0:07 Voiceover: June 21, 2019,
0:10 the Philadelphia Energy Solutions,
0:11 or PES Refinery in Philadelphia, Pennsylvania.
0:16 A dangerously corroded pipe elbow ruptured,
0:19 releasing process fluid into the refinery's
0:21 hydrofluoric acid or HF alkylation unit.
0:26 The process fluid then ignited
0:27 causing a fire and series of explosions.
0:31 The fire and explosions caused the release of
0:33 over 5,000 pounds of highly toxic HF,
0:37 launched a 38,000-pound vessel fragment offsite
0:41 and resulted in an estimated property damage loss
0:45 of 750 million dollars.
0:49 Owens: Thankfully despite the urban location
0:50 of the PES Refinery,
0:52 the local community was not seriously harmed.
0:55 But it could've been worse.
0:56 Our investigation found that a critical safeguard
0:58 intended to protect the local community
1:00 from a release of hydrofluoric acid
1:03 did not function as designed.
1:06 If a large amount of hydrofluoric acid
1:07 had escaped from the refinery,
1:09 the consequences could've been disastrous.
1:12 This incident should be a wakeup call
1:14 to industry and regulators
1:15 to take every step possible
1:17 to prevent a similar event from occurring.
1:29 Voiceover: The Philadelphia Energy Solutions Refinery
1:31 was the largest oil refining complex on the east coast
1:35 and could process up to
1:36 335,000 barrels of crude oil per day.
1:41 Within its hydrofluoric acid alkylation unit,
1:44 the refinery produced alkylate,
1:46 a high octane blending component of gasoline.
1:50 That was done by using hydrofluoric acid as a catalyst.
1:55 HF is a highly toxic chemical
1:57 that is particularly hazardous
1:58 if a release occurs
2:00 because it vaporizes, becoming airborne.
2:04 Breathing HF can cause lung damage, and skin contact
2:07 with HF can cause severe burns and death.
2:12 On the day of the incident,
2:13 the HF alkylation unit was operating normally.
2:17 Shortly before 4:00 a.m. a board operator
2:19 in the refinery's main control room
2:22 performed a routine change
2:24 in the configuration of the process within the unit.
2:28 The operator increased the flow of process fluid
2:30 in an area of the unit
2:32 by a total of seven barrels per hour.
2:35 Stable operation continued with no abnormal pressure
2:38 or temperature changes in the unit
2:40 as a result of these actions.
2:42 But nevertheless at 4:00 a.m.
2:44 a severely corroded pipe elbow within the unit ruptured.
2:49 Flammable process fluid containing mostly propane
2:52 along with a small concentration of HF
2:54 escaped through the failed pipe elbow.
2:58 The leaking process fluid formed
2:59 a large ground-hugging vapor cloud about 10 feet high
3:03 that engulfed a portion of the unit.
3:06 Moments later the vapor cloud ignited,
3:09 causing a massive fire.
3:11 Approximately 30 seconds later,
3:13 the board operator took steps
3:15 to prevent the release of additional HF.
3:18 This was done by rapidly draining the unit's
3:20 339,000 pounds of hydrofluoric acid to a special vessel
3:25 called the Rapid Acid De-inventory or RAD drum.
3:31 The RAD drum was designed to safely
3:33 hold HF in the event of an incident.
3:36 At 4:15 due to the ongoing fire,
3:39 an explosion erupted in the alkylation unit.
3:42 Four minutes later a second explosion.
3:46 At 4:22 a process vessel in the unit
3:48 containing flammable hydrocarbons violently ruptured,
3:53 causing the third largest explosion.
3:58 A giant 38,000-pound fragment of the vessel
4:01 flew across the Schuylkill River
4:03 and landed on the river's opposite bank.
4:07 Two other fragments, one weighing about
4:09 23,000 pounds and the other about 15,500 pounds,
4:14 landed inside the refinery.
4:18 The fire knocked out the control system communication
4:21 to the refinery's HF water mitigation system,
4:24 and the backup power supply to the system also failed.
4:28 As a result,
4:29 the refinery's elevated HF mitigation water cannons
4:32 which were designed to spray high volumes of water
4:35 to help contain an HF release
4:37 could not be turned on remotely from the control room.
4:41 The water mitigation system is a critical safeguard
4:44 at the refinery designed to prevent
4:46 released HF from going offsite.
4:49 About 40 minutes after the release began,
4:52 the refinery shift supervisor wearing bunker gear
4:55 entered the unit and manually turned on a pump
4:58 that allowed the HF mitigation water cannons to operate.
5:02 Other refinery workers closed valves
5:04 to stop the flow of hydrocarbons and steam into the unit.
5:09 The fire burned for over 24 hours
5:11 until it was finally extinguished
5:13 the following day at about 8:30 a.m.
5:18 Five workers sustained minor injuries
5:20 during the incident and response.
5:23 The CSB is unaware of anyone offsite experiencing
5:26 health impacts from the hydrofluoric acid release.
5:31 The CSB launched an investigation into the fire
5:34 and explosions
5:36 and found five key safety issues
5:38 contributed to the severity of the incident.
5:42 They are: mechanical integrity;
5:45 verifying safety of equipment
5:47 after changes to good practice guidance;
5:49 remotely operated emergency isolation valves;
5:52 safeguard reliability in HF alkylation units;
5:56 and inherently safer design.
6:00 The first safety issue is mechanical integrity.
6:03 The CSB determined that the pipe elbow
6:05 that failed had corroded faster than
6:07 other piping in the HF alkylation unit.
6:11 That is because the steel pipe elbow
6:13 contained a higher content of nickel and copper
6:16 than other piping in the unit.
6:18 Carbon steel is commonly used in HF alkylation units
6:22 but is known to be susceptible
6:23 to hydrofluoric acid corrosion.
6:26 In refinery processes using some amount of HF,
6:29 hydrogen fluoride reacts with iron
6:32 in steel piping to produce iron fluoride.
6:35 The iron fluoride then forms a film
6:38 that coats the inside surface of the piping
6:41 and protects the steel from corrosion.
6:44 However if the steel contains
6:45 high concentrations of copper,
6:47 nickel or chromium known as residual elements,
6:51 the rate of corrosion is often higher.
6:54 This is because the iron fluoride film
6:56 that forms on steel containing high amounts
6:59 of residual elements is less protective.
7:02 The pipe elbow that ruptured in the PES Refinery
7:05 was installed around 1973.
7:09 It had originally been constructed
7:10 of a particular steel alloy
7:12 that intentionally contained
7:14 a higher concentration of nickel and copper.
7:17 But by current industry practices,
7:19 the high concentrations of nickel and copper
7:22 in the pipe elbow
7:23 meant it was not fit for service
7:25 in a process using hydrofluoric acid.
7:28 Yet the pipe elbow remained in service for over 40 years,
7:32 corroding at a much faster rate
7:33 than adjacent piping components that did not have
7:36 high concentrations of residual elements.
7:40 The CSB also found that PES
7:42 and the previous owner of the refinery
7:44 never inspected all carbon steel piping
7:47 circuit components susceptible to HF corrosion.
7:51 Such a program was not required in the standard
7:53 set by the American Petroleum Institute or API
7:57 for the safe operation
7:58 of hydrofluoric acid alkylation units.
8:02 But had PES or the former owner inspected
8:04 all of the carbon steel piping circuit components
8:07 susceptible to HF corrosion in the unit,
8:10 they may have identified that the pipe elbow
8:12 was corroding at a faster rate
8:14 than adjacent piping components,
8:17 which could have prevented the incident.
8:20 After the incident, API revised its standard
8:22 to include a new requirement for companies
8:25 to develop a special emphasis inspection program
8:28 to identify areas of accelerated corrosion
8:31 in their refineries.
8:33 Grim: The new API special emphasis program
8:35 requires companies to inspect all individual
8:38 carbon steel piping components in HF corrosion zones.
8:42 This will prompt refineries to find
8:44 any components that are corroding at a faster rate.
8:47 This is an important safety requirement developed by API,
8:51 and it should help prevent future catastrophic failures
8:54 from this known safety hazard.
8:58 Voiceover: The second safety issue identified by the CSB
9:00 involves verifying the safety of equipment
9:02 after changes to good practice guidance.
9:07 When the pipe elbow was initially installed in 1973,
9:10 the standard set by ASTM International for carbon steel piping
9:15 did not specify limits on nickel or copper content.
9:19 Over the next decades, that standard changed,
9:21 and by 1995 the ASTM standard
9:24 had been revised enough that the pipe elbow
9:27 no longer met its requirements
9:29 due to the elbow's high levels of nickel and copper.
9:33 Yet neither PES nor the previous refinery owner
9:35 performed a comprehensive evaluation
9:37 of all installed HF alkylation unit piping components
9:42 manufactured to older versions of ASTM standards
9:47 to ensure that the piping components
9:49 were still safe to use.
9:51 Grim: To prevent catastrophic incidents,
9:53 companies and industry trade groups
9:55 must take swift action to ensure process safety
9:58 when new knowledge on hazards is published.
10:01 These actions must include ensuring
10:03 that facilities built before the new knowledge
10:06 was published are still safe to operate.
10:09 Ensuring safety can include
10:11 100% inspection of all equipment and piping,
10:14 equipment replacement and other changes
10:17 needed to prevent loss of containment events.
10:21 Voiceover: A third safety issue discovered by the CSB
10:24 concerns remotely operated emergency isolation valves.
10:28 The largest of the three explosions at PES
10:31 occurred when a vessel located above
10:33 the failed pipe elbow violently ruptured.
10:37 The CSB concluded that a jet flame shot
10:40 from the ruptured pipe elbow
10:42 and heated the bottom of the steel vessel
10:44 which contained a large amount of flammable hydrocarbons.
10:48 For over 20 minutes, the jet flame erupted
10:50 from the failed pipe elbow,
10:53 wakening the steel bottom of the vessel
10:54 and causing it to stretch and thin.
10:57 The vessel then ruptured,
10:59 launching three huge fragments into the air.
11:03 The CSB found that there were no emergency
11:04 isolation valves installed in the HF alkylation unit
11:08 to remotely isolate nearby hydrocarbon sources
11:11 that could then flow through the failed elbow.
11:15 And these valves are not explicitly required
11:17 by the current API standard
11:19 on safe operation of hydrofluoric acid alkylation units.
11:24 Grim: Prolonged releases and fires in HF alkylation units
11:27 can cause equipment ruptures,
11:28 compromise safeguards
11:31 or lead to releases of toxic hydrofluoric acid.
11:34 Companies need to install
11:36 remotely operated emergency isolation valves
11:39 to quickly stop releases
11:40 before they become catastrophic events.
11:44 Voiceover: As a result,
11:45 the CSB made a recommendation to API
11:48 to update its standard on
11:49 safe operation of hydrofluoric acid alkylation units
11:53 to require installation of remotely operated
11:55 emergency isolation valves on the inlets and outlets
12:00 of all hydrofluoric acid containing vessels,
12:04 and any hydrocarbon containing vessels
12:06 meeting defined threshold quantities.
12:10 The CSB found a fourth safety issue
12:12 that contributed to the incident at the PES Refinery
12:15 which is safeguard reliability in HF alkylation units.
12:19 At PES the HF alkylation unit
12:22 was equipped with a water spray mitigation system
12:25 that was a critical safeguard
12:27 in the event of an HF release.
12:29 The water mitigation system was designed to use
12:31 cannons to spray large volumes of water at any HF release
12:36 in order to suppress the amount of vaporized HF
12:39 so that it could not travel
12:41 offsite to neighboring communities.
12:44 But when the control room operator tried to remotely
12:46 turn on the water pumps that fed the water cannons,
12:49 it was not possible because the
12:51 control system communication to the water pumps
12:54 as well as a backup power system in the unit
12:56 had both failed during the initial fire.
13:00 Although API recommends fireproofing these elements,
13:03 it does not specifically require companies to do so.
13:07 Instead 40 minutes elapsed from the time of the release
13:10 before a worker was able to manually turn on the pump.
13:15 In the meantime, highly toxic HF was able
13:17 to freely escape from equipment and vaporize into the air.
13:23 Grim: Hydrofluoric acid alkylation units
13:24 present unique hazards due to the presence of
13:27 highly toxic HF alongside large quantities
13:31 of flammable materials within one unit.
13:35 The damage to the water spray mitigation system at PES
13:37 demonstrates that active safeguards
13:40 or safeguards that require a person
13:42 or technology to trigger their activation
13:44 have the potential to fail
13:47 in major incidents involving fires and explosions.
13:51 Critical safeguards and their
13:52 associated control system components
13:54 must be protected from fire and explosion hazards.
14:00 Voiceover: As a result,
14:01 the CSB made an additional recommendation to API
14:04 to update its standard to require protection of critical
14:07 safeguards and associated control system components
14:11 from fire and explosion hazards,
14:14 including radiant heat and flying projectiles.
14:18 And to help ensure that new API
14:20 safety requirements and recommendations
14:22 are implemented effectively nationwide,
14:25 the CSB recommended that the EPA should develop a program
14:29 that emphasizes inspecting refinery HF alkylation units
14:33 to verify that companies
14:35 are complying with API's standard.
14:39 The fifth and final safety issue highlighted by the CSB
14:42 in its report on the incident at PES
14:45 is inherently safer design.
14:48 Of the 155 U.S. petroleum refineries
14:50 currently in operation in the United States,
14:54 46 operate HF alkylation units.
14:57 But hydrofluoric acid is highly toxic
15:00 and is one of the eight most hazardous chemicals
15:02 regulated by EPA's RMP program.
15:06 The other acid catalyst
15:08 used in refinery alkylation units is sulfuric acid.
15:11 Although sulfuric acid is highly corrosive and can cause
15:15 skin burns upon contact, it remains a liquid upon release.
15:20 Therefore it does not present the same risk
15:23 to surrounding communities
15:25 as HF which vaporizes
15:27 upon release and has the potential to travel offsite.
15:31 In addition,
15:32 alternative alkylation technologies have been developed.
15:35 These include a solid acid catalyst
15:38 as well as the new ionic liquid acid catalyst
15:41 which was developed by Chevron.
15:44 Using a sulfuric acid catalyst
15:46 or other new alkylation technologies
15:48 would prevent offsite human exposure
15:51 to HF in the event of future incidents.
15:54 Replacing highly toxic chemicals with less hazardous
15:57 chemicals is an inherently safer design approach.
16:01 Grim: Currently there is no federal regulatory requirement
16:04 for refineries to analyze
16:06 inherently safer design strategies
16:08 to reduce the risk of serious accidental releases.
16:13 Technologies are being developed
16:14 that could be safer alternatives to HF alkylation,
16:17 and refiners should periodically
16:19 evaluate these available technologies.
16:23 Voiceover: In its report, the CSB recommended that the EPA
16:26 require petroleum refineries
16:28 to conduct a safer technology and alternatives analysis
16:33 as part of their Process Hazard Analysis
16:36 as evaluate the practicability of any inherently
16:39 safer technology,
16:42 and initiate prioritization to evaluate whether
16:45 HF is a high priority substance for risk evaluation.
16:49 If it is,conduct a risk evaluation of HF
16:53 and implement any identified corrective actions
16:56 as required by the Toxic Substances Control Act.
17:00 Owens: The destructive event
17:02 at the Philadelphia Energy Solutions Refinery
17:04 exposed weaknesses not only in PES policies
17:06 but also industry standards and federal regulations.
17:10 We call on the American Petroleum Institute,
17:12 the refining industry
17:13 and the United States Environmental Protection Agency
17:16 to implement our recommendations and help make sure
17:19 that another catastrophic incident
17:21 in a hydrofluoric acid alkylation unit never occurs.
17:25 Thank you for watching this CSB safety video.
17:30 [Music]