Investigation Report

Investigation Report

ExxonMobil Torrance Refinery

Electrostatic Precipitator Explosion
Torrance, California
Incident Date: February 18, 2015 On-Site Property Damage, Catalyst Particles Released to
Community, Near Miss in MHF Alkylation Unit

No. 2015-02-I-CA

KEY ISSUES:
• Lack of Safe Operating Limits and
Operating Procedure
• Safeguard Effectiveness
• Operating Equipment Beyond
Safe Operating Life
• Re-use of Previous Procedure Variance
Without Sufficient Hazard Analysis
Published May 2017 CSB · ExxonMobil Torrance Refinery Investigation Report
The U.S. Chemical Safety and Hazard Investigation Board (CSB) is an independent Federal agency whose mission is
to drive chemical safety change through independent investigations to protect people and the environment.

The CSB is a scientific investigative organization; it is not an enforcement or regulatory body. Established
by the Clean Air Act Amendments of 1990, the CSB is responsible for determining accident causes,
issuing safety recommendations, studying chemical safety issues, and evaluating the effectiveness of other
government agencies involved in chemical safety. More information about the CSB is available at
www.csb.gov.

The CSB makes public its actions and decisions through investigative publications, all of which may include
safety recommendations when appropriate. Examples of the types of publications include:
CSB Investigation Reports: formal, detailed reports on significant chemical accidents and include
key findings, root causes, and safety recommendations.
CSB Investigation Digests: plain-language summaries of Investigation Reports.
CSB Case Studies: examines fewer issues than a full investigative report, case studies present
investigative information from specific accidents and include a discussion of relevant prevention practices.
CSB Safety Bulletins: short, general-interest publications that provide new or timely information intended
to facilitate the prevention of chemical accidents.
CSB Hazard Investigations: broader studies of significant chemical hazards.
Safety Videos: high-quality outreach products that result in improved worker and environmental
protection.

CSB publications can be downloaded at www.csb.gov or obtained by contacting:

U.S. Chemical Safety and Hazard Investigation Board
Office of Congressional, Public, and Board Affairs
1750 Pennsylvania Ave NW, Suite 910
Washington, DC 20006
(202) 261-7600

No part of the conclusions, findings, or recommendations of the CSB relating to any chemical accident may
be admitted as evidence or used in any action or suit for damages. See 42 U.S.C. § 7412(r)(6)(G).

TABLE OF CONTENTS
1.0 Executive Summary ............................................................................................................................ 6
2.0 Refinery Background .......................................................................................................................... 8
ExxonMobil Corporation ................................................................................................................ 8

2 CSB · ExxonMobil Torrance Refinery Investigation Report

 Torrance Refinery ........................................................................................................................... 8
PBF’s Acquisition of the Torrance Refinery .................................................................................. 9
3.0 Process Description ........................................................................................................................... 10
Catalyst Loop ................................................................................................................................ 11
Main Column ................................................................................................................................ 12
Regenerator Combustion Gas ....................................................................................................... 13
Hydrocarbon Leak to Air Side ...................................................................................................... 14
4.0 Incident Description .......................................................................................................................... 15
Pre-Incident ................................................................................................................................... 16
4.1.1 Initial Expander Problems ..................................................................................................... 16
4.1.2 Monday, February 16, 2015 .................................................................................................. 16
4.1.3 Tuesday, February 17, 2015 .................................................................................................. 19
Incident ......................................................................................................................................... 19
4.2.1 Wednesday, February 18, 2015 ............................................................................................. 19
Incident Consequences .................................................................................................................. 23
4.3.1 Catalyst Dust Reaching Community ..................................................................................... 24 5.0
Causal Analysis of February 18 Explosion ....................................................................................... 25
Lack of Safe Park Procedure and Verifiable Operating Parameters ............................................. 27
Reliance on 2012 Variance ........................................................................................................... 29
5.2.1 Development of 2012 Variance ............................................................................................ 29
5.2.2 Use of 2012 Variance in 2015 ............................................................................................... 31
Spent Catalyst Slide Valve Failure ............................................................................................... 32
5.3.1 SCSV Testing Strategy Ineffective ....................................................................................... 33
5.3.2 Extended Operation of SCSV ............................................................................................... 34
5.3.3 Damage Mechanism Hazard Review Ineffective .................................................................. 35
5.3.4 Work Progressed on Day of Incident When It Was Known SCSV Was Leaking ................ 35
5.3.5 Opportunity for Safer Design ................................................................................................ 36
Steam Barrier Failure ....................................................................................................................
37
Heat Exchanger Tube Leak ........................................................................................................... 39
FCC Unit Remained in Safe Park and Was Not Shut Down ........................................................ 41
ExxonMobil Opened Process Equipment Not in Conformance with Refinery Standards ............ 42

CSB · ExxonMobil Torrance Refinery Investigation Report 3

 ESP Remained Energized When Hydrocarbons Entered Flue Gas System .................................. 44
5.8.1 Hydrocarbons in Flue Gas Piping Did Not Trigger ESP Shutdown ..................................... 45
5.8.2 Previous ESP Hydrocarbon Explosions ................................................................................ 47
5.8.3 Opportunities for Safer Design ............................................................................................. 47 6.0
Causal Analysis of Modified HF Alkylation Unit Near Miss ........................................................... 49
ESP Siting ..................................................................................................................................... 50
6.1.1 Preventing Consequences of an ESP Explosion ................................................................... 50
7.0 Additional Torrance Refinery Incidents............................................................................................ 52 8.0
California PSM Reform .................................................................................................................... 53
Damage Mechanism Review ........................................................................................................ 53
Employee Participation ................................................................................................................. 53
Safeguard Protection Analysis ...................................................................................................... 54
Conclusions ................................................................................................................................... 54
9.0 Key Lessons ...................................................................................................................................... 55
10.0 Conclusions ....................................................................................................................................... 56
11.0 Recommendations ............................................................................................................................. 57
ExxonMobil Corporation .............................................................................................................. 57
Torrance Refining Company ......................................................................................................... 59
American Fuel and Petrochemical Manufacturers ........................................................................ 60
Appendix A: Comparison Between 2012 and 2015 Safe Park DCS Data…………………………………...…….65
Appendix B: ExxonMobil 2015 Variance……………………………………………………………………………..….70

Appendix C: Acci-Map………………………………………………………………………………………………..………72

ACRONYMS AND ABBREVIATIONS

Acci-Map bpd Accident Map
Barrels Per Day
CSB U.S. Chemical Safety and Hazard Investigation Board
CO Carbon Monoxide
ESP Electrostatic Precipitator
FCC Fluid Catalytic Cracking
H2S Hydrogen Sulfide
HF Hydrofluoric Acid

4 CSB · ExxonMobil Torrance Refinery Investigation Report

 MHF Modified Hydrofluoric Acid
MOC Management of Change
OSHA Occupational Safety and Health Administration
PHA Process Hazard Analysis
ppm Parts Per Million
PSM
Process Safety Management
RCSV Regenerated Catalyst Slide Valve
SCAQMD South Coast Air Quality Management District
SCSV Spent Catalyst Slide Valve

1.0 EXECUTIVE SUMMARY

On Wednesday, February 18, 2015, an explosion occurred in the ExxonMobil Torrance, California refinery’s
Electrostatic Precipitator (ESP), a pollution control device in the fluid catalytic cracking (FCC) unit that removes
catalyst particles using charged plates that produce sparks—potential ignition sources—during normal operation.
The incident occurred when ExxonMobil was attempting to isolate equipment for maintenance while the unit was
in an idled mode of operation; preparations for the maintenance activity caused a pressure deviation that allowed
hydrocarbons to backflow through the process and ignite in the ESP.
The CSB found that this incident occurred due to weaknesses in the ExxonMobil Torrance refinery’s process safety
management system. These weaknesses led to operation of the FCC unit without pre-established safe operating
limits and criteria for unit shutdown, reliance on safeguards that could not be verified, the degradation of a safety-
critical safeguard, and the re-use of a previous procedure deviation without a sufficient hazard analysis that
confirmed that the assumed process conditions were still valid.
This report discusses the key factors that caused this incident, which include:
1. ExxonMobil did not establish the safe operating limits for operating the FCC unit in Safe Park—a
standby mode of operation—or determine process conditions that required unit shutdown. As a result, the

CSB · ExxonMobil Torrance Refinery Investigation Report 5

 FCC unit was unknowingly placed in an unsafe condition when a critical safeguard—pressure induced by
steam flow—was reduced below a safe level;

2. ExxonMobil re-used a procedure developed for a similar maintenance operation in 2012 that allowed
deviation from typical refinery safety requirements. ExxonMobil did not, however, perform a sufficient
hazard analysis to determine if the unit conditions specified in the 2012 procedure were valid for the 2015
operation. The safeguards specified in the 2012 procedure were not sufficient for the 2015 operation, and
they failed to prevent hydrocarbons from backflowing through the process and into the ESP;

3. ExxonMobil operated FCC unit equipment beyond its predicted safe operating life. 1 The failure of the
equipment allowed hydrocarbons to reach the ESP;

4. ExxonMobil lacked safety instrumentation to detect flammable hydrocarbons flowing through the
equipment and into the ESP. The inability to detect hydrocarbons flowing to the ESP appears to be an
industry-wide problem; and

5. ExxonMobil refinery management permitted opening process equipment without conforming to refinery
standards.

As a result of this incident, a near miss event occurred in the modified hydrofluoric acid (MHF) alkylation unit
when explosion debris nearly hit tanks in close proximity to the ESP, each containing hydrofluoric acid (HF),
water, hydrocarbons, and a chemical additive intended to reduce the amount of HF vaporized during a loss of
containment event.2 HF is a highly toxic chemical that can seriously injure or cause death at a concentration of 30
parts per million (ppm).3 ExxonMobil resisted CSB requests for safety information pertaining to the potential
release of HF in the event the tanks were struck by explosion debris. ExxonMobil continues to refuse to provide
the CSB with information detailing safeguards to prevent or mitigate a release of HF. The CSB has issued
subpoenas for this information, and is pursuing enforcement in US Federal district court. 4
As a result of the investigation findings of the February 18, 2015 incident, the CSB issues recommendations to
ExxonMobil, Torrance Refining Company (the current operator of the refinery), and American Fuel and
Petrochemical Manufacturers (AFPM). These recommendations aim to:

• Ensure all ExxonMobil and Torrance refinery safety-critical equipment can effectively perform its
safety-critical function;

• Ensure ExxonMobil procedure deviations are analyzed for safety by a diverse, experienced team prior
to their approval and implementation;

1 ExxonMobil does not define a piece of equipment’s safe operating life, but the company’s equipment strategy documentation
does set forth inspection and maintenance intervals.
2 The CSB was not provided with documentation quantifying the resulting effect of the chemical additive on a potential HF
release, and as such the CSB cannot comment on the effectiveness of this additive.
3 The National Institute for Occupational Safety and Health (NIOSH), "NIOSH Pocket Guide to Chemical Hazards,
Hydrogen fluoride," 11 April 2016. [Online]. Available: https://www.cdc.gov/niosh/npg/npgd0334.html. [Accessed 27
February 2017].
4 ExxonMobil has not provided this information to the CSB because they have stated that the requested documents are not
within the CSB’s jurisdiction in investigating the causes of the February 18, 2015 incident.
6 CSB · ExxonMobil Torrance Refinery Investigation Report
 • Ensure ExxonMobil and Torrance refinery ESPs are assessed for potential siting risks and are designed
with safeguards to prevent major consequences of an ESP explosion; and

• Ensure the lessons from this incident are learned broadly throughout the refining industry.

2.0 REFINERY BACKGROUND

EXXONMOBIL CORPORATION
The Exxon Mobil Corporation (ExxonMobil) was formed on November 30, 1999 as a merger between Mobil Oil
Corporation and Exxon.5 ExxonMobil operates five refineries within the United States with a total combined
capacity of approximately 1,857,500 barrels per day (bpd). 6 ExxonMobil also explores for oil and gas deposits;
drills wells; transports crude oil; and sells finished petrochemical products, including gasoline. In addition to a
substantial research division, ExxonMobil has a chemicals division that produces a wide range of products,
including synthetic rubber, plasticizers, synthetic automotive oil base stocks, and catalysts. 7 In 2016, ExxonMobil
reported $226 billion in revenue, with a net earnings of $7.8 billion. 8

5 ExxonMobil, 2017. Our history. [Online]

Available at: http://corporate.exxonmobil.com/en/company/about-us/history/overview [Accessed 07 March 2017].
6 U.S. Energy Information Administration, 2016. Refinery Capacity Report. [Online]
Available at: https://www.eia.gov/petroleum/refinerycapacity/refcap16.pdf [Accessed 07 March 2017].
7 ExxonMobil, "Our Products," 2017. [Online]. Available: http://www.exxonmobilchemical.com/Chem-
English/about/ourproducts.aspx. [Accessed 07 March 2017].
8 ExxonMobil, "ExxonMobil Earns $7.8 Billion in 2016; $1.7 Billion During Fourth Quarter," 31 January 2017. [Online].
Available: http://news.exxonmobil.com/press-release/exxonmobil-earns-78-billion-2016-17-billion-during-fourth-quarter .
[Accessed 07 March 2017].
CSB · ExxonMobil Torrance Refinery Investigation Report 7
 TORRANCE REFINERY
The General Petroleum Corporation, which would eventually become part of Mobil Oil, 9 announced the
construction of the Torrance refinery on October 4, 1928. 10 The company chose this site due to its proximity to the
Los Angeles Harbor, and because the City of Torrance was designed as a mixed use, industrial/residential area. 11
The Torrance refinery was ExxonMobil’s second smallest refinery nationwide, 12 and currently sells about 5 million
gallons of low emissions gasoline per day in Southern California, Arizona, and Nevada. The Torrance refinery
currently produces approximately twenty percent of the gasoline sold in southern California and ten percent
statewide. The refinery also produces jet fuel, diesel fuel, liquefied petroleum gases (LPG), coke, and sulfur. The
refinery covers 750 acres and employs approximately 650 employees and 550 contractors. The Torrance refinery
is surrounded by the City of Torrance, which as of July 2015, had a population of 148,000. 13 Figure 1 shows the
Torrance refinery, outlined in yellow.

FIGURE 1
Google Earth image of Torrance refinery and surrounding community

9 Gnerre, Sam. South Bay Daily Breeze, "Capt. John Barneson brings an oil refinery to Torrance," 4 October 2014. [Online].
Available: http://blogs.dailybreeze.com/history/2014/10/04/capt-john-barneson-brings-an-oil-refinery-to-torrance/ . [Accessed 07
March 2017].
10 Torrance Herald, "3 Million Dollar Refinery to Go Up Here Immediately," 4 October 1928. [Online]. Available:
http://arch.torranceca.gov/archivednewspapers/Herald/1928%20May%203%20-%201929%20Oct
%2031/PDF/00000239.pdf. [Accessed 07 March 2017].
11 M. Crawford, Building the Workingman's Paradise - The Design of American Company Towns, London: Verso, 1995.
12 The Torrance refinery was sold by ExxonMobil to PBF.
13 United States Census Bureau, "QuickFacts, Torrance City, California," 01 July 2016. [Online]. Available:
https://www.census.gov/quickfacts/table/PST045215/0680000. [Accessed 07 March 2017].
8 CSB · ExxonMobil Torrance Refinery Investigation Report
 PBF’S ACQUISITION OF THE TORRANCE REFINERY
On September 30, 2015 ExxonMobil announced an agreement to sell the Torrance refinery to PBF Holding
Company LLC (PBF).14 Founded on March 1, 2008, PBF owns five refineries in the United States with a
combined capacity of 884,000 bpd.15 PBF completed its acquisition of the Torrance refinery from ExxonMobil on
July 1, 2016, and Torrance Refining Company LLC (TORC), a fully-owned subsidiary of PBF, currently operates
the refinery.16,17

14 ExxonMobil, "ExxonMobil to Sell Torrance Refinery to PBF Energy," 30 September 2015. [Online]. Available:
http://news.exxonmobil.com/press-release/exxonmobil-sell-torrance-refinery-pbf-energy . [Accessed 07 March 2017].
15 PBF Energy, "Refineries," 2017. [Online]. Available: http://www.pbfenergy.com/refineries. [Accessed 07 March 2017].
16 PBF Energy, "PBF Energy Completes Acquisition of the Torrance Refinery and Related Logistics Assets," 01 July 2016.
[Online]. Available: http://investors.pbfenergy.com/news/2016/07-01-2016-113123883. [Accessed 07 March 2017].
17 The PBF Torrance refinery is now operated under new leadership. Many employees who worked at the refinery while it
was owned by ExxonMobil still work at the refinery.
CSB · ExxonMobil Torrance Refinery Investigation Report 9
3.0 PROCESS DESCRIPTION
The February 18, 2015 explosion at the Torrance refinery occurred in the refinery’s fluid catalytic cracking (FCC)
unit (Figure 2). The FCC unit “cracks” heavy, high boiling point hydrocarbon molecules into smaller molecules
with lower boiling points. The main product produced by the FCC unit is gasoline.

A large portion of the FCC unit was involved in the sequence of events leading to the explosion in the unit’s
electrostatic precipitator (ESP), which removes catalyst particles from the regenerator combustion gas to meet
environmental regulations before it is discharged into the atmosphere. This section of this report describes the
FCC unit at the Torrance refinery.

FIGURE 2
Schematic of ExxonMobil Torrance Refinery FCC unit

10 CSB · ExxonMobil Torrance Refinery Investigation Report

 CATALYST LOOP
During normal operation, a catalyst18 in the form of small spherical particles19 circulates between the reactor and
the regenerator in the direction of the circular arrow in Figure 3. The catalyst is typically fluidized, meaning that
the solid catalyst is aerated with hydrocarbon vapor, steam, or air so that it behaves like a liquid (Figure 4 20). The
catalyst both drives the cracking reaction and transfers heat from the regenerator to the heavy hydrocarbon feed
entering the reactor riser.

FIGURE 3
Catalyst loop in ExxonMobil FCC unit

FIGURE 4
Depiction of stationary particles (left) and
fluidized particles (right)

18 A catalyst is a substance that increases the rate of a chemical reaction without changing its own composition.
19 The catalyst used in the FCC unit is a powdery solid composed mainly of clay and aluminum oxide.
20 Photos in Figure 4 are still video clips from Glatt, "HP Spray Coating," 2017. [Online]. Available:
http://www.glatt.com/en/processes/coating/fluidized-bed-coating/hp-spray/#jfmulticontent_c6020-1 . [Accessed 07
March 2017].

CSB · ExxonMobil Torrance Refinery Investigation Report 11

 The cracking reaction occurs in the reactor riser (Figure 3). Heavy hydrocarbons are fed into the reactor riser,
where they vaporize upon contact with fluidized hot catalyst, and the cracking reaction begins. The cracking
reaction continues as the mixture of hydrocarbon vapor and catalyst travel up the riser. Coke, a solid byproduct of
the cracking reaction, deposits onto the catalyst particles during the reaction process, making the catalyst less
effective. The coke-covered catalyst is referred to as “spent catalyst.” The spent catalyst and cracked hydrocarbon
vapor exit the riser and enter the reactor vessel, where most of the catalyst particles are separated from the
hydrocarbon vapor. The cracked hydrocarbon vapor then flows to the main column for separation (Section 3.2).
The spent catalyst is routed to the reactor standpipe. Within the reactor standpipe is the spent catalyst slide valve
(SCSV), which controls the spent catalyst flow into the regenerator.
Inside the regenerator, the hot spent catalyst contacts air supplied by the main air blower. The coke deposits that
are on the surface of the hot catalyst particles burn off when in contact with the air, in a combustion reaction. The
heat of combustion further heats the catalyst particles, and this “regenerated catalyst” enters the regenerator
standpipe. The regenerated catalyst slide valve (RCSV) controls the flow of the hot catalyst to the reactor riser
where it contacts, heats, and vaporizes fresh heavy hydrocarbon feed to begin the cracking reaction.

MAIN COLUMN
The cracked hydrocarbon vapors leave the top of the reactor and enter a distillation column 21 called the main
column (Figure 5). The main column is fed superheated 22 hydrocarbon vapor, with no additional heat added to the
column during normal operation. Heat is removed from the column to cool and condense the gas feed for
separation by removing heat in several loops called pumparounds. In these pumparounds, heat exchangers transfer
heat to other process streams in the refinery, reducing the temperature of the streams returning to the main column.
The main column separates the product from the reactor into light hydrocarbons and heavy naphtha (which are
further processed to produce gasoline), light cycle oil, and slurry oil.

FIGURE 5
FCC unit main column

21 A distillation column is a type of process equipment that separates a feed mixture based upon the mixture’s various
components’ boiling point temperatures. Components with lower boiling point temperatures (the more volatile
components) leave the upper portion of a distillation column, while components with higher boiling point temperatures
(the less volatile components) leave the lower portion of a distillation column.
22 A superheated vapor is hotter than its boiling point temperature.

12 CSB · ExxonMobil Torrance Refinery Investigation Report

 REGENERATOR COMBUSTION GAS
The gas leaving the top of the regenerator is composed of
combustion product gases entrained with catalyst particles. 23
The gas is routed to the gas/catalyst separator (Figure 7)
where most of the catalyst dust particles are removed from
the combustion product gases. The gas, still containing
some catalyst dust, flows through the expander, where the
expansion of gas is used to partially power the main air
blower. Heat is removed from the gas in the carbon
monoxide (CO) boiler,24 and then the gas is routed to the
ESP. The ESP collects most of the remaining small catalyst
particles from the gas to meet California emissions
FIGURE 6
regulations25 by using charged plates to attract the fine The
ESP removes catalyst particles using charged catalyst particles (Figure 6).26 This operation generates plates
that produce sparks (as designed). sparks—potential ignition sources—inside of the ESP.

23 The majority of the catalyst particles are removed from the regenerator combustion gas by “cyclones” inside of the
regenerator.
24 The CO Boiler essentially serves as a heat exchanger, using the hot regenerator combustion product gas to generate
steam for use around the refinery. When the FCC unit was originally designed, it burned CO flowing from the
regenerator, but the process has since been modified so that all CO is now combusted in the regenerator.
25 SCAQMD, "Rule 1105.1, Reduction of PM10 and Ammonia Emissions from Fluid Catalytic Cracking Units," 07
November 2003. [Online]. Available: http://www.aqmd.gov/docs/default-source/rule-book/reg-xi/rule-1105-1.pdf?
sfvrsn=4. [Accessed 07 March 2017].
26 Figure from https://en.wikipedia.org/wiki/Electrostatic_precipitator#/media/File:Electrostatic_precipitator.svg
[Accessed 07 March 2017].

CSB · ExxonMobil Torrance Refinery Investigation Report 13

 FIGURE 7
Regenerator combustion
gas flow to ESP (indicated
by red arrows)

HYDROCARBON LEAK TO AIR SIDE

This report refers to the FCC unit as having two “sides” which are (1) the
hydrocarbon side, and (2) the air side. The hydrocarbon side includes the
reactor and the main column. The air side includes the regenerator and the
piping and equipment downstream of the regenerator leading to the ESP
(Figure 2). The SCSV and the RCSV are used to prevent undesirable mixing
of air and hydrocarbons, which is an explosion hazard. During the Safe Park
mode of operation (a standby mode of operation that the FCC unit was in on
the day of the incident), the two valves isolate the air side and the hydrocarbon
side from each other by maintaining a level of catalyst on top of the valves,
forming a “plug” that prevents reactor process vapors from entering the
regenerator, and vice versa (Figure 8).
Discussed in Section 4.0, on the day of the incident, the SCSV did not maintain
the catalyst plug. Hydrocarbons from the reactor flowed into the regenerator in
the air side of the FCC unit, which in the Safe Park mode of operation was not
sufficiently hot to burn (i.e. combust) the hydrocarbons. As a result,
flammable hydrocarbons flowed to the ESP, where they mixed with air fed to
the ESP from the CO boiler fans. Sparks within the ESP ignited the
flammable mixture, causing an explosion.

14 CSB · ExxonMobil Torrance Refinery Investigation Report

 During Safe Park, a catalyst level on
top of the SCSV and RCSV is
intended to prevent hydrocarbons
and air from mixing.

FIGURE 8
4.0 INCIDENT DESCRIPTION
On February 18, 2015, a mixture of hydrocarbons and air accumulated and exploded inside of the ESP. This
section details the events that led to the explosion. Figure 9 shows a timeline of events in the days leading to the
incident.

CSB · ExxonMobil Torrance Refinery Investigation Report 15

FIGURE 9
Timeline of events leading to explosion

16 CSB · ExxonMobil Torrance Refinery Investigation Report

 PRE-INCIDENT 4.1.2 MONDAY,
FEBRUARY 16,
4.1.1 INITIAL EXPANDER PROBLEMS 2015
The sequence of events leading to the incident began when the
expander (located in the air side of the FCC unit—see Figure 2) started 4.1.2.1 EXPANDER
to experience vibration problems. EXCESSIVE VIBRATION AND
The gas that flows through the expander contains a small amount of SAFE PARK
catalyst particles that may, over time, build up on the expander blades
On the morning of Monday,
(Figure 10). Uneven distribution of this buildup causes the expander
February 16, 2015, workers
to vibrate excessively, which can cause significant damage to the
cleaned the expander blades
expander. Torrance refinery instrumentation monitored the vibration
again. This time, however, it
of the expander so that when the expander vibration increased to a
did not reduce vibrations.
certain level, operators could clean the catalyst buildup from the
Refinery personnel decided
expander blades.
to assess expander vibrations
further after a planned FCC
unit rate increase, in case the
increased flow through the
expander reduced the
vibration. The vibrations,
however, worsened when the
flow rate through the
expander increased. At
12:50 PM, the vibrations
reached a high limit, and the
control system automatically
began emergency shutdown
FIGURE 10 to transition the unit into an
Catalyst buildup within expander. Photo was taken post-incident in idled state referred to by
2015. ExxonMobil as “Safe Park”
On the morning of Wednesday, February 11, 2015, the FCC (Figure 11). To put the unit
expander started to experience increased vibration. On into Safe Park, the following
Thursday, February 12, 2015, workers cleaned the expander process changes occur
blades,27 and this temporarily reduced the expander vibration. automatically:
Three days later on Sunday, February 15, 2015, however, the (1) the spent and
expander again began to experience high vibration. regenerated
catalyst slide
valves close;
(2) hydrocarbon feed
to the reactor
27 When operators clean expander blades, they inject ground-up riser stops;
walnut shells into the flue gas just upstream of the expander. The
intent is for the shells to scour the expander blades to remove
catalyst, and with the catalyst removed, allow the expander rotor
balance to be restored and thereby reduce expander vibrations.

CSB · ExxonMobil Torrance Refinery Investigation Report

 (3) the main air blower and expander are shut down; and (2) Suff
(4) valves open to inject steam into the reactor riser. icie
nt
The main column pumparound loops continue to operate and stea
hydrocarbons remain in the main column. In addition, the ESP m
remains energized. flo
w
into
reac
tor,
whi
ch
16 is
use
d to
gen
erat
ea
hig
her
pres
sure
in
the
reac
tor
than
in
the
mai
n
FIGURE 11 colu
Configuration of FCC unit in Safe Park mn
to
pre
To prevent an explosion during Safe Park, ExxonMobil relied vent
on two safeguards (Figure 12) to isolate flammable hyd
hydrocarbons in the hydrocarbon side of the unit from mixing roca
with air in the air side of the unit. These safeguards include: 28 rbo
ns
(1) A level of catalyst accumulated on
in
top of each closed slide valve to
the
form a physical barrier; and
mai
n
colu
28 Allowing hydrocarbons and air to mix introduces an explosion hazard.

18 CSB · ExxonMobil Torrance Refinery Investigation Report

 mn from backflowing into the leaked
reactor. through the
SCSV and
Leading to the incident, both safeguards failed, allowing entered the
hydrocarbons from the main column to enter the air side of the regenerator
FCC unit. (Appendix
A). The
In Safe Park configuration, the accumulated
SCSV
catalyst on top of the SCSV and steam pressurizing safeguard
the reactor are intended to act failed
because the
as safeguards preventing hydrocarbons in the damaged
SCSV
main column from backflowing through the reactor and to the
likely could
regenerator.
not
4.1.2.2 maintain a
FAILURE TO protective
level of
MAINTAIN
catalyst to
REACTOR isolate the
CATALYST LEVEL reactor
On February 16, from the
2015, when the regenerator
FCC unit (Figure 13).
automatically
transitioned to
Safe Park, the
control system
moved both slide FIGURE 13
valves into the In Safe
closed position. Park, the
The SCSV, catalyst
however, had leaked
severely eroded through
over six years of the closed
operation (see SCSV,
Section 5.3) and which was
was unable to severely
seal. As a result,
within minutes eroded
after the FCC unit from six
went into Safe years of
Park and the operation
SCSV closed, the and did
catalyst particles not form a
from the reactor

CSB · ExxonMobil Torrance Refinery Investigation Report 19

 c
a
t
a
l
y
s
t

s
e
a
l
.
4.1.3 TUESDAY,
FEBRUARY 17,
2015
On Tuesday, February 17,
2015, a meeting took place
4.1.2.3 ATTEMPTS TO RESTART EXPANDER involving maintenance and
With the unit in Safe Park, operators attempted to restart the machinery reliability
expander to bring the FCC unit back online. After four personnel, the FCC unit
unsuccessful restart attempts, refinery personnel worked to operations manager, and
identify a strategy to repair the expander. Operations personnel the FCC unit business team
predicted the expander could not restart because catalyst had manager. This group
likely accumulated between the expander blades and the discussed a similar
expander casing, preventing the blades from rotating (Figure expander outage that
14). At the direction of ExxonMobil management, operators occurred in 2012, when the
began isolating the expander from the process to allow for company made an entry
visual inspection inside of the expander. The expander, into the expander while the
however, could not be isolated using the typical safe isolation unit was in Safe Park to
practices required by ExxonMobil safety procedures. inspect its internals
following a failed startup.
For that expander entry
operation, the Torrance
refinery developed a
“Variance,” a
management-approved
procedure deviation that
allowed a departure from
typical refinery equipment
isolation requirements.
ExxonMobil engineers
developed, analyzed, and
approved the expander

20 CSB · ExxonMobil Torrance Refinery Investigation Report

 isolation method detailed in the Variance in 2012 (see Section
5.2).
Because ExxonMobil developed, approved, and successfully
used the Variance in 2012, the group decided to reuse the same
2012 Variance to isolate the expander for visual inspection.
The approved Variance is located in Appendix B of this report.
On the afternoon of Tuesday, February 17, 2015, operators
worked to isolate the expander for maintenance as specified in
the Variance. Part of the required isolation was to install a
blind29 in a flange at the expander outlet. Workers began
opening the flange on the outlet of the expander so that they
could install the blind.

INCIDENT

4.2.1 WEDNESDAY, FEBRUARY 18, 2015

FIGURE 15
On the morning of Wednesday, February 18, 2015, ExxonMobil
maintenance workers approached the open flange to install the On the morning of the incident,
blind. They did not install the blind, however, because at that steam leaked out of the open
time steam was escaping from the open flange, and they were expander outlet flange. Steam
concerned about their safety (Figure 15). Steam leaking from from the reactor had leaked
the flange indicated that the SCSV, one of the safeguards through the eroded SCSV,
specified in the Variance, did not fully seal and there was no through the FCC unit air side
catalyst barrier present. Post-incident, the CSB identified piping and equipment, and out
meeting notes written on the Wednesday morning prior to the of the open flange.
incident by an ExxonMobil manager overseeing the expander
maintenance that questioned, “Does the leaking spent slide valve
invalidate the Variance?” The sequence of events leading to the
Because no protective
incident, discussed below, indicate that ExxonMobil
catalyst level had
management decided to continue isolating the expander while
developed on the closed
the unit remained in Safe Park even though it was known that the
SCSV, the reactor pressure
SCSV was leaking.
generated by steam fed to
the reactor was the only
safeguard preventing
hydrocarbons from the
main column from entering
the air side of the FCC
unit. Steam enters the
reactor from several feed
29 A blind is a metal plate inserted between flanges to ensure positive locations (e.g. steam fed to
isolation of a vessel from the process. the riser, and “stripping

CSB · ExxonMobil Torrance Refinery Investigation Report 21

 steam” fed to the stripping section of the reactor). ExxonMobil an attempt to reduce the
adjusted the steam flow to the reactor primarily by adjusting the amount of steam releasing
riser steam, although stripping steam was also being fed to the from the expander outlet
reactor during Safe Park. The Variance specified that for the flange, so workers could
expander entry operation the reactor steam flow should not be safely access the flange. By
reduced below 2,000 pounds per hour (Figure 16). On the day 7:16 AM, the steam flow rate
of the incident, ExxonMobil did not evaluate whether this through the riser had been
minimum steam flow rate specified in the Variance was decreased from
sufficient to prevent hydrocarbons from entering the approximately 20,000 pounds
regenerator, with the knowledge that the reactor steam—the per hour to approximately
only remaining safeguard which was used to pressurize the 7,500 pounds per hour.31
reactor—was leaking through the SCSV (Section 5.4). Hourly Unknown to operations
workers who may have been more familiar with a higher, more personnel at the time,
typical Safe Park steam flow rate were not included in however, the reactor pressure
evaluating the steam flow rate specified in the Variance was now too low to prevent
(Section 5.4). hydrocarbons from
backflowing from the main
column into the reactor.
Hydrocarbons from the main
column (as will be discussed
in Section 5.5 was at a
higher-than-typical pressure
due to accumulation of light
hydrocarbons from a heat
exchanger tube leak) flowed
into the reactor and entered
the air side of the FCC unit
through the leaking SCSV
(Figure 17).

31 In addition to the riser

steam, other sources of
steam entered and
pressurized the reactor.
FIGURE 16
The board console
The 2012 Variance that was approved for use in 2015 supervisor, however, was
specified that the reactor steam flow rate should not fall primarily managing steam
below 2,000 pounds per hour. (emphasis added) flow rate using the riser
steam as other steam feed
to the reactor was
Relying on the minimum specified 2,000 pounds per hour reactor operated primarily by
steam rate, the operations shift supervisor instructed the board manual valves. During
console supervisor30 to reduce the steam flow through the riser in the course of the morning,
the total reactor steam
was reduced from about
30 The console supervisor operates the control board of the FCC 45,000 pounds per hour to
unit. At other refineries, this person may be called a “board about 18,000 pounds per
operator.” hour.

22 CSB · ExxonMobil Torrance Refinery Investigation Report

 At 8:07 AM, a maintenance supervisor working in the FCC unit
received an alarm on his personal hydrogen sulfide 32 (H2S)
monitor.33 H2S is present in the FCC unit hydrocarbons, and the
alarm indicated that hydrocarbons were likely leaking from an
unanticipated location. Refinery personnel, however, continued
working near the expander. At approximately 8:40 AM, H 2S
monitors on multiple workers around the expander outlet flange
activated, indicating that hydrocarbons were leaking out of the
expander flange. At this point, operators began evacuating
personnel from the FCC unit.
Operations staff increased the steam flow up the reactor riser to
35,000 pounds per hour, but this action was taken too late;
hydrocarbons had already entered the air side of the FCC unit and
were flowing towards the ESP. The hydrocarbons soon reached
the ESP and mixed with air flowing into the ESP from fans on the
CO Boiler.34 At 8:48 AM, the flammable mixture ignited inside
of the ESP, causing an explosion.35 See Appendix A for a full
analysis of the relevant pressures, flow rates, and catalyst level
data leading to the incident, and how they compare to the similar
2012 operation.
FIGURE 17
When steam flow rate was
reduced through the reactor
riser, reactor pressure could no
longer prevent hydrocarbon
backflow from the main
column. Hydrocarbons leaked
through closed SCSV, through
FCC unit air side piping and
equipment, and to the
energized ESP. A
32 Hydrogen sulfide is a colorless gas that has the odor of rotten eggs. The
hydrocarbon/air mixture
gas is heavier than air, toxic and flammable. Hydrogen sulfide is present
ignited inside of the ESP.
in many types of crude oils processed in refineries.
33 H2S levels that were recorded on the day of the incident for the
majority of the workers were at or below the Occupational Safety
and Health Administration (OSHA) exposure limits. One contract
worker was exposed to levels that were at the level that is INCIDENT
specified as immediately dangerous to life and health.
34 The CO Boiler fans were operated during a separate CONSEQUENCES
troubleshooting activity being performed simultaneously to the The explosion severely
expander isolation attempt.
damaged the ESP (Figure 18).
35 Light naphtha, the primary hydrocarbons that entered the ESP,
Debris from the explosion hit
has a lower explosive limit of approximately 1.0 volume %. See
equipment near the ESP,
ExxonMobil, "Material Safety Data Sheets, 3139 Naphtha,"
[Online]. Available: causing two small fires and
http://www.msds.exxonmobil.com/IntApps/psims/SearchResults.a multiple leaks of flammable
spx. [Accessed 07 March 2017]. liquids. The explosion debris

CSB · ExxonMobil Torrance Refinery Investigation Report 23

 also punctured a heat exchanger that was out-of-service. Four (Figure 19). Pure HF is a
contract employees who were working nearby sought first aid for highly toxic chemical that can
injuries sustained while fleeing the area. Debris also fell on a seriously injure or cause death
building frequently used by operators, though was unoccupied at at a concentration of 30 ppm.40
the time. In addition, catalyst dust was reported outside of the ExxonMobil resisted CSB
refinery property in the nearby community.36,37 requests for safety information
pertaining to the potential
release of HF in the event the
tanks were struck by
explosion debris.
ExxonMobil continues to
refuse to provide the CSB
with information detailing
safeguards to prevent or
mitigate a release of HF. The
CSB has issued subpoenas for
this information, and is
pursuing enforcement in US
Federal district court.41
FIGURE 18
Damage to the ESP from the explosion. White catalyst dust
from the ESP is visible on the ground in left photo. A large piece
of debris from the explosion fell on scaffolding38 around two
settler tanks, each containing hydrofluoric acid (HF), water,
hydrocarbons, and a chemical additive intended to reduce the
amount of HF vaporized during a loss of containment event 39

36 The South Coast Air Quality Management District (SCAQMD)

performed monitoring in the community after the incident, 40 The National Institute for
including a composition analysis of the “fall out.” See SCAQMD, Occupational Safety and
"Report on ExxonMobil Torrance Refinery Incident of February Health (NIOSH),
18, 2015; SCAQMD Response and Sampling & Analysis Efforts," "NIOSH Pocket Guide to
[Online]. Available: Chemical Hazards,
http://www.aqmd.gov/docs/default- Hydrogen fluoride," 11
source/compliance/exxonmobil-02182015.pdf. [Accessed 07 April 2016. [Online].
March 2017]. Available:
37 U.S. Chemical Safety and Hazard Investigation Board, "Transcript from https://www.cdc.gov/nios
1.13.2016 Public Meeting (30015_Exxon public meeting pt1)," 13 h/npg/npgd0334.html.
January 2016. [Online]. Available:
[Accessed 27 February
http://www.csb.gov/assets/1/19/Public_meeting_transcript.pdf.
2017].
[Accessed 07 March 2017].
41 ExxonMobil has not provided
38 The scaffolding was temporarily in place for work being done on the
alkylation unit. this information to the CSB
39 The CSB was not provided with documentation quantifying the because they have stated that the
resulting effect of the chemical additive on a potential HF release, requested documents are not
and as such the CSB cannot comment on the effectiveness of this within the CSB’s jurisdiction in
additive. ExxonMobil did present CSB investigators with a investigating the causes of the
presentation on MHF. February 18, 2015 incident.

24 CSB · ExxonMobil Torrance Refinery Investigation Report

 regarding the toxicity or
potential health effects of
the catalyst dust. In this
report, the CSB identifies
the events and conditions
that led to the February 18,
2015 ESP explosion, with
the goal of preventing
other similar incidents in
refineries and communities
across the country. The
findings, key lessons, and
recommendations from this
report can help the refining
industry learn from this
FIGURE 19 incident. This report does
Explosion debris landed in close proximity to
not analyze the health
alkylation unit settler tanks containing HF,
effects of catalyst dust
water, hydrocarbons, and a chemical additive
exposure.
intended to reduce the amount of HF
vaporized during a loss of containment event.
5.0 CAUSAL
ANALYSIS OF
4.3.1 CATALYST DUST REACHING FEBRUARY 18
COMMUNITY EXPLOSION
Some members of the local community are concerned about
potential health effects from catalyst exposure, as a result of the The CSB identified key
ESP explosion and dispersion of catalyst dust.42,43 The CSB is factors that contributed to a
not aware44 if there are long-term health effects from exposure flammable mixture
to this catalyst.45 The CSB therefore cannot make a statement accumulating inside of the
ESP on the day of the
42 U.S. Chemical Safety and Hazard Investigation Board, "Transcript from incident. An Acci-Map46
1.13.2016 Public Meeting (30015_Exxon public meeting pt1)," 13
January 2016. [Online]. Available:
18, 2015; SCAQMD
http://www.csb.gov/assets/1/19/Public_meeting_transcript.pdf.
Response and Sampling
[Accessed 07 March 2017]. See statement by Alicia Rivera.
& Analysis Efforts,"
43 In the hours immediately following the explosion, the community
[Online]. Available:
was given mixed alerts from various responding agencies regarding
http://www.aqmd.gov/doc
whether to shelter-in-place.
s/default-
44 CSB subpoenaed health studies of the catalyst from ExxonMobil. source/compliance/exxon
ExxonMobil provided the CSB with safety data sheets on the mobil-02182015.pdf.
catalyst. The CSB has not been able to review any health studies of [Accessed 07 March
the catalyst dust 2017].
45 The South Coast Air Quality Management District (SCAQMD) 46 An Acci-Map is a causal
performed monitoring in the community after the incident, diagram of a major incident.
including a composition analysis of the “fall out.” See SCAQMD, The different levels of
"Report on ExxonMobil Torrance Refinery Incident of February causation that led to the

CSB · ExxonMobil Torrance Refinery Investigation Report 25

depicting the CSB causal analysis is located in Appendix C. This section discusses each
The key causal factors include the following: of these factors that
contributed to the incident.
1. ExxonMobil relied on indirect operating parameters
to measure critical safeguards for the Safe Park mode
of operation. The relied-upon operating parameters
did not signify that the FCC unit was in a dangerous
condition leading to the incident. In addition,
ExxonMobil had not developed a Safe Park
procedure for how to safely operate within specified
safe operating limits (Section 5.1);
2. In 2015, ExxonMobil relied on a Variance that had
been developed in 2012, without verifying that the
safeguards specified in the Variance were sufficient
(Section 5.2);
3. Erosion damage that had developed over six years of
operation likely compromised the SCSV, and it could
not maintain a catalyst barrier while the FCC unit was
in Safe Park (Section 5.3);
4. Steam flow to the reactor had been reduced, likely
causing a pressure deviation that allowed
hydrocarbons to enter the flue gas system (Section
5.4);
5. A leaking heat exchanger in the slurry oil
pumparound allowed light hydrocarbons to enter and
pressurize the main column to a higher-than-typical
pressure (Section 5.5);
6. ExxonMobil did not shut down the FCC unit when it
was identified that the SCSV leaked and had not
established a catalyst barrier (Section 5.6);
7. The expander could not be effectively isolated while
the unit was in Safe Park. ExxonMobil opened
process equipment without conforming to refinery
standards (Section 5.7); and
8. The ESP remained energized when hydrocarbons
entered the flue gas system, providing an ignition
source to trigger the explosion (Section 5.8).

incident are visually indicated. These levels include physical condition

causes, site and/or corporate causes, industry codes and standards
causes, and regulatory causes. The Acci-Map was originally developed
by Jens Rasmussen in the article J. Rasmussen, "Risk Management in a
Dynamic Society: A Modelling Problem," Safety Science, vol. 27, no.
2/3, pp. 183-213, 1997. The AcciMap was subsequently used and
popularized by Andrew Hopkins, in A. Hopkins, Lessons from
Longford: The Esso Gas Plant Explosion, CCH Australia, 2000.

26 CSB · ExxonMobil Torrance Refinery Investigation Report

 LACK OF SAFE
Equipment Isolation Methods
PARK
This report discusses three types of equipment isolation methods: PROCEDURE
(1) single block and bleed; (2) double block and
bleed; and (3) blinding equipment. AND
Single Block and Bleed
VERIFIABLE
OPERATING
PARAMETERS

ExxonMobil relied on
indirect operating
parameters to measure
A single block valve is closed to isolate the equipment from the process. A bleed valve between the closed
critical safeguards for the
block valve and the equipment is opened to remove process fluid from the piping. The pressure between the
Safe Park mode of
closed block valve and the bleed valve is measured to (1) verify the piping has been emptied and (2) to detect a
operation. The relied-upon
pressure increase due to leakage of the closed block valve.
operating parameters did
not signify that the FCC
Double Block and Bleed unit was in a dangerous
condition before the
More Robust

incident. ExxonMobil did

not develop a Safe Park
procedure for how to safely
operate within specified
safe operating limits, with
specified operating
Two block valves in series are closed to isolate equipment from the process. A bleedthat
parameters valve between the two
could
closed block valves is opened to remove process fluid from between the directly
valves. verify
A bleedthevalve between the
critical
second closed block valve and the equipment is also opened to remove process
Safe Park safeguards. Safeblock valve
fluid between that
and the equipment. The pressure between the two closed block valves, Park and between
procedure the second closed block
valve and the equipment, is measured to (1) verify the piping has been emptied and (2)
development andtoimproved
detect a pressure
increase due to leakage of the closed block valve(s). measurement and control of
critical process conditions
Blinding Equipment could have prevented this
incident.

The Occupational Safety

and Health Administration
(OSHA) Process Safety
Management (PSM)
A blind is a solid metal disc that is inserted into a pipe flange, preventingregulation
the flow ofrequires
process fluid to the
chemical processing
equipment to be isolated. The use of a blind is often referred to as “positive isolation.” The piping upstream
of the blind is often isolated by a single or double block and bleed. facilities to develop

Figures based upon

Health and Safety Executive (HSE). The Safe Isolation of Plant and Equipment, HSG253, pg. 26, 2006.
CSB · ExxonMobil Torrance Refinery Investigation Report
http://www.hse.gov.uk/pubns/priced/hsg253.pd 27
f
 operating procedures for each operating phase—including Comparison of ExxonMobil’s
temporary operations such as Safe Park—that detail safe operating parameters to
operating limits, consequences of deviation, and the steps monitor safeguards and possible
required to correct or avoid the deviation.47 ExxonMobil had alternative operating
developed a procedure to enter Safe Park, and a procedure to parameters
transition from Safe Park back to normal operation.
ExxonMobil had not, however, developed a procedure that KEY LESSON
detailed how to safely operate the FCC unit while in Safe
Park.48 Despite the additional safety management system flaws
that led to this incident, which will be discussed later in this It is essential to identify and
report, the development of and adherence to a robust procedure define safe operating limits
that established Safe Park safe operating limits and the for all modes of operation,
conditions that required emergency shutdown could have and measure process
prevented this incident. conditions and parameters
At the time of the incident, ExxonMobil relied on two that can verify the operation
safeguards to prevent hydrocarbons from the main column from of the process relative to
reaching the air side of the FCC unit: (1) a reactor pressure those safe operating limits.
higher than the main column pressure, established by steam fed When a facility relies on
to the reactor; and (2) a catalyst barrier on top of the closed operating parameters that
SCSV. ExxonMobil, however, relied on indirect operating only indirectly provide
parameters to maintain the two safeguards. Table 1 shows the information on critical
two safeguards relied upon in Safe Park, the indirect operating process parameters, it can
parameters ExxonMobil used to monitor these safeguards, and lead to the inability to
examples of potential direct operating parameters ExxonMobil identify when a process is in
might have used to better verify that the safeguards were
an unsafe condition.
available.
ExxonMobil Indirect Operating Example Direct Operating Parameters to Verify
Safe Park Safeguards
Parameters Used to Monitor Safeguards

Accumulated catalyst SCSV valve position (Variance specifies

above closed SCSV SCSV will be in closed position) differential pressure measurement or a level indicator)

Reactor steam flow rate (Variance Differential pressure measurement between reactor
Reactor pressure greater
specifies 2,000 pounds per hour steam and main column, to ensure reactor pressure is higher
than main column pressure
flow rate)

TABLE 1
47 29 C.F.R. § 1910.119(f).
48 Cal/OSHA issued ExxonMobil a citation for “fail[ing] to develop
and implement a safe-park procedure for the FCC Unit during the
FCC emergency shutdown.” It was classified as a “Serious”
violation, with a proposed penalty of $7,200.00. See State of
California, Department of Industrial Relations, "Citation and
Notification of Penalty, ExxonMobil Refining & Supply
Company," 13 August 2015. [Online]. Available:
http://www.dir.ca.gov/dosh/citations/ExxonMobil.Signed-
CitationDocuments.1042440.pdf. [Accessed 03 March 2017].

28 CSB · ExxonMobil Torrance Refinery Investigation Report

To maintain the reactor pressure above the main column pressure, 2. Develop procedures for all
ExxonMobil specified a minimum steam flow rate (2,000 pounds modes of operation that
per hour) to feed to the reactor. Operating at this flow rate did not, detail those safe upper and
however, ensure that the reactor pressure was kept above the main lower operating limits, and
column pressure. A better parameter to measure could have been consequences of
the differential pressure between the reactor and the main column. deviation;
Because it was critical to maintain the reactor pressure above the 3. Configure process
main column pressure, ExxonMobil could have installed instrumentation to
instrumentation to measure the differential pressure between the measure critical process
reactor and main column, specifically for use during Safe Park. conditions, so that
ExxonMobil could have required in a Safe Park procedure for operators can monitor and
operators to monitor the differential pressure and adjust the riser control the process such
steam flow rate to confirm the reactor pressure was maintained that it is within the
sufficiently above the main column pressure. As a potentially more intended safe operating
robust system, ExxonMobil could also have configured the process limits; and
control system to automatically adjust the riser steam flow rate to 4. Include in procedures the
maintain the target reactor/main column differential pressure. values for process
Finally, ExxonMobil should have specified in a Safe Park parameters that represent
procedure the minimum pressure differential that indicated the the boundaries of safe
inability to maintain the differential pressure necessary to prevent upper and lower operating
dangerous backflow. This low differential pressure safety limit limits that require pre-
should have automatically, or as a minimum through operator determined corrective
required action, triggered a full unit shutdown to prevent action (e.g. unit
hydrocarbon backflow and ignition in the ESP. shutdown). Define the
steps for these pre-
ExxonMobil relied on SCSV position (i.e. closed SCSV) to
determined actions,
indicate if a catalyst barrier was developed during Safe Park. As
whether implemented in a
demonstrated by this incident, SCSV position does not provide
Safety Instrumented
information on the catalyst level above the SCSV. ExxonMobil
System or by operator
should have specified process parameters for operators to monitor
action.
that could confirm the existence of a catalyst barrier. For
example, a Safe Park procedure could have required operators to Had ExxonMobil
monitor the differential pressure between the SCSV standpipe and developed such a
the regenerator (see Appendix A for 2012 and 2015 differential procedure, process
pressure data) to confirm that a catalyst barrier had been controls, and pre-defined
established. Alternatively, ExxonMobil could have measured the safe operating limits for
catalyst level in the SCSV standpipe. In addition, ExxonMobil Safe Park, this incident
should have specified in a Safe Park procedure the minimum limit could have been prevented.
(e.g. minimum differential pressure or minimum level) that
should trigger full unit shutdown to prevent hydrocarbon
backflow and ignition in the ESP.
RELIANCE ON 2012 VARIANCE
It is essential that refineries and chemical process facilities:
1. Establish the upper and lower safe operating limits for all
Leading to the incident,
modes of operation;
ExxonMobil chose to
perform maintenance

CSB · ExxonMobil Torrance Refinery Investigation Report 29

on the expander using a managementapproved deviation p
from typical site safety policies. They chose to re-use a r
“Variance” procedure developed for a previous o
maintenance operation conducted in 2012. Leading to the c
incident, however, ExxonMobil management trusted the e
validity of the Variance procedure without ensuring the s
safeguards specified were sufficiently robust. The s
safeguards specified in the Variance procedure were not
sufficient for the 2015 expander maintenance, and because p
they were not technically analyzed prior to the incident this i
deficiency was never identified. This section discusses the p
2012 development of the expander maintenance Variance i
and its implementation in 2015. n
g

l
5.2.1 DEVELOPMENT OF 2012 VARIANCE e
a
In 2012, an event
d
similar to the 2015
i
expander shutdown
n
occurred in the
g
Torrance refinery; in
2012, the FCC unit
t
had entered Safe Park
o
due to a power outage,
and when personnel
t
attempted to re-start
h
the expander, it would
e
not restart. At the
time, ExxonMobil
e
believed catalyst
q
buildup was
u
preventing the
i
expander blades from
p
rotating. To verify the
m
problem, refinery
e
personnel planned to
n
perform an entry into
t
the expander to
identify the expander
t
operation problem.
h
Safe entry into process a
equipment such as the t
expander typically
requires blinding the w

30 CSB · ExxonMobil Torrance Refinery Investigation Report

 ill be entered. The
inlet piping to the
expander, however,
could not be blinded in
its existing
configuration; rather,
blinding the expander
inlet required removing
a pipe spool piece.
ExxonMobil justified
not blinding the
expander inlet by
stating that “[t]he
dropping of the
expander inlet spool
would present more FIGURE 21
hazards (including Conversation b
hand rigging, critical ExxonMobil engineers during
lifts, etc.) and more development of Variance in 2012
hours of exposure to
personnel under
unplanned conditions”
Nevertheless, ExxonMobil
than if they relied on a
refinery management
single block and
developed and approved
bleed instead of a blind.49 the Variance for use in
In this scenario, using a single block and bleed to isolate 2012. As specified in the
Variance, in 2012 refinery
equipment Safeguards specified in 2012 Variance for a
personnel conducted the
confined space entry was not consistent with standard expander entry with the
ExxonMobil safety policies. As previously discussed, following unit
ExxonMobil allows deviation from safety policies as long as a configuration (Figure 22):
Variance—a departure from ExxonMobil policies—is • Single block and
developed and analyzed for safety prior to performing the work. bleed of expander
ExxonMobil engineers therefore developed a Variance in 2012 inlet as opposed
to perform the expander entry. In a conversation about the to blinding;
Variance procedure, ExxonMobil engineers discussed that both • Blind installed at
a steam barrier and a catalyst barrier (Figure 20) were necessary expander outlet;
to safely perform the confined space entry to prevent • SCSV and RCSV
hydrocarbons from entering the expander, but they were still in closed position
uncertain whether the discussed isolation strategy complied (Note:
with ExxonMobil safety practices (Figure 21). accumulated
catalyst on top of
valves was not
specified in the
49 ExxonMobil did not consider fully shutting down the unit to perform the
expander maintenance.

CSB · ExxonMobil Torrance Refinery Investigation Report 31

 Variance even though it was discussed by the down (Section 4.1.2) and
engineers in Figure 21); ExxonMobil refinery
• Steam flowing to the reactor, specified as a minimum management wanted to enter
of 2,000 pounds per hour (Note: No analysis was the expander to identify why
presented for this steam flow rate. Actual riser steam the expander would not
flow rate was about restart. Personnel involved
7,000 pounds per hour. with the 2015 expander
KEY LESSON
See Appendix A.); and troubleshooting had
• Unit was in Safe Park, participated in the 2012
When implementing a with ESP energized. expander entry, and believed
deviation from an existing that a similar entry would be
In 2012, refinery personnel required to identify the
procedure, it is critical
conducted the expander entry expander startup problem.
that the company conduct
with no incident. Process data ExxonMobil management
a management of change indicates that a catalyst barrier
to—among other decided to re-use the 2012
accumulated on top of the closed Variance to perform a
requirements—verify and SCSV (Appendix A). No confined space entry into the
authorize the technical hydrocarbons entered the flue expander. In 2015, however,
basis, the implementation gas system during the confined no formal meetings or
time period, and identify space entry. discussions were held to
any new or affected
discuss the validity of the
hazards and associated
Variance. Rather, one FCC
mitigation strategies. If
unit manager presented the
the procedure deviation is
2012 Variance to five
saved for future use,
management personnel
before implementing the individually, seeking their
procedure the company approval. No managers
should verify that the considered whether the
underlying conditions, condition of the FCC unit was
activities, and technical the same as it was in 2012.
assumptions that were the No one conducted a safety
basis for the initial analysis to identify whether
authorization are in place the safeguards in place for the
and are still valid. 2012 confined space entry
were still adequate for the
FIGURE 22 2015 planned operation. As
Equipment configuration specified in discussed below, the steam
2012 Variance and catalyst safeguards
discussed by the engineers in
2012 and specified in the 2012
Variance were not adequate or
5.2.2 USE OF 2012 were not maintained during
preparation for expander entry
VARIANCE IN 2015 in 2015.
Discussed above, in February 2015
Spent
the expander automatically shut

32 CSB · ExxonMobil Torrance Refinery Investigation Report

 Catalyst Slide providin FIGURE 23
Valve g an SCSV erosion
open identified post-
path for incident
The Spent Catalyst Slide SCSV diagram from http://www.tapcoenpro.com/fccu-slidevalves/ catalyst
Valve (SCSV) is a (accessed January 10, 2017)
to flow
control valve that through
controls the flow of the
catalyst from the reactor SPENT CATALYST valve
to the regenerator.
VALVE FAILURE even
when in
the fully
The 2012 Variance specified the closed closed
SCSV as a safeguard, with the intent for position.
it to develop a catalyst level above it to The
prevent the backflow of hydrocarbons to erosion
the regenerator. On the day of the prevente
incident, however, the SCSV could not d the
function as an effective safeguard during closed
SCSV
Safe Park because it had severely eroded
from
during its six years of operation. Leading
developi
to the incident, ExxonMobil refinery
ng the
personnel became aware that the SCSV
During normal operation, necessar
was not an effective safeguard during
the disc inside of the y
Safe Park, but they continued with their
SCSV is partially open to catalyst
expander maintenance attempt. This
regulate the catalyst flow barrier
to the regenerator. The section discusses the history of erosion of on the
continuous flow of the SCSV, ExxonMobil’s failure to day of
abrasive catalyst through effectively test the sealing capability of the
the partially open valve the valve, the refinery’s extended use of incident.
erodes both the disc and the SCSV beyond its established safe Photos
the sealing surfaces of the operating life, and the absence of an of the
valve. effective risk analysis to identify the erosion
safety consequences of valve failure identifie
during Safe Park. d in the
SCSV
are
Following the February 18, 2015
shown
incident, the CSB inspected the internal
in
components of the SCSV. The
Figure
inspection found the valve internals to be
23.
severely eroded to the point that the
valve could not seal. An area of
approximately 16 square inches eroded
away during six years of operation,

CSB · ExxonMobil Torrance Refinery Investigation Report 33

 5.3.1 SCSV TESTING STRATEGY INEFFECTIVE
KEY LESSON
When the FCC unit entered Safe Park on February 16, 2015, the
SCSV automatically closed. The SCSV is classified by
ExxonMobil as a “safety critical device.”50 As discussed It is essential to schedule
previously, for the SCSV to perform its safety function to prevent and perform maintenance
undesirable mixing of air and hydrocarbons while the FCC unit of safety-critical
was in Safe Park, ExxonMobil relied on the SCSV to sufficiently equipment so that the
seal so that catalyst particles could accumulate on top of the valve equipment is available to
and form a plug (Section 3.4). The CSB notes, however, that the perform its safety-critical
SCSV is a control valve, and the use of the SCSV in this way function.
treats it as a block valve which may be beyond its design intent.
With this qualifier, the CSB discusses in this section the
deficiencies that resulted in the SCSV not sufficiently sealing
during the 2015 Safe Park.
The SCSV operates in a severely erosive service. The continuous
flow of abrasive fluidized catalyst particles during normal
operation erodes the slide valve internals, which can prevent the
valve disc from sealing. ExxonMobil repaired the SCSV internals
during turnarounds in 2000, 2004, and 2009 because the valve
had eroded. An ExxonMobil “Equipment Degradation
Document” details the likelihood of SCSV inability to seal due to
erosion of the valve (Figure 24).

FIGURE 24
ExxonMobil Equipment Degradation Document

The Equipment Degradation

50 ExxonMobil defines a “safety critical device” as the last line of defense Document predicts the
against, or to be used to mitigate the consequences of, a significant probability of failure of the
undesirable process incident.

34 CSB · ExxonMobil Torrance Refinery Investigation Report

 SCSV due to erosion, based upon a four- to five-year run length of evaluation (e.g. management
the FCC unit between turnarounds. To ensure effective operability of change) to identify the
of the valve, ExxonMobil assigned it a testing interval of every four safety consequences of
years to make sure the valve could function as required to prevent a operating the SCSV for the
flow reversal during normal operation. To meet the four-year extended period.
testing requirement, ExxonMobil periodically partially closed the ExxonMobil also did not
SCSV while the unit operated to verify that the mechanical valve schedule its turnaround to
components functioned properly. While an important mechanical accommodate the safe
testing strategy, this testing method did not evaluate whether the operating life of the safety-
valve was eroded, or test whether the SCSV could close and seal. critical SCSV.
ExxonMobil therefore relied on the SCSV—specified as a safety-
critical device—without verifying that it could perform its safety
function of preventing air and hydrocarbons from mixing when the
unit was in Safe Park.
To effectively assess the integrity of the SCSV internals, the valve
had to be visually inspected to identify erosion that could prevent
the valve from performing its Safe Park safety-critical function—
sufficiently sealing to develop a catalyst barrier. 51 At the time of
the incident, however, ExxonMobil had been operating the SCSV
since January 2009—over six years—and had not performed a
visual inspection after the 4-5 year run length specified in the
Equipment Degradation Document. ExxonMobil therefore
operated the SCSV without verifying that the valve could perform
its safety-critical function. As a result, on the day of the incident,
the eroded SCSV could not establish a catalyst safeguard and did
not prevent hydrocarbons from entering the air side of the FCC
unit.

5.3.2 EXTENDED OPERATION

OF SCSV
ExxonMobil performed FCC unit turnarounds in 2000 and 2004.
The refinery scheduled the next turnaround for April 2009, but
due to timing of other projects taking place in the FCC unit, it was
split into two turnarounds that took place in
January 2009 and March 2010. ExxonMobil replaced the SCSV
during the January 2009 turnaround.
ExxonMobil planned to conduct its next FCC unit turnaround in
June 2015. This turnaround timing meant that the SCSV would
operate for over six years. ExxonMobil did not perform a risk

51 Putting the FCC Unit into Safe Park also tests the ability of the
SCSV to hold catalyst. If the valve is too eroded to hold a catalyst
level above it, however, that protective barrier is lost. This therefore
may be an unsafe method to test the SCSV.

CSB · ExxonMobil Torrance Refinery Investigation Report 35

 5.3.3 DAMAGE
KEY LESSON
MECHANISM
It is important to consider HAZARD REVIEW
all modes of operation— INEFFECTIVE
including non-routine
ExxonMobil performed a
operations such as unit
damage mechanism hazard
standby—when
review52 of the SCSV. The
performing process
hazard review correctly
hazard analyses. Incident
identified that erosion was a
scenarios could be
damage mechanism that
possible during
affected the SCSV.
nonroutine modes of
ExxonMobil, however,
operation that may not
identified only a financial
have been considered consequence of SCSV failure
when analyzing process by erosion. Despite the
hazards for normal, SCSV classification as a
continuous operation. safetycritical device, the
company did not
identify a safety and health
ExxonMobil damage
mechanism hazard consequence
(Figure 25). The CSB
review of SCSV erosion
identified no safety found that
ExxonMobil considered
consequence. “SHE”
stands for “Safety, only normal
operating conditions Health,
and Environment.” (emphasis
when identifying consequences
added)
of
failure. ExxonMobil did not
consider that an eroded
SCSV may not maintain a
catalyst plug while the FCC
unit was in Safe Park.

52 ExxonMobil called the

damage mechanism hazard
review an “Equipment
Strategy Document.”

36 CSB · ExxonMobil Torrance Refinery Investigation Report

 5.3.4 WORK PROGRESSED ON DAY OF INCIDENT solely on steam as a barrier to
prevent the flow of
WHEN IT WAS KNOWN SCSV WAS hydrocarbons into the air side
of the FCC unit.
LEAKING ExxonMobil did not,
ExxonMobil management knew the SCSV was leaking leading up however, perform a risk
to the incident. Notes from meetings of management personnel analysis of whether steam
questioning “Does the leaking spent slide valve invalidate the was a sufficient safeguard,
variance?” (Figure 26) and CSB interviews demonstrate that and did not analyze the steam
managers knew and discussed that the flow rate necessary to
KEY LESSON SCSV was leaking on the day of the prevent hydrocarbons from
incident. The catalyst level in the entering the air side of the
reactor—showing zero level—was FCC unit (Section 5.4). And
Companies should displayed on the FCC unit console, as discussed in Section 5.1,
develop operating measurements of high temperature had ExxonMobil previously
procedures for all modes downstream of the slide valve developed and followed a
of operation—including indicated that steam was leaking pre-established Safe Park
unit standby—that detail through the slide valve, and steam was operating procedure, it may
safe operating limits, visually observed leaking from have required unit shutdown
consequences of multiple locations on the air side of when the catalyst barrier was
deviating from those the FCC unit. lost.
limits, and specified
actions to implement in Despite the leaking SCSV,
the event the process ExxonMobil continued to try to
deviates outside of its isolate the expander from the process.
safe operating limits. At that point, the company relied

FIGURE 26

CSB · ExxonMobil Torrance Refinery Investigation Report 37

Notes from day of incident show that ExxonMobil knew of leaking
SCSV.
(emphasis added)

5.3.5 OPPORTUNITY FOR

SAFER DESIGN
As demonstrated by this incident, an SCSV may not effectively FIGURE 27
seal and develop a catalyst barrier during Safe Park. The CSB ExxonMobil FCC unit
learned that some FCC units include two SCSVs in series emergency shutdown
between the reactor and regenerator. The second SCSV operates procedure specifies that
only when the unit enters Safe Park, functioning as a block valve steam is a buffer (safeguard)
to accumulate a catalyst barrier. This strategy may reduce the between hydrocarbons and
potential of relying on an eroded SCSV to establish a catalyst air. (emphasis added)
barrier.

On the morning of February

STEAM BARRIER FAILURE 18, 2015, steam leaked out of
the open expander flange.
ExxonMobil operations
Despite it being the only remaining safeguard preventing management instructed the
hydrocarbons from flowing to the energized ESP, ExxonMobil console supervisor to reduce
never calculated the steam flow rate required to pressurize the the steam flow rate—in an
reactor to prevent hydrocarbons from backflowing to the air side attempt to reduce the amount
of the FCC unit. This section discusses ExxonMobil’s reliance on of steam exiting the expander
and lack of analysis of the 2,000 pounds per hour steam flow rate outlet flange—to allow
specified in the 2012 Variance, which was never technically maintenance workers to
analyzed by ExxonMobil prior to the 2015 expander maintenance install a blind safely. The
attempt. console supervisor reduced
the steam riser flow rate to
about 7,500 pounds per hour.
In Safe Park, steam is the second barrier between the hydrocarbon The company based this
and air side of the FCC unit. It is used to pressurize the reactor reduction in steam flow on
pressure above the main column pressure. Steam flows into the the 2012 Variance, which
reactor from several feed locations, one of which is the reactor specified a minimum steam
riser, separating air in the regenerator from hydrocarbons in the flow rate of 2,000 pounds per
main column (Figure 27). hour. But by reducing the
steam flow to 7,500 pounds
per hour, the reactor pressure
fell below the main column
pressure. The reduced
reactor pressure could no
longer prevent hydrocarbons
from the main column from

38 CSB · ExxonMobil Torrance Refinery Investigation Report

 entering the reactor, then flowing into the regenerator and the flue like “No, the engineers
gas system. have looked at it.” I
said, “Okay.”
In the 2012 Safe Park, the steam flow into the riser was reduced to
approximately 6,500 pounds per hour during the expander ExxonMobil can improve the
maintenance work. During that 2012 expander maintenance safety analysis of a proposed
operation, the catalyst barrier Variance by requiring a
KEY LESSON remained above the closed SCSV and multi-disciplinary team—
the main column pressure was lower composed of a technical
than its pressure in 2015 (Appendix expert such as a process
Robust management of A). engineer, a safety and health
change practices are representative, and an
When ExxonMobil developed the
needed when making experienced operator on the
Variance in 2012, the company
changes to procedures. applicable unit—to review
performed no analysis and provided no
Similar to PHAs, the proposed Variance before
justification for the 2,000 pounds per
conducting management hour steam flow rate. On the day of the its approval and
of change as a implementation.
incident, although ExxonMobil knew the
multidisciplinary group— catalyst safeguard was not in place, no
composed of individuals one conducted an analysis to determine
with different areas of whether the 2,000 pounds per hour steam
expertise—can assist in rate specified in the Variance was
identifying hazards sufficient—even though it served as the
introduced by the only remaining safeguard preventing
procedure change. hydrocarbons and air from mixing. Had
ExxonMobil conducted a safeguard
analysis, they may have required a
higher minimum steam flow rate, or
decided to shut down the FCC unit
before the expander maintenance could
be safely conducted.
The CSB also found that FCC unit
operators were not included in the 2012
Variance development process and
were not consulted on the day of the
incident about the 2,000 pounds per
hour steam flow rate specified in the
Variance. An ExxonMobil FCC unit
operator expressed to the CSB doubts
about relying on the 2,000 pounds per
hour steam flow rate:
I asked about the amount of
steam because it said 2,000
pounds [per hour], and I said,
“Shouldn’t it be a lot higher than
that?” And [my supervisor]’s

CSB · ExxonMobil Torrance Refinery Investigation Report 39

 HEAT EXCHANGER TUBE LEAK
Tubes in a heat exchanger connected to the FCC unit developed was clean and ready for use when
holes during extended operation, causing an increased main the operating heat exchanger had
column pressure that contributed to hydrocarbons flowing to the to be taken offline for cleaning,
ESP. inspection, and maintenance.

On the day of the incident, a higher than normal pressure in the

Post-incident photos of heat
main column allowed hydrocarbons to enter the reactor with the
exchanger tube bundle that
riser steam flow rate reduced to 7,500 pounds per hour. Leading
to the incident, the main column operated at a pressure of about leaked naphtha into main column
8.5 psig, roughly double the main column pressure during the slurry oil pumparound The tubes
2012 Safe Park (see Appendix A). of the operating heat exchanger
were scheduled to be cleaned to
In 2015, the column pressure had increased because a heat
remove process buildup and then
exchanger—that had an extended operation—on the slurry oil
be visually inspected in
pumparound loop was leaking naphtha into the slurry oil (Figure
September 2013. A block valve
28 and Figure 29). The high temperature of the slurry oil
that could isolate the heat
vaporized the more volatile naphtha, which increased the pressure
exchanger from the process,
of the main column.
however, would not sufficiently
The heat exchanger that leaked naphtha into the slurry oil close (Figure 30), and so the heat
exchanger cleaning and inspection
could not be completed while the
unit was operating. ExxonMobil
chose to continue operating the
fouled heat exchanger until the
next scheduled turnaround in June
2015.
In its Equipment Strategy
document, ExxonMobil
personnel previously
identified that the heat
exchanger tubes could corrode
and/or erode and leak naphtha
into the slurry oil, but they did
not identify that such a leak
could have negative safety
consequences during Safe
Park (Figure 31), and
FIGURE 28 identified only a minor
economic consequence
Leaking heat exchanger tube allowed light naphtha to enter main
(“Consequence IV” in Figure
column.
31 is an internal ExxonMobil
pumparound was one of two heat exchangers that provided heat to a
financial consequence
distillation column in a neighboring unit. The heat exchangers were
category). This specific main
designed so that one heat exchanger could be operated while the
column pressurization
second heat exchanger remained on standby. The standby exchanger

40 CSB · ExxonMobil Torrance Refinery Investigation Report

scenario could be difficult to identify—and was not identified by FCC UNIT
ExxonMobil—in typical hazard analyses. This underscores that
ExxonMobil could have best prevented this incident by REMAINED IN
FIGURE 29 SAFE PARK
AND WAS
NOT SHUT
DOWN

Leading to the incident, there

were indications that the
FCC unit was in an unsafe
state, but due to, among other
things, a lack of effective
safeguard analyses,
ExxonMobil never shut down
the unit. This section
discusses the missed
FIGURE 30 opportunities to identify the
potential for an ESP
Heat exchanger shell-side path showing isolation block valve that
explosion.
would not close
monitoring operating parameters that could directly verify
safeguard availability, and developing a procedure that required From the time the vibrating
corrective action (e.g. unit shutdown) when pre-determined safe expander caused the FCC
operating limits were deviated from to prevent hydrocarbon unit to go into Safe Park until
backflow through the process (Section 5.1). the explosion two days later,
the FCC unit remained
energized and hydrocarbons
ExxonMobil identified no safety consequence for leaking continued to circulate within
heat exchanger tubes. “SHE” stands for “Safety, Health, the unit. When ExxonMobil
and Environment.” (emphasis added) personnel identified the

FIGURE 31

leaking SCSV and the

absence of a catalyst barrier,
ExxonMobil chose to keep
the FCC unit in Safe Park

CSB · ExxonMobil Torrance Refinery Investigation Report 41

and proceed with working to enter the expander. When refinery EXXONMOBIL
personnel saw steam leaking out of the open flange, presenting a
hazard to workers, ExxonMobil kept the FCC unit in Safe Park, OPENED
choosing to reduce the steam flow rate to minimize worker
exposure. The ESP remained energized in Safe Park, and the
PROCESS
ignition source remained available when the reduction in steam EQUIPMENT
flow rate caused the pressure deviation that allowed hydrocarbons
to backflow through the process and reach the ESP. NOT IN
The CSB identified four main reasons ExxonMobil continued to CONFORMANCE
operate in Safe Park when personnel identified the SCSV had not WITH REFINERY
developed a catalyst barrier:
(1) It is faster to start the FCC unit up from Safe Park
STANDARDS
than from a complete shutdown, meaning production
can begin again sooner; The expander outlet could
(2) ExxonMobil believed that completely shutting down not be isolated in
the FCC unit was a non-routine, non-steady state conformance to
operation that could introduce greater hazards to ExxonMobil Torrance
refinery personnel; refinery safety policies
while the FCC unit was in
(3) ExxonMobil personnel did not conduct an analysis to
Safe Park. As a result,
identify the safety consequences of relying on the
ExxonMobil did not follow
single steam safeguard after they became aware that
refinery safety policies
the SCSV safeguard failed; and
when attempting to blind
(4) ExxonMobil did not have a Safe Park procedure that the expander outlet.
required unit shut down if a safety-critical safeguard,
such as a specific catalyst level above the closed
SCSV, was not established. ExxonMobil was motivated
to perform maintenance on
The CSB concludes that ExxonMobil personnel were likely not the expander while the unit
focusing on how the failure of the SCSV safeguard affected the was in Safe Park, but the
overall safety of the unit. Rather, refinery personnel were piping around the expander
primarily focusing on accessing the expander and restarting the was not designed to allow the
unit. expander to be safely
isolated.53 ExxonMobil

53 ExxonMobil could have

installed a blind between the
main column and the reactor
(a common industry term
for this blind is the “big
blind”). Installing this blind
could have prevented
hydrocarbons from
backflowing through the
process and reaching the
ESP. Some refineries use a
slide valve in place of or in

42 CSB · ExxonMobil Torrance Refinery Investigation Report

 management, however, chose to isolate the expander, described
below, using unreliable and unsafe isolation methods. KEY LESSON
On the day of the incident, ExxonMobil opened the expander
outlet flange so that a blind could be inserted to isolate the
Control valves typically
expander from the process for a confined space entry operation.
should not be used as
ExxonMobil corporate policies require double block and bleed to
block valves because fluid
isolate equipment prior to installing a blind, but also allow single
flow through a partially
block and bleed (which is detailed in the “Lock Out Tag Out
open control valve can
Procedure”) if that is the only option (Figure 32).
cause damage to the valve
that can limit its ability to
fully seal.

FIGURE 32
Excerpt from ExxonMobil Torrance Refinery equipment opening and
safe blinding procedure (emphasis added)

The Lock Out Tag Out Procedure states the following (Figure 33):

addition to the big blind.

CSB · ExxonMobil Torrance Refinery Investigation Report 43

 FIGURE 33
Excerpt from ExxonMobil Torrance Refinery Lock Out Tag Out
procedure (emphasis added)

The piping leading to the expander outlet flange was not

designed to allow double block and bleeding. The
maintenance bypass valve shown in Figure 34 could not be
used to isolate the expander from the process because it had a
hole designed into it for overpressure protection purposes. 54
ExxonMobil, therefore, had to perform a single block and
bleed to isolate the expander from the process. The only
valves available to isolate the expander outlet from process
fluids (steam and hydrocarbons) were the SCSV and RCSV.
These valves, however, are control valves that throttle the flow
of catalyst. ExxonMobil does not consider control valves to be
energy isolation devices that can be used to isolate equipment
for opening (Figure 33). Control valves typically should not be
used as block valves because fluid flow through a partially
open control valve can cause damage to the valve that can limit
its ability to fully seal. The site therefore did not comply with
refinery standards when attempting to insert the blind into the
expander outlet. If ExxonMobil management had adhered to FIGURE 34
the Lock Out Tag Out procedure, they would not have been Configuration used to isolate expander outlet fo
able to use the SCSV and RCSV to isolate the expander from
process fluids, and the expander outlet flange would not have
been able to be opened while the unit was in Safe Park.
Alternatively, ExxonMobil could have developed a Variance to
depart from the typical safety practice and conducted a detailed
ESP REMAINED
hazard evaluation to evaluate the safety of the proposed ENERGIZED WHEN
isolation strategy. ExxonMobil did not, however, develop a
Variance for this operation. In this instance, opening the
HYDROCARBONS
expander outlet flange led to the decision to reduce reactor ENTERED FLUE GAS
steam flow, which led to the ESP explosion.
SYSTEM

ExxonMobil hazard analyses

did not sufficiently address
the risk of hydrocarbon
backflow to the ESP. This
oversight resulted in an FCC
unit design that could not
detect all possible flammable
gases flowing toward the
54 The bypass valves are control valves used to control the pressure ESP. This section discusses
downstream of the regenerator. The hole designed into the the ignition of hydrocarbons
Maintenance Bypass valve prevents possible overpressure of the in the ESP at the ExxonMobil
regenerator. refinery.

44 CSB · ExxonMobil Torrance Refinery Investigation Report

 ESP, potentially causing a
fire or explosion (Figure 36).
The ESP generates sparks during normal operation. ExxonMobil
corporate design practices therefore require ESPs to be shut down
when a flammable gas mixture might enter them (Figure 35). On
the day of the incident, however, the Torrance refinery ESP was
not shut down when hydrocarbons flowed toward and entered the
energized ESP. As a result, sparks within the operating ESP
ignited the flammable mixture, resulting in the explosion. This
section discusses CSB findings of why the ESP was not
automatically shut down when hydrocarbons entered the flue gas
piping leading to the ESP.

FIGURE 36
PHA performed in 2006
identified flammable vapor
could reach ESP. PHA
recommended installing
sensors to detect flammable
vapor and to initiate shut down
of ESP. (emphasis added)
FIGURE 35
In its 2006 PHA, however,
ExxonMobil corporate design practices require ESPs to be shut down
the company did not identify
when an explosive mixture might enter them. (emphasis added)
specific scenarios that could
cause the generically termed
“flammable vapors” to reach
the ESP. ExxonMobil
resolved the action item by
installing carbon monoxide
(CO) analyzers in the flue gas
5.8.1 HYDROCARBONS IN FLUE GAS PIPING DID system to detect combustible
NOT TRIGGER ESP SHUTDOWN gases flowing into the ESP.
Carbon monoxide is a
The ExxonMobil Torrance refinery installed a new ESP into the
flammable gas that can be
FCC unit in 2009 to meet new environmental regulations. 55 The
generated by incomplete
refinery contracted an engineering services firm to design and
combustion of hydrocarbons
construct the new ESP. The engineering services firm performed
within the FCC unit.
a Process Hazard Analysis (PHA) on the design in November
ExxonMobil chose to install
2006. The PHA identified that flammable vapors could reach the
CO analyzers to detect
55 SCAQMD, "Rule 1105.1, Reduction of PM10 and Ammonia flammable vapors because
Emissions from Fluid Catalytic Cracking Units," 07 November ExxonMobil personnel
2003. [Online]. Available: http://www.aqmd.gov/docs/default-
believed any hydrocarbon
source/rule-book/reg-xi/rule-1105-1.pdf?sfvrsn=4. [Accessed 07
March 2017].
vapors within the flue gas

CSB · ExxonMobil Torrance Refinery Investigation Report 45

 system would be accompanied by carbon monoxide. ExxonMobil
personnel believed hydrocarbons would partially combust in the
FCC unit, producing CO (Figure 37). The 2006 PHA, the action
item resolution team, and the subsequent PHAs performed in
2009 and 2014, did not consider the scenario of hydrocarbons
entering the flue gas piping while the unit was in Safe Park, when
heat is not available to initiate the combustion reaction that
produces CO.
On the day of the incident, while the unit was in Safe Park,
hydrocarbons entered the flue gas system without the presence of
CO. With no analyzer for hydrocarbons, the flammable
atmosphere could not be detected. As a result, the energized ESP
ignited the hydrocarbons and caused an explosion. The Torrance
refinery designed the ESP to remain energized during Safe Park
in order to comply with environmental regulations requiring
removal of catalyst fines from discharge gases released to the
atmosphere.56

FIGURE 37
ExxonMobil Torrance Refinery personnel determined that any
flammable hydrocarbons entering the ESP would be accompanied
by carbon monoxide (CO) due to partial combustion in the
regenerator. (emphasis added)

56 SCAQMD, "Rule 1105.1, Reduction of PM10 and Ammonia

Emissions from Fluid Catalytic Cracking Units," 07 November
2003. [Online]. Available: http://www.aqmd.gov/docs/default-
source/rule-book/reg-xi/rule-1105-1.pdf?sfvrsn=4. [Accessed 07
March 2017].

46 CSB · ExxonMobil Torrance Refinery Investigation Report

 5.8.2 PREVIOUS ESP where they mixed with
KEY LESSON purge air also flowing
HYDROCARBON EXPLOSIONS into the ESP. The ESP
The CSB is aware of at least two other ignited the mixture,
Uncombusted causing an explosion.
hydrocarbons that are not incidents similar to the 2015 ExxonMobil
Torrance incident where hydrocarbons No injuries were
accompanied by carbon reported.
mixed with air, resulting in an ESP
monoxide have the
explosion:
potential to reach FCC
unit electrostatic 1. On October 28, 1994, an
precipitators (ESPs). explosion occurred at the Conoco
Refining companies Lake Charles Refinery in 5.8.3
should evaluate their FCC Westlake, Louisiana.57 Similar to
the ExxonMobil incident,
OPPORTUNITIES FOR SAFER
units to determine whether
there are sufficient hydrocarbons from the FCC unit DESIGN
safeguards to prevent an main column entered the air side The 2015 ExxonMobil
ESP hydrocarbon of the FCC unit. The incident, as well as previous
explosion. hydrocarbon source was SNG FCC unit incidents in the
(sweet natural gas) that was being refining industry, show that
used to maintain pressure on the hydrocarbons can and have
main column. The hydrocarbons ignited in refinery ESPs. CO
mixed with air and ignited, analyzers may not be
causing an explosion that ruptured sufficient to identify all
the ESP. One person was killed potential flammable gases in
and nine were injured. flue gas piping leading to an
ESP; hydrocarbons may enter
2. On January 10, 2013, an flue gas piping without CO
explosion occurred in the also being present.
Chevron Salt Lake Refinery ESP.
During a unit upset, refinery Following the February 18,
personnel fed hydrocarbons58 to 2015 incident, based upon
the regenerator to maintain the information obtained by
regenerator temperature to allow ExxonMobil, TORC
for a more efficient re-start of the personnel communicated to
FCC unit. At the time, however, the CSB that it was TORC’s
the main air blower was not understanding that
operating at full capacity, and the hydrocarbon detectors could
hydrocarbons did not fully not adequately function at the
combust inside of the hot very high temperatures
regenerator. Unburned typical in the flue gas piping.
hydrocarbons traveled to the ESP, This reasoning could have
contributed to the decision by
57 AP News Archive, "Explosion Rocks Refinery, Killing a Worker," ExxonMobil to install only
28 October 1994. [Online]. Available: CO analyzers to detect
http://www.apnewsarchive.com/1994/Explosion-Rocks-Refinery-Killing-a-
Worker/id-85c44b8bc43388a815cf474c5ffdbce7. [Accessed 07 March 58 The hydrocarbons
2017]. mentioned here were torch oil.

CSB · ExxonMobil Torrance Refinery Investigation Report 47

flammable vapors in the flue gas piping because CO analyzers
may be able to operate at a higher temperature than hydrocarbon
detectors. To prevent ESP explosions, it may be essential to be
able to detect hydrocarbons—not in the presence of CO—in the 6.0 CAUSAL
flue gas system leading to ESPs. The inability to detect
hydrocarbons in FCC unit flue gas systems may be an ANALYSIS OF
industrywide process safety design weakness. MODIFIED HF
In addition, it is not clear for how long after an ESP shuts down it
continues to spark, creating potential ignition sources. The CSB
ALKYLATION UNIT
identified industry references that indicate an ESP may continue NEAR MISS
to contain ignition sources for hours after they are shut down. An
alternative design could possibly include an emergency ESP Following the ESP explosion,
bypass or an emergency grounding system to prevent ignition in a portion of the ESP fell to
the ESP. At the time of the incident, once a flammable gas the ground. A large fragment
entered the flue gas system, the only path it could follow routed it struck scaffolding59
to the ESP. Furthermore, because the ESP is known within the surrounding the MHF
refining industry to cause explosions, a potentially safer design alkylation unit.60 This
could incorporate, for example, explosion relief panels to control scaffolding was located
where an explosion is vented. This design could help ensure that within a few feet of the
debris is directed away from hazardous areas, such as the MHF alkylation unit’s settler
alkylation unit. Alternatively, the use of a wet gas scrubber tanks61 (Figure 38), each
instead of an ESP may achieve the required emissions control containing hydrofluoric acid
while reducing or eliminating possible ignition sources. (HF), water, hydrocarbons,
and a chemical additive
intended to reduce the
amount of HF vaporized
during a loss of containment
event.62 Discussed

59 The scaffolding was

temporarily in place for work
being done on the alkylation
unit.
60 Alkylation is the reaction
of propylene or butylene
with isobutane, in the
presence of a catalyst such
as HF, to create an
isoparaffin called alkylate,
which is used as a blending
agent in high octane
gasoline.
61 The settler tanks separate
hydrocarbons from the acid in
the MHF alkylation unit.
62 ExxonMobil had installed
multiple mitigation systems

48 CSB · ExxonMobil Torrance Refinery Investigation Report

 previously, the CSB has issued subpoenas for safety information FCC unit and in close
pertaining to the potential release of HF in the event the tanks proximity to other units
were struck by explosion debris, and is pursuing enforcement of (Figure 39). For example,
the subpoenas in US Federal district court.63 the distance from the ESP to
the alkylation unit is
approximately 80 feet. From
the ESP to the Pretreater
Unit65 is less than 50 feet.
And from the ESP to the
Demineralization Unit,
located directly south of the
ESP, is also less than 50 feet
away.
ExxonMobil
constructed the ESP
in its chosen location
because there were
“no feasible
alternative Overhead
view of a portion of
the Torrance refinery
FIGURE 38
ESP sites.”
Damage to scaffolding surrounding the MHF alkylation
Specifically, given
unit’s settler tanks. The alkylation unit produces
hydrocarbons used as a blending component to increase the refinery’s
the octane rating of gasoline.

ESP SITING
The ESP was installed in the FCC unit in 2009, to
comply with new environmental regulations.64
ExxonMobil constructed the ESP adjacent to the

to control a release of HF, but has not provided the CSB with
documentation to explain those control systems. Therefore, the
CSB could not analyze whether the safeguards could prevent a
potential release of HF outside of the refinery property.
63 ExxonMobil has not provided this information to the CSB because they
have stated that the requested documents are not within the CSB’s 65 The pretreater unit removes
jurisdiction in investigating the causes of the February 18, 2015 incident. unwanted chemical
64 SCAQMD, "Rule 1105.1, Reduction of PM10 and Ammonia components from the
Emissions from Fluid Catalytic Cracking Units," 07 November FIGURE
2003.39 hydrocarbon feed prior to it
[Online]. Available: http://www.aqmd.gov/docs/default-source/rule- being sent to various units
book/reg-xi/rule-11051.pdf?sfvrsn=4. [Accessed 07 March 2017]. for further processing.

CSB · ExxonMobil Torrance Refinery Investigation Report 49

 “limited space and logistical constraints,” other sites were Regulatory oversight of unit
“deemed infeasible.”66 It was found that “the new siting is addressed by
ESPs must be located adjacent to the existing FCC [unit].”67 Cal/OSHA69 through its PSM
Constructing the ESP further away from the FCC standard70 and also by the
“would require additional duct work, more blowers, more support Environmental Protection
facilities, increased energy use (to accommodate any potential Agency through its RMP
pressure drops), and more extensive construction activities . . . .” 68 standard.71 In addition to the
current PSM regulation,
Cal/OSHA is seeking to draft
improvements to its PSM
standard.72 The current
6.1.1 PREVENTING CONSEQUENCES OF AN ESP proposed draft requires that
EXPLOSION companies address in their
PHAs ”[f]acility siting,
ExxonMobil addresses process unit siting hazards by conducting including the placement of
risk assessments based upon prescriptive spacing requirements for processes, equipment, buildings,
specific processes and materials. For the ESP siting, however, employee occupancies and work
ExxonMobil only conducted these risk assessments for units stations, in order to effectively
within 50 feet of the intended ESP location. protect employees from process
Because the new ESP was located within 50 feet of the pretreater safety hazards.”73,74
unit and the power distribution center, ExxonMobil analyzed siting
hazards associated with the close proximity. ExxonMobil performed 69 Cal/OSHA develops and
no analysis for the siting of the ESP relative to the alkylation unit, administers job safety and
however, because the alkylation unit was more than 50 feet away. health programs for workers
in California. Cal/OSHA is
The ESP was constructed in close proximity to settler tanks
the state OSHA program for
containing, among other substances, HF which is a highly toxic
California.
chemical. The CSB notes that ESPs have historically caused 70 8 CCR § 5189. Process
explosions in the refining industry. Two of these incidents are Safety Management of
discussed in Section 5.8.2, but the CSB is aware that additional ESP Acutely Hazardous
explosions have occurred. Materials [Online].
The siting of equipment that is known within the industry to cause Available:
explosions ideally should have required a risk assessment. Because https://www.dir.ca.gov/title
8/5189.html. [Accessed 07
the HF settler tanks were more than 50 feet away, however,
March 2017].
ExxonMobil did not perform a risk analysis of the ESP proposed
71 40 CFR § 68.67 Chemical
location relative to the HF settler tanks.
Accident Prevention
Provisions.
72 State of California
Department of Industrial
66 SCAQMD, "Final Environmental Impact Report for the Relations, "DIR and the
ExxonMobil Torrance Refinery Rule 1105.1 Compliance Project," Governor's Interagency
March 2007. [Online]. Available: Refinery Task Force,"
http://www.aqmd.gov/docs/default- [Online].
source/ceqa/documents/permitprojects/2007/exxon/feir.pdf? Available:
sfvrsn=2. [Accessed 07 March 2017]. http://www.dir.ca.gov/dosh/interag
67 Id. ency-refinery-task-force.html.
68 Id. [Accessed 07 March 2017].

50 CSB · ExxonMobil Torrance Refinery Investigation Report

 In addition to the Cal/OSHA proposed PSM standard siting • November 15,
requirements, the CSB recommends that ExxonMobil and TORC 2016—A fire
perform a siting risk analysis of the ExxonMobil and Torrance occurred while
refinery ESPs, respectively, and implement appropriate work was being
safeguards to minimize the consequences of an ESP explosion. conducted on a
portion of the
refinery flare
system in the
alkylation unit.
• February 1,
2017—A fire
occurred in the
Torrance
refinery tank
farm.
• February 18,
2017—A pump-
related fire
occurred in the
7.0 ADDITIONAL TORRANCE REFINERY crude unit.
INCIDENTS In previous investigations,
such as the Chevron
Since the February 18, 2015 ESP explosion, the Torrance refinery Richmond refinery
has experienced multiple incidents under both ExxonMobil and investigation76 and the
PBF ownership. The incidents75 that have occurred since the ESP Williams Geismar Olefins
explosion include: plant investigation,77 the CSB
• September 6, 2015—A leak from a clamped pipe in 76 U.S. Chemical Safety and
the alkylation unit caused a hydrofluoric acid Hazard Investigation Board,
release. The release did not result in any injuries or "Final Investigation Report -
off-site consequences, but because the leaking clamp Chevron Richmond Refinery Pipe
Rupture and Fire," 2015.
was connected to a vessel containing thousands of
[Online]. Available:
pounds of hydrofluoric acid. http://www.csb.gov/file.aspx?
DocumentId=666. [Accessed 07
March 2017]. See
73 "Standards Presentation to California Occupational Safety and recommendations 2012-03-I-CA-
Health Standards Board," [Online]. Available: R36 and 2012-03-I-CA-R37.
http://www.dir.ca.gov/OSHSB/documents/Process-Safety- 77 U.S. Chemical Safety and
Management-for-Petroleum-Refineriess-proptxt.pdf. [Accessed 07 Hazard Investigation Board,
March 2017]. "Williams Geismar Olefins
74 The California Accidental Release Prevention (CalARP) Program also Plant Reboiler Rupture and
requires that PHAs address “[s]tationary source siting.” 19 CCR § Fire," October 2016. [Online].
2760.2(c)(5) [Online]. Available: Available:
http://www.caloes.ca.gov/FireRescueSite/Documents/CalARP http://www.csb.gov/file.aspx?
%20Regulations%2001012015.pdf. [Accessed 07 March 2017]. DocumentId=753. [Accessed 07
75 Due to the limited scope of the CSB’s investigation into these March 2017]. See
incidents, the CSB is not issuing formal recommendation(s) to PBF recommendation 2013-03-I-
or ExxonMobil based upon these incidents. LA-R1.

CSB · ExxonMobil Torrance Refinery Investigation Report 51

 recommended the implementation of continual improvement Petroleum Refineries”
programs to improve process safety culture. The CSB encourages regulation.82 The draft
TORC to implement a process safety culture continual regulation proposes
improvement program at the Torrance refinery. 78 Such a requirements that could help
program may help prevent process safety incidents at the refinery. to prevent causal factors that
led to the February 2015
ExxonMobil incident.

DAMAGE
MECHANISM
REVIEW
8.0 CALIFORNIA PSM REFORM The draft regulation proposes
79
In its Chevron Richmond Refinery interim and regulatory 80 the requirement for refineries
reports, the CSB issued recommendations to the to conduct Damage
State of California to enhance its process safety management Mechanism Reviews
regulations for petroleum refineries. Since the August 6, 2012 (DMRs). The draft
Chevron incident, California has made significant progress in regulation states “[t]he DMR
developing new, proposed regulations in its effort to “advance the for each process shall include
safety, health and environmental performance of the state’s […] [i]dentification of all
refinery sector through prevention, emergency preparedness, and potential damage
community engagement.”81 mechanisms, pursuant to
subsection (k)(9).” Section
In July 2016, the California Department of Industrial Relations (k)(9) includes “[e]rosion,
published a draft of its proposed “Process Safety Management for such as abrasive wear,
adhesive wear and fretting”
as damage mechanisms to be
78 California drafted a proposed process safety management regulation for analyzed. The draft
petroleum refineries, which includes a requirement to “develop, regulation also proposes that
implement and maintain an effective [Process Safety Culture “[t]he PHA shall address […]
Assessment] program.” See "Standards Presentation to California DMR reports that are
Occupational Safety and Health Standards Board," [Online]. Available: applicable to the process
http://www.dir.ca.gov/OSHSB/documents/Process-Safety-Management-for-
units ….”83
Petroleum-Refineriess-proptxt.pdf. [Accessed 07 March 2017].
A regulatory requirement to
79 U.S. Chemical Safety and Hazard Investigation Board, "Interim
perform DMRs and analyze
Investigation Report - Chevron Richmond Refinery Fire," [Online].
Available: http://www.csb.gov/file.aspx?DocumentId=662 .
[Accessed 07 March 2017]. 82 "Standards Presentation to
California Occupational
80 U.S. Chemical Safety and Hazard Investigation Board, "Regulatory
Safety and Health Standards
Report - Chevron Richmond Refinery Pipe Rupture and Fire,"
Board," [Online]. Available:
October 2014. [Online]. Available: http://www.csb.gov/file.aspx?
http://www.dir.ca.gov/OSHSB/doc
DocumentId=661. [Accessed 07 March 2017].
uments/Process-Safety-
81 State of California Department of Industrial Relations, "DIR and Management-for-Petroleum-
the Governor's Interagency Refinery Task Force," [Online]. Refineriess-proptxt.pdf. [Accessed
Available: http://www.dir.ca.gov/dosh/interagency-refinery-task-force.html . 07 March 2017].
[Accessed 07 March 2017]. 83 Id.

52 CSB · ExxonMobil Torrance Refinery Investigation Report

 them during PHAs could facilitate refining companies to identify combined
the potential consequences of equipment degradation (e.g. erosion effectiveness
of the ExxonMobil SCSV) and the effects of that degradation of additional
during all modes of operation (e.g. Safe Park). or alternative
safeguards
that may be
EMPLOYEE PARTICIPATION
needed.85
The draft California PSM regulation for refineries proposes new
requirements to increase the participation of operations personnel The draft regulation proposes
in process safety management. The draft regulation states “the using a tool such as Layer of
employer shall develop, implement and maintain a written plan to Protection Analysis (LOPA)
effectively provide for employee participation in all PSM to “identify the most
elements” which includes: protective safeguards.”86
Effective participation by affected operating and This proposed regulatory
maintenance employees and employee change could help refining
representatives, at the earliest possible point, in companies to focus on
performing PHAs, DMRs, [Hierarchy of Hazard determining the quality and
Controls Analyses], [Management of Change], effectiveness of critical
Management of Organizational Change safeguards (e.g. SCSV
(MOOCs), Process Safety Culture Assessments catalyst accumulation and
(PSCAs), Incident Investigations, [Safeguard steam flow) to prevent a
Protection Analyses], and [Pre-Startup Safety major process safety incident.
Reviews].84
This proposed regulation change could require refining companies
to include additional knowledgeable personnel in changes to CONCLUSIONS
safety procedures (e.g. ExxonMobil’s Variance, a type of MOC),
The CSB views the
which could help include a broader knowledge base when
modernization of United
specifying operational safeguards (e.g. riser steam flow rate).
States process safety
management regulations as
one of the most important
SAFEGUARD PROTECTION ANALYSIS chemical safety improvement
The draft regulation also proposes enhanced Safeguard Protection goals.87 In previous
Analyses—tools to assess the effectiveness of safeguards. The
85 "Standards Presentation to
draft regulation states:
California Occupational
For each scenario in the PHA that identifies the Safety and Health Standards
potential for a major incident, the employer shall Board," [Online]. Available:
perform an effective written [safeguard protection http://www.dir.ca.gov/OSHSB/doc
uments/Process-Safety-
analysis] to determine the effectiveness of Management-for-Petroleum-
existing individual safeguards, the combined Refineriess-proptxt.pdf. [Accessed
effectiveness of all existing safeguards for each 07 March 2017].
86 Id.
failure scenario in the PHA, the individual and
87 U.S. Chemical Safety and
combined effectiveness of safeguards
Hazard Investigation Board,
recommended in the PHA, and the individual and "Drivers of Critical
84 Id. Chemical Safety Change,"

CSB · ExxonMobil Torrance Refinery Investigation Report 53

 investigation reports,88 the CSB has issued safety should verify that the
recommendations with the goal of improving process safety underlying conditions,
management regulations at Federal, state, and local levels, to help activities, and technical
prevent catastrophic industrial accidents. 89 The CSB supports the assumptions that were
effort to improve process safety management of California the basis for the initial
refineries. The CSB encourages California to fully implement the authorization are in
recommendations issued as a result of the CSB Chevron place and are still valid.
Richmond refinery investigation.90
3. It is essential to
9.0 KEY LESSONS schedule and perform
maintenance of safety-
1. It is essential to identify and define safe operating limits for critical equipment so
all modes of operation, and measure process conditions and that the equipment is
parameters that can verify the operation of the process available to perform its
relative to those safe operating limits. When a facility relies safety-critical function.
on operating parameters that only indirectly provide
information on critical process parameters, it can lead to the 4. It is important to
inability to identify when a process is in an unsafe condition. consider all modes of
operation—including
2. When implementing a deviation from an existing procedure, non-routine operations
it is critical that the company conduct a management of such as unit standby—
change to—among other requirements—verify and authorize when performing
the technical basis, the implementation time period, and process hazard analyses.
identify any new or affected hazards and associated Incident scenarios could
mitigation strategies. If the procedure deviation is saved for be possible during non-
future use, before implementing the procedure the company routine modes of
operation that may not
[Online]. Available: http://www.csb.gov/drivers-of-critical- have been considered
chemical-safety-change/. [Accessed 07 March 2017]. when analyzing process
88 See CSB investigation reports on the Chevron Refinery Fire, hazards for normal,
Tesoro Refinery Fatal Explosion and Fire, Motiva Enterprises
continuous operation.
Sulfuric Acid Tank Explosion, BP Texas City Explosion, Improving
Reactive Hazard Management report, Donaldson
5. Companies should
Enterprises, Inc. Fatal Fireworks Disassembly Explosion and Fire, and the
West Fertilizer Explosion and Fire. See U.S. Chemical Safety and Hazard develop operating
Investigation Board, "Process Safety Management Investigations - procedures for all modes
Investigations with findings related to modernization of process safety of operation—including
management," [Online]. Available: unit standby—that detail
http://www.csb.gov/recommendations/process safety-management-
investigations/. [Accessed 07 March 2017]. safe operating limits,
89 For a full list of the CSB recommendations for PSM consequences of
modernization, see U.S. Chemical Safety and Hazard Investigation deviating from those
Board, "PSM Recommendations - Open Recommendations for PSM limits, and specified
modernization," [Online]. Available: actions to implement in
http://www.csb.gov/recommendations/psm-recommendations/. the event the process
[Accessed 07 March 2017].
deviates outside of its
90 U.S. Chemical Safety and Hazard Investigation Board, "Chevron
Refinery Fire," [Online]. Available: safe operating limits.
http://www.csb.gov/chevron-refinery-fire/. [Accessed 07 March 2017].

54 CSB · ExxonMobil Torrance Refinery Investigation Report

6. Robust management of change practices are needed when The CSB identified several
making changes to procedures. Similar to PHAs, conducting process safety design
management of change as a multidisciplinary group— weaknesses in the Torrance
composed of individuals with different areas of expertise— refinery FCC unit at the time
can assist in identifying hazards introduced by the procedure of the February 18, 2015
change. incident. The piping and
equipment between the
7. Control valves typically should not be used as block valves regenerator and ESP were not
because fluid flow through a partially open control valve can configured with
cause damage to the valve that can limit its ability to fully instrumentation to detect
seal. hydrocarbons (not in the
presence of carbon
8. Uncombusted hydrocarbons that are not accompanied by monoxide) flowing toward
carbon monoxide have the potential to reach FCC unit the ESP. Due to possible
electrostatic precipitators (ESPs). Refining companies temperature limitations of
should evaluate their FCC units to determine whether there hydrocarbon detection
are sufficient safeguards to prevent an ESP hydrocarbon instrumentation, this may be
explosion. an industry-wide problem.
As demonstrated by this
incident and previous
incidents described in this
report, hydrocarbons can and
have accumulated and ignited
10.0 CONCLUSIONS in FCC unit ESPs. The
inability to detect
This incident was preventable; weaknesses in the ExxonMobil hydrocarbons in piping and
Torrance refinery’s process safety management program led to a equipment leading to a
hydrocarbon backflow in the FCC unit and ignition in the ESP. potential, unintended ignition
ExxonMobil did not develop a procedure specifically for source (i.e. an ESP) may be a
operating in Safe Park that established safe operating limits and process safety deficiency.
the process conditions that required unit shutdown. In addition,
ExxonMobil did not adequately define the function of its safety- In addition, the spent catalyst
critical equipment while in Safe Park, and did not ensure the slide valve could not reliably
safety-critical equipment could perform its safety-critical isolate the hydrocarbon side
function. ExxonMobil also did not sufficiently perform risk and air side of the FCC unit
analyses to identify the adequacy of its Safe Park safeguards. from one another.
Effective safeguards were not established to prevent the incident. ExxonMobil relied on the
At the Chevron Richmond refinery, piping material of SCSV as a safety-critical
construction and relied-upon inspection techniques did not block valve while in Safe
prevent pipe failure from sulfidation corrosion. 91 Park, but the SCSV was
designed to be a control valve
and could not adequately
91 U.S. Chemical Safety and Hazard Investigation Board, "Final seal. Other refineries may be
Investigation Report - Chevron Richmond Refinery Pipe using SCSVs in this way,
Rupture and Fire," 2015. [Online]. Available: which may be beyond their
http://www.csb.gov/file.aspx?DocumentId=666. [Accessed 07 March design intent. The CSB calls
2017].

CSB · ExxonMobil Torrance Refinery Investigation Report 55

on refining companies to analyze the causal factors, key lessons, operation. In the event
and recommendations from this incident, and look for the expert team members
opportunities to prevent a similar incident at their own facilities. do not come to a
consensus that the
Variance measures can
result in a safe operation,
require the proposed
work to be routed to a
higher management level
for final approval.

2015-02-I-CA-R2
ExxonMobil did not
have an operating
procedure for
operating the FCC unit
in its Safe Park mode
of operation. At all
11.0 RECOMMENDATIONS ExxonMobil U.S.
refineries, develop a
program to ensure
EXXONMOBIL CORPORATION operating procedures
are written and
2015-02-I-CA-R1 available for each
A Variance to a safety policy or procedure requires robust mode of operation—
analysis of the proposed safeguards prior to its approval such as unit standby—
and implementation. To ensure the proposed methodology for all ExxonMobil
described in the Variance is safe and the proposed U.S. refinery FCC
safeguards are sufficiently robust, revise corporate and U.S. units. Specify in the
refinery standard(s) to require that a multidisciplinary team program that
reviews the Variance before it is routed to management for ExxonMobil U.S.
their approval. Include knowledgeable personnel on the refineries develop and
Variance multidisciplinary team such as: train operators on any
new procedure.
(1) the developer of the Variance;
(2) a technical process representative (e.g. process
engineer for the applicable unit); 2015-02-I-CA-R3
(3) an hourly operations representative (e.g. The spent catalyst slide
experienced operator in the applicable unit); and valve, specified as a
safety-critical device
(4) a health and safety representative. for normal operation,
The role of the multidisciplinary team is to formally meet to could not perform its
review, discuss, and analyze the proposed Variance, and safety-critical function
adjust the safety measures as needed to ensure a safe of preventing air and

56 CSB · ExxonMobil Torrance Refinery Investigation Report

hydrocarbons from mixing while the FCC unit was in its 2015-02-I-CA-R5
“Safe Park” mode of operation. Also, ExxonMobil
Electrostatic
Torrance did not operate the FCC unit as if the reactor steam
precipitators create
was a safety critical safeguard. Require identification of all
potential ignition
safety critical equipment and consequence of failure for
sources during normal
each mode of operation and ensure safety critical devices
operation, and have
can successfully function when needed. Develop and
historically caused
implement a policy that requires all U.S. ExxonMobil
explosions within the
refineries to:
refining industry. At
(1) specify each safety-critical device’s safety all U.S. ExxonMobil
function; refineries, require a
siting risk analysis be
(2) identify the consequences of failure of each
performed of all
safety-critical device;
electrostatic
(3) specify the testing strategy used to verify whether precipitators and
the safety-critical device can function as intended implement appropriate
to perform its required safety function; and safeguards to
(4) maintain target availability (e.g. safe operating minimize the
life) for each safety-critical device through consequences of an
inspection and maintenance. electrostatic
precipitator explosion.
Require that items (1) through (4) above consider each mode
of operation, including but not limited to normal operation,
start up, shut down, and “Safe Park” modes of operation.

2015-02-I-CA-R4
ExxonMobil extended the maintenance interval of the spent
catalyst slide valve and the inspection interval of the
pumparound heat exchanger without analyzing whether the
extended operation lowered their availability (by operating
them beyond their predicted safe operating life) and could
result in negative safety consequences. In the event safety-
critical equipment is operated beyond its inspection and/or
maintenance interval (e.g. extended turnaround interval),
require all ExxonMobil U.S. refineries to perform a risk
evaluation (e.g. MOC or risk assessment) to identify the
safety consequences of the extended operation. Require TORRANCE
that each mode of operation, including but not limited to REFINING COMPANY
normal operation, start up, shut down, and “Safe Park”
modes of operation is evaluated during the risk evaluation. 2015-02-I-CA-R6
Implement protective
systems that prevent
ignition of flammable

CSB · ExxonMobil Torrance Refinery Investigation Report 57

 gases (including hydrocarbons not in the presence of CO) Park” modes of
inside of the electrostatic precipitator, for each mode of operation is evaluated
operation. during the risk
evaluation.

2015-02-I-CA-R7
The spent catalyst slide valve, specified as a safety-critical 2015-02-I-CA-R9
device for normal operation, could not perform its safety- Electrostatic precipitators
critical function of preventing air and hydrocarbons from create potential ignition
mixing while the FCC unit was in its “Safe Park” mode of sources during normal
operation. Require identification of all safety critical operation, and have
equipment and consequence of failure for each mode of historically caused
operation and ensure safety-critical devices can explosions within the
successfully function when needed. Develop and refining industry. At the
implement a policy that requires the Torrance refinery to: Torrance refinery,
(1) specify each safety-critical device’s safety require a siting risk
function; analysis be performed of
(2) identify the consequences of failure of each the FCC unit electrostatic
safety-critical device; precipitator and
(3) specify the testing strategy used to verify whether implement appropriate
the safety-critical device can function as intended safeguards to minimize
to perform its required safety function; and the consequences of an
(4) maintain target availability (e.g. safe operating electrostatic precipitator
life) for each safety-critical device through explosion.
inspection and maintenance.

Require that items (1) through (4) above consider each mode AM
of operation, including but not limited to normal operation, FUEL AND
start up, shut down, and “Safe Park” modes of operation.
PETROCHEMICAL
MANUFACTURERS
2015-02-I-CA-R8
The Torrance refinery extended the maintenance interval 2015-02-I-CA-R10
of the spent catalyst slide valve and the inspection interval Facilitate forum(s)—
of the pumparound heat exchanger without analyzing attended by fluid
whether the extended operation lowered their availability catalytic cracking unit
(by operating them beyond their predicted safe operating engineers and other
life) and could result in negative safety consequences. In relevant personnel from
the event safety critical equipment is operated beyond its American Fuel and
inspection and/or maintenance interval (e.g. extended Petrochemical
turnaround interval), require the Torrance refinery to Manufacturers member
perform a risk evaluation (e.g. MOC or risk assessment) to companies—to discuss
identify the safety consequences of the extended operation. the causal factors of the
Require that each mode of operation, including but not February 18, 2015
limited to normal operation, start up, shut down, and “Safe ExxonMobil Torrance

58 CSB · ExxonMobil Torrance Refinery Investigation Report

 refinery incident. Encourage participants to share topics such 40 CFR § 68.67 Chemical
as design, maintenance, and procedural practices that can Accident Prevention
prevent a similar incident. Topics of discussion should Provisions.
include:
(1) Detection of hydrocarbons flowing to an ESP; 8 CCR § 5189. Process
Safety Management of
(2) Isolation strategies to prevent mixing of air and
Acutely Hazardous Materials
hydrocarbons during standby operations;
[Online]. Available:
(3) Safe operation during unit standby;
https://www.dir.ca.gov/title8/
(4) Use of SCSVs as a safeguard during standby
5189.html. [Accessed 07
operations;
March 2017].
(5) Use of reactor steam as a safeguard during standby
operations;
A. Hopkins, Lessons from
(6) Measuring reactor / main column differential
Longford: The Esso Gas
pressure during standby operations;
Plant Explosion, CCH
(7) ESP explosion safeguards; and
Australia, 2000.
(8) Preventing ESP explosions.

Create documentation that creates institutional knowledge AP News Archive,

of the information discussed in the forum(s), and share "Explosion Rocks Refinery,
with the member companies and forum attendees. Killing a Worker," 28
October 1994. [Online].
Available:
http://www.apnewsarchive.co
m/1994/Explosion-Rocks-
Refinery-Killing-a-
Worker/id85c44b8bc43388a8
15cf474c5ffdbce7. [Accessed
07 March 2017].

ExxonMobil, "ExxonMobil
Earns $7.8 Billion in 2016;
$1.7 Billion During Fourth
Quarter," 31 January 2017.
[Online]. Available:
http://news.exxonmobil.com/
press-release/exxonmobil-
earns-78-billion-2016-17-
billionduring-fourth-quarter.
REFERENCES [Accessed 07 March 2017].

19 CCR § 2760.2(c)(5) [Online]. Available: ExxonMobil, "ExxonMobil

http://www.caloes.ca.gov/FireRescueSite/Documents/CalARP to Sell Torrance Refinery to
%20Regulations%2001012015.pdf. [Accessed 07 March 2017]. PBF Energy," 30 September
2015. [Online].
29 C.F.R. § 1910.119(f).

CSB · ExxonMobil Torrance Refinery Investigation Report 59

Available: http://news.exxonmobil.com/press- SCAQMD, "Final
release/exxonmobil-sell-torrance-refinery-pbf-energy. Environmental Impact Report
[Accessed 07 March 2017]. for the ExxonMobil Torrance
Refinery Rule 1105.1
ExxonMobil, "Material Safety Data Sheets, 3139 Naphtha," Compliance Project," March
[Online]. Available: 2007. [Online]. Available:
http://www.msds.exxonmobil.com/IntApps/psims/SearchResults. http://www.aqmd.gov/docs/d
aspx. [Accessed 07 March 2017]. efaultsource/ceqa/documents/
permit-
ExxonMobil, "Our history," 2017. [Online]. Available: projects/2007/exxon/feir.pdf?
http://corporate.exxonmobil.com/en/company/aboutus/history/ove sfvrsn=2. [Accessed 07
rview. [Accessed 7 March 2017]. March 2017].

ExxonMobil, "Our Products," 2017. [Online]. Available: SCAQMD, "Report on

http://www.exxonmobilchemical.com/ChemEnglish/about/our- ExxonMobil Torrance
products.aspx. [Accessed 07 March 2017]. Refinery Incident of
February 18, 2015;
Glatt, "HP Spray Coating," 2017. [Online]. Available: SCAQMD Response and
http://www.glatt.com/en/processes/coating/fluidizedbed- Sampling & Analysis
coating/hp-spray/#jfmulticontent_c6020-1. [Accessed 07 Efforts," [Online].
March 2017]. Available:
http://www.aqmd.gov/docs/
Gnerre, Sam. South Bay Daily Breeze, "Capt. John Barneson defaultsource/compliance/e
brings an oil refinery to Torrance," 4 October 2014. [Online]. xxonmobil-02182015.pdf.
Available: http://blogs.dailybreeze.com/history/2014/10/04/capt- [Accessed 07 March 2017].
john-barneson-brings-an-oilrefinery-to-torrance/. [Accessed 07
March 2017]. SCAQMD, "Rule 1105.1,
Reduction of PM10 and
J. Rasmussen, "Risk Management in a Dynamic Society: A Ammonia Emissions from
Modelling Problem," Safety Science, vol. 27, no. 2/3, pp. 183- Fluid Catalytic Cracking
213, 1997. Units," 07 November 2003.
[Online]. Available:
M. Crawford, Building the Workingman's Paradise - The Design http://www.aqmd.gov/docs/d
of American Company Towns, London: Verso, 1995. efault-source/rule-book/reg-
xi/rule1105-1.pdf?sfvrsn=4.
PBF Energy, "PBF Energy Completes Acquisition of the Torrance [Accessed 07 March 2017].
Refinery and Related Logistics Assets," 01
July 2016. [Online]. Available: "Standards Presentation to
http://investors.pbfenergy.com/news/2016/07-01-2016- California Occupational
113123883. [Accessed 07 March 2017]. Safety and Health Standards
Board," [Online]. Available:
PBF Energy, "Refineries," 2017. [Online]. Available: http://www.dir.ca.gov/OSHS
http://www.pbfenergy.com/refineries. [Accessed 07 March B/documents/Process-Safety-
2017]. Management-for-Petroleum-
Refineriess-proptxt.pdf.
[Accessed 07 March 2017].

60 CSB · ExxonMobil Torrance Refinery Investigation Report

State of California Department of Industrial Relations, "DIR and U.S. Chemical Safety and
the Governor's Interagency Refinery Task Force," [Online]. Hazard Investigation Board,
Available: http://www.dir.ca.gov/dosh/interagency-refinery-task- "Process Safety Management
force.html. [Accessed 07 March 2017]. Investigations -
Investigations with findings
State of California, Department of Industrial Relations, "Citation related to modernization of
and Notification of Penalty, ExxonMobil Refining & Supply process safety management,"
Company," 13 August 2015. [Online]. Available: [Online]. Available:
http://www.dir.ca.gov/dosh/citations/ExxonMobil.Signed- http://www.csb.gov/recom
Citation-Documents.1042440.pdf. [Accessed 03 March 2017]. mendations/process-safety-
management-
T. Kletz and P. Amyotte, Process Plants-A Handbook for investigations/. [Accessed
Inherently Safer Design (2nd Edition), Taylor & Francis, 2010. 07 March 2017].

The National Institute for Occupational Safety and Health

U.S. Chemical Safety and
(NIOSH), "NIOSH Pocket Guide to Chemical Hazards, Hydrogen
Hazard Investigation Board,
fluoride," 11 April 2016. [Online]. Available:
"PSM Recommendations -
https://www.cdc.gov/niosh/npg/npgd0334.html. [Accessed 27
Open Recommendations for
February 2017].
PSM modernization,"
[Online]. Available:
Torrance Herald, "3 Million Dollar Refinery to Go Up Here http://www.csb.gov/recomme
Immediately," 4 October 1928. [Online]. Available: ndations/psm-
http://arch.torranceca.gov/archivednewspapers/Herald/1928%20 recommendations/.
May%203%20%201929%20Oct%2031/PDF/00000239.pdf. [Accessed 07 March 2017].
[Accessed 07 March 2017].
U.S. Chemical Safety and
U.S. Chemical Safety and Hazard Investigation Board, "Chevron Hazard Investigation Board,
Refinery Fire," [Online]. Available: http://www.csb.gov/chevron- "Regulatory Report -
refinery-fire/. [Accessed 07 March 2017]. Chevron Richmond Refinery
Pipe Rupture and Fire,"
U.S. Chemical Safety and Hazard Investigation Board, "Drivers October 2014. [Online].
of Critical Chemical Safety Change," [Online]. Available: Available:
http://www.csb.gov/drivers-of-critical-chemical-safety-change/. http://www.csb.gov/file.aspx
[Accessed 07 March 2017]. ?DocumentId=661.
[Accessed 07 March 2017].
U.S. Chemical Safety and Hazard Investigation Board, "Final
Investigation Report - Chevron Richmond Refinery Pipe Rupture U.S. Chemical Safety and
and Fire," 2015. [Online]. Available: Hazard Investigation Board,
http://www.csb.gov/file.aspx?DocumentId=666. [Accessed 07 "Transcript from 1.13.2016
March 2017]. Public Meeting
(30015_Exxon public
U.S. Chemical Safety and Hazard Investigation Board, "Interim meeting pt1)," 13 January
Investigation Report - Chevron Richmond 2016. [Online]. Available:
Refinery Fire," [Online]. Available:
http://www.csb.gov/file.aspx?DocumentId=662. [Accessed 07
March 2017].

CSB · ExxonMobil Torrance Refinery Investigation Report 61

http://www.csb.gov/assets/1/19/Public_meeting_transcript.pdf.
[Accessed 07 March 2017].

U.S. Chemical Safety and Hazard Investigation Board,

"Williams Geismar Olefins Plant Reboiler Rupture and Fire,"
October 2016. [Online]. Available:
http://www.csb.gov/file.aspx?DocumentId=753. [Accessed 07
March 2017].
U.S. Energy Information Administration, "Refinery Capacity
Report," June 2016. [Online]. Available:
https://www.eia.gov/petroleum/refinerycapacity/refcap16.pdf.
[Accessed 07 March 2017].

United States Census Bureau, "QuickFacts, Torrance City,

California," 01 July 2016. [Online]. Available:
https://www.census.gov/quickfacts/table/PST045215/0680000.
[Accessed 07 March 2017].

62 CSB · ExxonMobil Torrance Refinery Investigation Report

 Appendix A: Comparison between 2012 and 2015 Safe Park DCS Data

CSB ANALYSIS OF EXXONMOBIL TORRANCE REFINERY DISTRIBUTED CONTROL SYSTEM (DCS) DATA
COMPARISON BETWEEN 2012 AND 2015 SAFE PARK DCS DATA

ExxonMobil Torrance, California Investigation

Appendix A: Comparison between 2012 and 2015 Safe Park DCS Data

CSB · ExxonMobil Torrance Refinery Investigation Report 63

 1.0 CATALYSTLEVEL ABOVE CLOSED SCSV
At the Torrance refinery, the level of the fluidized catalyst bed
in the reactor is measured, using the two sensors shown in
Figure A-1. During normal operation and during Safe Park,
the catalyst in the reactor is fluidized by steam fed to the
reactor stripping section. The fluidizing steam feed location is
also shown in Figure A-1.
In both the 2012 and 2015 transitions to Safe Park, when the
Spent Catalyst Slide Valve (SCSV) closed, the reactor catalyst
level fell below the bottom sensor shown in Figure A-1. In
2012, it took 20 minutes for the catalyst level to fall below the
bottom sensor, and in 2015 it took 9 minutes (see Figure A-2).
This likely indicates that the fully closed SCSV was leaking
both in 2012 and 2015. The leak rate in 2015 was likely faster
due to the advanced erosion of the SCSV. Industry experts
have informed the CSB that SCSVs may leak, even when the
SCSV is new and has not been eroded by catalyst.

FIGURE A-1
Reactor catalyst bed level measurement

FIGURE A-2
In both 2012 and 2015, catalyst leaked past closed SCSV when unit entered Safe Park. In 2012, catalyst level fell below
level sensors shown in Figure A-1 in 20 minutes. In 2015, catalyst level fell below level sensors shown in Figure A-1 in
9 minutes.

Because the level of catalyst between the SCSV and

the bottom sensor shown in Figure A-1 cannot be

64 CSB · ExxonMobil Torrance Refinery Investigation Report

 Appendix A: Comparison between 2012 and 2015 Safe Park DCS Data

detected below the level instrument’s lower detection limit, the differential pressure indicator shown in
Figure A-3 (PDC_Tag 4), which measures the difference in pressure between the SCSV standpipe (above
the closed SCSV) and the regenerator, can be used to identify if there is a catalyst level above the closed
SCSV. Catalyst can still accumulate above a leaking SCSV.
ExxonMobil measured the reactor pressure (P_Tag 2 shown in Figures A-3, A-4, A-5) and regenerator
pressure (P_Tag 3 in Figures A-3, A-4, A-5) in addition to the SCSV standpipe/regenerator differential
pressure (PDC_Tag 4 in Figures A-3, A-4, A-5). In 2012, the measured SCSV standpipe/regenerator
differential pressure (PDC_Tag 4) was approximately 5 psi greater than the calculated pressure difference
between the reactor and regenerator (P_Tag 2 minus P_Tag FIGURE A-3 A-4). In 2012, ExxonMobil
3) (Figure
engineers compared the PDC_Tag 4 differential SCSV standpipe / regenerator differential pressure
pressure indicator reading to the calculated pressure instrument used to determine catalyst level above

difference between the reactor pressure and the closed SCSV regenerator pressure (P_Tag 2 minus P_Tag
3). They
identified the 5 psi pressure difference, and concluded that a catalyst level had developed above the closed
SCSV and was exerting 5 psi of pressure, providing a barrier between the reactor and regenerator. In
2015, the measured SCSV standpipe/regenerator differential pressure closely correlated with the
calculated pressure difference between the reactor and the regenerator (Figure A-5). This could have
served as an indication that a catalyst level had not developed on top of the closed SCSV, meaning that
the anticipated catalyst safeguard was not available. ExxonMobil refinery management, however, did not
monitor the PDC_Tag 4 differential pressure reading during preparation to enter the expander during the
days leading to the incident, and this important information was not analyzed or considered prior to the
incident.

Appendix A: Comparison between 2012 and 2015 Safe Park DCS Data

CSB · ExxonMobil Torrance Refinery Investigation Report 65

 FIGUREA-4
In 2012, measured SCSV
standpipe/regenerator
differential pressure
exceeded calculated
reactor/regenerator
differential pressure,
indicating that catalyst had
accumulated above the
closed SCSV.

FIGUREA-5
In 2015, measured SCSV
standpipe/regenerator
differential pressure
closely matched the
calculated
reactor/regenerator
differential pressure,
indicating that catalyst
had not accumulated
above the closed SCSV.

66 CSB · ExxonMobil Torrance Refinery Investigation Report

 Appendix A: Comparison between 2012 and 2015 Safe Park DCS Data

2.0 RISER STEAM FLOW RATE AND MAIN COLUMN / REACTOR PRESSURES
During the 2012 Safe Park, the riser steam flow rate was approximately 7,000 pounds per hour. This was a
lower flow rate than the riser flow rate on the day of the 2015 incident, which was reduced to
approximately 7,500 pounds per hour.
The main column overhead pressure was lower in 2012 (~ 4 psig) than the main column overhead pressure
leading to the 2015 incident (9-10 psig). This difference in pressure was likely due to the 2015 heat
exchanger tube leak that allowed light hydrocarbons to enter the main column.
Plant data does not accurately indicate the main column pressure relative to the reactor pressure leading to the
incident due to the design and configuration of the main column pressure sensors. As a result, plant
personnel would not have been able to identify when reactor pressure reduced below the main column
pressure to allow backflow of main column hydrocarbons, based upon the available data.

3.0 SUMMARY
The table below (Table A-1) compares the 2012 Safe Park conditions to the 2015 Safe Park conditions.
Based upon the distributed control system data, it is not possible to determine whether the reactor pressure
was adequately maintained above the main column pressure in 2012. The difference between the 2012 and
2015 operations that is evident in the data is the presence of the catalyst barrier above the closed SCSV. In
2012, the catalyst barrier developed, but in 2015, the catalyst barrier did not develop likely due to erosion
of the SCSV.
Table A-1. Comparison between 2012 and 2015 Safe Park
2012 Safe Park 2015 Safe Park

Riser Steam Flow Rate ~ 7,000 lb/hr ~ 7,500 lb/hr

Approximate pressure exerted by ~ 5 psi ~ 0 psi (No catalyst level)

accumulated catalyst above closed
SCSV (Calculated value)

Main Column Overhead Pressure ~ 4 psig ~ 9-10 psig

Reactor Pressure ~ 4 psig ~ 9-10 psig

Appendix B: ExxonMobil 2015 Variance

CSB · ExxonMobil Torrance Refinery Investigation Report 67

68 CSB · ExxonMobil Torrance Refinery Investigation Report
Appendix B: ExxonMobil 2015 Variance
 CSB · ExxonMobil Torrance Refinery Investigation Report 71 Appendix C: Acci-Map

70 CSB · ExxonMobil Torrance Refinery Investigation Report

 Members of the U.S. Chemical Safety and Hazard Investigation Board:

Vanessa Allen Sutherland, J.D./M.B.A.

Chairperson

Manuel Ehrlich
Member

Richard Engler
Member

Kristen Kulinowski, Ph.D.

Member

CSB · ExxonMobil Torrance Refinery Investigation Report 73

72 CSB · ExxonMobil Torrance Refinery Investigation Report