Skip to content

Tosco Avon Refinery Petroleum Naphtha Fire

Overview

On February 23, 1999, a fire occurred in the crude unit at Tosco Corporation's Avon oil refinery in Martinez, California. Workers were attempting to replace piping attached to a 150-foot-tall fractionator tower while the process unit was in operation. During removal of the piping, naphtha was released onto the hot fractionator and ignited. The flames engulfed five workers located at different heights on the tower. Four workers were killed and one sustained serious injuries.

Incident Snapshot

Field Value
Facility / Company Tosco Corporation
Location Martinez, CA
Incident Date 02/23/1999
Investigation Status The final report on this investigation was approved March 21, 2001.
Accident Type Oil and Refining - Fire and Explosion
Final Report Release Date 03/21/2001

What Happened

  • On February 10, 1999, a pinhole leak was discovered in the crude unit on the inside of the top elbow of the naphtha piping, near where it was attached to the fractionator at 112 feet above grade.
  • Tosco personnel responded immediately, closing four valves in an attempt to isolate the piping. The unit remained in operation.
  • Subsequent inspection of the naphtha piping showed that it was extensively thinned and corroded.
  • A decision was made to replace a large section of the naphtha line.
  • Over the 13 days between the discovery of the leak and the fire, workers made numerous unsuccessful attempts to isolate and drain the naphtha piping.
  • The pinhole leak reoccurred three times, and the isolation valves were retightened in unsuccessful efforts to isolate the piping.
  • On the day of the incident, the piping contained approximately 90 gallons of naphtha, which was being pressurized from the running process unit through a leaking isolation valve.
  • A work permit authorized maintenance employees to drain and remove the piping.
  • After several unsuccessful attempts to drain the line, a Tosco maintenance supervisor directed workers to make two cuts into the piping using a pneumatic saw.
  • After a second cut began to leak naphtha, the supervisor directed the workers to open a flange to drain the line.
  • As the line was being drained, naphtha was suddenly released from the open end of the piping that had been cut first.
  • The naphtha ignited, most likely from contacting the nearby hot surfaces of the fractionator, and quickly engulfed the tower structure and personnel.
  • Operators heard the naphtha ignite, used fire monitors to direct a stream of water onto the fire, and began an emergency shutdown of the unit.
  • Within minutes, the Tosco emergency response team was on scene and began firefighting efforts.
  • The Contra Costa Fire and Consolidated Fire Departments responded and were positioned to provide support if requested.
  • The fire burned for about 20 minutes.
  • Rescue efforts were delayed because of the size of the fire, the risk of re-ignition, and the location of most of the victims on the tower.
  • One worker was pronounced dead at the scene, and the other three victims died at the hospital.
  • The fifth worker jumped away from the flames at an elevated location and sustained serious injuries.

Facility and Process Context

  • Tosco Corporation operated the Avon facility from 1976-2000, when it was purchased by Ultramar Diamond Shamrock (UDS) and renamed the Golden Eagle refinery.
  • The Avon refinery is located on a 2,300-acre site near the town of Martinez in Contra Costa County, California.
  • The refinery has been in operation for more than 80 years; its main products are motor fuels such as gasoline and diesel.
  • The crude unit, or 50 Unit, was originally designed and built in 1946, and had undergone several major capital improvements.
  • The Avon facility refined crude oil into motor fuels; other products included propane, butane, and fuel oils.
  • At the Avon refinery, naphtha was removed from a tray near the top of the fractionator (112-foot level) into 6-inch steel piping.
  • The naphtha flowed through the piping and a level control valve, and then into the naphtha stripper.
  • In prior years, the stripper had been used to remove lighter hydrocarbons from the naphtha.
  • This practice had been discontinued at the time of the February 23 incident.
  • However, the vapor return line remained in place.
  • The lower half of a crude oil fractionator operates at temperatures of 500 to 650°F.
  • The fractionator was a 150-foot distillation tower designed to heat and separate components of crude oil.
  • The fractionator continued to operate, with large volumes of flammable vapor and liquid flowing inside the tower and its attached piping.
  • The surface temperature of the equipment was over 500°F.
  • Crude oil fractionation is the first step in the oil refining process.
  • A fractionator is a vessel that separates heated crude oil into components, such as natural gasoline, naphtha, kerosene and diesel.
  • Inside the vessel, trays are used to collect the different fractions as liquids.
  • Pipes connected to each tray withdraw the liquids to storage or other processes.
  • Processing is continuous.

Consequences

  • Fatalities: 4
  • Injuries: 1 critically injured; also described as one seriously injured
  • Operational impact: The fire burned for about 20 minutes. The unit began an emergency shutdown. Rescue efforts were delayed because of the size of the fire, the risk of re-ignition, and the location of most of the victims on the tower.

Key Findings

Immediate Causes

  • During removal of the piping, naphtha was released onto the hot fractionator and ignited.
  • The naphtha contacted the hot fractionator and ignited, quickly engulfing the tower structure and personnel.
  • The sudden release of liquid from the open piping at approximately 12:18 pm resulted in the fire.

Contributing Factors

  • The naphtha stripper level control bypass valve was leaking, which prevented isolation of the line from the operating process unit.
  • The running unit pressurized the naphtha piping.
  • Excessive levels of corrosive material and water in the naphtha line and operation of the bypass valve in the partially open position for prolonged periods led to erosion/corrosion of the valve seat and disk.
  • Excessive levels of corrosives and water also produced plugging in the piping and led to the initial leak.
  • Tosco’s job planning procedures did not require a formal evaluation of the hazards of replacing the naphtha piping.
  • The pipe repair work was classified as low risk maintenance.
  • Despite serious hazards caused by the inability to drain and isolate the line, the low risk classification was not reevaluated, nor did management formulate a plan to control the known hazards.
  • Tosco’s permit for the hazardous nonroutine work was authorized solely by a unit operator on the day of the incident.
  • Operations supervisors were not involved in inspecting the job site or reviewing the permit.
  • Operations supervisors and refinery safety personnel were seldom present in the unit to oversee work activities.
  • Neither Tosco’s corporate safety group nor Avon facility management conducted documented audits of the refinery’s line breaking, lockout/tagout, or blinding procedures and practices in the 3 years prior to the incident.
  • Tosco did not perform a management of change review to examine potential hazards related to process changes, including operating the crude desalter beyond its design parameters, excessive water in the crude feedstock, and prolonged operation of the bypass valve in the partially open position.
  • Corrective actions were not implemented in time to prevent plugging and excessive corrosion in the naphtha piping.
  • The crude unit corrosion control program was inadequate.
  • The crude mix was changing as input to the refinery and was increasingly sour.
  • The crude mix frequently exceeded the design limits for the 50 Unit.
  • The desalter was operated with a crude mix it wasn't designed for at a flow rate that exceeded its design flow rate, up to 150 percent.
  • The impurities contributed to accelerated corrosion in the pipe wall of the naphtha draw line.
  • The impurities contributed to deposition of solid materials in the lower levels of the pipe.
  • The solids and gunk blocked the control valve.
  • The bypass valve is not designed to be operated full time and its internals were eroded by the flow.
  • The bypass valve would not isolate.
  • There was no formal decision-making protocol to help decide whether to shut down the unit.
  • There was no formal process for how to make those decisions.
  • The work was considered routine by some and high hazard by others.
  • The work was taking place at elevated platforms high above the ground level, with very limited means of egress.
  • There were multiple sources of ignition on the tower.
  • The vacuum truck was located within about 30 feet of the base of the tower.
  • There was no vent valve at the top of the naphtha draw line to fully vent to drain and steam the line.
  • The line could not easily be purged of hydrocarbons prior to cutting it.
  • The job involved moving heavy pieces of pipe using a crane in close proximity to an operating unit.
  • The operating crews had multiple indications that there was something not working the way it should have been working.
  • The leaks appeared to come and go.
  • The information may not have been effectively communicated between crews or with members of supervision and management beyond the operating crews.
  • Operators and maintenance responsibilities were unclear.
  • There were two operating organizations exerting both authority and responsibility on this unit.
  • The shift supervisors never got involved in this job.
  • The job may have been influenced by pressure from the crane crew, vacuum truck, and scaffolding workers already on site.
  • The benzene-containing stream did not have the permit/signoff process that would have been required for a benzene stream.
  • The bleeder valve was very lightly plugged and could have been easily cleared and used to do draining and testing prior to the incident, and it was not used.
  • Control of ignition sources in the area was not done.
  • Safety personnel were not involved in the review and approval of the naphtha draw line replacement.
  • The work permit system did not require the involvement of safety personnel at any stage in this job.
  • Management processes did not assure positive control and effective monitoring of operations and maintenance actions.
  • Supervisors and managers assigned to the unit were new, generally not having been at the unit for more than six months; in one instance the maintenance supervisor had been assigned for less than two weeks.
  • There was little specific knowledge of the day-to-day operation and technical operation of the 50 Unit.
  • The operation was taking place in a self-directed manner.
  • Management involvement rose only when hazards rose, but the process for elevating issues was not clearly directed.
  • There was insufficient direction from management to perform at the level management expected.
  • The Layered Safety Survey Program did not document findings and it wasn't clear what corrective actions had been taken.
  • There were few direct interactions between management and outside supervision with the operators on a day-to-day basis.
  • The safety permit process did not clearly direct when issues should be elevated to management.
  • The safety message was not clearly and universally understood.
  • Organizational changes were not reviewed by Tosco management to evaluate their potential impact on safety.
  • Employees were asked to take on new safety responsibilities with only limited training.
  • There was an adversarial relationship between workers and managers at the refinery.
  • The general perception of workers at the refinery was that management's commitment to safety was lacking.
  • Safety communications up and down the ranks would frequently break down or get blocked.
  • The refinery's management systems were not in place and functioning to provide management with adequate information regarding the safety of the job.
  • Management systems were not in place to ensure that managers and first line supervisors take appropriate actions based on responsibility and authority.

Organizational and Systemic Factors

  • Tosco Avon refinery’s maintenance management system did not recognize or control serious hazards posed by performing nonroutine repair work while the crude processing unit remained in operation.
  • Tosco Avon management did not recognize the hazards presented by sources of ignition, valve leakage, line plugging, and inability to drain the naphtha piping.
  • Management did not conduct a hazard evaluation of the piping repair during the job planning stage.
  • Management did not have a planning and authorization process to ensure that the job received appropriate management and safety personnel review and approval.
  • Tosco did not ensure that supervisory and safety personnel maintained a sufficient presence in the unit during the execution of this job.
  • Tosco’s reliance on individual workers to detect and stop unsafe work was an ineffective substitute for management oversight of hazardous work activities.
  • Tosco’s procedures and work permit program did not require that sources of ignition be controlled prior to opening equipment that might contain flammables, nor did it specify what actions should be taken when safety requirements such as draining could not be accomplished.
  • Tosco’s safety management oversight system did not detect or correct serious deficiencies in the execution of maintenance and review of process changes at its Avon refinery.
  • The Avon refinery’s safety auditing program consisted of undocumented observations referred to as layered safety surveys.
  • These observations focused on worker behavior rather than measuring the effectiveness of procedures; they did not record findings, make recommendations, or track corrective actions.
  • Tosco’s auditing program did not record or remedy the pattern of serious deviations from the safe performance of maintenance work and proper review of operational changes in process units.
  • Tosco Avon management did not conduct an MOC review of the potential safety effects on the fractionator and associated piping that might result from operating the desalter beyond its design parameters, increasing water in the crude feed, and shutting down the No. 3 unit and resulting effects on the 50 Unit.
  • Tosco Avon management did not conduct an MOC review of operational changes that led to excessive corrosion rates in the naphtha piping.
  • Management did not consider the safety implications of process changes prior to their implementation.
  • The crude unit corrosion control program was inadequate.
  • Avon did not have a systematic job planning and authorization process to ensure that this kind of maintenance work received appropriate scrutiny before going forward.
  • No formal hazard evaluation was conducted before or during the maintenance project, and managers and safety specialists were not sufficiently involved in decision-making and oversight.
  • Individual workers were given the authority to put a halt to unsafe work.
  • The CSB found that Tosco should have evaluated operational changes that could worsen the corrosion of piping and valves.
  • This omission contributed to the final breakdown and the fire.
  • The incident highlighted several ineffective safety practices and procedures at the Avon refinery.
  • Had Tosco Corporation or Avon refinery management conducted an audit of these programs, problems could have been corrected prior to the accident.
  • However, no relevant documented safety audits were performed during the three years leading to the fire.

Failed Safeguards or Barrier Breakdowns

  • The unit remained in operation.
  • The piping was not drained, locked, or tagged.
  • The drain lines appeared to be plugged.
  • The reaming device broke due to the hardness of the material in the line.
  • The pipe was plugged solid with a dark, tar-like substance, which also contained large chunks of hard material.
  • Valve C was jammed partway open, and isolation was in doubt.
  • The permit readiness sheet and the work permit identified that draining was needed, but draining attempts were unsuccessful.
  • The maintenance supervisor and workers attempted to open a flange upstream of the control valve, but both efforts to drain the line were unsuccessful.
  • The personnel conducting the work did not take into account that the naphtha piping was pressurized from the running process unit due to a severe leak through a badly corroded valve.
  • Tosco’s procedures and the permit did not identify ignition sources as a potential hazard.
  • The permit also failed to identify the presence of hazardous amounts of benzene in the naphtha.
  • The permit form did not address the hazards of open containers of flammables or ignition sources from hot equipment surfaces.
  • Tosco procedures did not contain spacing requirements for placement of the vacuum truck.
  • The potential hazard of static electricity was not addressed by procedures or the permit system.
  • The work permit was authorized solely by a unit operator on the day of the incident.
  • Operations supervisors were not involved in inspecting the job site or reviewing the permit.
  • No health and safety personnel visited the job site before the incident occurred.
  • The maintenance supervisor was the only management representative present during the conduct of the repair work on February 23.
  • The safe work permit was marked as job not finished on February 18 and February 19.
  • The block valves (valves C and E) were not locked out.
  • The spool piece was not drained, nor was isolation of the block valves verified prior to removal.
  • The first cut and second cut were made before the line was drained or isolation was verified.
  • Hot equipment surfaces most likely ignited the naphtha.
  • special precautions
  • shutting down the fractionator
  • draining hazardous materials from lines and equipment
  • verifying that the equipment has been isolated before opening for maintenance
  • shut-off valves
  • drain valves
  • systematic job planning and authorization process
  • formal hazard evaluation
  • management of change (MOC)
  • corrosion control and management of change programs
  • opening process equipment
  • controlling sources of hazardous energy
  • isolating piping prior to maintenance
  • safety audits

Recommendations

  1. 1999-014-I-CA-R1 — Recipient: Tosco Corporation — Status: Not specified — Summary: Conduct periodic safety audits of your oil refinery facilities in light of the findings of this report. At a minimum, ensure that: Audits assess the following: Safe conduct of hazardous nonroutine maintenance; Management oversight and accountability for safety; Management of change program; Corrosion control program. Audits are documented in a written report that contains findings and recommendations and is shared with the workforce at the facility. Audit recommendations are tracked and implemented.
  2. 1999-014-I-CA-R2 — Recipient: Ultramar Diamond Shamrock Golden Eagle Refinery — Status: Not specified — Summary: Implement a program to ensure the safe conduct of hazardous nonroutine maintenance. At a minimum, require that: A written hazard evaluation is performed by a multidisciplinary team and, where feasible, conducted during the job planning process prior to the day of job execution. Work authorizations for jobs with higher levels of hazards receive higher levels of management review, approval, and oversight. A written decision-making protocol is used to determine when it is necessary to shut down a process unit to safely conduct repairs. Management and safety personnel are present at the job site at a frequency sufficient to ensure the safe conduct of work. Procedures and permits identify the specific hazards present and specify a course of action to be taken if safety requirements such as controlling ignition sources, draining flammables, and verifying isolation are not met. The program is periodically audited, generates written findings and recommendations, and implements corrective actions.
  3. 1999-014-I-CA-R3 — Recipient: Ultramar Diamond Shamrock Golden Eagle Refinery — Status: Not specified — Summary: Ensure that MOC reviews are conducted for changes in operating conditions, such as altering feedstock composition, increasing process unit throughput, or prolonged diversion of process flow through manual bypass valves.
  4. 1999-014-I-CA-R4 — Recipient: Ultramar Diamond Shamrock Golden Eagle Refinery — Status: Not specified — Summary: Ensure that your corrosion management program effectively controls corrosion rates prior to the loss of containment or plugging of process equipment, which may affect safety.
  5. 1999-014-I-CA-R5 — Recipient: American Petroleum Institute (API); Paper, Allied-Industrial, Chemical & Energy Workers International Union (PACE); National Petrochemical & Refiners Association (NPRA) — Status: Not specified — Summary: Communicate the findings of this report to your membership.

Key Engineering Lessons

  • A leaking or corroded isolation valve can prevent safe isolation of a live process line and allow the process unit to continue pressurizing the line during maintenance.
  • When a line cannot be drained and isolated, cutting or opening the piping can release flammable liquid that may ignite on nearby hot process equipment.
  • Corrosion control and management of change are necessary to prevent excessive corrosion, plugging, and loss of containment in process piping and valves.
  • Hazardous nonroutine maintenance requires a formal hazard evaluation, clear authorization, and management/safety oversight before work begins.
  • Work permits must identify ignition sources, flammable contents, and the actions to take when draining and isolation cannot be achieved.

Source Notes

  • Priority 1 final report was used to resolve conflicts and establish the authoritative findings, sequence, causes, and recommendations.
  • Priority 4 supporting documents were used only to supplement context where consistent with the final report.
  • Terminology such as 'fractionator', 'naphtha stripper level control bypass valve', 'management of change', and 'corrosion control program' was preserved from the source documents.
  • Some consequence wording varies across documents ('seriously injured' versus 'critically injured'); the final report wording was retained in the consolidated dataset.

Similar Incidents

Incidents sharing the same equipment, root causes, or hazard types.

Same Equipment

Same Root Cause

Same Hazard

← View in Knowledge Graph