Skip to content

Tesoro Anacortes Refinery Fatal Explosion and Fire

Overview

On April 2, 2010, the Tesoro Anacortes refinery in Anacortes, Washington experienced a catastrophic rupture of the in-service E heat exchanger in the Catalytic Reformer / Naphtha Hydrotreater unit. The rupture was caused by High Temperature Hydrogen Attack (HTHA). Highly flammable hydrogen and naphtha were released, ignited, and led to an explosion and intense fire. Seven Tesoro operations personnel were fatally injured.

Incident Snapshot

Field Value
Facility / Company Tesoro Refining and Marketing Company LLC
Location Anacortes, WA
Incident Date 2010-04-02
Investigation Status The CSB's final report was approved 3-0 at a public meeting on May 1, 2014.
Accident Type Oil and Refining - Fire and Explosion
Final Report Release Date 2014-05-01

What Happened

  • On March 28, 2010, the A/B/C heat exchanger bank was taken offline for cleaning of fouled tubes.
  • On March 31, 2010, the maintenance cleaning activity was completed and the equipment was reassembled and prepared for operation.
  • On the evening of April 1, 2010, Tesoro initiated startup of the A/B/C heat exchanger bank.
  • At approximately 10:30 p.m., six additional Tesoro employees joined the outside operator, at the request of the supervisor, to assist in bringing the A/B/C heat exchanger bank online.
  • Two leaks from the heat exchangers were reported during the startup.
  • At 12:30 a.m. on April 2, 2010, while startup operations were still underway, the E heat exchanger on the adjacent in-service bank catastrophically ruptured.
  • Highly flammable hydrogen and naphtha were released and likely autoignited, creating a large fireball and intense fire.
  • All seven outside operations personnel were badly burned and died within 22 days of the incident.

Facility and Process Context

  • Tesoro Anacortes refinery petroleum refinery
  • Catalytic Reformer / Naphtha Hydrotreater unit (NHT unit)
  • Two parallel banks of three heat exchangers (A/B/C and D/E/F)
  • Startup, shutdown, and cleaning activities were hazardous nonroutine operations
  • Heat exchangers fouled during operation and required periodic cleaning to maintain process temperature requirements

Consequences

  • Fatalities: 7
  • Injuries: All seven outside operations personnel were badly burned.
  • Environmental release: Highly flammable hydrogen and naphtha were released from the ruptured heat exchanger.
  • Facility damage: The E heat exchanger catastrophically ruptured; the fire engulfed the entire heat exchanger structure.
  • Operational impact: The intense fire burned for more than three hours and resulted in a seven month shutdown.

Key Findings

Immediate Causes

  • The E heat exchanger catastrophically ruptured because of High Temperature Hydrogen Attack (HTHA).
  • The pressure-containing shell of the heat exchanger separated at weld seams.
  • The explosion and fire resulted from the sudden catastrophic rupture of the E heat exchanger, releasing flammable material that ignited likely because it was above its autoignition temperature.

Contributing Factors

  • HTHA can accumulate in high-stress areas in carbon steel, such as non-post-weld heat-treated welds.
  • The welds of the B and E carbon steel heat exchangers were not post-weld heat-treated.
  • The high stress areas near the welds of these heat exchangers were found to contain HTHA damage.
  • The B and E heat exchangers were constructed with the same materials and operated under the same conditions.
  • The startup of the NHT heat exchangers was hazardous nonroutine work.
  • Leaks routinely developed that presented hazards to workers conducting the startup activities.
  • Tesoro procedures did not prohibit or effectively limit the use of additional personnel during the nonroutine hazardous startup of the NHT heat exchangers.
  • The heat exchanger startup procedure specifies the use of only one outside operator to perform startup operations of the NHT heat exchanger banks.
  • The NHT heat exchangers frequently leaked flammable hydrocarbons during startup, sometimes resulting in fires.
  • Tesoro management had been complacent about these hazardous leaks and did not always investigate the cause of the leaks.
  • The NHT heat exchanger banks were designed with large, difficult-to-manipulate manual block valves on different levels of the NHT heat exchanger structure.
  • These valves were used to start up the NHT heat exchanger banks and typically required numerous adjustments to maintain temperature specifications.
  • The difficulties with valve operation during startup typically resulted in the need for additional operator assistance.
  • Refinery management had normalized the occurrences of hazardous conditions, including frequent leaks from the NHT heat exchangers, by using steam to mitigate leaks.
  • Tesoro did not monitor actual operating conditions of the B and E heat exchangers within the NHT heat exchanger banks, even though it would have been technically feasible to do so.
  • Tesoro was not aware that the hottest section of the B and E heat exchangers (Can 4) at times likely operated above the carbon steel Nelson curve.
  • No temperature measurements were made between the heat exchangers.
  • The operating temperature was unknown at the B and E heat exchangers, specifically as it increased significantly from heat exchanger fouling.
  • The heat exchangers were in service for 38 years and were constructed of carbon steel, a material that is highly vulnerable to HTHA damage.
  • The report states that the corrosion experts had concluded HTHA was not a credible damage mechanism in these heat exchangers based on reliance on the carbon steel Nelson curve and a lack of knowledge of the actual operating conditions of the NHT heat exchangers.
  • Design operating data were used in lieu of obtaining actual measurements or performing a technical evaluation such as a process simulation to estimate needed process data.
  • The PHA used inspection as a safeguard to mitigate HTHA consequences on the tube side.
  • No inspection for HTHA was ever conducted on the B or E heat exchangers.
  • The PHA analysis concluded that the worst consequence resulting from a loss of primary containment (catastrophic failure of the E heat exchanger) was a disabling injury and substantially understated the actual consequence of seven worker fatalities.
  • The combination of understating the consequence and overstating the safeguards resulted in underestimating the risk of a catastrophic failure of the E heat exchanger.

Organizational and Systemic Factors

  • Process Hazard Analyses (PHAs) at the refinery repeatedly failed to ensure that these hazards were controlled and that the number of workers exposed to these hazards was minimized.
  • The 1996 Shell Oil NHT unit PHA simply cited ineffective, non-specific, judgment-based, qualitative safeguards to prevent equipment failure from HTHA.
  • The effectiveness of these safeguards was neither evaluated nor documented; instead the PHA merely listed general safeguards.
  • The 2001 and 2006 Tesoro PHA revalidations did not address or modify the analysis performed in the 1996 Shell Oil PHA.
  • The Tesoro 2010 NHT unit PHA failed to identify HTHA as a hazard for the shell of the B and E heat exchangers.
  • For the 15 years before the April 2010 incident, assumptions used by PHA teams at the Anacortes refinery contributed to ineffective safeguards, ineffective hazard identification, and ineffective control of hazards to prevent equipment failures from HTHA damage.
  • Shell Oil completed a PHA in 1995 related to process modifications that could increase the hydrogen partial pressure in the NHT heat exchangers; however, when managing this change no consideration, evaluation, or recommendations were made to address the potential for HTHA damage to the NHT heat exchangers.
  • Shell Oil and Tesoro periodically performed damage mechanism hazard reviews (DMHRs), called corrosion reviews; however, these reviews did not identify HTHA as a credible failure mechanism for the B and E heat exchangers.
  • These reviews were weakened by primarily relying on design operating parameters for these heat exchangers rather than data from actual process operating conditions.
  • The 2006 Tesoro NHT unit PHA discontinued a review of its corrosion control program and a specific mechanical integrity checklist associated with the corrosion program after concluding that they were "not a legal requirement."
  • Tesoro routinely relied on additional staff members during NHT heat exchanger startups but never assessed the risks or made any attempts to control them.
  • Tesoro did not conduct an MOC to consider the risks of these organizational changes, despite its policy that required the performance of such a risk assessment.
  • The practices of the Tesoro Anacortes Refinery included the use of excessive number of personnel to participate in hazardous activities, the lack of verification of actual process conditions, normalization of hazardous leaks of the NHT heat exchangers, and PHA assumptions that contributed to ineffective hazard evaluation of major hazards.
  • The existing regulatory approach for onshore petroleum refineries in Washington relies on a framework that is primarily activity-based without a risk reduction target.
  • The existing regulatory approach does not effectively involve the workforce in hazard analysis and prevention of major accidents.
  • The existing regulatory approach does not employ a sufficient number of staff members with the technical expertise needed to provide sufficient oversight of petroleum refineries.
  • Washington L&I has only four PSM specialists to regulate nearly 270 PSM-covered facilities, including five petroleum refineries.
  • None of the DOSH NEP team members had an engineering or metallurgy background, and the team as a whole had limited experience with PSM and with refinery operations.
  • The NEP inspection lacked the level of detail required to detect the technical deficiencies in the Tesoro refinery’s mechanical integrity program.
  • The state of Washington did not have sufficient personnel resources with the required technical knowledge and experience to seek out and oversee the highly technical area of failure mechanisms.
  • The PSM and RMP regulations do not require companies to reduce risks to ALARP.
  • There is no requirement to submit PHAs to the regulator, and the regulator is not responsible for assessing the quality of the PHA or the proposed safeguards.
  • Neither Washington nor California requires the use of inherently safer design to the greatest extent practicable.

Failed Safeguards or Barrier Breakdowns

  • inspection program
  • unit monitoring
  • procedures
  • practices
  • limits on key and critical variables for temperature (based on the Nelson curve)
  • post-weld heat treating
  • steam suppression to mitigate leaks
  • steam lances
  • Management of Change (MOC) review
  • damage mechanism hazard reviews (DMHRs)
  • Process Hazard Analyses (PHAs)
  • pressure relief valve
  • The PHA failed to identify significant hazards associated with the immediate causes of the incident, including damage mechanisms such as HTHA.
  • The PHA failed to address HTHA damage in the B or E heat exchangers on the shell-side.
  • The PHA used inspection as a safeguard to mitigate HTHA consequences on the tube side.
  • No inspection for HTHA was ever conducted on the B or E heat exchangers.
  • API RP 941 does not establish minimum requirements to prevent HTHA failures.
  • API RP 581 does not require verification of actual operating conditions when identifying applicable damage mechanisms.
  • The NEP inspection found no citable deficiencies for the nine pressure vessels reviewed, including the E heat exchanger, and did not identify HTHA issues.

Recommendations

  1. 2010-08-I-WA-R1 | Recipient: The U.S. Environmental Protection Agency | Status: Closed – Acceptable Alternative Action | Summary: Revise the Chemical Accident Prevention Provisions under 40 CFR Part 68 to require the documented use of inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible when facilities are establishing safeguards for identified process hazards. The goal shall be to reduce the risk of major accidents to the greatest extent practicable, to be interpreted as equivalent to as low as reasonably practicable (ALARP). Include requirements for inherently safer systems analysis to be automatically triggered for all management of change, incident investigation, and process hazard analysis reviews and recommendations, prior to the construction of a new process, process unit rebuilds, significant process repairs, and in the development of corrective actions.
  2. 2010-08-I-WA-R2 | Recipient: The U.S. Environmental Protection Agency | Status: Closed – No Longer Applicable | Summary: Until Recommendation 2010-08-I-WA-R1 is in effect, enforce through the Clean Air Act’s General Duty Clause, section 112(r)(1), 42 U.S.C. §7412(r)(1) the use of inherently safer systems analysis and the hierarchy of controls to the greatest extent feasible when facilities are establishing safeguards for identified process hazards.
  3. 2010-08-I-WA-R3 | Recipient: The U.S. Environmental Protection Agency | Status: | Summary: Develop guidance for the required use of inherently safer systems analysis and the hierarchy of controls for enforcement under 40 CFR Part 68 and the Clean Air Act’s General Duty Clause, section 112(r)(1), 42 U.S.C. §7412(r)(1).
  4. 2010-08-I-WA-R4 | Recipient: Washington State Legislature, Governor of Washington | Status: Closed – Reconsidered/Superseded | Summary: Implement a process safety culture continuous improvement program at the Tesoro Anacortes Refinery including a written procedure for periodic process safety culture surveys across the work force. The process safety culture program shall be overseen by a tripartite committee of Tesoro management, USW representatives, Washington State Department of Labor and Industries Division of Occupational Safety and Health, and the U.S. Environmental Protection Agency.
  5. 2010-08-I-WA-R5 | Recipient: Washington State Legislature, Governor of Washington | Status: Closed – Acceptable Alternative Action | Summary: Based on the findings in this report, augment your existing process safety management regulations for petroleum refineries in the state of Washington with more rigorous goal-setting attributes including a comprehensive process hazard analysis, a thorough review by technically competent regulatory personnel, required preventative audits and preventative inspections by the regulator, minimum requirements in safety codes and standards, an increased role for workers, and reporting of information to the public to the greatest extent feasible.
  6. 2010-08-I-WA-R6 | Recipient: Washington State Legislature, Governor of Washington | Status: Open – Acceptable Response or Alternative Response | Summary: Establish a well-funded, well-staffed, technically qualified regulator with a compensation system to ensure the Washington Department of Labor and Industries regulator has the ability to attract and retain a sufficient number of employees with the necessary skills and experience to ensure regulator technical qualifications. Periodically conduct a market analysis and benchmarking review to ensure the compensation system remains competitive with Washington petroleum refineries.
  7. 2010-08-I-WA-R7 | Recipient: Governor and Legislature of the State of Washington | Status: Open - Awaiting Response or Evaluation/Approval of Response | Summary: Work with the regulator, the petroleum refining industry, labor, and other relevant stakeholders in the state of Washington to develop and implement a system that collects, tracks, and analyzes process safety leading and lagging indicators from operators and contractors to promote continuous process safety improvements.
  8. 2010-08-I-WA-R8 | Recipient: Washington State Department of Labor and Industries | Status: Open – Acceptable Response or Alternate Response | Summary: Perform a verification audit at all Washington petroleum refineries to ensure prevention of HTHA equipment failure and safe operation of the equipment, written hazard evaluation for nonroutine work, and effective programs to control the number of essential personnel present during all hazardous nonroutine work.
  9. 2010-08-I-WA-R10 | Recipient: American Petroleum Institute | Status: Closed – Unacceptable Action | Summary: Revise American Petroleum Institute API RP 941: Steels for Hydrogen Service at Elevated Temperatures and Pressures in Petroleum Refineries and Petrochemical Plants to clearly establish the minimum necessary “shall” requirements to prevent HTHA equipment failures using a format such as that used in ANSI/AIHA Z10-2012, require the use of inherently safer materials to the greatest extent feasible, require verification of actual operating conditions to confirm that material of construction selection prevents HTHA equipment failure, and prohibit the use of carbon steel in processes that operate above 400 ºF and greater than 50 psia hydrogen partial pressure.
  10. 2010-08-I-WA-R11 | Recipient: American Petroleum Institute | Status: Closed – Unacceptable Action | Summary: Revise American Petroleum Institute API RP 581: Risk-Based Inspection Technology to clearly establish the minimum necessary “shall” requirements to prevent HTHA equipment failures, prohibit the use of carbon steel in processes that operate above 400 ºF and greater than 50 psia hydrogen partial pressure, and require verification of actual operating conditions to determine potential equipment damage mechanisms.
  11. 2010-08-I-WA-R12 | Recipient: Tesoro Refining & Marketing Company LLC | Status: Closed – Acceptable Action | Summary: Actively participate with API in the completion of recommendation 2010-08-I-WA-R10. Document this participation.
  12. 2010-08-I-WA-R13 | Recipient: Tesoro Refining & Marketing Company LLC | Status: Closed – No Longer Applicable | Summary: Once recommendation 2010-08-I-WA-R10 is in effect, develop and implement a plan to meet the requirements established through the acceptable completion of recommendation 2010-08-I-WA-R10. Document the implementation of the plan and the corrective actions taken.
  13. 2010-08-I-WA-R14 | Recipient: Marathon Petroleum Corporation, formerly Tesoro Refining & Marketing Company LLC | Status: Closed – Acceptable Action | Summary: Revise and improve the Process Hazard Analysis (PHA), the Integrity Operating Window (IOW), and the damage mechanism hazard review (DMHR) programs and cross-linking among these three programs such that all identified hazards are effectively managed in each program.
  14. 2010-08-I-WA-R15 | Recipient: Tesoro Anacortes Refinery | Status: Closed – Acceptable Alternative Action | Summary: Implement a process safety culture continuous improvement program at the Tesoro Anacortes Refinery including a written procedure for periodic process safety culture surveys across the work force. The process safety culture program shall be overseen by a tripartite committee of Tesoro management, USW representatives, Washington State Department of Labor and Industries Division of Occupational Safety and Health, and the U.S. Environmental Protection Agency.
  15. 2010-08-I-WA-R16 | Recipient: United Steelworkers Local 12-591 | Status: Closed – Acceptable Action | Summary: Effectively participate in the Tesoro Anacortes Refinery process safety culture survey oversight committee as recommended under recommendation 2010-08-I-WA-R15.

Key Engineering Lessons

  • HTHA can occur in carbon steel equipment even where the carbon steel Nelson curve suggests safe operation; the curve is not reliable as a sole basis for prevention.
  • Actual operating conditions should be verified rather than inferred from design data when evaluating HTHA susceptibility.
  • Inspection and post-weld heat treating are not sufficient as primary safeguards for HTHA prevention.
  • Inherently safer materials and inherently safer design are the preferred approach to prevent HTHA.
  • Hazardous nonroutine startup work requires strict control of staffing, procedures, and exposure of personnel.
  • Process Hazard Analyses, damage mechanism hazard reviews, and management of change must be coordinated and based on actual process conditions.
  • Mechanical integrity programs must be capable of identifying damage mechanisms in aging equipment and should not rely on permissive standards without minimum requirements.

Source Notes

  • Final report (source_priority 1) used as primary authority for incident cause, sequence, and findings.
  • Recommendation status change summaries (source_priority 3) used to populate recommendation statuses and later regulatory outcomes.
  • Supporting documents (source_priority 4) were used only where they provided explicit facts consistent with the final report.
  • Where documents conflicted, higher-priority final report language was preferred.
  • Official terminology such as High Temperature Hydrogen Attack (HTHA), Process Hazard Analysis (PHA), Damage Mechanism Hazard Review (DMHR), Integrity Operating Window (IOW), and Management of Change (MOC) was preserved.

Similar Incidents

Incidents sharing the same equipment, root causes, or hazard types.

Same Equipment

Same Root Cause

Same Hazard

← View in Knowledge Graph