The April 2010 fatal explosion and fire at
the Tesoro refinery in Anacortes, Washington, was caused by
damage to the heat exchanger, a mechanism known as high
temperature hydrogen attack or HTHA, which severely
cracked and weakened carbon steel tubing leading to a
rupture, according to a CSB draft report released
The draft report makes far-reaching recommendations to the
federal Environmental Protection Agency and the Governor and
State Legislature of the State of Washington to more
rigorously protect workers and communities from potentially
catastrophic chemical releases.
The draft report is available at www.csb.gov
for public comment until Sunday, March 16. Comments
should be sent to firstname.lastname@example.org
. All comments will
be reviewed and published on the CSB website.
Seven lives were tragically lost at the Tesoro refinery
in 2010, said Dr.
Rafael Moure-Eraso, CSB chairperson. I believe the
draft report does an outstanding job of tracing this complex
accident to its roots: a deficient refinery safety culture,
weak industry standards for safeguarding equipment, and a
regulatory system that too often emphasizes activities rather
than outcomes. The report is a clarion call for refinery
Using sophisticated computer models, the investigation found
the industry-wide method used to predict the risk of HTHA
damage to be inaccurate, with equipment failures occurring
under conditions the deemed to be safe from HTHA.
It also cited deficiencies in the companys safety
culture that led to a complacent attitude toward
flammable leaks and occasional fires. Investigators
determined that during the unit startup, Tesoro did not
correct the history of hazardous conditions or limit the
number of people involved in the hazardous non-routine
startup of the heat exchangers.
But because of the reoccurring leaks and the need to manually
open a series of long-winded valves that required over one
hundred turns by hand to fully open, a supervisor requested
five additional workers to help, the CSB said. All seven lost
their lives as a result of the blast.
The accident at Tesoro could have been prevented had
the company applied inherent safety principles and used HTHA
materials to prevent
the heat exchanger cracking," said Moure-Eraso.
"This accident is very similar to the one that occurred at
the Chevron refinery in Richmond, California, in August 2012,
where corrosion of piping went undetected for decades until
it ruptured, endangering the lives of 19 workers caught in a
vapor cloud and sending 15,000 community members to the
hospital. Companies must do a better job of preventing
refinery accidents, which occur all too frequently.
The draft report notes that recommended practices of the
American Petroleum Institute, the leading industry
association, are written permissively with no
minimum requirements to prevent HTHA failures. For example,
API Recommended Practice 941 -- Steels for Hydrogen Service
-- uses the term should 27 times and
shall only once.
It also does not require users to verify actual operating
conditions in establishing operation limits of the equipment
or to confirm that the materials of construction selection
will prevent the damage. An inspection strategy that relied
on design operating conditions rather than verifying actual
operating parameters contributed to the accident.
The investigation found Tesoro, like others in the industry,
use published data from the American Petroleum Institute,
called the Nelson Curves, to predict the susceptibility of
the heat exchangers to HTHA damage. The CSB found these
curves unreliable because they use historical experience data
concerning HTHA that may not sufficiently reflect actual
operating conditions. For example, a CSB computer reconstruction
of the process
conditions in the exchangers determined that the portion of
the carbon steel exchanger that failed likely operated below
the applicable Nelson curveindicating it was
The CSB said it determined that inspections for such damage
are unreliable because the microscopic cracks can be
localized and difficult to identify. The report concludes,
Inherently safer design is a better approach to prevent
It notes that API has identified high-chromium steels that
are highly resistant; these were not installed by Tesoro.
The CSB has called for the adoption of inherently safer
, design and equipment
in other reports, notably the Richmond, California, Chevron
fire of August
We need a national mandate for state and federal
regulators to require chemical facilities
to the greatest extent
practicable," said Moure-Eraso. "For example, storing or
utilizing less hazardous materials, making the process safer
by lowering temperatures and pressures, and installing the
most reliable equipment available are critical to lowering
the industrys accident rate.
The report stresses that the accident occurred during a
startup of the naphtha hydrotreater unit, considered
hazardous non-routine work, particularly due to the
reoccurring leaks of flammable liquid. Despite this, required
Process Hazard Analyses (PHA) at the refinery repeatedly
failed to ensure that these hazards were controlled and that
the number of workers exposed to these hazards was minimized.
In addition, past PHAs, including those done by the
preceding owner, Shell Anacortes Refining
Company, cited only
judgment-based safeguards and did not verify whether
safeguards listed in the PHAs were actually
Data for actual operating conditions was not readily
available and technical experts were not required to prove
safety effectiveness. The refinery process safety
culture required proof of danger rather than proof of
effective safety implementation, the report concluded.
As with the Chevron accident investigation, the Tesoro report
notes the considerable frequency of significant and
deadly incidents at refineries over the last decade. It
states that in 2012 alone, the CSB tracked 125 significant
incidents at US petroleum refineries.
The draft report examines the effectiveness of refinery and
chemical facility regulatory oversight, noting that
Washington States Department of Labor and Industries
(L&I) does not have sufficient personnel resources to
verify that process safety management requirements are being
implemented adequately. The report states that the agency
audited the Tesoro refinery in March 2009 but found no
deficiencies related to the heat exchanger that ruptured.
The regulatory findings also concluded that under the
existing US and Washington State regulatory systems, there is
no requirement to reduce risks to a specific target, for
example as low as reasonably practicable, or ALARP, which is
a hallmark of the safety case regime adopted successfully in
Europe and Australia in the refinery and chemical sectors, as
well as the nuclear and space sectors in the US.
The safety case model is the subject of the draft regulatory
report on the Chevron accident, released on December 16 of
last year. The draft is still being considered by the board.
The draft report states in one of its 40 key findings:
It is essential that regulators of high-hazard facilities
well-funded, well-staffed, and technically qualified. These
individuals must be able to effectively communicate with
refinery personnel and monitor the adequacy of refinery
process safety practices.
The draft report -- subject to a future vote by the board --
includes numerous proposed safety recommendations to
Washingtons legislature and governor, to its regulatory
agency, Tesoro, and the American Petroleum Institute.
These include a recommendation to the state to
establish a more rigorous regulatory model, possibly based on
the safety case regime, revise the states process
safety management regulations to ensure the prevention of
catastrophic releases, perform a safety verification audit at
all refineries in the state.
The report found that both the Tesoro and Chevron incidents
could have been prevented if inherently safer equipment
materials of construction
had been used.
Although the use of inherently safer technology
(IST) is the most
effective approach to preventing major chemical accidents, it
is not enforced by the EPA through the General Duty Clause or
EPAs Risk Management Program. The report concludes that
EPA has the authority to require the use of IST and
recommends that it should do so.
Other proposed recommendations would urge API to clearly
establish the minimum necessary shall
requirements to prevent HTHA equipment failures.
Recommendations to Tesoro were aimed among other things at
revising and improving its Process Hazard Analysis and damage
mechanism hazard review programs for all Tesoro refineries in
order to validate damage mechanism hazards and
The company was also urged in the draft to implement a
program to perform periodic process safety culture surveys
among the work force at the Tesoro Anacortes refinery
to be conducted by a