Comment is mandatory

Lessons Learned Bulletin No. 4

pdf version (en) Korrosionsbedingte Unfälle in Erdölraffinerien (de)
Return to Lessons Learned Home Page

Chemical Accident Prevention & Preparedness

Corrosion-related accidents in petroleum oil refineries

The aim of the bulletin is to provide insights on lessons learned from accident reported in the European Major Accident Reporting System (eMARS) and other accident sources for both industry operators and government regulators. In future the CAPP Lessons Learned Bulletin will be produced on a semi-annual basis. Each issue of the Bulletin focuses on a particular theme.

This is the fourth issue of the JRC-MAHB Lessons Learned Bulletin for chemical accident prevention and preparedness. Each issue of the Bulletin focuses on a particular theme. The theme of this issue is Corrosion-Related Accidents in Petroleum Oil Refineries. The case studies are drawn from a JRC study of nearly 100 accident reports available in eMARS and other open sources of information on accidents occurring in EU and OECD countries.


The accident descriptions and lessons learned are reconstructed from accident reports submitted to the EU’s Major Accident Reporting System
as well as other open sources.
EMARS consists of over 800 reports of chemical accidents contributed by EU Member States and OECD Countries.

Most relevant sources of information:
• CSB:
• JST Failure Knowledge Database:

Accident 1

Crude distillation unit

Sequence of events
A pipe in the crude distillation unit ruptured, releasing flammable hydrocarbon process fluid that partially vaporized into a large vapor cloud engulfing nineteen employees. Approximately two minutes after the release, the flammable portion of the vapor cloud ignited. All of the employees escaped, narrowly avoiding serious injury. The ignition and subsequent continued burning of the hydrocarbon process fluid resulted in a large plume
of unknown and unquantified particulates and vapour that went offsite in the direction of a nearby city (approximately 2 km from the site). In the weeks following the incident, approximately 15,000 people from the surrounding area sought medical treatment due to the release and of these, 20 were hospitalized for treatment. As a result of the accident, the refinery’s crude unit remained out
of commission for more than eight months.

Contractors The underlying cause of the pipe rupture in this case appears to be poor operating procedure in regard to mechanical integrity. The operator appears to have overlooked a number of factors that should have been incorporated into the maintenance strategy for this particular process unit, including the following:
• Subsequent testing determined that the rupture was due to pipe wall thinning caused by sulphidation corrosion. In fact, over a period of nearly 35 years, the 52-inch piping component had lost on average, 90 percent of its original wall thickness in the area near the rupture.
• Although the operator employed experts in sulphidation corrosion, their opinion was not consulted on any key decisions associated with potential sulphidation risk of the crude distillation unit. The crude distillation unit is one of the processes most associated with sulphidation corrosion in petroleum refineries. Yet the process hazard analysis of the crude unit did not consider the potential for sulphidation corrosion.
• The 4-sidecut piping circuit containing the 52-inch component that failed was constructed in the mid-70’s of ASTM A53B carbon steel which had no minimum specification for silicon content. Silicon in carbon steel inhibits sulphidation when the silicone concentration is above 0.10-wt%. Inspection frequencies were established based on data associated with pipes of a different material composition with higher resistance to corrosion. The crude distillation unit of the pipe in question was a result of sulphidation corrosion that was apparently overlooked for a long period of time.

Lessons Learned
Crude distillation units are generally at risk for elevated corrosion rates due to the high presence of a variety of corrosive substances present, or that may be formed from, the crude oil. Numerous corrosion mechanisms, including sulphidation, are associated with the presence of sulphur compounds in crude feedstock, as well as ammonia and hydrogen, and derivatives of these

substances formed by chemical reactions facilitated by process conditions.
Hazard assessments of these units should therefore evaluate the corrosion vulnerabilities associated with the process, including the composition of the crude feedstock, extremes and fluctuations in temperature and flow, and production intensity. For these processes there should be established procedures that make involvement of relevant experts routine in the process risk assessment and the associated risk management strategy.
• The risk assessment should identify sections of a pipeline as a critical area of the equipment on the basis of potential accident risk. Inspection frequencies should be calculated accordingly. Likewise, maintenance and inspection procedures
should be established with particular attention to age-associated weaknesses in processes over 20 years old in petroleum refineries (as well as other similar high hazard industry sectors).
• Any documentation associated with the original specifications of equipment, or any subsequent modifications to equipment, should be made accessible explicitly for establishing an appropriate
mechanical integrity programme. If complete records are not available, conservative strategies to manage mechanical integrity should be applied to areas of the equipment of critical relevance to risk potential such information is missing and until more precise estimates of the risk can be established from testing and monitoring over time.

[Chevron Interim Investigation Report, U.S. Chemical Safety Board]
[Chevron Investigation Report, Chevron U.S.A.]

Similar accidents: eMARS Accident: 26/06/2004 Petrochemical/Oil Industries


Accident 2

Crude distillation unit

Sequence of events
An 8” pipeline was located in an overhead rack (pressure = 31 bars; thickness specification = 5 mm). It was installed when the unit was constructed in 1992 to collect gasses, essentially butane and propane, from different units (reforming gasoline, atmospheric distillation). According to the witnesses in the control room, the unit was functioning normally and the pipe suddenly burst. The violence of the rupture caused the entire control room to shake. A black cloud was observed as well as the odour of H2S. The rupture zone was located near an elbow, not far from the compressor discharge.

After examination, it was noted that the pipeline had signs of internal corrosion, notably in the lower generator. The hole occurred in a zone affected thermally by welding. Measurements of thickness at various points revealed that certain areas were less than specified. The site has a preventive inspection and maintenance programme but the particular sensitivity of this area at the discharge point had not been identified previously. In addition the poor accessibility of this particular section may have also caused this section to be overlooked in past inspections.

Lessons Learned
• Hazard assessments should also pay particular attention to the potential for accelerated corrosion in particular localized areas of equipment, such as elbow joints, T-intersections and welded sections. Elbow joints and T joints exhibit particular vulnerability to certain types of stresses, notably, vibration, and external pressure from natural forces such as wind and floods and additionally for elbow joints, erosion/corrosion and low or uneven flow. The process of welding is invasive and errors in miscalculation in procedure can increase corrosion vulnerability of welded areas.
• Inspection routines should be based on the risk estimates resulting from the hazard assessments and be adjusted as necessary when changes to metal thickness exceed predicted rates.
• Inaccessible equipment cannot benefit from even the occasional visual check and routine monitoring can be neglected for this reason. For this reason, pipes that are less accessible are often not monitored as frequently as required in relation to their actual risk potential. If certain areas are inaccessible, alternatives to visual inspections should be applied as appropriate to the type of equipment and corrosion expected.

[ARIA #19538]
Similar accidents:  ARIA #40173 (also Confirmed but not yet Online in eMARS) and ARIA #20356

Accident 3

Hydrocracker unit

Sequence of events
Due to a leakage at a T-junction in the high pressure side of an air cooler of the hydrocracker, a rapid pressure drop occurred. The emergency pressure release was therefore not activated. A little later the released gas ignited due to an unknown ignition source resulting in a vapour cloud explosion that was followed by a fire. The products present in the unit at the time were estimated to be 30 t of hydrogen, 150 t of light hydrocarbons (C1-C4), 5.5 t of pentane, as well as hydrogen sulphide. A substantial part of this plant was destroyed by the explosion and subsequent fire. Because of this incident, the hydrocracker unit was shut down for approximately seven months. 24 persons working on the site suffered light injuries.

The leakage was caused by the failure of the air cooler due to erosion/corrosion resulting from a productivity increase of the unit. The effects on the design plant of a productivity increase were not adequately analyzed because of a wrong attitude of management towards safety.

Lessons Learned
• The effect of a significant departure from design conditions, such as increased production rates, should trigger a management of change process. The management of change process in refineries should automatically include an analysis of potential in creased corrosion risk for areas of known elevated corrosion risk.
• In this particular case, the site of the accident had elevated risk
of corrosion due to the presence of hydrogen and hydrogen sulphide, the T-joint configuration of the pipeline and location in cooling equipment. Moreover, the intensity of temperatures and temperature fluctuations in heating and cooling elements, such as air coolers and heat exchangers, are a factor that can accelerate the corrosion process in the presence of certain corrosive agents. The operator should take this circumstance into consideration in the hazards assessment.
• In addition to the crude distillation unit, there are several units in a refinery that normally exhibit vulnerability to accelerated corrosion rates, including cracking units. The refinery should systematically identify these units, including internal pipelines for product transfer as well as storage tanks, and ensure that their process hazard as sessments are thorough in accounting for this phenomenon.
• All hazard assessments should include evaluation of the potential for localized vulnerabilities associated with the location and function of equipment elements and their history.

[EMARS Accident 12/10/1991 Petrochemical/Oil Refineries, ARIA 2631, ZEMA 9112]
Similar accidents:
• JST Failure Knowledge Database – 10/02/2000 - Fire in a fin-fan cooler of a hydro-desulphurization unit
• JST Failure Knowledge Database – 27/07/1996 - Leakage and fire due to corrosion of branch piping
• JST Failure Knowledge Database - 06/03/1989 - Leakage and
explosion of hydrogen at outlet piping of a reactor.

Accident 4

External pipeline

Sequence of events
A leak was detected on an exposed pipeline section 2 meters from the subway. The pipeline was connected to a tank in the crude oil tank-farm associated with the refinery’s topping plant. The pipeline was part of a bundle of 102 pipes belonging to three different companies used for one-way transfer of raw materials, intermediates and/or finished products (liquid hydrocarbons and gas) and included also service lines (nitrogen, high pressure water steam at different temperatures, etc). The company decided to seal the leak by installing a sealing collar on the located rupture point. The workers dismantled the piping insulation (latten and rock wool) in the corresponding pipe section. After the insulation had been dismantled the spill increased with hot hydrocarbons (60° C) spraying downwards towards the subway. An approx. 30 mm long fissure was revealed on the pipe axis. A liquid hydrocarbon pool formed and spread some 60 m from the leakage point in the pipe due to the incline of the slope inclination.
A vapour cloud subsequently formed and was ignited from an ignition source downhill from the subway where the first fire was detected. 10 persons were injured and hospitalized as a result of the fire. The rail line and the shipping area of the port were closed for up to 48 hours and one public road was closed for 53 days. Production loss from the temporary shutdown of refinery operations was estimated at approximately € 110,000,000.

An investigation determined that the pipe was perforated due to corrosion processes occurring externally on the pipe surface. The investigation report speculated that the fissure occurred at that location due to one or more of the following factors:
• localized damage in the original pipe coating;
• material defect in the original pipe coating;
• critical operative conditions (of the pipe section in which the fissure occurred) linked to the placement of the pipe near the ground and its exposition to atmospheric events (sea air).

The operator declared that the pipe was periodically inspected in compliance with established norms. The last inspection of the pipeline had been performed approximately a year prior to the accident. The report also indicated that it was not possible to affirm that the maintenance of the pipe in question was insufficient. It pointed out that the pipeline examined had been built more than 40 years ago. Moreover, the pipeline had been bought from another entity 4 years prior without any technical documentation on maintenance operations on the piping bundle prior to the sale.

Lessons Learned
• Inspections should be designed not only to be consistent with the relevant industry standard for the equipment but also take into account specific circumstances associated with the equipment in question. The pipe that failed in this case was very old. It was in contact with the ground below, and potentially abrasive substances on the surface, as well as a marine (salty) atmosphere. Although the technical documentation for the pipeline was not available, it should already have been obvious that the minimum standard inspection would not be adequate.
•  Moreover, pipelines in remote locations or external to the site are often at risk of accelerated corrosion rates due to atmospheric conditions as well as neglect. The condition of the anti-corrosion protection associated with these refinery equipment should be systematically verified during routine inspections scheduled at a frequency established on the basis of a hazard assessment.

[EMARS Accident: 30/04/2007 Petrochemical/Oil Refinery]
Similar accidents: ARIA 1952; JST Failure Knowledge Database – 11/10/1990- Leakage of fuel oil into the sea from receiving piping at a jetty

Accident 5

Vacuum distillation unit

Sequence of events
The discharge piping of a furnace recycle pump of a vacuum distillation unit was corroded by a sulphur compound contained in a residue under high-temperature conditions. An opening was formed, from which fuel oil leaked. The leaked vacuum residue ignited, and a fire occurred. The piping was used for recycling from the bottom of the vacuum distillation column to the feed furnace, and joined with a fresh feed liquid, which was bottom oil of the topper, at just downstream the accident position. The section of the piping that failed was composed of ordinary carbon steel.As a consequence of the accident, piping around a recycling pump of a heating furnace. Peripheral electrical equipment and instrumentation were also damaged by fire. Peripheral electrical equipment and instrumentation were damaged by fire. Damage was estimated at approximately € 400, 000. There were no injuries or other consequences reported.

One of the causes is considered to be the fact that changes in piping material selection often set flanges as a boundary. It seems that the designer of this piping selected carbon steel to cut cost because there were no suitable flanges downstream from the check valve. Originally, a material above 5Cr-0.5 Mo steel should have been chosen as the piping material around the confluence at the fresh feed side. High-grade material of above 5Cr-0.5 Mo steel is necessary for recycling piping considering the temperature and fluid properties, while ordinary carbon steel can be used for the fresh feed. As the location of the accident was upstream from the confluence, material above 5Cr-0.5 Mo steel should have been used. However, the piping material was changed at the position of a check valve downstream flange, which was upstream from the location of the accident, and carbon
steel had been used at the location of the accident.

Lessons learned
This accident is particular noted as a failure in management of change. Apparently, there was an error in selection and design of
material when it was decided to replace this section of the pipe. The location of the accident was the heaviest part of the crude oil distillation system. There were a lot of solids and corrosive mediums present, and the temperature was high. A management of change process should have been activated resulting in an assessment of the risk associated with different options for the material in the replacement pipe.

[Japanese Failure Safety Knowledge database – 19/07/1990 - Fire caused due to leakage from corrosion in a vacuum distillation unit]
Similar accidents:
eMARS Accident: 13/07/2006 Petrochemical/Oil Industries



Corrosion-related accidents in refineriesand typical accident causal factors


Uncontrolled corrosion can cause release of hazardous substances and components or can reduce both the performance and reliability of equipment until their failure. This latter situation can put at risk the safety and well-being of both plant employees and the general public as well as lead to severe damage of process units, and in some cases shutdown of refinery operations. Notably, of the 137 major refinery accidents reported by EU countries to the EU’s eMARS database since 1984, around 20% indicated corrosion failure as an important contributing factor. Moreover, this remains the average percentage of the total accidents reported even in recent years.

Corrosion represents a particularly relevant risk to petroleum refineries because refineries typically have several high risk factors because of the type of substances and processes involved in refinery operations. Other local conditions may also contribute to an acceleration in the corrosion rate, including physical location of equipment and the climate. Moreover, certain operating conditions in a refinery, both normal and abnormal, by their nature are particularly likely to present favourable opportunities for a
corrosion failure to initiate a chain of events leading to a major accident.

Types of corrosion
Corrosion can appear as either uniform corrosion or localized corrosion. The American Petroleum Institute Recommended Practice 571 (API 571) lists over 25 common corrosion damage mechanisms to industrial activity plus 11 addition types that are specific to refineries. In addition, studies of aging facilities may classify corrosion effects into different groupings on the basis of characteristics such as failure mechanisms (e.g., wall thinning, cracking and fracture, physical deformation), common causal factors (e.g.,
stress-driven damage, metallurgical/ environmental damage) or other commonalities.

Uniform corrosion is also known as general corrosion and is the classic form of corrosion in which the entire surface area, or a large fraction of the total area, is affected by a general thinning of the metal. In chemical processing uniform corrosion is considered the least dangerous form because it is easily visible long before it is degraded enough to fail. Nonetheless, uniform corrosion may sometimes be a cause of accidents, for example, in pipelines that are in remote locations, underground, or otherwise, not viewed frequently, general corrosion may continue for a long time undetected.

Conversely, there are numerous types of localized corrosion that are far more difficult to detect without targeted effort. Thus, consequences of

localized corrosion can be more severe than uniform corrosion as failure occurs without warning and often after only a short period of use or exposure. Typically, localized corrosion occurs between joints (crevice corrosion) or under a paint coating or insulation. Stress corrosion cracking and hydrogen-assisted stress corrosion are also forms of localized corrosion. They are often grouped together with hydrogen embrittlement and stress embrittlement, even though these are not corrosion phenomena, because the conditions and the resulting failure mechanism (cracks in the metal) are remarkably similar. As such, it is not necessarily easy to determine which phenomenon caused such a failure following an accident; hence, by necessity, analyses of accidents involving corrosion-related failures may refer to both phenomena.

Process Conditions
A fundamental ingredient of corrosion is exposure to a corrosive agent via a refinery process, that is, a substance that under certain processing conditions acts upon the metal and weakens it. These corrosive agents are in effect oxidizing substances, which may include water, a variety of acid compounds introduced or generated in the process as well as the crude oil and final and interim products, such as coke and kerosene. Some substances have unique corrosion “signatures”, that is, the corrosion produced is characterized by a particular specific visual or textural pattern, reacts with specific metal compounds, and frequently occurs in the same types of locations. As noted in Figure 1, substances cited most commonly in relation to corrosion failures were sulphur and sulphur compounds and water (14 cases each) followed by hydrogen sulphide (11 cases). The substances identified in Figure 1 are normally present in the highest volumes and in a variety of processes throughout a typical refinery site.

The Importance of Implementing Safety Management Systems to Address Corrosion Risks
Neglecting to identify or manage corrosion hazards also continues to be a problem on some refinery sites. Accident reports studied by JRC-MAHB were quite clear that the lesson learned was less about the technical challenge of managing corrosion but simply about having an effective risk management program. In fact, many of the reports studied by JRC-MAHB (60%) contained detail that suggested that a risk assessment should have occurred at a particular point in the life cycle, and that at the time it was either not performed or it was insufficient in identifying the corrosion hazard and/or its associated risk potential.

The study found that these inadequacies could be grouped into
four different categories according to their occurrence in the safety
management process, as follows:
• Inadequate risk analysis at design and construction stage
• Inadequate risk analysis prior to change, which is essentially a lack of or failure in the management of change process
• Failure to identify or address process risks in planning inspections
• Inadequate identification of hazards and risks for other purposes, such as safe performance of repairs and establishment of detection and mitigation systems.

In addition, one of the most important challenges in managing refinery corrosion is the element of change. Already changes to process design and equipment pose a challenge and need a certain competency to identify if a new corrosion risk has been introduced.

However, other changes that can affect corrosion rates may go unrecognized and thus not be evaluated for an elevated risk. Particular changes of this nature could be a change in the source of crude oil or an increase in production rate, particularly if they are considered to be somewhat temporary. Inconspicuous changes can also create risk and in this regard, the refinery’s greatest risk may be change over time. Loss of experienced personnel, lack of knowledge of the original process and equipment design (some-times decades ago), and aging equipment all fall in this category. Strategies such as risk-based inspections, life-cycle management, and safety performance indicators, to name a few, are all good practices that can support risk management for this somewhat insidious changes that can greatly influence the level of risk. Corporate leadership and safety culture, areas of renewed emphasis following the accident at BP Texas City in March 2005, also offer promising conceptual frameworks for organizations to reinforce and sustain efforts at the operational level.


Figure 1: Process-related substances cited as contributing to corrosion failures in association with the process unit of origin
[Source: Corrosion-Related Accidents in Petroleum Refineries: Lessons Learned from Accidents in EU and OECD countries, JRC-MAHB, 2013]

Motto of the semester


There is no knowledge
that is not power
(Ralph Waldo Emerson)


Number 4, Dec 2013



For more information related to this bulletin on lessons learned from major industrial accidents, please contact

Security Technology Assessment Unit
European Commission Joint Research Centre Institute for the Protection and Security
of the Citizen Via E. Fermi, 2749
21027 Ispra (VA) Italy

If your organisation is not already
receiving the MAHBulletin, please contact
Please include your name and email address of your organisation’s focal point for the bulletin.


Corrosion-Related accidents in Petroleum Refineries: Lessons Learned from Accidents in EU and OECD countries, JRC-MAHB, 2013

To understand better failure associated with corrosion in refineries, the Major Accident Hazards Bureau conducted a study of corrosion-related accidents in OECD and EU refineries over the past 50 years, looking at lessons learned from past corrosion-related accidents at refinery sites. The study was based on 99 reports of important refinery ac cidents in which corrosion of an equipment part was identified or suspected as being the key failure leading to the event. For this study, the main sources of accident information were eMARS and the other open sources cited in the accident cases selected for this bulletin (ARIA, ZEMA, the CSB and the JST Failure Knowledge Database). The lessons learned and the summary of corrosion risk in refineries in this report are derived from study findings as well as analyses in the individual accident reports cited.

Available soon