AIChE Paper Number 175267

ETHYLENE UNIT FIRE LESSONS LEARNED

SUNOCO MARCUS HOOK, PA REFINERY

By Arthur Jensen
Mechanical Reliability Specialist
Sunoco, Inc.

Prepared for Presentation at the 2010 Spring National Meeting

San Antonio, TX, March 21 – 25, 2010

AIChE and EPC shall not be responsible for statements or opinions contained in papers or
printed in its publications
 ETHYLENE UNIT FIRE LESSONS LEARNED
SUNOCO MARCUS HOOK, PA REFINERY
By Arthur Jensen
Mechanical Reliability Specialist
Sunoco, Inc.

Abstract

At approximately 10:15 p.m. on Sunday, May 17, 2009, there was a sudden and large
hydrocarbon release from a main process pipe in the Ethylene Unit at the Sunoco Marcus
Hook, Pennsylvania Refinery. The release found an ignition source at an operating process
furnace within 2 seconds, resulting in a fire. Seven other process lines within the pipe rack in
the vicinity of the initial release ruptured from short-term overheating within the first 10
minutes. Fire fighting and process isolation efforts brought the fire under control, but it
continued to burn for approximately 18 hours while process systems depressured. There were
no injuries from the fire or the emergency response activities. There was significant heat
damage to facility piping and equipment in the vicinity of the initial release, and the event
received media coverage and attention from regulatory agencies.

The initial release was from a pipe rupture 10” long by 7” wide on the bottom of the 10"
diameter (60oF - 475 psig) main process line. The cause of the failure was long-term localized
external corrosion at a pipe support contact area. A loose steel quarter-sleeve was found
under the pipe at the support location, with the dimensions of the sleeve being almost
identical to the size of the localized thin area. This sleeve trapped moisture creating crevice
corrosion between the sleeve and outside of the pipe. This sleeve also obscured the corrosion
such that visual pipe inspections failed to detect the degradation. There was essentially no
corrosion or thinning of the line outside of this sleeve crevice area during the 48-year service
life.

The investigation identified the physical causes of the failure as well as design, inspection,
maintenance, and operational work practice areas for improvement to prevent a similar event
in the future.
 Background

The ethylene unit at the Marcus Hook facility is a multi-step separation and distillation
purification process to produce a high-purity ethylene product stream. The ethylene product is
subsequently used by downstream units to produce ethylene oxide, polyethylene, or for
ethylene product sales. The unit was built in 1961 by SunOlin Company with the process and
design license from Lummus Technology. The facility is constructed on a remote corner of the
Sunoco Marcus Hook Refinery, and was purchased and subsequently operated by Sunoco in
approximately 1990.

The distillation process is high pressure (400 to 500 psig) and very cold (down to -140oF). The
feed stream to the ethylene unit is a mixture of light refinery gases including butane, propane,
ethane, ethylene, methane, hydrogen, carbon dioxide, sulfur compounds, and other
contaminants. The process first involves amine scrubbing to remove sulfur compounds and
contaminants. This is followed by desiccant driers to remove any moisture from the process
stream, which would condense and freeze inside the cold distillation towers. The desiccant
drying section of the unit is of particular importance, since this is the section where the pipe
failure and fire occurred.

What Happened

At approximately 10:15 p.m. on Sunday night, May 17, 2009, there was a hydrocarbon release
and fire on the ethylene unit at the Marcus Hook Refinery. This was followed by a sustained
fire in the area surrounding the initial release. Within the first minute of the release the unit
operators initiated the unit shutdown functions, including emergency trip of the feed gas and
recycle compressors. This reduced the pressure on various systems on the unit and also
began to depressure systems through the flare stack. Over the next 10 minutes there were
additional releases in the same area of the pipe rack, and these additional releases continued
to fuel the fire. Unit operations personnel and responders from Sunoco emergency response
and outside volunteer fire companies began aggressive actions to fight the fire within the first
10 minutes, providing water cooling to piping and equipment that stabilized the fire after the
initial series of releases.

Over the next several hours the fuel sources to the fire were blocked in and the systems de-
pressured, steadily reducing the size and intensity of the fire through the night. By the
morning of Monday, May 18, the fire was under control, but one or more systems continued to
de-pressure and feed small fires on the unit. By 4:30 p.m. on Monday afternoon, May 18,
2009, the final systems had de-pressured and the fire was declared extinguished.

There were no reported injuries from the fire or subsequent emergency response activities.
There was damage to ethylene unit piping, structures, and equipment in the proximity of the
fire. Intra-refinery piping systems that pass through this area of the ethylene unit were also
damaged, requiring other refinery units to be shut down or cut back until repairs were made
or bypass systems installed. There was television, radio, and newspaper coverage of the
event. Investigations by Sunoco investigators, the Delaware Fire Marshal’s Office, and OSHA
were started on Monday morning, May 18, while the fire was being extinguished.

Evidence Summary: Physical Causes

The investigation followed a combination of methodologies, including the United Steel Workers
Triangle Of Prevention (TOP) System Of Safety (SOS) analysis, and the Failsafe Latent Cause
Analysis (LCA) methodologies. Both of these methodologies place a high importance on
systematic evidence gathering and evaluation – including evidence from people (witness
interviews to obtain observations and knowledge), physical (photographs and analysis of
plant components involved in the event), and paper (process monitoring computer data,
records, procedures, etc.). The following is a summary of the evidence the investigation team
used toward the determination of the physical causes of this event:

• Several witnesses in the refinery at the time of the release reported hearing a loud release
noise, similar to the sound made when a high-pressure boiler safety valve lifts. They
turned to look in the direction of the noise, and within about one second reported seeing a
large fire ball ignite at the ethylene unit. Witnesses reported the initial fire was very large
and very intense: “300 feet high by 300 feet wide”. Figure 1 includes two photographs
which support these initial eyewitness observations: the photo on the left was taken
between 30 seconds to 1 minute after the initial release, and the photo on the right was
taken the morning after the fire to orient the location and scale of the fire.

Boiler stack ~300 ft high

Figure 1: The photo on left was taken from an eyewitness camera within one minute of the initial
release and fire. The distance is approximately ½-mile from the ethylene unit. The photo on the right
was taken the next day to orient and provide a reference for the eyewitness photo.
• Physical evidence identified the initial failure was a 10” high-pressure (475 psig) process
gas line that experienced a large (10” by 7”) rupture in the bottom of the line at the
location of a pipe support. This was a main process gas line through the ethylene unit, on
the common outlet line from the desiccant drier vessels. The failure location was in the
lower tier of a 3-tier main pipe rack through the unit, with numerous other process and
utility lines in close proximity. Figure 2 shows photographs of this initial line rupture.

Side view of initial

10” line leak.

Figure 2: The photo on left was taken from ground level. The photo on the right is a close-up photo
of the rupture, showing the 10” x 7” hole in the bottom of the pipe. Pieces of the ruptured line are
visible “folded back” on the line, with other pieces missing. The bottom of the line blew out in a
manner similar to a rupture disk, suggesting the metal was very thin in this localized area.

• This 10” pipe was a mixed-light-hydrocarbon main process line through the ethylene unit.
The process is routed through multiple interconnected piping, vessel, exchanger, and
distillation towers on the unit, such that there was a large volume of high pressure gas in
the system at the time of the failure.
• Within the first 10 minutes of the event witnesses reported hearing up to 6 additional
ruptures and releases. Physical evidence after the event has shown that in addition to the
initial 10” line rupture there were 7 other secondary line ruptures within the pipe rack from
short-term overheat. Process data supports that these secondary ruptures took place
between 3 minutes and 10 minutes after the initial release and fire. The evidence indicates
that fire fighting and cooling water spray efforts were effective at preventing additional
pipe failures after the first 10 minutes.
• Process monitoring data was reviewed after the event, and this showed the initial system
pressure loss was in the area of the process that included the V210A and B process
desiccant driers. Figure 3 shows a simplified schematic of the process drier system with
the relevant process pressure and flow data (at the upstream compressors and
downstream deethanizer tower) highlighted. The data showed other systems having
sudden pressure loss several minutes and up to 8 minutes after the initial leak, consistent
with the secondary pipe ruptures due to short-term overheating.
 Process Drier Simplified Schematic

10:15 p.m. - Pressure

drops sharply with large 10:15 p.m. - Pressure
flow forward sudden drops sharply with flow
increase forward stop (reverse
flow)

Figure 3: Simplified schematic of the desiccant drier section of the unit, including process data from
upstream and downstream equipment.

• The initial pipe rupture on the 10” process gas line was determined to be from external
corrosion at the bottom of the pipe. A localized area of corrosion (approximately the size
of the failure) resulted from the presence of a loose steel sleeve under the pipe where it
crossed over the pipe support (approximately 18 feet above grade). This loose sleeve was
found resting on top of the pipe support (under the failed pipe) the morning after the fire
was extinguished. Figure 4 shows a photograph of the sleeve along with the approximate
orientation where the sleeve was found.
• The presence of this sleeve could enable moisture to be trapped within the crevice space
between the sleeve and pipe. A crevice between two metal components would create a
localized galvanic corrosion cell, with the potential to increase the expected corrosion rate
significantly.
• A corrosion situation such as this would be accelerated due to the normal operating
temperature of this process line, which was approximately 60oF year-round. During the
summer months the metal surface temperature of this uninsulated line would be below the
 daily dew point temperature, such that the line would sweat and enable the moisture to be
pulled into the crevice area between the sleeve and pipe.

• The sleeve is ~10 inches

long and provided extended
area of contact corrosion.
• The large corrosion area
explains the large initial
“blowout” failure.

The loose sleeve was found

under the failure (resting on
top of the pipe support) the
morning after the fire.

Figure 4: Loose steel sleeve found under the failed pipe the morning after the fire.

• Although there is evidence the pipe was originally painted, there was no evidence
indicating that this paint was a grade sufficient for a continuously wet marine-type
environment. Pipe and sleeve external corrosion (outside of the crevice area) was
negligible over the 48-year service life of the pipe.
• Within the crevice area the corrosion was significant, with the physical metallurgical
examination showing that 90% of the metal thickness had corroded away in the proximity
of the failure area.
• The metallurgical analysis verifies that the area within the sleeve had severe pipe wall
thinning occurring over a long time period prior to the May 17 failure.
• During the night of May 17 the 10” process gas line was going through a normal thermal
transient due to the planned start of the regeneration of the V210B desiccant drier. This
thermal transient and thermal growth of the piping could have caused a minor amount of
pipe movement at the location of the failure. It is believed that a small amount of
movement could be what initiated the pipe failure and loss of containment. Although this
small movement is believed to be what “triggered” the failure, the ongoing and
undiscovered corrosion at the failure location is the primary cause of this event.
• A contributing factor to the size of the initial rupture was also determined to be the high-
pressure gas service of this piping system. With an initial small leak the gas will rapidly
expand through the fracture, and the large and rapid energy release will cause the fracture
area to expand rapidly along the area of pipe thinning. The result (in this case) was a
large “blowout” type of failure along the entire area of thin pipe. If the system pressure
was much lower, or the service was a non-expanding liquid, then it would be more likely
that the failure would have been a small fracture and much smaller leak, rather than the
large blowout rupture.
• The H-202 drier regeneration heater, which was operating at the time of the leak, was
determined to be the ignition source of the fire. There were penetrations through the
heater skin at the top of the fire box (approximately 20 ft above grade), along with a
negative draft inside the heater during operation. This would enable a flammable mixture
to be drawn into the fire box where numerous hot surfaces provided ignition sources. The
ignited flammable mixture then flashed back outside the heater.

Ignition source at
top of H202 Heater

Desiccant driers

Initial 10” pipe failure

Figure 5: Overhead photo of fire damage area within the ethylene unit.
• Due to the operating pressure of the system (475 psig), the size of the initial pipe rupture,
and the volume of material in the system, the velocity of the leaking process gas was high.
Dispersion models estimated that the flammable vapor cloud reached the top of H202 fire
box area and ignited within 1 to 2 seconds. This rapid ignition of the released gas greatly
limited the size of the vapor cloud and limited the scale of resulting pressure wave.
Although witnesses at the time of the event reported hearing an “explosion”, there was
minimal pressure-wave damage found during the physical evidence examination. Almost
all of the damage to the unit piping, equipment, and structures was consistent with
overheating from the fire. Figure 5 is an overhead photo of the fire scene showing heat
damage in the area of the pipe rack, and locations of equipment involved with the event.

Lessons Learned

The following is a summary of what was learned from this event, and improvements in work
practices and Systems Of Safety that can prevent similar failures in the future:

1. Design and Engineering

• The loose external sleeve at the bottom of this line is a unique configuration, not typical of
refinery installations. It was believed to have been installed as an abrasion protection for
the pipe where it rested on the concrete and steel support beam.
• The microscopic and chemical analysis of the components indicates there may have
originally been tar or a similar organic adhesive substance between the pipe and sleeve
when it was installed, but this material had degraded over the service life of the
installation. It is believed that this sleeve was installed during initial construction in 1961
or within the first few years of operation.
• The ethylene unit was originally owned and constructed by SunOlin Company with the
process and design license from Lummus Technology, and was purchased by Sunoco in
approximately 1990. Research of the design and construction standards in use by SunOlin
and Lummus does not indicate that the use of loose sleeves was specified. It is not clear
whether this installation was an exception to the standards in use at the time, or if a field
modification was implemented at some point during or after initial construction.
• Examination of numerous pipe support locations throughout the ethylene unit identified
only a couple of other locations where this type of loose steel sleeve was used. In the
other locations that evidence of loose sleeves were found there was clear evidence of
similar large-contact-area corrosion taking place in the crevice area between the sleeve and
the pipe. Figure 6 is a photograph of another 10” line on the unit where a loose sleeve
had apparently been used, showing the thinned area at the bottom of the pipe.
• Current Sunoco Piping Standards do not permit the use of this type of loose sleeve, and
also do not permit piping (2” and larger) to be installed directly on steel or concrete pipe
supports. Current requirements include the use of welded pipe shoes or non-metallic wear
materials (Teflon, fiberglass, or carbon fiber) to prevent contact between the pipe and
support. As long as Sunoco Standards are followed (with new construction, field
 modification, or replacement projects), future piping installations will not be susceptible to
this type of failure mechanism.

Figure 6: Another 10” pipe on the ethylene unit with external corrosion from extended contact area
due to a loose sleeve at a pipe support.

• As an opportunity for continual improvement after review of the findings from this event,
the Sunoco Engineering Services leadership team is reviewing these standards. Under
consideration is the addition of non-metallic half-round rods to be installed under piping at
support locations. These half-rods will allow for reduced friction between the pipe and
support, as well as further minimize the contact (crevice) area for corrosion. It is
important to note that this configuration will increase the compressive load-bearing
requirements of the half-round rods, such that high compressive strength thermoplastic
materials or equivalent must be specified to avoid crushing the rods. Figure 7 includes
some pictures of example rod installations (courtesy of www.stoprust.com).
 http://www.stoprust.com/6pipesupports.htm

Figure 7: The use of non-metallic half-round pipe supports will minimize contact area, avoid
protective coating abrasion, avoid creating a galvanic cell, and make future inspections simpler.

2. Maintenance & Inspections

• The 10” process gas line that had the initial failure had undergone repeated inspections
over the 48-year service life of the system. Thickness monitoring showed no measurable
wall loss on the system due to either internal or external corrosion; the lines were
essentially at new original wall thickness at the time of the failure.
• There were two small-bore drain connections that had been replaced on this system
several years ago, due to external corrosion that was found during planned inspections
(the two drain lines were along the ground in contact with the soil and experienced
localized corrosion).
• External visual inspections of this pipe were also conducted, with the most recent
inspection in April of 2005. These inspections are in conformance with API-570
requirements, including the use of a certified piping inspector. The inspection checklist
included observations of pipe supports, but no problems were noted during the 2005
inspection of this piping.
• Standard piping inspection practices, which conform to API-570 requirements, did not
detect the progressing corrosion damage under the pipe sleeve. One reason for this is a
lack of awareness for this type of corrosion and pipe failure potential. It is important to
recognize that the location of corrosion was obscured by the presence of the large concrete
pipe support and loose sleeve under the pipe. Walk-by observations, which are the typical
practice for these visual pipe inspections, would likely not have been able to detect the
ongoing crevice area corrosion.
• Visual inspection practices need to be more detailed and rigorous, such that any
obstructions must be overcome to assure that a positive observation of the pipe condition
is achieved. This may involve: the use of ladders or high-reach devices to access elevated
piping; binoculars, borescopes, or other visual examination aids; or the use of advanced
NDE technologies to assess piping condition (long-range guided ultrasonics, short-range
ultrasonics, radiography, or other techniques).
• Other challenges with visual inspections are effective screening criteria for categorization
and prioritization of follow-up actions to conditions that are found. Practices used in the
offshore industry provide methodology that can be effective for this purpose. Figure 8
provides one suggested categorization method (courtesy of www.stoprust.com).

Contact Point Corrosion

Crevice Corrosion

CC-L (Light Crevice Corrosion) - Corrosion products visible but no

evidence of layered scaling.

CC-M (Moderate Crevice Corrosion) - A single layer of corrosion

scale is visible at the edge of the crevice.

CC-H (Heavy Crevice Corrosion) - corrosion product leaching and

visible multi-layer corrosion scale is visible.

When investigated more closely, the CC-M and CC-H situations

would be expected to show a wall loss at the deepest pit of >40%.

A visual guide is provided to assist in making the correct assessment.

http://www.stoprust.com/6pipesupports.htm

Figure 8: Example screening and prioritization criteria for visual inspection of pipe support locations.

• One additional concern is whether to perform high-urgency retroactive inspections of

certain ultra-high-risk piping systems, where ongoing corrosion of this type may have been
missed by previous routine inspections. The primary consideration would be piping
systems which could have areas of significant contact area corrosion and also have the
potential for a large rupture type of failure (rather than a small leak). The following six
screening criteria are one suggested way to identify systems that could have this large
failure consequence potential:
1. Operating pressure above 150 psig;
2. Gas, LPG, or vaporizing liquid services;
3. Piping larger than 2” diameter;
4. Piping with a service life of 20 years or longer;
5. Carbon or low-alloy steel (12% chrome or less);
 6. Operating temperature between 32oF to 80oF, or operating between 80oF and 350oF
and proximity to an ambient moisture source (such as a cooling tower).
• If all six criteria are met then the system has the potential risk of a large rupture failure
from undetected contact area corrosion, and would be a candidate for urgent inspection
priority.

3. Mitigation Devices
• The size of the initial fire (approximately 300 feet high by 300 feet wide) resulted in the
unit boundary limit isolation valves (approximately 100 feet away) being within the initial
hot zone. Operators were not able to get access to close these manual valves during the
first couple of hours following the initial release, so that they could not isolate the ethylene
unit from the refinery. Process streams from upstream or downstream refinery process
units at the refinery fed the initial and subsequent secondary line leaks, until block valves
at the boundary limits of the other units could be isolated. Even then the volume of
material within the inter-connecting unit pipe lines was still available to sustain the fire.
• The size of the initial fire also put the location of permanent fire monitors (also
approximately 100 feet from the initial release) within the initial hot zone. This restricted
the ability of the operators and initial emergency response personnel (who did not yet have
full personnel protective equipment for aggressive hot-zone actions) from taking defensive
actions and they could not apply adequate cooling water directly on the fire source within
the first 3 to 10 minutes of the initial event. Once proper protective gear was put on and
additional (long range and high volume) fire water spray equipment was brought on scene
the team was able to stabilize the fire. The rapid and effective response of the team
prevented the fire from escalating, but was not able to prevent the secondary line failures
near the initial leak (which happened within 3 to 10 minutes of the initial release).
• The overall size and location of the fire did not increase above the initial approximately 300
feet high by 300 feet wide area. The efforts of the team and the value of the fire
protection equipment to mitigate and prevent escalation of the event were effective.
• During the attempt to isolate the unit via alternate (secondary) isolation valves outside the
boundary limits of the unit and at other process units, it was found that a number of these
valves were not identified as isolation valves or did not operate adequately – further
impeding the isolation effort. Past standard practices did not require clearly identified and
maintained “secondary” emergency isolation devices for all process streams, which is an
area for improvement.
• It is recommended that facilities adopt a practice of identifying process unit primary (at
unit boundary limit) and secondary (outside of unit boundary limit) emergency isolation
valves. It is recognized that many of the secondary isolation valves will be at upstream
and downstream process units. Where unit inter-connecting piping branches there may be
two or more secondary valves for each process stream.
• Once these valves are identified they should be further reviewed and managed to assure
high reliability when needed. Some of the aspects to consider in these reviews include:
1. Are the valve locations clearly identified and accessible;
2. Have design and operability reviews been done to be sure the correct valve design,
materials of construction, and installation orientation is in place;
 3. Operational controls are considered (such as not to be used for throttling service –
or a second valve in series is installed if throttling is required);
4. Are periodic operability checks considered (such as exercising the valves);
5. Is preventive maintenance appropriate (lubrication, packing adjustment, etc.);

4. Cold-Eye Mechanical Integrity Review

• The investigation into the causes of this line rupture and fire identified opportunities for
Sunoco to improve mechanical integrity design, inspection, maintenance, and operational
practices. Many of the improvement actions being taken go above and beyond regulatory
compliance or even above and beyond conformance with industry Recognized and
Generally Accepted Good Engineering Practices (RAGAGEP). With the benefit of
retrospective learning following this event it is much easier to see the value and benefits of
“going above and beyond” in these specific areas noted in this report.
• The greater challenge is to learn from others throughout industry, with a focus more
toward “industry excellence” rather than compliance and conformance.
• With this objective in mind it is important to consult with expertise from outside the
company, to gain a broader industry-wide perspective and sharing of experiences.
• Sunoco is currently working with one of these industry consultants (the Equity Engineering
Group, Inc. – www.equityeng.com), with one site assessment currently completed and
numerous detailed recommendations being organized and improvement initiatives
implemented.
• This type of comprehensive assessment by an industry-experienced “outsider” will greatly
enhance the ability to identify and implement improved practices proactively – and avoid
having to learn future improvement lessons “the hard way”.