 June 21st, 2019, the Philadelphia Energy Solutions or PES Refinery in Philadelphia, Pennsylvania, a dangerously corroded pipe elbow ruptured, releasing process fluid into the refineries hydrofluoric acid or HF alkylation unit. The process fluid then ignited, causing a fire and series of explosions. The fire and explosions caused the release of over 5,000 pounds of highly toxic HF, launched a 38,000-pound vessel fragment off-site and resulted in an estimated property damage loss of $750 million. The Philadelphia Energy Solutions Refinery was the largest oil refining complex on the East Coast and could process up to 335,000 barrels of crude oil per day. Within its hydrofluoric acid alkylation unit, the refinery produced alkylate, a high-octane blending component of gasoline. That was done by using hydrofluoric acid as a catalyst. HF is a highly toxic chemical that is particularly hazardous if a release occurs because it vaporizes becoming airborne. Breathing HF can cause lung damage and skin contact with HF can cause severe burns and death. On the day of the incident, the HF alkylation unit was operating normally. Shortly before 4 a.m., a board operator in the refineries main control room performed a routine change in the configuration of the process within the unit. The operator increased the flow of process fluid in an area of the unit by a total of 7 barrels per hour. Stable operation continued with no abnormal pressure or temperature changes in the unit as a result of these actions. But nevertheless, at 4 a.m., a severely corroded pipe elbow within the unit ruptured. Flammable process fluid containing mostly propane along with a small concentration of HF escaped through the failed pipe elbow. The leaking process fluid formed a large ground-hugging vapor cloud about 10 feet high that engulfed a portion of the unit. Moments later, the vapor cloud ignited, causing a massive fire. Approximately 30 seconds later, the board operator took steps to prevent the release of additional HF. This was done by rapidly draining the unit's 339,000 pounds of hydrophoric acid to a special vessel called the Rapid Acid Deinventory or RAD drum. The RAD drum was designed to safely hold HF in the event of an incident. At 4.15, due to the ongoing fire, an explosion erupted in the alkylation. Four minutes later, a second explosion. At 4.22, a process vessel in the unit containing flammable hydrocarbons violently ruptured, causing the third largest explosion. A giant 38,000-pound fragment of the vessel flew across the Schoolkill River and landed on the river's opposite bank. Two other fragments, one weighing about 23,000 pounds and the other about 15,500 pounds, landed inside the refinery. The fire knocked out the control system communication to the refinery's HF water mitigation system and the backup power supply to the system also failed. As a result, the refinery's elevated HF mitigation water cannons, which were designed to spray high volumes of water to help contain an HF release, could not be turned on remotely from the control room. The water mitigation system was a critical safeguard at the refinery, designed to prevent released HF from going off-site. About 40 minutes after the release began, the refinery's shift supervisor, wearing bunker gear, entered the unit and manually turned on a pump that allowed the HF mitigation water cannons to operate. Other refinery workers closed valves to stop the flow of hydrocarbons and steam into the unit. The fire burned for over 24 hours until it was finally extinguished the following day at about 8.30 a.m. Five workers sustained minor injuries during the incident and response. CSB is unaware of anyone off-site experiencing health impacts from the hydrofluoric acid release. The CSB launched an investigation into the fire and explosions and found five key safety issues contributed to the severity of the incident. They are mechanical integrity, verifying safety of equipment after changes to good practice guidance, remotely operated emergency isolation valves, safeguard reliability in HF alkylation units, and inherently safer design. The first safety issue is mechanical integrity. CSB determined that the pipe elbow that failed had corroded faster than other piping in the HF alkylation unit. That is because the steel pipe elbow contained a higher content of nickel and copper than other piping in the unit. Carbon steel is commonly used in HF alkylation units, but is known to be susceptible to hydrofluoric acid corrosion. In refinery processes using some amount of HF, hydrogen fluoride reacts with iron in steel piping to produce iron fluoride. The iron fluoride then forms a film that coats the inside surface of the piping and protects the steel from corrosion. However, if the steel contains high concentrations of copper, nickel, or chromium, known as residual elements, the rate of corrosion is often higher. This is because the iron fluoride film that forms on steel containing high amounts of residual elements is less protective. The pipe elbow that ruptured in the PES refinery was installed around 1973. It had originally been constructed of a particular steel alloy that intentionally contained a higher concentration of nickel and copper. But by current industry practices, the high concentrations of nickel and copper in the pipe elbow meant it was not fit for service in a process using hydrofluoric acid. Yet the pipe elbow remained in service for over 40 years, corroding at a much faster rate than adjacent piping components that did not have high concentrations of residual elements. The CSP also found that PES and the previous owner of the refinery never inspected all carbon steel piping circuit components susceptible to HF corrosion. Such a program was not required in the standard set by the American Petroleum Institute or API for the safe operation of hydrofluoric acid alkylation units. But had PES or the former owner inspected all of the carbon steel piping circuit components susceptible to HF corrosion in the unit, they may have identified that the pipe elbow was corroding at a faster rate than adjacent piping components, which could have prevented the incident. After the incident, API revised its standard to include a new requirement for companies to develop a special emphasis inspection program to identify areas of accelerated corrosion in their refineries. The second safety issue identified by the CSB involves verifying the safety of equipment after changes to good practice guidance. When the pipe elbow was initially installed in 1973, the standard set by ASTM International for carbon steel piping did not specify limits on nickel or copper content. Over the next decades, that standard changed and by 1995, the ASTM standard had been revised enough that the pipe elbow no longer met its requirements due to the elbows high levels of nickel and copper. Yet neither PES nor the previous refinery owner performed a comprehensive evaluation of all installed HF alkylation unit piping components manufactured to older versions of ASTM standards to ensure that the piping components were still safe to use. The third safety issue discovered by the CSB concerns remotely operated emergency isolation valves. The largest of the three explosions at PES occurred when a vessel located above the failed pipe elbow violently ruptured. The CSB concluded that a jet flame shot from the ruptured pipe elbow and heated the bottom of the steel vessel which contained a large amount of flammable hydrocarbons. For over 20 minutes, the jet flame erupted from the failed pipe elbow, weakening the steel bottom of the vessel and causing it to stretch and thin. The vessel then ruptured, launching three huge fragments into the air. The CSB found that there were no emergency isolation valves installed in the HF alkylation unit to remotely isolate nearby hydrocarbon sources that could then flow through the failed elbow. And these valves are not explicitly required by the current API standard on safe operation of hydrofluoric acid alkylation units. As a result, the CSB made a recommendation to API to update its standard on safe operation of hydrofluoric acid alkylation units to require installation of remotely operated emergency isolation valves on the inlets and outlets of all hydrofluoric acid-containing vessels and any hydrocarbon-containing vessels meeting defined threshold quantities. The CSB found a fourth safety issue that contributed to the incident at the PES refinery, which is safeguard reliability in HF alkylation units. At PES, the HF alkylation unit was equipped with a water spray mitigation system that was a critical safeguard in the event of an HF release. The water mitigation system was designed to use cannons to spray large volumes of water at any HF release in order to suppress the amount of vaporized HF so that it could not travel off-site to neighboring communities. But when the control room operator tried to remotely turn on the water pumps that fed the water cannons, it was not possible because the control system communication to the water pumps as well as a backup power system in the unit had both failed during the initial fire. Although API recommends fireproofing these elements, it does not specifically require companies to do so. Instead, 40 minutes elapsed from the time of the release before a worker was able to manually turn on the pump. In the meantime, highly toxic HF was able to freely escape from equipment and vaporize into the air. As a result, the CSB made an additional recommendation to API to update its standard to require protection of critical safeguards and associated control system components from fire and explosion hazards, including radiant heat and flying projectiles. And to help ensure that new API safety requirements and recommendations are implemented effectively nationwide. The CSB recommended that the EPA should develop a program that emphasizes inspecting refinery HF alkylation units to verify that companies are complying with API's standard. The fifth and final safety issue highlighted by the CSB and its report on the incident at PES is inherently safer designed. Of the 155 U.S. petroleum refineries currently in operation in the United States, 46 operate HF alkylation units. But hydrofluoric acid is highly toxic and is one of the eight most hazardous chemicals regulated by EPA's RMP program. The other acid catalyst used in refinery alkylation units is sulfuric acid. Although sulfuric acid is highly corrosive and can cause skin burns upon contact, it remains a liquid upon release. Therefore, it does not present the same risk to surrounding communities as HF, which vaporizes upon release and has the potential to travel off-site. In addition, alternative alkylation technologies have been developed. These include a solid acid catalyst as well as the new ionic liquid acid catalyst which was developed by Chevron. Using a sulfuric acid catalyst or other new alkylation technologies would prevent off-site human exposure to HF in the event of future incidents. Replacing highly toxic chemicals with less hazardous chemicals is an inherently safer design approach. In its report, the CSB recommended that the EPA require petroleum refineries to conduct a safer technology and alternatives analysis as part of their process hazard analysis as well as evaluate the practicability of any inherently safer technology. And initiate prioritization to evaluate whether HF is a high priority substance for risk evaluation. If it is, conduct a risk evaluation of HF and implement any identified corrective actions as required by the Toxic Substances Control Act.