Podcast: Corroded Pipe, Decades-Old regulations Cause Catastrophe at Philadelphia Energy Solutions

Trish and Traci welcome Greg Borgard, Chemical Processing's corrosion expert, to examine what went wrong at the Philadelphia refinery.

Transcript

Traci: Welcome to this edition of "Process Safety" with Trish and Traci, the podcast that aims to share insights from current incidents to help avoid future events. I'm Traci Purdum, senior digital editor with Chemical Processing, and I'm joined by Trish Kerin, the director of the Institution of Chemical Engineers Safety Center. IChemE is based in the UK and Australia, but its reach is global. Hey, Trish, how are you?

Trish: Hey, Traci, doing well. How are you today?

No worries! Subscribe and listen whenever, wherever. 

Traci: I'm doing well, excited because we have a guest with us today. Joining the process safety discussion is Greg Borgard, Chemical Processing's corrosion expert. Greg is an engineering consultant with 25 years of industry experience. He specializes in material selection issues, conducting compatibility testing and delivering training courses. He holds a bachelor of science in chemical engineering from Purdue University and a master's in chemical engineering from the University of Wisconsin Madison. Thanks for joining us today, Greg.

Greg: Hi Traci. Thanks for having me. Glad to be here.

Traci: Well, I'm happy you're here today because today's topic is a news story from earlier this year regarding the fire and explosions and ultimate shuttering of the Philadelphia Energy Solutions oil refinery. The official word from the U.S. Chemical Safety and Hazard Investigation Board is that a corroded pipe fitting found to be half the thickness of a credit card at its thinnest point led to that incident. The concern is that the pipe, which was installed when Richard Nixon was president in 1973, went all this time without being checked. The incident also released a dangerous chemical, hydrofluoric acid, although no known injuries related to that release occurred. Greg, I guess I want to get your thoughts on this incident. I know that this isn't the only facility that's experienced similar catastrophe.

Greg: Right. Traci, when you first alerted me to this incident it reminded me of the Chevron incident from 2012 out in California. And that's actually an example I use in a corrosion training course that I teach about the dangers of corrosion and erosion and the implications that may have on process safety. And so, it was very interesting to see that, you know, these same type of incidents continue to happen. There was another one a few years even before that in 2009 at Eagle Refinery, again, where the cause was related to kind of extreme thinning up the pipe that led to a rupture and subsequent safety incident. So, we continue to have similar problems, kind of keep recurring in these types of systems. And so, it's good to understand what is happening in them. So, in this particular case, it looks like you have the mechanics of the failure are basically related to corrosion and erosion of the piping to the point where as you said, it was extremely thin, as they described, less than half the thickness of a credit card.

And so it's very important that you do full inspections of these pipings. The Chemical Safety Board has a very good writeup of their preliminary findings of this incident with pictures and details and measurements. And it shows that while some pipe inspections were taking place, they did basically just spot checks of the entire system and not a comprehensive view of the piping. And so, they missed the spots that were most at risk when they did their inspections.

Traci: Now, Trish, I know your concern is with the grandfathering process in terms of regulations. Can you talk about that and other examples that reinforce that concern?

Trish: Yes, certainly. So, I guess my concern in this particular incident, the Philadelphia one, was really around how the metallurgy specification changed over time for that particular service, that the elbow was never changed out or...and as Greg has said, they missed testing that elbow specifically amongst their spot testing that they were doing. So, that allowed it to get to that significantly corroded aspect to where it then finally failed. But the point here around the grandfathering is around how we don't take the opportunity potentially when we can to upgrade certain things to better or newer or adequate, I would suggest even technology as technology advances. There have been another couple of quite prominent examples of where we saw this concept of the grandfathering clause, which is basically just to accept that it was built to standards at the time, therefore it's okay. And we see a lot of that tending to happen.

I would suggest more within the U.S. regime than we do in other parts of the world. Because where we have performance-based legislation, we're actually not allowed to just say, but it was the standard at the time. We actually have to, if it's been determined that there is a better option that's reasonable to do, we actually have to take that step and do it. So, another couple of examples, if you think back to the San Bruno pipeline rupture in California several years ago, so this was a section of high-pressure gas main. It ran through a domestic neighborhood. It was classified in the drawings and the maintenance system as being a seamless pipe. However, when the pipe was installed, seamless pipe hadn't actually even been made yet.

So, it was definitely not seamless. It was welded pipe. So, that created some additional corrosion issues with it that I'm sure Greg could certainly speak to. But the other issue that happened is when the part was installed, there was no need to hydro test it. So, they continued through process of justifying why they didn't need to hydro test it, and they were allowed to assume this idea that they could specify their maximum allowable operating pressure on the pipe by saying the MAOP was the largest pressure the pipe had seen of refined that period.

So, what they would do is every five years they would spike the pressure through the pipe so they could climb ahead of 400 PSI MAP and go down that process. This was a pipe that had never been hand-tested, not been inspected. It was buried underground and it was actually not even identified as the material that it was made off.

Subsequently, when it did rupture, it took out, I think, a significant number of houses. It killed, I believe from memory, eight people. And at the time they actually didn't even know that it was a pipe burst. The company didn't know they'd lost containment for about 50 minutes, which is a concern in itself. And because the neighborhood was so close to San Francisco International Airport, there was some initial period of time when people believed there had been a terrorist attack or a plane had crashed going into the airport because there was such a massive explosion in this neighborhood. So, that's one example. Another example of a grandfathering issue that's occurred is what we throw in the Texas City refinery, where there was a continued use of the blowdown system, the blowdown drum rather than popping it to a flare installation.

And, in fact, that drum had been replaced when flares were the way to go and the way to be building things. But justification was made that because it was a like for like replacement, therefore not a management of change was needed. They were able to just install another blowdown drum rather than take the step at that point in time to pipe it to flare. So, we need to make sure we consider the safer technologies as we go forward. And unfortunately, this idea of relying on that it was to code when we put it in, creates some significant safety hazards in our organizations that, as we've seen, can certainly have massive ramifications and kill people. Fortunately not in the Philadelphia instance, but it can happen.

Traci: Absolutely. And, Greg, you go into these plants, you have your ear to the ground in some instances. What can be learned from these other incidents and when these types of things happen, does it resonate through the industry and do folks now concern themselves with what's happening in pipes that they don't even think about?

Greg: Well, I think that's a key learning point. And I think a lot of learning is shared. But, of course, you know, the incidence that we investigate that happen are the ones where maybe some learning was not carried forward. But I do want to pick up on a couple of things that Trish mentioned because there's not just the grandfathering of standards, but also she mentioned, you know, there were changes get brought into the process over time. And so, as well as even just understanding that equipment should have a planned lifetime or obsolescence before it's replaced or certainly, you know, fully inspected and repaired.

Well, I don't know the details of the process in this refinery, I think it's fair to say that over 46 years they probably would have optimized and improved that process. Some made some changes, maybe temperatures, flow rates, pressures, things like that are changing over time or the composition of the stream may be changing over time. And so, it's not only the standards change and, say, the piping here from this application and the standard was changed for a particular reason, which was to prevent these types of incidents, to make piping more robust, to hold up against the corrosion and erosion that might happen inside.

But the process itself can change. And I think we need to take a step back and kind of reevaluate our designs and the underlying assumptions kind of behind those designs and see are those assumptions still true. So, if a particular pipe was specified that meant, you know, the way the process was run 46 years ago, but that process has changed enough through maybe incremental changes that accumulated over the years, maybe that specification is no longer valid.

So, I think sometimes you just need to take a step back and review the whole plan. And so, that I think is a key learning that we need to take forward on some of these things as well as, I guess, you know, understanding that when you've got equipment that's, you know, decades and decades old, you need to be very aware of those pieces of equipment and understand nothing has a perfect lifetime. Nothing's going to last forever. So we need to investigate those and inspect them with some regularity.

Traci: Absolutely. And I've heard you talk about compatibility assessments. Can you explain that for us?

Greg: Yeah. We have basically a six-fold process that we use. It may sound complicated, it's really relatively straightforward, whereas we break these six steps down. The first step is we'll just say, know your process. So, I talk about, for this refinery process, what are the details of the process? You need to know temperatures, concentrations, flow rates, you know, the pretty good level of detail. And so, you need to really understand that process and the high level of detail and understand, what is needed to operate that process. The next is know your materials.

Here we talking about the specification of the pipe, exactly which grade of the carbon steel piping is being used. And so, the standard changed and what may look like relatively minor components of the piping, some trace elements that, you know, a few tenths of a percent, but they can make a significant difference in the lifetime of that piping. So, when you specify your materials of construction, you need to do that with, you know, pretty high level of detail in the exact grades that you need. So, you know your process, you know your material. Now, the step three is you put those two things together. What is the compatibility of your process with that material and what failure modes, you know, might exist? And so, here you can look at industry data. You know, for industry like refinery, there are probably standards and specifications that we would draw upon, save, you know, for this type of piping or for this type of process, you would use this greater piping.

There's literature, you can do in-house testing. You can benchmark with other companies in strict guidelines, regulatory standards. There's a lot of different sources to pull from to understand, is my process compatible with this specific material? So, now you've understood compatibility, you move to the fourth step, which is to assess the level of risk. As I talked with some folks, I'll just make a rough example, saying, the level of risk for, a leak in the water pipe to my house, to my sink is less than the level of risk associated with this particular piece of equipment, where you've got highly flammable materials, highly toxic materials under a high pressure and surrounded by a bunch of other flammable equipment. So, what is your level of risk to health, safety, environmental, the business risk, regulatory risk if you're in a highly regulated industry and you need to adjust your plans of that level of risk?

So, the fact that this piece of piping never got inspected with the level of risk that was inside of it is not acceptable. You might see that on a wastewater pipe or something else that's in much lower level of risk. So, understand your level of risk and understand that the risk is not the same everywhere in the system. So, for example, here, this failed at an elbow where there was basically two elbows right in a row. So, there's a lot of velocity and changing of direction, where erosion in that section of the piping may be much higher than it is on a straight run of piping where there's a lot less turbulence. And so, even within the system there can be places that are higher risk than others. And so, you would adjust your plans, you know, to that level of risk. Say, for example, your inspection plans.

And the next step is basically to document your work. You know, what is the basis for your design, that assessment? As you pull all that together, you know, write it down. Can it be referenced? This refinery was designed and built in the early '70s, the ability to go back and reevaluate our assumptions depends on having all that material written down or in one form or another so we can check those assumptions and how they...you know, do they still apply today or not?

And then I think the final step is once you've got all that done is your ongoing maintenance and inspection plans. So, the first several steps of the process gets you to an initial design and an installation. But every system requires ongoing maintenance and inspection. And so, in the CSB writeup, there are preliminary writeup of this incident. They talk about there was thickness inspection at certain points of the piping and there was a criteria for once it got below a certain thickness that would trigger, you know, replacement or repair. But the problem was they didn't inspect in all the right places or enough places to define this particular point. But, you know, develop maintenance inspection plans. Are the plans comprehensive and do they account for the level of risk?

I think probably one of the failures here was that their inspection and maintenance plans did not properly account for the level of risk that was present in the system. And so, it wasn't comprehensive enough to catch what turned out to be a very costly mistake.

Traci: Well, an excellent six-fold process that you just outlined for us there. I appreciate that. Trish, from a wider angle lens, I know you're a champion of safety culture, a big proponent of making sure that employees are empowered to say, "I don't care if that was the way it was done in the '70s, we need to readdress it." What are some of the lessons that we can learn from the wider view that you take a look at?

Trish: I think for me, one of the key things is we need to get a lot better at this idea of systems thinking and looking at the entire system of the organization rather than just simply looking at small incremental parts of it. We need to look at the whole. There's certainly been a lot of work done in this space over the years, particularly with Nancy Leveson's work at MIT. And that actually allows us to really understand the bigger picture of what's going on, I think, and understand how we can make sure that we are taking into account what we need to be focusing on from that organizational perspective, you know, our management systems and things like management of change, making sure we've got robust systems around that and they're used, making sure that in that we do have a way, and in our PHAs we, have a way to really take into account that there may be evolving or better technology that we seriously need to consider and not just discount because it was to code when we built it.

So, I think we need to be more challenging in our organization. So, I would like to say, it is the emergency response in that particular incident in Philadelphia, I think, was very good. The operators responded as we would expect them to. But so often in a panic situation, people don't always respond the right way. They do inventory, the hydrofluoric acid very, very quickly. So, that if he says some interesting things about their capability within that organization. So, they were obviously very competent in the safety aspect of emergency response. There was potentially an issue in terms of how they're managing their acid integrity, though. But there was some positives that we did see out of that as well.

Traci: In recent news we've heard about the EPA rollback of the chemical disaster rule. What are your thoughts on that, Trish, in terms of impacting future events?

Trish: Yeah, I think that's a very concerning change. There's a number of reasons for them. I mean, some of the things that were rolled back with things like that, safer technology does not need to be considered when reviewing what you're doing. And fundamentally, this is how I think we end up with situations where we assume that because it was okay at the time, it's going to be okay in the future rather than saying, "Actually, no, we need to be doing something different."

So an everyday example would be, so we used to have cars without seat belts, but now we have cars with seat belts. We need to be moving to cosmic seat belts, not just assuming that because the first cars didn't have them that's okay.

There’s certain technologies that we can be putting in place there, I think. The fact that incident findings were no longer needed to be included in the inputs to the hazard assessments, I think, is concerning. Because that's fundamentally where you're going to learn what went wrong and be able to assess what you can do to prevent it going wrong in the future. Less need to investigate incidents, I think, is very concerning. So, we won't get to the root causes of what's caused the incidents and therefore we can't fix them and have those learnings available to people. And so, it's not required to keep up to that process safety information. These are just a couple of the changes that have been put into place. And when you sort of summarize them in that way, it sounds quite ridiculous, I think, certainly from my perspective that even if you talk to non-process safety people, you say, "Well, surely there are fundamental things that you just should be doing."

And they are, and that's I think one of the messages I'd like to leave with people just because the rule has been rolled back. These are fundamental management systems and processes that you should have in place and you should be doing, because at the end of the day, what we need to not lose sight of in process safety is, we are running businesses and those businesses are there to make money. But we've seen what can occur if you destroy your business, you no longer have the ability to make money when your facility is breaking down because you don't have adequate acid integrity, then you're not a reliable facility. Therefore, you can't have productivity and you're not going to make money.

When you have good process safety programs in place that are managing your asset integrity, then you're going to have better plant reliability, which means your plant is running. If your plant is running, you've got a hope of money. There are other factors that come into it, commodity prices, etc. But at the end of the day, if you're plant is safely running, you've got a chance of making money. When your plant is not running because it's broken down because you're not maintaining it adequately, you're not making any money. You're losing money. So, this is a business equation for people, and I think we need to just remind people about that, that process safety doesn't cost us money. It actually provides sustainability for our business that allows us to continue to make money. And I think that's the final thought that I would like to leave people with on this particular topic.

Traci: And it's a very good premise there, obviously. You say that's your final thought, but I want to ask the question to you both. Are there any other final thoughts regarding this type of what we're talking about today, the incident, not necessarily pinpointing that incident, but any final thoughts that you'd like to offer up?

Greg: Yeah. I would chime and I would think, one thing just to point out is that failures come suddenly. And so, the day before this explosion happened at the plant was probably an ordinary day. And so, you can't just rely upon if things are running well this instant and use that as your basis for safety. I think sometimes a question I will ask people is, how do you know what you know? So, how do you know your plant is in a good position, you know?

So, if I had challenged, say, an engineering manager at the site say, how do you know your equipment is safe in a good working order? And if you can't access information, whether it's through the inspection and maintenance process that you've done, your basis for design, etc., that gives you confidence that you know today you're operating safely, then you need to stop and think about that and change what needs to be changed so that you can answer that question with confidence that says, "I know my plant is safe. For me, I focus on materials and my materials are in good order because of, you know, this." And so, I think that for me is a key and it's a good way, as Trish was saying about, you know, systems thinking. How do you know your whole system is working, your installation, operational system, maintenance system, all that working together so that you know that your plant is safe and in good working order as opposed to hoping that it's safe in good working order?

Traci: And definitely hope is not a good strategy.

Trish: Yeah. I would agree with that. I would agree with those comments, Greg. And it really, for me, is around challenge. You need to be willing to challenge what's going on in the organization and that means you need to ask questions. One of the quotes I use a lot in our leadership programs is a quote from Winston Churchill in World War II when he became aware that Singapore was more vulnerable to invasion than he previously thought.

And his first question was, "Why didn't I know? Why didn't my advisors know? Why wasn't I told?" And the most important question he then asked was, "Why didn't I ask?" You can't just assume someone's going to give you the information. You need that assurance. You need to be making sure that you've got the information you need. So, I would certainly agree with what you said there, Greg. It's about challenge and it's about understanding fundamentally whether you actually do have your system in control. And what evidence do you have to support that position?

Traci: Well, a great conversation. Unfortunate events happen all over the world and we will be here to discuss and learn from them. On behalf of Trish and Greg, I'm Traci, and this is "Process Safety" with Trish and Traci.

Trish: Stay Safe