HomeMy WebLinkAboutMINUTES - 08031999 - D1 THE BOARD OF SUPERVISORS
F CONTRA COSTA COUNTY, CALIFORNIA
ADOPTED THIS ORDER ON August 3, 1999,by the following vote:
Ayes:
Noes:
Absent: See the text below for action and vote
Abstain:
On this date, the Board of Supervisors considered the status reports from the Health Services
Director on
A. the results of the rest cause analysis conducted by the Health Services Department of
the February 23, 1999, accident at the Tosco.Avon Refinery.
B. The irnplernentation by Tosco Avon Refinery of the recommendations made by
Arthur D. Little, Inc., in the report to the Board dated April 17, 1999.
Those present included Phil Batchelor, County Administrator; Bill Alton,Hazardous Materials
Program; handy Little, Accidental release Prevention Specialist; and Dr. Walker,Director of
Health Services.
Mr. Alton presented the Health Service's perspective and discussed the incident.
The Board discussed the issues.
Dandy Sawyer presented the background and presented the ofthe report of A.D. Little, Inc.
Discussion continued. Larry Ziernba, Tosco Refineries presented the maintenance report,
FollowiT12 further Board questions and connrnents, the public hearing was opened, and the
following people appeared to comment:
Denny Parson, CBE, 324 Railroad Avenue, Pittsburg;
Donald R. Brown, CF'-\TCC7 Refinery, 1.234 S. Lakeland Load, Santa.Fe Springs, CA;
Henry Clark, West Coast Toxics Coalition; 1019 Macdonald Avenue, Richmond; and
Greg Feere, Contra Costa Building Trades Council, 935 Alhambra Avenue, Martinez;
Those desiring to speak having been heard, the Board continued their discussions.
Dr. Walker was asked several questions about the County's authority regarding the refineries and
he responded.
Following farther discussion, Supervisor Gerber moved to request Health Services develop a
protocol for unannounced inspections of refineries in the County, that the County receive
ongoing indications of incidents at Tosco, and approve the A.D. Little, Inc. report. Supervisor
Gioia seconded..
The vote on this portion was unanimous.
Supervisor Uilkenia nnade a second motion to approve the reports as presented.. Supervisor Gioia
seconded the motion,
The vote was unanimous.
I Wreby , het thl's is a t.-.so r�c peat copy of
a:,ry�.'a.�pcej6:,. itaker, si.»y'�'".y erty ed o,, }}t� ta55��,�;.""utes of ad o
.''4b'C�kY W 6r s paY� th"s dWi`5.d' S n
AE -
�y
�y4 �k 3 . lwk of the cw
of EYupe Si+'ro �i+r'a�a'mR.+o;.IInty
Sa
D14
D.
INVESTIGATION IN'F`O THE CAUSES
OF THE FIRE OF FEBRUARY 23, 1999
AT NO. 50 CRUDE UNIT
'POSCO AVON REFINERY
PRELIMMARY REPORT TO THE
CONTRA R STA COUNTY BOARD OF SUPERVISORS
Contra Costa Health Services
William Alton
Perry Calos
July 28, 1999
TABLE OF CONTENTS
EXECUTIVE SUMMARY
SECTION 1, PURPOSE OF THE INVESTIGATION
SECTION 2, SCOPE OF THE INVESTIGATION
SECTION 3, PROCESS DESCRIPTION
SECTION 4, EVENTS BEFORE FEBRUARY 23, 1999
SECTION 5, EVEN'T'S OF FEBRUARY 23, 1 999
SECTION 6, INVESTIGATIVE PROCESS
S CTIO 7, BARRIER ANALYSIS
SECTION 84 CAUSAL FACTOR ANALYSIS
SECTION 9, C3MMENTI)AI'IO S
APPENDIX A, EXHIBITS
APPENDIX B, CORROSION CONTROL AND LABORATORY RESULTS
EXECUTIVE SUMMARY
On February 23, 1999, a fire at the No= 50 Crude Unit at the Tosco Avon refinery
re ulted in the deaths of four workers and permanent injuries to a fifth worker. Contra
Costa health Services (CCHS) and CalOSHA initiated a joint investigations on February
23', and were Joined iti the joint investigation by the U.S. Chemical Safety and Hazard
Investigation Board(Chemical Safety Board)on February 26th.
The incident occurred while naphtha piping was being dismantled for replacement. The
crude unit was operating at the time. The immediate cause of the fire was that naphtha
was released from the piping being dismantled and contacted surfaces of the operating
equipment that were hotter than the auto-ignition ternperature of the naphtha. and the
naphtha ignited.
The naphtha piping being replaced had been taken out of service on February 10, 1999,
due to a leak. The CCHS investigation focused on events starting on February 1€3 " after
the leak was isolated to determine how the naphtha was physically released, and the
contributing and root causes that led to the situation that the naphtha could be released
causing the subsequent fire.
PHYSICAL RELEASE
The naphtha piping runs from Fractionator to the NTaphtha Supper as shown in Exhibit 2
(all exhibits are in Appendix A). After Valve A was closed to stop the leak, the piping
remained about 70% full. The line remained 70% was due to the "U" shaped liquid trap
foamed by the bottom of the piping, and the fact that the pressure in the operating
-Naph- a Stripper supported (pushed up) a vertical leg of naphtha in the piping next to the
Fractionator. The naphtha was physically released from.the piping as follows: Following
unsuccessful atte r ms to dram:the lime before starting to dismantle it, Tosco workers cold
cut and removed the top section of the piping above the liquid level (Exhibit 5). Tosco
workers then initiated a second cold cut below the liquid level that leaked naphtha.
ES-1
Tosco workers then began draining the line from a flange as shown in Exhibit&. Valve B
leaked badly, though this was not known on February 23'd. Consequently, as naphtha
was being drained, the level of the vertical leg of naphtha next to the Naphtha Stripper
dropped. This vertical leg was a liquid seal that prevented naphtha vapors from the
Naphtha Stripper flowing through Valve B. When sufficient naphtha was drained, the
liquid seal was broken, naphtha vapors flowed through Valve B mixing with and lifting
naphtha liquid up and out of the piping next to the Fractionator (Exhibit 8). The naphtha
ignited off hot Fractionator surfaces.
CAUSES OF THE RELEASE AND FIRE
A causal analysis was done to dete nine both contributing causes and root causes.
Several contributing causes were found, two which were serious and significant. These
two were (1) on, February 2P, the piping was not properly prepared according to Tosco
written safety procedures: workers did not, but should have drained, depressuared, cleaned
and positively isolated the piping before work started, and (2) on February 237d, workers
and a supervisor did not exercise stop-work authority while unsafe work was in progress.
The situation should not have evolved such that the workers were put in the position to
have to make the decisions leading to the contributing causes.
Between February 10' and February 23d there were events that were warning signs that
valves were leaking, that the line was essentially full of naphtha and that the drain valves
were plugged so the operators could not drain the system. Managers and first line
operating supervisors did not know this information.
The job involved d=smantling a line containing naphtha located directly above sources of
ignition. No plans .for safely preparing the line were made for the operators to
supplement the standard safety procedures. No one in operations supervision took charge
of the safe execution of the job to ensure that standard safety procedures were being
ES-2
i tplemented, or that appropriate supplemental procedures were prepared and
irrmlemented.
CCHS therefore found tlhat the root -causes of the incident were less than adequate
management systems in the areas of(l) poor communications between the op-erators aid
`d;eir s,Ipe--visors that resulted in the managers and supervisors not being aware of the
warning signs, and (2) the responsibility of managers and supervisors to recognize
situations that they should proactively become involved in and provide leadership to the
workers to ensure teat t o work is safely done. CCHS recommendations are for Tosco to
address and -correct these management systems.deficiences,
ES-3
SECTION 1.
PURPOSE OF THE INVESTIGATION
The purpose of any incident investigation is to understand the causes of the incident in
order to improve the ability, to predict the likelihood of future ocemences and to be able
W. recommend and in plement actions to reduce the likelihood of future occurrences.
.These causes are frequently the result of organizational factors that result in human errors
being made at various levels in the organization. In describing and analyzing the causes
of the fire of February 23'6,, we will discuss human errors that were made a,various levels
in the Tosco organization that were involved in either contributing causes or root causes
of the incident,
SECTION 2
SCOPE OF THE INVESTIGATION
The scope of this Contra Costa Health Services (CCHS) root cause analysis includes the
activities contributing to the February 23, 1999 fire at the Noa 50 Crude Unit (50 Unit) at
the Tosco Avon Martinez Refinery that resulted in the deaths of four workers and critical
injuries to a fifth worker. The fire resulted from a release and ignition of naphtha during
replacement of out of service naphtha piping. The naphtha piping was taken out of
service or. February 10, 1999 due to a leak in the line. The scope of our root cause
analysis for the fire stan-Is with the events on February I Ot" that, began with the closing of
the first valve to isolate the naphtha piping and ends with the ignition of the fire on
February 23re. CCIJIS considers the initial leak`fat resulted in the naphtha piping being
taker. out of service a separate incident that ended with isolation of the leak. Therefore,
causes of the leak itself are not part of the root cause analysis. The leak Nvas caused by
corrosion. Appendix B discusses possible causes of this corrosion and current Tosco
efforts aimed atminimiring fature corrosion. Similarly, CCHS considers Tosco's
emergency response to the fire to be outside the scope of the root cause analysis.
SECTION 3
PROCESS DESCRIPTION
The 50 Crude Unit is the first step in the refining process of crude oil at the Tosco Avon
Refinery. Currently, 50 Unit is the only crude unit at Tosco Avon. It has the capacity to
process approximately 100,000 barrels of cede oil per day.
GENERAL DESCRIPTION
Crude sail is a mixture of various hydrocarbons, such as pentanes, hexanes, acid aromatic
compounds. A refinery cr=ude unit, or fractionation unit, separates the mixture sof
hydrocarbons into various components, or fractions, for use throughout the rest of the
refinery. This separation is achieved ley heating the crude oil, feeding the oil into a tall
column (usually cal ed a Fractionation Tower or Fractionator), and removing the various
components from the Fractionator at.different heights, based on the boiling points of each
of these components.
The "lighters' components (those vAth low boiling plaints, e.g., naphtha, gasoline, butanes,
etc.) are typically removed from the upper portions of the Fractionator, while the
"heavier" components (higher boiling point liquids, e.g., gas oils, resid, etc.) are remove
from the lower portions of the Fractionator. There are alsomid-bailing point range
materials removed from the middle portions of the Fractionator (e.g., kerosene, diesel;
etc.).
A crude unit can process different types of crude oil, depending on the origin of the
crude. Certain sail fields contain higher quantities of lighter components than others. As
crude is heated and fed to the crude Fractionator, changes in tower pressure result, slue to
the increase in temperatures and the boiling of the hydrocarbons. The amounts sof the
various products leaving the Fractionator "dill change. These ``swingss' in the unit
o aeration are recorded by process sensors (measuring temperatures, pressures, and flow
-1
rates), and monitored by operators who male process changes to the crude unit to ensure
safe and efficient operation of the unit.
Crude oil also contains varying quantities of contaminants such as sulf-uracont ining
comma o ds, organic and inorganic sets, organic and inorganic acids, solids, and water,
Optimally, most of these contaminants are reeved prior to feeding the crude to the
Fractionator. There are, however, downstream omits that also remove contaminants from
crude unit products.
50 UNIT PROCESS
50 Unit is composed of three systems; feed treatment, fractionation, and stabilization.
There are numerous "steps" performed within each of these systems. A simplified
diagram of 50 Unit is provided in Figure 3-11.
The feed treatment system
The heat from the fractionated prod acts is -transferred to the incorning crude oil in Crude
preheat exchangers. The products leaving the Fractionator at ternperatres higher than
the entering evade oil exchange their heat with the crude oil. This is done to conserve
thermal energy in the crude oil in order to minimize the fuel consumption in the Furnace.
One of the processes the crude oil undergoes before entering the crude tower is desalting.
Desalting is necessary to remove salts and other potential contaminat is from the crude oil
that may cause corrosion in downstream process piping and equipment. This is
accomplished by mixing the raw crude oil with wash water, and feeding this mixture into
large horizontal vessels called Desalters. The water (now containing significant a our is
of the contaminants) separates from the oil and is removed. The desalted crude then can
proceed through the remainder of the preheating and fractionating processes. More
information. or. contaminants in crude oil and methods to control them is incl=uded in
.Appendix B, Corrosion Control and Laboratory Results.
3-2
After the Desalters, the crude oil is again preheated and fed to the Flash Column. in the
Flash Colo r°q, light components from the crude (i.e., naphtha, gasoline, butanes, etc.),
heated to above heir boiling points during crude preheating, "flash" off or, or are
instantly vaporized from, the evade and are fed to the Fractionator via the Flash Colun n.
overhead line.
The heavier components of the crude, still in liq=aid form, leave the dash Column and are
putri,ped through the Furnace. The Fm.ace is a "fired" beater that uses fuel gals to heat
the crude oil as it flow through isms in the Furnace firebox. The crude oil: is heated to
approximately 700'F and fed to the Fractionator.
The fractionation system
The Fractionator separates the components of the crude oil into various product streams,
the lightest components moving ip the tower, and the heavier components moving down
the tower. The product streams, in over from lightest to heaviest, are wet gas, gasoline,
naphtha, kerosene, diesel, atmospheric gas oil (AGO), and resid. Stripping steam is
in;ected into the bottom of the Fractionator to assist in the separation process.
The wet gas (methane, ethane, and noncondensable gases), butanes, and gasoline vapors
leave the Fractionator via the overhead line. All but the wet gas is condensed in the
Overhead Condensers and the liquid collects in the Accumulator. Some of the liquid is
pumped back to the Fractionator as "reflux", which aids in the Fractionator separation
process, The rest of the liquid is sent to the Debutanizer for Ilse stabilization process.
Naphtha, kerosene, and diesel products are each drawn from separate trays in the
F ractionator and sent to dedicated stripper towers. In each stripper tower, the lighter
vapor components from each product(e.g.,kerosene from vapor in the diese. stream, etc.)
separate and flow back to the Fractionator. The liquid from each stripper tower is
3e3
pumped to dedicated product tankage for further processing at do-aa-strearn € nits. Only
the kerosene Stripper has stripping steam injected for additional light end removal.
The AGO and resid product streams are each cooled and sent to storage.
Stabilization
n
The overhead gasoline product is sent to the Debutanizer for stabilization"i.e., removal of
light gids such as butanes and lighter components). These butanes and lighter
components leave the Debutanizer through the overhead line. The Debutanizer bottoms
(also called naphtha) is fed to the Gasoline Splitters where light straight run (LSA.)
gasoline (i.e., near product-grade gasoline) is removed in the overheads and heavy
straight ruri (HSS) naphtha Tows through the bottoms line. HSR naphtha is combined
with the product naphtha from. the Naphtha Stripper bottoms at the Fractionator prior to
going to ta>~ age a .d rther treating to produce gasoline.
3-4
u a.
CL
t Lu
Lu
fL C° aI pJ
! S1i m
re D 3
Fr
�
-j {E IE
C" S Ld
CL
LU Ul
E
f
aQ q 6
NNm'oo t 3
r�
LU
89S �
#L°
�i
i
i� �
SECTION 4
EVENTS BEFORE FEBRUARY 23, 1999
Note: All Exhibits referred to are in Appendix A. Valves names, e.g., Valve A, are the
names assigned in the exhibits.
ORGANIZATIONS INVOLVED
Three organizations at Tosco were involved in the events smounding the fire of
February 23'6. These are shown on Chart 4-I. These organizations are tree
o Production Day 0-rganization
0 Operations Shift Organization
0 Maintenance Execution Organization(Elements thereof)
This report makes reference to ma-pagers and supervisors. Supervisors means the first
line supervisors who are the Operations Supervisor, Shift Supervisors, and the
Maintenance Supervisor. Others above these first line supervisors are included in the
meaning of management. When we refer to workers, we mean. operators, maintenance
mechanics, and contractors. It should be noted that the titles No. 1 Operator and Shift
Supervisor do not necessarily refer to the same individual= There are one of each position
on each of four shift crews.
LEAK ON FEBRUARY 16"'
On February I0, 1999, a leak was discovered in the naphtha draw line that-:ups between
Fractionator V-I and the Naphtha Stripper Vm3. The leak was mediately downstream
of the fractionator naphtha block Valve A on the Dorton. of the line as indicated in
Exhibit I-A. Tosco decided to stop the leak and isolate the naphtha piping while keeping
the Fractionator in operation. Tosco operators reduced the Fractionator operating
pressure from- about 12.5 prig to about 10.2 psig and made other operational charges that
minirnized the leak. Two Tosco supervisors then climbed up the Fractionator ladders and
4 - I
closed Valve A. This act of closing Vale A ended.the February 10'-" leak incident and is
the starting point of the CCHS scope of investigation into the causes of the fire on
February 23, 1999. After Valve A was closed, only about 30% of the naphtha in the
piping between the Fractionator and the Naphtha Stripper could dram into the Naphtha
Stripper. Drainage was limited to 30% because of the configuration €f the piping and
because the' aphtha Stripper was still at operating pressure. The piping configuration is
such that the piping from the Fractionator goes to a low point before rising into the
Naphtha Stripper. This configuration form, s a "U" shaped iquid trap (like a kitchen sink
trap', that contained naphtha to the level of the Naphtha Stripper inlet. In addition, the
pressure in the 'naphtha Stripper supported (pushed up) a vertical cobxrm of naphtha 30
to 31 ft. above the liquid trap level. This situation is shown in Exhibit 2. flxr Nage A
was closed, operators closed Valves B, C, and B.
INSPECTION OF PIPING
Tosco promptly initiated a thorough inspection of the entire naphtha system on the
evening of February W" that took several days. Both X-ray and ultrasonic thickness
testing methods were used to determine pipe thickness. The bottom of the piping at the
leak location was determined to be thin and the leak itself was later found to be due to
corrosion. (Refer to 'appendix B for a discussion of the possible causes of this
corrosion.) Other areas in the piping showed significant loss of thickness. Tosca
inspectors initially recommended replacing all the piping between the Fractbonator and
the Naphtha Stripper. However, the piping between Valves B and E wnd the Naphtha
Stepper cannot be replaced while the Fractionator is operating because the Naphtha
Stripper was at operating pressure and there is no valve at the Naphtha Stripper end of the
piping from the Fractionator for isolation. in addition,this piping that cannot be replaced
with the Fractionator operating had acceptable thickness. Consequently, Tosco operating
supervisors and inspectors made a decision to immediately replace the piping between
Valve A and. Valves B and. B with. the Fractionator operating, and to replace the piping
between Valves B and B and.file Naphtha Stripper during the next scheduled maintenance
turnaround. In the meantime, the piping between '`Valves B and E and the Naphtha
4 -2
Stripper would be subject to frequent thickness testing to verify continuing safe
operation.
INTote; Before restarting 50 Unit after the refinery standdown, Tosco replaced all piping
and valves in the naphtha system between the Fractionator and.the Naphtha Stripper.
OPERATIONAL AND MAINTENANCE VENT BE'TWEE'N FEBRUARY 10,
1999 AND FEBRUARY 2 , x.999
Determination of Liquid Level
Exhibits I A, I B, and l C show the naphtha levels assumed by varices people at Tosco
after the valves were closed on February 1€6''. Some at Tosco assumed a low naph`-m
level in the piping as shown in Exhibit IA. Some assumed the "sinik trap" level of
Exhibit IB and others thought the level was high as depicted in Exhibit IC:. However,
the actual level was never determined before the fire. T'he Maintenance Supervisor, was
observed hanmriering on the lane ding the week of February 1.�h trying to determine the
liquid level in the line. Exhibit 2 shows the actual naphtha level that had to be in the line
after Valve A was closed after the leak of Febmary lOt`,
Leak on February 13th
The line leaped main on February I3`a' at the point of the original leak. The operators
further tightened down can both Valve A and bypass Valve B. The operator wrote in the
operator log kook"the raptured drawn line is full", but did not mention the leak in they log.
A Shift Supervisor assisted in stopping the leak, but apparently did not pass this
information along. Cather supervisors and managers indicated they did not receive this
inforn.iation.
4-3
Naphtha Stripper Pumpo t
Chemical Safety Board investigators determined by review of the 50 Unit operating
records and discussions with an operator; that the operators pumped out the Naphtha
Stripper once on February 13�", and pumped it out five times on. February 14' . Valves A
and B were further tighten.ed by the operators on February 14' and a valve on the bottom
outlet piping system) and the high level did not return. This pumping out was not noted
in the operator's log. A Shift Supervisor stated in his Nvntten turnover log of February
10", "pumped out level in Naphtha Stripper" referring to the single pumpout of February
13�` . The Shift Supervisor hover logs are available electronically to all supervisors
and managers.
Leak on February y 1 7th
The line Peaked again. on February 17L" at the point of the original leak. The operators
f€irther tightened down on both Valve A. and bypass Valve B. Again, no mention of this
I
eak was rade in the operator's logbook.
Plugged Drain Valves
Also on February 17 the No. l Operator told the Business Team Leader that drain
Valves F and G %vere plugged (see Exhibit ). The Business Team Leader relayed this
information to the Operations Supervisor. That same day, the No. I Operator also
discussed the plugged dram valves and inability to drain via, these valves with the
Operations Supervisor and the Maintenance Supervisor. As a result the Operations
Supervisor made arrangements for maintenance mechanics to drill (clears) out the drain
valves the next day.
The operators entered into their log for February 17 9 `bBeat about 1/2 spoke out of the
naphtha drays valve (Valve A) and the CN bypass valve (Valve B), (which means that
the operators harnmered the valves ffiener closed one-half the distance between spores of
4 -4
a h dwheel). Both bleeders are plugged and cannot case up (unplug) with a welding
rod-will need to drib out eventually."
On the afternoon of Thursday, February 18`h, maintenance mechanics attempted to drill
out the drain valves but were unsuccessful. The drills used are attached to flexible
cables. The cable attached to the drill was broken in t<-ie attempt. The operators entered
into their log: "fitters made attempt to bare out naphtha stripper LCV (level control
valve) bleeder valves, but no go." Again, this information was not transmitted to
supervisors and managers.
Discovery of Sludge
On Friday, February 19�.h, maintenance mechanics signed in to 50 Unit at noon time to,
according to their sign-in sheet entry: "Drain 6" line on Fractionator Tower and unplug
I"drain valve," Before the maintenance mechanics arrived, the operators had filled out a
work permit for the maintenance mechanics to remove the short section of pipe between
tl5be level Control Valve D and the downstream block Valve E (see Exhibit 4). The
maintenance mechanics removed the section of pipe and found it contained a small
amount of black sludge. There was also a small amount of sludge in the downstream
b€ock Valve E. However, the outlet of Control Valve D was f,11 of sludge. The
maintenance mechanics thea installed a blind flange on Valve E and a blind flange with,a
drain valve on the Control Valve D. TSne operators and Maintenance Supervisor were
aware of the sludge at this time;. Managers or operating supervisors indicated that they
did not receive this information. No attempts were made to drain from the newly
installed drain valve on the control valve on February l9t', Apparently, it was planned to
attempt draining again on Monday, February 22 because the operators made tle
followrng bog -entry: "Fitters (maintenance mechanics) swung spool piece (section of
pipe)just downstream of naphtha LCV and will drain leg up to frac (Fractionator) towner
on Monday."
4 -
Fong Bolting and Deck Hole Enlargement
On Monday, February 22"x, maintenance mechanics "four bolted" (removed four of the
eight bolts frond) each flange in the naphtha piping from Valves B and D to Valve A to
facilitate removing the piping the following day. No attem pts were made to drain the line
that day. Preparations were also made to facilitate removal of the top section of piping.
This involved enlarging the bole in a steel deck that the piping Massed through with a
cutting torch.. A leak prevention clamp was installed on the hole that leaked on February
I€'-' . A hot work permit was issued that was signed by the Ido. i Opera-or and the Shift
Supervisor that were involved on February 2P'. The hole in the deck was enlarged with
a cutting torch.
Job Discussion on February 22nd
Also on Monday, February 22'd, the Operations Supervisor discussed the extent of work
scheduled for the next day with the No. 1 Operator present Monday (and who would be
the o. I &operator on February 23 ) and the Maintenance Supervisor. The extent of
work discussed was to drain and rem pave the Naphtha Piping. The Operations Supervisor
entered into the permit headiness Sheet for work to occur on February 23�d; "Bigge,
Interstate Scaffold, Tosco and Rust (vacuum truck) personnel to drain and start removal
of naphtha draw piping." The Permit Readiness Sheet is an electronic means of
informing the Shift Supervisors and operators what jobs permits are required for the next
day. It is finalized by the Operations Supervisor late in the afternoon the day before and
transmitted to the Shift Supervisors and operators for the following day's work..
Job Planning
Wren Tosco --managers and supervisors made the decision to replace the naphtha piping
with the € nit still ruruning, they made a decision, perhaps not knowingly, to dismantle
piping containing a large amount of naphtha located directly above several sources of
ignition., i.e., the hot surfaces associated with the hot Fractionator and hot associated
4-6
piping, so e of which were above the auto-ignition temperature of the naphtha. The
planing involvement thatwent into this job between February 10, and February 2P card
be summarized as follows;
• Tosco management, and Operations Supervisor (whose job it is to coordinate
maintenance activities fbr operations with maintenance), planning
involvement was determining the extent of piping to be replaced and the
scheduling priority for completion of the work.
• The Operations Shift Organization was not involved at all in the planning of
the work,
: The Maintenance Execution Department made the necessary drawings,
assembled all the materials needed to execute the job; and scheduled the work
in coordination with the Operations Supervisor.
4 - ?
4
00 Z
0
q0
ty-
01
14, i�
c
s
00
SECTION 5
EVENTS OF FEBRUARY 23, 1999
Note, All Exhibits referred to are in. Appendix A. Valves names, e.g., 'halve A, are the
names assigned in the exhibits. Exhibit 9 is a scale drawing that shows the relative
locations of sites referred to in the following discussion.
Worker Sign-in
On the rnormng of February 3'd, the crew that was to drain and remove the naphtha line
arrived at 50 Unit. About 7:15 AM three Interstate Scaffolding workers signed in. They
were to erect and adjust scaffolding as deeded for the Tosco maintenance n echanics and
Biggs Crane workers. At 7820 AM 'waste Management arrived with two workers and a
vacuum truck and signed in. Material from the line was to be drained into the vacuum
truck. At 7:40 AM,the two Tosco maintenance mechanics that world assist the operators
in draining the line and dismantle the piping signed in. And finally, at 8:00 AM, a Bigge
crew of tree arrived with a crane and signed in. The crane, which was to lifit out pieces
of piping,had been scheduled the previus week.
Shift Supervisor Check-in
T'he Shift Supervisor, in preparation for the 8:00 AM staff'meeting he regularly attends,
telephoned the No. 1 Operator before 8:00 AM and inquired about the status of the 50
Unit operations. He also asked if there were any problems associated with maintenance
activities. Wile the naphtha line was not specifically discussed, the No. 1 Operator
responded that there were no problems. When problems subsequently developed during
execution,the No, 1 Operator did not notify the Shift Supervisor.
5-1
Work Permit
Piping in hydrocarbon service must be in proper condition so it can be safely worked on,
and these conditions should be indicated on the work permit. (The naphtha line should
have been prepared as shown in Exhibit 3 before any cold cutting was started,) To
comply with both Tosco safety procedures and. the Cal/OSHAPetroleurn Safety Orders,
the naphtha lire should have been drained, depressured, steamed out or water washed. (as
practical) to remove residual naphtha, and slip blinds installed between the flanges at
Valves A and l3 for positive isolation to prevent any leakage through either Valve A or
`halve B.
The No. l Operator finished preparing the permit that was started by operators on the
previous shift. The permit stated that equipment conditions for proceeding with the work
were that the system be at zero prig pressure and isolated with double block valves and
open: bleeders valves. (Please see Appendix C for a description of piping isolation:
tec iques.). Under controlled conditions, two closed and locked block valves in series
with a locked open bleeder valve between them (double block and bleed) car, be an
acceptable s€ bstit� to for slip blinding. However, neither Valve A nor I3 has an associated
second block valve or bleeder valve; therefore, it was impossible to double block and
bleed the naphtha line for isolation;. A single closed: valve, ever* locked, is Seldom
considered ars acceptable substitute for a slip blind in the petroleum industry. There was
no mention of slip blinding on the work permit. The work permit did not authorize cold.-
cutting of the line. In addition. the naphtha, due to a small benzene content, is a
designated benzene stream. Benzene was not, but should have been checked off on the
permit as a Special Hazard that requires Shift Supervisor approval of the permit.
Joint Job Site Visit
Tosca procedures require that the No. s Operator who is issuing the permit and the
aintenance mechanic who will accept the work permit conduct a Joint ,lob Site Visit
(Job Walk) before either signs the permit. The purpose of the Job Walk is for the No. l
5-2
Operator to explain the hazards of the job to the worker, and to show the maintenance
mechanic that required safety measures are in place. The operator and maintenance
mechanic should have signed the permit after the Job Walk and only after being satisfied
that all safety measures were in place. Both the deo. i Operator and the maintenance
mechanic signed the permit at 8:30 AM before the job walk. in addition, the permit was
signed without conditions specified on the permit satisfied.
First Draining Attempt
From approximately 9:00 AM to 9:30 AM, the operators and maintenance mechanics
again attempted to dram the piping frorn the same location as the previous week, this
time through an unplugged chair: Valve "I" (See Exhibit S) do,,Nnstrea. of the control
valve into a half barrel with a hose in the barrel connected to the vacu;{�=n track. Darin
fids attempt, the No. i Operator in the field had ars operator in the control room operate
tlhe control valve to various open positions in an atterr�pt to start drainage. This attempt
failed..
First Cold Cut
After failing to drain the line, a decision was made to initiate the first cold.cut. The No. 1
Operator, the three Interstate Scaffolding employees, the Bigge foreman, and the two
Tosco maintenance mechanics proceeded to the top of the naphtha line to make the first
cold.cut, (All cold cutting was done w th a pneu€natically driven hacksaw.) The line was
in the condition as shown in.Exhibit 4. (Since both Waives A and B leaked after February
10'-h, and the pressure in the naphtha stripper increased from that of February 10':" when
the line was shutdown, the height of naphtha in the lire had increased about 7 ft. more
than-lie level shown in Exhibit 2.)
The Bigge foreman attached a cable from the crane to the piece or pipe to be removed
and cold cutting was initiated (see Exhibit 5). At the same time the bolts were removed
from the f<azige connecting Valve A to the piece of pipe and the flanges were separated.
S-3
(it is possible that when no leakage occurred when these flanges were separated, the
workers considered this as evidence that bypass Valve B was not leaking. If so, this was
a false sense of security because bypass Valve B could have been wide open and there
would have beer:no leakage at the first cut due to the liquid seal leg.) As can be seen in
Exhibit 5, the first cold cut was made about 25 f4. above the level of naphtha in the pipe.
During the cold cutting the line was pulled away from Valve A and a blind flange was
installed on Valve A. (The deck hole was enlarged the previous day to allow the pipe to
be pilled back to install the blind flange.) While the cold cutting was progressing, the
Maintenance Supervisor coined the group at the cold-cutting site. .As soon as the cut was
completed, the crane reeved the piece of pipe.
Second Draining attempt
After the firs. cold cit was complete, the ' o, 1 Operator, Maintenance Supervisor and a
maintenance mechanic returned to the control valve and cracked open the downstream
flange on Valve C (See Exhibit 5), and nothing drained. (The rest of the group remained
on the tourer in the vicinity of the second cut.) The Maintenance Supervisor next probed
between the flanges with a gasket scrapper, but still nothing drained. (lost incident
investigation revealed that the piping at the bottom of the "U" was essentially plugged
solid as indicated in Exhibit 5).
Second Cold Cut
After the second draining attempt,the Maintenance Supervisor and the No. I Operator
gent up the Fractionator to where the second old cut would be made. The Maintenance
Supervisor joined the maintenance mechanic who would -make the cut and the Bigge
foreman on the deck of the cold cut. The No. I Operator joined others in the vicinity. As
can be seer on Exhibit 5,time naphtha level in the pipe was about four fee.above the
second cold cut location. The second cut was initiated and, when the'pack saw
penetrated the inside diameter of the pipe, naphtha leaked out the savrcut. This leak was
not squirting out; it was described by a witness as seeping out.
5-4
The Maintenance Supervisor told the maintenance mechanic to stop cutting and to leave
the saw in the cut to minimize the leak. `I`'he Maintenance Supervisor then told the
maintenance mechanic to leave the job site to get a pipe leak clamp, which he did. The
Maintenance supervisor again hammered on the line attempting to locate the liquid level.
After hammer testing, and since it was lunchtime,the entire crew carne down off the
Fractionator. The Maintenance supervisor, the No. I Operator, and a maintenance
mechanic proceeded to the stripper deck by the level control valve and discussed the
status of the job. Plans were made to drain the lire after lurch by spreading the flanges at
the bottom ofthe vertical leg of piping as shown on Exhibit 6. At this time the workers
R-11 gent to lunch. Before lunch,the maintenance mechanic sent for the leak clamp
returned and, was seen starting to climb up the Fractionator with the clamp. It is not
known whether or not he installed the clamp before he tonic his lunch break.
Lunch Break
The maintenance mechanics lunch break is frons. 11:00 AM to 11:30 AM. t.this time all
involved in the ,fob left the job site. During the hunch breakk one of the scaffolding
workers was assigned to another job.
Third Draining Attempt
After lunch, a Tosco maintenance m.echanic, the Bigge foreman., and two Interstate
scafolding workers returned and climbed the Fractionator to site of the second cut. The
other Tosco maintenance mechanic set up to drain the line from the flanges at the bottom
of the vertical leg. ( see Exhibit 6) During all activities after lunch neither the Na. I
Operator nor the Maintenance Supervisor were present. The No. 1 Operator was in the
control room and the Maintenance supervisor was elsewhere in the ref-inery, The
°maintenance maec hanic at the flame started to successfally drain the line into a plastic pan
with a :ease in it connected to the vacuum truck. We believe that e maintenance
mechanic at the second cold cut location resumed cutting; when the naphtha level was
5-5
below the cut. We believe cold cutting was rested because the depth of cut was much
greater that described as being the depth before lunch. The leak clamp sent for before
lunch was found uninstalled at the cold cut site. The maintenance mechanic could have
installed it before lunch and removed it after lunch for resumption of cold cutting.
Naphtha Release and Fire
Post incident investigation revealed that the disc and seat ring of bypass Valve B, a globe
valve, were badly worn due to a combination of erosion and corrosion. A tight
compression fit of the disc and seat ring is required to prevent leafage through the valve.
In this case, the disc and seat ring met at only two points. The area of the circumferential
gap area was equivalent to the area of a one and one-half inch diameter hole. The actual
flow rate through the jagged circumferential gap would be less than through a one and
one-half inch hole, but was large enough to result in the release mechanism described
below. The valve exhibited significant leakage during post incident testing by Tosco.,
As the naphtha was draining into the vacuum true., the naphtha in the liquid seal leg (in
tlhe vertical piping next to the Naphtha Stripper)was flowing through the Valve B and the
liquid seal leg was dropping and growing smaller (as shown in Exhibit 6). The seal leg
dropped to the point that there no longer was a liquid seal. (as shown in Ex,Iibit 7). At
this point the pressure in the naphtha stripper was sufficient enough to lift the remaining
calumn of naphtha in the vertical leg by the Fractionator. As the maintenance rnechwa i c
continued to drain the line, naphtha vapors flowed through the bypass Valve B in
sufficient volume and force to mix with and lift the naphtha liquid up the vertical section
of pipe next to the Fractionator (see Exhibit 8). Naphtha was released at three locations:
out the flanges where the maintenance mechanic was draining the lute, out of the second
saw cut, and out the open top of the piping at the first cut. The Bigge crane operator
observed naphtha spraying over tate railing of the deck where the second cut was being
:made and lei the crane and ran toward the control room. The crane operator said when
he first looked back, he saw ignition between where the maintenance mechanic was
draining the line and the top of the tower and a flame front going both up and down.
5-6
After a couple more steps, be looked back and saw a fireball. The fire burred for about
twenty minutes. Tosco initiated their emergency response. The four workers on. the
Fractionator died from their barns. The maintenance mechanic draining the lire
s-arvwed, but suffered seeric us burns and permanent injures.
5.7
SECTION 6
INNESTIGATIVE PROCESS
This incident investigation was conducted in a cooperative effort by Contra Costa health
Services, CalOSHA, and the Chemical Safety and Hazard Investigation Board, CCHS
and Cal0SHA started collaborating on the day of the fire, February 23 `, and the
Chemical Safety and Herd Investigation Board joined the investigation on February
26th. From the onset of the investigation the three agencies fireely and fully cooperated
with each other on the fact finding portion of the investigation. Each agency
independently performed analysis of the Endings according to their statutory authority.
CCHS would welcome the opportmuty to collaborate with Ca10SI and/or the
Chernical Safety Board on future investigations.
The investigative process included interviewing T Osco and contractor employees,
reviewing Tosco documentation and operating data, and examining and testing physical
evidence.
INTERVIEWS
With few exceptions that were mown to all the agencies, all interviews were joint agency
interview%s. All interviews were conducted at Tosco with the exception of the interviews
of the Bigge Crane and Interstate Scaffolding employees, which -were- conducted at their
attorneys' office. We were able to interview all 38 individuals we requested with the
exception of the maintenance supervisor for the jobb The private attorney retained by the
maintenance supervisor declined to make her client available due to a potential for
criminal proceedin=gs. Interviews with nine other key individuals were delayed several
weeks while they obtained private a'torneys. These included (I) the Avon Refinery Site
Manager, (2) the Operations Supervisor, (3) the Business Tear Leader, (4) the
Operations Superintendent of the Production Day Organization; (5) the shift supervisor
on shift during the fire, (6) the Shift Superintendent on shift during the fire, (7) the Shift
��I
Operations Superintendent of the Operations Shift Organization; (8) the maintenance
Daily Planning Supervisor, and (9) the Superintendent of the Maintenance Execution
Organization. (Please refer to Chart 6-1) Tosco and/or private attorneys for the
individuals were preset at all intervilew except for February 25'x' interview of the No. 1.
Operator on shift during the I reg who declined Tosco legal representation. We were
enable to do subsequent interviews of this No. l Operator because he retained private
attorneys who declined to make hire. available. We certainly regret not being able to
interview the Maintenance Supervisor who directly supervised the workers at the job site
during the morning of February 23d or to re-interview the No. l Operator. lye believe
they could possibly explain the reasoning for decisions made on,February 23rd to proceed
with disramitling the line b€;fore it was properly preparers, and to continue dismantling the
line when a hazardous situation was evident i.e.,the leaking second cold cut.
DOCUMENT REVIEW
The combined agencies requested 249 documents for review, Copies of documents
requested by arriy agency were giver.to all agencies.
PHYSICAL EVIDENCE
alOSHA had control of the incident site and the collection and testing of physical
evidence. CalOSHA cooperated with the other agencies to be sure the other agency
reeds were et on the control of the incident site and the collection and testing of
physical evidence. The physical evidence included all the naphtha piping between.Valve
up to and including the bypass Valve B and block Valve E. The physical evidence also
included samples of the black tarry-like sludge plugging ts?e control valve manifold.
CCHS was interested, as were the other agencies, in the corrosion mechanism that caused
the leak of February 1.0"', even though the leaf of February 10'x�' is not included in the
scope of the CCHS root cause investigation, CCHS was also interested in the test results
for the leaking bypass valve and the sludge that caused the drain valve plugging. The test
results show that;
6-2
• wall leak of February 1 0�1 was cause by ammonium chloride corrosion of the pipe
YV all
: The sludge plugging the bottom section of the line was comprised of iron oxides and
sulfur and chloride oompoa €ds, i.e.,probably products of corrosion
• The significant bypass valve leakage was cause by corrosion and erosion of the valve
seat ring and plug due to the valve being in service rather than normally closed.
These test results are discussed in Appendix B.
6-3
s
0 i o
z > ' i
LU
s
Z LU
LU
CL
0
L
q., l,
1�
n
Ul i Fiiw 0 1 0 z
'fes "� � tz �}
uj
4 $ i i kid g 4 ; •� �£# CL
yqi� $ 4 :Dw i .d
r
�7�25
0 7ut�l o
0 U1
� t
SECTION 7
BARMER ANALYSIS
One tnethod used to conduct the incident investigatio-n is the technique of barrier analysis, A
barrier analysis examines any potential cor`trols, or barriers, that would have prevented an
unwanted everA from occurring. Studying the nature of the failure of these barriers is part of the
incident invest. atio uroccss.
In examining an incident, the primary hazard must first be identified. The definition of hazards
can be simplified down to ars uncontrolled flour of energy, be it kinetic, potential, chemical,
thermal, electrical, radiation, etc. in an incident scenario, the target, which is either people or
objects, comes in contact with the hazards, which are meant to be contained in &-,e system.
Barriers are any physical, acimit strative, or supervisory/management controls that prevent the
hard from reaching the target.
Examples of the barriers are:
® Physical Barriers. adequate piping integrity, personal
protective equipment, fire fighting systems
* Administrative Ba-riersa Adequate equipment designs, proper
followLng of procedures, proper work
practices and operations
* Supervisory/ anbagesnentBarriers: proper supervision, proper management
oversight
For an incident to occur,barriers can either not be in place, or be in place but fail.
7-1
the case of the Tosco fire, the primary hazard was the uncontrolled release of flammable
hydrocarbon.. The targets were the Tosco employees and contractors working on. the naphtha
piping at the time of the hydrocarbon release. This barrier analysis is the result of evaluating the
effectiveness of Tosco's barriers in place at the time of the incident.
On one level of analysis, it was a barrier failure that resulted it the are on. February 23, 1999.
The fail•,-ues of ene barriers Listed in the following table are those that CCH' believes caused or
contributed to this incident. The effectiveness of the barriers was analyzed and, from the
investigation:of the evidence available, a list of failures for each barrier was generated,
The table below lists the barriers that, had they either been in place or, if in place, had failed to
prevent the incident. Each barrier is listed w with a brief description of the intent of the barrier (in
italics).
*descri tion,of the faire or failures of the barriers is also listed.
* discussion of some of these barrier failures is covered in Causal Factors Analysis, Section. 8.
7-2
s4,1 . • :. o +:
AA
'`a��, "� , fid,; ,, 0
°1
`t
of
K3
for te + s ?a' it
o w o�a*� C 'tSu fl3i Q3r �a
'�' V � z"•'"` � �AA � � � ''.�' �"+. ''+, �L4 �1 'ti° rd+s IPA I
tr
00 . ZA
Its
t z
4,
s �t
tai w: s cY 1 0
°cam fig '; r' S
S,
ik
'sC3
sV-' to , 'Ss e
"Zi PA
to 00
6 ab
`; t
t
4S ; S
s �
s� �
sem"
1 t c wed t c»
t £ i;`
i 1tn, 3trxr,
to
O, { o
i s r ' a
t-
Ik
At
`
'tV '
tn
15
fz
,;
i
a % i
i 8 s S
ja
y J #
in
to
°
to
it
Ord
.' ^
i
i C✓
lCw�^d+ 44 A �Ae
it
;
## i i '.
� she �} 1� ��•'. � :3 s;
nil
jr : Ta' c �s
y svia I :
`� '•;�°� � � � �� ' `':yam � � °���,
# ate
Y Cyt its
# 6 X39 ;
!a
i it
•, ,A cd .
# s#
t�
t} ,
` s
tot }Ito
to
<>ad
at
t?
r� t� t ': sh
41
to
o 5
C+,
t oil,
` , 090
a " G'
It
it
bz `;
A10
cJ �t g
tw„ ;aux g �"-
stQjt4 } It
ta
{' NO it, 0 0 lot �
i
� as �
r { i q
CA
� to
$
to it
4 s C ice,
s t ut �} ST
eft
" a S vireiA
9 to
ad to
Ss
s ' .� 7
io
A
lvm
t
t E` �.`� fie, � � "��;,•d': � �'? � �' � �� � � '� Cd
At
,•' let
Q.
CA
ad
Eo to
s
's
in
S t
" nv :z4ro
Twi
15,
tj ti
<9.e
. ,'� vhf � id'1 '•..7 # 3 �� � i � � � S
fry+
S
S � s i4
3+
1�
�� # ��# � f� t °�. � t# fib •� � "� #
f i ' r4rA
1
gid
•�' ' J
SECTION 8
CAUSAL FACTOR ANALYSIS
An incident investigation should answer three questions: what happened, how it
happened, aid�;hy it happened, Ca�,u�sal facto analysis, including identif�ling root causes
addresses why an accident happened. Section 5 described what happened and how it
happened. The objective of causal factor analysis is to identify the causal factors or
potential causal factors of the fire. The methodology used is based on that described in.
the U.S. Department of Energy Workbook "Conducting Incident Investigations,"
Revision 1 dated November 21, 1997.
TYPES OF CAUSAL FACTORS
S
There are three kinds of causal factors covered in this analysis:
• Direct cause
• Contributing causes
• Root causes
The direct cause of an accident is the immediate event or condition that caused the
accident.
Contributing causes are events or conditions that collectively increase the likelihood of an
accident but that individually did not cause the accident.
Root causes are the causal factors, including management systems, that if corrected,
would prevent recurrence of the accident. foot causes can include management system
deficiencies, management failures, improper worker actions, inadequate competencies,
accepted risks performance, errors, omissions, non-adherence to procedures, and
inadequate organizational communication. Simply stated, the rest causes answer the
8-1
question "why dad the accident happen?" Note that the definition neither limits root
causes to management activities nor precludes workers' activities from being root causes.
However, the DOE methodology states the following conditions must exist for the root
case of an accident to be fc}gid at the worker level (In this case worker level would be
50 ;nit operators including No. I Operators, Tosco mechanics, and the Bigge Crane and.
Interstate Scaffolding employees.)
a Management systems were in place and functioning, acid provided
management with feedback on system implementation and performance.
Management took appropriate actions based on the feedbag.
Management, including supervision., could not reasonably have been expected
to take additional actions based on their responsibilities and authorities.
It's important to p=ut this accident into context. This accident was not the result of a�
unexpected operational upset or ars € unexpected equipment fail-are in 50 Unita This
accident happened while workers were dism antling a piping system that had been
shutdown for replacement two weeks earlier. This piping replacement was not a high
priority rush soba The dismantling was scheduled for February 23�d and installation of the
replacement piping was scheduled for February 26th. Beginning immediately following
isolation the leak of February lIl`". the execution of this,fob was subject solely to human
actions at the operator and mechanic level and various management and supervisory
revels at 'l cisco. 'There were also standard Tosco safety procedures that applied to the
safe execution of the Job.
In the following discussion, CCAS argues that though serious and significant contributing
causes were found at the worker level, worker actions were not the root. cause because
mana ernent systems and actions were less than adequate and did not f ulf fl: the above
criteria for finding root causes at the worker level.
8-2
DIRECT CAUSE
The direct case of the fire was naphtha released froni the naphtha piping that ignited off
hot sur.faces on the Fractionator which were above the autoignition to perature of the
naphtha.
CONTRIBUTING CAUSES
a Naphtha was released because the naphtha line was not property prepared for
maintenance in compliance with Tosco safety procedures and the State of
California Petroleum Safety Orders.
'l`-pis is a serious and significant contributing cause, because if Tosco safety procedures
had beer,. complied with on the day of the fire; the fire woad not have occurred. These
safety procedures reflect Vhat is corn mon practice in the refining industry nor preparing
piping for maintenance work. This non-compliance is tabulated in Section 7, Barrier
Analysis. Before cold cutting started, isolation valves should have been locked and
tagged,which was done,and the line then should have been, but was nota
• Drained
• Depress °ed
• Washed or stewed out
• Blinded(Slip blinds installed for isolation)
After sec °ire the, isolation valves, the essential first step for accomplishing all of the
above is draining the line. In this case, cold cutting and removing the first section of
piping was initiated without the line being drained. Draining was critical for two reasons
First and obvious, draining would have eliminated most. of the naphtha, and seconds only
by draining the lir=e could the operators have verified that the isolation valves were leak
free, i.e., that there was no flog through the closed valves. This would ensure that the
s3
line was depressured. Blinds cannot be installed unless piping is both drained and
depress€red, i.e. block valves do not leak . This accident would not have happened if the
bypass valve had been blinded. However, because the bypass valve was leaking
significantly, a blind could not have been instaRed. If the line had been drained, the Fact
Haat either the top block valve or the bypass salve (or both) were sign ficantly leaking
would have been discovered. With knowledge of this valve leakage, CCHS assumes that
Tosco would have shutdown the entire 50 Unit to safely replace the naphtha line. As
described in Sections 4 and 5, Tosco made efforts to dram the line before proceeding to
cold cut, but when these efforts bailed, decided to proceed without draining.
The State Petroleusni Safety Orders also require that precautions be taken to prevent
ignition by eliminating or controlling sources of ignition before opening lines or
equipment where flammable liquids or vapors may be present. In this incident, there was
no evidence of any precautions being taken on tie hot surfaces beneath the naphtha line
that were sources of ignition;before cold cutting st.; ted.
2. Stapp-Work authority not exercised:
This is a serious wid significant contributing cause because if the wormers and
maintenance supervisor had exercised their stop work authority, the fire would have not
occurred. Section. D.2 of Safety girder S-5, Tosco's procedure that corers Safe 3'Vorm
Permits, sets forth, the authority for anyone (including operators, echanz%cs and
supervisors) to stop unauthorized work it progress, which includes maintenance work
being done in non-compliance wiffi procedures. It became clear during interviews that
Tosco employees recognize tfiat they have this authority. The cold cutting proceeded in
clear non-compliance with procedures and neither the No. 1 Operator, the Tosco
mechanics nor the Maintenance Supervisor stopped the job.
8a
Sys Line plugging
Plugging of the piping at the bottom of the"U" is a contributing cause, because if th line
was not plugged, it could have been drained, Draining the line would have revealed that
valves were leaking ad tl,e line could not be de-pressured.
4s Uncommunicated or unrecognized warning signs.
Managers and operating supervisors stated that the wamr,in signs cited below were not
known by them.. Had mnanagement or operating supervisors been aware of these warning
signs, they could have reacted to the information by getting involved in the safety aspects
of the job.
A. Valve leakage
Between February 1 `" and February 23", there were events in the 50 Unit that 'were
warning signs that clearly indicated that there were problems with the valves leaking.
These events and lack of cora-n€ nicatio-n are described in section 4 and are the
subsequent leafs of February 1P, and 17'�', and the necessity of pumping out the Naphtha
Stripper six times on February I PI through 14d. The leaks were clear indication that
Valve Aeras leaking. The liquid filling the Naphtha stripper necessitating the purnpouts
of February 13L'and 14ffi couId conceivably have come only through Valve A and valves
at the control valve manifold, Valve B and/or Valves C, lis and E. This was a clear
indication `hat va Ives were lealking. The significance of valve leaking is the. the line
could not be depressured and blinds installed. Consequently, the job could not safely be
done with 50 Unit operating.
B. Drain valve plugging
As described in section.4, both.the Business Team. Leader and the Operations supervisor
were informed by operators that the drain valves were plugged. neither followed up to
find out whether or not the drain valves had been unplugged. This is a contributing cause
8-5
because had they found out the drain valves could not be unplugged because the drill
cable broke,they should have became involved in job preparation.
C. Sludge in line
As Described in Section 4, sludge found in the piping was not reported to managers and
operating supervisors (the maintenance supervisor was aware of the sludge on February
19""). This is a contributing cause because managers or operating supervisors may have
become involved in job execution had they known about the sludge and the possibility of
she sludge causing line plugging.
50 Two operating organizations with responsibility and authority over 50 Unita
When the incident occurred, two operating organizations had responsibility and authority
for 50 unit. These are shown on the organization chart, chart 6-1. The production Day
Organization was responsible for planning operations and maintenance, while the
Operations Shift Organization was responsible for the execution of the operating pans
and maintenance. The operators formally worked for the Shift Supervisors in the shift
organization, but in reality, the Shia. Supervisors and all levels in the Production Day
Or ani .tion, particularly the Operations Supervisor, ,gave the operators direct work
direction. Some operators were not clear on who their supervisor was: when asked, the
nnost common wiswers Y,,vere the Business Tear.Leader or the Operations Supervisor, not
the Shift Supervisor, CCHS believes that having two organizations responsible for 50
unit and exerting authority over the operators could have contributed to the accident as
follows.
• The warning signs cited above were possibly not reacted to by the first line
supervisors doe to this split responsibility and authority. Each organization
could have expected the other to have and take action on the information.
• The Shift Supervisors did not get involved at all in the execution of the
naphtha bine replacement, and stated they would have gotten involved only if
8-6
asked to by the Production Day Organization. The Production Day
Organization stated the operators were responsible for the safe execution of
the job and did not get involved in job execution. This left the changing crews
of operators to fend for themselves on a job that should have had sorneone in
operations supervision in charge and coordinating the job on a continuous
day-today basis.
6m Job scheduling
In CH 's opinion, the line should have been filly prepared for dismantling before the
crane and scaffolding workers arrived on the job site. It is possible, but there is no
evidence to the effect, that the presence of the crane and it's three man, crew plus the
three scaffolding workers on the job site exerted pressure on the decision to proceed
without draining the line.
. Non-conformance with benzene safety practices
A stream that contains more than 0.1% benzene Falls under CalOSHA regulations that
require specific precaution be taken. to prevent worker exposure to the stream. Tosco
procedures designate the naphtha stream as falling under these benzene regulations. The
Tosco procedures require that in addition to an operator a Shifft Supervisor also sign a
work permit for work on the naphtha stream that could involve worker exposure. This
was not dome for work that tools place on.February 23'd, nor was done for any other work
done between February I fl'h and February 23'd. This is a contributing cause because had
the procedure been followed, a Shift Supervisor would have signed the permit for the
drilling out of Che plugged drain valves on February 18'h and removing the section of
piping on February 19t'. This Mould have made the Shift Supervisor mare that there
were problems draining the lure. Also, had the ship Supervisor signed the permit on
February 23 d, he should have noticed that the permit did not adequately cover the proper
preparation of the line for dismantling.
8--7
7. Unused drain valve
There was a bleeder valve in the piping between upstream of the control valve manifold
that was not tried for draining the line. This is Valve H on Exhibit 6. Post incident
investigation showed that Valve H was lightly plugged and easy to clear. Had this valve
been used to drain the lire prior to February 23�d, or or. February 23'd before
discom ecting the line at Valve A, the valve leakage described above probably would
have been safely discovered.
8. Control of ignition sources
Ignition sources were not controlled as required by the State Petrole= Safety Orders.
Adequate control of the hot surfaces would have prevented ignition, of released naphtl-la.
ROOT CAUSES
The situation at the start of work on February 23'c can be summarized as follows:
* Draining attempts had been unsuccessful. This was not co=u icated to
managers and operating supervisors.
® Warning signs that clearly indicated valve leakage were not, Lnown by
management or operations supervisors.
The operators had received no work direction to supplement Tosco standard
safety procedures.
* Managers and operating supervisors were .not aware that the line was about
75%fW of naphtha..
Referring back to flee conditions required to find root causes at the worker level;
8-8
Root Cause No. I a
Management systems were not in place and functioning to provide management with
adequate information regarding the safety of the Job-
Tosco management did not receive the information that should have caused
management to react and ass-Lune a leadership rale in safely preparing the lrne for
maintenance. Tosco management stated that they were not informed that there were
any problems. Specifically:
Tosco management and fiat line supervisors did not know that the operators
could not drain the line,
Tosco management dict not know that bleeder valves were plugged and that an
attempt to drill thein out failed,
l cisco management and first line supervisors did not know that the line Mice
leaked agair,indicating that Fractionator Valve A was leaking,
Tosco management and first lir=e supervisors did not know that the line was
reported by operators as being
* Tosco management did not know that the Naphtha Stripper had to be pumped out
indicating leakage of the top Fractionator valve and valves at the control valve
manifold,
* Tosco operating rnanagernent did not know of the sludge fousid in the piping
causing the drain valves to be plugged.
Root Cause No. 2
'management systems were not in place to ensure that managers and first line supervisors
take appropriate actions that they should have, based on their responsibilities and
authority.
8-9
Management and supervisors cannot be expected to get involved in all
maintenance activities in 50 Unit. However, Tesco management systems should
expect manager and supervisors to recognize those maintenance activities where
they should be proactive in exerting leadership and authority to ensure that a
particular job is safely -executed. ?'Managers and supervisors should not assume a
job is routine without first considering the satiety aspects of the,deb. In CCHS's
opinion, because this job involved dismantling of a naphtha line located directly
above sources of ignition, operations managers and supervisors should have
become involved in considering the safe execution of the,fob from the beginning.
Operations management should have ensured that plans were made and
cornmunicated to the operators on how to safely prepare this line to be
dismantled. An individual operations supervisor should have beer made
resporsib e for preparing a plan and following the execution of the plan.. in this
case, it appears the nobody in operations took charge of the Job or responsibility
for planning safe execution of the job. CCH s believes that had operations
management become involved early,
* Management would have quickly recognized that the line was almost full. of
naphtha presenting a hazardous situation meriting their attention preparation
of an execution plan..
By following up on progress in executing the plan, management would have
been aware of all the problems encountered in draining the lane and possibly
come up with alternative draining methods. One Tosco manager stated. `there
is always a moray to drain a line." This may not be s 00% correct, but there
were options not tried that may have been successful.,
T
f an alternative draining method had been successful, Tosco would have
realized at least one valve had significant leafage. This tined out to be the
bypass Valve B, At this point CCHS assumes that Tosco management would
have shutdown the entire unit to replace the piping.
8-10
SECTION 9
RECOMMENDATIONS
RECOMMENDATIONS ADDRESSING ROOT CAUSES
The two recorn endations on management systern.s below are complementary one
addresses effective communications between the s'hi organization, supervisors and
management so t1at management and supervisors can be reactive, and the other involves
the responsibility and authority of managers and supervisors to be proactive in
appropriate situations.
Recommendation..No. t
Develop a system to improve communications between the operating shift organization
and rnanaernent and first line supervisors.
* This could involve more face to face communications and less _reliance on electronic
information. Face to face communications provides a better form for exc ian in
information, explaining the significance of information, questioning, and giving
guidance. Safety should be a specific topic covered in these face to face
communications.
CCHS would have included in this recommendation for a reorganization that would
have clarified organization responsibility for 5€1 Unit. Tosco's elimination of the
Operations Sift Organization and including the Shift Supervisor in. the Production
Day Organize-tion satisfies this. Tosco should, if they have not already, clarify lanes
of communication,responsibility, and authority within ttbis organization.
9-i
Recommendation No. 2
Develop a system, or foster a culture or philosophy, that encourages management and
first line supervisors to seely to recognize situations that they should exercise their
responsibility and authority to proactively ensure that these situations are handled in a
safe manner. This could take the form of:
* Questioning the safety aspects of a particular Job.
* Issuing written or oral instructions to supplement standard safety procedures.
: Field follow-up sin proper execution of the job.
* Proactive co unications with the shift operating organization to seely out and
respond to operator concerns.
OTHER RECOMMENDATION
CCHS recomnends that Tosco investigate and implement measures to either prevent
plugging from occurring at the bottern of the naphtha piping, and/or the means to clean
out the piping while 50 Unit is operating. Included in this recomm ndatien would be a
means of verifying flow through the level control valve.
9®2
1,-'IPPENTDIXA
EXHIBITS
SUSPECTED SITUATION OF NAPHTHA LINE AFTER LEAK ON FEBRUARY 1 TI€
TO F RACTIONAt7OR
OVERHEAD ACCUMULATOR
=—,-S VAPOR RETURN LINE
aNe"A"c€used
NAPHTHA
yHHJRApTRAY
r At? ;
CL ELEV.-137:T;
i€
r
Leak' #mlN
location DIAMETER-8"
t
t
CRUDE
FRACTIONATION
TOWS R
V-1
CL FLEA.-73`6"
U SEE DIAMETER-
6" me®
s
F} <t Valve's,closed
s
NAPHTHA
4 f-FB'S` Hp
t STRIPPE
s
it�F}
F'f�2P [i ti
Suspected 3
naphtha �
level k, E
e#erminia#e)
x et st,+L�"
� �d
Valves"C"and"E"�l�sed
TO NAPHTHA PROD CT PUMP
DRAWING NOT TO SCALE
CONTRA COSTA HEALT H SERVICES
Ju€ l 5,-1,999
1 all-AB
SUSPECTED SITUATION OF NAPHTHA LINE AFTER LEAK ON FEBRUARY IOTI,
OVERHEAD ACCUMULATOR
, I VAPOR RETURN DINE
s
Va€gee"A"closed
NAPHTHA DRAW BRAY
4L ELEV.-13?`3"
UNE
DIAMETER-8'
CRUDE
FRACTIONATION
TOWER
napMt a
Vm
level
I
z _
#
VV Am"-3"closed
NAPHTHA
STRIPPER
0v ELEV.£u`2-313" t-3
ss la "•.+� 'E" I
t�F" "G"
Valves" "and"E" Iced
a
TO NAPHTHA PRODUCT PUMP
DRAWING NOT TO SCALE
CONTRA COSTA HEALTH SERV# wS
EXHIBIT.--I
SUSPECTED SITUATION OF NAPHTHA LINE AFTER'. LEAK ON FEBRUARY I()TI1
TO FRACTIONATOR
OVERHEAD ACCUMULATOR
VAPOR RETURN LINE
. Ix
Valve"A"c1csed s
NAPHTHA ORAD'TRAY j iiLeak'� UNE
i
CRUDE 3
FRACTIONATION
s TOS` E
Ove;
Indetern nate)
UNE DIAMETER- Q ELEV. 73'6"
s
s '
t
"H" News"S"dosed
64 Si NAPHTHA
STRIPPER
C6 ELEV.60:2.3E8"
G:y0.iF }.,3 Ff�49
{ swA I i
"F eFG"
Valves"C"and"E"dosed
TO NAPHTHA PRODUa T PUMP
DRANONG NOT TO SCALE
CONTRA COSTA HEALTH SERVtCE-S
ACTUAL SITUATION OF NAPHTHA. LINE .AFTER LEAK OF FEBRUARY 10TH
TO FRACTIONATOR
OVERHEAD ACCUMULATOR
. ( VAPOR RETURN DINE
t
Va::we"A"dosed but leaks by #
NAPHTHA DRAWT
me C- ELEV.-13T 3"
Leap
ti LINE
TOP OFAPP"!'HA
ELEV. 103t 8"
CRUDE
FRACTIONATION
TOWER est 5"
�. V-1 i
sFY ® �em
-------------
3 -
T
:€quid naphtha
SEAL
LES
i
Valve 16"closed
"H" but lease by j
Ff ti NAlyy�l�"THA ?.
STRIPPER
C,ELEV.6V 2-3/8- V--3
$ t{t'pFe
l F6(i{t C•� ki t?
"G"
S €
fpj
0 section of piping
VIC
manifold,valves,and
drain.valves plugged with Valves"C"and"E"closed
black se.mi-solid mateftl
TO NAPHTHA PRODUCIT PUMP
ORMMNG NOT TO SCALE
CONTRA COST'S HEALTH SERMC E
July 15, 1999
EXHOIT
REQUIRED PREPARATION OF NAPHTHA SYSTEM BEFORE COLD CUTTING STARTED
ON FEBRUARY 23RD
FRACTIONATOR
OVERHEAD ACCUMULATOR
VAPOR RETURN LINE
[L6 P!LGJ
Va#ve„A"cried
NAAp�iTHA[3i�e'e�TRAY -�
Siip b d ir:�ta ied to prevent leakage
Legit ;
location LINE
i
DIAMETER-8'
i
CRUDE i
� Requirements dor opening the's?ne:
F it IONAT*N -piping drained
TOWER ER i e Ping depressured
c -piping steamed out or water washed as precti !
... dee§ f E
LANE DIAMETER Ce ELEr/:73'6"
� f
r , ,
i r ;
r f ,
r :
' 11
{ � �F,G,Cd PSEG S
S
Slip b##r;d if3$teiied
Feta
to prevent leakage Value"S'dosed
{ APHTHA
STRIPP
ERu
CL EN V.69a 2-3E8" V-3 i
t4p5Ff --ry66 «EFF
r
f r .
f
tfr
A f
�lBUND FLANGE
eive opus t
Drain valve"F"open
TO NAPHTHA PRODUCT PUMP
DRAIWING NOT TO SCAILE
CONTRA COSTA HEALTH#SERVICES
Jt::y 15, 1999
ACTUAL CONDITION OF NAPHTHA SYSTEM BEFORE COLD CUTTING BEGAN ON
FEBRUARY "
TO FRACTIONATOR
OVERHEAD ACCUMULATOR
i
-- VAPOR RETURN LINE
.6 PS
Va€be`K closed and leak tight
r
NAPHTHA DRAW TRAY
a Q ELEV.-137'3"
APP^ ,
Leakll
location LINE
D'AMETER-8" E
TCP OF NAPHTHA
CRUDE E ELEV. 10T7
FRACTIONATION4
TOWER
sV-11 :1
Ci ELEV.-73:6"
LINEDIAMETER-
TOP OF NAPHTHA,
ELEV.70'31' �
3
r
LIQUID
SEAL ` .6P G f
r
LEG
s
Vai°de'El"closed
itPb
but€Saks by �
sett NAPHTHA
€ TMPPER
0'-ELEV60'2-3/8" V--3
St�PP
S
EEp'4tf it E"
BUND FL
as ve"C',
p PP ti J��igj*,
closed d i
Drain valves s
closed
TO NAPHTHA PRODUCT PUMP
-DRAW€,NG NOT TO SCALE
CONTRA COSTA HEALTH SERVIC S
July 15, 19099
LOCATION OF FIRST AND SECOND COLD CUTS AND NAPHTHA LEVELS BEFORE
INITIATION OF DRAINING A17EMPTS
----� TO FRACTIONATOR
OVERHEAD ACCUMULATOR
°2.6 @ VAPOR RETURN LINE
i
NAPHTHA DRAW TRAY BUND FLANGE(installed dudig first piece remova)
(Baca removed
after first cut)
iA" �
4s y�aLINE
FIRST sJ C; ELEY.—;GeV S"
333f i
'— NAPHTHA ELEV.-10T 7.:
f
FRACTIONATION r
TOWS
ELEV,73'6"
3
LINE DiAtMETER- 3
3 TOP OF NAPHTHAELEV7V 3"
®___��➢ '
't
a
LQUM 3
SEAL;
LEGWve"S"i0aits by
i
a
tFH"
NAPHTHA
STRiPPER
CL ELEV.69 2-318" VA3
"D"
SAS "E"
Lower ssctlon of piping
manftid, salvos,and #
drain valves p;!uggedwftlh
black semLsolid materSUND FLANGES
s?
9f �
Manges spread during (Installed after spool
second draining attempt piece removed)
Dra;n Va!ve"I"sised in TO NAPHTHA PRODUCT PUMP
first draining attemp`
DRAWNG NOT TO SCALE
CONTRA COSTA HEAI T SERViCE3
July 16, 1999
TYPICAL SITUATION WHILE MAKING SECOND COLD CUT AFTER INITIATION OF THIRD
DRAINING A17EMPT
0 FRACTIONATOR
OVERHEAD ACCUMULATOR
2.6 PSIG VAPOR RETURN LINE
I NAPHTHA DRAM TRAY BUI,4D FLANGE
—FIRST Cu-CL ELEV.-129'6' UNE
DIAMETER-8"
CRUDE
FRACTIONATION I SECOND CUT ELEV.-103'7"
TOWER
V-1
CELEV.-7T 6"
UNE DIA-METER J
(LIQUID LEVEL BELOW
SEi NAPHTHA
SECONDCOLD CLIT) VAPOR
LOW
FLANGE ELEV.-631 1'
draining
DECREAStNG
system,
LIQUID
SEAL
" ' Valve'B"lssks by
LEG
LV
R + STRiPPER
NAPHTHA
H
�EE . V-3
"D"
"C" "E"
'F? BLIND FLANGE
V AC U U M TR U CC K
VaIve"H";
uriused b:eeder valve TONAPHTHA PRODUCT PUMP
0"AANG NOT TO SCALE
CONTRA COSTA HEALTH SERVICES
ju;!y 15i 1995
IT�7
LOSS OF LIQUID SEAL
TO FRAC70NATOR
OVERHEAD ACCUMULATOR
VAPOR RETURN LINE
4
12.6 PSIG
r ,
f
i
N*APHTHA DRAW TRAY BLIND FLANGE
{ tuff
i
CL E" 929'&' i;'tom �
4 DIAMETER a 6" `
CRUDE
s o
F ICTIONa TION SECOND CUT ELEV.-103'7" 9
TOWER
CL nEV.-73'6"
UNE DIAMETER
Nauhtha
t pit i 9 Los 12.6 (
liquid
Valve'B";aaks by
"H;'
/may r NAPHTHA
,/- ELEV.
s t - S� STRIPPER
"F BLINDF�ANGE
VACUUM TRUCK
cC/yvy.Bi 1
tf,Pe<t 4 2s'.a1 :t�ff
TO NAPHTHA PROO CT PULP
DRRwV:N s 0m TO SCALE
CONTRA 00 STA HEALTH SE DICES
July 95,9399
RELEASE OF NAPHTHA RESULTING IN FIRE
- TO FRACTIONATOR
- -�
OVERHEAD ACCUMULATOR
VAPOR RET€R L( EE
_ -
NAPHTHA DRAW TRAY FLANGE NAPHTHA VAPOR to FLOWH
y �
3
RELEASE ®m FIRST CUT CL ELEV.-129`&" LINE 3
FRf3', ' a DIAMETER-8"
OF DIFF
i
CRUDE RELEASE
CUT C3l� CUT� -� `�`�'i�S � ELEV.-1�3`7"
FRACTIONATION SECONDTOWER UT
^ V- NAPHTHA
al LIQUID AND
Ci ELEV.-73'6" ;
a I VAPOR �
FLOW �
t
3 NAPHTHA
RELEASE o VAPOR
f
AT#�R4I FLOW -
ik :
i L_Ji t
NAPHTHA
' PPER
CL ELEV.60'
3 � ff�tr
old—
"E"
� 4 3
: f. 1 f
i s
i
`F BUND FLANGE ff
i
Via..
VACUUM TRUCK
TO NAPHTHA PRODUCT PUMP
DR.NWING NOT TO SCALE
CONTRA COSTA€ HAL`H SERVICES
July 15,1C999
E Ids
RELATIVE
TOP `OVIV
ELEVATIONS OF EL. 174'V
WORK SITES
AND NAPHTHA
ON FEBRUARY 2
3 3
1
3
NAPHTHA DRAW NOZZLE
E 137'3'
L
HORIZONTAL RUN EL.m 129'8" _._._._._._.—.—. .
(LOCATION OF FIRST CUT)
I
NAPHTHA LIQUID EL. -107'7"
SECOND CUT EL.e 103'7" ._.—.—
�• PERMANENT PLATFORM 94
EL. 102'T'
i 9
i
� t
FACE OF FLANGE,
I
LOCATION OF THIRD
LOCATIONOCONTROL l�Ale g—._._._._._ AND FINAL DRAINING
MANIFOLD AND PLUGGED ��® Ls 63'0-112"
DRAT yyZ��YF°iALVES
Lc 'AS" --------------
� g
STR#PPER °°; TEMPORARY PLATFORM#8
PERMANENT Per" ��R�iy � �• �EL.60'0"
EL.54'0" 3
i
STR€PP R
PERMANENT PLATFORM 03
EL.365-1/2"
i
LF
.—.—.—.._._._----.—.—.—.—._. _.
NO€t NAL GRADE EL.e 25;0" ~�
APPENDIX
CORROSION CONTROL AND LABORATORY ANALYSIS
Crude contaminants and their sources
Crude oil is a mixture of hydrocarbon compounds of varying boiling points and densities.
A crude fractionation unit is designed to separate these compounds for further processing
in downstream units. Along with these hydrocarbon compounds, crude oil contains
various organic and inorganic compounds which act as contaminants for downstream
operations, and can potentially harm downstream equipment and catalysts.
Examples of these contaminants are as follows;
• organic and inorganic salts
• organic and inorganic acids(sometimes formed by decomposition of salts)
• sulfur-containing compounds
• soli ds/sedirnent
• water
• mtrogen.
Effects of contaminants €n process operation and equipment
Salts and acids in crude oil carr. cause severe corrosion problems in downstream
processes. These salts and acids attack different locations of a process, usually based on
process temperatures (i.e., some attack the lower, or hotter, areas of a tower, while some
attack the higher, or cooler, areas). The presence of water in the upper areas of a tower
(at temperatures below the dew point) also affects corrosion rates. Salts can ortn highly
corrosive sites in the presence of water. At these corrosive sites, wader combines with the
chlorides from the salts to forrn highly corrosive Hydrochloric acid, wlhich pits, and tnay
eventually hole-through the metal.
APPENDIX B-I
ulf-wr compounds .also can increase corrosionn downstream, but .are mainly considered as
poisons to downstream catalytic reaction units. sulfur compounds in refining products is
a significant problem for certain users.
Solids and sediment in crude cause plugging with the potential for signif.cant operability
problems. Metals in crude oil are highly undesirable to certain downstream processes.
Metals are concentrated in the heavier cr;ade oil components, and when entering certain.
reaction units, can cause damage to reactor catalysts.
"Tater in any process feed, if not removed prig the entering a high-temperature vessel,
can cause potentially serious damage to equipment. As the water is rapidly •:vaporized to
stem, the sudden increase in volumes and pressures could result in vessel fai re.
Nitrogen is another potential -poison to downstream units. Nitrogen can deactivate
reactor catalyst, caasing significant decrease in operational performance.
`here are other potential contaminants in crude oil, each, with similar consequences to
those listed above. Different crude slates have varying amounts of the above
contaminants, as well as varying concentrations of components with different boiling
points. For example, a crude slate from one feed tack could contain significant ly higher
concentrations of lighter hydrocarbons than that from another tares. When the crude feed
is suddenly changed from a heavier feed to a lighter feed, there is a possibility of the
lighter com=ponents surging up the Fractionation, bringing with it acidic components that
normally reside in the bottom of the tooter. 'rn€s can result in an increase in corrosion
rates in the upper sections of the Fractionator.
Contaminant removal
Only a few o= the contain, marts listed above are of concern in a crude fractionation
process. They are organic and inorganic salts, organic and inorganic acids,
solids/sediment, and water. The primary means for removal of these contaminants is
through the desalting process. Boor desalting can result in carryover of contaminants to
the c4ade fractionator and other downstream equipment.
As described if Figure 3e1 in Section 3, process Description, Desalting is achieved in
large horizontal vessels called Desalters, which are located fairly early in the crude
refiring process. Desalting is soften a two-stage process, with additional water injection
and mixing before each stage. The crude it is mixed with wash water and desalting
chemicals, forming an emulsion, and fed to the Desalters. Desalters are designed to be
large enough to allow sufficient residence time for the oil/water emulsion to separate. As
the emulsion separates or "breaks", the water phase, containing the majority of the salts
and acids, sinks to the bottom of the Desalter. Assisting in the water/oil separation
process are electrostatic grids located in the oil layer above the water layer. These grids
electrically "attract" small water droplets entrained in the oil phase. As more droplets
forri together, they become large enough to drop out of the oil layer into the water layer
below. ";he water is pumped away. The level of the emulsion layer (the layer between
the oil phase and the water phase) in the Desalter is controlled to prevent water carryover
with the crude feed.
Laboratory test results
Laboratory testing concentrated on three areas: the cause of the original leak, analysis of
the bypass Valve B, and analysis of the solid residue that was located in the piping
around the Level Control Valve D. The naphtha piping, valves, and various solid and
liquid samples were sent to an independent laboratory for rnetall€.:rgical and chemical
analysis. Following is a discussion of the test results and conclusions.
The original leap in the bottom of the elbow of the naphtha piping was determined to
have occurred due to ammonium chloride corrosion. As ammonium chloride salts
deposited on the metal piping walls. These salt deposits combined with Condensing water
and formed hydrochloric acid, which eventually holed through the carbon steel piping.
The liquid sarnples taken frorn, the control valve rnanifold were found to have extremely
high total acid numbers, as well as other corrosive constituents, indicating increased acid
corrosion potential.
The effects of corrosion/erosion on the 4-inch bypass Valve B were also analyzed. The
valve body, constructed of carbon steel, experienced corrosion similar to that seen in the
upstream piping. Even though the valve disc and seat ring are of harder, more
corrosion erosion. resistant metal (13 Chrome steep than the carbon steel body of the
valve, they experienced considerably more corrosion/erosion than the rest of the valve
body. This can be attributed directly to the higher velocities of fluid through a partially
closed valve. This bypass valve, designed For periodic operation when the control valve
is not operating correctly; had been in continuous operation for some time.
Laboratory conciusions state the disc/seat ring lost so much metal due to
corrosion/erosion that the seal between `.been was lost. In a closed position, the disc was
in metal-to-metal contact with the seat ring at only two locations. The open area of the
gaps was equivalent to a l%-inch diameter hale when the valve was in the closed
Position. The erosion occ=, ed because the valve was in a partially opera position during
normal operation.
The solid residue consisted mainly of iron oxides mixed with sol ar and chloride
compounds. These presence of these compounds indicate corrosion upstream. The
insolubility of these compounds allowed them to settle in the low points of the piping,
causing the plugging of Level Control Valve D. This plugging prevented Valve D frorn
controlling properly, necessitating the continuous use ofbypass Valve B.
Tesco Steps to Improve Desalter Operation at 50 Unit
There is evidence that there had been difficulties in the Desalter operation at 50 Unit for
quite some time; possibly since the crude slates were changed after the shut down of No.
3 Grade .:nit in 1998. After reviewing the Desalter operating history and discussions
with Tosco's desalting chemical technical sales representatives, it was discovered that the
APPENDIX Bm4
Desalters had leen frequently operating outside their design parameters. In addition,
there were periodic changes in er ade slates that frequently resulted in Desalter upsets for
extended periods cftime (i.e., over rn€�ltiple shifts).
Based on ',he esa ter operating history and the discussion above, Tosco has decided to
take the fallowing steps to improve the Desa°ter operation at 50 Amit:
— Establish minimum 6 hour settling time sof waterborne crude prior to introduction
as eed the 50 Unit.
— Install mixers in crude tanks as the tanks are removed from service for
inspectionl,nairdtenance,hark.
— Increase 'cus on water draining to; minimize water heel in feed.tanks.
® Install equipment to leu-"gyp water/emulsion to separate tank for improved water
management vs. draining water to sewer.
® Work with treatment chemical vendors to improve treatment performance.
Evaluate the performance of current process chemical treatment supplier.
Study desalter technology improvements (e.g., considering a change to bielectric
desalting).
APPENDIX C
PIPING ISOLATION METHODS
Most standard piping is connected by flanges. A flange is a flat piece of metal, welded
onto the ends sof lengths of pipes, with bolt boles which allow for bolting flanged pipe to
other flanged lengths of pipe or to other pieces of equipment. Between the two flanges is
a gasket, a thin piece of material compatible to whatever service the piping is in, which
provides a seal between the metal surfaces of the flanges.
The number of flange bolt holes varies depending on pipe diameter and pressure service.
Larger or higher pressure systems have greater numbers of bolt boles. A typical flange in
the .most common service (as in the naphtha draw piping) normally has eig°it bolt boles,
as shown in the attached figures.
Prior to maintenance on process piping or other equipment attached to process piping,
industry regulations require positive isolation of tie process whenever possible.
Providing positive isolation means that the flow of any material through the pipe is
prevented through mechanical means (beyond a single closed valve). positive isolation
provides the m.axisnum protection for workers and equipment from unexpected releases
of hazardous material through a pipe.
There are different methods for providing positive isolation of piping. The most secure
methods for providing positive isolation are air gapping and slip blinding. An additional
method discussed below is the double block and deed.
Air Gapping
Fig-.ue C-1 shows air gapping. A short piece of flanged piping between Flanges A and B
was removed., creating the air ,gap, referring to the empty space between the two blind
flanges. A blind flange, 5s then installed on the face of Flanges A and B. A blind flange
is a flat piece of metal that is bolted to the open face of a pipe flange. A blind flange is
often referred to by other names, including Old and boilermaker.
Slip Blinding
Figure C-2 shows two; pipe flanges that have beer, separated for the installation of a slip
blind. T o instals a slip blind, the top gree bolts are removed from the flange, and the
remaining five, are loosened. A slip Mind, a thin piece of metal with a tongue-like
protnision, is literally "slipped" between the two flanges. A slip blind has no bole holes,
so it rests between the bolts and covers the papa hole. e two flanges are thea re-bolted.
Slip blinding is used when the systern is to be isolated without removing any piping.
Prior to installing blinds with either of these methods, as with any maintenance that
w, requires opening a piece of pipe or equipment for maintenance, the system must be
blocked in, drained., and flushed as thoroughly as possible to wird-Mize the chances of
Dersonnel exposure to hazardous materials.
Double Black and Bleed
An additional method of isolation is called "double block and bleed," as shown in Figure
C-3. A double block and bleed consists of two valves with a bleeder valve in between.
The two valves are closed and the bleeder valve is open. The bleeder varve muse be clean
and unplugged. If eit`..her of the valves leak by, the bleeder valve will indicate this by
allowing the leaking material to flow out through it and prevent leakage past both block
valves. When this isolation method is used, the double block and bleed should be Dept
under surveillance, so the work can be stopped if a leak is discovered. properly
monitored, double blocks and bleeds provide the protection equal to one blind,
APPENDIX C62
PIPING ISOLATION METHODS
C.
4"0 o 4�0�
BLIND FLANGE
EF 0i f
V 0
,g ._._.�.o. .a
FLANGE Figure C-1: Air Gapping
FLANGE A V1 FLANGE B
AIR GAP
F 0
'�aAtea 3"{{qq;;dot aIjfj f l�olt�
are actually removed. 0 0 v ...
T'r-ae bolts are reel oved., 0 �._e 0
five loosened, the sip Mnd
installed, and all belts are :Metalled Figure C-2;. Slip Blinding
and tightened.
VALVECLOSED VALVE CLOSED
:
9
Figure C-3s Double Block
VALVE OPEN and Bleed
CONTRA COSTA HEALTH SERVICES
Jud 21, 19 9 APPENDIX s3
;co: - � l��uEc;o BOARD OF SC;. V€SOBS
07-t _ ...
KEP,, M`,. �. JIB RooEzs, 1ST isFRicr
W?LLW,A 3. WAi
DRECTOR &I 'HEALTH OFFICER ' :"`' ....... GAYLE i3. i.IILKEMA, 2N DISTRICT
.'
20 Aller, StreetDONNA GERs-R, BRo DISTRICT
Viu'tin eZ, Cai:'forr?3a y ;'%,41 , � A 'SARK DESAULNIER, 4TH DISTRICT
94553-3191 �---.�. "�"_ .r�...v.�_ JOSEPH CANCIAWLIA, STY DISTRICT
1,925; 37"-5903 ^
C OUN-ry Avm.!N€STPAT02
Fax(925)- 7.70-5099 ?HIL BATCHELOR
TO: BOARD- OF SUPERVISORS
FROM. WE..AtM B.WALKER,M.D.
SUBJECT' TOSCO AVON MANAGadENT S ...�Vir 'SAFE'i Y EVAI:LTA-;.ION
DATE: 07/23/99
CC. LEWIS O.PASCA.LL,JR.,RANDALL T.SAW 2'.R
On February 23, 1999, an accident occurred at the Tosco San Francisco Area Refinery at
Avon where four people died and another person was seriously injured. On February 27, 1,999,
the Board of Supervisors asked the Tosca Avon management to shut down the refinery to
perform a safety evaluation of the refinery. Can March 2, 1999, the Chief Executive Officer of
Tosco, Thomas O'Malley agreed to stand down the refinery, while a safety evaluation was
performed. On :March 16, 1999, the Board of Supervisors approved a scope of work, third party
consultants, and public participation for this evaluation. Arthur D. Little, Inc. performed the
evaluation with three public meetings and presented their report on the findings and
recommendations to the Board of Supervisors on April 27, 5999. On April 27, 1999, the Board
of Supervisors asked that Health Services report within thirty days on the follow up from the
Arthur D. Little report and the scope of phase 11 of this evaluation.. Can May 25, 1999, a report
was given to the Board of Supervisors on follow up of the Arthus D. Little recommendations and
phase II of this evaluation, which was accepted by the Board of Supervisors. I said that I would
come back with a report on the progress that Tosco is making on Arthur D. tittle's findings and
recommendations.
Tosco is working with Arthur D. Little and Health Services to ensure that their action plan is
addressing the findings and recommendations from the Arthur D. Little report. Arthur D. Little
has r-et with Tosco twice on the action plan developed by Tosca and the progress that Tosca is
:raking on this plan. Arthur D, Little plans to meet with Tosco eight to twelve hours a month
reviewing the progress that Tosco is making on their action plan..
Some of the action items that Tosco has made to address the Arthur I3, Lithe report are listed
below.
Tosco has held a Leadership Conference.
* Tosco has held a safety Surnrnit. This summit was with fifty-tyro employees and was
facilitated by an outside consultant. This is the first of this type of facilitated meeting to
address the communication throughout the refinery.
* The refinery manager has had a meeting with each of the employees of the refinery.
� 1
a Contra Costa Community Substance Abuse Services m Contra Costa Emergency Medical Services s Contra Costa Environmenta Health e Contra Costa Health Plan a
'' a Contra Costa Hazardous Materials Programs Contra Costa Menta:Health a Contra Costa Public Health Contra Costa Reglonai Mechcal Center Contra Costa Health Centers
* "Tosco hired an outside contractor to audit, review, and train their employees on field
safety during the turnaround. The outside contractor reviewed such items as work order
and hat work permits.
* Tosco is making visible changes on cleaning up the plant. Where have been unused
buildings removed, stacks painted, insulation on equipment replaced, and housekeeping
prs�ved.
* Vasco is emphasizing safety slogans with electronic signs in the refinery.
* Tosco is discussing with safety consultants about reviewing fi'asco's safety programs to
improve the overall safety at the refinery.
Health services plans to continue to work with Arthur D. Little and Vasco on ensuring that
the findings and recommendations from the Arthur D. Little report is addressed. Arthur D.
Little recommends that the onsite follow-up evaluation occur in late November or early
December. This will include public meetings, public comment period, and a report to this
Board.
2
b ryh✓
/✓ Ap�.,
� X19
Orn�-
_
z 0
e
Zak
r
ys
CD
ZZ:4111
1919
114
nlol
fi
�'x,
`i � v 'SFSG ~'M l,n
j �
u
vonAl `M
- - CD
4
o
-- -- ---
� I
Af _ w_w.. -
------------------
---
rn
e
01,
z
I