An investigation by the U.S. Chemical Safety Board has found that a fatal explosion in 2010 at an oil refinery was the result of damage to a heat exchanger. The April 2010 fatal explosion and fire at the Tesoro refinery in Anacortes, Wash., was caused by damage to the heat exchanger, a mechanism known as high temperature hydrogen attack (or HTHA), which severely cracked and weakened carbon steel tubing leading to a rupture, according to a draft report released by the CSB.

Using computer models [video link], the investigation found the industry-wide method used to predict the risk of HTHA damage to be inaccurate, with equipment failures occurring under conditions deemed to be safe from HTHA. It cited deficiencies in the company’s safety culture that led to a “complacent” attitude toward flammable leaks and occasional fires. Investigators also determined that Tesoro did not correct the history of hazardous conditions or limit the number of people involved in the hazardous non-routine startup of the heat exchangers during the unit startup. But because of the reoccurring leaks and the need to manually open a series of long-winded valves that required over 100 turns by hand to fully open, a supervisor requested five additional workers to help. All seven lost their lives as a result of the blast.

CSB Chairperson Dr. Rafael Moure-Eraso said, “The accident at Tesoro could have been prevented had the company applied inherent safety principles and used HTHA-resistant construction materials to prevent the heat exchanger cracking.” He also noted that the accident is similar to one that occurred in August 2012 at a Chevron refinery in Richmond, Calif. In that accident, piping ruptured after corrosion went undetected for decades. The rupture created a vapor cloud that endangered 19 workers and sent 15,000 members of the community to the hospital.

The draft report notes that recommended practices of the American Petroleum Institute, the leading industry association, are written “permissively” with no minimum requirements to prevent HTHA failures. Additionally, they do not require users to verify actual operating conditions in establishing operation limits of the equipment or to confirm that selected construction materials will prevent damage. An inspection strategy that relied on design operating conditions rather than verifying actual operating parameters contributed to the accident.

The investigation found Tesoro, like others in the industry, use published data from the American Petroleum Institute, called the Nelson Curves, to predict the susceptibility of the heat exchangers to HTHA damage. The CSB found these curves unreliable because they use historical experience data concerning HTHA that may not sufficiently reflect actual operating conditions. For example, a CSB computer reconstruction of the process conditions in the exchangers determined that the portion of the carbon steel exchanger that failed likely operated below the applicable Nelson curve, indicating it was “safe.”

The CSB determined that inspections for such damage are unreliable because the microscopic cracks can be localized and difficult to identify. The report concludes, “Inherently safer design is a better approach to prevent HTHA.” It notes that API has identified high-chromium steels that are highly resistant; these were not installed by Tesoro. The CSB has called for the adoption of inherently safer technology, design and equipment in other reports, notably the Chevron refinery fire of August 2012.

The report stresses that the accident occurred during a startup of the naphtha hydrotreater unit, considered hazardous non-routine work, particularly due to the reoccurring leaks of flammable liquid. Despite this, required Process Hazard Analyses (PHA) at the refinery repeatedly failed to ensure that these hazards were controlled and that the number of workers exposed to these hazards was minimized. In addition, past PHAs, including those done by the preceding owner, Shell Anacortes Refining Co., cited only judgment-based safeguards and did not verify whether safeguards listed in the PHAs were actually effective.

Data for actual operating conditions was not readily available, and technical experts were not required to prove safety effectiveness. “The refinery process safety culture required proof of danger rather than proof of effective safety implementation,” the report concluded.

As with the Chevron accident investigation, the Tesoro report notes the “considerable frequency of significant and deadly incidents at refineries over the last decade.” It states that the CSB tracked 125 significant incidents at U.S. petroleum refineries in 2012 alone. The regulatory findings in the report also concluded that under the existing U.S. and Washington state regulatory systems there is no requirement to reduce risks to a specific target – for example, as low as reasonably practicable (ALARP), which is a hallmark of the safety case regime adopted successfully in Europe and Australia in the refinery and chemical sectors, as well as the nuclear and space sectors in the United States.

The report found that both the Tesoro and Chevron incidents could have been prevented if inherently safer equipment materials of construction had been used. Other proposed recommendations would urge API to clearly establish the minimum necessary “shall” requirements to prevent HTHA equipment failures. Recommendations to Tesoro were aimed at revising and improving its PHA and damage mechanism hazard review programs for all its refineries in order to validate damage mechanism hazards and safeguards. The company was also urged to implement a program to perform periodic process safety culture surveys among the workforce at the Tesoro Anacortes refinery to be conducted by a third party.

The draft report is available at for public comment until March 16, 2014. Comments should be sent to All comments received will be reviewed and published on the CSB website.