Skip to content

Caribbean Petroleum Corporation (CAPECO) Refinery Tank Explosion and Fire

Overview

A gasoline overfill occurred during transfer from the tanker ship Cape Bruny at CAPECO’s Bayamón tank terminal. The overfill led to a vapor cloud, ignition in the wastewater treatment area, an explosion, multiple tank fires, and offsite and environmental impacts. The final CSB report identified failures in tank overfill prevention, tank gauging, dike drain control, emergency response planning, and broader regulatory and management systems.

Incident Snapshot

Field Value
Facility / Company Caribbean Petroleum Corporation (CAPECO)
Location Bayamón, PR
Incident Date 10/23/2009
Investigation Status The CSB investigation is final.
Accident Type Chemical Distribution - Fire and Explosion
Final Report Release Date 10/21/2015

What Happened

  • On October 21, 2009, the Cape Bruny cargo ship arrived at the CAPECO dock in San Juan Bay to unload CAPECO’s near-weekly shipment of more than 11.5 million gallons of unleaded gasoline.
  • CAPECO planned to pump the gasoline shipment to four smaller storage tanks (405, 504, 409, and 411) and the balance to Tank 107.
  • On October 22, 2009, operators switched flow among tanks during unloading operations.
  • The tank farm operator observed that the level instrument for Tank 504 was physically stuck and Tank 504 was closed early.
  • Operators then fully opened the valve on Tank 409 and partially cracked the valve on Tank 411, directing more than 7,000 gallons of gasoline per minute into Tank 409 and allowing a small flow into Tank 411.
  • At approximately 6:30 p.m., the operator manually calculated that Tank 409 would reach maximum fill sometime between 9 p.m. and 10 p.m., during shift change.
  • At about 10 p.m., operators fully opened the valve on Tank 409 after Tank 411 reached maximum capacity.
  • Between the 11 p.m. and 12 a.m. check, Tank 409 began to overflow.
  • At the 12 a.m. check, operations staff noticed a fog on the ground and on the road along Tanks 504, 411, and 409.
  • Fuel gushed from the vents, creating a spray of gasoline that formed a vapor cloud and pooled in the secondary containment dike.
  • The gasoline vapor cloud migrated to low-lying areas of the tank farm and to the storm water retention pond in the wastewater treatment (WWT) area through open dike valves.
  • At 12:23 a.m. on October 23, 2009, security cameras at CAPECO and neighboring facilities recorded the ignition of the vapor cloud in the WWT area.
  • About seven seconds after ignition, the vapor cloud exploded.
  • Local fire departments with assistance from an industrial firefighting company took 66 hours to extinguish the fire after the explosion.

Facility and Process Context

  • CAPECO operated as a storage and distribution facility for gasoline, fuel oil, jet, and diesel fuel.
  • The site was capable of storing approximately 90 million gallons of product.
  • The CAPECO site covered 179 acres, 115 of which were developed into four areas: a tank farm, the decommissioned refinery, an administration area, and a wastewater treatment (WWT) plant.
  • The facility also owned and operated a loading dock on San Juan Bay in Guaynabo, 2.5 miles northeast of the site.
  • Two tank farm operators, one WWT operator, and one shift supervisor conducted normal site operations staffing work on three 8-hour rotating shifts.
  • The Planning and Economics Department coordinated fuel deliveries, instructed operators on which tank to fill, specified the volume of materials, and determined the filling schedule during unloading operations.
  • CAPECO operators commonly switched flow among multiple tanks during unloading operations of a single shipment, requiring constant contact between tank operators and the shift supervisor.
  • The tank farm used both rising stem and fixed stem valves on the dike drains leading to the storm water retention pond in the WWT area.
  • The design of the dike valve system made it difficult to distinguish between open and closed valve positions.
  • The WWT area was not electrically classified for use in a flammable atmosphere.
  • Insufficient lighting in the tank farm areas hindered operators from observing the overfilling of Tank 409 and the subsequent vapor cloud formation.

Consequences

  • Fatalities: 0
  • Injuries: 3 minor injuries at Fort Buchanan
  • Environmental release: Thousands of gallons of oil, fire suppression foam, and contaminated runoff were released to the environment; CAPECO and the EPA collected and shipped offsite an estimated 171,000 gallons of oil and 22 million gallons of contact water; approximately 30 million gallons of petroleum was released via storm water channels, on-site and off-site surface water bodies, and neighboring wetlands to San Juan Bay.
  • Facility damage: Significant damage to 17 of the 48 petroleum storage tanks and other equipment onsite; 17 of 48 tanks were burned.
  • Operational impact: The fires burned for almost 60 hours; air and vehicle transportation was interrupted; PR-22 was closed for three days; temporary flight restrictions affected Luis Muñoz Marín International Airport.

Key Findings

Immediate Causes

  • A 5-million gallon aboveground storage tank (AST) overflowed into a secondary containment dike.
  • The gasoline spray aerosolized, forming a large vapor cloud, which ignited after reaching an ignition source in the wastewater treatment (WWT) area of the facility.
  • The topography of the tank farm allowed the gasoline vapor cloud to migrate through open dike valves to low-lying areas of the tank farm and to the storm water retention pond in the wastewater treatment area, where it ignited.
  • The open dike valve directed gasoline to the storm water retention pond located in the WWT area where the large surface area pond provided a second location for gasoline to collect and vaporize.

Contributing Factors

  • Malfunctioning of the tank side gauge or the float and tape apparatus during filling operations led to recording of inaccurate tank levels.
  • Normal variations in the gasoline flow rate and pressure from the Cape Bruny without the facility’s ability to identify and incorporate the flow rate change in real time into tank fill time calculations may have contributed to the overfill.
  • Potential failure of the tank’s internal floating roof due to turbulence and other factors may have contributed to the overfill.
  • Inadequate tank filling procedures.
  • CAPECO’s normal filling operations required that operators partially open the intake valve to a tank while filling another tank, because the pressure in the pipeline from the dock made manually opening a fully closed valve difficult.
  • Unreliable tank gauging equipment.
  • The design of the dike valve system made it difficult to distinguish between open and closed valve positions.
  • Insufficient lighting in the tank farm areas hindered operators from observing the overfilling of Tank 409 and the subsequent vapor cloud formation.
  • CAPECO lacked sufficient firefighting equipment to effectively fight and control a fire involving multiple tanks.
  • CAPECO did not preplan with local emergency responders or adequately train facility personnel to deal with a fire involving multiple tanks.
  • Local fire departments lacked sufficient training and resources to respond to industrial fires and explosion.
  • A lack of coordination among the 43 federal, commonwealth and nongovernmental organizations that responded to the CAPECO incident further complicated the emergency response.
  • The lack of motor-operated valves compromised the accuracy of tank-filling time estimates.
  • The lack of flow indicators coupled with various pipe diameters, the tank-switching process, and an unreliable gauging system all contributed to the overfilling of Tank 409.
  • An unreliable level control and monitoring system did not provide accurate and timely information for the operator to prevent overfilling Tank 409.
  • The failure-prone float and tape gauges and the unreliable level transmitters proved ineffectual.
  • The level transmitters were frequently out of service due to lightning damage.
  • Insufficient independent and separate safeguards to prevent overfill, such as a high-level alarm and an automatic overfill prevention system (AOPS), compromised facility safety.
  • Inadequate formal tank filling procedures were restricted to a list of equipment to be manipulated.
  • The outdated procedures were often applicable to the tank farm when the refinery was in operation.
  • The automatic tank gauging system, the only level control and monitoring system to support the operator in preventing overfill, was often out of service.
  • The defective level transmitter was not sending data for Tank 409 or 107 to the computer in the operator shack or to the supervisor’s office on the day of the incident.
  • A nonexistent automatic overfill prevention system and the inability to rapidly stop transfer operations or divert flow before an overfill weakened CAPECO’s safety program.
  • Ill-equipped CAPECO tanks were left with an unreliable level monitoring and control system or a high-level alarm system.
  • Tanks were not equipped with an independent high-level alarm system.
  • Tanks were not equipped with an independent Automatic Overfill Prevention System (AOPS) for terminating transfer operations.

Organizational and Systemic Factors

  • The CSB determined that numerous technical and systemic failures contributed to the explosion and multiple tank fires at the CAPECO tank terminal.
  • The CSB found that multiple layers of protection failed within the level control and monitoring system at the same time.
  • A lack of independent safeguards contributed to the overfill.
  • The CSB found that systemic failures at CAPECO included a history of poorly maintaining terminal operations, an inherent financial pressure to fill the tanks within the Planning Department’s stipulated time, a failure to learn from previous overfill incidents at the facility, a lack of preventative maintenance for the malfunctioning float and tape device and automatic tank gauge transmitters, an unreliable computer for calculating tank fill times, a lack of overfill prevention safeguards as an independent alarm, a lack of formal procedures for tank-filling operations for operators and managers, an insufficient mechanical integrity program for safety critical equipment, and poor adherence to human factors principles for safety critical equipment.
  • CAPECO had a history of poorly maintaining its terminal operations.
  • CAPECO had multiple overfills and spills during transfer operations.
  • CAPECO operators received instructions from the Planning Department to fill the tanks to their maximum fill level during the October 21-23, 2009 filling operations.
  • CAPECO’s standard operating procedures only addressed activities requiring a permit to work and did not cover terminal operations.
  • CAPECO lacked procedures dictating how to load multiple tanks at the same time.
  • The management decision to staff each fuel offloading shift with two operators at the tank farm and one operator at the dock provided insufficient staffing resources during filling operations.
  • CAPECO was not required to conduct a risk assessment that evaluated the quantity of flammable products stored at the terminal and their proximity to the neighboring community.
  • The facility was not required to conduct periodic PHAs and MOCs of its process equipment after the shutdown of the refinery in 2000 because of the atmospheric storage tank exemption.
  • CAPECO and the local fire department lacked sufficient firefighting equipment to effectively fight and control a fire involving multiple tanks because they are not required to conduct a risk analysis where they have to consider and plan for the potential of a vapor cloud explosion involving multiple tanks.
  • The US regulatory system does not consider bulk aboveground storage tank terminals storing flammable liquid to be highly hazardous, even those near communities.
  • Due to a lack of regulatory coverage under OSHA Process Safety Management (PSM) standard and EPA Risk Management Plan (RMP), tank terminal facilities are not required to conduct risk assessments to address flammable hazards on site or to follow Recognized and Generally Accepted Good Engineering Practices (RAGAGEP).
  • A high-level alarm system or high-integrity overfill prevention system are not required by OSHA’s Flammable and Combustible Liquids standard or the EPA’s Spill Prevention Control and Countermeasure (SPCC) requirements.
  • Under SPCC, facilities similar to CAPECO do not have to report overfill incidents unless oil is discharged to navigable waters.
  • NFPA 30 only requires one layer of protection on storage tanks, at minimum consistent gauging without requirement for an independent or redundant level alarm or an automatic overfill prevention system.
  • ANSI/API 2350 only requires an automatic overfill prevention system for remotely operated facilities and does not offer substantial guidance on conducting a risk assessment that considers the complexity of site operations, the type of flammable and combustible liquids stored at the facility or proximity to nearby communities when considering the necessary safeguards to protect the public.
  • There is a lack of one comprehensive industry standard to address tank terminal operations, including tank-filling operations and overfill prevention.
  • ICC does not require an independent audible or visual alarm to indicate rising liquid levels.

Failed Safeguards or Barrier Breakdowns

  • Tanks were not equipped with an independent high-level alarm system.
  • Tanks were not equipped with an independent Automatic Overfill Prevention System for terminating transfer operations.
  • The automatic gauging system at CAPECO had a history of repeated failures and prolonged out-of-service periods.
  • On the night of the incident, the float and tape device inside Tank 504 became stuck and the transmitters for Tanks 107 and 409 were not receiving data from the side gauge on Tank 409; therefore, data on the tank liquid level and a calculated fill rate into 409 were not available in real time on the computer.
  • The computer monitoring system was often compromised by outages from lightning strikes and accidental breakage of the computer cables after maintenance activities in the tank farm area.
  • The transmitters that sent the data to the computer were susceptible to electromagnetic interference and frequently needed replacing after lightning storms.
  • CAPECO did not calculate the roof displacement of Tank 409.
  • The dike drain valve for Tank 409 was open at the time of the incident.
  • The tank farm used both rising stem and fixed stem valves on the dike drains leading to the storm water retention pond in the WWT area.
  • The fixed stem valve on the dike drain for Tank 409 made it difficult for tank farm operators to observe its position without physically turning it.
  • On the night of the incident, operators could not see the tank overflowing or the vapor cloud forming because the lighting was insufficient.
  • CAPECO lacked the necessary firefighting equipment to fight multiple tank fires at once.
  • CAPECO personnel and local firefighters were trained only for a worst-case scenario involving one tank on fire, rather than 11 tank fires at the same time caused by a vapor cloud explosion.

Recommendations

  1. 2010-02-PR R1 | Recipient: Environmental Protection Agency (EPA) | Status: Not specified | Revise where necessary the Spill Prevention, Control and Countermeasure (SPCC); Facility Response Plan (FRP); and/or Accidental Release Prevention Program (40 CFR Part 68) rules to prevent impacts to the environment and/or public from spills, releases, fires, and explosions that can occur at bulk aboveground storage facilities storing gasoline, jet fuels, blendstocks, and other flammable liquids having an NFPA 704 flammability rating of 3 or higher.
  2. 2010-02-PR R2 | Recipient: Environmental Protection Agency (EPA) | Status: Not specified | Conduct a survey of randomly selected bulk aboveground storage containers storing gasoline or other NFPA 704 flammability rating of 3 or higher at terminals in high risk locations (such as near population centers or sensitive environments) that are already subject to the Spill Prevention, Control and Countermeasure (SPCC) and/or Facility Response Plan (FRP) rules to determine the nature of the safety management systems in place to prevent overfilling a storage tank during loading operations; the extent to which terminals use independent high level alarms, automated shutoff/diversion systems, redundant level alarms or other technical means to prevent overfilling a tank; the history of overfilling incidents at the facilities, with or without consequence; and whether additional reporting requirements are needed to understand the types of incidents leading to overfilling spills that breach secondary containment and have the potential to impact the environment and/or the public, as well as the number of safeguards needed to prevent them.
  3. 2010-02-PR R3 | Recipient: Environmental Protection Agency (EPA) | Status: Not specified | As an interim measure, until the rule changes in CSB Recommendation No. 2010-02-I-PR-R1 are adopted and go into effect: issue appropriate guidance or an alert, similar to EPA’s previously issued Chemical Safety Alert addressing Rupture Hazard from Liquid Storage Tanks, to illustrate the hazards posed by spills, releases, fires and explosions due to overfilling bulk aboveground storage containers storing gasoline, jet fuel, blendstocks, and other flammable liquids having an NFPA 704 flammability rating of 3 or higher.
  4. 2010-02-PR R4 | Recipient: Occupational Safety and Health Administration (OSHA) | Status: Not specified | Revise the Flammable and Combustible Liquids standard (29 CFR§ 1910.106) to require installing, using, and maintaining a high-integrity automatic overfill prevention system with a means of level detection, logic/control equipment, and independent means of flow control for bulk aboveground storage tanks containing gasoline, jet fuel, other fuel mixtures or blendstocks, and other flammable liquids having an NFPA 704 flammability rating of 3 or higher, to protect against loss of containment.
  5. 2010-02-PR R5 | Recipient: International Code Council (ICC) | Status: Not specified | Revise the Section 5704.2.7.5.8 (2015), Overfill Prevention of the International Fire Code (IFC) to require an automatic overfill prevention system (AOPS) for bulk aboveground storage tank terminals storing gasoline, jet fuel, other fuel mixtures or blendstocks, and other flammable liquids having an NFPA 704 flammability rating of 3 or higher, or equivalent designation.
  6. 2010-02-PR R6 | Recipient: National Fire Protection Association (NFPA) | Status: Not specified | Revise NFPA 30, Flammable and Combustible Liquids Code, Section 21.7.1.1 (2015) for bulk aboveground storage tank terminals storing gasoline, jet fuel, other fuel mixtures or blendstocks, and other flammable liquids having an NFPA 704 flammability rating of 3 or greater.
  7. 2010-02-PR R7 | Recipient: American Petroleum Institute (API) | Status: Not specified | Revise ANSI/API 2350, Overfill Protection for Storage Tanks in Petroleum Facilities (2015), to require the installation of an automatic overfill prevention systems for existing and new facilities at bulk aboveground storage tanks storing gasoline, jet fuel, other fuel mixtures or blendstocks, and other flammable liquids having an NFPA 704 flammability rating of 3 or higher.
  8. 2010-02-PR R8 | Recipient: American Petroleum Institute (API) | Status: Not specified | Develop detailed guidance on conducting a risk assessment for onsite and offsite impacts of a potential tank overfill during transfer operations involving one and multiple tanks and for determining the Safety Integrity Level of the required overfill prevention safeguard to replace Annex E of ANSI/API 2350, Overfill Protection for Storage Tanks in Petroleum Facilities (2015).
  9. 2010-02-PR R9 | Recipient: American Petroleum Institute (API) | Status: Not specified | Develop a single publication or resource describing all API standards and other relevant codes, standards, guidance, and information for filling operations of aboveground storage tanks in petroleum facilities that describes the required design and management practices for control of filling operations; the minimum set of independent overfill prevention safeguards if the control fails; and operational challenges related to loading multiple tanks concurrently from a single product source.

Key Engineering Lessons

  • A single level-measurement method is not sufficient when it is unreliable or out of service; independent and separate overfill safeguards are needed.
  • Overfill prevention should not depend solely on manual calculations, operator monitoring, or a single gauging system during transfer operations.
  • Dike drain configuration and valve position visibility matter because open drains can route spilled gasoline to low-lying areas and the wastewater treatment area where ignition sources may exist.
  • Tank farm lighting and valve design can directly affect the ability of operators to detect overfill and confirm safe valve positions.
  • Overfill prevention systems should be physically separate and independent from the tank level control and monitoring system.
  • Emergency response planning and equipment must account for the possibility of multiple tank fires, not only a single-tank fire scenario.
  • Risk assessment for tank terminals should consider onsite and offsite impacts, including nearby populations and environmental resources, when selecting safeguards.

Source Notes

  • Priority 1 final report was used as the primary authority for incident facts, causes, consequences, and recommendations.
  • Priority 3 recommendation status summaries were used to update recommendation statuses where explicitly stated.
  • Where the final report and status summaries differed in wording, the final report terminology was preferred unless a later status document provided a specific recommendation status change.
  • No external facts were added beyond the provided source extracts.

Similar Incidents

Incidents sharing the same equipment, root causes, or hazard types.

Same Equipment

Same Root Cause

Same Hazard

← View in Knowledge Graph