Skip to content

ExxonMobil Torrance Refinery Explosion

Overview

On February 18, 2015, an explosion occurred in the ExxonMobil Torrance Refinery's Fluid Catalytic Cracking (FCC) unit Electrostatic Precipitator (ESP) during maintenance isolation activities while the unit was in Safe Park / idle mode. Preparations for the maintenance activity caused a pressure deviation that allowed hydrocarbons to backflow through the process and ignite in the ESP. The explosion severely damaged the ESP, caused minor injuries to workers nearby, and dispersed catalyst dust into the surrounding community.

Incident Snapshot

Field Value
Facility / Company ExxonMobil
Location Torrance, CA
Incident Date 2015-02-18
Investigation Status The CSB's final report was released at a news conference in Torrance, California, on May 3, 2017.
Accident Type Oil and Refining - Fire and Explosion
Final Report Release Date 2017-05-03

What Happened

  • On the morning of Wednesday, February 11, 2015, the FCC expander started to experience increased vibration.
  • On Thursday, February 12, 2015, workers cleaned the expander blades, and this temporarily reduced the expander vibration.
  • On Sunday, February 15, 2015, the expander again began to experience high vibration.
  • On Monday, February 16, 2015, workers cleaned the expander blades again, but it did not reduce vibrations.
  • At 12:50 PM on Monday, February 16, 2015, the vibrations reached a high limit, and the control system automatically began emergency shutdown to transition the unit into Safe Park.
  • On Tuesday, February 17, 2015, a meeting took place involving maintenance and machinery reliability personnel, the FCC unit operations manager, and the FCC unit business team manager.
  • On the afternoon of Tuesday, February 17, 2015, operators worked to isolate the expander for maintenance as specified in the Variance.
  • On the morning of Wednesday, February 18, 2015, ExxonMobil maintenance workers approached the open flange to install the blind, but did not install the blind because steam was escaping from the open flange.
  • The operations shift supervisor instructed the board console supervisor to reduce the steam flow through the riser in an attempt to reduce the amount of steam releasing from the expander outlet flange.
  • By 7:16 AM, the steam flow rate through the riser had been decreased from approximately 20,000 pounds per hour to approximately 7,500 pounds per hour.
  • At 8:07 AM, a maintenance supervisor working in the FCC unit received an alarm on his personal hydrogen sulfide (H2S) monitor.
  • At approximately 8:40 AM, H2S monitors on multiple workers around the expander outlet flange activated, indicating that hydrocarbons were leaking out of the expander flange.
  • Operations staff increased the steam flow up the reactor riser to 35,000 pounds per hour, but this action was taken too late; hydrocarbons had already entered the air side of the FCC unit and were flowing towards the ESP.
  • At 8:48 AM, the flammable mixture ignited inside of the ESP, causing an explosion.
  • The explosion severely damaged the ESP and caused debris to hit nearby equipment, resulting in two small fires and multiple leaks of flammable liquids.
  • Four contract employees who were working nearby sought first aid for injuries sustained while fleeing the area.
  • Catalyst dust was reported outside of the refinery property in the nearby community.

Facility and Process Context

  • The incident occurred in the refinery's fluid catalytic cracking (FCC) unit.
  • The FCC unit cracks heavy, high boiling point hydrocarbon molecules into smaller molecules with lower boiling points.
  • The main product produced by the FCC unit is gasoline.
  • The electrostatic precipitator (ESP) removes catalyst particles from the regenerator combustion gas to meet environmental regulations before it is discharged into the atmosphere.
  • The FCC unit has two sides: the hydrocarbon side and the air side.
  • The hydrocarbon side includes the reactor and the main column.
  • The air side includes the regenerator and the piping and equipment downstream of the regenerator leading to the ESP.
  • During Safe Park, the spent catalyst slide valve (SCSV) and the regenerated catalyst slide valve (RCSV) are used to prevent undesirable mixing of air and hydrocarbons by maintaining a level of catalyst on top of the valves, forming a plug that prevents reactor process vapors from entering the regenerator, and vice versa.
  • The ESP was installed in the FCC unit in 2009 to comply with new environmental regulations.
  • ExxonMobil constructed the ESP adjacent to the FCC unit and in close proximity to other units.
  • The distance from the ESP to the alkylation unit is approximately 80 feet.
  • From the ESP to the Pretreater Unit is less than 50 feet.
  • From the ESP to the Demineralization Unit is also less than 50 feet away.
  • The scaffolding was temporarily in place for work being done on the alkylation unit.

Consequences

  • Fatalities: None reported.
  • Injuries: Four contract employees who were working nearby sought first aid for injuries sustained while fleeing the area.
  • Environmental release: Catalyst dust was reported outside of the refinery property in the nearby community.
  • Facility damage: The explosion severely damaged the ESP. Debris from the explosion hit equipment near the ESP, causing two small fires and multiple leaks of flammable liquids. The explosion debris also punctured a heat exchanger that was out-of-service. A large piece of debris from the explosion fell on scaffolding around two settler tanks.
  • Operational impact: The FCC unit transitioned into Safe Park on February 16, 2015. The unit remained in Safe Park and was not shut down. The explosion occurred on February 18, 2015.

Key Findings

Immediate Causes

  • Hydrocarbons from the reactor flowed into the regenerator in the air side of the FCC unit.
  • The SCSV did not maintain the catalyst plug.
  • The reactor pressure generated by steam fed to the reactor was reduced below a safe level.
  • Hydrocarbons from the main column backflowed into the reactor.
  • Flammable hydrocarbons flowed to the ESP, where they mixed with air fed to the ESP from the CO boiler fans.
  • Sparks within the ESP ignited the flammable mixture, causing an explosion.

Contributing Factors

  • ExxonMobil did not establish the safe operating limits for operating the FCC unit in Safe Park.
  • ExxonMobil did not determine process conditions that required unit shutdown.
  • ExxonMobil relied on indirect operating parameters to measure critical safeguards for the Safe Park mode of operation.
  • ExxonMobil re-used a procedure developed for a similar maintenance operation in 2012.
  • ExxonMobil did not perform a sufficient hazard analysis to determine if the unit conditions specified in the 2012 procedure were valid for the 2015 operation.
  • The safeguards specified in the 2012 procedure were not sufficient for the 2015 operation.
  • ExxonMobil operated FCC unit equipment beyond its predicted safe operating life.
  • ExxonMobil lacked safety instrumentation to detect flammable hydrocarbons flowing through the equipment and into the ESP.
  • ExxonMobil refinery management permitted opening process equipment without conforming to refinery standards.
  • The SCSV had severely eroded over six years of operation and was unable to seal.
  • The SCSV could not function as an effective safeguard during Safe Park because it had severely eroded during its six years of operation.
  • ExxonMobil did not perform a risk evaluation to identify the safety consequences of operating the SCSV for the extended period.
  • ExxonMobil did not identify a safety and health consequence in the damage mechanism hazard review of the SCSV.
  • ExxonMobil management knew the SCSV was leaking leading up to the incident.
  • ExxonMobil did not perform a risk analysis of whether steam was a sufficient safeguard.
  • ExxonMobil did not analyze the steam flow rate necessary to prevent hydrocarbons from entering the air side of the FCC unit.
  • A leaking heat exchanger in the slurry oil pumparound allowed light hydrocarbons to enter and pressurize the main column to a higher-than-typical pressure.
  • The main column operated at a pressure of about 8.5 psig, roughly double the main column pressure during the 2012 Safe Park.
  • The heat exchanger had an extended operation.
  • The piping around the expander was not designed to allow the expander to be safely isolated.
  • ExxonMobil opened the expander outlet flange so that a blind could be inserted to isolate the expander from the process for a confined space entry operation.
  • The only valves available to isolate the expander outlet from process fluids were the SCSV and RCSV.
  • The SCSV and RCSV are control valves that throttle the flow of catalyst.
  • ExxonMobil did not follow refinery safety policies when attempting to blind the expander outlet.
  • ExxonMobil did not develop a Variance for this operation.
  • The ESP remained energized in Safe Park.
  • ExxonMobil did not shut down the FCC unit when it was identified that the SCSV leaked and had not established a catalyst barrier.
  • The ESP was not automatically shut down when hydrocarbons entered the flue gas piping leading to the ESP.
  • The 2006 PHA identified that flammable vapors could reach the ESP, potentially causing a fire or explosion, but did not identify specific scenarios that could cause the generically termed flammable vapors to reach the ESP.
  • ExxonMobil installed CO analyzers in the flue gas system to detect combustible gases flowing into the ESP.
  • The 2006 PHA, the action item resolution team, and the subsequent PHAs performed in 2009 and 2014 did not consider the scenario of hydrocarbons entering the flue gas piping while the unit was in Safe Park.
  • CO analyzers may not be sufficient to identify all potential flammable gases in flue gas piping leading to an ESP.
  • Hydrocarbons may enter flue gas piping without CO also being present.
  • The inability to detect hydrocarbons in FCC unit flue gas systems may be an industry-wide process safety design weakness.
  • The ESP was constructed in close proximity to settler tanks containing HF.
  • ExxonMobil did not perform a risk analysis of the ESP proposed location relative to the HF settler tanks because the HF settler tanks were more than 50 feet away.

Organizational and Systemic Factors

  • The CSB found that this incident occurred due to weaknesses in the ExxonMobil Torrance refinery's process safety management system.
  • These weaknesses led to operation of the FCC unit without pre-established safe operating limits and criteria for unit shutdown.
  • These weaknesses led to reliance on safeguards that could not be verified.
  • These weaknesses led to the degradation of a safety-critical safeguard.
  • These weaknesses led to the re-use of a previous procedure deviation without a sufficient hazard analysis that confirmed that the assumed process conditions were still valid.
  • ExxonMobil had not developed a procedure that detailed how to safely operate the FCC unit while in Safe Park.
  • ExxonMobil relied on a Variance that had been developed in 2012, without verifying that the safeguards specified in the Variance were sufficient.
  • ExxonMobil management trusted the validity of the Variance procedure without ensuring the safeguards specified were sufficiently robust.
  • ExxonMobil did not conduct a management of change to verify and authorize the technical basis, the implementation time period, and identify any new or affected hazards and associated mitigation strategies.
  • ExxonMobil did not include hourly workers in evaluating the steam flow rate specified in the Variance.
  • ExxonMobil did not include FCC unit operators in the 2012 Variance development process and were not consulted on the day of the incident about the 2,000 pounds per hour steam flow rate specified in the Variance.
  • ExxonMobil did not have a Safe Park procedure that required unit shut down if a safety-critical safeguard was not established.
  • ExxonMobil chose to keep the FCC unit in Safe Park and proceed with working to enter the expander.
  • ExxonMobil believed that completely shutting down the FCC unit was a non-routine, non-steady state operation that could introduce greater hazards to refinery personnel.
  • ExxonMobil personnel were primarily focusing on accessing the expander and restarting the unit.
  • ExxonMobil did not have an operating procedure for operating the FCC unit in its Safe Park mode of operation.
  • ExxonMobil did not schedule its turnaround to accommodate the safe operating life of the safety-critical SCSV.
  • ExxonMobil did not perform a visual inspection after the 4-5 year run length specified in the Equipment Degradation Document.
  • ExxonMobil did not perform a risk evaluation to identify the safety consequences of operating the SCSV for the extended period.
  • ExxonMobil considered only normal operating conditions when identifying consequences of failure.
  • ExxonMobil did not consider all modes of operation, including non-routine operations such as unit standby, when performing process hazard analyses.
  • ExxonMobil did not have a Safe Park procedure that required unit shutdown when a safety-critical safeguard, such as a specific catalyst level above the closed SCSV, was not established.
  • ExxonMobil corporate design practices require ESPs to be shut down when a flammable gas mixture might enter them.
  • ExxonMobil designed the ESP to remain energized during Safe Park in order to comply with environmental regulations requiring removal of catalyst fines from discharge gases released to the atmosphere.

Failed Safeguards or Barrier Breakdowns

  • A level of catalyst accumulated on top of each closed slide valve to form a physical barrier.
  • Sufficient steam flow into reactor, which is used to generate a higher pressure in the reactor than in the main column to prevent hydrocarbons in the main column from backflowing into the reactor.
  • The SCSV did not fully seal.
  • The SCSV could not maintain a protective level of catalyst to isolate the reactor from the regenerator.
  • The reactor pressure was too low to prevent hydrocarbons from backflowing from the main column into the reactor.
  • The catalyst barrier was not established.
  • The steam barrier was the only remaining safeguard preventing hydrocarbons from flowing to the energized ESP.
  • The SCSV testing method did not evaluate whether the valve was eroded, or test whether the SCSV could close and seal.
  • The SCSV could not perform its safety-critical function of preventing air and hydrocarbons from mixing while the FCC unit was in Safe Park.
  • The heat exchanger block valve would not sufficiently close.
  • The flammable atmosphere could not be detected because there was no analyzer for hydrocarbons.
  • The ESP was not shut down when hydrocarbons flowed toward and entered the energized ESP.
  • The ESP remained energized when hydrocarbons entered the flue gas system.
  • The 2012 Variance specified the reactor steam flow rate should not fall below 2,000 pounds per hour, but this was not sufficient to prevent hydrocarbons from entering the regenerator.
  • The 2012 Variance specified the SCSV and RCSV in closed position, but accumulated catalyst on top of the valves was not specified in the Variance.
  • The 2012 Variance was reused in 2015 without verifying that the safeguards specified were sufficient.
  • The maintenance bypass valve could not be used to isolate the expander from the process because it had a hole designed into it for overpressure protection purposes.

Recommendations

  1. 2015-02-I-CA-R1 — Recipient: ExxonMobil Corporation — Status: Not provided — Summary: A Variance to a safety policy or procedure requires robust analysis of the proposed safeguards prior to its approval and implementation. To ensure the proposed methodology described in the Variance is safe and the proposed safeguards are sufficiently robust, revise corporate and U.S. refinery standard(s) to require that a multidisciplinary team reviews the Variance before it is routed to management for their approval. Include knowledgeable personnel on the Variance multidisciplinary team such as: (1) the developer of the Variance; (2) a technical process representative (e.g. process engineer for the applicable unit); (3) an hourly operations representative (e.g. experienced operator in the applicable unit); and (4) a health and safety representative. The role of the multidisciplinary team is to formally meet to review, discuss, and analyze the proposed Variance, and adjust the safety measures as needed to ensure a safe operation. In the event the expert team members do not come to a consensus that the Variance measures can result in a safe operation, require the proposed work to be routed to a higher management level for final approval.
  2. 2015-02-I-CA-R2 — Recipient: ExxonMobil Corporation — Status: Not provided — Summary: At all ExxonMobil U.S. refineries, develop a program to ensure operating procedures are written and available for each mode of operation — such as unit standby — for all ExxonMobil U.S. refinery FCC units. Specify in the program that ExxonMobil U.S. refineries develop and train operators on any new procedure.
  3. 2015-02-I-CA-R3 — Recipient: ExxonMobil Corporation — Status: Not provided — Summary: Require identification of all safety critical equipment and consequence of failure for each mode of operation and ensure safety critical devices can successfully function when needed. Develop and implement a policy that requires all U.S. ExxonMobil refineries to: (1) specify each safety-critical device’s safety function; (2) identify the consequences of failure of each safety-critical device; (3) specify the testing strategy used to verify whether the safety-critical device can function as intended to perform its required safety function; and (4) maintain target availability (e.g. safe operating life) for each safety-critical device through inspection and maintenance. Require that items (1) through (4) above consider each mode of operation, including but not limited to normal operation, start up, shut down, and Safe Park modes of operation.
  4. 2015-02-I-CA-R4 — Recipient: ExxonMobil Corporation — Status: Not provided — Summary: In the event safety-critical equipment is operated beyond its inspection and/or maintenance interval (e.g. extended turnaround interval), require all ExxonMobil U.S. refineries to perform a risk evaluation (e.g. MOC or risk assessment) to identify the safety consequences of the extended operation. Require that each mode of operation, including but not limited to normal operation, start up, shut down, and Safe Park modes of operation is evaluated during the risk evaluation.
  5. 2015-02-I-CA-R5 — Recipient: ExxonMobil Corporation — Status: Not provided — Summary: At all U.S. ExxonMobil refineries, require a siting risk analysis be performed of all electrostatic precipitators and implement appropriate safeguards to minimize the consequences of an electrostatic precipitator explosion.
  6. 2015-02-I-CA-R6 — Recipient: Torrance Refining Company LLC — Status: Not provided — Summary: Implement protective systems that prevent ignition of flammable gases (including hydrocarbons not in the presence of CO) inside of the electrostatic precipitator, for each mode of operation.
  7. 2015-02-I-CA-R7 — Recipient: Torrance Refining Company LLC — Status: Not provided — Summary: Require identification of all safety critical equipment and consequence of failure for each mode of operation and ensure safety-critical devices can successfully function when needed. Develop and implement a policy that requires the Torrance refinery to: (1) specify each safety-critical device’s safety function; (2) identify the consequences of failure of each safety-critical device; (3) specify the testing strategy used to verify whether the safety-critical device can function as intended to perform its required safety function; and (4) maintain target availability (e.g. safe operating life) for each safety-critical device through inspection and maintenance. Require that items (1) through (4) above consider each mode of operation, including but not limited to normal operation, start up, shut down, and Safe Park modes of operation.
  8. 2015-02-I-CA-R8 — Recipient: Torrance Refining Company LLC — Status: Not provided — Summary: In the event safety critical equipment is operated beyond its inspection and/or maintenance interval (e.g. extended turnaround interval), require the Torrance refinery to perform a risk evaluation (e.g. MOC or risk assessment) to identify the safety consequences of the extended operation. Require that each mode of operation, including but not limited to normal operation, start up, shut down, and Safe Park modes of operation is evaluated during the risk evaluation.
  9. 2015-02-I-CA-R9 — Recipient: Torrance Refining Company LLC — Status: Not provided — Summary: At the Torrance refinery, require a siting risk analysis be performed of the FCC unit electrostatic precipitator and implement appropriate safeguards to minimize the consequences of an electrostatic precipitator explosion.
  10. 2015-02-I-CA-R10 — Recipient: American Fuel and Petrochemical Manufacturers — Status: Closed – Acceptable Action — Summary: Facilitate forum(s)—attended by fluid catalytic cracking unit engineers and other relevant personnel from American Fuel and Petrochemical Manufacturers member companies—to discuss the causal factors of the February 18, 2015 ExxonMobil Torrance refinery incident. Encourage participants to share topics such as design, maintenance, and procedural practices that can prevent a similar incident. Create documentation that creates institutional knowledge of the information discussed in the forum(s), and share with the member companies and forum attendees.

Key Engineering Lessons

  • Safe Park or standby operation requires pre-established safe operating limits and explicit shutdown criteria.
  • Safety-critical devices must be evaluated for each mode of operation, including non-routine modes such as Safe Park, start up, and shut down.
  • A control valve used as a safeguard must be verified to perform the required safety function over its actual service life; erosion and leakage can defeat the intended barrier.
  • Steam used as a safeguard must be analyzed to confirm the flow rate is sufficient to maintain the required pressure barrier.
  • Detection systems for flammable gases in FCC flue gas systems should not rely only on carbon monoxide detection if hydrocarbons may be present without CO.
  • If hydrocarbons can enter an energized ESP, protective systems should shut down the ESP or otherwise prevent ignition.
  • Extended operation beyond inspection or maintenance intervals requires a risk evaluation that considers all modes of operation.
  • Siting of electrostatic precipitators near other units and HF-containing equipment requires a risk analysis and appropriate safeguards to minimize consequences of an explosion.

Source Notes

  • Priority 1 final report was used to resolve conflicts and establish the authoritative incident narrative.
  • Priority 3 recommendation status change documents were used to confirm recommendation statuses where available.
  • Priority 4 supporting documents were not used to override final report findings when conflicts existed.
  • Official terminology such as Safe Park, Electrostatic Precipitator (ESP), spent catalyst slide valve (SCSV), and regenerated catalyst slide valve (RCSV) was preserved from the source documents.
  • Some recommendation statuses were not provided in the final report excerpt and remain blank.
  • The incident date and final report release date are taken from the highest-priority source and incident metadata.

Similar Incidents

Incidents sharing the same equipment, root causes, or hazard types.

Same Equipment

Same Root Cause

  • Tesoro Martinez Sulfuric Acid Spill — Shared failure mode: Design Deficiency · Inspection Failure · Maintenance Error · Management Of Change Failure · Operator Error · Procedural Failure
  • TPC Port Neches Explosions and Fire — Shared failure mode: Design Deficiency · Inspection Failure · Maintenance Error · Management Of Change Failure · Procedural Failure
  • Delaware City Refining Company — Shared failure mode: Design Deficiency · Maintenance Error · Management Of Change Failure · Operator Error · Procedural Failure
  • AirGas Facility Fatal Explosion — Shared failure mode: Design Deficiency · Maintenance Error · Management Of Change Failure · Operator Error · Procedural Failure
  • CAI / Arnel Chemical Plant Explosion — Shared failure mode: Design Deficiency · Inspection Failure · Management Of Change Failure · Operator Error · Procedural Failure

Same Hazard

← View in Knowledge Graph