Investigators: Deficient refinery safety culture to blame in recent blasts

The April 2010 fatal explosion and fire at the Tesoro refinery in Anacortes, Washington, was caused by damage to the heat exchanger, a mechanism known as “high temperature hydrogen attack” or HTHA, which severely cracked and weakened carbon steel tubing leading to a rupture, according to a CSB draft report released Thursday. 

The draft report makes far-reaching recommendations to the federal Environmental Protection Agency and the Governor and State Legislature of the State of Washington to more rigorously protect workers and communities from potentially catastrophic chemical releases. 

 

The draft report is available at www.csb.gov for public comment until Sunday, March 16.  Comments should be sent to tesorocomments@csb.gov. All comments will be reviewed and published on the CSB website.

 

“Seven lives were tragically lost at the Tesoro refinery in 2010,” said Dr. Rafael Moure-Eraso, CSB chairperson. “I believe the draft report does an outstanding job of tracing this complex accident to its roots: a deficient refinery safety culture, weak industry standards for safeguarding equipment, and a regulatory system that too often emphasizes activities rather than outcomes. The report is a clarion call for refinery safety reform."

 

Using sophisticated computer models, the investigation found the industry-wide method used to predict the risk of HTHA damage to be inaccurate, with equipment failures occurring under conditions the deemed to be safe from HTHA.

It also cited deficiencies in the company’s safety culture that led to a “complacent” attitude toward flammable leaks and occasional fires. Investigators determined that during the unit startup, Tesoro did not correct the history of hazardous conditions or limit the number of people involved in the hazardous non-routine startup of the heat exchangers.  

But because of the reoccurring leaks and the need to manually open a series of long-winded valves that required over one hundred turns by hand to fully open, a supervisor requested five additional workers to help, the CSB said. All seven lost their lives as a result of the blast.

“The accident at Tesoro could have been prevented had the company applied inherent safety principles and used HTHA resistant construction materials to prevent the heat exchanger cracking," said Moure-Eraso.

"This accident is very similar to the one that occurred at the Chevron refinery in Richmond, California, in August 2012, where corrosion of piping went undetected for decades until it ruptured, endangering the lives of 19 workers caught in a vapor cloud and sending 15,000 community members to the hospital. Companies must do a better job of preventing refinery accidents, which occur all too frequently.”

 

The draft report notes that recommended practices of the American Petroleum Institute, the leading industry association, are written “permissively” with no minimum requirements to prevent HTHA failures. For example, API Recommended Practice 941 -- Steels for Hydrogen Service -- uses the term “should” 27 times and “shall” only once.

It also does not require users to verify actual operating conditions in establishing operation limits of the equipment or to confirm that the materials of construction selection will prevent the damage. An inspection strategy that relied on design operating conditions rather than verifying actual operating parameters contributed to the accident.

 

The investigation found Tesoro, like others in the industry, use published data from the American Petroleum Institute, called the Nelson Curves, to predict the susceptibility of the heat exchangers to HTHA damage. The CSB found these curves unreliable because they use historical experience data concerning HTHA that may not sufficiently reflect actual operating conditions. For example, a CSB computer reconstruction of the process conditions in the exchangers determined that the portion of the carbon steel exchanger that failed likely operated below the applicable Nelson curve—indicating it was “safe.”  

 

The CSB said it determined that inspections for such damage are unreliable because the microscopic cracks can be localized and difficult to identify. The report concludes, “Inherently safer design is a better approach to prevent HTHA.” 

It notes that API has identified high-chromium steels that are highly resistant; these were not installed by Tesoro.  The CSB has called for the adoption of inherently safer technology, design and equipment in other reports, notably the Richmond, California, Chevron refinery fire of August 2012. 

 

“We need a national mandate for state and federal regulators to require chemical facilities utilize inherently safer technology to the greatest extent practicable," said Moure-Eraso. "For example, storing or utilizing less hazardous materials, making the process safer by lowering temperatures and pressures, and installing the most reliable equipment available are critical to lowering the industry’s accident rate.”

 

The report stresses that the accident occurred during a startup of the naphtha hydrotreater unit, considered hazardous non-routine work, particularly due to the reoccurring leaks of flammable liquid. Despite this, required Process Hazard Analyses (PHA) at the refinery repeatedly failed to ensure that these hazards were controlled and that the number of workers exposed to these hazards was minimized.

In addition, past PHA’s, including those done by the preceding owner, Shell Anacortes Refining Company, cited only judgment-based safeguards and did not verify whether safeguards listed in the PHA’s were actually effective. 

 

Data for actual operating conditions was not readily available and technical experts were not required to prove safety effectiveness. “The refinery process safety culture required proof of danger rather than proof of effective safety implementation,” the report concluded.

 

As with the Chevron accident investigation, the Tesoro report notes the “considerable frequency of significant and deadly incidents at refineries over the last decade.” It states that in 2012 alone, the CSB tracked 125 significant incidents at US petroleum refineries. 

The draft report examines the effectiveness of refinery and chemical facility regulatory oversight, noting that Washington State’s Department of Labor and Industries (L&I) does not have sufficient personnel resources to verify that process safety management requirements are being implemented adequately. The report states that the agency audited the Tesoro refinery in March 2009 but found no deficiencies related to the heat exchanger that ruptured.  

 

The regulatory findings also concluded that under the existing US and Washington State regulatory systems, there is no requirement to reduce risks to a specific target, for example as low as reasonably practicable, or ALARP, which is a hallmark of the safety case regime adopted successfully in Europe and Australia in the refinery and chemical sectors, as well as the nuclear and space sectors in the US. 

The safety case model is the subject of the draft regulatory report on the Chevron accident, released on December 16 of last year. The draft is still being considered by the board.

 

The draft report states in one of its 40 key findings: “It is essential that regulators of high-hazard facilities are independent, well-funded, well-staffed, and technically qualified. These individuals must be able to effectively communicate with refinery personnel and monitor the adequacy of refinery process safety practices.”

 

The draft report -- subject to a future vote by the board -- includes numerous proposed safety recommendations to Washington’s legislature and governor, to its regulatory agency, Tesoro, and the American Petroleum Institute.  These include a recommendation to the state to establish a more rigorous regulatory model, possibly based on the safety case regime, revise the state’s process safety management regulations to ensure the prevention of catastrophic releases, perform a safety verification audit at all refineries in the state.

 

The report found that both the Tesoro and Chevron incidents could have been prevented if inherently safer equipment materials of construction had been used. Although the use of inherently safer technology (IST) is the most effective approach to preventing major chemical accidents, it is not enforced by the EPA through the General Duty Clause or EPA’s Risk Management Program. The report concludes that EPA has the authority to require the use of IST and recommends that it should do so.

 

Other proposed recommendations would urge API to clearly establish the minimum necessary “shall” requirements to prevent HTHA equipment failures. Recommendations to Tesoro were aimed among other things at revising and improving its Process Hazard Analysis and damage mechanism hazard review programs for all Tesoro refineries in order to validate damage mechanism hazards and safeguards. 

The company was also urged in the draft to implement a program to perform periodic process safety culture surveys among the work force at the Tesoro Anacortes refinery to be conducted by a third party.