CorrosionRelatedAccidentsinPetroleum

Refineries

LessonslearnedfromaccidentsinEUandOECDcountries

MaureenHeratyWOOD
AnaLisaVETEREARELLANO
LorenzoVANWIJK

2013

EUR26331EN


European Commission
Joint Research Centre
Institute for the Protection and Security of the Citizen

Contactinformation
MaureenHeratyWOOD
Address:JointResearch Centre, Via Enrico Fermi 2749, TP 720, 21027 Ispra (VA), Italy
E-mail: Maureen.Wood@jrc.ec.europa.eu
Tel.: +39 0332 78 9140
http://ipsc.jrc.ec.europa.eu/
http://www.jrc.ec.europa.eu/
LegalNotice
Neither the European Commission nor any person acting on behalf of the Commission
is responsible for the use which might be made of this publication.
Europe Direct is a service to help you find answers to your questions about the European Union
Freephone number (*): 00 800 6 7 8 9 10 11 (*)
Certain mobile telephone operators do not allow access to 00 800 numbers or these calls may be billed.
A great deal of additional information on the European Union is available on the Internet.
It can be accessed through the Europa server http://europa.eu/.
JRC84661
EUR 26331 EN
ISBN 978-92-79-34652-1 (pdf)
ISBN 978-92-79-34653-8 (print)
ISSN 1831-9424 (online)
ISNN 1018-5593 (print)
doi: 10.2788/37909
Luxembourg: Publications Office of the European Union, 2013
European Union, 2013

Reproductionisauthorizedprovidedthesourceisacknowledged
Printed in Italy
.

Table of contents

EXECUTIVESUMMARY..........................................................................................................................1
CHAPTER1

INTRODUCTIONANDBACKGROUND...........................................................................8

1.1

Background........................................................................................................................12

1.2

AimsoftheStudy...............................................................................................................14

1.3

Corrosionasamajorhazardconcernforthepetroleumrefineryindustry.........................15

1.4

Descriptionofaccidentreportsourcesusedinthestudy...................................................17

1.5

Typeofeventsandconsequencesofaccidents..................................................................22

CHAPTER2
CONDITIONS

ANALYSISOFTHEPOTENTIALCONTRIBUTIONOFPROCESSANDEQUIPMENT
30

2.1

Processconditionscontributingtocorrosioninstudycases..............................................31

2.2

Analysisofcasesinassociationwithspecificprocessconditions.......................................34

2.3

Corrosionriskassociatedwithchemicalrefiningprocesses...............................................39

2.4

Involvementofrefineryequipmentincorrosionrelatedaccidents...................................44

2.5

Frequencythatvariousequipmentvulnerabilitieswerecitedintheaccidentsstudied.....50

CHAPTER3
3.1

ANALYSISOFTHEPOTENTIALCONTRIBUTIONOFRISKMANAGEMENTFAILURES.....57

Inadequateawarenessoforattentiontoknowncorrosionhazards..................................58

3.2
Failuretoconductanadequatehazardidentificationorriskassessmentforlifecycle
planningandevents........................................................................................................................61
3.3

Inadequateriskanalysisatdesignandconstructionstage.................................................64

3.4

Inadequateriskanalysispriortoachange.........................................................................68

3.5

Inadequateriskanalysisforplanninginspections..............................................................71

3.6

Inadequateidentificationofhazardsandrisksforotherpurposes.....................................74

CHAPTER4

CONCLUSIONS...........................................................................................................77

APPENDIX1:LISTOFACCIDENTSSTUDIED.........................................................................................80
APPENDIX2:REFERENCES..................................................................................................................88

TABLE OF FIGURES

iii

Figure1.Totalcasedistributionbycountry........................................................................................17
Figure2.Accidentsbyyearofoccurrence...........................................................................................18
Figure3.Percentageofcasesinwhichsomelessonslearnedinformationcouldbeextracted...........21
Figure4.Accidentsclassifiedbytypeofevent....................................................................................22
Figure5.Substancesreleasedinrefineryaccidentsinvolvingcorrosionbynumberofaccidents........23
Figure6.Distributionofeventtypeforeachtypeoffailure................................................................24
Figure7.Severityofaccidentconsequencespreandpost2000........................................................25
Figure8.Distributionofeventtypeforeachtypeoffailure................................................................26
Figure9.Levelofconsequencevs.typeofconsequence....................................................................27
Figure10.Processconditionscitedascontributingtocorrosiveconditionsaccidentsstudied...........31
Figure11.Processrelatedsubstancescitedascontributingtocorrosionfailures...............................36
Figure12.Processsubstancescontributingtocorrosionfailureinassociationwiththeprocessunitof
origin...................................................................................................................................................37
Figure13.Observationsonprocessconditionsrelatedtoaccidentoccurrence..................................38
Figure14.Simplifieddiagramofarefineryprocess.............................................................................39
Figure15.Unitofaccidentbyoriginofcasesstudied.........................................................................42
Figure16.Severityofconsequencesassociatedwithunitoforiginofaccidentsstudied....................43
Figure17.Accidentoriginbyequipmentcomponent..........................................................................46
Figure18.Descriptionsfromcasestudiesofcorrosionfailuresinstoragetanks................................49
Figure19.Typesofvulnerabilitiessitedforpipeworkandpipelinescontributingtocorrosion
accelerationofequipmentinvolved....................................................................................................51
Figure20.Observationsfromcasesonrelatedequipmentconditions................................................52
Figure21.Observationsfromcasesoninadequateanticorrosionprotection....................................55
Figure22.Percentageofaccidentswhereaninadequateawarenessorattentionconcerningaknown
corrosionhazardwasindicated...........................................................................................................58
Figure23.Indicationsofamanagementfailureincasesstudied........................................................59
Figure24.Observationsfromcasesstudiedindicatingpotentialinadequateawarenessoforattention
toknowncorrosionhazards...............................................................................................................60
Figure25.Exampleofconsequenceeventtree...................................................................................62
Figure26.Illustrationofbarriersinfluencingaprocessincident.........................................................63
Figure27.BasicSafetyBarrierDiagram...............................................................................................63

iv

Figure28.Percentageofaccidentswhereriskanalysispriortodesignandconstructionwascitedas
potentiallyinadequate........................................................................................................................66
Figure29.Observationsfromcasesoninadequateriskassessmentpriortodesignandconstruction66
Figure30.Percentageofaccidentswhereriskanalysispriortoadesignorprocesschangewascitedas
potentiallyinadequate........................................................................................................................69
Figure31.Observationsfromcasesoninadequateriskassessmentpriortoachange........................70
Figure32.Percentageofaccidentswhereriskanalysisforplanninginspectionswascitedaspotentially
inadequate..........................................................................................................................................71
Figure33.Observationsfromcasesoninspectiondeficiencies...........................................................73
Figure34.Observationsfromcasesoninadequatehazardevaluationpriortorepairwork................74
Figure35.Observationsfromcasesontheabsenceofadequatedetectionandmitigationsystems..75

TABLE OF TABLES

Table1.TotalOilSupply.......................................................................................................................9
Table2.NumberofOperatingRefineriesinOECDandEUMemberCountries....................................11
Table3.Typicalrefineryelementscontributingtoelevatedcorrosionrates.......................................16
Table4.Primarysourcesofaccidentreportsanalysedinthisstudy....................................................19
Table5.ConsequenceRankingCriteria...............................................................................................25
Table6.Cumulativetotalsofconsequencefiguresforallaccidents....................................................29
Table7.ExamplesofstresscorrosioncrackingdamagemechanismsproposedbyAPI571...............32
Table8.Typicalprocesssubstancesassociatedwithrefinerycorrosion..............................................35
Table9.Typicalrefineryprocesses......................................................................................................40
Table10.Classificationoftypeofdamagevs.systems/componentsinprocessplantsfromtheRIMAP
project................................................................................................................................................45
Table11.Factorscontributingtocorrosionandagingequipmentfailuresidentifiedinvariousstudies
............................................................................................................................................................47
Table12.Corrosionandagingfailuresassociatedwithpipework.......................................................47
Table13.Factorscontributingtocorrosionandagingfailuresassociatedwithatmosphericstorage
tanks...................................................................................................................................................49
Table14.Pressurevesselssubjecttopotentiallyrapiddeterioration..................................................50
Table15.Exampleofguidancefordesigningtominimizecorrosionandchallengesinmonitoringand
maintainingcorrosionvulnerableareas..............................................................................................65
Table16.Examplesofcriteriausedtodetermineinspectionfrequencyforpressureandpipe
equipmentinvariousRBImethodologies............................................................................................72

vi

EXECUTIVE SUMMARY

Petroleumrefiningindustrycontinuestobeofcentralimportancetotheglobaleconomy.Refined
petroleumproductsarenotonlyaprimarysourceofenergyforhomesandbusinessesbutalsoare
fundamentaltoathrivingtransportindustry.Refineryoilproductsandbyproductsoftheproduction
processsuchasammoniaandsulphur,alsoformthebasicingredientsforavastrangeofproducts
suchasplasticsandothermaterialsforconsumerandindustrialproducts,clothandindustrialfabric,
paintsanddyes,pharmaceuticals,fertilizers,andnumerousothermanufacturedgoods.Thepresence
ofthissectorinanycountryisconsideredtobeasignificantadvantagenotonlytothecountrybut
alsotothesurroundingregion.
Petroleumrefiningisalsoahighhazardindustrywithmostsitesprocessingthousandsoftonnesofoil
intovariousproductlineseachyearmanyofwhichareflammable,toxictohumanhealthortoxicto
theenvironment.Atthesametimerefineriesarealsolarge,complexsiteswithmanyprocesses,
severalofwhichoperateatveryhighlevelsofpressureandtemperature,andavastpipelineto
transportprocessfluidsthroughoutthesiteandeventuallytoexternalmodesoftransport.This
combinationoffactorsmakerefinerysitesveryvulnerabletoavarietyofcorrosionphenomenathat
caneventuallycausealossofcontainmentofprocessfluids,sometimesleadingtoaseriousaccident
affectingworkers,theenvironment,thesurroundingeconomyandevenonoccasionthelarger
economy.
ThemajorityofEUandOECDcountriesarehosttoatleastonepetroleumrefinery,ifnotseveral,and
thosecountrieswithoutrefineriesallhavepetroleumstoragedepotswhosharesomeofthesame
storageandhandlingissuesasrefineries.OECDcountriesrepresentanestimated49.2%[1]ofglobal
refiningcapacity,andalltogetherEUcountries(includingnonOECDmembers)representan
approximate18%ofglobalrefiningcapacity.[2]Ithasbeennotedbyanumberofexpertsoverthe
yearsthatmechanicalintegrityconsistentlyremainsacontributortomajoraccidentsinthese
countriesdespitenumerousgainsinknowledgeaboutvulnerabilitiesofrefineriesandhowtheycan
bemanaged.Notably,ofthe137majorrefineryaccidentsreportedbyEUcountriestotheEUs
eMARSdatabasesince1984,around20%indicatedcorrosionfailureasanimportantcontributing
factor.ThisproportionofrefineryaccidentsineMARSwiththisprofilehasremainedconstantwell
intothe21stcentury.
ThisreportfocusesoncorrosionrisksinrefineriesinEUandOECDcountries,lookingatlessons
learnedfrompastcorrosionrelatedaccidentsatthesesites.Theanalysiswasconductedaspartof
thelongstandingcollaborationonlessonslearnedbetweentheEuropeanUnionandOECDcountries
intheOECDWorkingGrouponChemicalAccidents.Theaimofthestudywastoanalysethereportsin
termsofknowncorrosionrisksassociatedwithoilrefineriesanddeterminetowhatextentafailureto
recognizeorcontrolvariousknownfactors,technicaland/ormanagerial,mayhavecontributedtothe
accident.Thestudyisaimedmanagersandinspectorsofvariousexpertisewhoarechargedwith
overseeingormonitoringaspectsofriskmanagementatrefinerysites.Fortheseprofessionals,itis
hopedthattheanalysismayprovidesomeinsightintospecifictypesofvulnerabilitiesandpotential
risksthatonoccasionmaybeoverlookedandleadtoaseriousevent.
Thisstudyofcorrosionrelatedaccidentsinrefineriesisbasedon99reportsofimportantrefinery
accidentsinwhichcorrosionofanequipmentpartwasidentifiedorsuspectedasbeingthekeyfailure
leadingtotheaccidentevent.Onlyreportslistedinopensourcesandproducedbyorwiththe
collaborationofpartiesdirectlyinvolvedintheaccidentinvestigationwereused.Therefore,witha
1

fewexceptions,onlinegovernmentdatabasesofaccidentreportswerethemainsourceofaccident
reports.Moreover,sincethestudywasconductedonrefineriesinaspecificgeographicarea,reports
thatdidnotspecifygeographiclocationoftherefinerycouldnotbeused.
Theaccidentscannotbeusedforcomputingstatisticaltrendseitherbyyearoronageographicbasis.
ThevastmajorityofEUandOECDcountrieshavenotconsistentlycollecteddataorreportsonmajor
chemicalaccidentsovertheperiodbythisstudyorinsomecasesthedataarenoteasilyavailable.
ThereisasignificantoverrepresentationofaccidentsoccurringinJapan,Franceandtheother
EuropeancountrieswhowerepartoftheEuropeanUnionpriorto2004.However,acollective
analysisoftheseaccidentscanhelptoidentifyareasofongoingconcerngenerallyforrefineries.They
alsocanprovideinsightastowhethertheprofileofcorrosionrelatedaccidentsoccurringinrefineries
afewdecadesagohasevolvedorhasstayedrelativelythesame.
Consequences of corrosion-related accidents in refineries
Uncontrolledcorrosioncancausereleaseofhazardoussubstancesandcomponentsorcanreduce
boththeperformanceandreliabilityofequipmentuntiltheirfailure.Assuch,corrosionhazardscan
putatriskthesafetyandwellbeingofbothplantemployeesandthegeneralpublicaswellasleadto
severedamageofprocessunits,andinsomecasesshutdownofrefineryoperations.Agoodportion
oftheaccidentsstudiedappearedtobefairlyrepresentativeofthetypesofhighriskscenarios
associatedwithpetroleumrefineries.Manyoftheseeventswerenotifiedtothedatasourcesusedby
thestudyonthebasisofhighimpactsintermsofeffectsonhumanhealthortheenvironmentor
significantcosteithertotheoperatororintermsofoffsitepropertydamageordisruption.As
evidence,itisobservedthatnearly50%ofthereportsstudiedbothpreandpost2000werehighor
veryhighconsequences[seeFigure7].Accidentswithlowconsequencesrepresentaboutathirdof
theaccidentsstudiedandalsotheratiooflowimpactaccidentstototalaccidentsremainedvirtually
unchangedforpreandpost2000accidentsstudied.Manyoftheselatteraccidentscontributed
importantinsightstothestudyonconditionsthatcontinuetoplayaroleinelevationofcorrosionrisk
onrefinerysites.
Publicserviceinterruptionandpropertydamagewerethedominantconsequencesoverall.Taking
intoaccountproductionlossaswell,55%oftheaccidentsstudiedwereprojectedtohaveaveryhigh
economicimpact.Significantenvironmentaldamagewasreportedfornearlyathirdofaccidentsand
mainlyassociatedwithtoxicreleasestowater.Althoughtherehavebeennodeathsandonly17
injuriesrecordedincorrosionrelatedaccidentsinrefineriessince2000,potentialforcatastrophic
humanhealtheffectsfromanytypeofchemicalaccidentinarefinerycannotbediscounted.There
havebeenseveralfatalaccidents(relatedtoothercausesthancorrosion)occurringinrefineriesin
theEUandOECDinthelast10years(andeveninthelasttwo),manyoftheminplantsseveral
decadesold.Thepotentialforacorrosionfailuretocauseahumandisasterdoesnotappeartohave
greatlydiminished.
Process conditions contributing to corrosion in study cases
Refineriesaremostvulnerabletocorrosionduetointernalprocessconditions.Thestudyanalysedthe
casestoidentifywhattypesofsubstancesandprocessunitswereassociatedwiththeaccidents.In53
casesprocessconditionswereidentifiedascontributingtothecorrosiveconditionsprecedingthe
accident.Themostcommonlycitedcontributorwasthesubstance(cited46times).Flow(either
high,low,turbulentorunequal)wascitedin10cases,andtemperature(mostlyhigh,butinafew
cases,low)andpressure(mostlyhigh)werecitedascontributorsin11and7casesrespectively.In8
casesotherexacerbatingprocessconditionswerepresent,includingoperationoutsidedesign
parametersandvariationacrossprocesscycles.

Refineryprocessesgenerallyconsistofeitherrefiningortreatmentprocesses.Refiningprocesses,
suchasdistillationandthermalcracking,breakdownandmanipulatethemoleculesinthecrudeoil
feedstocktoconvertitintomarketableproducts.Treatmentprocessesremoveimpuritiesand
byproductsfromthefeedstockandrefiningoutput.Asmuchaspossibletheseunwanted
substancesareeitherrecycledintotherefiningortreatmentprocess(e.g.,hydrogen)orsoldas
productsintheirownright(e.g.,sulphur).
Outof99cases,thehighestpercentage(23%)startedinthedistillationunit,followedcloselyby
hydrotreatmentunits(20%).Inthecasesstudiedthereweresubstantiallyfewercasesinvolvingsuch
unitsafter2000comparedtoprioryears.Conversely,thenumberofcasesinvolvingthepipeline
transfernetworkisproportionallysomewhathigherafter2000.TheOthercategoryincludesunits
forsulphurrecovery,solventextraction,saturatedgas,olefinmanufacturingandoilgasification.The
studydoesnotshowanypatternlinkingspecificunitswithaccidentconsequencesofaparticularlevel
ofseverity.
Involvement of refinery equipment in corrosion-related accidents
Themagnitudeofapetroleumrefineryunitandthecomplexoftheprocessesissuchthatawide
varietyofequipmenttypescanbesubjecttocorrosiondependingontheprocess.Ingeneral,the
pipelineinfrastructureandthepipeworkassociatedwithinaparticularunitand/orpieceof
equipmentarequitevulnerable.Storagetankfailurescanalsooccurduetocorrosionandgenerally
havehighriskprofilesduetothevolumesthattheymaycontain.Corrosioncanalsooccurinother
equipmentcomponentssuchastrays,drums,andtowers.Someequipmenttypesaremore
vulnerabletocorrosion,ortocertaintypesofcorrosion,thanothersusuallyduetotheirroleinthe
process,thedesignofthepipework,orphysicallocationonthesite.Sometimesfaultyrepairsor
processredesigncanincreasecorrosionvulnerability.Hence,equipmentdesignandmaintenance
practicesarecriticaltocontrollingrefinerycorrosion.Afewtypesofequipment,notablytheheat
exchanger(anecessarycomponentofmanyprocessunits)andthestoragetank,arealsohighly
correlatedwithelevatedcorrosionrisk.
Ofthecasesstudied,corrosionfailureoriginatedpredominantlyinpipeworks,causing71%ofthe
accidentsstudied.Fiftypercentofaccidentsinvolvedtheinternalpipeworkoftheequipment.As
notedintheprevioussection,17%oftheoriginalfailurestookplaceinthepipelineinfrastructureof
theplantfortransferbetweenunitsandtoandfromtransportmodes,and4%tookplaceintubes
associatedwithheatexchangeandcoolingunits.FIfteenpercentoftheaccidentsoccurredinstorage
tanks.
Variousfactorsmakesomeequipmentcomponentsmorevulnerabletotheaccelerationofthe
corrosionratethanothers.Configurationanddesignofequipmentplayaparticularroleincreating
opportunityforcorrosivedepositstoaccumulate.Functionandlocationcanalsodeterminethelevel
ofexposuretocorrodingagents.Integrityofcorrosionprotectionandrepairareapplicationsthatcan
alterthecharacteroftheequipmentwithanimpactonitsvulnerabilitytocorrosivefactors.
Moreover,inanyrefinery,therewillusuallybepointsatwhichthepipeworkfailstomeetthe
necessarydesignstandardsforanumberofreasons.Thesereasonsincludeage,processchange,
designchange,riskassessmenterrors,andpoorrepairandmaintenance.Thesevulnerabilitiesare
commoncausalfactorsforothertypesofmechanicalintegrityfailuresbesidescorrosion.
Thestudyhighlightedthefollowingvulnerabilitiesthatwerecitedinnumerousreports,individuallyor
incombinationwithotherfactors,ascontributingtoanaccidentevent.

Materialcompositionofthecomponent
3

Configuration

Function

Location

Adequacyofanticorrosionprotection

Weldedparts

Thestudyrevealedthatinninecases,theinadequacyofthematerialcompositionindesignorrepair
ofthepipecomponentwasconsideredacontributorfactortothecorrosionfailure.Sixcases
indicatedthatinfrequentusemayhaveresultedinareductioninthefrequencyofmonitoringand
maintenanceofanequipmentcomponent.Overallfailureoftheanticorrosionprotectionwascited
in16oftheaccidentsstudied.Corrosionfailurewasattributedtopotentialweldingerrorinnineof
thecasesstudied.Onlyfourcasesmentionedtheageoftheequipmentasacontributingfactor,
althoughinseveralreportstherewerealsoreferencestotheadvancedageoftheequipmentinvolved
intheaccidentwithoutindicatingitasacausalelement.
Inparticular,configurationofthepipeworkplaysastrongroleinthecorrosionprocess.Somedesign
featurescreateweakpointsinthesystemthatareparticularlyvulnerablepotentialstresses,including
corrosion.Theelbowjointisthemostcommongeometricconfigurationinvolvedinacorrosion
relatedfailureinthestudy,notedin18%ofallcasesastheoriginalsiteofcorrosion.Elbowjoints
havepracticalandengineeringadvantagesbuttheyalsoarevulnerabletocertaintypesofstresses,
particularlyerosion/corrosion,lowofunevenflow,vibration,andexternalpressurefromnatural
forcessuchaswindandfloods.Aslightlyhigherproportionofthepre2000casescitedanelbowjoint
astheoriginofthecorrosionfailure.
Intotal8differentcasesreferredtovalvesorbranchedpipingastheoriginallocationofthecorrosion
failure.Valves,nozzlesandbranchedpipeworkallrepresentpipeintersectionsthatarejoinedtothe
systembyvariousmechanisms,includingwelding.Whiletheconstructionanddesignofthese
componentsvariesconsiderably,itcangenerallybesaidthattheprocessofmakinganintersection
createsaweakpointinthepipesystem.
Asidefromprocesslocation,otherlocationfactorsalsomayaffectcorrosionvulnerability.Inthis
studytwoadditionallocationissueswerehighlightedin13separatecases:exposuretotheexternal
environmentandaccessibility.Inonecaseasectionofequipmentpipeworkwaspoorlyaccessiblefor
routineinspection.Sevencasesconcernedpipesthatwereonthegroundorunderground,4ofwhich
wereconsideredalsofairlyinaccessibleforroutineinspection.Pipelinestandardsgenerally
recommendthatburiedandsubmergedmetallicequipmentshouldhaveadequateprotectivecoating.
Fivecasesconcernedpipessubmergedinwater.
Potential contribution of risk management failures
Everyrefineryisexpectedtohaveanappropriateriskmanagementstrategytominimizetheriskswith
adequatelayersofprotectionsupportedbyaneffectivesafetymanagementsystem.Fromthe
reports,therewasanindicationthatafailureinriskmanagementwasacontributingcausetothevast
majorityofaccidentsstudied.
Duetothevariationinreportingdetailandstyle,itwasnotpossibletoanalysetheriskmanagement
failuresassociatedwiththeseaccidentsinasystematicway.Nonetheless,thestudywasableto
summarizepotentialriskmanagementfailuresintermsoffivegeneraldeficiencies:

Inadequateawarenessorattentiontoknowncorrosionhazards
4

Inadequateriskanalysisatdesignandconstructionstage

Inadequateriskanalysispriortochange,whichisessentiallyalackoforfailureinthe
managementofchangeprocess

Failuretoidentifyoraddressprocessrisksinplanninginspections

Inadequateidentificationofhazardsandrisksforotherpurposes,suchassafeperformance
ofrepairsandestablishmentofdetectionandmitigationsystems

Accordingtothestudy,aninadequateawarenessorattentionofmanagementtoknowncorrosion
hazardscouldwasimpliedasacontributingfactorin23%ofthecasesstudied.Thisincidencewas
flaggedincaseswhereoneormoreofthefollowingconditionsappearedtoexistaccordingtothe
observationsfoundintheaccidentreport:

Generallackofmanagementattentiontocorrosionissues

Lackofawarenessintheprocessunitofpotentiallyunsafeconditionsandpotentialaccident
triggers

Inadequatecorrosionmonitoringandfeedbackmechanismsforknownareasofelevated
corrosionrisk.

Theremainingfourcategoriesofriskmanagementfailureidentifiedinthestudycanbetracedtoa
failureassociatedwithhazardidentificationorriskassessmentatanimportantstageinthelifeofthe
equipment.Mostmajoraccidentsimplyatleastapartialfailureintheidentificationandrisk
assessmentofamajorhazardresultinginaninadequateevaluationofthehazardandassociatedrisk.
Forcorrosionhazards,riskisnormallyexpressedastheproductoftheprobabilityofacorrosion
relatedfailureandtheconsequencesofsuchafailure.Theoutcomeoftheassessmenthas
implicationsfordownstreamdecisionsassociatedwithdesign,operationandmaintenanceofthe
process.
Itcouldbededucedfromnumerousaccidentreportsstudiedinthisanalysisthataninadequaterisk
assessmentoftheprocessatacriticaloperationalphasewasacontributingcauseoftheaccident.
Usuallytheriskassessmentwasinadequateforanumberofreasons,including:

Thehazardwasnotidentifiedandariskassessmentforthathazardwasneverperformedat
acriticalpointinthesafetylifecycle

Criticalinformationaboutthehazardandpotentialriskwasavailablebutomittedfromthe
riskassessment.

Criticalinformationaboutthehazardandpotentialwasnotfullyavailablefortherisk
assessment

Thisstudyfoundthattheseinadequaciesintofourdifferentcategoriesaccordingtotheiroccurrence
inthesafetymanagementprocess,asfollows:

Inadequateriskanalysisatdesignandconstructionstage

Inadequateriskanalysispriortochange,whichisessentiallyalackoforfailureinthe
managementofchangeprocess

Failuretoidentifyoraddressprocessrisksinplanninginspections
5

Inadequateidentificationofhazardsandrisksforotherpurposes,suchassafeperformance
ofrepairsandestablishmentofdetectionandmitigationsystems

Accordingtothestudy,theriskassessmentpriortooriginaldesignoralaterequipmentdesign
changewasnotadequateoverathirdofallaccidents.Someofthereportswerenotentirelyclearas
towhetheradesignerrorwastheresultofadecisionintheoriginaldesignoftheprocessorwaspart
ofachangetoprocessequipmentatalaterstage.Asapracticalmatter,thestudyassumedthat,if
changewasnotmentioned,theerrorwaspartoftheoriginaldesign;however,thischoicecouldnot
befullyverified.
Changesandmodificationstoprocessesandprocessequipmentareanaturalpartofarefineryplant
lifecycle.Acoreelementofanysafetymanagementsystemisaproperlyfunctioningmanagementof
changeprocess.The1974Flixboroughexplosionisperhapsthemostwellknowncatastrophe
associatedwithafailureinthemanagementofchangeprocess.Eightoutof60accidentsinvestigated
bytheU.S.ChemicalSafetyBoardbetween1998and2012alsowereassociatedwithfailureto
manageaprocessorequipmentchange.Inthisstudy10%ofaccidentswerecitedaspotentially
resultingfromafailureinthemanagementofchangeprocess.
Theestimatedcorrosionriskassociatedwithaprocessorpieceofequipmentshouldbealeading
factorinschedulingroutineinspectionsofequipmentintegrity.Amoredetailedriskassessmentmay
alsobewarrantedtoidentifyspecificdegradationthreats,theremaininglifeoftheequipmentandto
feedbackinformationintotheoverallriskassessmentandcontrolsystem.Theinitialcorrosionrisk
assessmentshouldidentifyalsopointsinthelifecyclewhenthecorrosionriskassessmentshouldbe
upgraded.Accordingtothereportsstudied,athirdoftheaccidentsmighthavebeenavoidedwith
appropriateplanningofinspectionsonthebasisofknownriskcriteria.
Severalreportsalsohighlightedothersituationswhereariskanalysismighthavebeenusedtoavoida
potentialaccident.Insixcasesitwasreportedthatadequateassessmentofconditionswasnot
conductedpriortorepairwork.Ingeneralthistypeoffailureisprimarilyassociatedwithneglecting
tofollowgoodpracticeforperforminghotwork.
Insevencasestherewereobservationsintheassociatedreport(s)concerningdetectionand
mitigationmechanismsthatcouldhavepreventedareleasefrombecomingaseriousaccidentifthey
hadbeeninplace.Aneffectiveriskmanagementapproachreliesonassigningappropriatetechnical
measurestoreduceandeliminatetherisks.Theseverityofconsequencesassociatedwithsome
cases,forexample,anaccidentoccurringduringaloadingoperationinwhich478tonnesoffuelwere
spilled,suggestedthat,inadditiontomeasurestopreventlossofcontainmentprevention,second
orderprotection,suchassensors,alarms,automaticshutoffcontrolsand/orotherpossible
measures,couldhavesignificantlyreducedtheimpactoftheevent.
Conclusions
Corrosioncontrolremainsaparticularlychallengingphenomenonintheefforttoreducerefinery
accidentrisks,furtherelevatedinmanyEUandOECDcountriesbytheaginginfrastructureand
variationincrudeoilsupplyandmarketconditions.Thestudyidentified40accidentsoccurringsince
2000,manyofthemserious,indicatingthatmajoraccidentsatrefineriesinvolvingcorrosionfailure
continuebeaparticularcauseofconcerninthe21stcentury.
Generally,significantcorrosionfailuresoccureitherbecausethehazardwasnotproperlyidentifiedor
thehazardwassubstantiallyignored.Itappearedfromthestudiesthatexpertssometimes
overlookedhowthevariouselementsofaprocesscouldcombinetocreatetheconditionsfor
acceleratedcorrosion.Thereisalsoaquestionabouthowmuchexperiencespecificallyinmechanical
integritydisciplinesisavailableatsomerefineriestodiagnosetheseproperly.However,there
6

appearedtobeanumberofcasesstudiedinwhichthecorrosionriskwasquiteobvious,andyetthe
managementchosetoignoreorunderestimateit.
Thestudyseemstoindicatethatoneofthemostimportantchallengesinmanagingrefinerycorrosion
isalsotheelementofchange.Alreadychangestoprocessdesignandequipmentposeachallenge
andneedacertaincompetencytoidentifyifanewcorrosionriskhasbeenintroduced.However,
otherchangesthatcanaffectcorrosionratesmaygounrecognizedandthusnotbeevaluatedforan
elevatedrisk.Inconspicuouschanges,suchaslossofexperiencedpersonnel,lackofknowledgeofthe
originalprocessandequipmentdesign,andagingequipment,canalsocreateriskandinthisregard,
therefinerysgreatestriskmaybechangeovertime.
Neglectingtoidentifyormanagecorrosionhazardsalsocontinuestobeaproblemonsomerefinery
sites.Someaccidentreportsarequiteclearthatthelessonlearnedwaslessaboutthetechnical
challengeofmanagingcorrosionbutsimplyabouthavinganeffectiveriskmanagementprogram.
Theworkofinspectionauthoritiesismostcertainlychallenginginthesesituations.
Inessencethisstudyprovidessomeevidencetoconfirmconcernsamongexpertsinbothgovernment
andindustrythattheriskofcorrosionfailurescausingmajoraccidentsremainsastrongareaof
concern.Inillustratingthekindsofdecisionsthatmayhaveledtocertainaccident,ortheseverityof
theirconsequences,itishopedthatinspectorsandrefineryengineerswhoarelookingtoimprove
theirawarenessofcorrosionriskswillhavegainedsomeknowledgethatwillhelpthemintheirwork.
Inaddition,itispossiblethatthefindingscanalsohelpkeyleadersingovernmentandindustrypoint
outthatcorrosionremainsasignificantrefineryhazarddeservingseriousandsustainedmanagement
attention.

CHAPTER 1

INTRODUCTION AND BACKGROUND

Petroleumrefineriesaregenerallyacknowledgedtobehighhazardsitesduetothenatureof
petroleumproductsandtheprocessingtechnologiesthatproducetheminthecurrentera.Forthe
mostpart,however,therisksarewellknownandrefineryoperatorshaveappliedconsiderable
knowledgeandresourcesoverthepastdecadestocontrolandminimizeriskpotential.Nonetheless,
majoraccidentsinrefineriestendtoregularlyoccurwithimpactsnotonlyonhumanhealthandthe
environment,butalsoinmanycasesonsocialandeconomicwellbeing.Arecurringcauseof
accidentsinpetroleumrefineriesiswellknowntobecorrosion.Thisreportstudiescorrosionrelated
accidentsinrefinerieswithintheEuropeanUnion(EU)andtheOrganizationforEconomicCo
operationandDevelopment(OECD),comparingaccidentoccurringbeforeandafter2000andwith
theviewtoprovidinginsightsintorecentcausaltrendsandidentifyinglessonslearnedthatcould
influencepreventionstrategiesinfuture.
ThisreportwasdevelopedonbehalfoftheEUCommitteeofCompetentAuthoritiesfortheSeveso
Directive(CCASeveso)1andOECDsWorkingGroupofChemicalAccidents(WGCA)whichmanages
theOECDProgrammeonChemicalAccidentsandconsistsofrepresentativesofOECDmember
countriesaswellasexpertsfromobservercountries,internationalorganizations,industry,labour,
andenvironmentalorganizations.TheEuropeanCommissionisrepresentedontheWGCAbyDGENV
andtheJointResearchCentresMajorAccidentHazardsBureau(MAHB).Inaddition,OECDmembers
contributeaccidentreportsonavoluntarybasistotheeMARSdatabaseofchemicalaccidents
managedbyMAHB.AlistofOECDMemberCountries,indicatingthosethatarealsoEUMembers,is
providedinTable2onpage12.
ThemajorityofEUandOECDcountriesarehosttoatleastonepetroleumrefinery,ifnotseveral,and
thosecountrieswithoutrefineriesallhavepetroleumstoragedepotswhosharesomeofthesame
storageandhandlingissuesasrefineries.OECDcountriesrepresentanestimated49.2%Error!
Referencesourcenotfound.ofglobalrefiningcapacity,andalltogetherEUcountries(includingnon
OECDmembers)representanapproximate18%ofglobalrefiningcapacity.[2]Studiesaboutcauses
associatedwithrefineryproductionandstorageremainhighlyrelevant.Moreover,itcanbeassumed
thatmostorallrefineriesinEU/OECDcountriesstrivetofollowcommoninternationalstandardsof
goodpracticeformanagingrefineryrisks.

Directive2012/18/EUoftheEuropeanParliamentandoftheCouncilof4July2012onthecontrolof
majoraccidenthazardsinvolvingdangeroussubstances.AllEUMemberStatesareobligedto
implementtheSevesoDirectiveintheirnationallegislation.
8

TABLE1.TOTALOILSUPPLY(THOUSANDBARRELSPERDAY)[1]

EU-27
Austria
Belgium
Bulgaria
Cyprus
Czech Republic
Denmark
Estonia
Finland
Former Czechoslovakia
France
Germany
Germany (Offshore)
Germany, East
Germany, West
Greece
Hungary
Ireland
Italy
Latvia
Lithuania
Luxembourg
Malta
Netherlands
Netherlands (Offshore)
Poland
Portugal
Romania
Slovakia
Slovenia
Spain
Sweden
United Kingdom
United Kingdom
(Offshore)
OECD
Australia
Austria
Belgium
Canada
Chile

2008

2009

2010

2011

2012

2647.227
27.35455
8.5207
3.51701
0.2
10.90856
290.3941
7.6
8.53291
-73.07799
124.8994
20.81967
--6.00839
36.9994
-0.45946
160.7857
0.9
10.04207
0
0.02
31.47712
34.07377
35.27595
6.96014
116.9844
10.30085
0.165
25.3903
8.4702
85.14396

2542.01
28.19153
12.60347
3.3409
0.2
10.38968
264.3081
9
9.54122
-76.31161
133.0608
23.72877
--6.41675
35.36659
-0.2957
145.5256
1.2
9.45376
0
0.02
37.83117
25.56438
34.24601
5.41664
112.6989
7.53781
0.145
29.48995
11.19146
87.38141

2413.188
28.71441
12.70007
3.58363
0.1
10.28301
249.4648
10
15.30335
-76.5425
125.0016
20.88219
--8.47986
34.45847
1.07504
156.1428
1.1
9.71077
0
0
34.84203
20.30137
28.65921
5.57404
107.1448
7.68135
0.405
28.75125
10.41947
87.13009

2162.712
30.39195
10.53035
3.38363
0.1
13.01232
226.2842
11
14.2309
-75.88213
141.0002
24.08767
--7.57805
27.64039
0.72561
152.7214
1
9.11077
0
0
40.98095
17.5863
28.33946
5.17594
105.3409
9.85793
0.305
28.45621
11.26664
82.65457

1992.969
29.48281
10.53035
3.38363
0.00847
10.00915
207.3841
11
13.5309
-72.30336
144.5077
25
--7.49677
27.9886
0.72561
154.5105
1
9.11077
0
0
54.7248
16.99727
27.68447
5.24991
101.6478
9.27711
0.305
29.29182
11.26664
86.17039

1502.864
20968.22
587.717
27.35455
8.5207
3343.577
12.12632

1422.145
21160.93
592.4863
28.19153
12.60347
3318.829
12.97693

1318.737
21505.25
604.1056
28.71441
12.70007
3441.73
18.42176

1084.068
21623.91
530.5067
30.39195
10.53035
3597.333
18.36149

922.3808
22571.73
519.065
29.48281
10.53035
3868.956
17.33709

Czech Republic
Denmark
Estonia
Finland
Former Czechoslovakia
France
Germany
Germany (Offshore)
Germany, East
Germany, West
Greece
Guam
Hawaiian Trade Zone
Hungary
Iceland
Ireland
Israel
Italy
Japan
Korea, South
Luxembourg
Mexico
Netherlands
Netherlands (Offshore)
New Zealand
Norway
Poland
Portugal
Puerto Rico
Slovakia
Slovenia
Spain
Sweden
Switzerland
Turkey
U.S. Territories
United Kingdom
United Kingdom
(Offshore)
United States
Virgin Islands, U.S.

2008

2009

2010

2011

2012

10.90856
290.3941
7.6
8.53291
-73.07799
124.8994
20.81967
--6.00839
0
-36.9994
0
-0.45946
4.023
160.7857
125.2716
33.6573
0
3184.164
31.47712
34.07377
65.27087
2463.917
35.27595
6.96014
0.66277
10.30085
0.165
25.3903
8.4702
3.65681
47.73348
NA
85.14396

10.38968
264.3081
9
9.54122
-76.31161
133.0608
23.72877
--6.41675
0
-35.36659
0
-0.2957
5.98119
145.5256
137.6242
54.65003
0
3000.791
37.83117
25.56438
61.02682
2352.555
34.24601
5.41664
0.53813
7.53781
0.145
29.48995
11.19146
3.87793
54.59644
NA
87.38141

10.28301
249.4648
10
15.30335
-76.5425
125.0016
20.88219
--8.47986
0
-34.45847
0
1.07504
5.839
156.1428
142.4722
58.47474
0
2978.599
34.84203
20.30137
60.77085
2134.621
28.65921
5.57404
0
7.68135
0.405
28.75125
10.41947
3.60576
57.75023
NA
87.13009

13.01232
226.2842
11
14.2309
-75.88213
141.0002
24.08767
--7.57805
0
-27.64039
0
0.72561
5.839
152.7214
136.257
59.78946
0
2959.989
40.98095
17.5863
52.17398
2007.35
28.33946
5.17594
0.8536
9.85793
0.305
28.45621
11.26664
3.61281
57.63345
NA
82.65457

10.00915
207.3841
11
13.5309
-72.30336
144.5077
25
--7.49677
0
-27.9886
0
0.72561
5.839
154.5105
135.5125
61.04358
0
2936.009
54.7248
16.99727
48.19111
1902.084
27.68447
5.24991
0.6737
9.27711
0.305
29.29182
11.26664
3.61281
56.65329
NA
86.17039

1502.864
8564.232
16.64497

1422.145
9133.129
16.76659

1318.737
9692.433
14.88036

1084.068
10135.55
14.88036

922.3808
11124.05
14.88036

10

TABLE2.NUMBEROFOPERATINGREFINERIESINOECDANDEUMEMBERCOUNTRIES[3][4][5]

OECDMembersOnly

OECDandEUMembers

Australia

Austria

Canada

18

Belgium

Israel

CzechRepublic

Japan

30

Denmark

Korea

Estonia

Mexico

Finland

Switzerland

France

12

UnitedStates

144

Germany

13

Norway*

Greece

Turkey

Ireland

Italy

16

EUMembersOnly

Luxembourg

Bulgaria

Netherlands

Cyprus

Poland

Latvia

Portugal

Lithuania

SlovakRepublic

Malta

Slovenia

Romania

Spain

Sweden

UnitedKingdom

11

TotalEU&OECD

317

*EuropeanEconomicArea(EEA)Member
EUCandidateCountry
.

11

1.1

Background

Chemical,refineryandpetrochemicalindustriesarecomplexlargeestablishmentsthatbynatureof
theiroperationsaresubjecttoanumberofhighriskfactors,amongthemthemaintenanceofthe
mechanicalintegrityofprocessandstorageequipment.Ithasbeennotedbyanumberofexperts
overtheyearsthatmechanicalintegrityconsistentlyremainsacontributortomajoraccidentsdespite
numerousgainsinknowledgeaboutvulnerabilitiesofrefineriesandhowtheycanbemanaged.
Theseconcernshavebeendrivenbyrecentaccidents,observationsfromthefieldbynumerous
governmentsafetyinspectors,andageneralawarenessofchangingconditionsinrefineries
potentiallyaffectingmechanicalintegritysuchasplantaging,thechemicalandphysicalpropertiesof
crudefeedstocksincurrentsupply,andothereconomicandmarketfactors.
Toillustrate,ofthe137majorrefineryaccidentsreportedbyEUcountriestotheEMARSdatabase2
since1984,around20%indicatedcorrosionfailureasanimportantcontributingfactor.This
st
proportionofrefineryaccidentsineMARSwiththisprofilehasremainedconstantwellintothe21
century.Consideringgainsinknowledgeinregardtobothcontroltechnologiesandriskmanagement
overthepast30years,theunchanginginfluenceofcorrosiononrefineryaccidentratesintheEU
couldbeconsideredasevidencethattheseexpertsconcernsarenotmisplaced.
Uncontrolledcorrosioncancausereleaseofhazardoussubstancesandcomponentsorcanreduce
boththeperformanceandreliabilityofequipmentuntiltheirfailure.Corrosionhazardscanputat
riskthesafetyandwellbeingofplantofbothplantemployeesandthegeneralpublicaswellaslead
toseveredamageofprocessunits,andinsomecasesshutdownofrefineryoperations.Thehuman
impact,fromdeath,injury,trauma,incomeorpropertylossresultingfromanaccidentcanbe
particularlydevastating.Thoughlessfrequent,theenvironmentalimpactswhentheyoccurtendto
besevereinanindustrywherehighvolumeproductionisthenorm.
Inparticular,theeconomicimpactofcorrosionphenomenaanditsconsequencesonrefineriesis
significant,takingintoaccountmaintenanceandrepaircostsandproductionlossfromplannedand
unplannedshutdowns.Assuch,indirectconsequencesassociatedwithshortandlongtermsocialand
economicdisturbances(e.g.,infrastructureoutages,jobloss,fuelpriceincreases)fromarefinery
accidentmaybeparticularlysevere.
Ofallpotentialimpacts,thefinancialimpactofcorrosionismostconsistentlyandalarminglyhigh.
Corrosioninrefineriesalsocansignificantlydecreasethefinancialefficiencyofthedifferentrefinery
processessincefailureofequipmentduetocorrosioncanresultinashutdownofallorpartofthe
facility.AccordingtoRuschauetal.,yearlycostsrelatedtocorrosionintheoilindustryhavebeen
estimatedintherangeof$3.7billionperyearintheU.S.Thisstudyalsoestimatedthattotalproperty
damagelossesfrommajorrefineryaccidentsbetween1972and2001equatedtoaround$5billion
(January2002dollars).Arefineryoperationmayhaveinexcessof3,000processingvesselsofvarying

TheMajorAccidentReportingSystem(MARSandlaterrenamedeMARS)wasfirstestablishedbythe
EUsSevesoDirective82/501/EECin1982andhasremainedinplacewithsubsequentrevisionstothe
SevesoDirectiveineffecttoday.ReportinganeventintoeMARSiscompulsoryforEUMemberStates
whenaSevesoestablishmentisinvolvedandtheeventmeetsthecriteriaofamajoraccidentas
definedbyAnnexVIoftheSevesoIIIDirective(2012/18/EU).FornonEUOECDandUNECEcountries
reportingaccidentstotheeMARSdatabaseisvoluntary.
12

size,shape,form,andfunction.Inaddition,atypicalrefineryhasabout3,200km(2,000mi)of
pipeline,muchofwhichisinaccessible.Someofthesepipelinesarehorizontal;somearevertical;
someareupto61m(200ft)high;andsomeareburiedundercement,soil,mud,andwater.The
diametersrangefrom10cm(4in)upto76cm(30in).[6]
SomecommongeneralconditionsassociatedwithrefineriesinEUandOECDcountriestodayare
believedtobeleadingtoanelevationincorrosionrisks,notablyaging,changesintheoverallrefinery
infrastructure,andthequalityofcrudeoilavailableinthemarketplace.Forexample,in2003Marsh
PropertyRiskConsultingindicatedthatlossesintherefineryindustrywerecontinuingtoincrease
mostnotablyduetoagingfacilitiesinthiscategory.[7]Agingwascitedasoneofthemostimportant
factorscreatingthepotentialforthedisasterthatoccurredattheBPTexasCityrefineryintheU.S.in
2005.Recently,aspateofguidanceandexpertrecommendationshavebeenproducedbymajoroil
refiningcountries,notablytheUnitedKingdomandFrance,onmanagingagingplantsandrefineries.
ThemajorityofrefineriesinOECDandEUcountriesareover20yearsold.
Demandandsupplytrendsintheoilindustryinthesecountriesalsohavegivenrisetoaconcern
regardingimpactsofreducedprofitmarginsonplantmaintenanceandnewinfrastructure
investment.Refineryprofitabilityisparticularlyvulnerabletomarketfluctuationbecausethe
operatorhaslittleinfluenceoverthepricingofbothinput(crudeoilfeedstock)andoutputwhichare
drivenbyworldwide,andtosomeextentalsoregional,markets.In2009profitmarginsforEU
refinerieswerereportedasthelowestobservedinfifteenyears.[2]
Thefallinprofitabilityhascausedseveralrefineriestoclose,acircumstancethatincreasesdemand
onremainingrefineries,someofwhichmaybeoperatingnearcapacitylimits.Notably,theEU,theUS
andJapanhaveexperiencedclosuresofmajoroilrefineriessince2008andmoreclosuresare
predictedinfuture.[8]Intheseregions,therefiningindustryhasmaintainedcapacitydemands
largelybyexpandingexistingfacilitycapacity,oftenbyincreasingthecapacityofindividualprocesses,
particularlythecrudedistillationprocess,andstorageunitsandtankstomanagegreatervolumes.[1]
Nonetheless,olderprocessunitsremaininuseoftenoperatingatanincreasedrateofproduction
thaninpastyears.
AtthesametimeintheEUregioninparticular,marketconditionshaveincreaseddependenceon
crudeoilfeedstocksthatareheavierandmoresulphurous,requiringmoreintenseprocessingwith
theaccompanyinghighercorrosionriskassociatedwithhigherproportionsofnapthenicacids.In
EuropeNorthSeacrudeproduction(fromNorway,UK,Denmark)fellfrom6.4to4.3millionbarrels
perdaybetween2000and2008.Overthesameperiod,thesuppliestoEuropeofheavier,
sourer/moresulphurous,crudesfromRussiaandAfricahavebeengrowing.Theresulthasbeenan
increaseintheproportionofheavyandsulphurouscrudespurchasedbyEUrefineriesandresulting
heavierprocessingdemands.[2]3[2]
AsnotedbyYeung,crudeselectionisthemostimportantdecisionrefinersmustmakeonadaily
basis.Thecompositionofcrudevarieswiththesourceandcansignificantlyimpactonthecorrosion
resistanceofrefineryequipment,andparticularlyinrefineriesthatweredesignedwithheavycrudes
inmind.Theoperatorhastoevaluatemarketcostssuchasoilsourcereliabilityandtermdeals,
deliveryadvantages,discountversusothercrudes,andproductdemandmixagainstthepotential
impactonoperationalcostsrelatedtoplantoperationalflexibility,potentialprocessingproblemsand

Thecorrosionriskisnotnecessarilylessenedinproductionofbiofuelsandsyntheticgaseswhere
variousconditionscanpresentpotentiallydifferentbutequallyseriouscorrosionrisks(e.g.,theuseof
chloriderichbiomassforbiofuelproduction).[9]
13

risks,mitigationoptionsandcosts,andenvironmentalconcerns.[9]Heavycrudecanthereforebring
changesinotherindirecteconomicforces,suchasprofitmargins,maintenancepractices(e.g.,
outsourcing),theavailability/relianceoninhouseexpertiseforcorrosionengineeringandthe
increasinglossofhistoricalknowledgeregardingthedesignandoperationalhistoryofolder
equipment.[10]4
Allthesefactorshaveraisedconcernsabouttheriskofaseriousaccidentduetotheelevated
presenceofcorrosionriskinrefinerysitesinEUandOECDcountries.Aseriousrefineryaccidentcan
havegraveimpactsonproductionalonewhichthreatenstheeconomicviabilityoftherefineryitself.
Moreover,numerouspastaccidentshavedemonstratedthepotentialforrefineryaccidentstocause
injuryanddeathtoworkersonthesite,environmentaldamagetonaturalresourcescovering,on
occasion,vastgeographicregions,threatenthehealthandsafetyofthecommunity,andsignificantly
disruptitsqualityoflifefordaysorweeksatatime.Thisstudyofcorrosionrelatedaccidentsin
refineriesexploreslessonslearnedfrompastaccidentsisintendedtoprovideinsightsthatmayassist
operatorsandtheenforcementcommunityinevaluatingvulnerabilityofrefineriestocorrosion
relatedrisksinfuture.

1.2

Aims of the Study

Overthepastfewdecades,avastamountofscientificliteraturehasbeengeneratedonthesubjectof
corrosioninprocessingandstorageactivitiesassociatedwithindustrialactivity,asignificantportion
ofwhichisdevotedtocorrosionspecificallyintheenergysector.Fromthesepublications,itis
evidentthatcorrosionsubdividesintoanumberofsubcategoriesofcorrosionphenomenawithvaried
andcomplexprofilesdependentonproductandequipmentcompositionandinteractionsaswellas
somefactorsindependentofoperationalactivity(e.g.,location,atmosphericconditions).The
corrosionpotentialinpetroleumrefineriesismadeinfinitelymorevariedandcomplexduetothe
additionalsize,variationandcomplexityofactivityinmostrefineries.Forthisreasonthereisa
concernthatcorrosioncontrolinEUandOECDrefineriesmaybeinconsistentlyeffectiveacrossthe
industryandgeographiclocationsincurrenttimes.
Asmallbutsignificantportionofcorrosionliteraturehasbeenaimedatsummarizingtheresearch,
lessonslearnedandtrendstofacilitatepracticalapplicationofcorrosioncontrolmeasuresinawide
varietyofindustrialsectorsandeconomiccircumstances.Notably,variousindustryassociations
associatedwiththeenergysectorhavemadesubstantialcontributionstothetheoreticalframework
andgoodpracticerecommendationsavailableforcorrosioncontrolinrefineries.Moreover,alarmed
byrecentaccidentsinolderrefineries,anumberofEUandOECDnationalgovernmentauthorities
haveinvestedeffortoverthelastseveralyears,conductingsubstantialscientificresearch,field
studiesandaccidentanalyses,inordertoassesstheextentandseverityoftheagingphenomenain
refineriesandhowtocontrolitsassociatedriskssuchascorrosion.

TheU.S.isanothersignificantOECDrefiningcountrythathasexperienceadowngradeinthequality
ofcrudeoilsupplyoverthelasttwodecades,withanassociatedimpactontheintegrityofitsrefining
infrastructure.However,infuturetheU.Smayeventuallybenefitfromgreateravailabilityoflighter,
lowersulphurfeedstocksasaproportionofitstotallysupplywiththeexploitationofshaleoil
reservoirs.
14

ThisreportcitesparticularpublicationsproducedbytheAmericanPetroleumInstitute(API),the
InstituteofChemicalEngineers(IChemE),theInstituteofEnergy(IE),theUnitedKingdomHealthand
SafetyExecutive(UKHSE),theFrenchNationalInstituteofEnvironmentandIndustrialRisk(INERIS),
theU.S.DepartmentofEnergy,theU.S.DepartmentofTransportation,theU.S.OccupationalSafety
andHealthAdministrationandNACEinternational.Whiletherearenodoubtothervalidpublications
thatthisreportignores,thesereportswereconsideredtobesufficientlyexhaustiveandrecentto
representthestateofthearttheoryandpracticeinEUandOECDcountries.Moreover,language,
accessibilityandprominenceofthesereportsasreferencesforrefineryoperatorsplayedarolein
definingthescientificreferencesforthisstudy.
Theseworksaddconsiderablevalueascataloguesofcorrosionandcorrosioninducingphenomena
andbyprovidinganincreasinglyrobustarsenalofeffectivecontrolstrategiesastimegoeson.
However,thedauntingtaskofprioritizingandprocessingthisinformationtominimizerisknecessarily
remainswiththerefineryoperator.Likewise,enforcementagenciesmustsiftthroughthiswealth
informationandwithrelativelylittletimeorotherresources,trytofindaneffectivefocusand
approachthatcangivemeaningfuloversightandassistancetotheoperatorsownefforts.
Withthisinmind,theauthorsofthisstudyaimedtoprovideinsightonthecollectiveknowledgebase
fromanotherperspective,thatis,usingaccidentdatarelatedtooneparticular,corrosioninrefineries,
tohelpoperatorsandinspectorstorefreshtheirknowledgeandperhapsalsofocustheirattentionon
particularaspectsassociatedwiththisphenomenon.Usingreportsfromanumberofopensources
overthelastfewdecades,theauthorsaimedtoidentifyrepeatedpatternsinaccidentoccurrences
bothintermsofspecificcausalfactorsandfailuresincontrolstrategies.
Theintentionisnotsimplytoreemphasizethesignificanceofsomeknownchallenges,forexample,
corrosionunderinsulationorthelackofsufficientprotectivecoating,butalsotoidentifypotential
failuresandopportunitiesregardingstrategicapproachestocorrosioncontrolthatmayberelevant
forfutureplanningofcontrolstrategies.Moreover,theanalysisalsocomparesfindingsbetween
accidentspreandpost2000toidentifywhethercertaincausalandcontrolfailuresmayhavebecome
moreorlessrelevantinrecenttimes.Itishopedthatthisinformationisofparticularassistanceto
inspectorsbyprovidingaconcisesummaryofrefinerycorrosionhazardsandexamplesofhowthey
havebeenmanifestedinpastaccidents.Thefindingsmaybealsousefultooperatorsinrenewing
aspectsoftheirriskmanagementstrategyortrainingpersonnelonhowtorecognizeandevaluate
potentialcorrosionrisks.

1.3 Corrosion as a major hazard concern for the petroleum

refinery industry

Corrosiondoesnotstandforasinglephenomenonbutisageneralizedtermtocoveradestructive
attackonametalasaresultofeitherachemicalorelectrochemicalreactionbetweenthemetaland
variouselementspresentintheenvironment.Forinstance,ironisconvertedintovariousoxidesor
hydroxideswhenreactingwiththeoxygenpresentinair/water,whenincontactwithamorenoble
metalsuchastinorwhenexposedtocertainbacteria.Theinternationalstandarddefinescorrosion
morespecificallyasaphysicochemicalinteractionbetweenametalanditsenvironmentwhich
resultsinchangesofthepropertiesofthemetalandwhichmayoftenleadtoimpairmentofthe
functionofthemetal,theenvironment,orthetechnicalsystemofwhichtheseformapart.[11]
Accordingtootherauthors,corrosionderivesfromthenaturaltendencyofmaterialstoreturnto
15

theirmostthermodynamicallystablestate.[12]Table3belowidentifiesfourbroadcategoriesof
refineryelementsthatcancontributetocorrosionrisk.
Corrosionofametaloccurseitherbytheactionofspecificsubstancesorbytheconjointactionof
specificsubstancesandmechanicalstresses.Dependinguponenvironmentalconditions,corrosion
canoccurinvariousformssuchasstresscorrosion,pittingcorrosion,embrittlementandcracking.
Theparticulartypeofcorrosionoccurringinaspecificcomponentcanoftenbedifficulttoclassify.
Forexample,severalformsofcorrosion(e.g.,galvaniccorrosion,pittingcorrosion,hydrogen
embrittlement,stresssulphidecorrosioncracking)arecharacterizedbythetypeofmechanicalforce
towhichthemetalcomponentisexposed.Itisnotwithinthescopeofthisworktoaddressindepth
eithercorrosionelectrochemistryortheidentificationofdifferentformsofcorrosion.Thebasicsof
corrosionmechanismsaredescribedasabasisforunderstandingtheconditionsthatmakecorrosion
riskshighlyrelevantforrefineryoperationsandmorespecificallytoprovidesomeinsightintothe
underlyingcausesofthecorrosioneventsleadingtotheaccidentsanalysedinthisreport.Also,
corrosionofcertainmetals(e.g.aluminium)enhancestheircorrosionresistance,butinthiswork
corrosionisassumedtobesolelyanundesirablephenomenon.

TABLE3.TYPICALREFINERYELEMENTSCONTRIBUTINGTOELEVATEDCORROSIONRATES
Refineryelement

Examples

Corrosivesubstancesinfeedstockoraddedor
producedinprocess

Hydrogenchloride,hydrofluoricacid,amines,sulphuricacid,
polythionicacidsandothersulphurcompounds,oxygen
compounds,nitrogencompounds,tracemetals,saltscarbon
dioxide,andnaphthenicacids

Refineryprocessesinvolvingextremesof
temperatureorvelocity

Distillation,desulphurization,catalyticreformers,fluidcatalytic
cracker,hydrocracker,alkylation

Localconditions

Ageofequipment,volumeandrateofproduction,atmospheric
conditions(e.g.,climate),plannedandunplannedshutdowns

Riskmanagementmeasures

Frequencyofinspection,riskassessmentandrankingpractices,
equipmentinventorymanagement,maintenanceandrepair
procedures,auditingandimplementationoffeedback,useof
safetyperformanceindicators

16

1.4

Description of accident report sources used in the study

Thisstudyofcorrosionrelatedaccidentsinrefineriesisbasedon99reportsofimportantrefinery
accidentsinwhichcorrosionofanequipmentpartwasidentifiedorsuspectedasbeingthekeyfailure
leadingtotheaccidentevent.Onlyreportslistedinopensourcesandproducedbyorwiththe
collaborationofpartiesdirectlyinvolvedintheaccidentinvestigationwereused.Therefore,witha
fewexceptions,onlinegovernmentdatabasesofaccidentreportswerethemainsourceofaccident
reports.Moreover,sincethestudywasconductedonrefineriesinaspecificgeographicarea,reports
thatdidnotspecifygeographiclocationoftherefinerycouldnotbeused.
Table4providesadescriptionofalltheprimarysourcesofaccidentreportsusedinthisstudy.When
available,officialinvestigationreports,orsummariesproducedbygovernmentorindustry,wereused
tosupplementinformationintheprimarysources.Mainstreammediareportscontaininginformation
onanaccidentwerenotconsideredsufficientlyreliabletechnicalsourcesforthisstudyandtherefore,
werenotused.
Somereportswerelistedinmorethanonedatabaseandsometimesadditionalreportsonthesame
accidentfromothercrediblesourceswereusedtosupplementthefirstreport(e.g.,anindepth
investigationreport,aworkshoppresentationoftheaccident).Sincereportingaccidentswith
significantconsequencestoeMARSiscompulsoryunderEUlaw,anyaccidentwithsignificant
consequencesrecordedintheFrenchnationaldatabase(ARIA)ortheGermannationaldatabase
(ZEMA)willalsobereportedtotheeMARSdatabase.
Theseparticularsourcesalsotendtocollectaccidentsbasedonreportingcriteriaorotherwisebased
onscreeningcriteriaappliedbythesource.Thisfactorwasconsideredtoprovidesomeadditional
weighttothelessonslearnedofferedbythecollectiveexperiencerepresentedbytheseaccidents.

FIGURE1.TOTALCASEDISTRIBUTIONBYCOUNTRY

17

ThestudycoversaccidentsreportedinEUandOECDcountriesoveraspanofnearlyfiftyyears,from
1965through2012.Thereisnoparticularstatisticalsignificanceintermsofvariationsinthe
frequencyorlocationofaccidentsstudiedperyearorgeographic.Notably,severalsourcesusedfor
thisstudy,includingeMARS,ARIA,MHIDASandLeesLossPreventionintheProcessIndustrieswere
allestablishedinthemid1980s.Fewerdatabasesrecordedsuchincidentspriortothisdateandin
anycasemuchofthedataarenotavailableinelectronicformwhichwastheprinciplesourceof
information.
Theaccidentsreportedineachyeararenotinanywayrepresentativeofatrend.Thevastmajorityof
EUandOECDcountrieshavenotconsistentlycollecteddataorreportsonmajorchemicalaccidents
overtheperiodbythisstudyorinsomecasesthedataarenoteasilyavailable.Insomecasesitis
possiblealsothatreportsmaybeavailableelectronicallybutnotinlanguagesknowntothestudys
authors.Forallthesereasons,thestudywaslimitedtothesourcesidentifiedinTable4suchthat
thereisasignificantoverrepresentationofaccidentsoccurringinJapan,Franceandtheother
EuropeancountrieswhowerepartoftheEuropeanUnionpriortoenlargementin2004(thesocalled
EU15)5andasignificantunderrepresentationofpotentialimportantchemicalaccidentsoccurringin
allotherEUandOECDcountries.WiththeexceptionoftheU.S.andJapan,findingasignificant
collectionofaccidentreportsfromOECDcountriesoutsidetheEUischallenging.

FIGURE2.ACCIDENTSBYYEAROFOCCURRENCE

Austria,Belgium,Denmark,Finland,France,Germany,Greece,Ireland,Italy,theNetherlands,
Luxembourg,Portugal,Spain,Sweden,andtheUnitedKingdom.
18

TABLE4.PRIMARYSOURCESOFACCIDENTREPORTSANALYSEDINTHISSTUDY6
Source

No.

Timespan

Comments

Geographical
coverage
29

eMARShttps://emars.jrc.ec.europa.eu
AccidentsreportedtotheEuropeanCommissionincompliancewithSevesoDirectiveAnnexVI
criteria.
ARIA(France)http://www.aria.developpementdurable.gouv.fr/

EU/OECD

47

AdatabaseoperatedbytheFrenchMinistryofEcology,Energy,SustainableDevelopmentlisting
theaccidentaleventswhichhave,orcouldhavedamagedhealthorpublicsafety,agriculture,
natureortheenvironment.Chemicalaccidentsarereportedthatmeetestablishedcriteria.

>1970
France,some
Germany&
UK/US

18

JSTFailureKnowledgeDatabasehttp://www.sozogaku.com/fkd/en/index.html

>1984;

CreatedbytheJapanScienceandTechnologyAgency.AmainpurposeincreatingtheFailure
KnowledgeDatabasewaspreciselytoprovideameansofcommunicatingfailureknowledge.

>1970
Japan

rd

LeesLossPreventionintheProcessIndustries,3 edition[13]

Firstpublishedin1980,thiscomprehensivesourceforprocesssafetymanagementintheprocess
safetyindustries.

>1911

Completenessandprecisionofdescriptionsvaries
considerably.Includesdetailsonsubstances,
consequencesandcost.
Concise,comprehensivetechnicalsummaries.
Reportsareverifiedbytechnicalexperts.

Selectedmajoraccidentsanalysedbyexperts.
Scenariodiagrammesinclude.

Wellknownoraccidentswithimportantlessons
learnedorsignificantimpactsonlifeand/or
property

Thistableonlycountscasesinwhichthereferencewasusedastheoriginalsourceforcasesstudiedthoughinmanycasesitturnedoutthatitwasnottheprimarysourceoftheinformation.Whenavailable,
originalinvestigationreportsorothermoredetailedsummarieswereusedwhenavailabletosupplementinformationonthesedatasources.Moreover,manyaccidentswererecordedinmorethanonesource
abovewithoftendifferentandcomplementaryinformationaboutthesameevent.
19


Source

No.

Timespan

Comments

Geographical
coverage
th

Marsh100LargestLosses,20 edition,19722001[7]

Everyotheryearthisinsurancecompanypublishesareviewofthe100largestpropertydamage
lossesthathaveoccurredinthehydrocarbonchemicalindustriessince1972.
MHIDAS

DatabasemanagedbytheGermanFederalEnvironmentAgencyofhazardousincidentsand
incidentsinprocessengineeringfacilities.

>1980
Germany

TheCSBisanindependentfederalagencyoftheUnitedStatesgovernmentchargedwith
investigatingindustrialchemicalaccidents.www.csb.gov

>1998

Mainlyasecondarysourceofinformationon
accidentsanalysedinthisstudy.

Concisetechnicalsummariesofchemical
accidents.

Comprehensiveanalysisbyexperts.

USA

LouisianaDepartmentofEnvironmentalQuality(LDEQ)

UnderU.S.law(EPCRAsection304),ifanaccidentalchemicalreleaseexceedstheapplicable
minimalreportablequantity,thefacilitymustnotifystateauthoritiesandprovideadetailed
writtenfollowupassoonaspracticable.
http://www.labucketbrigade.org/article.php?id=498

20

19592005
World

U.S.ChemicalSafetyBoard(CSB)

Lowlevelofdetail.Preciselossfigures.

World

MHIDASwasestablishedbytheU.K.Health&SafetyExecutivein1986,andprovideskey
informationonmajoraccidentsinvolvingchemicals.Itdoesnotappeartobeavailableanymore
ontheInternetfordownloading.
ZEMA(Germany)http://www.infosis.uba.de/index.php/de/site/12981/zema/index.html

19722001

20052008

Anadvocacygrouppostedanumberofofficial
companyaccidentreportssubmittedtothe
LDEQbetween20052008includingrefinery
accidentsinvolvingcorrosion.

FIGURE3.PERCENTAGEOFCASESINWHICHSOMELESSONSLEARNEDINFORMATIONCOULDBE
EXTRACTED

Alsoitshouldbenotedthatreportsvariedconsiderablyintheirdetail.Forexample,inmanycases
lessonslearnedpersefromanaccidentwerenotgiven(seeFigure3above)Inmostcasesthetypeof
accident(e.g.,toxicrelease,fire,explosion),location(pipeortank,processunit)andknown
consequenceswereprovided.IngeneraltheleastdetailwasprovidedinreportsfromtheMHIDAS
andMarshaccidentregisterswhiletheJapaneseFailureKnowledgeDatabaseandtheU.S.Chemical
SafetyBoardreportswereextremelydetailed.ARIA,ZEMAandeMARSweremoreuneveninthis
regard,butforthemostpartcontainednumerousdetailedreportsaswellassomereportswith
sparsedetail.Insomecasesalsomoredetailscouldbefoundforthesameaccidentinamore
extensiveinvestigationreportpublishedseparatelyonlineasanacademicstudyorbytheresponsible
competentauthorityitself.
Intheinterestsofidentifyingdifferencesandsimilaritiesovertime,thestudylooksatfindingsfrom
pre2000accidentstothoseofaccidentsoccurringin2000orlater.Inparticular,onaqualitative
basis,itremainsinterestingastowhethervarioustypesoferrorsorfailuresarerepeated(andto
whatdegree)inaccidentsreportedbefore2000andin2000andafterwards.Thecomparisonmay
alsorevealsomenewtypesoffailuresorerrorsbeingrecordedafter2000.Whileinitselfsuch
findingscouldnotbeconfirmedasatrendforexample,itcanbearguedthatinmanycasescertain
detailsarerecordedmorefrequentlyinrecentyearsduetobetterqualityreportingthecomparison
helpsidentifywhattypesoferrorsandfailuresremainrelevanttotodaysrefineries.Moreover,if
suchfindingsareanalysedincombinationwithexperienceandotherfindingsrelatedtosafety
managementinrefineriestoday,itmaybepossibletohavemorepreciseinsightonthepatternsthat
aremostrelevantfromthisanalyses.

21

1.5

Type of events and consequences of accidents

Becauseofthevolumeofflammableandexplosivesubstancestypicallypresentinrefineries,
scenariostendtoincludefiresandexplosionswithpotentiallyhighconsequencesifnotadequately
controlled.Inparticular,productionofhydrocarbonproductsleadstoahighpresenceofflammable
compoundsonsite.Notsurprisingly,therefore,nearly80%oftheeventsstudiedinvolvedafireor
explosion(seeFigure4below).Inaddition,asignificantamountoftoxicsubstancesmaybepresent
suchthatrefineriesarealsoexposedtotheriskofpotentialtoxicreleases.Manycrudeoilscontaina
significantpercentageofhydrogensulphidethatiseventuallyseparatedfromthecrudeandusually
processedtoproducesulphurforthemarketplace.Otherprocessesrequirethepresenceofsulphuric
acidorhydrofluoricacid(foralkylation)orammonia(toremovenitrogenfromthecrudefeedstock).
Infact,overonethirdoftherefineryaccidenteventsinvolvingcorrosionhavealsogeneratedtoxic
releases.Toxicreleasestothesoilwereslightlyhigherinrelationtotoxicreleasestowaterandair,
probablyresultingfromanumberofaccidentsstemmingfromtankandundergroundpipefailures
includedinthedatabase.
Releasesweremostoftenhydrogenandhydrocarboncompoundsincludingprocessgases,naphtha,
crudeoilandvarioustypesoffuels.(SeeFigure5onthenextpage).Thelargestreleasewas
estimatedtobearound100,000tonnesofcrudeoilfollowedby50,000tonnesoffuel.Hydrogen
sulphidewasthetoxicgasreleasedmoreoftenthananyother(16cases).Fewerthan10%of
accidentsinvolvedreleasesofothertoxicgasessuchashydrogenfluoride,carbonmonoxideand
sulphurdioxide.Thehighest(known)releaseofasubstancetoxictohumanhealthwas15tonnesof
furfural,followedby1tonneofsulphurdioxide.

FIGURE4.ACCIDENTSCLASSIFIEDBYTYPEOFEVENT7

Theremaybemorethanonetypeofeventperaccident.
22

FIGURE5.SUBSTANCESRELEASEDINREFINERYACCIDENTSINVOLVINGCORROSIONBYNUMBER
8
OFACCIDENTS
AsshowninFigure6onthenextpage,mosteventswereinitiatedbyaleak,ruptureorstructural
collapse.Aleakconsistsofareleasefromasmallopeningthatovertimefacilitatetheformationofa
poolofdangeroussubstancesthatmayeventuallycatchfireorexplode.Arupturegenerallyresults
fromaleakthatreleasesaflammablesubstanceinternallywhichovertimeincreasespressureand
explodesinsideapipeortank,causingarupture.Structuralcollapseisdefinedasanaccidentin
which,accordingtothereport,corrosionwasfirstmanifestedinthedestructionorcollapseofthe
unit(e.g.,collapseofthedistillationtower)ratherthaninalocalizedleakorrupture.Intheaccidents
studied,leakswerelesslikelytoleadtoexplosions(vapourclouds)thanrupturesandruptureswere
lesslikelytoleadtotoxicreleases.However,bothscenariosseemedtobeequallycapableof
resultinginafire.Twostructuralcollapseswererecorded.Oneoccurredafterthestartofthefirein
whichthedistillationtower,weakenedbycorrosion,collapsed.Intheotherthestructurecollapsed
firstandafirefollowed.

Anaccidentmayhaveinvolvedthereleaseofmorethanonesubstanceandtherefore,thetotal
numberofaccidentscountedinthefigureaboveexceedsthetotalnumberofaccidentsstudied.
23


EFFECT

TOXIC
RELEASE

LEAK
RUPTURE
STRUCTURAL
COLLAPSE
UNDECLARED
GRAND TOTAL

FIRE

EXPLOSION

UNDECLARED

28
9

24
18

10
19

0
2

0
2
39

1
2
45

0
0
29

0
0
2

FIGURE6.DISTRIBUTIONOFEVENTTYPEFOREACHTYPEOFFAILURE
Toevaluateimpacts,theauthorsdevelopedasimplifiedmethodologybasedontheEuropeanGravity
Scale.(SeeTable5onthenextpage).Thesimplifiedversioncombinessomecategoriesandcriteriaof
thegravityscaleforanalyticalpurposesandalsoinrecognitionofthesometimeslimitedconsequence
dataprovidedinsomereports.Inthecaseofenvironmentalimpacts,additionalcalculationswere
alsomadeonthedataprovidedtofacilitateaconsistentrankingofenvironmentalimpactsbasedon
thescale.9Usingthisconsequencerankingmethodology,theaccidentsstudiedappeargenerally
representativeofthetypesofhighriskscenariosthataretypicallyassociatedwithpetroleum
refineries.Mostoftheseeventswerenotifiedonthebasisofhighimpactsintermsofeffectson
humanhealthortheenvironmentorsignificantcosteithertotheoperatororintermsofoffsite
propertydamageordisruption.Asevidence,itisobservedthatnearly50%ofthereportsstudied
bothpreandpost2000werehighorveryhighconsequences.[SeeFigure7onthenextpage).
Accidentswithlowconsequencesrepresentmorethanathirdoftheaccidentsstudiedandalsothe
ratiooflowimpactaccidentstototalaccidentsremainedvirtuallyunchangedforpreandpost2000
accidentsstudied.

Inparticularenvironmentalimpactsarenotrecordedinaconsistentmanner.Thereportsstudied
citedenvironmentalimpactsoftenprovidedoneoracombinationofthefollowingasanindicatorof
impact:costofrestorationandcleanup,areaofcontamination,orvolumeormassoftherelease.To
facilitatecomparisonofenvironmentalimpactsbetweenaccidents,thestudyusedinformationfrom
thescientificliteraturetoestimateenvironmentalcostsfrommassorvolumeofthereleasewhen
suchcostswerenotavailable.Thepriceofcleanuppercubicmetreofcontaminatedsoilwas
providedbyKhanetal.[15]andastudybyEtkinwasthesourceofalgorithmstoestimatecleanupof
contaminatedwaterbodiesindifferentworldregions.[16]
24

FIGURE7.SEVERITYOFACCIDENTCONSEQUENCESPREANDPOST2000

TABLE5.CONSEQUENCERANKINGCRITERIA
For human consequences, production loss and public disruption, the scale approximates the European gravity
scale(condensedinto5categories).[14]Formaterialandenvironmentaldamage,levelofimpactwasassessed
usingalogarithmicscalefromLowtoHighforcostsstartingwith<10,000.

Deaths

VeryHigh

>100

Injuries

Material
Damage

Environmental
Damage

PublicService
Disruption

>1000

>1,000,000

1,000,000

>1month

High

11100

101 1000

100,001
1,000,000

100,001
1,000,000

1weekto1
month

Medium

010

11100

10,001
100,000

10,001100,000

1dayto1week

Low

110

110,000

110,000

>1day

None

25


SOURCE

VERY
HIGH

HIGH

MEDIUM

NONE/UN
KNOWN

LOW

GRAND
TOTAL

ZEMA

17
3
21
6
0
4
3
2
4

1
0
2
2
0
0
0
0
0

3
1
1
1
0
0
0
0
1

21
0
5
8
2
0
0
1
0

5
0
0
1
1
0
0
0
0

47
4
29
18
3
4
3
3
5

GRAND
TOTAL

60

37

116

ARIA
CSB
EMARS
JST
LDEQ
LEES'
MARSH
MHIDAS

FIGURE8.DISTRIBUTIONOFEVENTTYPEFOREACHTYPEOFFAILURE10
FromFigure8above,itcanalsobeobservedthatsomesourcesfocusedmoreexclusivelyonhigh
impactaccidents,inparticular,theMarshandCSBreports.Ontheotherhand,accidentsreported
withinARIA,JSTandZEMAincludealsoaccidentswithlowerimpacts,basedoncriteriaotherthan
damageseverity,e.g.,releasevolumeoreventduragion.EUMemberStatesmustreportmajor
accidentsatSevesosites(whichincludesallpetroleumrefineries)usingtheseveritycriteriainAnnex
VIoftheDirective.Therefore,eMARSisgenerallyassociatedwithpredominantlyhigherconsequence
11
accidentsreviewedinthisstudythatoccurredintheEU. AccidentsineMARSoccurringinFrance
andGermanywerealsorecordedinARIAandinZEMA(startingin1993),respectively.

10

Someaccidentswerereportedordescribedbymorethanonesourcesothenumberofsource
citationsexceedsthenumberofaccidentsstudied.
11
SomeEUaccidentsreportedinotherdatabases(e.g.,ARIA,ZEMA)maybeassociatedwithhigh
impactsinthisstudyeventhoughtheywerenotrequiredtobereportedtoeMARS.Thestudyused
anadditionalcriterion(productionloss)withrespecttoeMARStoevaluateseverity.Inaddition,the
studyusedcleanupandrestorationcostsratherthanareatoestimateenvironmentalimpacts.
26

Publicserviceinterruptionandpropertydamagewerethedominantconsequencesoverall.(See
Figure9below.)Takingintoaccountproductionlossaswell,57%oftheaccidentsstudiedwere
projectedtohaveasignificant(veryhigh)economicimpact.Notably,sixteenOECD/EUaccidents
resultedinshutdownofentireproductionunitsorentirerefineriesforweeksormonths.Twelve
accidents(12%)reportedthattherefinerywaspartiallyorcompletelyshutdownforaperiod.(Note
thatthisconsequenceislikelytobeunderreported.)AsnotedinTable6,estimatesofshutdown
timesrangedfrom10daystoapproximately240days.Inonereportashutdownofthehydrocracker,
desulphurization,andhydrogenprocessingunitsforapproximately7months(~210days)resultedina
30%reductioninproductiongeneratingabusinesslossestimatedatabout90,000,000forthe
refinery[7].

LEVEL OF
IMPACT
VERY
HIGH

DEATH

INJURY

PROP
DAM

ENVIR

PROD
LOSS

PUB
SRVC

NONE

5
0
2
0
0

4
0
0
2
0

8
1
1
16
0

32
4
3
13
1

13
0
2
6
0

41
2
5
31
8

Grand
Total

26

53

21

87

HIGH
MEDIUM
LOW

FIGURE9.LEVELOFCONSEQUENCEVS.TYPEOFCONSEQUENCE12

12

Theremaybemorethanonetypeofdominantconsequenceperevent.For8accidentsitappeared
thatminimalornoconsequencesresulted.
27

Whilelessthanonethirdofaccidentsstudiedinvolveddeathandinjuries,potentialhealthimpacts
remainhigh.Forexample,twoaccidentsaccountforthemajorityofdeathsandinjuriesrecordedfor
theaccidentsstudied.AsshowninTable6onthenextpage,intotalthenumberofdeathsreported,
onandoffsite,equals67,or0.68deathsperaccident.Thenumberofinjuriestotaled219or2.21per
accident.Evacuationnumberswerereportedlessfrequently,butintotal7500peoplewerereported
asevacuatedacrossthe99accidents.
Althoughtherehavebeennodeathsandonly19injuriesrecordedincorrosionrelatedaccidentsin
refineriessince2000,potentialforcatastrophichumanhealtheffectsfromanytypeofchemical
accidentinarefinerycannotbediscounted.Therehavebeenseveralfatalaccidents(relatedtoother
causesthancorrosion)occurringinrefineriesintheEUandOECDinthelast10years(andeveninthe
lasttwo),manyoftheminplantsseveraldecadesold.Thepotentialforacorrosionfailuretocausea
humandisasterappearstobeundiminished.
Environmentaldamagewasreportedfornearlyathirdofaccidentsandmainlyassociatedwithtoxic
releasestowater.Sixoutof14accidentsinwhichcleanupandrestorationcostswereprovidedor
couldbecalculated,theenvironmentalcosts(usualsoilorsurfacewatercontamination)werefairly
high.Oneaccidentaloneaccountedforenvironmentalcleanupandrestorationcostsof
approximately624,000,000.Eightaccidentswereestimatedtocostunder50,000andthefive
remainingaccidentsrangedfrom300,000to32,000,000.(SeeTable6onthenextpage.)

28

TABLE6.CUMULATIVETOTALSOFCONSEQUENCEFIGURESFORALLACCIDENTS

Category

#ofaccidents

Totalreported

Totalfatalitiesreported

67

Onsitefatalities

67

Offsitefatalities

Totalinjuriesreported

18

219

Onsiteinjuries

16

193

Offsiteinjuries

27

7450

Totalreportedpopulationevacuated

Totalmaterialcostsofaccidentsreported13

42

748,386,332

Onsitepropertydamage

10

172,712,786

8,235,999

165,164,253

14

698,615,706

10

1036days

Offsitepropertydamage
Operatinglosses

Estimatedenvironmentalrestorationand
cleanupcosts

14

Estimatedtimeoffullorpartialshutdown

13

Thetotalmaterialcostsrepresentthesumofpropertydamage,onandoffsite,andoperating
losses.Inmanycases,accidentreportsdidnotprovideabreakdownofthesecosts.Therefore,the
totalmaterialcostscategoryismuchgreaterthanifoneaddsupthetotalsofthesubcategories
(e.g.,onsitepropertydamage).Thesubcategoriesrepresentonlythetotalfigureforcaseswherethis
breakdownwasprovided.
14Temporaryshutdownwasmanagedasaconsequencein12casesbut2didnotspecifyatime
frame.
29

CHAPTER 2 ANALYSIS OF THE POTENTIAL

CONTRIBUTION OF PROCESS AND EQUIPMENT
CONDITIONS

Corrosionrepresentsaparticularlyrelevantrisktopetroleumrefineriesbecauserefineriestypically
haveseveralhighriskfactorsbecauseofthetypeofsubstancesandprocessesinvolvedinrefinery
operations.Otherlocalconditionsmayalsocontributetoanaccelerationinthecorrosionrate,
includingphysicallocationofequipmentandtheclimate.Moreover,certainoperatingconditionsina
refinery,bothnormalandabnormal,bytheirnatureareparticularlylikelytopresentfavourable
opportunitiesforacorrosionfailuretoinitiateachainofeventsleadingtoamajoraccident.The
accidentsreviewedinthisstudyconsistofseveralcaseswheretypicalconditionsconducivetoa
significantcorrosionfailureweresomehowoverlookedorifrecognized,sufficientmeasureswerenot
appliedtoavoidanaccident.Thischaptersummarizesthestudyfindingsinthecontextoftheprocess
andequipmentconditionswithknownriskpotential,highlightinginparticularthosewhichwere
identifiedasrelevantinanalysesofthecasesstudied.
Corrosioncanappearaseitheruniformcorrosionorlocalizedcorrosion.Uniformcorrosionisalso
knownasgeneralcorrosionandistheclassicformofcorrosioninwhichtheentiresurfacearea,ora
largefractionofthetotalarea,isaffectedbyageneralthinningofthemetal.Inchemicalprocessing
uniformcorrosionisconsideredtheleastdangerousformofcorrosionbecauseitiseasilyvisiblelong
beforeitisdegradedenoughtofail.Nonetheless,uniformcorrosionmaysometimesbeacauseof
accidents,forexample,inpipelinesthatareinremotelocations,underground,orotherwise,not
viewedfrequently,generalcorrosionmaycontinueforalongtimeundetected.
Conversely,therearenumeroustypesoflocalizedcorrosionthatarefarmoredifficulttodetect
withouttargetedeffort.Thus,consequencesoflocalizedcorrosioncanbemoreseverethanuniform
corrosionasfailureoccurswithoutwarningandoftenafteronlyashortperiodofuseorexposure.
Typically,localizedcorrosionoccursbetweenjoints(crevicecorrosion)orunderapaintcoatingor
insulation.Stresscorrosioncrackingandhydrogenassistedstresscorrosionarealsoformsoflocalized
corrosion.Theyareoftengroupedtogetherwithhydrogenembrittlementandstressembrittlement,
eventhoughthesearenotcorrosionphenomena,becausetheconditionsandtheresultingfailure
mechanism(cracksinthemetal)areremarkablysimilar.Assuch,itisnotnecessarilyeasyto
determinewhichphenomenoncausedsuchafailurefollowinganaccident;hence,bynecessity,
analysesofaccidentsinvolvingcorrosionrelatedfailuresgenerallyincludebothphenomena.
Generallyspeakingrefineriesarevulnerabletocorrosionbothduetointernalprocessconditionsas
wellasotherfactors.Inthemajorityofcasesstudiedforthisreport,itwaspossibletoidentifysome
ofthecausalfactorsandhaveageneralknowledgeaboutwhichoneswerelikelytobedominant.
Thefollowingsections,presenttheresultsoftheanalysisofcorrosionconditionsthatmayhavebeen
responsibleforequipmentfailureinthesecases.

30

2.1 Process conditions contributing to corrosion in study

cases
Refineriesaremostvulnerabletocorrosionduetointernalprocessconditions.Ironically,despitethe
existenceofseveralcorrosionreferencesandstandards,auniformapproachtodescribingand
organizingcorrosiontypesdoesnotexist.TheAmericanPetroleumInstituteRecommendedPractice
571(API571)listsover25commoncorrosiondamagemechanismstoindustrialactivityplus11
additiontypesthatarespecifictorefineries.[17]Inaddition,studiesofagingfacilitiesmayclassify
corrosioneffectsintodifferentgroupingsonthebasisofcharacteristicssuchasfailuremechanisms
(e.g.,wallthinning,crackingandfracture,physicaldeformation),commoncausalfactors(e.g.,stress
drivendamage,metallurgical/environmentaldamage)orothercommonalities.Table7onpages33
and34showsexamplesofsometypicalcorrosionphenomenainrefineriesasclassifiedinAPI571by
damagemechanism.15Thetableshowsonlyaportionofthevastnumberofcorrosionphenomena
identified.
In53casesprocessconditionswereidentifiedascontributingtothecorrosiveconditionspreceding
theaccident.Themostcommonlycitedcontributorwasthesubstance(46).Flow(eitherhigh,low,
turbulentorunequal)wascitedintencases,andtemperature(mostlyhigh,butinafewcases,low)
andpressure(mostlyhigh)werecitedascontributorsin11and7casesrespectively.Ineightcases
otherexacerbatingprocessconditionswerepresent,includingoperationoutsidedesignparameters
andvariationacrossprocesscycles.

N=99

FIGURE10.PROCESSCONDITIONSCITEDASCONTRIBUTINGTOCORROSIVECONDITIONS
ACCIDENTSSTUDIED (53CASESINTOTAL)

15

Notethaterosion/corrosionisincludedbecauseitissostronglyassociatedwithcorrosion.
However,severalothermechanicalandmetallurgicalfailuresnotlistedhereareacceleratedby
corrosionphenomena(e.g.,creepandstressrupture).
31

TABLE7.EXAMPLESOFSTRESSCORROSIONCRACKINGDAMAGEMECHANISMSPROPOSEDBYAPI571[17]16
DamageMechanism

Velocity,Temperatureand
pHInfluences

SubstancesInvolved

OtherInfluences

ProcessesAffected

MechanicalandMetallurgicalFailureMechanisms
Erosioncorrosion

Highvelocity,High
Temperature,High,LowpH

Varied

Particularlyoccursinpockets,
elbowsandsimilarconfigurations.

Affectsalltypesofequipmentexposedto
movingfluids,gasbornecatalyticparticles.

UniformorLocalizedLossofThickness(Generic)
Galvaniccorrosion

Atmosphericcorrosion

Lowtemperature

Coolingwatercorrosion

Lowvelocity,High
temperature

Varied
Cyclic:Fluctuationbetween
ambientand<or>temperature.
Freshorsaltwater,potential
chlorides

HighTemperatureCorrosion(Generic)
Sulphidation

Hightemperature

Sulphurconcentration

FCC,coker,vacuumdistillation,visbreakerand
hydroprocessing

HightemperatureH2/H2S

Hightemperature

H2 andH2S

Desulphurizers,hydroprocessing,
hydrotreaters,hydrocracking

Nitriding

Hightemperature

Nitrogencompounds

16

Thistableisbynomeansacompletelist.ItonlyshowsanumberofexamplesofsometypicalrefinerycorrosionphenomenaclassifiedanddescribedinAPI571.For
moreinformationpleaseconsultthereferencedocument.
32

DamageMechanism

Velocity,Temperatureand
pHInfluences

SubstancesInvolved

Otherinfluences

ProcessesAffected

UniformorLocalizedThicknessPhenomena(RefinerySpecific)
Aminecorrosion

Highvelocity/temperature

Ammonia,H2SandHCN

Higherturbulence

HCLcorrosion

LowpH

HCLwhenwaterisavailable
(presenceofoxidizingagents)

Crudeunit,hydroprocessingunit,catalytic
reformingunits

Highvelocity/temperature

HFconcentration+O2and
sulphur,higherpresenceof
watertoHFconcentration

Higherturbulence

HFalykylation,deadlegs

Naphthenicacidcorrosion Highvelocity/temperature
lowpH

Naphthenicacid,sulphur
content

Twophaseflow(liquidandvapou), Crudeandvacuumheatertubesandlines,
Highturbulence
cokers,pipingsystems

Phenolcarbolicacid
corrosion

Hightemperature

Sulphurandorganicacidsand
verydilutephenolsolutions

Sourwatercorrosion

Hightemperature,lowpH

HigherconcentrationsofH2S,
Oxygen

FCCandcokers

Phosphoricacidcorrosion

LowvelocityandpH

Solidphosphoricacidcatalysts,
freewater,contaminants

Polymerizationunits

heatexchangertubes,hydroprocessing,crude
andcokerunits,FCCunits,boilers

Hydrofluoricacid
corrosion

EnvironmentallyAssisted(Refineries)
Polythionicacidstress
corrosioncracking

Sulphur acids&oxygen

Chloridestresscorrosion
cracking

Hightemperature,pH>2

Chloridecontent,oxygen

Cyclicfluxbetweenwetdry
conditions,tensilestress

33

2.2 Analysis of cases in association with specific process

conditions

Thestudyalsoanalysedthecasestoidentifywhattypesofsubstances,processunitsandequipment
wereassociatedwiththeaccidents.AsnotedinSection2.1abovecertainsubstanceshaveproperties
thatmaycausethemtobecorrosiveagents.Table8onthenextpagehighlightssometypical
substancesthathavenotableinfluenceoncorrosionratesinvariousrefineriesdependingonthe
crudeoilinputsandtypesofprocessespresentInaddition,differentprocessesandequipmenthave
greaterorlessertendenciestobeassociatedwithacorrosionrelatedincident.Forthesereasons,it
wasconsideredinterestingtodeterminetheprevalenceofvariouscategoriesofsubstances,
processesandequipmentinassociationwiththeaccidents.Althoughtrendsidentifiedcouldnotbe
consideredconclusive,becauseofthenonrepresentativenatureofthedata,itisstillworthnoting
howfrequentlysometypicalassociatedcausalfactorsappearinthedata.Afundamentalingredient
ofcorrosionisexposuretoacorrosiveagentviaarefineryprocess,thatis,asubstancethatunder
certainprocessingconditionsactsuponthemetalandweakensit.Thesecorrosiveagentsarein
effectoxidizingsubstances,whichmayincludewater,avarietyofacidcompoundsintroducedor
generatedintheprocessaswellasthecrudeoilandfinalandinterimproducts,suchascokeand
kerosene.AsnotedinTable7inthepreviouspages,somesubstanceshaveuniquecorrosion
signatures,thatis,thecorrosionproducedischaracterizedbyaparticularspecificvisualortextural
pattern,reactswithspecificmetalcompounds,andfrequentlyoccursinthesametypesoflocations.
Figure11onpage36indicatesthefrequencywithwhichvarioustypesofsubstanceswerecitedinthe
accidentreportsaspotentialagentswhichmayhaveacceleratedcorrosionratesultimatelyleadingto
equipmentfailure.Outof96cases,49(51%)identifiedtheprocesssubstancesthatweremostlikely
toberesponsibleforacceleratingthecorrosionrateoftheequipmentinvolved.
Substancescitedmostcommonlyweresulphurandsulphurcompoundsandwater(14caseseach)
followedbyhydrogensulphide(11cases),alongwithcrudeoil(8cases),asnotedinFigure11.The
substancesidentifiedinFigure11fromtheaccidentsstudiedarenormallypresentinthehighest
volumesandinavarietyofprocessesthroughoutarefinerysite.Carbonisanothercommon
corrosiveagentwithanimportantpresenceinrefineriesbutitwasnotmentionedasbeinginvolved
inanyoftheaccidentsstudiedforthisreport.

34

TABLE8.TYPICALPROCESSSUBSTANCESASSOCIATEDWITHREFINERYCORROSION
Substance
Crudeoil

Naphthenic
acid

Sulphur
compounds

Hydrogen

Water

Hydrofluoric
acid

Ammoniaand
ammonia
compounds
Carbonand
carbon
dioxide

RoleandSignificance
Crudeoilsconsistofmanydifferenthydrocarboncompoundsandvaryconsiderablydependingontheir
source.Crudeoilsrangeinconsistencyfromwatertotarlikesolids,andincolorfromcleartoblack.An
"average"crudeoilcontainsabout84%carbon,14%hydrogen,1%3%sulphur,andlessthan1%eachof
nitrogen,oxygen,metals,andsalts.[18]Therefiningindustrydifferentiatescrudeoilsinanumberof
waysinrelationtotheirpredominantproperties.Forexample,theycanbegenerallyclassifiedas
paraffinic,naphthenic,oraromatic,basedonthepredominantproportionofsimilarhydrocarbon
molecules.Theyarealsooftenclassifiedassweetorsouronthebasisofsulphurcontent.Refinery
crudefeedstockoftenconsistsofmixturesoftwoormoredifferentcrudeoilsandthestockislargely
influencedbyregionaleconomics,inparticular,wheretheclosestsourcesofcrudeoilarelocated.
Naphthenicacidisthegenericnameusedforalloftheorganicacidspresentincrudeoilsandthistypeof
acidcanbehighlycorrosive.Naphthenicacidcorrosionoccursprimarilyinhighvelocityareasofcrude
distillationunitsinthe220Cto400C(430Fto750F)temperaturerange.Whencombinedwithhigh
temperatureandhighvelocity,evenverylowlevelsofnaphthenicacidmayresultinveryhighcorrosion
rates.Thepresenceofnaphthenicacidandsulphurcompoundsconsiderablyincreasescorrosioninthe
hightemperaturepartsofthedistillationunits.[6]
Aftercarbonandhydrogen,sulphuristypicallythemostavailableelementonarefinerysite.Sulphurs
maybepresentincrudeoilashydrogensulfide(H2S),assulphurcompounds,suchasmercaptans,
sulphides,disulphides,thiophenes,andpolythionicacids,oraselementalsulphur.Infact,allhigh
temperaturesulphidationiscausedbyhydrogensulphurandtherateofcorrosionviasulphidation
dependsonthedegreetowhichallthesulphurcompoundsinthecrudefeedstockdecomposetoH2S.
OvertheyearstheaverageconcentrationofsulphurinthecrudefeedstockinOECDEUrefinerieshas
beenrisingforatleastadecadeandthistrendhascontributedtopotentialincreaseincorrosionrisk.
Hence,regardlessofthetypesofprocesseshostedbytherefinery,mostrefineriesarevulnerablein
varyingdegreestooneormoreformofcorrosionassociatedwithsulphurthroughouttheplant.
Hydrogenisplaysaparticularlyimportantroleintheremovalofimpurities,mostnotablyinthe
hydrotreatingandhydrocrackingprocesses.Theprocessingofheaviercrudeoilandstricter
environmentalregulationshasincreasedtheuseofanddemandforhydrogeninrefineriesinrecent
years.Accordingtoonesource,asrecentlyas2008petroleumrefineriesaccountedforapproximately
90%ofglobalhydrogenconsumption.[19]Atelevatedtemperaturesandpressures,hydrogencanhavea
corrosiveeffectoncarbonandlowalloysteels.Typicalcorrosionphenomenaresultingfrompipeline
exposuretohydrogenunderintenseprocessconditionsincludesgalvaniccorrosion,hightemperature
hydrogenattack,chemicalreactionsofmetalwithacids,orwithotherchemicalsasinsulfidestress
cracking.Althoughhydrogenembrittlementandblisteringarenotcorrosionmechanisms,theymay
createsimilarweaknessesinthemetalleadingtomaterialfailure.Expertknowledgeisoftennecessary
todistinguishthespecifichydrogendamagemechanism(s)responsibleforaparticularequipmentfailure.
Waterisassociatedwithcorrosionasaconductorofpotentiallycorrosiveagentsbutalsoasacatalystfor
generatingcorrosiveagents.Thepresenceofthechlorideioninthecrudeoil(frombrinywater),cooling
waterthathasbeenrecycledandpickedupvariousoxidizingagentsorthatthathasbeenpretreated
withchlorine(e.g.,fromthepublicwatersupply).Thecorrosivityofthewaterthereforevariesgreatly
dependingonitsorigin.Waterisalsoassociatedwiththeformationofcorrosiveagentssuchas
hydrochloricacidandacceleratingtheircorrosivebehavior.
Theaqueoussolutionofhydrogenfluoride(hydrofluoricacid)isaweakacidasthehighstrengthof
hydrogenfluorinebondsdonotallowcompletedissociationwithwater.Hydrofluoricacidisusedasthe
catalystofrefineryalkylationwhichfacilitatesthereactionoflowolefins(typicallybutene)and
isoparaffins(typicallyisobutane)toformhigherisoparaffins.
Asmallpercentageofcrudeoilconsistsofnitrogencompoundsaswellasammoniachlorides.These
productsaregenerallyextractedandprocessedtoproduceammonia.Ammoniumchlorideand
ammoniumsulphatesarecorrosive,asgas,assolid,orinsolutionandareofparticularconcern(butnot
limitedto)distillation,hydrotreating,hydrocracking,catalyticreforming,andcatalyticcrackingprocesses.
Carbondioxideisfoundintraceamountsincrudeoilandalsoincondensateandproducedwater.Itis
releasedfromcrudestypicallyproducedinCO2floodedfieldsandcrudesthatcontainahighcontentof
naphthenicacid.Whencombinedwithwater,carbondioxideproducescarbonicacid(H2CO2),whichis
highlycorrosivewithsteelandothermetallurgies.Conditionsalsoexistinrefineries(hightemperatures,
amplecarbonsources)thatareconducivetocarburizationanddecarburization.

35

FIGURE11.PROCESSRELATEDSUBSTANCESCITEDASCONTRIBUTINGTOCORROSION
17
FAILURES
Ammoniaandammoniacompounds,chlorineandchlorideions,andhydrogenwereeachcitedin
eightcasesasapotentiallydominantcorrosiveagentinfluencingtheequipmentfailure,mainlyinthe
distillationandstorageunits.Hydrogenchloridewasreportedasthecorrosiveagentintwoofthe
accidentsstudied.Onlyoneaccidentstudiedidentifiedhydrofluoricacidasacontributingfactor.
Manyrefineriesdonotusehydrogenfluorideforalkylationandhence,thisriskisnotnecessarily
presentinallrefineries.Otherprocessrelatedsubstancescitedintheaccidentsincludedrecycled
content,phosphoricacidandnitrogenandnitrogencompounds.

17

Oneaccidentcouldincludemorethanoneprocesssubstanceasacontributortocorrosion.Hence,
thetotalfrequencyofallsubstancesaddedtogetherexceedsthenumberofcaseswherethis
phenomenonwasnoted.Waterwasonlycitedasacontributingsubstanceifitwasintroducedintoor
generatedbytheprocess.Wherewaterwasintroducedbytheexternalenvironment(e.g.,rain,
marineclimate),itwasnotcountedasaprocesssubstancecontributingtocorrosion.

36

FIGURE12.PROCESSSUBSTANCESCONTRIBUTINGTOCORROSIONFAILUREINASSOCIATION
18
WITHTHEPROCESSUNITOFORIGIN
Figure12aboveshowswhichprocessunitswereidentifiedastheoriginoftheaccidentinassociation
withprocesssubstancesindicatedascontributingtothecorrosionfailure.Althoughsomesubstances
arecitedslightlymorefrequentlythanother,thefrequencyisnothighenoughinanyoneunitto
indicatedominanceofaparticularsubstance.Rather,thisfigureillustratesthewidediversityof
substancesthroughoutrefineryproductionthatcanacceleratecorrosionrates.
Theaccidentsstudiedhighlightedavarietyofconditionsthatappearedtocontributetoaccelerated
corrosionratesleadingtotheequipmentfailure,including:
Acorrosiveagentwasformedbyareactionbetweenprocessfluids

Processconditionscausedecompositionofthecorrosioninhibitor

Corrosionwasinducedbythepresenceofsulphurandsulphurcompounds

Corrosionwasinducedbythepresenceofhydrogen

Corrosionwasinducedbythepresenceofhydrogensulphide

Corrosionacceleratedthroughcorrosiveagentsinprocesswater

ExamplesoftheseconditionsaregiveninFigure12onthenextpage.

18

Oneaccidentcouldincludemorethanoneprocesssubstanceasacontributortocorrosion.Hence,
thetotalfrequencyofallsubstancesaddedtogetherexceedsthenumberofcaseswherethis
phenomenonwasnoted.
37


FIGURE 13. O BSERVATIONSONPROCESSCONDITIONSRELATEDTOACCIDENTOCCURRENCE
Corrosiveagentformedbyreactionbetweenprocessfluids
Ananalysisconductedontheprocesswatersshowedthatinnormalconditionsthismediumislightlycorrosivetosteel
carbon,butstronglycorrosiveduringtheperiodwhenthecatalyzerisbeingcirculated.Thetransitionphaseofrecirculation
ischaracterizedineffectbyadiversionofthecontenttobereplacedbyrecirculationofthecatalyzer.Aninjectionoftorch
oilkeepsthecatalyzeratacertaintemperature.Thecombustionofsulphurinthetorchoilreleasesvapoursofsulphur
trioxideofwhichapartpassesbythereactortoendupatthetopoftheprincipalfractionatingcolumn.Incontactwiththe
processwaters,theSO3formsanacid(H2SO4)thatisparticularlycorrosive.Thiscorrosionisaccentuatedbyamechanism
ofcorrosionerosionattheelbowjoints(dripphenomenon).Therepetitionofrecirculationphasesledtotheeventual
formationoftheleak.[Case79]
Thecauseofcorrosionoftheheattransfertubewasassumedtobehydrogenchloride.Inaddition,thefollowingfactwas
provenasaresultofaflowanalysisintheheatexchanger.Atbothrightandleftsidesoftheupperstageofheattransfer
tubesineachpassintheheatexchanger,thequantityofwashingwaterdecreased.Therefore,washingwater,whichhad
beencondensedonce,wasreheatedandpartofthesolvedammoniumchloridewasreevaporatedandhydrogenchloride
wasgenerated.Inthisheattransfertube,thelowerpartinwhichliquidremainsbecomesanintenselycorrosive
environment."[Case62]
Anovalopeningof13090mmwascausedinbypasspipingofthehydrogensulfideabsorptiontowerforrecirculation
gasattheatmosphericfueloilhydrodesulphurizationunit.Internalfluidspouted,andafireoccurred.Ammonium
hydrosulfidewasformedbyareactionofammoniainthecrudeoilwithhydrogensulfideinthebypass.Theflowofinternal
fluidwasuniqueduetopipinginacolddistrict,noheatinsulationfortheflange,andaverticaldeadend,etc.The
environmentwithactivecorrosionbyammoniumhydrosulfidewaspartiallycreatedbydropsofwater.[Case69]
Processconditionscausedecompositionofthecorrosioninhibitor
Theoperatorobservedcorrosionontheinsideoftheinjectionpipeanditscarbonsteelmanifold.Thetemperature
conditionsandtheinjectionflowweresuchthatanunexpecteddecompositionoftheinhibitor,containingphosphorus
compounds,ledtoformationofconcentratedphosphoricacid,asubstancethatisbothveryhotandverycorrosivein
particulartoHastelloyB2alloyofwhichtheinjectionpipewasmade.[Case64]
Corrosioninducedbythepresenceofsulphurandsulphurcompounds
therupturewascausedbyfourtypesofdeterioration,theeffectsofwhichhadcumulativelyledtoareductionof
thicknesstoapointbelowthatatwhichthetubecouldwithstandoperatingpressure.
aggressionsupposedlyduetoexposuretopolythionicacids:Theseacidsformwhenthesulphurisedconstituentsofthe
loadareincontactwithoxygen.
reductionofthicknessbyoxidation/sulphuration:Inthegroovesformedbythepolythionicacidaggression,thematerial
(austeniticstainlesssteel)hadlostitsunoxidizablecharacter,leadingtoareductionofthickness
thepresenceofsigmaphase(anintermetalliccompoundcausingverymarkedfragilityofthemetal)inalowproportion,
whichmayhavefacilitatedthedevelopmentandpenetrationoftheintergranularattack.
lossofintergranularcohesionentailingslowcreepwhichgeneratesfissuringintheouterskinofthetube:thiscouldbe
explainedbypoorheatexchangeduetoadepositofcokeontheinsideofthetube.[Case74]
Corrosioninducedbythepresenceofhydrogen
Thedecompressionofadepropanisorandtheheadsphericaltank,throughtheopeningofapipeline,causedanunconfined
vapourcloudexplosioninafluidcatalyticcrackerCorrosionofanelbowpipeof8"incarbonsteellocatedat15mhighon
thepipelineofthedepropanisorfromhydrogenblisteringwassuspectedastheoriginoftheaccident.[Case18]
Corrosioninducedbythepresenceofhydrogensulphide
Therupturedbufferdrumhadbeenoperatedinawethydrogensulfidegaseousenvironmentforalongtime.Stress
corrosioncrackinggraduallyproceededduetothehydrogensulfideenvironment,andaruptureoccurredunderusual
operationpressure.[Case41]
Corrosionacceleratedthroughcorrosiveagentsinprocesswater
Itisdesirabletoavoidtreatmentusingwaterwithahighchlorideconcentration.Industrialwaterwasusedtodilutethe
polythionicacid.Therefore,thechlorideconcentrationwashighinthepolythionicacidaqueoussolutionthataccumulatedin
thedrainvalvenozzle.Inaddition,thechlorinewasconcentratedbytheevaporationofwaterduetohightemperatureafter
startingoperation,andSCCoccurred.Watermanagementusingindustrialwaterisabasicfactor,thoughtherewasa
possibilityofSCCduetochlorine.Thestresswasgeneratedbythermalexpansionatthegussetsupportingdrainpipingbya
temperatureriseafterstartingoperation.[Case9]

38

2.3 Corrosion risk associated with chemical refining

processes

Refineryprocessesgenerallyconsistofeitherrefiningortreatmentprocesses.Figure14belowisa
simplifieddiagramoftherefineryprocessshowingwhataremoreorlessthebasicunitshostedby
mostrefineries,althoughthetechnologiesappliedmayvary.Thecompositionofprocessunitsis
uniquetoeveryrefinery.Whileseveralprocessstepsarefundamental,suchasdistillation,cracking,
andremovalofimpuritiesandbyproduct,thetechnologyappliedtothesameprocessescanvary
considerablyacrossrefineries.Thecompositionofprocessdownstreamfromdistillationisalso
determinedbytherefineryschosenproductlines.Sometypicalrefineryprocessesaredescribedin
Table9onthenextpages.
Refiningprocesses,suchasdistillationandthermalcracking,breakdownandmanipulatethe
moleculesinthecrudeoilfeedstocktoconvertitintomarketableproducts.Treatmentprocesses
removeimpuritiesandbyproductsfromthefeedstockandrefiningoutput.Asmuchaspossiblethese
unwantedsubstancesareeitherrecycledintotherefiningortreatmentprocess(e.g.,hydrogen)or
soldasproductsintheirownright(e.g.,sulphur).Afterdesalting,thecrudefeedstockisfedintothe
distillationunit,thefirstmainprocessingoperation.Thedistillationprocessresultsinoutputof
heavierandlighterfractionsofpetroleumproduct.

FIGURE14.SIMPLIFIEDDIAGRAMOFAREFINERYPROCESS
(SOURCE : U. S. DEPARTMENTOFE NERGY ) [4]

39

TABLE9.TYPICALREFINERYPROCESSES
Process
Atmosphericand
vacuumdistillation

RoleandSignificance
Distillation(fractionation)ofthecrudefeedstockisthestartoftherefiningprocess.
Sinceitreceivesuntreatedcrudeoil,itisexposedtoallpotentialcorrosiveagentsand
theirprecursorsinthefeedstock.Notably,morethanonefifthoftheaccidents
studiedstartedinthedistillationunit.InastudyofcorrosionfailuresinanIsraelioil
companyfrom20012004,15%of210corrosionfailuresoverthatperiodwere
recordedindistillationunits.[21]
Likemanyrefineryprocesses,distillationisheatintensive.Temperaturesatthe
bottomaregenerallyaround350Cto400Candgraduallydecreaseasvapourrises
inthecolumn.Asthevapourrisesandcools,itseparatesintolayersofproductwith
theheaviestatthebottom(lubricatingoil,paraffinwax,fueloils)tolighterproducts
(middledistillates,kerosene)andlighterproducts(naphthas),asshowninFigureX.
Residueandheavyoilsatthebottomofthecolumnarefurtherdistilledviavacuum
distillationatareducedpressureandhightemperature.
AccordingtotheUSOSHATechnicalManual,vulnerableareaswithinthedistillation
processincludethepreheatexchanger(HClandH2S),thepreheatfurnaceand
bottomsexchanger(H2Sandsulphurcompounds),theatmospherictowerand
vacuumfurnace(H2S,sulphurcompounds,andorganicacids),thevacuumtower(H2S
andorganicacids),andtheoverhead(H2S,HCl,andwater).[18]Thetopsectionofthe
atmosphericdistillationtowerishighlyvulnerabletocorrosion.
Themostcommonsubstancesreleasedasaresultofacorrosionfailureinthe
distillationfailuretendtobehydrocarbons,includingcrudeoilandvariousdistilled
products.

Hydrotreating

Hydrotreatingisacatalyticreactionoccurringinthepresenceofhydrogenatelevated
temperatureandpressure.Itremovesobjectionablematerialsfrompetroleum
fractionsbyselectivelyreactingthesematerialswithhydrogeninareactorat
relativelyhightemperaturesatmoderatepressures.Theseobjectionablematerials
include,butarenotsolelylimitedto,sulphur,nitrogen,olefins,andaromatics.[22]
Thereareanumberofhydrotreatingprocessesusedinrefineries,oneofthemost
commonbeingdesulphurisationanddenitrogenation.Hydrotreatmentunitscan
experienceanumberofcorrosionphenomena.

Storagefacilities

Mostrefinerystoragetanksfallintothefollowingcategories:atmosphericstorage,
pressurestorage,andheatedstorage.Allthestoragetankaccidentsstudiedinthis
reportoriginatedinatmosphericstoragetanks.Allatmosphericstoragetanksare
opentotheatmosphere,oraremaintainedatatmosphericpressurebyacontrolled
vaporblanket.[23]InGroysmansstudy,22%ofthecorrosionfailurescited
originatedinstoragefacilities.[21]
Potentialconsequencesofatmosphericstoragetankfailurescanbeparticularlyhigh
duetotheirlargecapacity.Storagetankshavegenerallybeeninvolvedinsomeofthe
mostsevereaccidentsinEUandOECDcountries,mostoftenbecausetheyhaveledto
sizablefiressometimesrequiringanumberofdaystoextinguish.However,the
majorityofstoragetankaccidentsstudiedinvolvedpredominantlyenvironmental
impacts,duetoleaksorrupturesatthebaseofthetank.

Alkylation

Theprimarycommercialalkylationprocessesarehydrogenfluorideandsulphuricacid
alkylation.Ingeneralcorrosioninbothtypesofunitscanoccurifthevulnerabilities
arenotcontrolled.Notably,hydrogenfluorideishighlycorrosivetomostmaterials.
Carbonsteelisgenerallylessvulnerabletocorrosionviasulphuricacid,buthigh
concentrationsofthesubstanceandthebreakdownofsulphuricacidesters,orwhere
causticisaddedforneutralization,mayacceleratetheprocess.[6][24]

40

TABLE9:TYPICALREFINERYPROCESSES (CONTINUED)
Process

RoleandSignificance

Cracking

Thistermisgiventothoseprocessesthatconvertheavyoil(usuallyfueloilor
residues)intolighterproductstocksuchasLPG,naphtha,andmiddledistillatesby
applyingonlyheattothefeedoveraprescribedelementoftime.Thereareanumber
oftypesofcrackingtechnologiesincludingthermalcracking,hydrocrackingand
catalyticcracking.Therearealsoanumberofcatalyticcrackingtechnologies,
includingfluidcatalyticcracking(FCC),movingbedcatalyticcracking,andThermofor
catalyticcracking(TCC).Ofthesefluidcatalyticcrackingisthemostcommon.The
FCCisoneofthelargestdownstreamunitsandoneofthefewunitswhosesizeis
relativelyconsistentwiththesizeofthedistillationtoweracrossrefineries.FCCstend
tobefrom3540%ofthedistillationtower.TheFCCandthealkylationunits,
combined,supplyclosetoonehalfofthegasolinevolumesinrefineryoperations.
Hydrocrackingistheoldestcrackingprocessandoperatesnormallyatveryhigh
pressures,typicallyaround2,000psig.Assuch,ittendstoberathercostlyin
comparisonanditsuseinrefinerieshasdeclinedovertimeinfavouroftheFCC.[20]
[22]

Pipelinetransfer

Thesheervolumeofthepipelinenetworkinarefinerymakesitinevitablethatfailure
inpipelinetransferduetocorrosionishigh.Processandutilitypipingdistribute
product,processinputs,steam,water,andotherprocessfluidsthroughoutthe
facility.Theirsizeandconstructiondependonthetypeofservice,pressure,
temperature,andnatureoftheproducts.Vent,drain,andsampleconnectionsare
providedonpiping,aswellasprovisionsforblanking.[18]
Forpipelinenetworks,processconditionsarenotnecessarilythedominant
contributortocorrosiveconditions.Inparticular,exposuretowetclimate,weather,
acidrain,andsoilmaybegreatercontributorsinsomecasesthaninternalprocess
conditions.Severeaccidentsinvolvingpipelinetransferareoftenassociatedwith
loadingandunloadinginvolvingthetransferoflargevolumesacrossthepipelineina
shortperiodoftime.Asrecentlyas2008aspillof478metrictonnesofheavyfuel
intoamajorwaterbodyoccurredwhenthepipeleadingtotheoiltankerfailedasa
resultofcorrosion.

Isomerisation

Isomerizationconvertsstraightchainmoleculestotheirbranchedchaincounterparts
primarilytoprovideadditionalfeedstockforalkylationunitsandtoproducehigher
octanemoleculesforgasolineblending.Corrosionpotentialcanbeelevatedwhen
acidshappentobepresentinthefeedstock.

Coking

Cokingisconsideredtobethemostsevereprocess,involvinganumberofintense
physicalsubprocesses,includingfrequentheatingandcoolingcycles,necessaryto
breakupthelongchainhydrocarbonresiduefromthebottomofthedistilling
column.Thecokingunithasbeennotedasafrequentcauseofrefineryfires,
especiallyassulphurandmetalcontentofresiduesincreaseandacceleratecorrosion.
Notably,manyrefineriesdonothavecokingunits.[20][26]

Catalyticreforming

Thecatalyticreformerplantaimstoupgradelowoctanenaphthatoahighoctane
productthatmeetsantiknockingforblendingintomotorgasolinefuel.Aswith
cracking,catalyticprocesseshaveovertakenthermalprocessesastheprocessof
choiceintheindustryasthemorecosteffectiveoption.Catalyticreformingunit
consistsofaseriesofseveralreactors(e.g.,cracking,polymerization,
dehydrogenation).Thecatalyticreformermayoperateatloworhighpressures(50
200psi)andcanbecontinuousornoncontinuous(upto1000psig).Thereformeris
alsoamajorgasolineproducingunit,providingabout1/3ofthegasolinevolumethat
arefineryproduces.[20]

41

Thedistillationprocessisfollowedbyanumberofconversionprocessesdependingontheproduct.
Theseprocessesinclude:

crackingprocesses(e.g.,thermalandcatalytic)whichresultindecompositionoftheproduct

unification,e.g.,throughalkylationandpolymerisation,inwhichsmallerhydrocarbonsareto
makelargerones(unification)

alterationprocesses,suchasisomerizationandcatalyticreforming,whichrearrangethe
moleculesessentiallymodifyingthemolecularstructuretocreateorimproveproduct.[18]

Conversionisthenfollowedbytreatment,formulatingandblending.Treatmentremovesunwanted
substancesfromtheproduct,suchasimpuritiesandcontaminants.Formulationandblendingare
finishingprocesseswhichimproveandalterproductpropertiestomeetvariousqualityor
performancecriteria.Otherrefineryprocessesalsoexistforrecoveryandtreatmentofprocess
effluentandtorecovercatalystsandsubstancesextractedfromtheproductforotheruses.
Figure15belowshowstheprocessesmostoftencitedattheoriginoftheaccidentinthecases
studied.Ithighlightstypicalunitswhereimportantcorrosionfailuresmayoccur.Outof99cases,the
highestpercentage(23%)startedinthedistillationunit,followedcloselybyhydrotreatmentunits
(20%).Inthecasesstudiedthereweresubstantiallyfewercasesinvolvingsuchunitsafter2000
comparedtoprioryears.Conversely,thenumberofcasesinvolvingthepipelinetransfernetworkis
proportionallysomewhathigherafter2000.TheOthercategoryincludesunitsforsulphurrecovery,
solventextraction,saturatedgas,olefinmanufacturingandoilgasification.Thestudydoesnotshow
anypatternlinkingspecificunitswithaccidentconsequencesofaparticularlevelofseverity(see
Figure16onthenextpage).

FIGURE15.UNITOFACCIDENTBYORIGINOFCASESSTUDIED
42

FIGURE16.SEVERITYOFCONSEQUENCESASSOCIATEDWITHUNITOFORIGINOFACCIDENTS
STUDIED
Inadditiontotheseprocesses,therefineryalsohasadditionalsupportunits,manyofwhichexistoff
siteordistinctlyapartfromthemainprocessingoperations.Majorunitsoftenlocatedoffsited
includestorage,productblending,roadandrailloading,jettyfacilities,wastedisposal,andeffluent
watertreating.Tankfarmsandtransportpipelinestoremotelocationsaregenerallymostassociated
withrecurringcorrosionproblems.Notably,pipesandequipmentlocatedinmarineenvironments
maybeexposedtosaltyairexacerbatingthecorrosionprocessfromtheoutside.
Inthecontextofcorrosion,thefinancialimpactoflossofproductionisasignificantfactorintherisk
managementofcorrosioninrefineries.Therefore,whenlargeunitssuchastheFCCaretakenoutof
serviceforsometime,therefinerymayhavetorundistillationandotherunitsatlowerrates.The
physicalconnectionsbetweendifferentrefineryunits,storagelimitations,anddistributionsystem
limitationsformovingintermediatefeedstocksintoandoutofarefineryresultsindownstream
effectsaffectingtotalproduction.Forexample,inputstothedistillationtowermaybereducedwhen
theFCCunitisdowninordertoreducetheamountofFCCfeedstockbeinggenerated.Inaddition,
reductionindistillationtowerrunswillaffectcokingunitinputsunlesscokingunitfeedstockisnot
readilyavailableforpurchase.[20]

43

2.4 Involvement of refinery equipment in corrosion-related

accidents

Themagnitudeofapetroleumrefineryunitandthecomplexityoftheprocessesaresuchthatawide
varietyofequipmenttypescanbesubjecttocorrosiondependingontheprocess.19Ingeneral,the
pipelineinfrastructureandthepipeworkassociatedwithinaparticularunitand/orpieceof
equipmentarequitevulnerable.Storagetankfailurescanalsooccurduetocorrosionandgenerally
havehighriskprofilesduetothevolumesthattheymaycontain.Corrosioncanalsooccurinother
equipmentcomponentssuchastrays,drumsandtowers.AsillustratedintheRIMAPstudyof
equipmentvulnerabilitiesinEuropeanprocessandpowerplants(seeTable10onthenextpage),
someequipmenttypesaremorevulnerabletocorrosion,ortocertaintypesofcorrosion,thanothers
usuallyduetotheirroleintheprocess,thedesignofthepipework,orphysicallocationonthesite.
Sometimesfaultyrepairsorprocessredesigncanincreasecorrosionvulnerability.Hence,equipment
designandmaintenancepracticesarecriticaltocontrollingrefinerycorrosion.
Figure17onpage47showstheequipmentcomponentscitedintheaccidentcasesstudied.As
illustrated,corrosionfailureoriginatedpredominantlyinpipeworks,causing71%oftheaccidents
studied.Fiftypercentofaccidentsinvolvedtheinternalpipeworkoftheequipment.Asnotedinthe
previoussection,17%oftheoriginalfailurestookplaceinthepipelineinfrastructureoftheplantfor
transferbetweenunitsandtoandfromtransportmodes,and4%tookplaceintubesassociatedwith
heatexchangeandcoolingunits.Fifteenpercentoftheaccidentsoccurredinstoragetanks.Two
accidentsstartedinthereactorvesselandtheremainingaccidentsresultedfromcorrosionfailuresin
avarietyofcomponentsincludingapressurevessel,aflare,achimney,andadrum.Inafewcases
theequipmentcomponentwasnotclearlyspecified.
Variousfactorsmakesomeequipmentcomponentsmorevulnerabletotheaccelerationofthe
corrosionratethanothers.Configurationanddesignofequipmentplayaparticularroleincreating
opportunityforcorrosivedepositstoaccumulate.Functionandlocationcanalsodeterminethelevel
ofexposuretocorrodingagents.Integrityofcorrosionprotectionandrepairareapplicationsthatcan
alterthecharacteroftheequipmentwithanimpactonitsvulnerabilitytocorrosivefactors.These
factorsapplyequallytoanypieceofrefineryequipment(assumingtheyallhavemetalparts).
Failuresduetoequipmentdesignandcompositionarealsooftenlinkedwithagingplant
infrastructures.Asignificantbodyoftechnicalstandardshasevolvedformoderndesignand
constructionofprocessequipmentandpipelinesforpetroleumandpetrochemicalproducts,
providingdetailedguidanceonhowtooptimizeresistancetovariousstressfactors.However,many
ofthesestandardsmaynothavebeeninplacewhentheprocessunitwasoriginallybuilt.Inaddition
theequipmentmaynothavebeenbuiltforthesameprocessconditionsandoftenitisnotclearwhat
processassumptionswereusedintheoriginaldesign.

19

Notethatthissectiononlydiscussesthetendencyforelevatedratesofcorrosionfailurein
equipmentandequipmentcomponents.Itdoesnottakeintoaccountcriticalityofequipmentand
equipmentcomponentsintermsofpotentialaccidentconsequences.
44

TABLE10.CLASSIFICATIONOFTYPEOFDAMAGEVS.SYSTEMS/COMPONENTSINPROCESS
PLANTSFROMTHE RIMAPPROJECT [27]
Typeofdamage
I.

Damagespecificmechanisms

Wheretolookforitinprocess
plants

Corrosion/erosion/environmentrelateddamage,equatedtoorleadingto:

I.A.Volumetriclossofmaterialon
surface

I.A1Generalcorrosion,oxidation,
erosion,wearsolidparticleerosion

Heatexchangers,pipes,bends,
pumpsreactorvessels

1.A2Localized(pitting,creviceor
galvanic)corrosion

Heatexchangers,reactorvessels,
pipes,watertubes

I.B.

I.B1Stresscorrosion(chloride,
caustic,etc.)

Stainlesspiping,reactorvessels

I.B2Hydrogeninduceddamage
(includingblisteringhigh
temperaturehydrogenattack)

Crackers,columns,reformers

I.B3Corrosionfatigue

Dissimilarwelds

I.C

I.C1Thermaldegradation
(spheroidization,graphitization,
etc.includingincipientmelting)

Heatexchangers,reformers,
crackers,pipes,reactorvessels

I.C2Carburization,decarburization,
dealloying

Reformers,crackers

1.C3Embrittlement(including
hardening,strainaging,temper
embrittlement,liquidmetal
embrittlement,etc.)

Forgings,hotvesselsandpiping

II.

Mechanicalorthermomechanicalloadsrelatedorleadingto:

II.A

Slidingwear,cavitationalwear

Pumps,valves,condensers

II.B

Overloading,creep,handling
damage

Hotpiping,nozzles,TY
configurations(pipes)

II.CMicrovoidformation

Creep,creepfatigue

Hotpiping,reformertubes,reactor
vessels

II.DMicrocracking,cracking

Fatigue(HCF,LCF),thermalfatigue,
corrosionfatigue,thermalshock,
creep,creepfatigue

Rotatingmachinery

II.EFracture

Overloading,brittlefracture,
foreignobjectdamage

Vesselfailures,pipebursts,
reformertubes

45

FIGURE17.ACCIDENTORIGINBYEQUIPMENTCOMPONENT
However,inanyrefinery,therewillusuallybepointsatwhichthepipeworkfailstomeetthe
necessarydesignstandardsforanumberofreasons.Thesereasonsincludeage,processchange,
designchange,riskassessmenterrors,andpoorrepairandmaintenance.Notably,thislistcontains
someofthemostimportanttechnicalchallengesfacedbyrefineryoperatorsoverthelifetimeofa
siteandnotsurprisingly,thesevulnerabilitiesarecommoncausalfactorsforothermechanical
integrityfailuresbesidescorrosion.
Afewtypesofequipment,notablytheheatexchanger(anecessarycomponentofmanyprocess
units)andthestoragetank,arealsohighlycorrelatedwithcorrosion.Astudyperformedbythe
Britishgovernmentagenciesresponsibleforplantsafetyidentifiedpumps,compressors,furnaces,
orificeplates,injectionpoints,poorlysupportedsmallborepipework,pipework/equipmentunder
lagging,andburiedpipelines,asparticularlypronetoageingmechanismssuchascorrosion,erosion
andfatigue.[31]Groysmancalculatedthatabout60%oftotalsuchfailureswereassociatedwithheat
exchangers,condensers,pipelinesandtanksinhisstudyofIsraelirefinerysites.[21]Table11onthe
nextpageprovidesanumberofadditionalinsightsonpossiblefactorscontributingtocorrosion
failuresinequipmentfromanumberofstudiesofcorrosionandaginginrefineriesandprocess
plants.

46


TABLE11.FACTORSCONTRIBUTINGTOCORROSIONANDAGINGEQUIPMENTFAILURES
IDENTIFIEDINVARIOUSSTUDIES[28] [29] [30]

Noreinforcementofmountingplates
Removablecoversforchargingpurposes
Retentionareas,areasthatemergefrominsulation(drains,purgepoints)
Expansioncompensators
Weldsthatarecomplexorlikelytobeahometostressconcentrations,
Heterogeneousweldsormajororspecifictappingpoints
Lowpoints,e.g.,lowerendoftheradius,bends,bases
Segmentsthatarerepresentativeofcircularandlongitudinalweldedjoins.
Specificpointswherethereisalackofcontinuity
Supportsandends
Outdatedmaterials
Weldingquality,weldingdefectsandrepairs
Designfatiguelife/corrosionallowanceutilized
Corrosiveenvironments
Predictabledeterioration
Changeofservice(function,rate,etc.)
Failureofcathodicprotectionsystemsorlackofrecords
Poorconditionofpaintandsurfacecoatings
Repairs
Source:INERIS[28][29][30]

TABLE12.CORROSIONANDAGINGFAILURESASSOCIATEDWITHPIPEWORK[29] [30][31]
General
Complexwelds
Nozzlesofdiametergreaterthan50%ofthediameterofthedevice
Supportsorattachmentpointsonequipmentsubjecttovibrationorcyclesfatigue
Tapbasesandsupports
Impurityconcentrationareas
Taps,purges,drainsanddeadlegs
pesinternaltothesite
Defectiveormissinginternallining
Internalcorrosionthatisdependentonthefluid
Erosion,especiallydownstreaminjectionpointsorchangesincrosssectionorintightelbows
pesexternaltothesite(i.e.,connectingtotransportvesselsordistributionnetworks)
Externalcorrosion
Drippingfromapipelocatedabove,ordrippingviasupports(racksorpipesupports)
Corrosionunderinsulation(CUI),corrosionunderthepaint(paintjoints)
Undergroundpipingoronesthatareinsheathsandarehardtoinspect.
Corrosionunderprotectionotherthananticorrosioncoating(e.g.,heat,coldorfireinsulation)
Corrosionatground/airinterfaces,orsupportingareasthatmaycauseliningdamagebyfriction(e.g.,gravel)
andareasthatarehardtoaccessandassuch,theliningsmaybelesseffectivelyapplied
Internalcorrosion
Underdepositsindeadlegs.Deadlegsaresectionsofprocesspipingthathavebeenisolatedandnolonger
maintainaflowofliquidorgas
Alongsloplines.Sloplinesconsistofoffspecfuelthatisusuallyreprocessedintotheplant.Offspecfuelis
anoutputthathasfailedtomeetproductspecifications.Assuchitscompositionvariesconsiderablyandoften
unpredictably.
Sources:INERIS[28][29]andtheUKHealthandSafetyExecutive[31]

47

Pipework.Pipesarepresentinabundancethroughoutarefinerysiteasbasiccomponentsof
equipmentinfrastructureaswellasthechieftransportconveyancebetweenrefineryunitsandto
remotesites,externalfromthemainprocessingarea,andasadeliverymechanismconnectingto
externalpipelinesdeliveringtheproducttodistributionpointsandcustomers.Constructedofmetal,
oftenavariantofcarbonsteel,pipesaremoreorlessnaturallyvulnerabletocorrosionprocesses.
Hence,pipesarethevastmajorityofcorrosionvictimsinrefinerieswhethertheyfunctionasa
componentofapieceofequipmentorofaunit,orservicemultipleunitsortherefineryatlarge.
Technicallysimilarincompositiontopipework,tubesarehighlightedherein8cases(9%)separately
frompipeworktohighlighttheparticularnatureofsomeaccidentsoriginatinginheatexchangers,
ovensorfurnaces.Intotal24accidents,oroneoutofeveryfouraccidents,originatedineitherinthe
tubestructureorinotherassociatedpipeworkofheatexchangers,ovensorfurnaces.Theintensity
oftemperaturesandtemperaturefluctuationsintheseelementsareafactorthatcanacceleratethe
corrosionprocessinthepresenceofcertaincorrosiveagents.
Table12onthepreviouspagehighlightstypicallyvulnerabilitiescontributingtocorrosionandaging
failuresassociatedwithpipeworkinthechemicalprocessindustries.
Storagetanks.Whilenotasprevalentaspipeworkfailures,storagetanksofhazardoussubstancesare
wellrepresentedinmajoraccidentsintheprocessindustries,includingcorrosionrelatedaccidents.
Bothatmosphericandheatedstoragetanksareusedextensivelyinrefineries.Atmosphericstorage
tanksgenerallycontainfuelsandotherproductswithlowvaporpressure.Commonproductsstoredin
insulatedandheatedtanksincludeacidandsolvents,benzene,naphtha,liquidsulphur,sourwater,
andasphaltandrelatedproducts.Bothtypesarevulnerabletocorrosion.Table13onthenextpage
highlightsfindingsfromstudiesbytheUKHealthandSafetyExecutiveandtheFrenchgovernment
researchinstituteforindustrialriskonfactorscontributiontocorrosionandagingfailuresassociated
withatmosphericstoragetanks.
Inparticular,theconstructionofsuchtanksisdeceptivelysimpleandoldtanksaccordinglyremainin
serviceforalongtime.Thelongerthatatankisinservicethemorelikelythatfactorsassociatedwith
age,includingoriginaldesignandconstruction,andundetectedoruncorrectedwearandtear,orthe
storageofincompatiblesubstancescanunderminetankintegrity.Assuch,lessthanrigorous
inspectionissometimesconsideredamajorcauseofcorrosionfailuresinstoragetanks.[32]Exterior
corrosion,whethergeneralorlocalizedatcrevices,isveryeasytodetectwithanexternalinspection.
Internalcorrosionfromexposuretocorrosiveagentsintheproductinthevapourorliquidphaseis
generallymonitoredviaanumberofmeasurementtechnologiesdetailedextensivelyintherelevant
literature.

48

TABLE13.FACTORSCONTRIBUTINGTOCORROSIONANDAGINGFAILURESASSOCIATEDWITH
ATMOSPHERICSTORAGETANKS [28]

Corrosionbetweensteelsheetandwallwithwhichthesteelsheetwasincontact
Corrosiononfixedtankroofs(bycondensation)whichmayrequireachangeintheroof
Rainwaterdrains(shouldtheydevelopholes,hydrocarbonsleakintothedike)
Externalcorrosion(possiblyunderinsulation)
Foundationsettling(watercollectsunderthetank)
Externalcorrosionatthebottomofpanandbottomofpan
Corrosionofthesoldercoatbottom
Corrosiononbothsidesofthefloatingroof
Leakingroofdrains
Leakingjointsoffloatingroof
Crackscausedbyfatigueonfloatingroofs

Source:INERIS[28]

INERISstudiedanumberofaccidentsassociatedwithstoragetanksintheprocessingindustriesand
concludedthattanksofcrudeoilarevictimsofmoreaggressivecorrosionforcesthanotherrefinery
products.[28]Inparticular,crudeoilstoragetanksshouldbedesignedwithspecialmaterialsto
preventcorrosionresultingfromsulphurcontent.KeyfactorsfromthisINERISstudyaresummarized
inTable13above.Figure18belowprovidessomeexamplesoffromthestudyoftypesofcorrosion
damagethatcontributedtoaccidentsinvolvingstoragetankfailure.

FIGURE18.FIGURE18.DESCRIPTIONSFROMCASESTUDIESOFCORROSIONFAILURESIN
STORAGETANKS
Acircumferentialfissureinthebottomplatehasbeenobservedaftercleaning.Thisfissurehasalengthof
about10mandissituatedatabout2mfromthetankwall.Samplesofthebottomplatehavebeentakenfor
furtherinvestigation.Thisincidentfurthershowsthatinthebottomofstoragetanksgutterscanbeformed.In
thosegutterscorrosiveproductscanaccumulate,andcanresultinlocal,uniformcorrosion.[Case77]
2

Corrosionofvesselfloorresultinginaholeofapproximately20cm .Oilsandbaseofthetankwaswashedout
byescapingoil.Thecompanyhadanticipatedpinholeleakswouldappear.Itfailedtoattempttomeasurethe
extentofpittingcorrosionoritsrateofprogression.Tankexamination/inspectionschemedidnotanticipatethe
rateofcorrosionwhichwasencountered.[Case58]
Therewasaleakofkerosenefromthebaseofalargestoragetankintothegroundandgroundwaterbeneath
thetankandthesiteMovementofasmallwaterdrainpipeagainstasumpwallcausedthesurfaceprotective
coatingonthesumptobeeroded.Thebaresurfacethencorrodedandformeda10mmhole,throughwhichthe
660tonnesofkeroseneleaked.[Case78]

49

Pressurevesselsandotherequipment.Pressurevesselsareusedmostlyinprocessindustry,refinery
andpetrochemicalplanttocarryorholdliquid,gasesorprocessfluids.Theyaretypicallysubjectedto
pressureloadingandinternalorexternaloperatingpressuredifferentfromambientpressure.A
numberofrefineryprocessingunits,includingcrackers,cokersandreformers,includepressurevessel
equipment.Pressurevesselsaswellasothervesselssuchasdrumsandreactorsalsoarevulnerableto
anumberoffailuremechanismsincludingcorrosion.Nonetheless,onlyasmallnumberofthecases
studiedinvolvedthesetypesofequipment.Table14belowhighlightsconditionsthatmakepressure
vesselsvulnerabletocorrosionandothermechanicalintegrityfailuresaccordingtotheSafety
AssessmentFederation(SAFed).

TABLE14.PRESSUREVESSELSSUBJECTTOPOTENTIALLYRAPIDDETERIORATION

Contentswhichcauserapidcorrosion/erosion
Potentiallycorrosiveexternalenvironment
Vesselsubjecttosignificantvibration
Vesselsubjecttosignificantcyclicpressures,cyclictemperaturesand/orthermalshock
Safetyvalvesorotherprotectivedevicessusceptibletoblockage
Rivetedseams
Inwardlydishedends

Source:SAFed[33]

2.5 Frequency that various equipment vulnerabilities were

cited in the accidents studied

Figure19onthenextpageshowsthefrequencywithwhichvarioustypesofconditionsassociated
withtheequipmentwerecitedinthereports,individuallyorincombinationwithotherfactors,as
potentiallycontributingtoanaccidentevent.Thestudygroupedtheseconditionsinthefollowing
categoriesofvulnerability:

Materialcompositionofthecomponent

Configuration

Function

Location

Adequacyofanticorrosionprotection

Weldedparts

Mostofthesevulnerabilitieswereassociatedwithcorrosionfailureinpipeworkbutfactorssuchas
equipmentconfigurationadequacyofanticorrosionprotection,andweldedpartswerealso
associatedwithothertypesofequipmentashighlightedbyvariousobservationsinthereports
studied.(SeeFigure20onpage53.)Manyofthefactorscitedarecommonlyreferencedinthe
scientificliteratureaspotentiallycontributingtoaccelerationofthecorrosionrateunderparticular
conditions.Formoreinformationonwhythesefactorsaremorevulnerabletocorrosionforces,there
arenumerousscientificreferencesandarticlesintheliteratureoncorrosion
50

FIGURE19.TYPESOFVULNERABILITIESSITEDFORPIPEWORKANDPIPELINESCONTRIBUTINGTO
20

CORROSIONACCELERATIONOFEQUIPMENTINVOLVED

thatexplaintheparticularpropertiesandcircumstancethatmayresultinapotentialaccelerationin
thecorrosionrate(someofwhichareincludedinthelistofreferencesinthisreport).
Thestudyrevealedthatinninecases,theinadequacyofthematerialcompositionindesignorrepair
ofthepipecomponentwasconsideredacontributorfactortothecorrosionfailure.Sixcases
indicatedthatinfrequentusemayhaveresultedinareductioninthefrequencyofmonitoringand
maintenanceofanequipmentcomponent.Overallfailureoftheanticorrosionprotectionwascited
in16oftheaccidentsstudied.Corrosionfailurewasattributedtopotentialweldingerrorinnineof
thecasesstudied.Onlyfourcasesmentionedtheageoftheequipmentasacontributingfactor,
althoughinseveralreportstherewerealsoreferencestotheadvancedageoftheequipmentinvolved
intheaccidentwithoutcitingitexplicitlyasacontributingfactor.

Materialcomposition.Corrosionisanaturalprocessthatoccursinchemicalprocessingbecause
unstablematerials,i.e.,therefinedmetalsusedtocontainprocessliquidsandproduct,wantto
returntoamorestablecompound.Inninecases,theinadequacyofthematerialcompositionin
designorrepairofthepipecomponentwasconsideredacontributorfactortothecorrosion
failure.Pipewallthicknesswasalsocitedintwocases(2%).Inreality,choiceofmaterial
compositionissuspectedtobeamuchhigherfactorintheaccidentsstudied,butthisisoneof
manycausesthattendstobeunderreportedincorrosionrelatedaccidentreports.Inthese
cases,eithertheinvestigationdidnotexplorethiselementortheaccidentsummaryneglectedto
includethiscausalfactor(inwhichcase,manyotherdetailsareusuallyalsomissing).

20

Insomecasesmorethanonedeficiencywascited.Hence,thetotalfrequencyofallsubstances
addedtogetherexceedsthenumberofcasesinthisfigure.
51

FIGURE20.OBSERVATIONSFROMCASESONRELATEDEQUIPMENTCONDITIONS
Presence of an elbow joint

Thelinehadbeenpiercedatapartofanelbowatthe135Cpointfollowinganelbowof90C.Subsequent
inspectionshowedthatthepresenceoftheelbowscausedaturbulencewhichinturncreatedalocalised
depression.Thisconfigurationwasconducivetotheformationofdeposits(inparticularfollowingstoppagesof
thewaterflushingpump).Corrosionunderthedepositsdevelopedandeventuallyformedaholeintheline.The
elbowat90Cwascheckedbutnottheoneat135C.[Case51]
Accordingtopreliminaryexaminations,itseemedthattheparticularpipeconfiguration(2elbowsinsuccession
of3differentdimensions)wereinvolvedintheincidentofthissection,exacerbatedbythepresenceofa
corrosiveproduct(H2S),provokingtheformationofanatypicalcorrosionzone.[Case52]
Anordinarysteelpipelinehadbeenputintoplacein1960withathicknessof11mmandin1972thelinewas
inspectedandathicknessof8.5mmwasmeasured.Thereductioninthicknesswasattributedtocorrosion.The
rupturetookplaceinastraightportionofthepipebetweentwoelbowjointswhere,aftertheaccident,a
thicknessof0.8mmwasmeasured.[Case7]
AslowflowvelocityattheUfiguredpipingpartiallyseparatedhydrogensulfidewhichstayedintheupperpart
oftheUfiguredpipingsection.Itisassumedthatthefreehydrogensulfideatahightemperatureof350C
corrodedthepipingarea,andthehydrogensulfidethatleakedfromtheopeningignited.[Case63]
ExaminationoftheASMEA106(8"bore)x8mmgrade13steelpiperevealedthataplugofrustandsludge
(containing9.9%FeF2,8.1%FeF3and37.5%Fe2O3)accumulatedinbaseofashallowbend.TheretentionofHFin
thisplugcausedacceleratedinternalcorrosioninalocalizedzonearoundthesurfaceoftheplug.[Case16]
Corrosion affected by presence of welding

Therupturezonewaslocatednearanelbow,notfarfromthecompressordischarge.Afterexamination,itwas
notedthatthepipelinehadsignsofinternalcorrosion,notablyinthelowergenerator.Theholeoccurredina
zoneaffectedthermallybywelding.Measurementsofthicknessatvariouspointsrevealedthatcertainareas
werelessthanspecified.[Case59]
PreliminaryNBS[NationalBureauofStandards]testresultsindicatedthatthesubjectplatematerial(ASTM
A516,Grade70carbonsteel)oftheamineabsorberwassusceptibletohydrogeninducedcracking.Furthermore,
repairweldsthatweredoneinthefield,andthathadnotbeenstressrelieved,wereespeciallysensitiveto
amineinducedcorrosionandcracking.Takingallofthesefindingsintoaccount,itcanbeconcludedthatthis
failureoccurredbecausetheweldingprocedureusedwhenreplacingasectionofthevesselcausedthe
formationofahardmicrostructureintheweld.Thishardregionwassusceptibletohydrogenassistedcracking
resultingingrowthoflargecracksinthevessel.Theuncrackedmaterialinthevicinityoftheexistingcrackshad
lowtoughnessduetohydrogenembrittlementandfailedattheCOTD[cracktipopeningdisplacement]inthe
vesselarisingfromtheoperatingpressureandresidualstressesassociatedwiththeweld.[Case15]
Thepipingwasremarkablythinduetocorrosionfrominsideandoutside.Scaleadheringtothesurfacewas
detachedbecauseawatersealandaweldingrepairwerecarriedoutrepeatedly.Therefore,theopening
suddenlyexpandedandLPGblewout.[Case30]
Corrosion at a valve intersection

Inanatmosphericdistillationunitinnormaloperationafirebrokeoutinthedistillationcolumn.Thefire
occurredatavalveonthenaphthastripper.Thestripperwasinsulateduptothevalvelocation.Thenaphtha
escapedthroughaleakandspreadintotheinsulationwhichignited.[Case6]
Corrosion at a little used section of pipe

Exampleofcorrosionofunnecessarypipingleftforalongtime.Leakageofwatercontaminatedwithcrudeoil
fromacorrodedpartofpipingduringremovingoperationofunnecessarypipingleftforalongtime.Crudeoil
leakedonremovingunnecessarypipingatanoilrefinery.Thepipingwasusedfortransfertoarefiningunitfrom
acrudeoiltank.Ithadnotbeenusedforabouttwoandahalfyears.[Case27]
Theperipheralpartofthesystemisnotconsideredtobesoimportant,andinspectionandmanagementareapt
tobeinadequate.Thismightbeacauseoftheaccident.Theventpipingwashardlymaintainedduringoperation
managementbecauseithadnotbeenconsideredtobesoimportant.[Case11]

52

Ingeneral,thechoiceofthematerialcompositionofthepipeisanimportantdesignandrepair
decisionwhenthereisalikelihoodthatthepipeworkcouldbeexposedtoexperienceahigher
corrosionrateduetoprocesslocationorlocationonsite.Theseconsiderationsalsoshouldtake
intoaccountotherconditionsthatcouldcreatethepotentialforanelevatedcorrosionrate,
particulartheexternalatmosphere.Therealsocanbeapotentialforelevatedcorrosionrates
whendissimilarmetalsareplacedadjacenttoeachalongapipeline.Corrosionpotentialmaybe
exacerbatedbecauseofintrinsicincompatibilitiesbetweenthemetals.
Wallthickness,orcorrosionallowance,mayalsobeaddedtothedesignwhenacomponent
maybeexposedtoexcessivecorrosiveconditions.Therearestandardcalculationsforcalculating
theallowanceinaccordancewithparticularconditionsandtheexpectedcorrosionratesfor
varioustypesofequipment,materialsandconfigurations.Theabsenceofaproperallowancefor
certaincorrosiveconditions,particularinrelationtotheprocessorregularexposureto
potentiallycorrosivefluids,canbeconsideredanerrorindesignthatmaypotentiallyelevatethe
riskofmaterialfailure.

Function.Functionislargelycoveredintheprevioussectionrelatedtoprocess.However,a
relatedfactorcanbefrequencyofuse.Sixcases(6%)indicatedthatinfrequentusemayhave
resultedinareductioninthefrequencyofmonitoringandmaintenanceofanequipment
component.Thesecasesusuallyinvolvedpipeworkthatwasnolongerusedduetoaprocess
changeorbydesignitsservicewasrequiredinfrequently.

Configuration.Configurationofthepipeworkplaysastrongroleinthecorrosionprocess.Some
designfeaturescreateweakpointsinthesystemthatareparticularlyvulnerabletopotential
stresses,includingcorrosion.Theaccidentsstudiedidentifiedthefollowingspecificequipment
typesofsubcomponentswiththistendency:elbowjoints,valves,nozzlesandbranchpiping.

Theelbowjoint.Theelbowjointisthemostcommongeometricconfigurationinvolvedina
corrosionrelatedfailureinthestudy,notedin19%(18)ofallcasesastheoriginalsiteof
corrosion.Elbowjointshavepracticalandengineeringadvantagesbuttheyalsoare
vulnerabletocertaintypesofstresses,particularlyerosion/corrosion,lowofunevenflow,
vibration,andexternalpressurefromnaturalforcessuchaswindandfloods.Aslightly
higherproportionofthepre2000casescitedanelbowjointastheoriginofthecorrosion
failure.

Valves,nozzlesandbranchpiping.Intotal8differentcases(8%)referredtovalvesor
branchedpipingastheoriginallocationofthecorrosionfailure.Valves,nozzlesand
branchedpipeworkallrepresentpipeintersectionsthatarejoinedtothesystembyvarious
mechanisms,includingwelding.Whiletheconstructionanddesignofthesecomponents
variesconsiderably,itcangenerallybesaidthattheprocessofmakinganintersection
createsaweakpointinthepipesystem.Corrosionmaybeoneofseveraltypesofstresses
(e.g.,thermalfatigue,vibration)ontheintersectionthateventuallyloosensthejoinorthefit
oftheconnection,orcausesdeteriorationinthewallthicknessofthesubcomponent,both
ofwhichmayleadtoaneventuallossofcontainment.Corrosionfailuresoriginatingatvalves
andnozzleswasonlyreportedinaccidentsoccurringbeforetheyear2000.

Location.Asidefromprocesslocation,otherlocationfactorsalsomayaffectcorrosion
vulnerability.Inthisstudytwoadditionallocationissueswerehighlightedin13separatecases
(13%):exposuretotheexternalenvironmentandaccessibility.Inonecaseasectionof
equipmentpipeworkwaspoorlyaccessibleforroutineinspection.Sevencases(7%)concerned
pipesthatwereonthegroundorunderground,4ofwhichwereconsideredalsofairly
53

inaccessibleforroutineinspection.Pipelinestandardsgenerallyrecommendthatburiedand
submergedmetallicequipmentshouldhaveadequateprotectivecoating.Five(5%)cases
concernedpipessubmergedinwater.

Also,theinaccessibilityofundergroundandsubmergedpipesalsocontributestopotentialfor
corrosionfailure.Asinthreecases(3%)studiedforthisreport,pipesmayalsobeinaccessible
duetoplacementbehindotherbulkierpipesorequipmentparts.Althoughinherentriskmaynot
behigherintheirparticularlocation,pipesthatarelessaccessiblemaybemonitored
infrequently.Theycannotbenefitfromeventheoccasionalvisualcheckandroutinemonitoring
canbecostly.

Adequacyofanticorrosionprotection.Inadditiontomaterialandwallthickness,another
methodofcorrosionprotectionincludesprotectivecoatings.Protectivecoatingsometimesmay
beasimplecoatofpaintproperlyapplied.Zinccoatings,alsocalledgalvanizingareoftenapplied
tosteeltoimproveresistancetoatmosphericexposure.Othermethodsofcorrosionprotection
includeanodicorcathodicprotection,addingametalliningtothepipe,oraddingacorrosion
inhibitortothecorrosiveenvironment(forexample,toprocessfluids).Eachofthesemethods
failedinatleastoneofthecasesstudiedwithinsulationandcoatingcitedmostofteninthis
regard.[34]Overallfailureoftheanticorrosionprotectionwascitedin16(12%)oftheaccidents
studiedandwasthesecondhighesttypeofequipmentvulnerabilitycitedasacontributingcause
toanaccident.
Thethreecasesinvolvingcorrosionunderinsulation(CUI)werealsocountedasfailureofanti
corrosionprotection.CUIcanbecausedbytheingressofwaterduetopoorinstallationor
subsequentdamage.Sometimestheinsulationmaterialitselfmaycontaincorrosiveagentssuch
asfreechlorides.Otherconditionssuchashightemperatureflowmayalsoincreasetheriskof
anelevatedcorrosionrate.CUImaybeparticularlydifficulttodetectsinceitisnotoftenvisible
andcontrollingforitmaybeexpensive.[35]
AshighlightedinFigure21onthenextpagethecasesstudiedprovidedanumberofexamples
whereanticorrosionprotectionwasdeemedinadequate,including:
o Lackofprotectivecoatingonanundergroundsectionofpipeline
o Poorapplicationofantiprotectivecoating
o Deteriorationoforiginalprotectivecoating
o Protectivecoatingwashedawaybywaterinjectionupstream
o Protectivecoatingwashedawaybywaterleakfromoverheadpipesection
o Corrosionunderinsulation
o Anticorrosioncoatingononesectionelevatesriskofcorrosionontheadjacentunprotected
section
Weldedparts.Corrosionfailuresrelatedtodeficienciesinweldingrepairsarealsocited
frequentlyascontributingcausestorefineryaccidents.Weldmentscanbeincorporatedinthe
originaldesignorbeusedforrepairofalltypesofequipment.Corrosionfailurewasattributedto
potentialweldingerrorinnine(9%)ofthecasesstudiedinassociationwithequipment

54

FIGURE21.OBSERVATIONSFROMCASESONINADEQUATEANTICORROSIONPROTECTION
Lack of protective coating on an underground section of pipeline

Accordingtotheoperator,thissituationwasprobablyduetothelackofaprotectivesandbedaroundthe
pipeline.Smallpebbleswereineffectindirectcontactwiththepipelinewallandevenpiercedthepitchcoating.A
repairwasundertakeninvolvinginstallationofantileakcollarsinthezonesmostaffectedandinestablishinganew
coatofpitch.[Case68]
Poor application of anti-protective coating

Thebranchpipingformountingapressuregaugewasinstalledin1973.Afterwards,itwasnotreplacedalthough
externalcorrosionwasadvancingduetosplashesofseawater.Thebranchpipingwascheckedbyremovingpaint.
Onrepaintingafterthecheck,surfacetreatingsuchasrustremovalbeforepaintingwasinadequate.Forthis
reason,corrosionadvancedanditseemsthatalumpofrustpeeledoffbypressureatthetimeofloading,anda
holeopened.[Case37]
Deterioration of original protective coating

Asthewaterproofingofthehotinsulationofthepipingwasinadequate,seawaterinvaded.Thepipingwhichwas
notcoatedwithcorrosiveprotectionpaintcorroded.Scaleadheredtothepipingaboutamaximumof10mmthick,
andisregardedtohaveseparatedduetotheincreaseintheinternalpressure.30yearshadpassedsince
constructionoftheheatinsulation.[Case28]
Itislikelythatthelocalizationofthefissure,withrespecttothepointwhereitformed,islinkedtooneormoreof
thefollowingfactors:

localizeddamageintheoriginalpipecoating

materialdefectintheoriginalpipecoating

criticaloperativeconditions(ofthepipesectioninwhichthefissureoccurred)linkedtotheplacementof
thepipenearthegroundanditsexpositiontoatmosphericevents(seaair).[Case83]
Protective coating washed away by water injection upstream

Theextentofthethinningwasmappedandshowntobelocalizedtotheelbowandtoaslightdegreethe
neighbouringsectionsofpipe.Thepatternofthinningappearedtobedirectlyassociatedwiththewaterinjection
positionandthedownstreamflowpathofthewaterfromtheinjectionpointandaroundtheoutsideoftheelbow.
Themetallurgicalexaminationrevealedthattheuncorrodedsectionsofthepipewereinternallycoatedwithblack
ironsulphide.Thisisknownasapassivationlayerandonceithasformeditservestoprotectthecarbonsteelwall
materialfromfurthercorrosion.However,whenthewaterinjectionwasinoperationitwashedawaythe
protectivecoating,leavingitopentoattackbycorrosiveagentsinthegasstream.[Case66]
Protective coating washed away by water leak from overhead pipe section

Theoriginofthebreakinthispipelineseemstobelinkedtoanotherbreachofwaterpipelocatedabovethefuel
pipe.Theperpetualleakingofwaterontothefuelpipewouldhaveledinitiallytotheslowdegradationofthe
insulationprotectingthepipefromcorrosion.[Case17]
Corrosion under insulation

Theincidentwasprimarilycausedbyastructuralfailureofa200mmNBCarbonSteelfeedpipetothedehexanizer
columnonUnit35.Thepipewasinsulatedandtheexternalsurfaceofthepipewallbeneaththeinsulationhad
corrodedataregionwherewaterhadbeencollecting.Thecorrosionhadreducedthepipewallmetalthicknessto
alevelthatcouldnotsupporttheinternalpressureoftheprocessfluidsandamajorprocessreleaseoccurred.
[Case89]
Thebreakofa6inchespipewasthecauseoftheaccident.Anexternalcorrosionprocess,undertheinsulating
material,affected,seriouslyandinalocalizedposition,theinnerfaceofanelbowintheaerialpiperack.[Case97]
Anti-corrosion coating on one section elevates risk of corrosion on the adjacent unprotected section

Preliminaryfindingsindicatethatthepipelinewasrustedoutlengthwise.Measurementstakenoftheaircameup
negativeforhydrocarbons.ThepipelinewasmodifiedinJune1997inordertoprovidegreaterprotection.Ahalf
shellofresinwasprovisionallypaintedonthepipe.Theoppositeeffectoccurredwithcreationofanareaof
corrosionpreferencethatledtotherupture.[Case61]

55

pipework(4),storagetanks(2),thepipelinetransfernetwork(1),apressurevessel(1)anda
flare(1).Studiesconfirmthatweldmentsexperiencealltheclassicalformsofcorrosion,butthey
areparticularlysusceptibletothoseaffectedbyvariationsinmicrostructureandcomposition.
Corrosionsusceptibilitygenerallystemsfromthenatureofwelding,andtheweldingprocess.
Thenatureofweldingissuchthatthecharacteroftheweldedcomponentisalteredinsome
way,sothatthematerialcompositionandoftenthesurfacetexturearealtered,usually
becomingmoreheterogeneous,andtherebycreatinggreateropportunityforcorrosion.
Moreover,theprocessofweldingitselfisinvasiveanderrorsinmiscalculationinprocedurecan
alsoincreasecorrosionvulnerabilityoftheweld.Skilledweldingprofessionalsaregenerally
requiredtominimizetheriskofcommittingseriouserrorleadingtocorrosionfailures,and
potentiallycatastrophicevents,duetowelding.

Aging.Anumberofstudiesoncorrosionandagingplantshavereportedrecurringproblems
associatedwiththeagingofspecificequipmentorequipmentcomponents.Inthisstudy,only
fourcases(4%)mentionedtheageoftheequipmentasacontributingfactor,althoughinseveral
reportstherewerealsoreferencestotheadvancedageoftheequipmentwithoutindicatingitas
acausalelement.Whilecorrosionisoftenassociatedwithaging,itisnotoftenconsideredthe
maincontributortoacorrosionfailure.Inparticular,processconditionsratherthanaging
contributetoavastamountofcorrosionfailuresinrefineriesasevidencedbythisstudy.
Moreover,corrosionduetoagingisnotinevitablebutpassageoftimecanelevatetherisk.Inthe
absenceofanyotheraggravatingfactors,timelyinspectionandmaintenancecanbeeffectivein
minimizingthisrisk.

56

CHAPTER 3 ANALYSIS OF THE POTENTIAL

CONTRIBUTION OF RISK MANAGEMENT FAILURES

Duetothecomplexityandsizeofmostrefineries,itisnotlikelythatoperatorsofsuchsitescan
eliminatethepresenceofcorrosionrelatedhazards.Giventhesecircumstances,everyrefineryis
expectedtohaveanappropriateriskmanagementstrategytominimizetheriskswithadequatelayers
ofprotectionsupportedbyaneffectivesafetymanagementsystem.Itwasclearthatafailureinrisk
managementwasacontributingcausetothevastmajorityofaccidentsstudied.
Duetothevariationinreportingdetailandstyleacrossthecasesstudied,itwasnotpossibleto
analysetheriskmanagementfailuresassociatedwiththeaccidentsinasystematicway.Inparticular
theanalysesofthecausesinreportsarealwayssubjective,tendingtovaryonthebasisofthe
authorsknowledge(competenceaswellasavailabilityofinformation)andtheperceivedpurpose
andaudienceofthereport.Forexample,whileonereportmayemphasizethecontributionofthe
poorprocessdesign,adifferentreportofthesameaccidentmayfocusonthelackoffrequent
inspections.
However,itcanstillbeveryusefulfromthepointofviewoflessonslearnedtoidentifyhowmany
timescertaintypesofriskmanagementfailureswerecitedinassociationwiththecasesreviewed.
Becauseofthelimitationsalreadycited,suchobservationswillbequitebroad.Thestudywasableto
summarizepotentialriskmanagementfailuresintermsoffivegeneralcategories:

Inadequateawarenessorattentiontoknowncorrosionhazards

Inadequateriskanalysisatdesignandconstructionstage

Inadequateriskanalysispriortochange,whichisessentiallyalackoforfailureinthe
managementofchangeprocess

Failuretoidentifyoraddressprocessrisksinplanninginspections

Inadequateidentificationofhazardsandrisksforotherpurposes,suchassafeperformanceof
repairsandestablishmentofdetectionandmitigationsystems

Thefindings,whilequitebroad,giveverystrongsupportforarobustriskmanagementprogramme
guidedbyadequateriskassessmentatappropriatepointsintheprocess.Manycasesillustratethat
therewerenotadequatelayersofprotection,bothintermsoftheprocessandequipmentdesignbut
alsomitigationanddetection.Thereisalsosubstantialevidencethataninadequateor
malfunctioningsafetymanagementsystemwasalargecontributortothefactthatacorrosionfailure
occurredaswellas,inseveralcases,themagnitudeofitsconsequences.

57

3.1 Inadequate awareness of or attention to known

corrosion hazards

AquestionoftenaskedintheprocesssafetycommunityisWhydowecontinuetorepeatthesame
mistakes?ConsiderableprogresshasbeenmadeinthelastthreedecadessinceBhopalin
understanding,identifyingandquantifyingrisksandtechnologyhasequallymadestridesinproviding
solutions.Forrefineriesapartialexplanationissimplythatsignificanthazardsarepresentinsite
consistingofavastandcomplexnetworkofinterconnectedprocesses.Moreover,manyrefineriesin
theEUandOECDcountriesareold;theownershiphaschangedhandsatleastonceinrecentyears
andcrucialknowledgeaboutprocessriskshasbeenlost.
Nonetheless,underthesameconditions,differentrefinerysitesmaybequitedisparateintermsof
safetyperformance.Ingeneralthesedifferencesareattributedtorefinerymanagementand
specifically,theoperatorsapproachtoriskmanagement.Notallaccidentinvestigationswillraisethe
possibilityofamanagementfailure,especiallyinvestigationsconductedwiththemainpurposeof
understandingthetechnicalcauses.Morethanhalfofthecasesstudiedforthisreportfocusedthe
causalandlessonslearnedanalysis(whenprovided)onpurelytechnicalfactorscontributingtothe
accidentandtherewasnoindicationofamanagementrole(seeFigure22below).However,
remainingreportscontainedhintsofmanagementinvolvement.Ofthese,itwasimplied,and
sometimesclearlystated,thataninadequateawarenessorattentionofmanagementtoknown
corrosionhazardswasacontributingfactortotheaccidentoccurrencein23%ofthecases.

FIGURE22.PERCENTAGEOFACCIDENTSWHEREANINADEQUATEAWARENESSORATTENTION
CONCERNINGAKNOWNCORROSIONHAZARDWASINDICATED

58

FIGURE23.INDICATIONSOFAMANAGEMENTFAILUREINCASESSTUDIED21
Thepotentialinfluenceofamanagementfailurewasflaggedincaseswhereoneormoreofthe
followingconditionsappearedtoexistaccordingtotheobservationsfoundintheaccidentreport:

Generallackofmanagementattentiontocorrosionissues

Lackofawarenessintheprocessunitofpotentiallyunsafeconditionsandaccidenttriggers

Inadequatecorrosionmonitoringandfeedbackmechanismsforknownareasofelevated
corrosionrisk

DescriptionsfromcasereportshighlightedinFigure24(onthenextpage)illustratehowthiscanbe
relevanttoanaccidentaloccurrence.
Figure23aboveillustratesthenumberoftimessuchsituationswerecitedinthecasesandwhich
werecountedbythestudyasanindicationofamanagementfailurebelongingtooneofthese
categories.Eachfactorwascitedin50%ofthecaseswhereitwasindicatedthatamanagement
failurewasafactor.Itwasalsonotedthatinsomecasestheconditionoccurredduetoalow
prioritizationofsafetyissuesbythemanagement.However,inothersituations,itwasnotclearthat
themanagementwasnegligent,butsimplythatthemanagement,ortheunitinquestion,didnot
havethepropercompetencetoidentifythepresenceortheextentofthecorrosionhazardorthe
knowledgeofthepropermeasuresthatwerenecessarytotakeinordertocontroltherisks.Insome

21

Anaccidentcouldhavemorethanoneindicationofamanagementfailure.Therefore,thetotalof
indicationsnotedexceedsthenumberofaccidentswherethisfactorwasimplied.
59

FIGURE24.OBSERVATIONSFROMCASESSTUDIEDINDICATINGPOTENTIALINADEQUATE
AWARENESSOFORATTENTIONTOKNOWNCORROSIONHAZARDS
General lack of management attention to corrosion issues

Theeffectsonthedesignplantofaproductivityincreasewerenotadequatelyanalysedbecauseofawrong
attitudeofmanagementtowardssafety.[Case31]
ThecompanywaswellawarethatthewaterconcentrationinHydrogenFluoride(HF)shouldnotexceed2%
weighttolimitthecorrosionofcarbonsteel.Onrecommissioningafterthehydrotest,therewouldhavebeena
relativelyhighconcentrationofwaterintheHFintheline.Thereisthereforenothingnewtobelearnedwith
regardtothisparticularissue.[Case71]
[Theoperator]didnothaveanadequatemechanicalintegritymanagementsystemtopreventandaddress
safetyandenvironmentalhazardsfromthedeteriorationofH2SO4storagetanks.[Theoperators]engineering
managementandMOC[ManagementofChange]systemsinadequatelyaddressedconversionofthetanksfrom
freshtospentacidservice.3.The[operators]hotworkprogramwasinadequate.[Case67]
Thepartialdistillationunitwasveryoldandhadalreadypresentedproblemsbefore,butneverthelessithadnot
beenmeticulouslychecked.Afteraninterruptionofsixmonthsitwasputintooperationthenightbeforethe
accident.[Case35]
Lack of awareness in the process unit of potentially unsafe conditions and potential accident triggers

Thepersonsrelatedtothetankdidnotunderstandthatatankcouldbeeasilycorrodedbysemifinished
keroseneincludinghydrogensulfide.Fromthisfact,itwaswellknownthatanoverhaulinspectionofsuchatank
isimportant[Case8]
Twosignificantcommunicationfailingscontributedtothisincident.Firstlythevariouschangestothefrequency
ofuseofthewaterinjectionpointwerenotcommunicatedoutsideplantoperationspersonnel.Asaresultthere
wasabeliefelsewherethatitwasinoccasionaluseonlyanddidnotconstituteacorrosionrisk.Secondly,
informationfromtheinjectionpointinspection,whichwascarriedoutin1994,wasnotadequatelyrecordedor
communicated,withtheresultthattherecommendedfurtherinspectionsofthepipewerenevercarriedout.
Thesefailingswereconfirmedinasubsequentdetailedinspectionofspecifichumanfactorsissuesatthe
refinery.Safetycommunicationswerefoundtobelargely'topdown'instructionsrelatedtopersonalsafety
issues,ratherthanseekingtoinvolvetheworkforceintheactivepreventionofmajoraccidents[Case66]
Corrosionwascausedby
lackofknowledgeofthedegradationmechanism;thecorrectnondestructivetechniqueswerenotused.
Informationoftheconditionoftheterpmaterialwaspresentwithintheorganization,butnotwiththe
departmentconcerned(inspection/maintenance)[Case75]
Inadequate corrosion monitoring and feedback mechanisms for known areas of elevated corrosion risk

Externalcorrosioniseasilygeneratedataspecificpart.Weknowthoseplaces.Forexample,theinsideof
thermalinsulation,wheretrappedwatercanhardlycomeout,andtheplaceswithpoorsurfacetreatmenton
painting.Managementorspecificationsofpaintworkwasinadequate.In1993,whentheaccidentoccurred,
externalcorrosionofpipinghadalreadybecomeatopicofmaintenance.Whydidtheexternalcorrosionof
branchpipingneartheseashoreremain?Duetoadiscrepancyininformationgathering,thepreservationplan
mayhavebeentoolate.Ascorrosionofpipingadvancestotheinsideofpipingunexpectedly,preservationrepair
workmightrequiremuchtimeandmanpower.[Case37]
[Theoperator]educatedpersonnelandadvocatedforidentificationandcontrolofdamagemechanisms,
includingsulphidationcorrosion.However,[personnel]hadlimitedpracticalinfluencetoimplementtheir
recommendations.TheseindividualsdidnotparticipateinthecrudeunitProcessHazardAnalysis(PHA)anddid
notaffectdecisionsconcerningcontrolofsulphidationcorrosionduringthecrudeunitturnaroundprocess.
[Case99]

60

casesemployeetrainingandawarenessmaynothavebeensufficienttoenablemembersofthe
workforcetorecognizecorrosionhazardsortoencouragethemtotakeactionwhenvarioustypes
andareasofdegradationhadbeenobserved.Whileawareofandconcernedaboutcorrosionrisks,it
isalsoisconceivablethatcostconsiderationsmayhavemotivatedmanagementinsomecasesto
foregoalayerorlayersofprotection,particularlyonthedetectionandmitigationside.Forthis
reasoninmanycasesmonitoringandfeedbackmechanismshavebeeninadequateforequipment
exposedtopotentiallyelevatedratesofcorrosionrisk.

3.2 Failure to conduct an adequate hazard identification or

risk assessment for life cycle planning and events

Theremainingfourcategoriesofriskmanagementfailureidentifiedinthestudycanbetracedtoa
failureassociatedwithhazardidentificationorriskassessmentatanimportantstageinthelifeofthe
equipment.Mostmajoraccidentsimplyatleastapartialfailureintheidentificationandrisk
assessmentofamajorhazardresultinginaninadequateevaluationofthehazardandassociatedrisk.
Forcorrosionhazards,riskisnormallyexpressedastheproductoftheprobabilityofacorrosion
relatedfailureandtheconsequencesofsuchafailure.Theoutcomeoftheassessmenthas
implicationsfordownstreamdecisionsassociatedwithdesign,operationandmaintenanceofthe
process.AccordingtoastudybytheHealthandSafetyExecutive(UnitedKingdom)acorrosion
hazardshouldbeassessedonthebasisofeachofthefollowingthreatcategories[36]

internalcorrosionthreat

externalcorrosionthreat

safety/hazardthreat

environmentalthreat

operabilitythreat

Figure25onthenextpageshowsanexampleofatypicalriskassessmentofacorrosionhazardusing
aneventtreeapproach.
Theoutcomeoftheriskassessmenttheninfluenceswhetherornotadditionalcontrolmeasuresare
necessaryaswellaswhatkindandhowmany.Abarrieranalysisissometimesanothertypeofrisk
assessmentusedtoevaluatetheeffectivenessofcontrolmeasuresselected,includingdetectionand
mitigationmeasures.Figure26and27onpage64showthegenericframeworkthatcouldbeusedto
assessbarriereffectivenessmeasuresforreducingriskassociatedwithtwotypicalpotentialfailure
scenariosoneofwhichiscorrosion.

61

FIGURE25.EXAMPLEOFCONSEQUENCEEVENTTREECARBONSTEELPIPECONTAININGLPG
EXPOSEDTOEXTERNALCORROSION
(SOURCE :STEINBEISADVANCEDRESEARCHTECHNOLGIES)[37]

Itcouldbededucedfromnumerousaccidentreportsstudiedinthisanalysisthataninadequaterisk
assessmentoftheprocessatacriticaloperationalphasewasacontributingcauseoftheaccident.
Usuallytheriskassessmentwasinadequateforanumberofreasons,including:

Thehazardwasnotidentifiedandariskassessmentforthathazardwasneverperformedat
acriticalpointinthesafetylifecycle

Criticalinformationaboutthehazardandpotentialriskwasavailablebutomittedfromthe
riskassessment.

Criticalinformationaboutthehazardandpotentialwasnotfullyavailablefortherisk
assessment

62

FIGURE26.ILLUSTRATIONOFBARRIERSINFLUENCINGAPROCESSINCIDENT
(SOURCE :S.SKLET)[38]

FIGURE27.BASICSAFETYBARRIERDIAGRAM
(SOURCE :UKHEALTHANDSAFETYEXECUTIVE][39]

63

Moreover,severalothersafetymanagementcomponentsdependontheaccuracyandcompleteness
oftheriskassessment,aswillbediscussedinotherpartsofthissection.Figure27illustrateshowa
riskassessmentfocusingoncorrosionhazardsmayinfluenceotherchoicesrelatedtoinspections,
monitoring,detection,andemergencyresponse.
Fromtheaccidentreportsstudied,itcannotbedeterminedwhetherornotariskassessmentwas
performedatacertainpointofthelifecycleandwhy,iftheassessmentwasperformed,itdidnot
adequatelycharacterizetherisk.However,manyofthereportscontaineddetailthatsuggestedthata
riskassessmentshouldhaveoccurredataparticularpointinthelifecycle,andthatatthetimeitwas
eithernotperformedoritwasinsufficientinidentifyingthecorrosionhazardand/oritsassociated
riskpotential.Justover60%oftheaccidentsindicatedthatariskassessmentwasnotadequateat
somepointinthelifecycle.Sinceanumberofaccidents,particularlypre2000,failedtoprovideany
causalinformationrelatedtoriskmanagement,itissomewhatlikelythatthisfiguregrossly
underestimatestheroleofafailureintheriskassessmentprocess.
Thisstudyfoundthattheseinadequaciesintofourdifferentcategoriesaccordingtotheiroccurrence
inthesafetymanagementprocess,asfollows:

Inadequateriskanalysisatdesignandconstructionstage

Inadequateriskanalysispriortochange,whichisessentiallyalackoforfailureinthe
managementofchangeprocess

Failuretoidentifyoraddressprocessrisksinplanninginspections

Inadequateidentificationofhazardsandrisksforotherpurposes,suchassafeperformance
ofrepairsandestablishmentofdetectionandmitigationsystems

Ofthislist,thefirsttwocategoriesarecloselyalignedwiththeclassicprocesshazardanalysisandrisk
assessmentthatisthebasisfortheriskmanagementstrategyofanoperation.Theremainingtwo
typesofriskanalysesaremorespecifictoaparticularoperationalfunction.Thefollowingsections
describeeachcategoryinmoredetailwithsomeexcerptsfromaccidentreportsforillustration
purposes.

3.3 Inadequate risk analysis at design and construction

stage

Thistypeoferrorreferstoaccidentswhereitappearsthatthepresenceofaparticularhazardorlevel
ofriskwasnotrecognizedwhentheprocesswasdesigned.Italsocoversaccidentsstemmingfrom
failurestorecognizetheimpactsofadesignchangeaftertheprocessisoperating.Itshouldbenoted
thatthisriskassessmentinoriginaldesigniscloselyalignedwiththeriskassessmentneedspriortoa
designchange,thatis,whentheequipmentorprocessaredeliberatelychangedtoimproveor
renovatetheoriginaldesignandconstruction.
Takingintoconsiderationtheconditionsthatcreateasignificantcorrosionhazard,thechemicaland
physicalprocessdesignthepotentialriskposedbythepresenceofthishazard.Moderntechnology
offersalargevarietyofsolutionsandselectionandimplementationarelargelydependentonprocess
andequipmentcharacteristic,riskanalysisoutcomes,andcostconsiderations.Recommended
technicalmeasurestendtofocusonprocessandequipmentadjustmentsthateitherreduceexposure
64

ofequipmenttocorrosiveagentsorreducevulnerabilityoftheequipmenttothecorrosiveagents.As
suchmeasuresforcorrosioncontrolindesignaremoreoftenprotectionmeasuresagainstcorrosion
(e.g.,inhibitors,equipmentupgrades)ratherthanprocesschanges,suchaschemicalsubstitution,but
inmanycases,opportunitiesforthelatteralsoexistTable15belowgivesexamplesofdesign
principlesthatcanbeusedtominimizecorrosionandassociatedchallengesfromtheUKHealthand
SafetyExecutive.
Figure28onthenextpageshowsthatoveralltheriskassessmentpriortooriginaldesignoralater
equipmentdesignchangemaynothavebeenadequateinjustover25%ofaccidents,accordingtothe
reports.Someofthereportswerenotentirelyclearwhetheradesignerrorwastheresultofa
decisionintheoriginaldesignoftheprocessorwaspartofachangetoprocessequipmentatalater
stage.Asapracticalmatter,thestudyassumedthat,ifchangewasnotmentioned,theerrorwaspart
oftheoriginaldesign;however,thischoicecouldnotbefullyverified.

TABLE15.EXAMPLEOFGUIDANCEFORDESIGNINGTOMINIMIZECORROSIONANDCHALLENGES
INMONITORINGANDMAINTAININGCORROSIONVULNERABLEAREAS

Explicittreatmentattheearlieststagesofconceptdesigntoeliminate,wherepossible,hazardsassociated
withcorrosiondamagethatcombinewithoperationalloadstoproducefailures.

Designassessmentsshouldlookforsitesofprobablecorrosionandconsidertheuseofcorrosionresistant
materialsoranothereffectivemethodofcorrosioncontrol.

Designtominimizecorrosiondamagetosafetycriticalitemsandsystems.

Ensurethatkeysupportstructuresforequipmenthaveahighreliabilityandresistancetofailure.Thisis
importantinareasexposedtomarineenvironmentsandsubjecttowashdownorregulardelugefromtests
offirewatermains.

Selectionoflocations,configurationsandorientationsthatminimizethreatstotheintegrityofequipment,
e.g.,designdetailingofimpingement/wearplates,drainage,andremovalofdeadlegswherecorrosive
conditionsdeveloporchemicaltreatmentsareineffective.

Designtosurvivelocalorcomponentfailurebymaximizingredundancy,e.g.,backupinjectionpumpsfor
inhibitorinjectionsystems.

Designtoallowmorereliableandeffectiveinspection,ensureadequateaccessforinspection/monitoring
equipment.

Designformaintainabilityeasyremovalofpumps,motors,valves.

Source:UKHealthandSafetyExecutive[40]

65

FIGURE28.PERCENTAGEOFACCIDENTSWHERERISKANALYSISPRIORTODESIGNAND
CONSTRUCTIONWASCITEDASPOTENTIALLYINADEQUATE

Ingeneralasisevidencedinthisreporttherearemanyknownconditionsthatcancontributetoan
acceleratedcorrosionrate.Figure29onthenextpageprovidesanumberofexamplesfromthe
reportwhereaninadequateriskassessmentpriortodesignandconstructionwasacontributing
factortotheaccidentevent.Thesecasesincludethosewherethereportimpliedthatasignificant
corrosionfailurehadoccurreddespiteeffortsofacompetentandsafetyawareoperator.Inother
wordsafailuretoidentifyanelevatedriskassociatedwiththeprocesscannotalwaysbeattributedto
negligenceorincompetence(thoughitisoftenthecase).Settingasidecosts,identificationand
monitoringofcorrosionrisksinherentinoilproductionprocesses(i.e.,corrosivecombinationsofflow
content,intensity,temperatureandpressure)remainsachallengingareaofcorrosionmanagement.
Evenifprocessrisksareknown,theavailablesciencemaynotalwaysbesufficienttoidentifyprecisely
whichequipmentcomponentsmaybesubjecttothehighestriskandthedegreetowhichthe
corrosionratemaybeelevated.Onesourcenotedthatinthepasttheimpactofcorrosionobserved
inthefieldhasnotsufficientlyfilteredtothedesigndisciplines,suchasflowmodeling,althoughthis
maybechanging.Resultsofstudiesthatindicatemorepreciselyhowprocessdesignfeaturescan
influencecorrosionratesmayeventuallyalsohelptojustifytheaddedexpensethatmaybe
associatedwithanticorrosiondesignmeasures.[41]
AsillustratedinFigure29onthenextpage,anumberoffailurescouldbeattributedtoaninadequate
riskassessmentintheaccidentsstudied,including:

Anadequateriskassessmentwasnotconductedpriortostartingoperations

Processriskswerenotforeseenintheoriginalriskassessment

Equipmentasconstructeddidnotadheretorecommendeddesignspecificationsandnorms

Aflawinmaterialwasintroducedintheconstructionphaseandwasignored

Therewasafailuretoanticipatecorrosiveeffectsoftheexternalenvironment

Costandconveniencecriteriahadgreaterweightthanpotentialrisk

FIGURE29.OBSERVATIONSFROMCASESONINADEQUATERISKASSESSMENTPRIORTODESIGN
66

ANDCONSTRUCTION
An adequate risk assessment was not conducted prior to starting operations

Itisnecessarytocheckpipingmaterials,standardizetheexchangecycleofthepiping,andpreparemanuals
includingtheabove.Selectionofthecorrectmaterialisvital.Thelifeofpipingofaplantwidelydiffers
dependingonitsserviceconditionsandflowingmaterial.Pointswithahighprobabilityofcorrosionwerenot
fullystudiedbeforetheaccident.Theeventshowshowimportantapriorstudyiswheninstallinganewplantas
wellasremodeling.[Case63]
Justasforeachprocessequipmentwithrisksformajoraccidents,thephenomenawhichcanleadtoa
degradationofthecontainment,inthiscasethestoragetank,shouldbeidentifiedandanalysed.Thisaccident
indicatesthepossiblerisksasaconsequenceofthepresenceofnonmixablephaseswhichcansettleout.An
investigationofthepossiblepresenceofsuchphasesshouldformapartoftheidentificationofpossiblecorrosive
phenomena.Ifnecessarychemicalanalysesshouldbeperformedtodeterminethecorrosivebehaviourofthese
phases(chemicalcomposition,pH,etc.).[Case77]
Theleakagewascausedbythefailureoftheaircoolerduetoerosion/corrosionbecauseofproductivity
increaseoftheunit.Theeffectsonthedesignplantofaproductivityincreasewasnotadequatelyanalyzed
[Case31]
Process risks were not foreseen in the original risk assessment

Anenvironmentinwhichcorrosionprogressespartiallyveryhighseemstobecreatedbythedistributionand
thehistoryoftemperatureinpipingandthemovementofinternalfluid,etc.Theestimationandanalysisof
phenomenainpipingwithadeadendaredifficult.Awrittenreportofthecompanystatesthatitwasimpossible
toforeseethisaccidentbecauseitwasaspecialcase.Itisauniqueaccidentwithcondensationatdeadend
pipingcombinedwiththebehavioroftheflowinverticalpiping.[Case69]
Equipment as constructed did not adhere to recommended design specifications and norms

Aventofapumpusuallyhasa1/2inchplughole.When3/4inchpipingisconnected,itiscommonsenseto
supportitsufficiently.Whywasthesupportinsufficient?[Case11]
This6inchdiameterelbowwasmadeofcarbonsteelinsteadofthe5percentchromealloysteelrequiredby
thedesignspecificationssincesomeofthepipesinthisunitareareachtemperaturesupto900FAn
investigationindicatedthatthepipingoneachsideoftherupturedelbow,whichwasfabricatedandinstalledin
1963,wasoftheproperalloysteel.[Case56]
A flaw in material was introduced in the construction phase and was ignored

Theinvestigationfoundthattheruptureoccurredduetolowtemperatureembrittlementinitiatedataflawin
thetankshellbasemetal,about20cmupfromthebottom.Theflawhadbeencreatedbyanoxyacetylene
cuttingtorchandhadbeentheresincetheinitialfabrication.[Case21]
There was a failure to anticipate corrosive effects of the external environment

Accordingtostudies,severalfactorscontributedtothecorrosionoftheline.Thesiteconsistsoffillclaywith
manysharppebbles(flint),someareimprintedinthecoatingcausingprimarycorrosionateachoccurrence.The
pipesaremountedonsteelbars,whicharesusceptibletoprematuredegradationofthecoating.Soilsamples
showaverylowconcentrationofchlorineandsignificantpresenceofsulfateandphosphateionswhichincrease
considerablytheconductivityofsoil.Finally,therupturedlineandthosenearbyweresubjecttothecathodic
protectionofotherpipelinesinthevicinity,increasingtherateofcorrosiontolocationswherethepipeis
exposed(tornorpuncturedbyflint).[Case25]
Cost and convenience criteria had greater weight than potential risk

Individualdecisionsonpipingmaterialmustbemadetakingintoaccountoperatingenvironmentand
conditions.Thepositionsatwhichpipingmaterialischangedmustbedeterminedfrombasicconditionssuchas
presenceofacorrosivemedium,temperature,andpressure.Evenifthechangepointdoesnotmatchthepiping
shape,itshouldnotbesetataconvenientpositionsuchasavalveoraflange.Highgradematerialshouldbe
useduptoasaferpositionevenifitismoreexpensive.Itisregardedasanerrorinpipingmaterialselectionor
applicationofthepipingselectionstandardOneofthecausesisconsideredtobethefactthatchangesin
pipingmaterialselectionoftensetflangesasaboundary.Itseemsthatthedesignerofthispipingselected
carbonsteeltocutcostbecausetherewerenosuitableflangesdownstreamfromthecheckvalve.[Case29]

67

3.4

Inadequate risk analysis prior to a change

Changesandmodificationstoprocessesandprocessequipmentareanaturalpartofarefineryplant
lifecycle.Acoreelementofanysafetymanagementsystemisaproperlyfunctioningmanagementof
changeprocess.AccordingtotheSevesoDirective,managementofchangeistheadoptionand
implementationofproceduresforplanningmodificationsto,orthedesignofnewinstallations,
processesorstoragefacilities[42]andincludesidentificationandanalysiswhereappropriateofany
safetyimplicationsofthechangeproposed.[43]Managementofchangeisalsoacoreelementof
U.S.processsafetyregulations.[44][45]
Failureinthemanagementofchangeprocesshasoftenbeencitedasanimportantelementinthe
sequenceofeventsleadingtoaseriouschemicalaccident.The1974Flixboroughexplosionisperhaps
themostwellknowncatastropheassociatedwithafailureinthemanagementofchangeprocess.
EightaccidentsinvestigatedbytheU.S.ChemicalSafetyBoardbetween1998and2012alsowere
associatedwithfailuretomanageaprocessorequipmentchange.Inthisstudy11%ofaccidents
werecitedaspotentiallyresultingfromafailureinthemanagementofchangeprocess.(SeeFigure
30onthenextpage.)
Foranumberofreasons,anoperatormayfailtoconductanadequateriskassessmentbeforea
changeevent,includingthefailuretorecognizethataparticularchangerequiresariskassessment.
Effectivecorrosionmanagementrequiresparticularattentiontothevariouskindsofchangesthatcan
makeaprocessorequipmentmoresusceptibletocorrosionfailure.AsnotedbyChosnek,themost
commonproblemwiththemanagementofchangeislackofamanagementofchangeprocess.The
secondmostcommonproblemispoorperformanceofthesafetyanalysisresultinginanaddedriskto
theprocess.(Chosnekalsomentionsthatthethirdmostcommonproblemisapoortechnical
descriptionofthechangeresultinginadifferentchangethantheoneintended,butthiselementwas
notmentionedintheaccidentreportsstudied.)[46]
Achangeinthesourceoftherawmaterial,crudeoil,mayinandofitselfbeconsideredasignificant
changetoarefineryprocess.Processeswillbechangedtoadapttotechnologyortheadditionofnew
productlinesmaycausechangesinotherpartsofasite,suchasstorageandwastetreatment.In
addition,olderrefinerieswillhaveundergonenumerouschangesofequipmentforanumberof
reasons,particularlyage,breakdownandprocesschanges.Inmanycases,particularlyprocesseswith
knownriskssuchascorrosion,evenaseeminglyminorchangeintheequipmentorprocessmayalter
theriskprofile(forwhichreasonscreeningcriteriamaybeusedtoidentifywhichchangeshaverisk
implications).

68

FIGURE30.PERCENTAGEOFACCIDENTSWHERERISKANALYSISPRIORTOADESIGNORPROCESS
CHANGEWASCITEDASPOTENTIALLYINADEQUATE

Casesstudiedinthereporthighlightedanumberofdeficienciesinthemanagementofchange
processthatmayhavecontributedtotheaccidentoccurrence.Areasofweaknessidentifiedincluded
thefollowing:

Themanagementofchangeprocessexistedwaslaunchedbutnotadequatelyperformed

Poordesignchoicesweremadeforchangestoequipmentexposedtoknowncorrosionrisks

Effectofasignificantchangeinproductivityofunitonmechanicalintegritywasnotthoroughly
analyzed

Effectofachangeinthesourceofcrudeoilonmechanicalintegritywasnotanalysed

Impactofaprocesschangeinoneunitwasnotconsideredforadownstreamunit

Figure31providesanumberofexamplesfromthereportofpotentialdeficienciesofthisnatureas
contributorstotheaccidentoccurrence.Insomecasesmorethanoneeventmayinvolvethistypeof
managementofchangefailure.

69

FIGURE31.OBSERVATIONSFROMCASESONINADEQUATERISKASSESSMENTPRIORTOA
CHANGE
Management of change process existed was launched but not adequately performed

InFebruary2000anMoC[ManagementofChange]formwascompletedtoincreasetheorificesizeinthewater
feedlinetotheP4363injectionpointintheoverheadsystem.Thisinterventionactuallyresultedinareductionof
thewaterflowrateduetoconfusionabouttheoriginalorificesize,buttheopportunitywasnottakenatthis
timetoreevaluatetheeffectthatthewaterinjectioncouldhaveondownstreampipework...Usinganexisting
ventvalvetoconnectthewaterintoP4363wasexpedient,andmeantthattherewouldhavebeenlittleorno
downtimerequiredforthismodification.Thisperceptionofaquickfixissupportedbythefailuretoimplement
theMoCsysteminoperationatthetimethatwouldhaverequiredatechnicalmemorandumtoberaised
coveringthemodification.[Case66]
In1985,theadditionofaheatexchangerandrearrangementofheatexchangersattheoutletofthereactor
werecarriedouttorationalizeenergyrecovery.Therefore,theconcentrationofcorrosivesubstancesattheheat
exchangeroutletincreased.Accordingtogeneralopinionatthattime,noonebelievedthewallthicknessatthe
partwouldbereducedbycorrosion,sothepartwasnotselectedforwallthicknessmeasurementsItisafact
thatifyoudonotmakeaverycarefulstudy,safetyaspectsmightbedisregarded,eveniftheinitialpurposeof
remodelingisachieved.[Case23]
Poor design choices for changes to equipment exposed to known corrosion risks

Aholeopenedduetocorrosion.Theheatingfurnaceoutlettemperaturewas360C,andthishightemperature
causedhightemperaturecorrosionconsideringthepropertiesofcrudeoil.Therefore,thematerialusedshould
be5Cr1/2Mosteel.However,differentmaterialsweremixedatthetimeofreinforcementofaproduction
capacityin1974,andimproper1/2Mosteelwasused.Asaresult,itispresumedthatcorrosionprogressedmore
thanexpectedandaholewasopenedUsually,beforepipingiserected,apipinglistforconstructionis
preparedforallconditionsincludingmaterialcorrespondingtoapplicationconditions.Theremighthavebeen
mistakesinthelistorincompletemanagementofpipingmaterials.Itisuncertainwhathappened.[Case48]
Tank393wasoneoffourtanksoriginallydesignedforfreshH2SO4thathadbeenconvertedtostorespentacid.
SpentH2SO4normallycontainssmallamountsofflammablematerials.Lighthydrocarbonsintheacidcan
vaporizeandcreateaflammableatmosphereabovetheliquidsurfaceifsufficientoxygenispresent.Toguard
againstthishazard,[theoperator]installedacarbondioxide(CO2)inertingsystemandaconservationventwith
flamearrestor.However,thesystemwaspoorlydesignedanddidnotprovideenoughCO2flowtopreventthe
formationofaflammableatmosphereinthevaporspaceoftank393.Becauseoftheholesinthetankandan
ineffectiveinertingsystem,tank393exhibitedseverelocalizedcorrosionbeyondthatconsiderednormalin
concentratedH2SO4service.[Case67]
Effect of a significant change in productivity of unit on mechanical integrity was not thoroughly analyzed

Theleakagewascausedbythefailureoftheaircoolerduetoerosion/corrosionbecauseofaproductivity
increaseoftheunit.Theeffectonthedesignplantofaproductivityincreasewasnotadequatelyanalyzed.
[Case31]
Theprocessedcrudeoilhasanincreasedcontentofsulphurwhichwastakenintoaccountbyusingsteelof
higherqualityforthepipework.Whenthesteelwasreplaced,itwasnotdoneatasmallpartseldomusedfor
maintenance.Thispartcorrodedandleaked,thereleasedcrudeoilcaughtfire.[Case82]
Effect of a change in the source of crude oil on mechanical integrity was not analyzed

TheoiltypehadbeenchangedtoArabianheavycrudeoiltwoyearsbefore,whichhasahighchlorinecontent
comparedtootherkindsofcrudeoil.Despitethechangeoftheoiltype,impuritylevelssuchaschlorinewere
intherangeofthelicenser'smanual.However,attentionshouldhavebeenpaidbecausethechlorinelevel
increased.[Case62]
Impacts of process change in one unit was not considered for a downstream unit

InJune,1972,storedoilwaschangedtokerosene.Somepartofkerosenewasbeingreceivedfromtheoil
waterseparatoroftheodorwatertreatmentunitafterthekerosenehadbeenusedforextractingodor
componentssuchashydrogensulfideinodorwastewater.Thecorrosivenessofthekerosenewasmuchstronger
thanthatofnormalkerosene.ItcorrodedthetankoverlongtermuseTheimportanceoffollowupafter
startingoperationofinhousedevelopedequipmentisshown.Thedevelopershouldpayattentionnotonlytohis
owntasks,butalsofollowupinfluencesonrelatedfacilities.[Case8]

70

3.5

Inadequate risk analysis for planning inspections

Theestimatedcorrosionriskassociatedwithaprocessorpieceofequipmentshouldbealeading
factorinschedulingroutineinspectionsofequipmentintegrity.Amoredetailedriskassessmentmay
alsobewarrantedtoidentifyspecificdegradationthreats,theremaininglifeoftheequipmentandto
feedbackinformationintotheoverallriskassessmentandcontrolsystem.[36]Theinitialcorrosion
riskassessmentshouldidentifyalsopointsinthelifecyclewhenthecorrosionriskassessmentshould
beupgraded.
Theriskassessmentmayalsobeusedtoassignprioritiesforcorrosionmonitoringandasinputintoa
RiskBasedInspection(RBI)scheme.RBImethodologiesareinterestingtoexaminesincetheyprovide
someinsightintosomeofthecriteriathatexpertsusetodetermineinspectionfrequenciesona
site.22

Riskanalysisforplanning
inspections

FIGURE32.PERCENTAGEOFACCIDENTSWHERERISKANALYSISFORPLANNINGINSPECTIONS
WASCITEDASPOTENTIALLYINADEQUATE

22

RiskBasedInspection(RBI)isatechnologyprocesswherebyfailurelikelihoodiscombinedwithestimated
severityofconsequencesintheeventofequipmentfailuretoratethecriticalityoftheequipmentandthereby
identifyappropriateinspectionfrequencies.Whencorrectlyimplemented,itisusedtoformallyoptimizethe
inspectioneffortsforeachequipmentitemofplantwithintheboundariesofappropriatelydefinedintegrity
operatinglimits,whileminimizingequipmentfailureriskscausedbytherelevantdamagemechanisms.[47]
ExpertsusuallyfavourtheapplicationofRBImethodologiestosomeorallpartsofrefinerysites.Whilesucha
recommendationisusuallyvalid,RBIwillnotnecessarilyleadtotherightinspectionssolutionsifitisapplied
withoutsufficientresources,dataorcompetence.

71


TABLE16.EXAMPLESOFCRITERIAUSEDTODETERMINEINSPECTIONFREQUENCYFORPRESSURE
ANDPIPEEQUIPMENTINVARIOUSRBI METHODOLOGIES
Failurelikelihoodwasusuallybasedonanumberofinputs,including:

operatingpressureandtemperature

servicelife

diameterandlength

numberofpastinspections

material

inspectioneffectiveness

thinningfactor

corrosionrate

stresscorrosioncracking(SCC)factor

corrosionallowance

H2partialpressure

onlinemonitoring

expertjudgment

Genericstandardswereusedwheninhousedatawereinadequateornotavailable.Oneparticipantalsoapplied
amanagementfactorbasedonguidanceinAPI581AppendixDandcoveringareasincludingleadershipand
administration,managementofchange,operatingprocedures,safeworkingpracticesandtraining.

Consequenceanalysiscouldbebasedonavarietyoffactorsaswell,including:

fluidcharacteristics,hazardcontentsandpressure

processstream,streamphase,toxicpercentage,temperature,pressure,inventoryandmaterialdensity

presenceofdetectionandisolationsystems

impactonproduction,personnelandequipment

impactonsafety,healthandenvironment

impactonbusinessissuesandequipmentcosts

thenumberofpotentialoutagedaystogetherwithgenericcostdata

Source:UKHealthandSafetyLaboratories[48]

72

FIGURE33.OBSERVATIONSFROMCASESONINSPECTIONDEFICIENCIES
Inspections hardly took place at all

Corrosioniscausedataplacethatisnotvisibleandisnotnoticed.Ontheotherhand,itcanbepreventedby
carefulwatch.Defectsinfacilitymanagementresultingfrominsufficientinformationgatheringorsafety
consciousnessareconsideredtobethecause.Externalcorrosionhadalreadybecomeaprobleminoilrefineries
andpetrochemicalcompaniesin1990,thetimeoftheaccident.Thiscompanyleftitfortenyearsafteracheckin
1980.Thatis,sufficientmaintenancewasnotperformedonexternalcorrosion.[Case28]
Inspectionswerenotadequatelythoroughtodetectareasofweaknessoraccelerateddeterioration
Thecausewasnotaweldingdefect,butalategeneratedbasematerialcrack.Thiscrackgrewwithalongterm
useorthechangeoftemperatureandpressureatturnaroundshutdowns/startups,etc.Althoughthebase
materialconformedtothestandard,theCharpyimpactvaluewaspartlylow.Breakingstrengthfellduetothe
abovefactor.TheDyePenetrantTestwascarriedoutonthewholeweldlineuntiltheinternaloverhaulinspection
ataturnaroundshutdownin1971.However,fornineyearsuntiltheaccident,asinspectionwaspartial,thecrack
wasnotfound
Corrosionandcracksmustalwaysbechecked.Afundamentalfactorisalongtermuseandomissionofinspection.
However,annualexecutionofthewholeinspectionisdifficult,consideringtimeandexpenseofdrawingoffand
reloadingalotofcatalysts.Atleast,sufficientinspectioneveryseveralyearswouldberequired.[Case14]
Inspection intervals were not planned in conformance with accepted criteria

Theintervalsbetweeninternalinspectionshavetobedefinedbasedontheestimatedcorrosionvelocity.Thisisa
generalprinciplethatcanbefoundindeAPI653standard"TankInspection,Repair,Alterationand
Reconstruction".Normallythecorrosionvelocityofthebottomplatesisthemostimportantone.Inthecaseof
majorlocalcorrosion,itwillbethishigher,localcorrosionvelocitywhichisdeterminativefortheinspection
interval.[Case77]
Accidentsatfueloildesulphurizationunitsoccurveryfrequently.Oneofthecausesisthepresenceofacorrosive
material.Thisunitshouldbeinspectedwithtoppriorityinarefinery.[EX056]
[Thecompany]failedtoimplementaneffectivesystemfortheinspectionofpipeworkontheSaturateGasPlant
(SGP),tocomplementthatinplaceforprocessequipment.Thesystemfellfarbelowrecognizedindustrygood
practiceatthetime.Inadditiontheyfailedtouseknowledgeandexperiencefromothersectionsoftheplantthat
shouldhaveidentifiedtheneedformoreinspectionoftheSGPpipework.Overtimesufficientpipeworkcondition
datashouldhavebeenobtained,andenteredintoaninspectiondatabase,toverifythebelievedintegrityand
informassessmentsoffutureinspectionrequirements.Withoutthisboththesystemandtheassessmentswere
inadequate.[Case66]
A sound risk-based inspection methodology was used but did not identify an elevated risk of corrosion
Theruptureofthetubethatstartedthefirewasaconsequenceofcertaintypesofdeterioration(cokedeposit,
attackbypolythionicacids),whichwerenotidentifiedwhentheinspectionplanwasdrawnupwiththeaidofthe
RBIsoftwareprogramusedbytheGroup.Furtherdevelopmentofthistoolwouldthusseemnecessarysothatit
includesthemodesofdeteriorationmentionedaboveandtotaketheageoftheequipmentintoaccountinthe
criticalitycalculations.[Case74]

In1993,whentheaccidentoccurred,externalcorrosionofpipinghadalreadybecomeatopicofmaintenance.
Whydidtheexternalcorrosionofbranchpipingneartheseashoreremain?Duetoadiscrepancyininformation
gathering,thepreservationplanmayhavebeentoolate.Ascorrosionofpipingadvancestotheinsideofpiping
unexpectedly,preservationrepairworkmightrequiremuchtimeandmanpower.Plannedanddetailedchecks
areimportant.[Case37]
An inspection frequency was recommended in line with existing standards; the recommendation was ignored

Thedesignandimplementationofthetankinspectionprogramwasinadequate.[The]planwastoinspectits
tanksatintervalsprescribedbyAmericanPetroleumInstitute(API)Standard6539(i.e.,every5yearsforexternal
inspectionsand10yearsforinternalinspections).However,API653notesthatinspectionfrequenciesmustbe
modifiedbasedonthecorrosivityofthestoredmaterial.[Company]inspectorsrecommendedrevised
frequencies,buttheinspectionsdidnotoccur.[Case67]
Inspection frequency was reduced for budget reasons

Pipesofthistypehavenotbeenmaintainedformanyyearstoreducecosts,leadingtothepartialdisposalof
certainsectionsbyprogressivesubsidenceoftheland.Soilmoisturehasprobablyacceleratedthephenomenonof
externalcorrosion.[Case94]

In2002theUKHealthandSafetyLaboratoriesconductedastudyofRBImethodologiesinvolving
sevendifferentorganizationsincludingthreerefineryoperators.Table16onpage73providesa
73

numberoffactorsusedtoevaluatefailurelikelihoodofequipment.Notably,anumberof
methodologiescombinedtechnicalindicators(equipmentdimensionsandprocesscharacteristics)
withoperationalfactors(e.g.,numberofpastinspections)andqualitativejudgment.[48]
Overathirdoftheaccidentsreviewedinthisstudymighthavebeenavoidedwithappropriate
planningofinspectionsonthebasisofsuchcriteria.(SeeFigure32onpage72.)Inmostcasesthe
inspectionfrequencyappearedtobeinadequatetakingintoconsiderationvulnerabilitiesassociated
withtheequipmentinvolved(e.g.,age,location,processintensity,etc.).Inafewcasesthe
inspectionssimplywerenotthoroughenoughtodetectthatcorrosionwasdevelopingandcould
developintoacriticalhazardwithsignificantaccidentpotential.Therewerealsoobservations
indicatingthattheassessmentconductedbytheoperatorhadnotidentifiedanelevatedriskof
corrosionfailure.Variousdeficiencieshighlightedbythesereportsincluded:

Inspectionsoftheequipmentinquestionhardlytookplaceatall

Inspectionswerenotadequatelythoroughtodetectareasofweaknessoraccelerated
deterioration

Inspectionintervalswerenotplannedinconformancewithacceptedcriteria

Asoundriskbasedinspectionmethodologywasusedbutdidnotidentifyanelevatedriskof
corrosion

Aninspectionfrequencywasrecommendedinlinewithexistingstandards;therecommendation
wasignored

Inspectionfrequencywasreducedforbudgetreasons

Figure33onthepreviouspageusesexcerptsfromvariousreportsinregardtotheseparticular
aspects.

3.6 Inadequate identification of hazards and risks for other

purposes

Severalreportsalsohighlightedothersituationswhereariskanalysismighthavebeenusedtoavoida
potentialaccident.Insixcasesitwasreportedthatadequateassessmentofconditionswasnot
conductedpriortorepairwork,notablyforhotworkoncorrodedequipment.Hotworkisaterm
usedtodescribeheatandsparkproducingoperationssuchaswelding,flamecuttingandgrinding.It
isawellknownhazardandispartofthepermittoworkprocedure,standardgoodpracticetocontrol
bothoccupationalandprocesssafetyhazards.TheU.S.ChemicalSafetyBoardhasnotedthathot
workisoneofthemostcommoncausesofworkerdeathinalltheinvestigationsithascovered.A
bulletinthatitissuedonthetopicidentifiessevenlessonslearnedfromsuchaccidentsincluding
identifyingthehazardspriortotheworkandifpossibleusealternativestoavoidtheworkaltogether
whenhighrisksareidentified.Furthermore,oncethehazardsareidentified,otherprecautions
shouldbefollowediftheworkisthentobecarriedforward.

FIGURE34.OBSERVATIONSFROMCASESONINADEQUATEHAZARDEVALUATIONPRIORTO
REPAIRWORK
Therewasalackofawarenessoftheimpactofchangingconditionsatthehotworksite.Althoughcombustible
74

gastestingpriortothestartofhotworkearlyinthemorningindicatedthatvaporswerenotpresent,gradual
warmingcouldmakethepresenceofcombustiblevaporsmorelikely.[Case44]
Onthedayoftheincident,thepipingcontainedapproximately90gallonsofnaphtha,whichwasbeing
pressurizedfromtherunningprocessunitthroughaleakingisolationvalve.Aworkpermitauthorized
maintenanceemployeestodrainandremovethepipingAsthelinewasbeingdrained,naphthawassuddenly
releasedfromtheopenendofthepipingthathadbeencutfirst.Thenaphthaignited,mostlikelyfrom
contactingthenearbyhotsurfacesofthefractionator,andquicklyengulfedthetowerstructureandpersonnel
Althoughthehotprocessequipmentwasclosetotheremovalwork,[theoperators]proceduresandsafework
permitdidnotidentifyignitionsourcesasapotentialhazard.Thepermitalsofailedtoidentifythepresenceof
hazardousamountsofbenzeneinthenaphtha.Thenaphthastrippervessellevelcontrolbypassvalvewas
leaking,whichpreventedisolationofthelinefromtheoperatingprocessunit.Asaresult,therunningunit
pressurizedthenaphthapiping[Theoperators]jobplanningproceduresdidnotrequireaformalevaluationof
thehazardsofreplacingthenaphthapiping.[Case55]
Thepipingwasremarkablythinduetocorrosionfrominsideandoutside.Scaleadheringtothesurfacewas
detachedbecauseawatersealandaweldingrepairwerecarriedoutrepeatedly.Therefore,theopening
suddenlyexpandedandLPGblewout.ThegasifiedLPGwasignitedbyaweldingspark.Thefirstrepairworkdid
notstoptheleakage,andthesecondandthirdattemptsatrepairingweremade.Thisinappropriateworkwas
alsooneofthecauses.[Case30]

FIGURE35.OBSERVATIONSFROMCASESONTHEABSENCEOFADEQUATEDETECTIONAND
MITIGATIONSYSTEMS
Vesseldesign,integrity,andmaintenancewereinadequate.Thevesselsdidnothavefireprotectioncapability
andhadnoprovisionforeitheremergencyventingorfrangibleroofseams.Followingtheexplosionofvapors,
thevesselsfailedalongtheircorrodedbottomseams,releasingtheircontents.[Case44]
Followingtheincidentanumberofdeficiencieswerenoted,includingthepooravailabilityofwatercurtains,the
failuretointerveneusingthemultipurposepump,thelackofaccessstairwaytotheisolationvalvesofthedryers
andtheabsenceofanybroadcastalarmfortheunittoalerttheotherunitsonthesiteaswellastheabsenceof
correspondingdetectorsinthecontrolroom.[Case36]
Aftertheaccident,theplantwasshutdownandthereactorpurged.Itscontentswereremovedandthereactor
waspreparedtoopenittoallowaninternalexamination.Itwasfoundthatthetemperatureindicatorson
reactorhadmaximumreadingsbelowexpectedtemperatures.Besides,nohightemperaturetripswerefitted.
[Case42]
Theleakagewasduetocorrosionofthepipe,whichhadnotbeenchangedsince1973.Therewasnoautomatic
gascontrolsystem,whichcurrentlyexistsineveryrefineryinthecountry.Thissystem,whenitworks,causesthe
immediateinterruptionoffunctioniftheleakingofcertaingasesisdetected.[Case35]
Investigationsrevealedthattheleakwasdetectedonlyafter5hours,bywhichtime478tonnesoffuelhadbeen
spilled,ofwhich180tonnesflowedintotherivertheestimatethatthevolumeshippedtoavesselcorresponds
moreorlesstothevolumeofastoragetankprovedtooimprecisetoserveasfeedbackforalertingtheworkers
inchargeoftheloadingoperationofaproblem[Case90]

75

Itappearedinthecasesstudiedthatatleastapriorriskanalyseswouldhavealsoidentifiedthe
existingcorrosiondefectsinthepartunderrepair.Thesedamagedsections(orintwocases,the
presenceofleakedfluids)createdtheopportunityfortheaccidenttooccur.Figure34onthe
previouspageprovidesexcerptsfromthecasesstudiedhighlightinganabsenceofanappropriate
hazardevaluationpriortoconductingrepairsonequipmentshowingclearsignsofcorrosionand
otherpotentialdeficiencies.Insomecasestheleakhadalreadyoccurredbeforetheworkwas
performedbutthesitewasnotmonitoredpriortothework.Inothercasesthereleaseoccurred
whiletheworkwastakingplace.Forexample,workwasperformedinaweakenedareaofthe
equipmentsuchthatthisareaexpandedandbrokeopenduringtherepairintervention.Inallcases
theflammablesubstancesfoundanignitionsourceresultinginafireorexplosionorboth.
Insevencasestherewereobservationsintheassociatedreport(s)concerningdetectionand
mitigationmechanismsthatcouldhavepreventedareleasefrombecomingaseriousaccidentifthey
hadbeeninplace.Aneffectiveriskmanagementapproachreliesonassigningappropriatetechnical
measurestoreduceandeliminatetherisks.Intheclassiclayerofprotectionstrategy,measuresthat
preventalossofcontainmentareconsideredfirstordercontrolsandmeasurestoreducetheimpacts
ofalossofcontainmentareconsideredsecondordercontrols.Theseverityofconsequences
associatedwithsomecases,forexample,anaccidentoccurringduringaloadingoperationinwhich
478tonnesoffuelwerespilled,suggestedthat,inadditiontomeasurestopreventlossof
containmentprevention,secondorderprotection,suchassensors,alarms,automaticshutoff
controlsand/orotherpossiblemeasures,couldhavesignificantlyreducedtheimpactoftheevent.
Figure35onthepreviouspagegivesexampleswheretheseverityoftheeventcouldhavebeen
minimizedwithadequatedetectionandmitigationmeasuresforequipmentwhereconditionswere
knowntobeassociatedwithhighercorrosionrates.

76

CHAPTER 4

CONCLUSIONS

Petroleumoilrefiningisanessentialindustryandanimportantelementoftheeconomic
infrastructureofmanyEUandOECDcountriesandthegeographicregionstheyinhabit.Italsohasa
largepresencewhereveritislocated.Sitesareusuallyfairlylargecomparedtootherindustries
becauseproductionandstoragecapacityweredesignedtosupportavolumesufficienttoassure
profitability.Butitisahighhazardindustry,dealingdailywithconsiderablevolumesofflammable
substances,ofwhichalargesubsetofthesearealsotoxictotheenvironmentandsomearealsotoxic
tohumanhealth.Hence,thereisalwayspotentialthatalossofcontainmentundercertainconditions
onthesesites,ifnotpreventedorcontrolled,mayhaveseriousconsequencesforthesurrounding
communityandenvironmentandsometimestheeconomyofthelocalregion.
Byandlargerefineriesareabletomanagetheirsitessafely.Itisgenerallyrefineryindustryexperts
thataredrivingeffortsforbettercontroltechnologiesandriskmanagementstrategiestoreducetheir
majoraccidentriskstoaminimum.ProfessionalorganizationssuchastheAmericanPetroleum
InstituteandtheEnergyInstituteareleadersinthepromotionofsafetytechnologyandstandards.
Nonetheless,corrosioncontrolremainsaparticularlychallengingphenomenonintheefforttoreduce
refineryaccidentrisks,furtherelevatedinmanyEUandOECDcountriesbytheaginginfrastructure
andvariationincrudeoilsupplyandmarketconditions.AccordingtotheeMARSdatabase,corrosion
failureisresponsibleforoneoutoffiveofeachmajorrefineryaccidentoccurringintheEUalone
since2000.Thisanalysisof99corrosionrelatedaccidentsoccurringinrefineriesoverthelast50
yearsisanefforttrytohelptheexpertcommunitymaintainafocusonconditionsthatmayput
criticalrefineryequipmentatriskofcorrosionfailure.
Inthisregardthefollowingfindingsandconclusionsarehighlighted:

CorrosionofequipmentcontinuestobeanimportantsourceofaccidentriskpotentialatEUand
OECDrefineries.Thestudyidentified40accidentsoccurringsince2000.Halfoftheaccidents
wereestimatedtohavehadveryhighconsequences,particularlyintermsofimpactsonthe
environmentandintermsofeconomiccostsfortherefineryitselfaswellaspotentiallythe
surroundingcommunity.

Generally,significantcorrosionfailuresoccureitherbecausethehazardwasnotproperly
identifiedorthehazardwassubstantiallyignored.Thereisanenormousvarietyofcorrosion
phenomenathatcanoccur,yetthelistoffactorsthatmaycontributetoanycorrosionfailure,
whatevertype,isrelativelyshort.Thefactorsmainlyinvolvethepresenceofvariousknown
corrosiveagents,exposuretocertainconditions,andequipmentcompositionandconfiguration.
Stillitrequiresacertainlevelofcompetency,particularinregardtoproductionprocesses(versus
storageandtransfer),torecognizethatalltheconditionsarepresenttocreateasignificant
corrosionhazard.However,thereappearedtobeanumberofcasesstudiedinwhichthe
corrosionriskwasquiteobvious,andyetthemanagementchosetoignoreorunderestimateit.

Thelackofanadequatehazardidentification,orinadequateassessmentoftheassociatedrisk
potential,cannotbeattributedtoanyonefundamentalcause.Itissometimesaclear
managementfailureinnothavingcompetencetomakeagoodanalysis,butnotalways.It
appearedfromthestudiesthatexpertssometimesoverlookedhowthevariouselementsofa
processcouldcombinetocreatetheconditionsforacceleratedcorrosion.Thereisalsoa
77

questionabouthowmuchexperiencespecificallyinmechanicalintegritydisciplinesisavailableat
somerefineriestodiagnosetheseproperly.

Thestudyindicatesthatoneofthemostimportantchallengesinmanagingrefinerycorrosionis
alsotheelementofchange.Alreadychangestoprocessdesignandequipmentposeachallenge
andneedacertaincompetencytoidentifyifanewcorrosionriskhasbeenintroduced.However,
otherchangesthatcanaffectcorrosionratesmaygounrecognizedandthusnotbeevaluatedfor
anelevatedrisk.Particularchangesofthisnaturecouldbeachangeinthesourceofcrudeoilor
anincreaseinproductionrate,particularlyiftheyareconsideredtobesomewhattemporary.

Inconspicuouschangescanalsocreateriskandinthisregard,therefinerysgreatestriskmaybe
changeovertime.Lossofexperiencedpersonnel,lackofknowledgeoftheoriginalprocessand
equipmentdesign(sometimesdecadesago),andagingequipmentallfallinthiscategory.The
industryiswellawareofthiskindofthreatandtherearenumerousresourcesonhowtowork
withsuchchallenges.Strategiessuchasriskbasedinspections,lifecyclemanagement,and
safetyperformanceindicators,tonameafew,areallgoodpracticesthatcansupportrisk
managementforthissomewhatinsidiouschangesthatcangreatlyinfluencethelevelofrisk.
Corporateleadershipandsafetyculture,areasofrenewedemphasisfollowingtheaccidentatBP
TexasCityinMarch2005,alsoofferpromisingconceptualframeworksfororganizationsto
reinforceandsustaineffortsattheoperationallevel.
Therearealsonumerousdevelopmentsthathavetakenplaceandtargetedforthefuturein
regardtocontroltechnologies.Inparticularimprovementsandinnovationsindetectionsystems
andmethodscanhelprefinerieswiththeinherentperilsofscientificuncertaintyassociatedwith
thecorrosionprocessintheproductionunitsandstoragetanks,aswellascreepingeffectsof
changeovertime.

Neglectingtoidentifyormanagecorrosionhazardsalsocontinuestobeaproblemonsome
refinerysites.Whiletherearemanyexemplaryrefineryoperatorswithadmirablerisk
managementprogrammes,theevidenceisclearthatnotallrefineryoperatorsarenecessarily
goodactorswhoplaceanappropriateemphasisonriskmanagementobjectives.Thereisalso
probablyaslightlydifferentcategoryofoperatorsthatintendstobeagoodactorbutlackthe
managementskillstoestablishasafetymanagementsystemthatworks.Ineithercase,some
accidentreportsarequiteclearthatthelessonlearnedwaslessaboutthetechnicalchallengeof
managingcorrosionbutsimplyabouthavinganeffectiveriskmanagementprogram.Thework
ofinspectionauthoritiesismostcertainlychallenginginthesesituations.

Inessencethisstudyprovidessomeevidencetoconfirmconcernsamongexpertsinbothgovernment
andindustrythattheriskofcorrosionfailurescausingmajoraccidentremainsastrongareaof
concern.Inillustratingthekindsofdecisionsthatmayhaveledtocertainaccident,ortheseverityof
theirconsequences,itishopedthatinspectorsandrefineryengineerswhoarelookingtoimprove
theirawarenessofcorrosionriskswillhavegainedsomeknowledgethatwillhelpthemintheirwork.
Inaddition,itispossiblethatthefindingscanalsohelpkeyleadersingovernmentandindustrypoint
outthatcorrosionremainsasignificantrefineryhazarddeservingseriousandsustainedmanagement
attention.

78

79

APPENDIX 1: LIST OF ACCIDENTS STUDIED

CASE

YEAR

COUNTRY

SOURCES

SHORTDESCRIPTION

23

Afirebrokeoutinaverticalovenofareformingunit
recentlyplacedinservice.

CASE1

1965

France

ARIA 26620

CASE2

1967

USA

Lees

Catastrophicexplosioninundergroundpipelinekills7and
injures13.

CASE3

1969

France

ARIA 7320

Aburiedpipelinecarryingacidgasescontaininghydrogen
sulphideleakedataweld.

CASE4

1973

France

ARIA 26574

CASE5

1974

France

ARIA 26620

CASE6

1975

France

ARIA 26578

CASE7

1975

France

ARIA 26990

CASE8

1975

Japan

JST

CASE9

1977

Japan

JST

Theupperpartofametallicchimneyofanatmospheric
distillationunitinnormaloperationdetachedandcaused
materialdamageinthevicinityoftheinstallation.
Afiretookplaceinaverticalovenofareformingunit
followingtheruptureofatubejoiningtheradiationand
convectionsections.
Inanatmosphericdistillationunitinnormaloperationa
firebrokeoutinthedistillationcolumn.
Theruptureofthesuctionlineatthebottomofthe
columninanatmosphericdistillationunitinstable
operationcausedalimitedfirebecauseofthe
inflammationoftheresiduals.
Largescalefireofanoiltankduetooverlookingcorrosive
propertiesofdistillate.
Leakageandfireofhydrogencausedduetostress
corrosioncrackingthatoriginatedfromtheinfluenceof
turnaroundshutdownmaintenanceonadrainvalveat
hydrogengaspipinginafueloildesulphurizationcracking
unit.

23

Sourcesareasfollows:
ARIA=http://www.aria.developpementdurable.gouv.fr/
JST=http://www.sozogaku.com/fkd/en/index.html
ZEMA=http://www.infosis.uba.de/index.php/de/site/12981/zema/index.html
eMARS=https://emars.jrc.ec.europa.eu
CSB=http://www.csb.gov
Lees=LeesLossPreventionintheProcessIndustries,3rdedition[13]
MARSH=Marsh100LargestLosses,20thedition,19722001[7]
MHIDAS=adatabaseestablishedbytheU.K.Health&SafetyExecutivein1986(nolongeravailable)
LDEQ=LouisianaDepartmentofEnvironmentalQuality

80


Firewasfedbytheruptureofthedischargepipeofthe
residuepumpinthedistillationunit.

CASE10

1978

France

ARIA 26534

CASE11

1978

Japan

JST

Leakageandfireofheavygasoilfromanopeninginvent
pipingofarefluxpumpatadistillationcolumn.

CASE12

1978

Japan

JST

Outflowofallfueloilfromatankcausedduetobreakage
ofabaseplateofanoutdooroiltankfromanearthquake.
Inanalkylationunitofsulphuricacid,butaneevaporated
intheatmospherecreatingavapourcloudthatengulfed
theboileroftheneighbouringcatalyticcracker.

CASE13

1979

USA

ARIA 7279

CASE14

1980

Japan

JST

Ruptureofareactorduringanairtighttestofreactorata
catalytichydrodesulphurizationunit.
Anamineabsorberpressurevesselrupturedduring
weldingworkandreleasedlargequantitiesofflammable
gasesandvapors.

CASE15

1984

USA

ARIA 7127
Koch et al.[50]

CASE16

1986

United
Kingdom

eMARS
MHIDAS

CASE17

1988

France

ARIA 163

CASE18

1988

USA

ARIA 324
Lees

Leakintheisobutanerecyclingunit
Inastorageareaduringloadingthesealofafixedroof
tankcontainingoilresiduesruptured.
Thedecompressionofadepropanizerandthehead
sphericaltankthroughtheopeningofapipeline,caused
anunconfinedvapourcloudexplosioninafluidcatalytic
crackerunit.
Firecausedduetoerosionofawaterinjectionnozzle
connectedtoreactoroutletpipingataheavyoil
hydrodesulphurizationunit.

CASE19

1988

Japan

JST

CASE20

1988

Australia

MHIDAS

Tankrupturecausesmajorspillofgasolinerequiring
evacuationofthesurroundingcommunity.

CASE21

1988

USA

Lees
MHIDAS

Catastrophicruptureof48yearolddieseltankoninitialfill
afterithadbeenrelocatedandreconstructed.

CASE22

1989

Japan

ARIA 106

CASE23

1989

Japan

JST

CASE24

1989

Germany

eMARS

CASE25

1990

France

ARIA 2257

Alossofhydrogenoccurredinadistributionboxofthe
thermalexchangerofadesulphurizationunit,triggeringan
explosionandfire.
Leakageandexplosionofhydrogenatoutletpipingofa
reactorinthehydrodesulphurizationunit.
Materialfailurecausesruptureinpipeline.
Anexplosionoccurredfromaleaklocatedatthelevelof
anelbowofaburiedpipelineexportingpremiumgasoline
fromtherefinery.

81


CASE26

1990

France

ARIA 26504

CASE27

1990

Japan

JST

CASE28

1990

Japan

JST

CASE29

CASE30

CASE31

CASE32

CASE33

CASE34

1990

1991

1991

1992

1992

1992

Japan

Japan

Germany

JST

JST

eMARS
ARIA 2631
ZEMA 9112

Anairtubecooler(aircooler)rupturedinaunitfor
hydrotreatment/desulphurizationofdistillate.
Leakageofwatercontaminatedwithcrudeoilfroma
corrodedpartofpipingduringremovingoperationof
unnecessarypipingleftforalongtime.
Leakageoffueloilintotheseafromthecorrodedpart
underhotinsulationofreceivingpipeatajetty.
Fireinvolvingavacuumresiduethatwasleakedfromthe
openingofapipeduetocorrosioninthebottomrecycling
lineofavacuumdistillationunit.
AfireoccurredduringrepairworkatanLPGwashing
columnofagasificationdesulphurizationunitforvacuum
residueoilinarefinery.
ApipefailureintheTjunctionsareaofacollectorforan
aircoolerinthehighpressuresectionofthehydrocracker
unitresultedinareleaseofhydrocarbonsandhydrogen,
whichsubsequentlyignited.
Anexplosionoccurredinthehydrogenprocessingunit
occurredreleasingahydrocarbon/hydrogenmixtureto
theatmosphere.

USA

MARSH

Belgium

eMARS
ARIA 22229

Alossofprocessgasoccurredatanelbowinthepipeline
ofadesulphurizationunit.Aflammablecloudwas
releasedtotheatmosphereandexplodedcausingafire.

France

eMARS
ARIA 3969

Abreachinthetransmissionlinefeedingthegasplant
releasedgasintothefluidcatalyticcrackercausinga
violentexplosion.
Anexplosionwascausedbytheignitionofavapourcloud
ofhydrocarbonsthatweremostlikelytohavebeen
releasedfollowingtheruptureofapipeatthebottomof
thenaphthastabilizertower.
Alossofpropane,causedbythecomingapartofapipe
purgingapropanedryer,occurredinarefiningunit.

CASE35

1992

Greece

eMARS
ARIA 3912
Iliopoulou et
al.[52]

CASE36

1993

France

ARIA 26186

CASE37

1993

Japan

JST

CASE38

1993

USA

MARSH

CASE39

1993

Germany

eMARS
ARIA 19222
ZEMA 9310

Fueloilleakagefromthecorrodedpartofbranchpiping
forpressuregaugeattachmentatjettyloadingequipment.
Afireoccurredduringnormaloperationinthecentralunit
ofthreedelayedcokerunits.
Afireoccurredinacokingunit resultinginasignificant
lossofproduct.

82


Asignificantlossofgasolinewasdiscoveredfroma
pipelineintherefineryandanexplosioncloudwasformed
neartherailway.

CASE40

1994

France

ARIA 6011

CASE41

1994

Japan

JST

Firecausedduetosuddenruptureofabufferdrumofa
compressoratalightfueloildesulphurizationunit.

CASE42

1994

United
Kingdom

eMARS

Ruptureofreactorvesselfollowinganexceedenceofthe
designparameters

CASE43

1995

Germany

ARIA 10347
ZEMA 9525

Thegasrecyclingpipelineburstandthespilledcontents
ignited.

CASE44

1995

USA

ARIA 7635
US EPA [53]

Abnormallyhighpressureledtoruptureatthetank
bottomweakenedbycorrosion.

CASE45

1995

France

ARIA 7433

CASE46

CASE47

1996

1996

France

France

ARIA 10400

ARIA 8167

Leakofsulphurizedhydrogeninthetankatthetopofthe
amineregenerationcolumn.
Alossoccurredintherefluxpipe(oftheFCCpumphouse)
downstreamfromaninjectionspoutforsuperheated
water.
Thelossfromathermalexchangerinaunitseparating
aromaticcompoundsfromdistillatesledtotherejection,
viathecoolingwater,offurfuralintoanearbywaterbody.
Leakageandfireduetocorrosionofbranchpipingofa
thermometerofanatmosphericdistillationunitinnormal
operation.

CASE48

1996

Japan

JST

CASE49

1996

France

eMARS

Leakageofsolventduetocorrosionoftubesintheheat
exchanger.

CASE50

1996

Germany

eMARS
ARIA 14666

Aseparatorexplodedcausingareleaseofhydrocarbon
gasesuponstartupofthefreezerinstallation.

CASE51

1998

France

ARIA 23175

Aleakoccurredinalineconnectingthehotseparatorto
thecoldseparatorofagasoildesulphurizationunit.

CASE52

1998

France

ARIA 20356

Followingtheburstingofa250mmpipe,amixture
containinghydrogen,hydrogensulphide,waterand
hydrocarbonswasdischargedintotheatmosphere.
Followingthe lossofcontainmentofapipelinelocated
downstreamfromaflowmeter,dieselusedtocleana
distillationcolumnundervacuumpressureignited.

CASE53

1998

France

ARIA 20355

CASE54

1999

Japan

JST

Firecausedbydiversionofnaphthatoacorrodedpipeline
duringanemergencyshutdown.

CASE55

1999

USA

CSB

Fireinafractionatingtowerinnormaloperationas
workersareperformingmaintenanceontheunit.

CASE56

1999

Greece

eMARS
MARSH

Areleaseandautoignitionoflightgasoiloccurreddueto
afailureofanoverheadlineconnectingacrudefurnaceto

83

areactorinthecrudedistillationunit.

CASE57

1999

United
Kingdom

eMARS

Uncontrolledreleaseofhighlyflammableliquidfroma
leakatthebaseofastoragetank.

CASE58

1999

United
Kingdom

eMARS

Failureofcrudeoilstoragetankduetopittingcorrosionof
thetankbottom.

CASE59

2000

France

ARIA 19538

An8"LPGpipelineburstinacrudedistillationunitdueto
aholeinazoneaffectedthermallybywelding.

CASE60

2000

France

ARIA 19527

Agasleakoccurredinthelowerpartofaprocessreactor
andsubsequentlytheunitwasengulfedinflames.

CASE61

2000

France

ARIA 19522

CASE62

2000

Japan

JST

CASE63

2000

Japan

JST

CASE64

Afirewascausedduetounequalflowdistribution
betweentubesinafinfancooleratanoutletofthe
reactoratafueloilhydrodesulphurizationunit.
Fireinvolvinghydrogensulphidethatleakedfrom
overflashpipingofanatmosphericdistillationcolumn.
Aleakofgasoil,followedbyselfignition,occurredinan
injectionpipefittedwithahightemperaturecorrosion
inhibitor.

France

ARIA 36581

2001

USA

MARSH
Lees

Threedays aftershutdownfromafirethedistillation
towersufferedastructuralfailureduetocorrosionissues
compoundedbythefire.

CASE66

2001

United
Kingdom

eMARS
HSE

Acatastrophicfailureoccurredonasectionofpipework
ontheSaturateGasPlantatanelbowjustdownstreamof
awaterintogasinjectionpoint.

CASE67

2001

USA

eMARS
CSB

Explosioninasulphuricacidstoragetankfarmcausesone
deathand8injuries.

CASE68

2002

France

ARIA 23034

Astreamofcrudeoilwasobservedalongapipelineinthe
refinery.

CASE65

2001

Alossofgasolineoccurredinatrenchnearapipeline.

CASE69

2002

Japan

JST

CASE70

2003

France

ARIA 25346

CASE71

2003

United
Kingdom

eMARS

CASE72

2004

France

ARIA 29518

CASE73

2004

France

ARIA 26978

Leakageand a fireoccurred duetocorrosionofbypass

pipingforrecirculationgasatafueloildesulphurization
unit.
Duringtheunloadingofpyrolysisoilatthejetty,therewas
aleakinanensheathedpipeinthestreetunderpass.
Failureinathermalrelieflinefromapressurereliefvalve
(PRV)duetocorrosionunderinsulation.
Leakofgasoilinadistillationunitduetoaholewornby
corrosioninto3tubesofanopenexchangercircuitcooled
withwater.
Aleakofgasoilfromaninternalpipelinespillednearthe
jetty.

84

A firebroke outinthepreheatingovenofthegasoil
desulphurizationunitoftherefinery.

CASE74

2004

France

eMARS

CASE75

2004

The
Netherlands

eMARS

CASE76

2004

Germany

eMARS

Fireandexplosioninapetroldesulphurizationplant
causedsignificantpropertyonsitedamage.

CASE77

2005

Belgium

eMARS

Failureofastoragetankresultinginthereleaseofall
contents.

CASE78

2005

UK

eMARS

CASE79

2006

France

ARIA 36578

CASE80

2006

France

ARIA 31370

CASE81

2006

Germany

ZEMA

CASE82

2006

Austria

eMARS

Leakageofreformatebenzenefromastoragetank.

Asignificantvolumeofkerosenewasreleasedfromthe
baseofalargestoragetankintothegroundand
groundwaterbeneaththetankandthesite.
A leakoccurredinanelbowsectionofasteelcarbonpipe
atthetopofaprimaryfractionatingcolumn.
Hydrogenescapedduringaloadingoperationandspilled
inthewaterproofzoneofthepumpingstationconnected
toafiltrationpipe.
Leakageintheatmosphericdistillationcolumncauses
releaseofgasoil.
Leakageofcrudeoilpipeduetocorrosionwith
subsequentfire.
Aleakofliquidhydrocarbons fromapipelineresultedina
massivefirewithin2metresdistancefromthelocal
subway.

CASE83

2006

Italy

eMARS

CASE84

2006

Austria

eMARS

Leakageofaheatexchangerandapipecontainingcrude
oilwithsubsequentfire.

CASE85

2006

Italy

eMARS

Acrudeoilleakwasdetectedinthebottompartofthe
shellofafloatingrooftank.
Largevolumesofsulphurdioxide,nitrogencompounds
andhydrogensulphidewerereleasedtotheflareafter
failedattemptstostopaleakinthesulphurrecovery
plant.

CASE86

2006

USA

LDEQ

CASE87

2006

USA

LDEQ

Aleakinanundergroundlineofthecatalyticreformer
causedareleaseof15tonsofcorrosivewasteandsludge.

CASE88

2007

Germany

ZEMA

Becauseofincorrectairflowtherewasanironsulphide
fireinaflarepipe.

CASE89

2007

United
Kingdom

eMARS

Afireoccurredintheisomerizationplant(Unit35)
releasingasignificantvolumeofnaptha.

85


CASE90

CASE91

2007

2008

USA

LDEQ

France

eMARS
MEEDDAT
[55]
ARIA 34351

Internalcorrosionofapipelineresultedinareleaseof
crudeoiltothesurroundingenvironment.
Duringloadingofatanker,aleakoccurredinacorroded
pipelineandcausedaspillofahighvolumeofheavyfuel
whichlastedoverfivehours,causingsignificantpollution
ofthenearbywaterbody.
Heavyaromatichydrocarbonsescapedfromaninsulated
pipelocatedatthejettyandarereleasedintotheadjacent
waterbody.

CASE92

2009

France

ARIA 37681

CASE93

2010

France

ARIA 38503

A leakwasspottedonanethyleneextrapipelocatedina
walkwayonthedownstreampartofvapocracker.

CASE94

2010

France

ARIA 39803

Aleakofcrudeoilwasdetectedatawaterpipeconnected
toastoragetank.

CASE95

2010

France

ARIA 38023

Anexplosionoccursduetofailureofinsulationinasection
oftheatmosphericdistillationunit.

CASE96

2011

France

eMARS
ARIA 40173

Anoilleakwasdetectedinadesulphurizationunitcausing
areleaseofhydrogenandhydrogensulfide.

CASE97

2012

Spain

eMARS

CASE98

CASE99

2012

2012

France

USA

ARIA 42801

CSB

Afireoccurredinthefluidcatalyticcrackingunitofanoil
refineryduetoaleakinaprocesspipe.
Aleakwasdetectedinahydrodesulphurizationunitofa
refineryprobablyduetocorrosionfromexposureto
hydrogensulphide.
Thecatastrophicfailureofapipeinthecrudeoil
distillationunitreleasedflammablesubstancesand
producedalargevapourcloudthatspreadtotheoffsite
community.

86

87

APPENDIX 2: REFERENCES

[1]

U.S.EnergyInformationAdministration.IndependentStatisticsandAnalysis.
http://www.eia.gov

[2]

EuropeanCommission.2010.Energyinfrastructureprioritiesfor2020andbeyonda
blueprintforanintegratedEuropeanenergynetwork.CommissionStaffWorking
Paper.CommunicationfromtheCommissiontotheEuropeanParliament,theCouncil,
theEuropeanEconomicandSocialCommitteeandtheCommitteeoftheRegions.SEC
(2010)1398Final.Brussels,Belgium.17November2010.http://eur
lex.europa.eu/LexUriServ/LexUriServ.do?uri=SEC:2010:1398:FIN:EN:PDF

[3]

EuropeanCommission.Energy.StatisticsandMarketObservatory.
http://ec.europa.eu/energy/observatory/oil/refining_processing_en.htm

[4]

U.S.DepartmentofEnergy.2012.Numberandcapacityofpetroleumrefineries.Energy
InformationAdministration.
http://www.eia.gov/dnav/pet/pet_pnp_cap1_dcu_nus_a.htm

[5]

Wikipedia.http://en.wikipedia.org/wiki/List_of_oil_refineries

[6]

RuschauGRandMAAlAnezi.2002.AppendixUPetroleumRefineries.Corrosioncosts
andpreventivestrategiesintheUSA.U.S.DepartmentofTransportationFederal
HighwayAdministrationwithCCTechnologiesandNACEInternational.PublicationNo.
FHWARD01156.http://corrosionda.com/information/otherstudies/index.htm

[7]

CocoJ,Editor.2003.The100LargestLosses(19722001):LargePropertyDamage
LossesintheHydrocarbonChemicalIndustries.20thEdition:MarshPropertyRisk
Consulting20thEdition.APublicationofMarshsRiskConsultingPractice.

[8]

InternationalEnergyAgencyandtheOrganizationforEconomicCooperationand
Development.2012.RecentDevelopmentsinEURefiningandProductSupply.
PresentationattheEURefineryForum.12April2013.Brussels,Belgium.
http://ec.europa.eu/energy/observatory/oil/doc/refining/20130505_eu_refining_foru
mhalffiea20130412.pdf

[9]

YeungTW.2007.LatestRefiningAdvancestoProcessHACsandBOB.Hydrocarbon
PublishingCompany.CrudeOilQualityGroupMeeting.Chicago.June7,2007.
http://www.coqainc.org/Yeung_Presentation.pdf

[10]

RopitalF.2009.Currentandfuturecorrosionchallengesforareliableandsustainable
developmentofthechemical,refinery,andpetrochemicalindustries.Materialsand
Corrosion2009,60,No.7.WILEYVCHVerlagGmbH&Co.KGaA,Weinheim.

[11]

ISO8044.1999.Corrosionofmetalsandalloysbasictermsanddefinitions.

[12]

TinoA,SWiryolukito,andMAbduh.2008.Corrosion:Technicalandeconomicdrivers
fortheIndonesiaoilandgasindustry.PetroenergyMagazine.JanFeb2008.

88

[13]

MannanS.Ed.2005.Leeslosspreventionintheprocessindustries.Hazard
Identification,AssessmentandControl.Thirdedition.UnitedStatesofAmerica:Elsevier
Inc.

[14]

EuropeanAccidentGravityScale.1994.CommitteeofCompetentAuthoritiesforthe
SevesoDirective.http://www.aria.developpementdurable.gouv.fr/Echelle
europeennedesaccidents3309.html

[15]

KhanFI,THusainandRHejazi.2001.Anoverviewandanalysisofsiteremediation
technologies.JournalofEnvironmentalManagement71(2004)95122.

[16]

EtkinDS.2000.WorldwideAnalysisofMarineOilSpillCleanupCostFactors.Presented
attheArcticandMarineOilspillProgramTechnicalSeminar.June1416.Alberta,
Canada.
http://www.environmentalresearch.com/erc_papers/ERC_paper_2.pdf

[17]

AmericanPetroleumInstitute.2003.DamageMechanismsAffectingFixedEquipmentin
theRefineryIndustry.RecommendedPractice571.FirstEdition.December2003.
Washington(DC),USA.

[18]

U.S.OccupationalSafetyandHealthAuthority.Petroleumrefiningprocesses.OSHA
TechnicalManual.http://www.osha.gov/dts/osta/otm/otm_iv/otm_iv_2.html

[19]

Freedonia.2010,WorldHydrogenIndustryStudywithForecastsfor2013and2018:
http://www.freedoniagroup.com/brochure/26xx/2605smwe.pdf.

[20]

U.S.DepartmentofEnergy.2007.RefineryOutages:DescriptionandPotentialImpact
onPetroleumProductPrices.EnergyInformationAdministration.OfficeofOilandGas.
Washington(DC),USA.ftp://ftp.eia.doe.gov/service/SROOG200701.pdf

[21]

GroysmanA.2006.Anticorrosionmanagement,environmentandqualityattheoil
refiningindustry.
http://www.engineers.org.il/_Uploads/1598AntiCorEnvironIndiaPaper06.pdf.

[22]

JonesDSJ.2006.Anintroductiontocrudeoilanditsprocessing.Chapter1.Handbook
ofPetroleumProcessing.DSJJonesandPRPujad,eds.Springer:Dordrecht,The
Netherlands.

[23]

JonesDSJ.2006.Supportsystemscommontomostrefineries.Chapter13.Handbook
ofPetroleumProcessing.DSJJonesandPRPujad,eds.Springer:Dordrecht,The
Netherlands.

[24]

JonesDSJ.2006.Petroleumproductsandarefineryconfiguration.Chapter6.
HandbookofPetroleumProcessing.DSJJonesandPRPujad,eds.Springer:
Dordrecht,TheNetherlands.

[25]

CatonJ,BRacen,andGTroutman.2008.Corrosionandfoulinginsulphuricacid
alkylationunits.DuPontSTRATCOCleanFuelTechnology.Leawood,Kansas(USA).
September2008.
http://www2.dupont.com/Sustainable_Solutions/en_US/assets/downloads/stratco/Alk
ylationUnit_CorrosionFouling.pdf

[26]

Felton,B.2001.Inthelineoffire.InTechMagazine.June2001.
http://www.isa.org/isaolp/journals/pdf/intech/20010654.pdf
89

[27]

JovanovichA.2003.Riskbasedinspectionandmaintenanceinpowerandprocess
plantsinEurope.NuclearEngineeringandDesign.Vol.226,no.2,pp.165182.

[28]

INERIS.2010.Benchmarkstockageenraffinerie.Matriseduvieillissementdes
installationsindustrielles.Rapportdtude29/04/2010.NDRA0910295708289B.
VerneuilenHalette,France.

[29]

INERIS.2010.Benchmarksurlestuyauteriesenraffineries.Maitriseduvieillissement
desinstallationsindustrielles.Rapportdtude05/02/2010.NoDVM10102957
08343B.PreparedfortheMinistryofEcologyandSustainableDevelopment.Verneuil
enHalette,France.http://www.ineris.fr/centredoc/benchmarktuyauteriesraffinerie
web.pdf

[30]

INERIS.2009.FinalreportInternationalbenchmarkonregulationsandpracticesas
regardsmanagingindustrialinstallationageing.StudyReportNDRA09102957
07985C.VerneuilenHalette,France.http://www.ineris.fr/centredoc/ageingweb.pdf

[31]

WintleJ,PMoore,SSmalleyandGAmphlett.2006.Plantageingmanagementof
equipmentcontaininghazardousfluidsorpressure.ResearchReport509.Preparedby
TWILtd,ABBEngineeringServicesSCS(INTL)LtdandAllianzCornhillEngineerforthe
HealthandSafetyExecutive.Norwich,UnitedKingdom.
http://www.hse.gov.uk/research/rrhtm/rr509.htm

[32]

HealthandSafetyExecutive.Integrityofatmosphericstoragetanks.SPC/Tech/Gen/35.
http://www.hse.gov.uk/foi/internalops/hid_circs/technical_general/spctechgen35.htm
#supportingguidanceinspection

[33]

SAFed.2003.GuidelinesonPeriodicityofExaminations.DocumentReference:PSG1
Issue02Dated06/11/03.TheSafetyAssessmentFederationLtd.London,United
Kingdom.

[34]

AmericanWeldingSociety.2007.UnderstandingCorrosion.InspectionTrends.
Summer2007.http://www.aws.org/itrends/2007/07/it200707/it070734.pdf.

[35]

HealthandSafetyExecutive.2011.Corrosionunderinsulationofplantandpipeworkv3.
PreparedbyHIDCI5B.UnitedKingdom.
http://www.hse.gov.uk/foi/internalops/hid_circs/technical_general/spc_tech_gen_18.h
tm

[36]

HealthandSafetyExecutive.2001.Reviewofcorrosionmanagementforoffshoreoil
andgasprocessing.PreparedbyCapcisLimited.OffshoreTechnologyReport2001/044.
Norwich,UnitedKingdom.

[37]

VanWijkL,SJovanovichandDBalos.2012.Reviewandsynthesisofcorrosion
phenomenaandrelatedriskmanagementpracticesinpetroleumrefineries.Prepared
fortheEuropeanCommissionJointResearchCentrebySteinbeisAdvancedRisk
TechnologiesGmbh.Stuttgart,Germany.

[38]

SkletS.2006.Safetybarriers:Definition,classification,andperformance.Journalof
LossPreventionintheProcessIndustries19(2006)494506.

90

[39]

AFranks.2002.Linesofdefence/layersofprotectionanalysisintheCOMAHcontext.
PreparedbyAmeyVECTRALimitedfortheHealthandSafetyExecutive.Warrington,
UnitedKingdom.http://www.hse.gov.uk/research/misc/vectra3002017r02.pdf

[40]

UKHealthandSafetyExecutive.2001.Reviewofcorrosionmanagementforoffshoreoil
andgasprocessing.PreparedbyCapcisLimited.OffshoreTechnologyReport2001/044.
Norwich,UnitedKingdom.

[41]

SinghBandKKanaKrishnathasan.2009.Pragmaticeffectsofflowoncorrosion
prediction.NACECorrosion2009ConferenceandExpo.Houston,Texas.

[42]

Directive2012/18/EUoftheEuropeanParliamentandoftheCouncilof4July2012on
thecontrolofmajoraccidenthazardsinvolvingdangeroussubstances.AnnexIII.
InformationreferredtoinArticle8(5)andArticle10onthesafetymanagementsystem
andtheorganisationoftheestablishmentwithaviewtothepreventionofmajor
accidents.

[43]

MitchisonNandSPorter.1999.GuidelinesonaMajorAccidentPreventionPolicyand
SafetyManagementSystem,asrequiredbyCouncilDirective96/82/EC(SEVESOII).
JointResearchCentre.EuropeanCommission.Ispra,Italy.EUR18123EN.

[44]

ProcessSafetyManagementRule.U.S.CodeofFederalRegulations.Part29.Section
1910.119(PSM).
https://www.osha.gov/pls/oshaweb/owadisp.show_document?p_table=STANDARDS&p
_id=9760

[45]

RiskManagementProgramRule.U.S.CodeofFederalRegulations.Part40.Section68
(RMP).http://www.epa.gov/osweroe1/docs/chem/AppendixAfinal.pdf

[46]

Chosnek,J.2010.Managingmanagementofchange.ProcessSafetyProgress.Volume
29,Issue4,pages384386,December2010

[47]

SelvaR.2012.Riskbasedinspection(RBI)bestpractice:TheTechnicalSpecificationfor
EnsuringSuccessfulImplementation.InternationalConferenceonPressureVessel&
PipingTechnology,KeynotePaperTechnicalSession:ManagingRisk.2023May2012.
London,UnitedKingdom.
http://www.ppsimtech.com/downloads/RISK_BASED_INSPECTION_BEST_PRACTICE
THE_TECHNICAL_SPECIFICATION_Ron_Selva_PP_SIMTECH_Keynote_Paper
1_13th_ICPVT_2012_London.pdf

[48]

GearyW.2002.Riskbasedinspectionacasestudyevaluationofonshoreprocessplant.
healthandsafetylaboratories.Sheffield,UnitedKingdom.HSL/2002/20.
http://www.hse.gov.uk/research/hsl_pdf/2002/hsl0220.pdf

[49]

U.S.ChemicalSafetyBoard.2009.Sevenkeylessonstopreventworkerdeathsduring
hotworkinandaroundtanks.ReportNo.200901SB.Washington(DC)USA.
http://www.csb.gov/assets/1/19/CSB_Hot_Work_Safety_Bulletin_EMBARGOED_until_
10_a_m__3_4_10.pdf

[50]

GKoch,MPHBrongers,NGThompson,YPVirmani,JHPayer.2001.Corrosioncost
andpreventivestrategiesintheUnitedStates.PreparedbyCCTechnologiesforthe
FederalHighwayAdministration.ReportNo.FHWARD01156.McLean(VA),USA.
http://www.corrosioncost.com/pdf/main.pdf
91

[51]

LossPreventionBulletin.UnionOilamineabsorbertower.Issue163.February2002.
Rugby,UnitedKingdom.(OriginallypublishedbytheInstituteofWelding.)

[52]

lliopoulouE,LochaitisA,KomninakisE,PoulikakosL,AsfourS,ChalkitisS,andTzortzis
C.1994.MassdisastersinGreece.AnnalsofBurnsandFireDisasters.Vol.VII.No.1.
March1994.
http://www.medbc.com/annals/review/vol_7/num_1/text/vol7n1p36.htm

[53]

U.S.EnvironmentalProtectionAgency.1998.EPAchemicalaccidentinvestigation
report.PennzoilProductCompanyRefinery.Rouseville,Pennsylvania.USEPA.Officeof
SolidWasteandEmergency.EPA550R98001.Washington(DC),USA.Http://
http://nepis.epa.gov

[54]

UKHealthandSafetyExecutive.2005.Publicreportofthefireandexplosionatthe
ConocoPhillipsHumberrefineryon16April2001.
http://www.hse.gov.uk/comah/conocophillips.pdf

[55]

Ministredelcologie,delnergie,duDveloppementDurableetdelAmnagement
duTerritoire.2008.Retourdexpriencesuitelaccidentdu16mars2008la
raffineriedeDonges.DossierdePresse.
http://www.aria.developpementdurable.gouv.fr/Petroleumrefining2931.html

92

European Commission
EUR 26331 EN Joint Research Centre Institute for the Protection and Security of the Citizen (IPSC)
Title: Corrosion Related Accidents in Petroleum Refineries: Lessons learned from accidents in EU and
OECD countries
Authors: Maureen Heraty Wood, Ana Lisa Vetere Arellano, and Lorenzo Van Wijk
Luxembourg: Publications Office of the European Union
2013 100 pp. 21.0 x 29.7 cm
EUR Scientific and Technical Research series ISSN 1831-9424 (online), ISSN 1018-5593 (printed)
ISBN 978-92-79-34652-1 (pdf)
ISBN 978-92-79-34653-8 (print)
doi:10.2788/37909

Abstract
Petroleum refineries are generally acknowledged to be high hazard sites due to the nature of petroleum
products and the processing technologies that produce them in the current era. For the most part,
however, the risks are well-known and refinery operators have applied considerable knowledge and
resources over the past decades to control and minimize risk potential. Nonetheless, major accidents in
refineries tend to regularly occur with impacts not only on human health and the environment, but also in
many cases on social and economic well-being. A recurring cause of accidents in petroleum refineries
is well-known to be corrosion. This report studies corrosion-related accidents in refineries within the
European Union (EU) and the Organization for Economic Co-operation and Development (OECD),
comparing accident occurring before and after 2000 and with the view to providing insights into recent
causal trends and identifying lessons learned that could influence prevention strategies in future. The
report highlights process and equipment conditions and potential risk management failures that were
cited in 99 different corrosion-related accidents occurring between 1965 and 2008. In particular, the
study provides some evidence to confirm concerns among experts in both government and industry that
the risk of corrosion failures causing major accidents in EU and OECD countries remains a strong area
of concern. The aim of this analysis is to aid particular inspectors by providing a concise summary of
refinery corrosion hazards and examples of how they have been manifested in past accidents. The
findings may be also useful to operators in renewing aspects of their risk management strategy or
training personnel on how to recognize and evaluate potential corrosion risks.

LBNA26331ENE

AstheCommission'sinhousescienceservice,theJointResearchCentre'smissionis
toprovideEUpolicieswithindependent,evidencebasedscientificandtechnical
supportthroughoutthewholepolicycycle.
WorkinginclosecooperationwithpolicyDirectoratesGeneral,theJRCaddresses
keysocietalchallengeswhilestimulatinginnovationthroughdevelopingnew
methods,toolsandstandards,andsharingitsknowhowwiththeMemberStates,
thescientificcommunityandinternationalpartners.