00:00:07.354 --> 00:00:12.899 Narrator: April second, 2010, the Tesoro Refinery in Anacortes, Washington, 00:00:12.899 --> 00:00:16.946 a nearly forty year old heat exchanger violently ruptures [sound of explosion], 00:00:16.946 --> 00:00:20.987 causing an explosion and fire that kills seven workers; 00:00:20.987 --> 00:00:25.794 the largest loss of life at a U.S. refinery since 2005. 00:00:25.794 --> 00:00:28.674 The Chemical Safety Board launched an investigation 00:00:28.674 --> 00:00:32.362 and determined that the heat exchanger catastrophically failed due to 00:00:32.362 --> 00:00:38.083 long-term damage from what is known as "high temperature hydrogen attack". 00:00:38.083 --> 00:00:42.299 The CSB's final report into the accident was unanimously approved 00:00:42.299 --> 00:00:47.723 at a public meeting in Ana Cortes on May first, 2014. 00:00:47.723 --> 00:00:54.139 Moure-Eraso: The CSB is seriously concerned by the number of deadly refinery accidents in recent years. 00:00:54.139 --> 00:00:58.339 We have concluded that extensive improvement must be made 00:00:58.339 --> 00:01:02.890 in how refineries are regulated at the State and federal levels. 00:01:02.890 --> 00:01:11.890 [Music] 00:01:12.187 --> 00:01:14.292 Narrator: The Tesoro Refinery in Anacortes 00:01:14.292 --> 00:01:20.522 is an 800 acre facility located approximately 70 miles northwest of Seattle. 00:01:20.522 --> 00:01:28.772 The refinery produces a variety of products, including gasoline, diesel, jet fuel and asphalt. 00:01:28.772 --> 00:01:32.963 Within the refinery's Naphtha Hydrotreater Unit, raw naphtha, 00:01:32.963 --> 00:01:39.451 a light component of crude oil, is treated to remove nitrogen, sulphur and oxygen impurities. 00:01:39.451 --> 00:01:43.052 Before entering the unit's reactor, the raw naphtha and hydrogen 00:01:43.052 --> 00:01:47.323 are preheated inside pressure vessels called "heat exchangers". 00:01:47.323 --> 00:01:53.468 The unit contains two banks of three heat exchangers, supported by a three-level steel structure. 00:01:53.468 --> 00:01:58.604 Each heat exchanger consists of a bundle of tubes inside a steel shell. 00:01:58.604 --> 00:02:02.748 Hot fluid exiting the reactor flows through the heat exchanger shell, 00:02:02.748 --> 00:02:08.124 while cool fluid headed for the reactor, flows inside the tubes. 00:02:08.124 --> 00:02:11.723 Heat is exchanged through the walls of the tubes. 00:02:11.723 --> 00:02:16.524 Every six months the heat exchangers are taken offline to be cleaned, because of fouling, 00:02:16.524 --> 00:02:20.659 a common occurrence when operating heat exchangers in this type of service. 00:02:20.659 --> 00:02:26.700 As the raw naphtha is heated, a scale-like material forms and deposits onto the inside of the tubes, 00:02:26.700 --> 00:02:32.140 hindering the transfer of heat in the exchangers. 00:02:32.140 --> 00:02:38.972 On March 28, 2010, one bank of heat exchangers was taken offline and disassembled for cleaning, 00:02:38.972 --> 00:02:41.763 while the other bank remained in service. 00:02:41.763 --> 00:02:45.451 This allowed the unit to continue to operate. 00:02:45.451 --> 00:02:47.579 By midafternoon on April first, 00:02:47.579 --> 00:02:55.212 the cleaning was complete and operators initiated the startup of the offline bank of heat exchangers. 00:02:55.212 --> 00:03:01.593 The procedure required an inside board operator monitoring the control console and one outside operator, 00:03:01.593 --> 00:03:05.715 opening and closing large manually operated valves. 00:03:05.715 --> 00:03:09.452 But the heat exchangers had a history of developing leaks during startup, 00:03:09.452 --> 00:03:13.668 something that refinery personnel had come to see as normal. 00:03:13.668 --> 00:03:18.652 Additional operators from other nearby units were called upon to assist with the startup, 00:03:18.652 --> 00:03:21.619 including mitigation of potential leaks. 00:03:21.619 --> 00:03:27.706 By 10:30 p.m., the outside operator was joined by six workers from other units within the refinery. 00:03:27.706 --> 00:03:34.059 The seven workers were located around the heat exchangers, where startup activities continued past midnight. 00:03:34.059 --> 00:03:39.636 But unknown to the workers, the steel shelves of the middle vessels in both banks of heat exchangers 00:03:39.636 --> 00:03:45.132 had been severely weakened due to cracking caused by high temperature hydrogen attack. 00:03:45.132 --> 00:03:50.203 This occurs when tiny hydrogen atoms diffuse into steel at a high temperature, 00:03:50.203 --> 00:03:54.481 then react with carbon in the steel to form methane gas. 00:03:54.481 --> 00:03:59.698 The larger methane molecules, unable to diffuse out of the steel, accumulate, 00:03:59.698 --> 00:04:03.497 stressing the steel and over time causing fissures. 00:04:03.497 --> 00:04:09.929 In both of the middle heat exchangers, the fissures grew and connected to form large internal cracks. 00:04:09.929 --> 00:04:12.561 One such crack was 48 inches long 00:04:12.561 --> 00:04:17.465 and extended more than one-third of the way through the vessel's one-inch thick shell. 00:04:17.465 --> 00:04:20.010 Shortly after midnight, the temperature of the fluid 00:04:20.010 --> 00:04:26.889 exiting the tubes of the online bank of exchangers increased about 75 degrees over the span of three minutes, 00:04:26.889 --> 00:04:30.985 a temperature increase that was typical and observed in previous startups, 00:04:30.985 --> 00:04:35.833 but the middle heat exchanger was so severely weakened from high temperature hydrogen attack, 00:04:35.833 --> 00:04:41.049 that it likely could not withstand the stress caused by the rapid temperature increase. 00:04:41.049 --> 00:04:46.794 At 12:35 a.m., employees working at a nearby process unit heard a loud hissing noise, 00:04:46.794 --> 00:04:51.585 when vapor began to leak as the heat exchanger cracked at its weakest point. 00:04:51.585 --> 00:04:54.714 Seconds later, the exchanger violently ruptured. 00:04:54.714 --> 00:04:55.905 [sound of explosion] 00:04:55.905 --> 00:04:59.219 Narrator: Hot hydrogen and naphtha vapor vapidly vented from the exchanger 00:04:59.219 --> 00:05:02.450 and spontaneously ignited upon contact with air, 00:05:02.450 --> 00:05:07.513 resulting in a massive fire that consumed the heat exchanger structure. 00:05:07.513 --> 00:05:10.410 Three of the seven operators died at the scene; 00:05:10.410 --> 00:05:14.929 the other four operators were transported to local burn centers with severe injuries. 00:05:14.929 --> 00:05:20.529 Two died within hours; the other two succumbed within days. 00:05:20.529 --> 00:05:23.962 Grim: High temperature hydrogen attack or HTHA 00:05:23.962 --> 00:05:29.337 is a common hazard that has long been known within the petrochemical industry. 00:05:29.337 --> 00:05:34.497 However, Tesoro engineers and corrosion experts did not believe 00:05:34.497 --> 00:05:38.986 it could occur within the heat exchanger that ultimately failed. 00:05:38.986 --> 00:05:41.434 Narrator: The CSB learned that like other companies, 00:05:41.434 --> 00:05:48.009 Tesoro relied on data published by the American Petroleum Institute, called "The Nelson Curves" 00:05:48.009 --> 00:05:54.074 to predict the susceptibility of the carbon steel heat exchangers to HTHA damage. 00:05:54.074 --> 00:05:59.761 They take into account process temperature, the amount of pressure contributed by hydrogen 00:05:59.761 --> 00:06:03.449 and the kinds of materials used in constructing the equipment. 00:06:03.449 --> 00:06:08.321 Above each Nelson Curve, HTHA was thought to be possible. 00:06:08.321 --> 00:06:12.786 Below each curve, HTHA was not predicted to occur. 00:06:12.786 --> 00:06:16.033 But after conducting detailed process simulations, 00:06:16.033 --> 00:06:20.689 the CSB concluded that the portion of the heat exchanger that ruptured 00:06:20.689 --> 00:06:28.040 actually had operated below the curve for carbon steel in a zone that industry guidance considered safe. 00:06:28.040 --> 00:06:32.383 And the CSB has learned of at least eight other refinery accidents 00:06:32.383 --> 00:06:37.999 where HTHA reportedly occurred below the carbon steel Nelson Curve. 00:06:37.999 --> 00:06:43.192 As a result, the CSB determined that the carbon steel Nelson Curve is inaccurate 00:06:43.192 --> 00:06:47.959 and cannot be trusted to predict the occurrence of high temperature hydrogen attack. 00:06:47.959 --> 00:06:52.096 Furthermore, the CSB found that Tesoro did not measure 00:06:52.096 --> 00:06:56.695 actual operating temperatures and pressures in the exchanger that failed. 00:06:56.695 --> 00:07:03.799 Instead, corrosion experts hired by Tesoro relied on design operating conditions 00:07:03.799 --> 00:07:09.223 to predict whether HTHA would occur, based on the Nelson Curve. 00:07:09.223 --> 00:07:13.863 And the CSB's process simulations indicated that when the exchangers 00:07:13.863 --> 00:07:20.086 were fouled the actual temperatures were likely much higher than design conditions. 00:07:20.086 --> 00:07:27.007 Grim: Had Tesoro used actual process conditions when determining HTHA susceptibility of the heat exchangers, 00:07:27.007 --> 00:07:33.287 their internal policies would have required the heat exchangers to be inspected for HTHA. 00:07:33.287 --> 00:07:38.215 However, we know that inspection for HTHA is not very reliable. 00:07:38.215 --> 00:07:44.103 Narrator: That is because damage to equipment may be microscopic or limited to small areas, 00:07:44.103 --> 00:07:47.920 but still be significant enough to cause catastrophic failure. 00:07:47.920 --> 00:07:49.071 [Sound of explosion] 00:07:49.071 --> 00:07:54.784 Grim: The best way to prevent HTHA is by using inherently safer materials of construction 00:07:54.784 --> 00:07:58.911 that are much more resistant to high temperature hydrogen attack. 00:07:58.911 --> 00:08:05.671 For example, industry has already identified steels with higher percentages of chromium and molybdenum 00:08:05.671 --> 00:08:08.959 that are much more resistant to HTHA. 00:08:08.959 --> 00:08:12.208 Narrator: The CSB recommended that the American Petroleum Institute 00:08:12.208 --> 00:08:19.176 revise its standards to prohibit the use of carbon steel equipment in HTHA-susceptible service 00:08:19.176 --> 00:08:25.943 and to require verification of actual operating conditions. 00:08:25.943 --> 00:08:32.104 Tillema: The safety culture of a company can have a huge influence on the actions it takes to prevent accidents. 00:08:32.104 --> 00:08:34.768 During our investigation of this accident, 00:08:34.768 --> 00:08:40.311 we discovered several instances where Tesoro's safety culture was lacking. 00:08:40.311 --> 00:08:44.823 Narrator: The CSB learned that the heat exchangers had a history of leaks during startup, 00:08:44.823 --> 00:08:48.520 creating hazardous conditions for personnel working nearby. 00:08:48.520 --> 00:08:53.159 However, the CSB found that although Tesoro took some corrective actions, 00:08:53.159 --> 00:08:55.717 it never adequately fixed the leaks. 00:08:55.717 --> 00:09:00.662 Instead, Tesoro treated the leaks and fires as normal occurrences 00:09:00.662 --> 00:09:06.430 and regularly allowed additional personnel to be present during startup to mitigate the hazards. 00:09:06.430 --> 00:09:11.989 On the night of the incident, two more leaks were reported during the exchanger startup. 00:09:11.989 --> 00:09:15.805 And the CSB found that the complexity of the startup procedure 00:09:15.805 --> 00:09:19.981 typically required more than just the one outside operator, 00:09:19.981 --> 00:09:24.981 yet operating procedures were not updated to account for the role of additional personnel 00:09:24.981 --> 00:09:28.334 during the hazardous non-routine work. 00:09:28.334 --> 00:09:32.445 Tillema: These additional operators were exposed to a serious risk. 00:09:32.445 --> 00:09:37.718 Narrator: Seven workers, including five additional operators from other refinery units, 00:09:37.718 --> 00:09:42.477 were supporting the startup of the heat exchangers on the night of April second, 2010. 00:09:42.477 --> 00:09:44.125 00:09:44.125 --> 00:09:47.365 Narrator: All were fatally injured. 00:09:47.365 --> 00:09:51.214 Tillema: The CSB found that if Tesoro had a strong safety culture, 00:09:51.214 --> 00:09:54.973 it would have addressed the ongoing leaks and defined a reasonable number 00:09:54.973 --> 00:09:57.989 of essential personnel for the startup activity. 00:09:57.989 --> 00:10:02.149 Had Tesoro done these things, we concluded that fewer workers 00:10:02.149 --> 00:10:07.581 would have been present on the night of the accident and lives would have been spared. 00:10:07.581 --> 00:10:12.389 Narrator: The CSB recommended that Tesoro implement a process safety culture program 00:10:12.389 --> 00:10:20.213 that would assess and continually improve safety at the Anacortes refinery. 00:10:20.213 --> 00:10:27.846 Moure-Eraso: Our Tesoro findings are all too similar to those of other CSB refinery investigations. 00:10:27.846 --> 00:10:30.342 Narrator: The CSB has found these similarities 00:10:30.342 --> 00:10:35.086 include weaknesses in industry standards for safeguarding equipment, 00:10:35.086 --> 00:10:42.053 a deficient refinery safety culture and a regulatory system in need of reform. 00:10:42.053 --> 00:10:45.851 Under the existing state and federal regulatory systems, 00:10:45.851 --> 00:10:50.085 there is no requirement to reduce risks to a specific target. 00:10:50.085 --> 00:10:57.301 The regulations predominantly required only the completion of activities or tasks, such as hazard analyses, 00:10:57.301 --> 00:11:04.238 but the regulations do not mandate actual risk reduction or continuous safety improvement. 00:11:04.238 --> 00:11:08.942 Tillema: The CSB believes the goal should always be to reduce the risk of major accidents, 00:11:08.942 --> 00:11:15.349 to as low as reasonably practicable, a concept known in the industry as ALARP. 00:11:15.349 --> 00:11:17.286 Narrator: To reduce accident risks, 00:11:17.286 --> 00:11:22.445 the CSB made the following recommendation to the U.S. Environmental Protection Agency. 00:11:22.445 --> 00:11:27.100 Revise rules under the Clean Air Act to require that facilities analyze 00:11:27.100 --> 00:11:32.163 and use inherently safer technologies to the greatest extent feasible. 00:11:32.163 --> 00:11:40.707 Use the "hierarchy of controls" with safe design at the top of the hierarchy, to reduce process hazards. 00:11:40.707 --> 00:11:47.756 Tragically, Tesoro only opted to install an exchanger made of a safer HTHA resistant alloy 00:11:47.756 --> 00:11:51.915 after the disastrous explosion that cost seven workers their lives. 00:11:51.915 --> 00:11:53.475 00:11:53.475 --> 00:11:56.627 Narrator: And the new design eliminated the risky step of switching 00:11:56.627 --> 00:11:59.771 between the parallel banks of heat exchangers. 00:11:59.771 --> 00:12:06.251 Until the EPA promulgates a regulation, the CSB recommends the EPA use its authority 00:12:06.251 --> 00:12:12.884 under the Clean Air Act's General Duty Clause to promote wider use of inherently safer design. 00:12:12.884 --> 00:12:15.052 The CSB also recommended that the Governor 00:12:15.052 --> 00:12:20.883 and Legislature of the State of Washington significantly strengthen the oversight of refineries, 00:12:20.883 --> 00:12:27.636 specifically the Board called on the State to require refineries to conduct more comprehensive hazard analyses 00:12:27.636 --> 00:12:33.211 and damage mechanism reviews, document the effectiveness of process safeguards 00:12:33.211 --> 00:12:38.563 and increase the role for worker representatives in process safety management. 00:12:38.563 --> 00:12:45.747 And these more rigorous company safety reviews should be examined by technically competent regulators. 00:12:45.747 --> 00:12:50.547 The CSB determined such regulatory changes would help prevent future accidents, 00:12:50.547 --> 00:12:58.508 like the tragedy at Tesoro, where many opportunities to identify and reduce hazards were overlooked. 00:12:58.508 --> 00:13:01.211 Moure-Eraso: Seven lives were lost at Tesoro. 00:13:01.211 --> 00:13:03.563 It should not have happened. 00:13:03.563 --> 00:13:09.972 Companies, workers and communities would all benefit from a more rigorous regulatory system 00:13:09.972 --> 00:13:15.323 that is focused on continuously lowering risks. 00:13:15.323 --> 00:13:22.645 Narrator: For more information on the CBS's Tesoro investigation, please visit csb.gov. 00:13:22.645 --> 00:13:26.699
Office location
Engineering company LOTUS®
Russia, Ekaterinburg, Lunacharskogo street, 240/12