Narrator: April second, 2010,
the Tesoro Refinery in Anacortes, Washington, a nearly forty year old heat exchanger
violently ruptures [sound of explosion], causing an explosion and fire
that kills seven workers; the largest loss of life at
a U.S. refinery since 2005. The Chemical Safety Board
launched an investigation and determined that the heat exchanger
catastrophically failed due to long-term damage from what is known
as "high temperature hydrogen attack". The CSB's final report into the accident
was unanimously approved at a public meeting in Ana Cortes
on May first, 2014. Moure-Eraso: The CSB is seriously concerned by the
number of deadly refinery accidents in recent years. We have concluded that
extensive improvement must be made in how refineries are regulated
at the State and federal levels. [Music] Narrator: The Tesoro Refinery
in Anacortes is an 800 acre facility located
approximately 70 miles northwest of Seattle. The refinery produces a variety of products,
including gasoline, diesel, jet fuel and asphalt. Within the refinery's Naphtha
Hydrotreater Unit, raw naphtha, a light component of crude oil, is treated to
remove nitrogen, sulphur and oxygen impurities. Before entering the unit's reactor,
the raw naphtha and hydrogen are preheated inside pressure
vessels called "heat exchangers". The unit contains two banks of three heat exchangers,
supported by a three-level steel structure. Each heat exchanger consists of a
bundle of tubes inside a steel shell. Hot fluid exiting the reactor
flows through the heat exchanger shell, while cool fluid headed for the reactor,
flows inside the tubes. Heat is exchanged
through the walls of the tubes. Every six months the heat exchangers are
taken offline to be cleaned, because of fouling, a common occurrence when operating
heat exchangers in this type of service. As the raw naphtha is heated, a scale-like
material forms and deposits onto the inside of the tubes, hindering the transfer
of heat in the exchangers. On March 28, 2010, one bank of heat exchangers
was taken offline and disassembled for cleaning, while the other bank
remained in service. This allowed the unit
to continue to operate. By midafternoon
on April first, the cleaning was complete and operators initiated
the startup of the offline bank of heat exchangers. The procedure required an inside board operator
monitoring the control console and one outside operator, opening and closing large
manually operated valves. But the heat exchangers had a
history of developing leaks during startup, something that refinery personnel
had come to see as normal. Additional operators from other nearby units
were called upon to assist with the startup, including mitigation
of potential leaks. By 10:30 p.m., the outside operator was joined by
six workers from other units within the refinery. The seven workers were located around the heat exchangers,
where startup activities continued past midnight. But unknown to the workers, the steel shelves of
the middle vessels in both banks of heat exchangers had been severely weakened due to cracking
caused by high temperature hydrogen attack. This occurs when tiny hydrogen atoms
diffuse into steel at a high temperature, then react with carbon in the steel
to form methane gas. The larger methane molecules, unable
to diffuse out of the steel, accumulate, stressing the steel and
over time causing fissures. In both of the middle heat exchangers, the fissures
grew and connected to form large internal cracks. One such crack
was 48 inches long and extended more than one-third of the way
through the vessel's one-inch thick shell. Shortly after midnight,
the temperature of the fluid exiting the tubes of the online bank of exchangers
increased about 75 degrees over the span of three minutes, a temperature increase that was
typical and observed in previous startups, but the middle heat exchanger was so severely
weakened from high temperature hydrogen attack, that it likely could not withstand the stress
caused by the rapid temperature increase. At 12:35 a.m., employees working at a
nearby process unit heard a loud hissing noise, when vapor began to leak as the heat
exchanger cracked at its weakest point. Seconds later,
the exchanger violently ruptured. [sound of explosion] Narrator: Hot hydrogen and naphtha vapor
vapidly vented from the exchanger and spontaneously
ignited upon contact with air, resulting in a massive fire that
consumed the heat exchanger structure. Three of the seven operators
died at the scene; the other four operators were transported
to local burn centers with severe injuries. Two died within hours;
the other two succumbed within days. Grim: High temperature
hydrogen attack or HTHA is a common hazard that has long been
known within the petrochemical industry. However, Tesoro engineers and
corrosion experts did not believe it could occur within the heat
exchanger that ultimately failed. Narrator: The CSB learned
that like other companies, Tesoro relied on data published by the American
Petroleum Institute, called "The Nelson Curves" to predict the susceptibility of the
carbon steel heat exchangers to HTHA damage. They take into account process temperature,
the amount of pressure contributed by hydrogen and the kinds of materials used
in constructing the equipment. Above each Nelson Curve,
HTHA was thought to be possible. Below each curve,
HTHA was not predicted to occur. But after conducting
detailed process simulations, the CSB concluded that the portion of
the heat exchanger that ruptured actually had operated below the curve for carbon steel
in a zone that industry guidance considered safe. And the CSB has learned of
at least eight other refinery accidents where HTHA reportedly occurred
below the carbon steel Nelson Curve. As a result, the CSB determined that the
carbon steel Nelson Curve is inaccurate and cannot be trusted to predict the
occurrence of high temperature hydrogen attack. Furthermore, the CSB found
that Tesoro did not measure actual operating temperatures and
pressures in the exchanger that failed. Instead, corrosion experts hired by
Tesoro relied on design operating conditions to predict whether HTHA would occur,
based on the Nelson Curve. And the CSB's process simulations
indicated that when the exchangers were fouled the actual temperatures were
likely much higher than design conditions. Grim: Had Tesoro used actual process conditions when
determining HTHA susceptibility of the heat exchangers, their internal policies would have required
the heat exchangers to be inspected for HTHA. However, we know that
inspection for HTHA is not very reliable. Narrator: That is because damage to equipment
may be microscopic or limited to small areas, but still be significant enough
to cause catastrophic failure. [Sound of explosion] Grim: The best way to prevent HTHA is by
using inherently safer materials of construction that are much more resistant to
high temperature hydrogen attack. For example, industry has already identified steels
with higher percentages of chromium and molybdenum that are much more
resistant to HTHA. Narrator: The CSB recommended
that the American Petroleum Institute revise its standards to prohibit the use of
carbon steel equipment in HTHA-susceptible service and to require verification
of actual operating conditions. Tillema: The safety culture of a company can have a huge
influence on the actions it takes to prevent accidents. During our investigation
of this accident, we discovered several instances where
Tesoro's safety culture was lacking. Narrator: The CSB learned that the heat exchangers
had a history of leaks during startup, creating hazardous conditions
for personnel working nearby. However, the CSB found that although
Tesoro took some corrective actions, it never
adequately fixed the leaks. Instead, Tesoro treated the
leaks and fires as normal occurrences and regularly allowed additional personnel to be
present during startup to mitigate the hazards. On the night of the incident, two more leaks
were reported during the exchanger startup. And the CSB found that the
complexity of the startup procedure typically required more than
just the one outside operator, yet operating procedures were not updated to
account for the role of additional personnel during the
hazardous non-routine work. Tillema: These additional operators
were exposed to a serious risk. Narrator: Seven workers, including five
additional operators from other refinery units, were supporting the startup of the heat exchangers
on the night of April second, 2010. [Sound of explosion] Narrator: All were fatally injured. Tillema: The CSB found that if
Tesoro had a strong safety culture, it would have addressed the ongoing
leaks and defined a reasonable number of essential personnel
for the startup activity. Had Tesoro done these things,
we concluded that fewer workers would have been present on the night of the
accident and lives would have been spared. Narrator: The CSB recommended that Tesoro
implement a process safety culture program that would assess and continually improve
safety at the Anacortes refinery. Moure-Eraso: Our Tesoro findings are all too similar
to those of other CSB refinery investigations. Narrator: The CSB has
found these similarities include weaknesses in industry standards
for safeguarding equipment, a deficient refinery safety culture and
a regulatory system in need of reform. Under the existing state and
federal regulatory systems, there is no requirement to
reduce risks to a specific target. The regulations predominantly required only the
completion of activities or tasks, such as hazard analyses, but the regulations do not mandate actual
risk reduction or continuous safety improvement. Tillema: The CSB believes the goal should
always be to reduce the risk of major accidents, to as low as reasonably practicable, a
concept known in the industry as ALARP. Narrator: To reduce accident risks, the CSB made the following recommendation
to the U.S. Environmental Protection Agency. Revise rules under the Clean Air Act
to require that facilities analyze and use inherently safer technologies
to the greatest extent feasible. Use the "hierarchy of controls" with safe design at
the top of the hierarchy, to reduce process hazards. Tragically, Tesoro only opted to install an
exchanger made of a safer HTHA resistant alloy after the disastrous explosion
that cost seven workers their lives. [Sound of explosion] Narrator: And the new design eliminated
the risky step of switching between the parallel banks
of heat exchangers. Until the EPA promulgates a regulation,
the CSB recommends the EPA use its authority under the Clean Air Act's General Duty Clause
to promote wider use of inherently safer design. The CSB also
recommended that the Governor and Legislature of the State of Washington
significantly strengthen the oversight of refineries, specifically the Board called on the State to require
refineries to conduct more comprehensive hazard analyses and damage mechanism reviews, document
the effectiveness of process safeguards and increase the role for worker representatives
in process safety management. And these more rigorous company safety reviews
should be examined by technically competent regulators. The CSB determined such regulatory changes
would help prevent future accidents, like the tragedy at Tesoro, where many opportunities
to identify and reduce hazards were overlooked. Moure-Eraso: Seven
lives were lost at Tesoro. It should not have happened. Companies, workers and communities would all
benefit from a more rigorous regulatory system that is focused on
continuously lowering risks. Narrator: For more information on the CBS's
Tesoro investigation, please visit csb.gov. [Music]
