Can One Thinned Elbow Shut Down a Refinery?: PES Philadelphia HF Alkylation Fire

The 30-Second Version

Investigation finding Before dawn on June 21, 2019, a pipe elbow ruptured in the hydrofluoric acid (HF) alkylation unit at the Philadelphia Energy Solutions (PES) refinery. A vapor cloud, mostly propane, ignited about two minutes later. The fire then triggered three secondary explosions. In the last one, a vessel fragment of about 17.2 t (38,000 lb) flew across a river.

The U.S. Chemical Safety and Hazard Investigation Board (CSB) found a simple root problem. One elbow contained high levels of nickel and copper. It corroded much faster than the pipe around it. Two factors made the event worse: no remote isolation valves on large fuel sources, and fire damage to the HF water spray system.

Five workers and one firefighter had minor injuries. Property damage was estimated at about $750 million. PES announced the refinery's shutdown five days later.

Editor's note The core question for any plant is this: does your inspection program watch "typical" points, or the single weakest piece?

What Happened

Investigation finding The unit was running normally. At 3:34 a.m., a board operator began a routine change to send propane product to storage. Feed to the propane stripper was raised at 3:55 and again at 4:00. No process upset was recorded.

At 4:00:16 a.m., an elbow on the discharge of an idle spare pump (P14-B) burst. The line was at about 2.62 MPa gauge (380 psig) and 38 °C (100 °F). Its design content was 94.7% propane, 2.5% HF, and 2.8% other hydrocarbons by weight. An outside operator saw a vapor cloud at least 3 m (10 ft) high and called it in.

The cloud ignited at 4:02:06. At that moment, control signals to the water spray pumps were lost. The backup power supply (UPS, uninterruptible power supply) failed nine seconds later. At 4:02:37, the board operator triggered the Rapid Acid Deinventory (RAD) system. This was 2 minutes 21 seconds after the release began. That was inside the company's 2:30 target. The RAD moved about 153.8 t (339,000 lb) of HF to a separate drum.

At 4:12, the operator tried to start the water cannon pumps remotely. They did not start. An operator tried to reach the pumps on foot, but the heat blocked the way.

Explosions followed at 4:15 and 4:19. At 4:22, the feed surge drum V-1 ruptured violently. It held butylene, isobutane, and butane. One fragment of about 17.2 t crossed the Schuylkill River. Two others, about 10.4 t and 7.0 t, landed inside the refinery. Debris traveled up to about 640 m (2,100 ft).

Around 4:39, a shift supervisor in firefighting gear entered the unit. The supervisor started the water pump by hand, about 40 minutes into the release. The fire was out at about 8:30 a.m. on June 22.

PES estimated that about 2,376 kg (5,239 lb) of HF was released. Water spray captured about 893 kg (1,968 lb). About 1,484 kg (3,271 lb) went to the air. About 306.6 t (676,000 lb) of hydrocarbons escaped, and about 275.8 t (608,000 lb) burned. The CSB was unaware of any off-site HF impact.

How the Process Works

Investigation finding Alkylation joins light olefins, such as butylene, with isobutane. The product, alkylate, is a high-octane gasoline blendstock. The catalyst is either sulfuric acid or HF. Sulfuric acid stays liquid when spilled. HF boils at about 19 °C (67 °F), so a leak forms a toxic vapor cloud. Its IDLH (Immediately Dangerous to Life or Health) level is 30 ppm.

In HF service, carbon steel grows a thin iron fluoride scale. This scale slows further corrosion. But steel with extra nickel, copper, or chromium forms a weaker scale. A 2003 NACE paper (No. 03651) set a guide: carbon above 0.18% and copper plus nickel below 0.15%.

Editor's note So one odd fitting can thin several times faster than its neighbors. Same fluid, same temperature, same circuit. If no inspection point sits on that fitting, nobody sees it coming.

Causes, Layer by Layer

Layer 1 — Materials

Investigation finding The elbow went in around 1973 at about 8.18 mm (0.322 in) thick. After the event, its thinnest spot was about 0.28 mm (0.011 in). That is under 7% of the company's retirement thickness of about 4.57 mm (0.180 in). Lab tests found 1.74% nickel and 0.84% copper, or 2.58% combined. Neighboring parts had only 0.02–0.03% combined and were still about 7.29–7.80 mm thick.

The elbow carried a "WPB" carbon steel stamp. Behind it was a faint stamp that appears to read "YOLOY," a low-alloy steel trade name. The CSB concluded the part was made as YOLOY steel and later restamped to a different grade. The 1965 edition of ASTM A234 did not clearly ban adding unlisted elements.

Layer 2 — Inspection

The piping circuit had 41 condition monitoring locations (CMLs) in 2002. It had 141 by 2019. A CML is a set spot for regular wall-thickness checks. None was on the failed elbow. PES and the prior owner never inspected every carbon steel component in the unit. The industry practice then in force, API RP 751 (4th edition), did not require it.

Layer 3 — Acting on New Knowledge

After the 2003 paper, ASTM updated pipe specs in 2004. API RP 751 followed in 2007. The CSB found that API RP 751, the prior owner, and PES did not respond by checking all existing components. U.S. process safety rules require owners to show that older equipment remains safe when practices change.

Layer 4 — Isolation

Emergency isolation valves sat on the pump suction side only. Nothing could isolate the large hydrocarbon inventory downstream. The CSB concluded a jet flame from the break hit the bottom of V-1. The steel stretched and thinned until the drum failed.

Layer 5 — Active Mitigation

The RAD worked as designed. The water spray system did not. It could only be started remotely, and the ignition knocked out its control wiring and UPS. It stayed offline for about 27 minutes after the first remote attempt. The CSB noted that "active" safeguards, which need a person or device to trigger them, can fail in major fires.

Layer 6 — Passive Protection

V-1 had no thermal insulation for fire protection.

Editor's note The CSB did not list this as a separate safety issue. Still, when isolation fails, passive fire protection is what buys time. It is worth checking alongside the other layers.

Why the Damage Grew

Investigation finding The CSB named two factors that raised severity. There were no remote isolation valves on large hydrocarbon sources. And the event itself damaged the HF water spray system.

One fragment landed among equipment holding cumene, a toxic and flammable chemical. The HF settler and RAD drum stood about 43 m (140 ft) and 61 m (200 ft) from V-1. More than 117,000 people lived within about 1.6 km (1 mi) of the refinery.

The wind was light, about 3.6 m/s (8 mph). Federal modeling found low off-site HF levels. The CSB stressed that other weather or terrain could have produced hazardous levels off site.

Editor's note The low injury count is best read as luck plus one working safeguard, the RAD. It is not proof that the defenses held.

Questions for Your Site

Application in South Korea

Editor's note The following elements of Korea's process safety report (PSM) system connect to the lessons from this incident.

• Occupational Safety and Health Act, Article 44 (Preparation and Submission of Process Safety Reports) — Act No. 22122, effective October 27, 2026. Employers with hazardous or dangerous facilities specified by Presidential Decree must prepare and submit a process safety report to prevent major industrial accidents (paragraph 1).
• Enforcement Decree of the Occupational Safety and Health Act, Article 44 (Contents of Process Safety Reports) — Presidential Decree No. 36540, partially amended July 28, 2026, effective August 1, 2026. Paragraph 1 specifies process safety information, process hazard assessments, safe operating plans, emergency plans and other report contents.
• Enforcement Rule of the Occupational Safety and Health Act, Article 50 (Detailed Contents of Process Safety Reports) — Ordinance of the Ministry of Employment and Labor No. 477, partially amended July 28, 2026, effective August 1, 2026. The detailed items in a safe operating plan include equipment inspection, examination and repair plans, maintenance plans and guidelines (paragraph 1, item 3(b)), and a management-of-change plan (item 3(g)).

Questions 1 and 2 can be reviewed against equipment inspection, examination and repair plans; question 3 against management of change; and questions 4–6 against process hazard assessment and emergency planning.

Technical principles and management decisions

Lessons for Other Processes

Editor's note The lessons apply most directly to HF alkylation. Yet the patterns travel well: blind spots in "representative" inspection, fuel you cannot isolate, and active safeguards that burn with the unit. They fit sulfuric acid units, other corrosive services, and tank farms.