Skip to content

Marathon Martinez Renewable Fuels Fire

Overview

On November 19, 2023, at 12:21 a.m., a metal tube ruptured within a fired heater during the initial startup of a renewable diesel hydroprocessing unit at the Marathon Martinez Renewables facility in Martinez, California. The ruptured tube released renewable diesel and hydrogen, resulting in a fire that seriously injured one Marathon employee. The incident occurred during startup of the unit as a renewable diesel hydroprocessing unit and caused approximately $350 million in property damage.

Incident Snapshot

Field Value
Facility / Company Marathon Martinez Renewables / Marathon Petroleum Corporation
Location Martinez, CA
Incident Date 11/19/2023
Investigation Status The CSB's investigation was approved and released on 3.13.2025
Accident Type Flammable Vapor Investigation Status: The CSB's investigation was approved and released on 3.13.2025 The incident involved a fire event at the Hydrodeoxygenation Unit recycle furnace. One operator sustained serious burn injures as a result of the fire.
Final Report Release Date 03/13/2025

What Happened

  • Startup activities began around November 1, 2023.
  • At some point during the initial startup sequence, both startup hydrogen valves, Valves A and B, were opened.
  • On the morning of November 11, 2023, Marathon Martinez operations personnel began feeding renewable diesel to the fired heater for the first time.
  • Valve A was closed and the Diverter Valve was opened, but Valve B remained open and a portion of the diesel-hydrogen mixture reverse-flowed through the open Valve B and bypassed the heater.
  • Some of the convection section tube metal temperature indicators triggered high-temperature alarms at 790 °F within the first half hour of the routing change and eventually reached approximately 900 °F.
  • Several hours later on November 11, a fire erupted in a different area of the unit, and Marathon Martinez shut down and depressurized the unit.
  • Marathon Martinez resumed startup activities on November 15, approximately four days after the unplanned shutdown.
  • On November 17, Marathon Martinez personnel lit the fired heater and began warming up the unit with hydrogen.
  • On November 17, personnel installed cover plates on six of the fired heater burners that were not in service.
  • On November 18, 2023, at approximately 10:25 p.m., operations personnel attempted to establish normal process flow routings.
  • A board operator opened the Diverter Valve and requested over the radio that a field operator close Valve A.
  • Valve B remained open.
  • At approximately 10:45 p.m. on November 18, during burner lighting activities, the safety instrumented system detected a loss of flame on one of the burners and automatically shut down the heater.
  • Marathon Martinez personnel restarted the heater at approximately 11:15 p.m., and two field operators lit four burners.
  • There was no specific guidance or requirement specifying which burners needed to be lit, and two of the burners that were lit had cover plates blocking their air intakes.
  • At approximately 11:30 p.m., the convection section tube metal temperatures exceeded 790 °F, activating high temperature alarms.
  • The board operators increased diesel flow to the heater, made heater draft adjustments, and lowered the fired heater feed temperature.
  • At 11:45 p.m., tube metal temperatures in the radiant section exceeded 1,100 °F and activated additional high-temperature alarms.
  • By 12:20 a.m. on November 19, 9 of the 13 temperature indicators inside the heater were in alarm.
  • As a final troubleshooting step, Marathon Martinez personnel radioed the field operators to shut down some of the fired heater’s burners.
  • One field operator approached the manual fuel gas valves to burners 5 and 6, located immediately next to the fired heater, and shut down burner 5 and then burner 6.
  • At 12:21 a.m., just after the field operator had shut down the second burner, one of the fired heater’s convection section tubes ruptured.
  • The ruptured tube released renewable diesel and hydrogen into the firebox, the released flammable material ignited, and a fire erupted.
  • Marathon Martinez operations personnel initiated an emergency shutdown within less than one minute of the tube rupture, depressurized the unit, and responded to the fire.
  • The fire was mostly extinguished after about 15 to 20 minutes.

Facility and Process Context

  • The Marathon Martinez Renewables facility is a 50/50 joint venture between Marathon and Neste, operated by a subsidiary of Marathon.
  • The facility began operations in 1913 as a petroleum refinery.
  • Marathon purchased the facility in 2018.
  • Marathon idled the Martinez refinery and transitioned the facility to terminal operation in 2020.
  • In September 2022, Marathon announced its joint venture with Neste to convert the facility from a petroleum refinery to a renewable fuels facility.
  • The newly converted site began production in early 2023.
  • The hydroprocessing unit involved in the incident is subject to Cal/OSHA Process Safety Management of Acutely Hazardous Materials regulation, the EPA Risk Management Program rule, and California’s Accidental Release Prevention (CalARP) Program 3 regulation.
  • The facility is also subject to the Contra Costa County Industrial Safety Ordinance.
  • The incident occurred during the initial startup of a renewable diesel hydroprocessing unit.
  • The HDO process catalytically removes oxygen from the renewable feedstock before it is processed further in downstream units to make renewable diesel.
  • Marathon repurposed equipment from its original diesel hydrotreater unit, reconfigured the process piping, and introduced new equipment to convert the existing unit into the new HDO unit.
  • The HDO unit was designed with a furnace to pre-heat renewable feedstock, recycled renewable diesel, and hydrogen before subsequent processing.

Consequences

  • Fatalities: 0
  • Injuries: 1 serious injury; the field operator suffered third-degree burns to over 80 percent of his body and remained in critical condition for over six months before being transferred to a rehabilitation center.
  • Environmental release: Over 200,000 pounds of renewable diesel and approximately 2,200 pounds of hydrogen were released. No off-site impacts were reported.
  • Facility damage: Approximately $350 million in property damage.
  • Operational impact: The unit involved in the incident was shut down for approximately one year until it was restarted in November 2024.

Key Findings

Immediate Causes

  • The cause of the incident was overheating of the fired heater’s tubes because (1) a misaligned (open) valve diverted a significant amount of process flow away from the fired heater; and (2) two of the four burners were operating with cover plates blocking their air inlets, leading to afterburning in the convection section.
  • Tube temperatures exceeded design metal temperature, decreasing tube strength.
  • Valve misalignment during startup.
  • Reverse flow through startup piping downstream of safety-critical SIS flow meter.
  • Incomplete combustion; afterburning in convection section.

Contributing Factors

  • personnel directed the field operator to conduct troubleshooting actions in close proximity to the fired heater while the heater was in an unsafe condition (had high tube temperatures)
  • Marathon had not established effective Not-to-Exceed limits (safe operating limits) for the fired heater tube temperatures to indicate when the fired heater was in an unsafe condition
  • Marathon Martinez’s failure to identify the potential for the flow diversion that defeated the heater’s safety interlock system
  • inadequate engineering and administrative controls to prevent the valve misalignment
  • Marathon Martinez’s inadequate operating procedures and operator training for safe burner operation
  • inadequate engineering controls for operators to identify combustion issues inside the fired heater
  • Marathon Petroleum Corporation’s inadequate oversight of the Martinez facility’s conformance to company standards
  • No Not-to-Exceed alarms triggered
  • Personnel continued troubleshooting high temperatures
  • Personnel did not recognize dangerous condition
  • Martinez heater alarms not adequate
  • Low process flow to fired heater
  • Burners operating with air intake cover panels
  • No continual combustibles monitoring and alarm
  • Inadequate operating procedures/training
  • Inadequate PHA prompting to identify SIS-defeating piping
  • Inadequate guidance for identifying reverse flow that could defeat SIS
  • Procedure did not match field labeling
  • No valve alignment verification before second startup
  • Ineffective flame detection and burner flameout protection
  • Insufficient industry guidance for detecting and preventing afterburning
  • Inadequate Walk the Line practices
  • Inadequate oversight of Martinez facility
  • Insufficient company guidance for detecting and preventing afterburning
  • poor combustion conditions

Organizational and Systemic Factors

  • Marathon did not adequately ensure that the Martinez facility met the company's minimum safety expectations before it started up as a renewable diesel facility.
  • The Martinez facility lagged behind in conforming to Marathon’s corporate standards, leading to deficiencies in local policies and their implementation.
  • Marathon did not adequately ensure that its Martinez facility conformed to internal corporate standards after 2019.
  • Marathon did not reinstate the refinery-specific gap assessment project for the facility when it began project work to resume operation as a refinery in 2021.
  • Some site policies had not been updated since the facility ceased operations as a petroleum refinery, and some still referenced Tesoro corporate standards that were no longer in effect.
  • Portions of the site policies at the Marathon Martinez facility were not being followed because personnel believed the existing policies to be outdated.
  • Fired heater did not conform to Marathon corporate standards
  • Inadequate guidance for heater tube safe operating limits and proper response
  • Insufficient industry guidance for heater tube safe operating limits and proper response
  • Individual site survey post-2018 Detroit incident did not identify scenario
  • Inadequate guidance for identifying reverse flow that could defeat fired heater low flow SIS
  • Insufficient industry guidance for identifying reverse flow that could defeat fired heater low flow SIS
  • corporate oversight
  • Marathon Petroleum Corporation’s “Process Heater Not-to-Exceed (NTE) Limits and Alarms” standard
  • Marathon Petroleum Corporation’s “Heater Application Standard”
  • Marathon Petroleum Corporation policies
  • AFPM Safety Portal
  • Marathon Petroleum Corporation’s refining reference document titled Operations Excellence

Failed Safeguards or Barrier Breakdowns

  • The safety instrumented system’s flow meter did not detect the low flow to the fired heater because the process material was diverted through piping that was downstream of the flow meter.
  • There was no control system data available to alert the board operators of the flow diversion or the combustion conditions that led to afterburning.
  • There was insufficient flame detection and combustibles monitoring capability to detect afterburning conditions inside the heater.
  • Neither of the startup valves was equipped with a position indicator that could be monitored from the control room screen.
  • Neither Valve A nor Valve B was equipped with position indicators that the board operators could see on the control room display to confirm their alignment.
  • The startup procedure did not clearly indicate which startup piping valve was to be opened.
  • The operating procedure did not require the operators to remove the cover plates when lighting the burners.
  • The operating procedures and operator training did not provide requirements for lighting specific burners.
  • The fired heater was equipped with flame detectors on 4 of the 11 burners, but only one of the four operating burners had a flame detector at the time of the incident.
  • The combustibles analyzer readings were only available at a local panel next to the heater and were not available to board operators in the control room.
  • The combustibles data was not recorded and therefore was not available for review post-incident.
  • The heater outlet temperature was used as a Not-to-Exceed limit for detecting loss of flow through each individual heater pass, which was described as directly counter to guidance from API RP 556.
  • Marathon had not established Not-to-Exceed limits for the fired heater tube metal temperatures.
  • safety instrumented system (SIS) to protect against low flow through the heater tubes
  • low-flow condition was not detected because the bypass line was installed downstream of the SIS flow meter
  • high heater outlet temperature alarm on the temperature indicators upstream of the bypass was not received
  • Multiple high skin-temperature alarms were not identified as a critical situation by the console operator
  • No continual combustibles monitoring and alarm
  • Ineffective flame detection and burner flameout protection
  • audio and visual high temperature alarms at 1,100 °F on computer control system screens inside the control room
  • safety interlocks existed to automatically shut down the furnace during low renewable diesel flow to the furnace and high temperatures downstream of the furnace
  • the interlocks did not activate

Recommendations

  1. 2024-01-I-CA-R1 | Recipient: Marathon Martinez Renewables | Status: Closed – Acceptable Action | Implement engineering safeguards to detect and prevent afterburning in the fired heater involved in the November 19, 2023, incident. The safeguards may include the use of instrumentation such as combustibles measurements, flame detectors, and/or thermocouples that measure tube metal, flue gas, and process fluid temperatures. The safeguards shall be capable of being monitored from the control room.
  2. 2024-01-I-CA-R2 | Recipient: Marathon Martinez Renewables | Status: Open – Acceptable Response or Alternate Response | For the fired heater involved in the incident, after Marathon Petroleum Corporation’s “Process Heater Not-to-Exceed (NTE) Limits and Alarms” standard is updated according to 2024-01-I-CA-R5, implement tube metal temperature alarming consistent with corporate guidance to alert operators when safe operating limits are exceeded and to specify predetermined response actions, such as shutting down the fired heater remotely. The predetermined response actions must include actions that specify when to stop troubleshooting and remove personnel from the vicinity of the fired heater.
  3. 2024-01-I-CA-R3 | Recipient: Marathon Martinez Renewables | Status: Open – Acceptable Response or Alternate Response | Implement changes to improve Walk the Line performance at the Martinez facility by ensuring that the facility’s practices are consistent with tools in the AFPM Safety Portal and guidance in Marathon Petroleum Corporation’s refining reference document titled Operations Excellence. At a minimum: (a) Require that operator field walkdowns ensure that valves are correctly aligned before all unit startup activities from planned or unplanned shutdowns, such as those due to non-normal operations, emergencies, turnarounds, and major maintenance; (b) Improve policies and practices for communications among and between shifts to ensure that operators understand abnormal line-ups in their units; and (c) Reinforce Walk the Line concepts, including the expectation for only trained operators to control valve line-ups at their units, through training for all levels of management in the Operations department.
  4. 2024-01-I-CA-R4 | Recipient: Marathon Martinez Renewables | Status: Open – Acceptable Response or Alternate Response | Complete a comprehensive gap assessment of the Martinez facility against Marathon Petroleum Corporation policies. At a minimum, address the following policies: Operating Limits; Process Hazard Analysis; and PSM/RMP Refining Operating Procedures. Develop and implement action items to effectively address findings from the assessment.
  5. 2024-01-I-CA-R5 | Recipient: Marathon Petroleum Corporation | Status: Open – Acceptable Response or Alternate Response | Update the corporate “Process Heater Not-to-Exceed (NTE) Limits and Alarms” standard with tube metal temperature alarming guidance to alert operators when safe operating limits are exceeded and to specify predetermined response actions, such as shutting down the fired heater remotely. The predetermined response actions must include actions that specify when to stop troubleshooting and remove personnel from the vicinity of the fired heater.
  6. 2024-01-I-CA-R6 | Recipient: Marathon Petroleum Corporation | Status: Open – Acceptable Response or Alternate Response | Update the corporate “Heater Application Standard” with the following requirements: (a) Requirements for protecting fired heaters from low process flow where process piping diverges downstream of a flow meter. Requirements may include achieving proof of flow to the heater through valve position indicators and interlocks on branch connections downstream of flow meters to prevent backflow, reverse flow, or other diverted flow scenarios that could defeat the safety instrumented system; and (b) Engineering safeguard requirements to detect and prevent afterburning in fired heaters. The safeguards may include the use of instrumentation such as combustibles measurements, flame detectors, and/or thermocouples that measure tube metal, flue gas, and process fluid temperatures. The safeguards shall be capable of being monitored from the control room.
  7. 2024-01-I-CA-R7 | Recipient: Marathon Martinez Renewables | Status: Open – Acceptable Response or Alternate Response | Confirm the results of the Martinez facility’s comprehensive gap assessment required in 2024-01-I-CA-R4. Upon completion, conduct an Operations Excellence full assessment on the Martinez facility. Develop and implement action items to effectively address findings from the assessment.
  8. 2024-01-I-CA-R8 | Recipient: American Petroleum Institute (API) | Status: Open – Awaiting Response or Evaluation/Approval of Response | Revise API RP 556 Instrumentation, Control, and Protective Systems for Gas Fired Heaters, or successor API products, with requirements for proper response to high tube metal temperatures, design requirements for protecting fired heaters from low process flow where process piping diverges downstream of a flow meter, and engineering safeguard requirements to detect and prevent afterburning in fired heaters, with monitoring capability from the control room.

Key Engineering Lessons

  • Low-flow protection for fired heaters can be defeated when process piping diverges downstream of a flow meter; proof of flow and branch-line interlocks are needed to prevent backflow, reverse flow, or other diverted flow scenarios.
  • Tube metal temperature alarming should be based on safe operating limits and paired with predetermined response actions, including stopping troubleshooting and removing personnel from the vicinity of the fired heater.
  • Afterburning in fired heaters may require dedicated engineering safeguards such as combustibles measurements, flame detectors, and thermocouples measuring tube metal, flue gas, and process fluid temperatures, with monitoring available in the control room.
  • Control room operators need direct visibility of critical valve positions, burner status, and combustion indicators to recognize abnormal conditions before tube overheating occurs.
  • Operating procedures, field walkdowns, and shift communications must ensure correct valve alignment before startup and clear burner-lighting requirements, especially after planned or unplanned shutdowns.
  • Corporate standards and site procedures must be kept current and aligned so that local practices do not drift from company safety expectations.

Source Notes

  • Priority 1 final report was used as the primary authority for incident facts, causal findings, safeguards, and recommendations.
  • Priority 2 supporting investigation update was used only where it added detail consistent with the final report.
  • Priority 3 recommendation status summaries were used for recommendation status updates and wording of recommendation text.
  • Where source documents used different equipment names for the same unit, the final report terminology was preserved where possible and the supporting document terminology was retained in context when explicitly stated.
  • No external facts were added; fields were consolidated only from the provided extracts.

Similar Incidents

Incidents sharing the same equipment, root causes, or hazard types.

Same Equipment

Same Root Cause

Same Hazard

← View in Knowledge Graph