Almost two years ago, a fatal flash fire broke out at the BP-Husky Refining LLC refinery in Oregon, Ohio, after a vapor cloud caught an ignition source and the cause was operators opened valves and removed a flange on a pressurized fuel gas mix drum to release a flammable liquid, naphtha, directly to the ground, federal investigators found.

After the release on September 20, 2022, at 6:46 p.m., the flammable liquid formed a vapor cloud that reached a nearby ignition source resulting in a flash fire which killed two operators, brothers Ben Morrissey and Max Morrissey.

Contributing to the incident were the refinery’s failure to implement effective preventive safeguards for the overflow of towers and vessels in various pieces of equipment which led to an over-reliance on human intervention to prevent incidents; the refinery’s failure to implement a shutdown or hot circulation through the use of Stop Work Authority or otherwise; the refinery’s ineffective policies, procedures, and practices to avoid and control abnormal situations; the refinery’s alarm system which flooded operators with alarms throughout the day resulting in poor decision making; and the refinery’s failure to learn from previous incidents, according to a final report released by the Chemical Safety and Hazard Investigation Board (CSB).

23,000 Pounds of Naphtha Release
In addition to the fatalities, the incident caused $597 million in property damage including loss of use. BP estimated over 23,000 pounds of naphtha released during the event, though there were no off-site impacts.

The fuel gas mix drum typically contained only vapor (fuel gas for furnaces and boilers). However, during the incident, the vessel filled with liquid naphtha when an upstream tower overflowed naphtha into a vapor bypass line directly to the vessel. The upstream tower overflowed liquid naphtha through the vapor bypass line after a board operator opened a closed valve sending liquid naphtha to the tower operating in a vapor-only mode. Other refinery units had been shut down due to a loss of containment incident that occurred earlier that morning.

Schneider Bold

The initial process upset, the subsequent events and operational decisions made on September 20, led to liquid naphtha filling the vessel, which normally contained fuel gas. The vessel then overflowed into vapor piping feeding downstream furnaces and boilers. While draining the overflowing vessel as fast as they could pursuant to the board operator’s directive communicated via radio, the BP employees opened the vessel and released liquid naphtha to the ground.

As it is with most disasters, the final incident was the last in a series of cascading events that started roughly 24 hours before, beginning with a relatively minor process upset during the previous night’s shift.

The sequence of events that led up to the vapor cloud ignition are the following:

On the Monday night shift of September 19, shortly after 7 p.m., water began to accumulate in the Crude 1 Overhead Accumulator Drum, which, several hours later, began to overflow into the naphtha stream that normally exited the drum. Excess water in the naphtha stream then began to accumulate downstream in the Coker Gas Plant Foul Condensate Draw-Off Drum. This drum began to overflow water into the Coker Gas Plant Absorber Stripper Tower. The water overflow and resulting liquid flow increase out of the Absorber Stripper Tower bottoms and into downstream equipment led to a downstream pressure increase in NHT Preheat.

Pressure Increase
The resulting pressure increase in NHT Preheat was enough to open two emergency pressure-relief valves shortly after 7 a.m. on the Tuesday day shift of September 20. A severe piping vibration began as a result of one of the emergency pressure-relief valves opening. A 3⁄4-inch drain line broke off the main naphtha piping, which led to a liquid naphtha loss of containment. The naphtha did not ignite but resulted in an emergency shutdown of the NHT unit and bypass of the Coker Gas Plant. The Crude 1 unit continued to operate.

The NHT unit emergency shutdown led to a Crude 1 Tower upset throughout much of the rest of the Tuesday day shift. With the NHT unit shut down and the Coker Gas Plant bypassed, naphtha from the Crude 1 Overhead Accumulator Drum could be sent only to Light Virgin Naphtha Storage. The Crude 1 Tower experienced several losses of pump around cooling, a Crude 1 Overhead Accumulator Drum level upset, and 11 instances of Crude 1 Tower overpressure on day shift after the NHT shutdown.

As operations personnel worked throughout the day to stabilize the Crude 1 Tower, they made several crude slate adjustments to the tower feed. At 4:56 p.m., the oncoming Tuesday night shift made another crude slate change, which removed all light crude oil from the Crude 1 Tower feed.

During the Tuesday night shift, another Crude 1 Tower process upset began due to the rapid and complete loss of light crude oil feed. The Crude 1 Tower upset caused a high level of liquid in the Crude 1 Overhead Accumulator Drum. To address the rapidly increasing level of liquid in the drum, board operators began transferring the excess liquid to the Coker Gas Plant Absorber Stripper Tower.

Vapor cloud ignition and the ensuing six seconds. Ignition at Crude Furnace (circled in red, upper left photo).
Source: BP with annotations by CSB

Once the board operator intentionally opened the flow control valve from the Crude 1 Overhead Accumulator Drum to the Coker Gas Plant (the “naphtha flow control valve to the Coker Gas Plant”), liquid naphtha flowed from the drum to the Absorber Stripper Tower. With the naphtha flow control valve to the Coker Gas Plant open, naphtha began to fill the Coker Gas Plant Absorber Stripper Tower, and eventually overflowed through the Coker Gas Plant bypass line to the Fuel Gas Mix Drum. Once the Fuel Gas Mix Drum was liquid full, the naphtha flowed to the downstream furnaces and boilers.

Board Operator Alert
By 6:09 p.m., the Fuel Gas Mix Drum level had begun to increase. The board operator noticed the Fuel Gas Mix Drum level alarm on the Distributed Control System (DCS) alarm screen and radioed the outside operators to check the level in the Fuel Gas Mix Drum at 6:16 p.m. Four outside operations personnel arrived at the Fuel Gas Mix Drum. Another outside operator began draining the Fuel Gas Mix Drum to the Flare Knockout Drum and Oily Water Sewer. The radio traffic captured the following conversation between outside operators and board operators regarding level in the Fuel Gas Mix Drum:

[Board] Hey, level in the Mix Drum. You’re going to want to check that ASAP.
[Outside] Got it.
[Outside] I’m not even in the sight glass on the Mix Drum.
[Board] Did you say the Mix Drum level is above the sight glass?
[Outside] That is correct.
[Board] Copy that, just drain it as fast as you guys can.
[Outside] We are.

The outside operators attempted to empty the Fuel Gas Mix Drum through the following flow paths:
With four operations personnel present, one of them fully opened the valve on the two-inch line to the Flare Knockout Drum (a closed system) at 6:17 p.m.

The same four personnel were present while one of them opened the Fuel Gas Mix Drum two-inch drain to the Oily Water Sewer, designed for this purpose, at 6:17 p.m. At a later unknown time, they opened a second one-inch drain line from the Fuel Gas Mix Drum guided wave radar level transmitter to the Oily Water Sewer.

2 Workers Depart; 2 Stay
Two of the operations personnel left the area around the Fuel Gas Mix Drum to check on the Sweet Gas Knock Out Pot in the Coker Gas Plant, leaving two BP employees, one outside operator and an operator trainee who were brothers, at the Fuel Gas Mix Drum to finish draining it.

These BP employees opened two 3⁄4-inch bleed valves to the ground at 6:32 p.m.: one at the Fuel Gas Mix Drum differential pressure level transmitter, and one at the Fuel Gas Mix Drum sight glass; and unbeknownst to anyone, the outside operator and operator trainee began releasing liquid from the Fuel Gas Mix Drum directly to the ground (while wearing a Self-Contained Breathing Apparatus [SCBA] and a hydrogen sulfide [H2S] gas detector) from a two-inch valve on the side of the Fuel Gas Mix Drum just before 6:39 p.m. This valve normally had a blind flange bolted on the discharge end during refinery operation. These BP employees removed the blind flange from the two-inch valve in order to release liquid from the Fuel Gas Mix Drum.

At 6:39 p.m., likely as a result of naphtha releasing to the ground and vaporizing, a flammable gas detector near the Fuel Gas Mix Drum indicated 100 percent of the lower flammability limit (LFL). This detector only alarmed locally, not in the control room. The CSB determined the alarm had been inadvertently disabled to the DCS, and therefore only the local alarm horn and lights were functional at the time of the incident, although the DCS console did provide an analog reading of the percent of LFL. The alarm horn for the detector was audible in the background of a radio transmission at 6:40 p.m., but there was no evidence that anyone inside the control room was aware the two BP employees were releasing liquid from the Fuel Gas Mix Drum to the ground.

A worker standing nearby saw the two workers near the Fuel Gas Mix Drum along with a visible vapor cloud, stating to the CSB in an interview after the incident:

“It looks like someone is draining product from the mix drum. And I seen water being sprayed on it. […] I saw product coming out of the drain. It was like somebody was draining it to the sewer. They laid something on…to kind of deflect the stuff spraying out, so it’ll stay […] going into the sewer, instead of spraying everywhere. So, at first, originally, I thought it was a flange or something had let loose. But, no, it was somebody was draining it. And strong, strong smell. And I saw that vapor cloud coming from it […] I decided to back up and I […] stepped back about 20 feet and then it went boom. “

An approaching rainstorm shifted the wind, which likely directed the vapor cloud toward the nearby Crude 1 Furnace, the likely ignition source. The vapor cloud ignited at 6:46 p.m.

As a result of the incident, CSB’s investigation identified the following safety issues:

Liquid Overflow Prevention. Although the BP Toledo Refinery conducted Hazard and Operability Studies, a process hazard analysis (PHA) methodology, to assess the risk of liquid overflow events and identify safeguards, the refinery did not have sufficient safeguards to prevent the initiating event. In some cases, the BP Toledo Refinery relied on human intervention to respond to process upsets and deviations.

Despite the BP Toledo Refinery’s reliance on human intervention as an identified safeguard for overflow of the Absorber Stripper Tower to the Fuel Gas Mix Drum, the refinery did not adequately consider potential hazards that could exist if the drum contained high levels of flammable liquid (such as naphtha) that needed to drain. Nor did the BP Toledo Refinery have procedures, written instructions, or documented corrective actions for operators to respond to or troubleshoot a high liquid level in the Fuel Gas Mix Drum during either normal operations or process upsets if liquid entered the drum.

Furnace safety instrumented systems and emergency pressure-relief valves also listed as safeguards in the BP Toledo Refinery’s PHAs for overflow of the Absorber Stripper Tower to the Fuel Gas Mix Drum, but neither were effective in preventing liquid overflow to the fuel gas system. Additionally, the industry lacks sufficient guidance on protective systems for a Fuel Gas Mix Drum despite it being an integral part of a refinery’s fuel gas system.

Abnormal Situation Management. An abnormal situation is a process disturbance with which the basic process control system cannot cope. Abnormal situations can create a stressful environment for the operators. If abnormal situations are not effectively managed, they can escalate into a more serious incident. In its book, Guidelines for Managing Abnormal Situations, the Center for Chemical Process Safety (CCPS) states: “[s]udden, potentially dangerous situations can affect human performance (the “startle” factor), leading to a “fight or flight” response that can lead to inappropriate action being taken.” In the 24 hours leading up to the incident, the BP Toledo Refinery experienced a number of abnormal situations across several units, escalating to overfilling the Fuel Gas Mix Drum. This prompted two BP employees to release the Fuel Gas Mix Drum contents to the ground, ultimately cascading to the vapor cloud, fire, and fatal injuries.

Alarm Flood. Board operators at the BP Toledo Refinery were receiving far more than 10 alarms in 10 minutes on average, a situation in which more alarms were annunciating than a human can effectively respond to, for nearly 12 hours preceding the incident. Between 6:50 a.m. and 6:49 p.m. on September 20, there were 3,712 alarms recorded. Continued operation in an alarm flood state contributed to the incident by causing delays and errors in responding to critical alarms and shift-to-shift communications. Had the Tuesday, September 20, night shift board operators been less overloaded with alarms, they might have identified the Coker Gas Plant Absorber Stripper Tower was overflowing naphtha through the Coker Gas Plant bypass piping directly to the Fuel Gas Mix Drum and stopped liquid flow to the Fuel Gas Mix Drum, preventing or mitigating the incident.

Learning from Incidents. The final recommendation of the report of the BP U.S. Refineries Independent Safety Review Panel in 2007 (“the Baker Panel Report”) stated: “BP should use the lessons learned from the Texas City tragedy and from the Panel’s report to transform the company into a recognized industry leader in process safety management.”

In its investigation of the September 20 naphtha release and fire, the CSB found similarities between the overflow events of the BP Toledo Refinery incident and the findings from the fatal explosions in 2005 at the BP refinery in Texas City, Texas. Catastrophic incident warning signs existed prior to the September 20 incident at the BP Toledo Refinery, and had BP effectively recognized and acted upon the warning signs following a 2019 incident, the company could have provided more effective safeguards to prevent the overflow of multiple vessels during a refinery upset such as the September 20 incident.

Click here for more on the report.


Pin It on Pinterest

Share This