use a water curtain or a water spray to knock it down out of the atmosphere, so it didn't go and harm people. Now again, this was one of those issues with remote actuation of valves. So these weren't isolation valves, but these were firefighting monitors, basically. During the incident, they lost power to the site, they lost electricity in an explosion. That's not unusual. They lost backup. Their UPS power didn't work either. So, then they had no means to activate remotely the water monitors to knock down the vapor cloud.

And so they did have that vapor cloud that did occur. As I said, fortunately, no one was seriously injured, but it took time to get the monitors up and running. In fact, to get the monitors up and running, they had to put an operator in a full fire suit with breathing apparatus because of hydrofluoric acid in the area, plus chemical resistance in the suits as well, so none of it got on his skin, to go into the area where this fire was occurring to be able to activate those monitors. And that took time to do.

So, make sure that when you have mitigation controls, and they're critical to the safety of your plant, they are survivable in an incident. So, it's like if you had an explosion and it took out all your fire pumps, what will you use to put out your fire? Your fire pumps were not survivable. You need to make sure that you're designing your emergency response controls to survive the incident so they can then kick in and start to mitigate what's going on.

Traci: With the emergency response controls, is there training for the plan B? So this failed and they sent someone in who was all suited up. Do they train for that or was this just like, "We got to do it." And it was ad hoc, and they put this person in a suit, and sent them in?

Trish: Look, I'm not sure about the detail of that particular site, but good emergency planning would have you doing some scenarios. But at what point do you stop? You know?

Traci: Right.

Trish: How long is a piece of string in terms of deciding how many failures we will say we've had in this emergency response exercise to train you in all sorts of different things? So I think what the key part of it is more around is being trained in a range of different response techniques and having really good knowledge of your plant and what's going on in it. Because in any emergency, you're going to get a curveball thrown at you. It just happens. You've got to be able to respond to it. And that's why we do practice emergency response. And we practice it in a whole lot of exercise ways where we focus on making sure we get our responses right and they're all as per our plans.

But a good emergency response exercise will also throw a curveball at you because they do happen in real life. All of a sudden, the wind might change direction. It happens. We can't control what the wind does. You'll even have different scenarios that take into account different wind directions depending on what your incident is. So we need to make sure that those sorts of things are thought about in emergency planning and exercises.

Inherently Safer Design

Traci: The final point that CSB made, and it's a recurring theme through nearly everything we've talk about, inherently safer design.

Trish: Yes. Yeah. As I mentioned earlier, this was a hydrofluoric alkylation unit. And hydrofluoric acid has a number of particularly hazardous components that have significant impact on human health if a human is exposed to it. One of the concepts of inherently safer design is can you substitute the hazard? So can we not use hydrofluoric acid? Can we use something else? Well, yes, there is another sort of alkylation unit that instead of using HF as a catalyst, uses sulfuric acid as a catalyst. Now, sulfuric acid is still highly corrosive, but it doesn't vaporize when it leaks, so you can't breathe it in. If it does get on you, yes, there will be a chemical burn, but it's not going to extract the calcium out of your body. There are some inherently safer design advantages to sulfuric acid. It still has its own issues, but they're different and perhaps arguably not as risky.

There are also even some new catalyst technology developments in alkylation that have been taking place that are even potentially more inherently safer than sulfuric acid. There are some solid catalysts that some organizations have been working on. So there's a lot of different developments in that space, and it comes back to the old saying by Trevor Kletz, "What you don't have can't leak." If you don't have hydrofluoric acid, you can't have a hydrofluoric acid leak. So, thinking about what substances you have, do you need them? Or can you substitute them for something less hazardous? If you do need them, do you need as much of them? Or can you have a smaller inventory?

Now, as I said earlier, the operators followed their procedures very well in this instance and de-inventoried the alkylation unit to a safe storage vessel that was not damaged, fortunately, in the incident. So effectively, they took the HF out of the alkylation unit. So they did kind of go by the, "What you don't have can't leak." If it's not in the alkylation unit, as it's got losses of containment through it, then you're not going to release it at that point. But we were fortunate they were so well-trained in that particular activity. They did an excellent job. It was what they were meant to do, and they did an excellent job doing it. Really challenge the thinking of your facilities and your processes. Do you need that chemical? Or can you do something different? Can you use something different for I?

Traci: Going out of the scope of this particular incident, but just based on what you were just saying, why is HF still out there when there are other alternatives?

Trish: It's a very effective alkylation catalyst. So it's a very effective and economic way to make alkylate. The facility can't just take HF out of the alky, alkylation unit. Sorry, my whole refinery days kicking, thinking about the alky unit. You can't just take HF out of the alkylation unit and replace it with sulfuric acid. It's not that simple. There are engineering changes that need to be made, the unit changes to do that. It's not just changing out a chemical. It is changing out some hardware as well, which makes it potentially an expensive change. Sulfuric acid, from my recollection, is not as economic a reaction, so it will cost a little bit more to make the alkylate than a HF alkylate will, in terms of using catalyst. There are basically economic reasons why HF units still exist.

Traci: Trish, is there anything you'd like to add on this topic?

Trish: Just that I think this is an interesting one from the perspective of such a wide range of things occurred, which is not unusual in an incident. As I said, you get thrown a curveball all the time in an incident, and I think it is just really useful for us to take a moment to reflect on it, think about our own facilities, and think about how we can make them that little bit safer. Are we grandfathering something we shouldn't be? If we really thought about it, should we just go with the, "Oh, it was okay when it was built argument?" Or should we be justifying why we need to do something different? Should we be considering inherently safer design? Can we substitute or eliminate the hazards that we have? And that's what I'd like to leave everyone with, to go away and think about those key questions on their facility for some of their key risks.

Traci: Well, Trish, always helping us with our curveball training. You're a great coach. Unfortunate events happen all over the world, and we will be here to discuss and learn from them. Subscribe to this free podcast so you can stay on top of best practices. You can also visit us at chemicalprocessing.com for more tools and resources aimed at helping you run efficient and safe facilities. On behalf of Trish, I'm Traci, and this is Process Safety with Trish and Traci.

Trish: Stay safe.