Investigation Report on the Fire at Avon Refinery of Tosco Company in the United States
Thread Content
1 Background on the Avon Refinery? 1.1 Overview of the Avon Refinery? The Avon Refinery is located in Martinez, Contra Costa County, California, USA, covering an area of approximately 2,300 acres (931.5 hectares). This factory has a production history of over 80 years; it mainly produces engine fuels such as gasoline and diesel, while its other products include propane and gas. Tosco managed the plant from 1976 to 2000, after which it was acquired by UDS (Ultramar Diamond Shamrock) and renamed Golden Eagle Refinery. Tosco is the largest gasoline product refining company in the United States, operating 7 large-scale refineries across the country. 1.2 Avon Refinery Distillation Unit? The crude oil unit at the Avon Refinery was designed and constructed in 1946. Crude oil distillation is the initial step in the refining process; it separates crude oil into various fractions based on their boiling points, including natural gas, naphtha, kerosene, diesel, and heavy oil for use in cracking units. The process operates continuously, with crude oil being steadily pumped into the processing unit, and the products or fractions being continuously pumped into containers or other refining units for further processing. ? 1.3 Avon Refinery Naphtha Unit? The naphtha from the Avon Refinery enters the naphtha buffer tank through 6-inch (152.4 mm) steel pipes at the top of the distillation tower (112 feet/34.1 m high), and from there it is pumped into storage units or other refining units for further processing. This buffer tank is used to extract lighter hydrocarbons from naphtha. ? 2 Incident Overview? On February 10, 1999, at the Avon refinery of Tosco Company in Martinez, western California, a pinhead-sized leak was discovered at the first bend in the naphtha pipeline located on a distillation column about 112 feet (34.1 meters) above the ground level; naphtha dripped onto the distillation tower. The emergency response team decided to do their best to seal the pipeline without stopping the plant in order to slow down or stop the leak; as a result, the operators reduced the pressure in the distiller, closed four isolation valves to separate the pipeline, and partially opened the bypass valves to keep the crude oil unit operating. After removing the insulating asbestos from the pipelines, an inspection of the naphtha pipelines revealed that they were excessively thin due to corrosion; as a result, it was decided to replace most of the naphtha pipelines. Within 13 days of the leak being discovered, workers tried to isolate and drain the naphtha pipeline, but without success; leaks caused by small holes occurred three more times, and even after tightening the isolation valves again, it was not possible to isolate the pipeline. The Tosco supervisors continued to arrange for the pipeline replacement. Over the following 13 days, for emergency repairs, operation supervisors and safety officers approved and issued 15 work permits, of which only 11 met the requirements of Tosco Company’s operating procedures. During the 10–14 days of maintenance, the naphtha buffer tank experienced 7 instances of high liquid levels. Each time, the operators reduced the liquid level by opening the flow control valve for naphtha storage. On the last occasion, they kept the valve open to allow naphtha to flow directly into the storage tank, in order to prevent another rise in liquid level; the valve remained open until the fire broke out. ? On the 23rd, there were approximately 90 gallons of naphtha in the pipeline (which is about 408.6 liters when converted using US gallons). The maintenance crew was tasked with emptying and removing the pipeline, but several attempts at emptying it were unsuccessful. The Tosco maintenance supervisor determined the liquid level by listening to the sound coming from the cut area; believing that the naphtha level was below the shut-off point, he ordered the workers to use a pneumatic saw to cut the pipeline (with the cut face facing the distillation tower). Leakage of naphtha began shortly after the cut, and the supervisor instructed the workers to open the flange in order to drain the liquid, while also using pipe clamps to stop the leakage. The workers did not consider that the naphtha pipeline could be subjected to pressure from the operating unit through the isolation valves that leak due to severe corrosion. At around 12:18 p.m. on that day, as the pipeline was being emptied, a large amount of naphtha sprayed out and was immediately set on fire. The flames quickly consumed the distillation column itself as well as the 5 workers at various heights within the column. Upon noticing that the naphtha had caught fire, the other operators on site immediately activated the fire suppression system and shut down the operation unit urgently. Within a few minutes, Tosco’s emergency response team arrived at the scene of the accident, followed by the fire department from Contra Costra County, which also came to assist with the rescue efforts. The fire lasted for about 20 minutes. The scale of the fire, the risk of re-ignition, and the location of the victims on the tower limited rescue efforts. The fire resulted in 4 deaths and 1 person suffering severe injuries (from falling due to jumping into the flames from a height). Of the 4 deceased, 2 were employed by a scaffolding construction company, 1 was part of the crane crew, and 1 was a maintenance worker. Another repair worker was also seriously injured. ? 3 Investigation Process? Given the severity of this accident, and the fact that a similar incident had occurred at this plant in 1997, the CSB (U.S. Chemical Safety and Hazard Investigation Board) conducted an investigation into this incident. The agencies also conducting an investigation into this accident are the California Department of Industrial Relations (i.e., the California branch of OSHA) and the Health Services Agency of Contra Costa County. The CSB accident investigation team cooperates with these two agencies. ? The CSB inspected the scene, interviewed relevant personnel, and reviewed relevant documents. CSB also signed a contract with the Hendrix group in Houston to assist with comprehensive analysis of corrosion and mechanics. API (American Petroleum Institute) and NPRA (National Petroleum Refining Association) provide information on safe practices in refinery maintenance work; at the request of CSB, these two organizations also prepared a work approval report for refineries. ? 4 Key Findings of the Accident Investigation? 4.1 The process units were still in operation while workers were performing maintenance; many of these units were hot, with the hottest one being only 3 feet away from the workers who were handling the pipelines. It is likely that the leaking naphtha came into contact with the hot surfaces of the nearby distillers, which led to the fire. ? 4.2 The substitution of the naphtha pipeline in the process route involves many risk factors. This unconventional work requires that pipelines carrying naphtha be moved at least 100 feet (30.4 m) away, as it is a highly flammable liquid. When workers are performing mobile tasks at a height of 112 feet (34.1 m) above the ground, their options for escaping hazards are limited. ? 4.3 Before the accident, the naphtha pipeline was leaking from the initial pinhole defect; it felt slightly warm to the touch, indicating that there were other isolation valves leaking as well. Multiple attempts to drain the piping system were unsuccessful, indicating that some of the pipes are severely blocked. ? 4.4 During repairs carried out by workers and maintenance supervisors, the naphtha pipeline containing flammable liquids was cut open. Although Tosco’s operating procedures require draining, depressurizing, purging, and flushing the pipeline before opening it, the pipeline was blocked and the naphtha could not be drained; the procedures do not provide any alternative methods or safety measures for such situations. Although the hot process equipment is located near the maintenance site, Tosco’s company procedures and safety regulations do not address hot surfaces as potential hazards, nor do they take into account the danger posed by benzene in naphtha. ? 4.5 Controlling the opening of the bypass valve that regulates the naphtha flow, as well as preventing leaks in the isolation valves, is necessary to ensure that the pipelines cannot be disconnected from the process unit. The process unit exerts pressure on the naphtha pipelines, which leads to corrosion of the valve seats; excessive corrosion products and water cause blockages in the pipelines. ? 4.6 Tosco’s operating procedures do not specify a requirement for conducting a hazard assessment on the replacement naphtha pipelines; pipeline maintenance work is classified as low-risk maintenance. ? 4.7 The operation supervisors and other safety personnel do not frequently visit the workshops to inspect work, and the on-site operation supervisors also fail to examine and assess the qualifications of workers carrying out non-standard tasks. The EPA (U.S. Environmental Protection Agency) also believes that the lack of operational supervision and inspection under abnormal conditions was one of the reasons for the pyrolysis fire and explosion that occurred at the plant in 1997. ? 4.8 During the three years prior to the accident, neither Tosco’s safety team nor Avon Plant’s equipment management department reviewed the inventory of equipment on the refinery’s production lines. ? 4.9 Tosco failed to conduct a management evaluation of process changes when assessing potential hazards associated with such changes, and these process changes include crude oil desalting and dehydration. The management was aware of the operational issues and corrosion problems associated with these processes, but failed to implement corrective measures in a timely manner to prevent blockages and excessive corrosion of the naphtha pipelines. ? 4.10 It is an unsafe decision on the part of the operation supervisors to require the replacement of all pipelines, as there are no shut-off valves on the naphtha vapor reflux line ； Moreover, the pipeline replacing the fractionator with the horizontal control valve is safe, as it has a block valve and an evacuation line. ? 4.11 The MSDS (Material Safety Data Sheet) for Tosco naphtha indicates that its auto-ignition temperature is 450 degrees Fahrenheit (approximately 232.2°C), but the lower part of the crude oil distillation tower operates at temperatures between 500–600 degrees Fahrenheit (260°C–315.6°C). Since this tower lacks insulation, its surface temperature is just slightly below these operating temperatures, which is sufficient to ignite any leaked naphtha. 5 Analysis of accident causes? Maintenance work in refineries always involves risks of fire and poisoning; careful control is necessary to prevent harm to people and damage to the environment. During the investigation into the Avon refinery accident, the CSB identified issues in areas such as work plans, hazard identification and assessment, isolation procedures, inspection management, work permits, corrosion control, and Management of Change (MOC). CSB analyzed the accident using several investigation methods, including creating time tables and logical tree diagrams. ? 5.1 Dangerous unconventional maintenance? Since unconventional maintenance is unplanned and falls under the category of emergency repairs, it can give rise to various unexpected dangers. ? On-site, dangerous non-routine maintenance includes activities such as hot work, hot plugging, as well as the damage to pipelines when isolation and evacuation cannot be ensured. OSHA’s PSM standard was issued following the fire and explosion at the Phillips Houston Chemical Complex in 1989, which resulted in 23 deaths. ) The appendix emphasizes the importance for staff to identify risks associated with unconventional repairs in their work. ? 5.2 Work Plan? The operating procedures of the Avon refinery specify that on-site inspections prior to maintenance, as well as discussions and analyses among the person in charge of the maintenance site, the planners, the maintenance supervisors, and the operation supervisors, are necessary; however, these steps were not taken in this incident. Preparatory work such as insulating the vessel walls and checking the pipelines began immediately after the leak occurred, without any planning process. ? One hour after the leak was discovered, the operator removed the insulation from the naphtha pipeline; this work was carried out without reducing pressure or isolating the pipeline. However, Tosco’s operating procedures specify that if the pipeline is not isolated, representatives from production, H&S, inspection, and maintenance must meet to discuss the safety procedures for removing the insulation. If the unit operation is still in progress but the insulation layer has not been completely removed, the pipeline must be shut off or the unit operation stopped. During this maintenance process, although inspection, repair, and operation supervision personnel were on site, no meetings were held to discuss hazard control, nor was the procedure for removing the insulation followed. Although this did not directly cause a fire, it shows that the plant’s managers did not consistently adhere to the established maintenance procedures in their daily work. ? Most of the maintenance work was carried out within 13 days before the accident; it was not included in the work plan documents. There was no mention that benzene-containing naphtha posed a serious health risk and required special preventive measures, nor was there any reference to the need for specialized equipment such as cranes, pneumatic saws, or empty tank trucks (used to contain the discharged materials) when removing the pipelines. There are also no specific instructions for the maintenance work; necessary information is lacking, such as the MSDS for naphtha, diagrams of pipelines and instruments, as well as best practice recommendations for carrying out the maintenance. It is necessary to outline the required steps for completing the work and to identify the potential hazards associated with each step. Maintenance work should be carried out only after careful analysis and consideration of the planning and repair methods. ? 5.3 Hazard Identification and Assessment? 5.3.1 Hazards associated with specific tasks? There were significant risks of accidents during the 13-day maintenance of the naphtha pipeline:? (1) When removing 100 feet (30.4 m) of 6-inch (152.4 mm) pipes, these pipes contained flammable naphtha. ? (2) The surface temperature of the lower half of the distillation tower exceeded the auto-ignition point of naphtha. ? （3） When fully tightened, the bottom of the shut-off valve and the upper part of the level control valve of the naphtha buffer tank protrude by 12 threads, which indicates that the valve is partially open and there may be a blockage. ? (4) There is a missing outlet at the bottom of the control valve, making it difficult to remove the naphtha in the pipeline. ? The Tosco plant classifies naphtha pipeline repairs into low-risk and routine repairs. The management failed to identify or assess the risks associated with the inability to isolate or empty operational units during operation, as well as other hazards; it is evident that the plant does not have a sufficient understanding of the risks involved in maintaining naphtha pipelines. ?
5.3.1.1 Unable to isolate? From February 10 to 14, there were 7 leaks in total, and each time the valves were tightened further in an attempt to stop the leaks. On the 13th, the duty officer noticed that the liquid level in the naphtha pipeline had dropped, suspecting a leak in the isolation valve. At the same time, the naphtha pipeline was warm to the touch at the leakage site, further confirming that the isolation valve was leaking (as the operating process unit is hot). ? 5.3.1.2 Unable to empty? Emptying the hazardous substances from equipment and pipelines and isolating them is a necessary condition to ensure safety during maintenance. From the discovery of the leak to the outbreak of the fire, seven attempts to empty the naphtha from the pipeline failed. The supervisors and operators at Tosco also became aware of the following issues: (1) On the 16th, an operator informed the site supervisor that the naphtha pipeline was blocked. On the 17th, the two operators discussed the pipeline blockage issue with the operation supervisor; the operators suggested shutting down the unit operation to repair the pipeline. ? (2) On the 18th, the supervisors arranged for maintenance workers to drill holes in the drainage pipeline, but several attempts at drilling were unsuccessful, and the blockages inside the pipe damaged the drilling tools. ? 5.3.1.3 Other hazards? Operators and supervisors are unaware that naphtha contains benzene. Since benzene is a toxic substance, Tosco’s operating procedures require it to be contained in sealed containers, kept away from anyone. Maintenance work involving benzene requires a special work permit, but the supervisors failed to recognize the risks associated with benzene during the repair of naphtha pipelines and did not implement any controls. Although this did not directly lead to a fire, it shows that Tosco’s management did not consistently adhere to the procedures. ? Pipeline relocation work requires coordination among operators and technicians from different departments and teams, and cranes are also used during the operation; as a result, these workers may be exposed to the risk of sudden release or spraying of flammable liquids, with opening the upper pipelines being particularly dangerous. Although supervisors and workers were aware of the severity of these hazards prior to the accident, no preliminary assessment of these risky operations was conducted, nor did the management develop any plans to control these hazards. ? 5.3.2 Good Practice Guidelines for Maintenance Work? Hazard assessment is a formal analytical method used to identify and detect potential hazards associated with processes or operational activities. Hazard assessment helps management control hazards and prevent accidents. Given that hazard assessment provides valuable practical guidance, the American Society of Chemical Engineers states that for maintenance operations involving multiple steps such as isolation, preparation for maintenance, and removal, hazard assessment methods are highly useful due to the numerous dangers and operational challenges that often arise. ? Essential elements for hazard assessment of maintenance tasks:? (1) Predicting hazardous activities, such as hot work, repairs, etc. ? (2) Environments where it is difficult to follow procedures, or work environments without available procedures. ? (3) Areas where safety measures are insufficient, such as the control of ignition sources in locations with flammable materials. ? (4) Identify the specific hazards that may arise during the execution of specific maintenance tasks. ? (5) Identify potential problems during isolation, such as pressure drop, evacuation, clogging, etc. ? (6) Additional preventive measures, such as: more monitors, isolation, improved supervision and management, and strict project planning. ? (7) The feasibility of safe operation when the task is in progress or needs to be delayed. ? 5.3.3 Lessons from Similar Accidents? The fire that occurred in the BP Grangemouth refinery in Scotland in 1987 is very similar to this incident; if the personnel at the Avon refinery had carefully analyzed and learned from the lessons of the Grangemouth fire, it is believed that this tragedy could have been avoided. ? 5.4 Decision to carry out isolation of unit operations? Due to inadequate work plans and risk assessments, the management at Tosco Avon Refinery failed to recognize that the safety procedures for maintaining naphtha pipelines required the isolation of relevant unit operations. It was only when supervisors and workers realized that the line could not be emptied or isolated that they understood the need to shut down the control unit. CSB believes that the shutdown and startup of refinery process units carry significant risks in themselves, but maintenance procedures require that operations be shut down promptly when severe hazards cannot be controlled or delays are not acceptable. Since the pipeline needs to be replaced immediately, the work cannot be delayed. During the evaluation of effective repair methods, CCPS (Chemical Process Safety Center) advises management to carefully consider whether it is necessary to completely shut down operations in order to carry out safe repairs to the facility. ? 5.5 Management and Supervision? 5.5.1 Description of Hazardous Operations? Despite the significant risks associated with this maintenance work, Tosco’s management treated the naphtha pipeline maintenance as a low-risk task. Operation supervisors rarely participate in plan formulation or in monitoring line maintenance, and no second-level managers or other experts are involved in hazard assessment. Although inspectors are involved in the formulation of plans or decisions, their authority to make decisions and give recommendations is limited. Management oversight and documentation are essential elements of an effective PSM program; the management system should include the establishment of responsibilities, evaluation of outcomes, the creation of a feedback system, and audits. At the request of CSB, API and NPRA prepared a document regarding the conditions for issuing permits for maintenance operations in the refining industry. It specifically addresses the approval process for permits in situations involving high risks, such as work at high temperatures or operations on leaking production lines, and calls for improved management in these areas. Based on the level of risk, certain tasks require approval from at least second-level safety personnel and managers. Jobs with a higher risk level may require the involvement of a risk management team in the assessment; team members should include labor managers, safety officers, maintenance staff, engineers, as well as personnel from metallurgy and other departments. The specific composition of such a team will depend on the nature of the work involved. 5.5.2 Supervision? Conducting dangerous unconventional repairs requires strict supervision. According to the operation supervisors at the Avon refinery, they checked the performance of the process units only when necessary. On the morning of the accident, the operation supervisor did not carefully inspect the relocation of the naphtha pipeline, and the operation supervisor responsible for coordinating the repairs was not at work on the day of the accident. ? There were no health and safety personnel at the work site before the accident occurred; on the day of the accident, only the maintenance supervisor was present at the maintenance site as the representative in charge. ? During the maintenance of the naphtha pipeline, many actions deviated from Tosco’s operating procedures; although the following situations did not directly cause an accident, they revealed serious management problems at the plant. ? (1) Naphtha was not considered to be a benzene-containing substance that poses a threat to health. The maintenance work was not carried out in accordance with Tosco’s procedures for handling benzene; there was no permit for working with benzene, no safety precautions were taken, no engineering controls were implemented, no area designated for managing benzene leaks was established, no plan for dealing with benzene leaks was prepared, and no personal protective equipment (PPE) was provided. ? (2) The work permit does not include authorization for the use of empty tank trucks and pneumatic saws. ? (3) The safety permits for several naphtha pipeline maintenance tasks lacked the signature of the duty officer. ? The EPA noted after investigating the accident at the Grangemouth refinery that inadequate supervision was a contributing factor to the incident. Under dangerous abnormal conditions, insufficient supervision can lead to a series of operational problems as well as accidents. ? 5.5.3 The power to reject violations? Workers who participated in the pipeline repairs afterwards said in interviews that they felt pressured to carry out their tasks correctly, as the crude oil unit was operating at that time; moreover, the presence of tank trucks, cranes, and various temporary workers on site also exerted considerable pressure on them. ? The Tosco management said that workers have the right to stop unsafe working practices, and they should have stopped the pipeline replacement work. However, there are significant concerns about stopping the work: (1) During the execution phase, managers usually exert considerable pressure to complete the tasks as quickly as possible. ? (2) Refusing to carry out illegal operations relies on individual workers taking the lead; to stop working, workers need to negotiate with supervisors for a long time. ? (3) Due to the use of temporary workers and external equipment, once work begins it represents consumption of these resources, so it must be completed as soon as possible and on time. ? 5.5.4 Audits? The safety audit procedures at the Avon Refinery include unwritten observations. In 1995, Tosco developed a written PSM audit procedure. However, in the three years prior to the accident, neither Tosco Company nor the management of the Avon plant conducted any written reviews of the pipeline damage and related records. ? The Tosco review process did not document or correct any serious deviations from safety procedures during maintenance work; such deviations included: ? (1) Opening pipelines containing flammable liquids before draining them. ? (2) A pipeline containing flammable liquid was opened in the vicinity of the ignition source. ? (3) Failure to insist on using blind plates for isolation. ? (4) Lack of supervision and inspection over violations. ? (5) Failure to consistently use MOC to evaluate process changes. ? Safety audits serve as a necessary feedback mechanism for the safety conditions within a factory; effective audits can identify areas where the factory fails to follow established procedures, allowing these issues to be addressed before accidents occur. ? 5.6 Licensing Systems and Pipeline Damage Procedures? 5.6.1 Confusion Regarding Operational Licenses? The plant’s written procedures stipulate that before opening pipelines or equipment, it is necessary to reduce pressure, empty them, and clean out any chemicals as much as possible. The issuance of work permits is generally entrusted to safety officers ； However, some of the more hazardous types of work require approval from a duty supervisor or an expert from the health and safety department; such hazardous tasks include working in confined spaces, starting up production lines with flames, performing X-ray operations, and being exposed to toxic environments. ? On the day of the accident, the permit specified different requirements for three task lists, grouping \"emptying\" and \"removing\" together, and approved these two operations. ? Deviation procedure: ? (1) Dangerous unconventional operations were carried out after a work assessment or permission from the operation supervisor, with permits issued by safety officers. ? (2) Neither Tosco’s operating procedures nor the work permits clearly state that ignition sources must be eliminated or controlled before opening the device. ? (3) For open pipelines, no emergency measures have been established in case the planned steps fail. ? 5.6.2 Inadequate procedures? Neither the Tosco operating procedures nor the work permits address the danger of flammable materials in open containers, nor do they explain the ignition effect of hot surfaces. Process safety experts at the plant emphasized that combustible liquids should not be stored in open containers in process plants, as there are many potential ignition sources. Additionally, another potential hazard is the transfer of the discharged naphtha to empty tank trucks, which are parked about 20 feet (6.08 m) away from the distillation tower; Tosco does not specify any requirements regarding where such vehicles should be parked. Based on practical experience, vehicles used to transport flammable liquids are not allowed to get that close; they must be at least 100 feet (30.4 m) away from any ignition sources. ? The potential danger posed by static electricity is another issue. The company’s operating procedures also do not provide any explanation on this matter. Before the accident, plastic drums were commonly used at the production site to hold the naphtha drained from the rings near the distillation tower. Static electricity is generated when flammable liquids are poured into plastic barrels, and liquid splashing can also produce static electricity. 5.6.3 *Inherent violation? Failing to empty the pipeline before opening it is an *inherent violation, as during the repairs a few days earlier, the device was left on while emptying. ? The company’s operating procedures also specify that the device must be emptied before it is turned on or before using a pneumatic saw. ? According to witnesses, the plant’s process unit opened the collar in order to discharge flammable liquids into open containers or the ground. The company’s operating procedures stipulate that flammable materials should be emptied through a closed system to prevent them from coming into contact with ignition sources. Furthermore, using a collar to drain flammable liquids from an operating process unit in the presence of ignition sources is a very unsafe practice, as it makes it impossible to control the speed and direction of the fluid. ? 5.7 Corrosion Control and Mechanical Maintenance? 5.7.1 Desalination Process? Crude oil desalination is the main process used to reduce corrosion and blockages in process equipment. The accelerated corrosion of the naphtha pipeline is mainly due to a decrease in desalination efficiency, which allows excessive amounts of water and corrosive substances such as inorganic salts to enter the distillation tower. ? In the year before the accident, the API gravity of crude oil averaged a decrease of 27.2%; the heavier the oil, the lower its API gravity, which increased the difficulty of separating oil from water and affected the desalination efficiency. ? Before the accident, there were two reports within the refinery regarding improvements to the desalination process, but they were not adopted by management. ? (1) In September 1998, a report recommended the use of better crude oil dehydration processes; it stated that when the gravity of the filler dropped to 18%, corrosion would occur more rapidly, especially in the naphtha pipelines at the top of the distillation tower, which could even lead to more serious accidents. ? (2) In November 1998, another written presentation showed that the company’s management had proposed several improvement methods for research and evaluation, including reinstalling desalination units in Unit 4 and improving the automated control system. Although the company’s management was aware of the process issues related to desalination, they failed to conduct appropriate inspections of the equipment, nor did they implement any further methods to improve the process. ? 5.7.2 Corrosion? The operation records of the refinery show that in early May 1998, the naphtha level control valve was blocked by solid corrosion deposits, which restricted the flow rate of the material. Due to corrosion, the bypass valve was already partially open for at least 10 months prior to the accident. Analysis of various residues in the pipelines revealed a high chlorine content; these corrosive salts entered the fractionation towers and naphtha pipelines. The mixture of these corrosive salts with water accelerated the oxidation process, which directly led to initial leaks, pipeline blockages, and corrosion of the bypass valves. CSB investigators believe that the naphtha pipeline was clogged by compounds of iron oxide, ammonium chloride, and sulfur. These are all corrosive materials or corrosion products. ? 5.8 Process Change Management? The procedures at the Avon Refinery require an MOC evaluation for filler changes. In December 1998, the packing ratio of the desalinator increased by 55%-80% compared to the design value. The lack of MOC evaluation for the filler change led to corrosion and blockage in the naphtha pipeline. ? The management department also failed to conduct an MOC evaluation regarding the operational changes related to the bypass valves that remained in the open position for extended periods; such an evaluation should have included an assessment of whether the bypass-related components around the facility were in proper condition. The lack of such an evaluation led to blockages caused by solid substances in the bypass valves and associated pipelines, as well as corrosion of the valve seats and control panels. ?
6 Causes of the accident? 6.1 Root cause? 6.1.1 During the maintenance of the crude oil unit, the process unit was still in operation; the maintenance managers at Tosco Company and Avon Plant failed to realize the serious dangers that could arise from such abnormal operations. ? (1) The management failed to recognize the dangers posed by hot surfaces, valve leaks, blocked pipelines, and the inability to drain naphtha. During the task planning phase, no risk assessment was conducted, which resulted in the failure to implement appropriate risk control measures when carrying out the tasks. ? (2) The management department does not have a comprehensive plan; by involving various working groups and senior management, it may be possible to safely disconnect the maintenance unit from the operating process units before carrying out repairs. ? (3) Tosco does not ensure that supervisors and safety personnel remain at the site where abnormal operations are carried out; Tosco relies on individual workers to carry out inspections, and such a management approach as a substitute for performing dangerous tasks is ineffective. ? (4) Tosco’s operating procedures do not specify that hot surfaces and other ignition sources must be controlled before opening equipment containing flammable materials, nor do they indicate what measures should be taken when safety requirements such as proper drainage cannot be met. 6.1.2 During maintenance and process changes at the Avon refinery, the safety management inspection system failed to detect or correct serious defects. ? (1) Neither Tosco Company nor the management of the Avon plant conducted audits of the process equipment records within three years prior to the accident, and failed to address certain potential hazards that could lead to accidents. ? (2) Disengagement of the safety interlock system. ? (3) The pipeline containing flammable liquid was opened before draining. ? (4) Lack of supervision and inspection over hazardous operations. ? (5) The ledger is not used frequently. ? (6) MOC opinions are not frequently used during process changes. ? 6.2 Immediate causes? 6.2.1 The management of this refinery failed to conduct an MOC assessment for the process change, which led to rapid corrosion of the naphtha pipelines. Process changes include: (1) crude oil desalting beyond design parameters ； (2) The crude oil supplied contains excessive water ； (3) When the bypass valve was partially open, the control of the naphtha level was delayed. ? These changes led to rapid corrosion of the naphtha pipelines and bypass valves, thereby causing problems with the transportation and drainage of naphtha. ? 6.2.2 The corrosion control system in the crude oil unit is inadequate? The cause of leaks in the naphtha pipelines is corrosion. Due to incomplete desalination, the presence of ammonium chloride caused severe corrosion and leaks in the naphtha pipelines. The blockage of the outlet valve on the naphtha pipeline control valve ring and the corrosion of the bypass valve are both contributing factors to the occurrence of accidents. The corrosion of the bypass valve exacerbated the consequences of the accident. ? Although the management at the Avon refinery was aware that operational issues in the naphtha production line would accelerate corrosion, they failed to take timely action to prevent blockages and excessive corrosion of the pipelines. ? 7 Recommendations? 7.1 Recommendations for Tosco Company? 7.1.1 The company should conduct regular comprehensive safety inspections of the refineries it operates. ? The inspection items include: (1) Non-routine maintenance tasks ； (2) Management supervision and safety instructions ； (3) Management transformation program ； (4) Corrosion control. ? 7.1.2 Prepare a written report on the inspection, including the problems identified and recommendations; discuss these with the employees at the factory, and evaluate the suggestions and opinions. ? 7.2 Recommendations for Golden Eagle Refinery? 7.2.1 Implement the following procedures to ensure the safe conduct of non-routine maintenance tasks:? (1) Conduct written risk assessments by multiple departmental teams, and prepare a feasible work plan before carrying out the tasks. ? (2) The person in charge of the task should have a higher level of management skills. ? (3) Safety personnel and supervisors must remain at the work site at all times to ensure the safe progress of the work. ? (4) The work procedures and operation permit evaluation processes identify the specific hazards that may arise, and can explain the safety measures required, such as controlling ignition sources and removing combustible materials. ? (5) A regular evaluation procedure shall be established to document the identified problems and recommendations, and to propose corrective actions. ? 7.2.2 Ensure that an MOC assessment is conducted during process changes. ? 7.2.3 It is necessary to ensure that the corrosion management procedures enable effective control of the corrosion rate before process equipment is damaged or blocked, otherwise it will affect safety.
The above is a third-party investigation report; it is very detailed and highly valuable for us to learn from and draw lessons from!
It’s really good; the analysis is thorough and worth learning from*:lol