Skip to content

BP - Husky Oregon Chemical Release and Fire

Overview

On September 20, 2022, an accidental release of flammable chemicals ignited at the BP-Husky Toledo Refinery in Oregon, Ohio. Two workers were fatally injured. Substantial property damage occurred. The CSB final report identified a naphtha release and fire involving the Fuel Gas Mix Drum, the Coker Gas Plant, and the Crude 1 unit. Alarm flooding and abnormal situation management deficiencies preceded the event.

Incident Snapshot

Field Value
Facility / Company BP-Husky Toledo Refinery / Ohio Refining Company LLC
Location Oregon, OH
Incident Date 09/20/2022
Investigation Status The CSB's investigation was released on June 24, 2024.
Accident Type Oil and Refining - Fire and Explosion
Final Report Release Date 06/24/2024

What Happened

  • On the Monday night shift of September 19, 2022, water began to accumulate in the Crude 1 Overhead Accumulator Drum.
  • Several hours later, the Crude 1 Overhead Accumulator Drum began to overflow into the naphtha stream that normally exited the drum.
  • Excess water in the naphtha stream began to accumulate downstream in the Coker Gas Plant Foul Condensate Draw-Off Drum.
  • The Coker Gas Plant Foul Condensate Draw-Off Drum began to overflow water into the Coker Gas Plant Absorber Stripper Tower.
  • The water overflow and resulting liquid flow increase out of the Absorber Stripper Tower bottoms and into downstream equipment led to a downstream pressure increase in NHT Preheat.
  • The pressure increase in NHT Preheat was enough to open two emergency pressure-relief valves shortly after 7:00 a.m. on the Tuesday day shift of September 20, 2022.
  • A severe piping vibration began as a result of one of the emergency pressure-relief valves opening.
  • A 3/4-inch drain line broke off the main naphtha piping, which led to a liquid naphtha loss of containment.
  • The naphtha did not ignite but resulted in an emergency shutdown of the NHT unit and bypass of the Coker Gas Plant.
  • The Crude 1 unit continued to operate.
  • At 4:56 p.m., the oncoming Tuesday night shift made another crude slate change, which removed all light crude oil from the Crude 1 Tower feed.
  • During the Tuesday night shift, another Crude 1 Tower process upset began due to the rapid and complete loss of light crude oil feed.
  • The Crude 1 Tower upset caused a high level of liquid in the Crude 1 Overhead Accumulator Drum.
  • Board operators began transferring the excess liquid to the Coker Gas Plant Absorber Stripper Tower.
  • Once the board operator intentionally opened the flow control valve from the Crude 1 Overhead Accumulator Drum to the Coker Gas Plant, liquid naphtha flowed from the drum to the Absorber Stripper Tower.
  • Naphtha began to fill the Coker Gas Plant Absorber Stripper Tower and eventually overflowed through the Coker Gas Plant bypass line to the Fuel Gas Mix Drum.
  • Once the Fuel Gas Mix Drum was liquid full, the naphtha flowed to the downstream furnaces and boilers.
  • By 6:09 p.m., the Fuel Gas Mix Drum level had begun to increase.
  • The board operator noticed the Fuel Gas Mix Drum level alarm on the Distributed Control System (DCS) alarm screen and radioed the outside operators to check the level in the Fuel Gas Mix Drum at 6:16 p.m.
  • Four outside operations personnel arrived at the Fuel Gas Mix Drum.
  • Another outside operator began draining the Fuel Gas Mix Drum to the Flare Knockout Drum and Oily Water Sewer.
  • At approximately 6:17 p.m., one of the personnel fully opened the valve on the two-inch line to the Flare Knockout Drum.
  • At approximately 6:17 p.m., one of the personnel opened the Fuel Gas Mix Drum two-inch drain to the Oily Water Sewer.
  • At a later unknown time, a second one-inch drain line from the Fuel Gas Mix Drum guided wave radar level transmitter to the Oily Water Sewer was opened.
  • Two of the operations personnel left the area around the Fuel Gas Mix Drum to check on the Sweet Gas Knock Out Pot in the Coker Gas Plant, leaving two BP employees, one outside operator and an operator trainee who were brothers, at the Fuel Gas Mix Drum to finish draining it.
  • These BP employees opened two 3/4-inch bleed valves to the ground at approximately 6:32 p.m.: one at the Fuel Gas Mix Drum differential pressure level transmitter, and one at the Fuel Gas Mix Drum sight glass.
  • Just before 6:39 p.m., the outside operator and operator trainee began releasing liquid from the Fuel Gas Mix Drum directly to the ground from a two-inch valve on the side of the Fuel Gas Mix Drum.
  • At 6:39 p.m., likely as a result of naphtha releasing to the ground and vaporizing, a flammable gas detector near the Fuel Gas Mix Drum indicated 100 percent of the lower flammability limit (LFL).
  • The vapor cloud ignited at 6:46 p.m.
  • After the vapor cloud ignited at 6:46 p.m., the BP Toledo Refinery Emergency Response Team (ERT) reported to the scene at 6:54 p.m.
  • At 7:04 p.m., a board operator realized that naphtha was flowing to the Fuel Gas Mix Drum from the Crude 1 Overhead Accumulator Drum through the Coker Gas Plant.
  • The board operator closed the naphtha flow control valve to the Coker Gas Plant.
  • The fire was extinguished by 10:10 p.m.

Facility and Process Context

  • The BP Toledo Refinery is located east of the city of Toledo, in Oregon, Ohio.
  • The refinery sits on 586 acres and has operated since 1919.
  • The refinery can process approximately 160,000 barrels of crude oil per day, producing gasoline, diesel, jet fuel, propane, asphalt, and other products.
  • As of September 2022, the refinery employed 588 people.
  • BP operated the BP Toledo Refinery for the joint venture, and refinery personnel were BP employees operating under established BP policies, practices, and procedures.
  • BP considered all the units within the refinery to be covered by the OSHA PSM standard.
  • The Crude 1 unit and the NHT unit were combined in the risk management plan because an event in either process could involve the other.
  • The risk management plan identified overfilling as one of the major hazards identified in the Crude 1 unit and Coker Gas Plant.
  • The Fuel Gas Mix Drum was located within the Crude 1 Unit of the refinery.
  • Fuel gas streams from seven refinery sources are routed to the Mix Drum where vapors mix before being distributed to thirteen fuel users throughout the refinery.
  • The liquid level in the bottom portion of the normally vapor-only drum was monitored and measured by a differential pressure level instrument, a guided wave radar level instrument, and a transparent level gauge commonly called a sight glass.
  • The coker gas plant removes sulfur and light hydrocarbon compounds from the gas produced in the coker units before it goes to the Mix Drum.
  • The flammable liquid naphtha from the Crude 1 Unit reached the Mix Drum by flowing through piping associated with the coker gas plant.

Consequences

  • Fatalities: 2 employees fatally injured: Ben Morrissey and Max Morrissey.
  • Injuries: Four operations personnel received first aid for skin irritation due to contact with the water-naphtha mixture as they worked to isolate the leak.
  • Environmental release: BP estimated over 23,000 pounds of naphtha were released during the event; BP estimated that 23,502 pounds of naphtha and 66,889 pounds of fuel gas were released during the incident.
  • Facility damage: Approximately $597 million in property damage including loss of use.
  • Operational impact: The NHT unit was shut down; the Coker Gas Plant was bypassed; the Crude 1 Tower was unstable throughout the day; the fire was extinguished by 10:10 p.m.

Key Findings

Immediate Causes

  • The CSB determined the cause of the incident was operators opening valves and removing a flange on the pressurized Fuel Gas Mix Drum to release a flammable liquid, naphtha, directly to the ground.
  • After being released to the ground, the flammable liquid formed a vapor cloud that reached a nearby ignition source resulting in a flash fire.
  • FV-3816 was opened while the Coker Gas Plant was in bypass mode.
  • The Absorber Stripper Tower (PR-550025) and downstream equipment including the TIU Fuel Gas Mix Drum (PR-510253) overfilled with liquid naphtha.
  • The high level switch (LSH-805) was not available to detect high level of flammables in the TIU Fuel Gas Mix Drum during an overfill scenario.

Contributing Factors

  • the refinery’s failure to implement effective preventive safeguards for the overflow of towers and vessels in various pieces of equipment which led to an over-reliance on human intervention to prevent incidents
  • the refinery’s failure to implement a shutdown or hot circulation through the use of Stop Work Authority or otherwise
  • the refinery’s ineffective policies, procedures, and practices to avoid and control abnormal situations
  • the refinery’s alarm system which flooded operators with alarms throughout the day resulting in poor decision making
  • the refinery’s failure to learn from previous incidents
  • The change in crude feed composition combined with the earlier shutdown of the NHT and bypassing of the CGP resulted in unstable operating conditions in the Crude 1 Unit.
  • During this time all the pump-arounds supplying cooling to the Crude 1 tower were not circulating.
  • The decreased cooling increased the vapor flow up the tower leading to additional material flashing overhead and condensing.
  • The additional overhead flow in the Crude 1 tower resulted in a high liquid level in the Crude 1 overhead accumulator drum.
  • Naphtha began accumulating in a 138-foot tower until the liquid level reached CGP vapor bypass piping which directed the naphtha to the Mix Drum.
  • An approaching rainstorm shifted the wind, which likely directed the vapor cloud towards the nearby Crude 1 Furnace, igniting the vapor cloud.

Organizational and Systemic Factors

  • The BP Toledo Refinery ASM policy narrowly defined abnormal operations.
  • The BP Toledo Refinery ASM policy was not effective for proactive recognition of abnormal situations.
  • The BP Toledo Refinery did not provide effective guidance for managing abnormal situations.
  • The BP Toledo Refinery did not have any procedures, written instructions, or documented corrective actions for board operators or outside operators to respond to or troubleshoot a high liquid level in the Fuel Gas Mix Drum, during either normal operations or process upsets, if liquid entered the drum.
  • The BP Toledo Refinery relied on safeguards that required operator intervention to respond to process upsets and deviations.
  • The BP Toledo Refinery did not have effective administrative controls such as written procedures and adequate training for operations personnel to recognize and prevent liquid overflow events.
  • The BP Toledo Refinery did not have sufficient preventive safeguards to prevent overflowing the Fuel Gas Mix Drum into the downstream fuel gas system.
  • The BP Toledo Refinery did not adequately communicate the guidance to safely operate the Crude 1 Tower from the afternoon meeting to the oncoming night shift personnel.
  • The BP Toledo Refinery had an alarm flood state for nearly 12 hours preceding the incident.
  • Between 6:50 a.m. and 6:49 p.m. September 20, 2022, a total of 3,712 alarms were recorded.
  • The BP Toledo Refinery’s alarm system flooded operators with alarms throughout the day resulting in poor decision making.
  • The BP Toledo Refinery had a procedure called “Handling Employee Health/Safety Concerns of Assigned Work,” which stated that all workers at BP Toledo Refinery have the right to a safe work environment and the right and the responsibility to STOP any work that may be UNSAFE.
  • Some BP Toledo Refinery operating procedures stated that all qualified unit operators have the full authority to take action (including shutting the unit down) when conditions are unsafe to continue to operate.
  • The BP Toledo Refinery Abnormal Situation Management policy narrowly defined abnormal situations such that process disturbances that occurred before the incident did not fit the policy’s definition.
  • The BP Toledo Refinery did not effectively use previously existing industry guidance, such as that available from the ASM Consortium, to develop its ASM policy.
  • The BP Toledo Refinery 2019 Five Whys incident investigation focused only on action items to prevent plugging in the Lean Oil Stripper overhead system, failing to learn important safety lessons from the 2019 incident.
  • The board operators were often qualified on the Crude 1 job with minimal, if any, experience in managing process upsets.
  • There was no simulator for the Crude 1 Tower.
  • The BP Toledo Refinery did not have site-specific guidance for managing or preventing alarm flooding at the time of the incident.
  • BP told the CSB it was unaware of any process safety culture assessment completed at the BP Toledo Refinery since the Baker Panel Report.

Failed Safeguards or Barrier Breakdowns

  • high level alarms coupled with operator response
  • emergency pressure-relief system valves
  • furnace safety instrumented systems
  • the refinery’s safeguards were not effective in preventing liquid naphtha from overflowing the Coker Gas Plant Absorber Stripper Tower to the Fuel Gas Mix Drum and into the fuel gas piping
  • No SIS prevented the Absorber Stripper Tower overflow to the Fuel Gas Mix Drum by stopping naphtha flow into the tower once a high level of liquid in the tower was detected.
  • The Absorber Stripper Tower emergency pressure-relief valves were not designed to prevent the process overflow into the bypass line, just the hazard of potential overpressure arising from an overflow scenario.
  • human intervention response to address alarms from the Absorber Stripper Tower level and differential pressure instrumentation
  • the Fuel Gas Mix Drum drain piping did not have enough capacity to drain naphtha overflowing from the open Coker Gas Plant in a closed system to the Flare Knockout Drum
  • the alarm had been inadvertently disabled to the DCS
  • the flammable gas detector only alarmed locally, not in the control room
  • the Fuel Gas Mix Drum differential pressure level indication plateaued at around 67 percent of the six-foot span even though the guided wave radar level instrument and sight glass showed the Fuel Gas Mix Drum at capacity
  • the differential pressure level measurement was calibrated with a density of 0.998
  • the Fuel Gas Mix Drum differential pressure level measurement never reached the Fuel Gas Mix Drum high-high level alarm point or indicated liquid was overflowing to the fuel gas piping
  • the Coker Gas Plant was not fully isolated, even though its operational state was considered “in bypass”
  • the Coker Gas Plant bypass line remained open
  • the Crude 1 Overhead Accumulator Drum level could not be well controlled
  • the control valve to Light Virgin Naphtha Storage was at maximum capacity
  • the closed ROEIV on the Absorber Stripper Tower bottoms caused the overflow through the Coker Gas Plant bypass line to the Fuel Gas Mix Drum to occur more quickly than it otherwise would have
  • the board operators shelved Coker Gas Plant Absorber Stripper Tower high level alarms
  • The Fuel Gas Mix Drum drain piping did not have enough capacity to drain naphtha overflowing from the open Coker Gas Plant in a closed system to the Flare Knockout Drum.
  • The Absorber Stripper Tower emergency pressure-relief valves and the refinery furnaces’ safety instrumented systems would not prevent a vessel overflow event.
  • The differential pressure indicator for the liquid level gave a false indication that the liquid level is below the six-foot level measurement span of the differential pressure indicator and deviated from the guided wave radar indicator.
  • The LFL alarm in the control room was set to “Disabled” due to an Alarm Configuration Manager enforcement configuration error.
  • The Coker Gas Plant Absorber Stripper Tower bottoms outlet ROEIV was closed, which caused the overflow through the Coker Gas Plant bypass line to the Fuel Gas Mix Drum to occur more quickly than it otherwise would have.
  • The board operators shelved Coker Gas Plant Absorber Stripper Tower high level alarms.
  • The Crude 1 Tower control valve to Light Virgin Naphtha Storage reached the instrument top of range of 10,000 barrels per day and remained there.
  • The Crude 1 Tower lost all three pumparounds in August 2022 after a furnace tripped.
  • The water phase level indication on the Crude 1 Overhead Accumulator Drum was changed as part of an MOC and operations did not know that water would overflow the naphtha standpipe at 69 percent water phase level, rather than the previous 100 percent level indicated before the 2022 Turnaround.
  • FV-3816 was required to be closed while the Coker Gas Plant was in bypass mode.
  • The Absorber Stripper Tower bottom valve (XV3821) was required to be open to avoid an overfill scenario.
  • The high level switch (LSH-805) was intended to detect high level of flammables in the TIU Fuel Gas Mix Drum.
  • Timely operator access to control board screens on the South A Board in the Control Room.

Recommendations

  1. 2022-01-I-OH-R1 | Recipient: Ohio Refining Company LLC | Status: Open – Acceptable Response or Alternate Response | Revise the safeguards used in the refinery’s process hazard analyses high level and overflow scenarios. At a minimum, establish effective preventive safeguards that use engineered controls to prevent liquid overfill and do not rely solely on human intervention.
  2. 2022-01-I-OH-R2 | Recipient: Ohio Refining Company | Status: Closed – Acceptable Alternative Action | Revise the Abnormal Situation Management policy to incorporate guidance provided by the ASM Consortium and the Center for Chemical Process Safety (CCPS). The revised policy should include, at a minimum: a broader definition of abnormal situations, such as that defined by the CCPS; additional predictable abnormal situations and their associated corrective procedures, including unplanned crude slate changes, continued operation of the Crude 1 unit with the naphtha hydrotreater unit shut down, and an emergency pressure-relief valve opening; and guidance to determine when an abnormal situation is becoming too difficult to manage and the implementing proper procedures for bringing it to a safe state.
  3. 2022-01-I-OH-R3 | Recipient: Ohio Refining Company | Status: Closed – Acceptable Action | Develop and implement a policy or revise existing policy that clearly provides employees with the authority to stop work that is perceived to be unsafe until the employer can resolve the matter. This should include detailed procedures and regular training on how employees would exercise their stop work authority. Emphasis should be placed on exercising this authority during abnormal situations, including alarm floods.
  4. 2022-01-I-OH-R4 | Recipient: Ohio Refining Company | Status: Closed – Acceptable Action | Revise the ‘Toledo Alarm Philosophy’ by incorporating the Engineering Equipment and Manufacturers Users Association (EEMUA) guidance for alarm rate following an upset and not limiting alarm performance to a single metric averaged over a month. In addition to including analyzing individual alarm flood events, the revised philosophy document should improve refinery alarm performance to reduce alarm flood duration and peak rate for events similar to the September 20, 2022, incident. Consult EEMUA Publication 191, Chapter 6.5.1, for guidance regarding abnormal condition performance levels. Apply the improved performance levels where applicable, but specifically to the Crude 1 control board alarm performance.
  5. 2022-01-I-OH-R5 | Recipient: American Petroleum Institute (API) | Status: Open – Awaiting Response or Evaluation/Approval of Response | Develop a new publication or revise an existing publication, such as API Recommended Practice 556 Instrumentation, Control, and Protective Systems for Gas Fired Heaters, to incorporate the process hazards associated with Fuel Gas Mix Drum overflow. The publication should include the following at a minimum: Description of the process hazards associated with Fuel Gas Mix Drum overflow and the consequential impacts on equipment using fuel gas, Guidance for Fuel Gas Mix Drum design and sizing criteria which includes consideration of condensation, entrainment, overflow, and draining, Guidance for instrumentation to detect high level to prevent overfilling of Fuel Gas Mix Drums, and Recommended practices for selecting preventive safeguards to prevent overfilling of Fuel Gas Mix Drums.
  6. 2022-01-I-OH-R6 | Recipient: American Petroleum Institute (API) | Status: Open – Awaiting Response or Evaluation/Approval of Response | Develop a publication that addresses preventing the overflow of pressure vessels such as towers and drums. The publication should be applicable to both new and existing pressure vessels. Include the following at a minimum: Description of typical overflow events that could result during normal, upset, or transient operations (startup, shutdown, standby) including the formation of a vapor cloud, Recommended practices for instrumentation to monitor and detect a pressure vessel overflow, Process hazard analysis guidance for pressure vessel overflow scenarios, Recommended practices for safeguards to prevent a pressure vessel overflow, Recommended field and board operator process safety training topics and methods to prevent a pressure vessel overflow, Guidelines for process safety assessments to prevent a pressure vessel overflow, and Incorporate lessons learned from this CSB investigation and the CSB’s BP Texas City Refinery investigation throughout the document.
  7. 2022-01-I-OH-R7 | Recipient: International Society of Automation (ISA) | Status: Open – Acceptable Response or Alternate Response | Revise American National Standard ANSI/ISA 18.2-2016, Management of Alarm Systems for the Process Industries, to include performance targets for short-term alarm flood analysis so that users can evaluate alarm flood performance for a single alarm flood event. The performance targets should include: number of alarm floods, duration of each flood, alarm count in each flood, and peak alarm rate for each flood. At a minimum, a target peak alarm flood rate should be defined, such as in the guidance provided by the ASM Consortium or Engineering Equipment and Materials Users Association (EEMUA), to establish trigger points that require alarm performance improvement actions.

Key Engineering Lessons

  • Preventive safeguards for tower and vessel overflow should use engineered controls and not rely solely on human intervention.
  • Abnormal situation management policies need a broader definition of abnormal situations and must include predictable upset conditions with clear corrective procedures.
  • Alarm systems should be evaluated for individual alarm flood events, including duration and peak rate, not only monthly averages.
  • Instrumentation used for level detection can provide false or incomplete indications during overfill scenarios; multiple independent indicators and appropriate protective actions are necessary.
  • Fuel gas system overflow hazards can propagate naphtha into downstream equipment, creating fire and explosion hazards that must be addressed in process hazard analyses.
  • Operator access to timely control board information and effective alarm management are critical during abnormal situations.

Source Notes

  • Priority 1 final report used as the primary authority for incident sequence, findings, consequences, and recommendations.
  • Priority 3 recommendation status summaries were used to update recommendation statuses and confirm post-incident corrective actions.
  • Priority 4 supporting document was used only to supplement sequence and context where consistent with the final report.
  • Conflicting or duplicate details were resolved in favor of the higher-priority source.

Similar Incidents

Incidents sharing the same equipment, root causes, or hazard types.

Same Equipment

Same Root Cause

  • Marathon Martinez Renewable Fuels Fire — Shared failure mode: Alarm Management Failure · Communication Failure · Design Deficiency · Management Of Change Failure · Operator Error · Procedural Failure · Training Deficiency
  • Aghorn Operating Inc. Waterflood Station Hydrogen Sulfide Release — Shared failure mode: Alarm Management Failure · Communication Failure · Design Deficiency · Instrumentation Failure · Operator Error · Procedural Failure · Training Deficiency
  • Pryor Trust Fatal Gas Well Blowout and Fire — Shared failure mode: Alarm Management Failure · Communication Failure · Design Deficiency · Management Of Change Failure · Operator Error · Procedural Failure · Training Deficiency
  • INDSPEC Chemical Corporation Oleum Release — Shared failure mode: Alarm Management Failure · Design Deficiency · Instrumentation Failure · Management Of Change Failure · Operator Error · Procedural Failure · Training Deficiency
  • Morton International Inc. Runaway Chemical Reaction — Shared failure mode: Alarm Management Failure · Communication Failure · Design Deficiency · Instrumentation Failure · Management Of Change Failure · Procedural Failure · Training Deficiency

Same Hazard

← View in Knowledge Graph