April 26, 2018. The Superior Refinery in Superior, Wisconsin. A large explosion erupted during a maintenance shutdown, puncturing a tank of asphalt that spilled into the refinery. The asphalt later ignited a fire.
causing a huge fire. The incident injured 36 workers, caused roughly $550 million in damage to the facility, and released 39,000 pounds of flammable hydrocarbon vapor into the air. Over 2,500 residents of the city of Superior were evacuated from their homes, and the city of Duluth, Minnesota issued a shelter-in-place order. Refinery shutdowns, as well as startups, can be particularly dangerous because processes are not in normal operation mode.
Our investigation found that critical safeguards were not in place during this shutdown, and that the procedures followed at the refinery were not correct. The result was a massive explosion and fire that injured dozens of workers, caused hundreds of millions of dollars in damage, and threatened the surrounding communities. The explosion and fire thankfully didn't compromise a nearby storage tank that contained highly toxic hydrofluoric acid.
But the CSB considers this incident to be a serious near-miss involving HF. If hydrofluoric acid had been released, this could have been much worse. Shortly before 6 a.m.
on the day of the incident, Operators took steps to shut down the refinery's fluid catalytic cracker, or FCC unit, for periodic maintenance and inspection. The FCC unit uses heat and a solid catalyst to break or crack heavy hydrocarbons. from crude oil into smaller hydrocarbons, which can then be blended into gasoline and other products.
Slide valves control the flow of catalysts between a reactor, which contains flammable hydrocarbons, and a regenerator, which contains flammable hydrocarbons. which contains air. It is always critical to prevent mixing of the hydrocarbons and air because a dangerous flammable mixture can form.
Under normal operation, the catalyst circulates continually between the reactor and regenerator through a carefully controlled balance of pressure. To initiate the shutdown of the FCC unit, refinery workers stop the flow of hydrocarbons to the reactor and close the two slide valves connecting the reactor to the regenerator. Circulation of the catalyst stopped, but one of the two slide valves was eroded. Catalyst from the reactor fell through the valve to the regenerator, leaving an open path for air or hydrocarbons to flow between the two pieces of equipment. Without other critical safeguards in place, air from the regenerator flowed backwards through the slide valve into the reactor.
The air then moved into the main column and other equipment downstream of the reactor. where it formed a flammable mixture with hydrocarbons. At approximately 10 a.m., the hazardous mixture of air and hydrocarbons found an ignition source, and there was a large explosion.
Debris from two vessels flew into the air. One piece traveled about 200 feet and hit a large above-ground storage tank, puncturing the side of the tank and releasing hot asphalt. Asphalt poured out of the tank over the containment berm and into the refinery's opposite arm, operating units where it spread along the ground.
At around 12 p.m., the released asphalt ignited at the storage tank and a fire broke out. The fire traveled along the stream of asphalt to the refinery's crude and FCC units. The fire produced a huge plume of black smoke, leading to the evacuation of a portion of the city of Superior.
Typically, this type of asphalt fire can burn for days. A plan to extinguish the massive asphalt fire was developed by the refinery's emergency response team. The refinery began to address the fire together with the Superior Fire Department. They used a combination of dry chemical fire extinguisher and water to attack the fire from multiple directions and surround it within a containment area. With the fire contained, emergency responders were able to put out the asphalt fire at around 7 p.m.
The asphalt fire had been extinguished in a matter of hours, as opposed to days as had been initially anticipated. The evacuation order was lifted, and superior residents were allowed to return home. Nevertheless, 36 Husky employees and contract workers sought medical attention for injuries.
The Chemical Safety Board launched an investigation and identified six safety issues that led to the explosion and fire. They are transient operation safeguards, process knowledge, process safety management systems, industry knowledge and guidance, brittle fracture during extreme events, and emergency preparedness. The first safety issue is transient operation safeguards.
At the time of the incident, the Superior Refinery was shutting down the FCC unit. Shutdowns, like startups, standbys, and emergencies, are known as transient operations, meaning activities that take place outside of normal process operations. Transient operations can pose unique hazards that are not present during normal operations.
An FCC unit presents atypical hazards during transient operations because air and flammable hydrocarbons are present within interconnected equipment, which increases the likelihood of an explosion. Therefore, during the shutdown of an FCC unit, certain FCC-specific safeguards must be in place to ensure that air and hydrocarbons do not mix. But the CSB found that at the Superior Refinery, these safeguards were not implemented.
or were ineffective. One such safeguard is to create a reactor steam barrier. This is done by injecting a large amount of steam into the reactor, creating a higher pressure in the reactor than in the connected equipment. This prevents air from the regenerator from flowing into the reactor, where it can then enter the main column and other equipment on the hydrocarbon side of the process. However, Superior Refinery's shutdown procedure did not call for a reactor steam barrier, but instead instructed the board operator to maintain the regenerator at a higher pressure than the reactor at all times.
Following these instructions set the refinery on a path toward disaster, as this hazardous pressure differential ensured that air from the regenerator would flow into the reactor and onward into the hydrocarbon side of the process, where a flammable mixture formed. Another critical safeguard that should be in place during an FCC unit shutdown is to use natural gas or nitrogen to purge air from the main column to the flare system to prevent oxygen accumulation inside the equipment. But the CSB found that even though Superior Refinery had the ability to purge air out of its main column, the refinery had not incorporated this safeguard into its operating procedures for transient operations. or its operator training program. So, it was not done.
Instead, the refinery overly relied on the catalyst slide valves to keep the air and hydrocarbon systems separated during the shutdown. But slide valves are designed to control flow of catalysts during normal operations, not to prevent flow of air and hydrocarbons during a shutdown. And one of the slide valves was eroded after years of use. Therefore, without other safeguards in place, air was readily available to pass from the regenerator through the worn slide valve into the reactor and onward into the hydrocarbon side of the process.
During transient operation for any process involving flammable materials, operators need to understand the potential for air to enter and accumulate inside equipment. Written procedures should be in place that outline safeguards meant to prevent air and hydrocarbon mixtures, and operators should be trained to understand why those safeguards are critical. To that end, the CSB made a recommendation to the new owners of the refinery, Cenevis Energy, to establish safeguards to prevent explosions in the FCC unit during transient operation, and incorporate these safeguards into written operating procedures.
The second safety issue found by the CSB is process knowledge. The CSB found that throughout the history of the Superior Refinery, under several owners, its FCC expertise was mostly in-house and with minimal engagement with other refineries. In addition, the refinery's use of external technical experts was limited to assessing the FCC unit's performance during normal, not transient operations.
The Superior Refinery required its operations department to review and recertify its operating procedures annually. But the refinery had not performed the technical review of its FCC unit operating procedures with its process engineers, the FCC technology licensor, or outside consultants for at least 25 years prior to the incident. And possibly... since the unit was commissioned around 1960. As a result, the refinery's shutdown procedures, which instructed operators to maintain the regenerator at a higher pressure than the reactor at all times, directly contradicted the FCC technology licensors'guidance and created the dangerous condition that enabled the explosion to occur. The Superior Refinery had serious errors in its FCC unit operating procedures.
that directly led to the explosion. But refinery employees did not have sufficient process knowledge of FCC unit technology to recognize the problem. Had the refinery engaged with other sites or outside experts to review its operating procedures, the technical errors could have been identified and corrected, and the explosion could have been prevented.
Therefore, the CSB made a recommendation to Cenovus Energy. to develop and implement a technology-specific, knowledge-sharing network program across all Cenevis-operated refineries, which at a minimum includes an FCC technology peer network. The third safety issue highlighted by the CSB is process safety management systems.
OSHA's Process Safety Management Standard and the EPA's Risk Management Plan rule require facilities like the Superior Refinery to implement process safety management systems. Process safety management, or PSM systems, are meant to identify, evaluate, and control process hazards. But the CSB found that the refinery's PSM systems were inadequate. For instance, the refinery's process safety information did not include the operating manual published by the FCC technology licensor.
Process hazard analyses performed at the refinery did not effectively identify hazards present during transient operations of the FCC unit, nor outline ways to control those hazards. The refinery's operating procedures lacked clear instructions and were not technically evaluated, and the operator training program at the refinery did not properly prepare operators to shut down the FCC unit safely. The deficiencies we found in Superior Refinery's process safety management systems directly contributed to the explosion. To prevent catastrophic incidents, companies should ensure that their PSM systems are effective at identifying, evaluating, and controlling process hazards, not just during normal operations, but during transient operations as well. As a result of its findings, the CSB made a recommendation to OSHA to develop guidance documents for performing process hazard analysis.
on operating procedures to address transient operation hazards in facilities with PSM covered processes. The fourth safety issue found by the CSB is industry knowledge and guidance. The explosion at Superior Refinery occurred less than one year after the CSB released its report on a similar explosion at the Exxon Mobil Refinery in Torrance, California. Industry trade groups distributed lessons learned from the California incident. as well as the CSB's safety video on the explosion.
But despite these educational efforts, employees at the Superior Refinery did not learn or apply these key lessons in a way that could have prevented the explosion at their refinery. For example, the workforce appeared to understand that flammable hydrocarbons had flowed from the California refinery's main column into the regenerator. and subsequently exploded. But they did not recognize that the reverse was also possible. Therefore, they did not realize a similar explosion was preventable by implementing a reactor steam barrier.
In addition, there is currently no industry publication that establishes common basic process safety expectations for all FCC units. Although the refining industry has accumulated many years of FCC process safety knowledge from its members, This information is scattered, complex, and not easily accessible to some refinery employees. The CSB believes that a publicly available technical publication outlining recognized and generally accepted good engineering practices for safe FCC operation and incorporating lessons learned from this and other similar CSB investigations could help drive important safety improvements in FCC units across the United States. Therefore, the CSB made a recommendation to the American Petroleum Institute to develop a publicly available technical publication for the safe operation of FCC units that is applicable to both new and existing units.
The fifth safety issue outlined by the CSB is brittle fracture during extreme events. The two process vessels that exploded were constructed from a grade of steel that is no longer recommended for new equipment. The vessels failed by brittle fracture, which means that they shattered like breaking glass.
When the vessels failed, the force of the explosion sent over a hundred metal fragments from the shattered vessels around the refinery. One large piece struck and punctured the nearby asphalt tank. Had the process vessels been made of a new grain of steel with better toughness properties, they would have more likely torn open rather than shattered, resulting in fewer, if any, dangerous projectiles.
While some vessels may be deemed fit for service, they're not usually assessed for their performance during an explosion. Selecting materials of construction that are not susceptible to brittle fracture can help lessen the impact to the surroundings. should an extreme event occur. The sixth and final safety issue noted by the CSV is emergency preparedness.
The Superior Refinery uses highly toxic hydrofluoric acid, or HF, in its alkylation process. The HF storage tank was about 150 feet away from the two vessels that exploded, which is about 50 feet closer than the asphalt storage tank that was damaged. The HF tank was not punctured.
or otherwise compromised. But the CSB considers this incident to be a serious near-miss event with hydrofluoric acid. Explosion debris did, however, puncture the asphalt storage tank, causing over 17,000 barrels of hot asphalt to spill out into the refinery, where it accumulated for approximately two hours before it ignited. It was only a matter of time until the spilled asphalt caught on fire. Had emergency responders treated the asphalt as a flammable liquid, they could have taken more effective action sooner to control the asphalt spill before it ignited.
The result is that the initial explosion escalated into a large fire that caused hundreds of millions of dollars in property damage. In addition, smoke from the fire and the potential for an HF release prompted the City of Superior evacuation order, causing disruption. to over 2,500 members of the surrounding community. The refinery remained shut down for more than four years following this incident. In response, the CSB made a recommendation to the EPA to develop a program that prioritizes and emphasizes inspections of FCC units in refineries that operate HF alkylation units to verify that safeguards that prevent explosions during transient operations are in place.
The incident at the Sapiri Refinery should serve as a wake-up call to other refineries, especially those that have hydrofluoric acid alkylation units. During transient operations like shutdowns and startups, refineries must have necessary safeguards in place and follow correct procedures to prevent disasters from occurring. Thank you for watching this CSB Safety Video.
For more information, please visit CSB.gov.