Washington D.C. June 24, 2024 – Today the U.S. Chemical Safety and Hazard Investigation Board (CSB) issued its final investigation report into the fatal naphtha release and fire at the BP-Husky Toledo Refinery (“BP Toledo Refinery”) in Oregon, Ohio, on September 20, 2022, which resulted in the death of two BP employees, who were brothers. During an emergency situation at the refinery, liquid naphtha was released from a pressurized vessel, which resulted in a vapor cloud that subsequently ignited, causing a flash fire, which fatally injured the two BP employees. The events on September 20, 2022 resulted in approximately $597 million in property damage at the refinery, including loss of use. Over 23,000 pounds of naphtha were released during the incident.
This is the largest fatal incident at a BP-operated petroleum refinery in the United States since the fatal explosions and fires at the BP refinery in Texas City, Texas, in 2005, that resulted in the deaths of 15 workers and injured 180 other people.
The CSB’s report details a series of cascading -- and worsening -- events throughout the day of September 20, 2022, that contributed to the release and fire. The CSB found that there was an “alarm flood”, with more than 3,700 alarms going off in the 12-hour period prior to the fatal incident, which overwhelmed and distracted BP’s board operators, causing delays and errors in responding to critical alarms. The CSB also found that the refinery failed to implement a shutdown or hot circulation through the use of stop work authority or otherwise in time to prevent the fatal incident.
Earlier that day, a process upset in the naphtha hydrotreater unit resulted in a loss of containment at the refinery. This resulted in other refinery units being shut down, and eventually operational decisions being made that led to liquid naphtha flowing to – and filling up -- a pressurized vessel, which normally contained only vapor (fuel gas). The vessel then overflowed into vapor piping, intended for downstream furnaces and boilers, which created the potential for furnace fires or explosions if liquid entered the fuel gas systems. Due to the abnormal state of the liquid-full vessel, several BP employees were directed to drain the liquid “as fast as you guys can.” Shortly thereafter, two of the employees released the liquid to the ground by opening the vessel, which subsequently created the vapor cloud that ignited, resulting in the fire that fatally injured the two employees. The CSB’s report concluded that the two employees who opened the vessel may have believed that the liquid was an amine-water solution, not naphtha.
CSB Chairperson Steve Owens said, “Nearly everything that could go wrong did go wrong during this incident. The tragic loss of life resulting from this fire underscores the importance of putting in place the tools that employees need to perform tasks safely, such as stop work authority, and having adequate policies, procedures, and safeguards in place to effectively manage highly stressful abnormal situations, including alarm floods.”
The CSB’s final report identifies several critical safety issues that contributed to the catastrophic outcome on September 20, 2022:
Liquid Overflow Prevention: - The refinery's process hazard analyses (PHAs) identified potential risks, including overflow events. However, the safeguards in place, such as safety instrumented systems and emergency pressure-relief valves, did not prevent liquid overflow into the fuel gas system. The high level in the vessel led to the subsequent release of naphtha, vapor cloud formation, and fire.
Abnormal Situation Management: An abnormal situation is a process disturbance with which the basic process control system cannot cope, which can create a stressful environment for the operators. Ineffective management of abnormal situations can escalate to a more serious incident, as occurred leading up to this incident. The BP Toledo Refinery experienced several abnormal situations across several units, escalating to overfilling multiple vessels. This prompted two BP employees to release the vessel’s contents to the ground, ultimately cascading to the vapor cloud, fire, and fatal injuries.
Alarm Flood: An alarm flood occurs when there are more alarms than board operators can effectively manage or respond to. Board operators were dealing with an alarm flood for nearly 12 hours before the incident occurred, with 3,712 alarms going off during this period. Excessive alarms contributed to delays and errors in response and mitigation of the overflow of naphtha into the fuel gas system.
Learning from Incidents: The CSB found that a previous incident at the BP Toledo Refinery had occurred in 2019 where naphtha began to fill the vessel after a refinery-wide process upset. The subsequent BP Toledo Refinery investigation team identified catastrophic incident warning signs during the investigation but did not develop action items to prevent naphtha from filling the vessel, resulting in a missed opportunity to improve safety and prevent another incident. The CSB also found similarities between the overflow events at the BP Toledo Refinery incident and the fatal explosions and fires in 2005 at the BP Texas City refinery.
As a result of its findings, the CSB is issuing a total of seven safety recommendations to the current owner of the facility (Ohio Refining Company LLC, a subsidiary of Cenovus Energy Inc., which acquired the refinery from BP in February 2023); the American Petroleum Institute (API); and the International Society of Automation (ISA). Each recommendation aims to address an existing safety gap.
To the Ohio Refining Company LLC, the CSB is calling on the company to revise safeguards in process hazard analyses for high-level and overflow scenarios, revise the Abnormal Situation Management (ASM) policy and revise the ‘Toledo Alarm Philosophy’. The CSB also is recommending that the company develop a policy (or revise an existing policy) to clearly provide employees with the authority to stop work that is perceived to be unsafe, including detailed procedures and regular training on how employees would exercise their stop work authority, with an emphasis on exercising this authority during abnormal situations, including alarm floods.
To the American Petroleum Institute (API) the CSB is calling on the trade association to develop or revise a publication on process hazards associated with Fuel Gas Mix Drum overflow and provide guidance on drum design, sizing criteria, instrumentation for detecting high levels, and preventive safeguards. The CSB is also asking API to develop a publication on preventing overflow of pressure vessels to address overflow events during normal, upset and transient operations.
Lastly, the CSB is calling on the International Society of Automation (ISA) to revise its guidance on the management of alarm systems for the process industries to include items such as performance targets for short-term alarm floods.
The CSB did not make any recommendations to BP, since BP no longer operates the Toledo Refinery.
The CSB’s board members are appointed by the President subject to Senate confirmation. The Board does not issue citations or fines but makes safety recommendations to companies, industry organizations, labor groups, and regulatory agencies such as OSHA and EPA.
Please visit our website, www.csb.gov. For more information, contact Communications Manager Hillary Cohen at [email protected]