Loss Prevention Bulletin 235
February 2014 | 5
Incident
Rapid carbon steel corrosion and HF acid leak
Dave Bridger
Summary
In 2005, the carbon steel piping of an acid relief neutraliser
(ARN) on an HF alkylation plant on a refinery rapidly
corroded (within one hour), releasing a solution of NaF,
FeF2 and HF acid. The ARN, which was connected to
the refinery flare system, was only designed for coping
with neutralising HF vapours, not liquid HF. The incident
resulted in the release of approximately 1.1 tonnes of
liquid anhydrous HF (AHF) to the ARN during the HF
tanker offloading process.
The investigation identified the cause of the incident
being the piping downstream of the liquid HF discharge
line connected to the offloading HF delivery tanker. The
intended purpose of this piping (as per procedure) was to
enable final residual HF vapours to be vented to the ARN
at the conclusion of the HF tanker offloading process.
This procedure to vent the residual HF vapours at the end
of the HF tanker offloading had been successfully used
previously, without incident, for decades. However, on
this occasion the delivery tanker was not quite empty and
as such caused discharge of HF liquid to the ARN.
Fortunately, the ARN liquid seal was maintained (using
make-up water) during the incident and as such no loss
of containment of refinery flare gases occurred. The HF
acid strength was maintained below 5% using a large
amount of water feed. The incident caused a significant
amount of liquid HF to attack the carbon steel pipework.
No noticeable pH drop was recorded at the refinery
interceptors in spite of fluoride levels peaking at 200 ppm
in wastewater.
There were a number of lessons learned from the
incident but the most significant finding was that the
piping pathway, as recommended in API RP751, allowed
a significant discharge of liquid HF to occur during the
HF tanker offloading operation2. API RP751 stipulates,
“There should be a connection from the unloading line to
the acid scrubber (ARN) for venting after unloading”. API
RP751 also stipulates that the aforementioned connection
can also be used for “emergency depressurisation”
purposes. In such an event, it is foreseeable for liquid
HF to be routed via the ARN. The ARN, however, is not
designed to cope with liquid HF discharge from the HF
tanker during the offloading operation. It is therefore of
paramount importance that all procedures (and hardware)
are thoroughly checked to ensure that liquid HF cannot
be routed via the ARN, even during emergencies, unless
the ARN is suitably designed to receive the liquid HF load.
A simple three-way plug valve is recommended for the
© Institution of Chemical Engineers
0260-9576/14/$17.63 + 0.00
purpose of making suitable adjustment to the system.
This valve can be retrofitted to the HF tanker offloading
systems. This should enable safe depressurisation (either
routine or emergency) of the system to the flare via ARN
through an EDV.
Keywords: Acid relief neutraliser, HF, corrosion,
API RP751
Background
HF acid was delivered to the refinery in an ISO container
tanker holding 16 tonnes of liquid HF. It was offloaded into a
45 m3 capacity onsite storage vessel using a nitrogen assisted
blow-egg via a “dip pipe” located inside the HF tanker. This is
often referred to as “the unloading line”. By design, the liquid
HF must enter the storage vessel’s vapour space (as shown
in Figure 1). This arrangement ensures that no liquid HF can
ever backflow to the tanker and thus cause it to overload. The
procedures concerning the offloading of HF acid tankers were
reviewed previously1.
The level measurement instrumentation on the HF
storage vessel had been problematic for years. There
had been frequent failures and loss of confidence in the
instrumentation, and as such, it was no longer used. This
status became an accepted norm by the operators and instead
they simply relied on the operation of try-cocks only. Even
so, the most recent revision of the offloading procedures still
referred to monitoring via the use of the level instrument. As
such an alternative fall-back procedure for offloading HF in an
emergency was not available. The atmospheric try-cocks had
therefore been used to estimate whether there was sufficient
ullage in the vessel to receive HF acid (with sufficient coarse
accuracy). Try-cocks have recently being phased out as
unacceptable practice by the HSE and are considered
inadequate in measuring tonnes of HF acid transferred from
the tanker. Furthermore, there was no weighbridge to weigh
HF at the tanker offloading gantry. This was largely due to
cost, because HF offloading only took place between six to
nine times per year.
The relevant sections of the plant associated with this
incident are shown in Figure 1. The entire acid relief
neutraliser (ARN) was built from Monel to minimise corrosion
attack from HF acid. For information, the lower sections of
the ARN are not expected to experience low pH conditions.
As such some lower sections of some ARNs are constructed
using carbon steel. The circulating caustic (neutralising)
system associated with ARN is always invariably made of
carbon steel piping.
6 | Loss Prevention Bulletin 235
February 2014
Figure 1: HF acid unloading arrangements and the incident leak point at the ARN
In the early years, operators would monitor the completion
of the HF offloading procedure by observing the excessive
vibrating movement of the flexible hose connected to the HF
tanker. Even to this day, some HF suppliers still follow such
practice. In the early 1990s, to combat flexible hose failures,
the refinery adopted the use of flexible hard piping spirals
(no obvious movement under two-phase flow conditions) for
gantry connection. The experienced operators then changed
from observing vibrating hose movement to listening for the
check valve chattering (see F in Figure 1) indicating the endpoint of HF offloading. This was not explicit in any operational
offloading procedures.
The offloading procedure recommended using nitrogen
to its maximum available pressure of 4 to 5 barg to minimise
tanker-offloading time. This practice typically allowed
offloading to be completed within 1½ hours. When the HF
tanker was considered empty, the procedure was to vent and
depressurise the tanker to the flare via the ARN. This was to
remove residual vapours from the tanker before it returned to
its supplier. The aforementioned procedure simply required
valve E to the storage to be fully closed and valve D to the ARN
fully opened for about five minutes.
Typically, 5% wt sodium hydroxide (NaOH) solution is the
maximum strength required to prevent sodium fluoride (NaF)
crystallisation and fouling of the flare system. The ARN had
approximately six tonnes of 5% caustic, capable of neutralising
approximately 150 kg of HF vapour. The strength of the
caustic was routinely monitored and altered as required. The
top temperature of the ARN was also monitored and this was
linked to a high process alarm. HF upon neutralisation with
caustic releases heat as does HF dilution in water. Thus, an
increase in temperature of the ARN indicates HF acidic gas
flow. As an aside, the refinery HF alkylation is never allowed to
operate without there being ARN in service.
The incident
This was the first time that the operator involved had offloaded
an HF tanker unaccompanied. Therefore he vigilantly
followed the procedure to ensure nothing would go wrong.
Nonetheless, although the procedure advised that the “ideal
offloading pressure (of N2 in the tanker) needed to be 4 to 5
barg”, the operator decided to be more cautious (i.e. more
safe for his first time use) and use the nitrogen at a lower
pressure setting.
The level indication on the acid storage vessel was (as usual)
not operational at the time of the HF offloading. The operator
was aware that this was quite normal and he disregarded its
need to monitor the transfer (according to the procedure).
Unfortunately, he did not have (from his peer training) the
information related to the noisy flapper in check valve F as the
alternative indication of an empty HF tanker.
The transfer of HF acid to on-site storage therefore
proceeded without incident (albeit, very slowly). The
inexperienced gantry operator was in radio contact with the
main control room. After almost two hours of offloading time
and close to the end of his shift, it was questioned whether the
tanker was empty or not. Given the unusually long duration of
the offloading activity, he was advised that “the tanker must
be empty” (without any secondary confirmations required
© Institution of Chemical Engineers
0260-9576/14/$17.63 + 0.00
Loss Prevention Bulletin 235
from observing the noisy flapper valve). Given that it was not
normal to leave the HF tanker offloading part way through
any shift changeover and with daylight rapidly diminishing,
it was agreed to vent the tanker via the ARN as per normal
procedure.
It is understood that a large number of other issues occurred
during the day prior to that final decision to depressure the
tanker, resulting in a warmer than normal ARN. In fact, the
high alarm at 35oC was already active (though this was not
considered an issue, given the alarm was sometimes active
on hot summer days). A quick pH test showed the circulating
caustic was still alkaline and as such it was acceptable to vent
the HF tanker.
As the night shift settled in to make their pre-plant checks,
they quickly realised that the ARN temperature was very
high (84oC), with inflexion having occurred from 43oC. It was
later determined that the 41oC increase in temperature was
consistent with the heat given off from dilution of 1.1 tonnes
HF with 6.6 tonnes of water (the 1.1 tonnes was calculated
from level change within the ARN during the incident).
Furthermore, operators in the work’s yard were reporting
odour of HF in the air (odour threshold of HF at 0.04 to 0.13
ppm). The onsite HF detectors did not activate at that time
because the high alarms at TLV TWA were set to function at 3
ppm. It was later learnt that some detectors did reach 10ppm
level for a few minutes some hours later. When the operators
finally detected liquids flowing out of holes in the piping (see
Figure 1), and observing a declining level in the ARN sump,
they quickly realised that there could be a release of refinery
flare gases. Hence, the water make-up to the ARN was fully
opened while operators donned PPE to enable entry to site and
isolation of the ARN caustic circulation valves.
The amount of carbon steel of the caustic circulation system
was about half that required to consume all 1.1 tonnes HF.
Figure 2: Storage pressure inflexion indicating HF tanker is empty
© Institution of Chemical Engineers
0260-9576/14/$17.63 + 0.00
February 2014 | 7
Nonetheless, a significant amount of hydrogen gas was
generated (indicated by the loss of capacity by the refinery
flare gas recovery compressor). While the theoretical HF
strength could have been as high as 14%, reaction with plant
steel and dilution with water, etc, likely resulted in the effluent
to drains being less than 5%wt HF acid. There was ultimately
massive dilution within the refinery waste water systems. This
was confirmed by an undetectable decrease of wastewater pH
at the refinery interceptors, in spite of fluorides peaking at 200
ppm.
Investigation outcome
Details of the actual incident investigation were extensive,
albeit at times contradictory. It became apparent that the
procedure for offloading an HF tanker was flawed even if it was
followed cautiously by an inexperienced operator. The absence
of level indication on the HF storage vessel should have been
of sufficient enough concern to stop using the procedure and
request an updated version. Another HF tanker was unloaded
using full available nitrogen pressure (limited by design
typically to 5 barg1). The profile of that offloading is attached as
Figure 2.
The information from the offloading was used to update
the unloading procedure. It took approximately one hour
for breakthrough of nitrogen to on-site storage (as shown by
the “inflexion” of pressure), indicating that it was possible
to unload a tanker with the working instruction modified
accordingly (with emphasis on maintaining full 4 to 5 barg
nitrogen pressure inside the tanker at all times). The pressure
trend was monitored by the control room. The pressure
inflexion is explained by an increased volumetric flow, for a
given pressure drop, down the same pipeline of liquid HF
vs vapour HF+N2 mix. Furthermore, the information about
listening for the noisy flapper was also included. However,
8 | Loss Prevention Bulletin 235
February 2014
the most important issue concerning the procedure was a
statement related to the certainty of the tanker being empty,
and not to depressurise the ARN if uncertain.
The updated procedure was issued to enable tanker
unloading to continue until the facility could be modified. The
ultimate latent failure was the existence of a rogue pathway
for liquid HF to be sent directly to the ARN. The preferred
fix to prevent recurrence of this, or associated incidents, is to
eliminate any liquid HF pathway to occur via the ARN. As such
the Emergency Depressure Valve (EDV) (shown in Figure 1)
was developed as a project to achieve this objective.
Most importantly, this investigation appears to indicate
that the existing facility was considered acceptable in
accordance with API RP7512. This permits “a connection
to be made from the offloading line to the acid scrubber
(ARN)” recommending its use for “venting HF vapours after
unloading”. However, of more serious concern is the additional
statement in API RP751 that the line can also be used for
“emergency depressuring”. On the contrary, this incident
clearly establishes that “emergency depressuring” of HF tanker
is considered potentially unsafe if it still holds liquid HF. This is
unless the ARN is suitably designed to cope with taking liquid
HF to the calculated maximum in the event of emergency
depressurisation.
There was no evidence of ARN and its associated HF
offloading arrangements, including how the system was set
up to cope with accepting liquid HF from the HF tanker in an
emergency venting scenario, ever being suitably HAZOPed.
Such a HAZOP would likely have highlighted the inadequacy
of the emergency depressurising arrangements for the HF
offloading line.
Conclusion
The ultimate learning from this incident is to routinely check
all procedures (and associated hardware) for potential errors.
Many of the procedures were used, over many years, if
not decades, without incident (therefore inferred as 100%
“proven”). However, as this incident shows, they may contain
latent faults (in association with hardware issues). Figure 1 is a
very simplified process flow schematic of an otherwise myriad
of pipes within the plant. It is essential to trace the process
engineering flow schemes on-site to be absolutely certain
that HF liquid cannot be sent to the ARN, unless it is suitably
designed to receive it.
In the interim period, prior to plant modification, the same
procedure was able to be updated using the physical science
of trending on-site storage pressure in the event of uncertain
level measurement (via the storage pressure inflexion).
Nonetheless, positive isolation of valve D, offering access
to the rogue route is considered essential. A simple threeway plug valve fix (see Figure 1) is presented for retrofitting
HF tanker unloading systems to enable safe routine and
emergency depressuring (EDV) to flare via the ARN to take
place. This can be considered for retrofitting at any other site.
Positive isolation with spectacle blind (spade) at the refinery
in question was considered necessary (ie instead of piping
disconnection), since that piping path was used routinely for
shutdown decontamination of the plant, etc.
API RP751
This incident raises the question of whether Appendix G in
API RP7512 should be suitably modified to prevent liquid HF
inadvertently being routed via the ARN, including emergency
depressurisation situations during HF tanker offloadings:
Appendix G —Design Features of an Acid–Truck Unloading
Station, states “There should be a connection from the
unloading line to the acid scrubber for venting after unloading
and for emergency depressuring”.
The event described in this article would suggest that some
modification of the above statement is needed to safeguard
against a situation where, for whatever reason, liquid HF finds
its way via the unloading line into the ARN. In this accident,
liquid HF found its way into the ARN, via the HF unloading line,
because the means of knowing that the HF tanker was empty
were not sufficiently robust. The amount of HF discharged was
limited to 1.1 tonnes only. However, if valve ‘D’ (Figure 1) was
fully opened with full N2 pressure inside a partially unloaded
tanker, then there was a potential to discharge a much greater
quantity (10 tonnes or more) of liquid HF via the ARN.
Emergency depressurisation of the tanker via the unloading
line to the ARN could clearly also result in an unplanned
discharge of liquid HF.
It is thus proposed that API RP751 be appropriately revised
to ensure that the ARN system is suitably designed to cope
with liquid HF (as well as its disposal) including any emergency
depressurisation scenario.
The application of the above should also be subject to a
HAZOP study.
References
1. Loss Prevention Bulletin, Anatomy of HF acid tanker
unloading, Issue 232, August 2013.
2. American Petroleum Institute Recommended Practice, API
RP751, for “Safe Operation of Hydrofluoric Acid Alkylation
Units”, third edition, June 2007.
© Institution of Chemical Engineers
0260-9576/14/$17.63 + 0.00