The CSB issues safety recommendations to prevent the recurrence or reduce the likelihood or consequences of similar incidents or hazards in the future. Recommendations are issued to a variety of parties, including government entities, safety organizations, trade unions, trade associations, corporations, emergency response organizations, educational institutions, and public interest groups. Recommendations are published in CSB reports and are closed only by vote of the Board. The CSB tracks all recommendations and communicates regularly with recommendations recipients to ensure that the recommended corrective actions are implemented. For more information, see Frequently Asked Questions about CSB recommendations.
2015-02-I-CA-10
Facilitate forum(s)—attended by fluid catalytic cracking unit engineers and other relevant personnel from American Fuel and Petrochemical Manufacturers member companies—to discuss the causal factors of the February 18, 2015 ExxonMobil Torrance refinery incident. Encourage participants to share topics such as design, maintenance, and procedural practices that can prevent a similar incident. Topics of discussion should include: (1) Detection of hydrocarbons flowing to an ESP; (2) Isolation strategies to prevent mixing of air and hydrocarbons during standby operations; (3) Safe operation during unit standby; (4) Use of SCSVs as a safeguard during standby operations; (5) Use of reactor steam as a safeguard during standby operations; (6) Measuring reactor / main column differential pressure during standby operations; (7) ESP explosion safeguards; and (8) Preventing ESP explosions. Create documentation that creates institutional knowledge of the information discussed in the forum(s), and share with the member companies and forum attendees. Status: Closed - Acceptable Action
Facilitate forum(s)—attended by fluid catalytic cracking unit engineers and other relevant personnel from American Fuel and Petrochemical Manufacturers member companies—to discuss the causal factors of the February 18, 2015 ExxonMobil Torrance refinery incident. Encourage participants to share topics such as design, maintenance, and procedural practices that can prevent a similar incident. Topics of discussion should include: (1) Detection of hydrocarbons flowing to an ESP; (2) Isolation strategies to prevent mixing of air and hydrocarbons during standby operations; (3) Safe operation during unit standby; (4) Use of SCSVs as a safeguard during standby operations; (5) Use of reactor steam as a safeguard during standby operations; (6) Measuring reactor / main column differential pressure during standby operations; (7) ESP explosion safeguards; and (8) Preventing ESP explosions. Create documentation that creates institutional knowledge of the information discussed in the forum(s), and share with the member companies and forum attendees.
2015-02-I-CA-1
A Variance to a safety policy or procedure requires robust analysis of the proposed safeguards prior to its approval and implementation. To ensure the proposed methodology described in the Variance is safe and the proposed safeguards are sufficiently robust, revise corporate and U.S. refinery standard(s) to require that a multidisciplinary team reviews the Variance before it is routed to management for their approval. Include knowledgeable personnel on the Variance multidisciplinary team such as: (1) the developer of the Variance; (2) a technical process representative (e.g. process engineer for the applicable unit); (3) an hourly operations representative (e.g. experienced operator in the applicable unit); and (4) a health and safety representative. The role of the multidisciplinary team is to formally meet to review, discuss, and analyze the proposed Variance, and adjust the safety measures as needed to ensure a safe operation. In the event the expert team members do not come to a consensus that the Variance measures can result in a safe operation, require the proposed work to be routed to a higher management level for final approval. Status: Closed - Acceptable Action
A Variance to a safety policy or procedure requires robust analysis of the proposed safeguards prior to its approval and implementation. To ensure the proposed methodology described in the Variance is safe and the proposed safeguards are sufficiently robust, revise corporate and U.S. refinery standard(s) to require that a multidisciplinary team reviews the Variance before it is routed to management for their approval. Include knowledgeable personnel on the Variance multidisciplinary team such as: (1) the developer of the Variance; (2) a technical process representative (e.g. process engineer for the applicable unit); (3) an hourly operations representative (e.g. experienced operator in the applicable unit); and (4) a health and safety representative. The role of the multidisciplinary team is to formally meet to review, discuss, and analyze the proposed Variance, and adjust the safety measures as needed to ensure a safe operation. In the event the expert team members do not come to a consensus that the Variance measures can result in a safe operation, require the proposed work to be routed to a higher management level for final approval.
2015-02-I-CA-2
ExxonMobil did not have an operating procedure for operating the FCC unit in its Safe Park mode of operation. At all ExxonMobil U.S. refineries, develop a program to ensure operating procedures are written and available for each mode of operation—such as unit standby—for all ExxonMobil U.S. refinery FCC units. Specify in the program that ExxonMobil U.S. refineries develop and train operators on any new procedure. Status: Closed - Acceptable Action
ExxonMobil did not have an operating procedure for operating the FCC unit in its Safe Park mode of operation. At all ExxonMobil U.S. refineries, develop a program to ensure operating procedures are written and available for each mode of operation—such as unit standby—for all ExxonMobil U.S. refinery FCC units. Specify in the program that ExxonMobil U.S. refineries develop and train operators on any new procedure.
2015-02-I-CA-3
The spent catalyst slide valve, specified as a safety-critical device for normal operation, could not perform its safety-critical function of preventing air and hydrocarbons from mixing while the FCC unit was in its “Safe Park” mode of operation. Also, ExxonMobil Torrance did not operate the FCC unit as if the reactor steam was a safety critical safeguard. Require identification of all safety critical equipment and consequence of failure for each mode of operation and ensure safety critical devices can successfully function when needed. Develop and implement a policy that requires all U.S. ExxonMobil refineries to: (1) specify each safety-critical device’s safety function; (2) identify the consequences of failure of each safety-critical device; (3) specify the testing strategy used to verify whether the safety-critical device can function as intended to perform its required safety function; and (4) maintain target availability (e.g. safe operating life) for each safety-critical device through inspection and maintenance. Require that items (1) through (4) above consider each mode of operation, including but not limited to normal operation, start up, shut down, and “Safe Park” modes of operation. Status: Closed - Acceptable Action
The spent catalyst slide valve, specified as a safety-critical device for normal operation, could not perform its safety-critical function of preventing air and hydrocarbons from mixing while the FCC unit was in its “Safe Park” mode of operation. Also, ExxonMobil Torrance did not operate the FCC unit as if the reactor steam was a safety critical safeguard. Require identification of all safety critical equipment and consequence of failure for each mode of operation and ensure safety critical devices can successfully function when needed. Develop and implement a policy that requires all U.S. ExxonMobil refineries to: (1) specify each safety-critical device’s safety function; (2) identify the consequences of failure of each safety-critical device; (3) specify the testing strategy used to verify whether the safety-critical device can function as intended to perform its required safety function; and (4) maintain target availability (e.g. safe operating life) for each safety-critical device through inspection and maintenance. Require that items (1) through (4) above consider each mode of operation, including but not limited to normal operation, start up, shut down, and “Safe Park” modes of operation.
2015-02-I-CA-4
ExxonMobil extended the maintenance interval of the spent catalyst slide valve and the inspection interval of the pumparound heat exchanger without analyzing whether the extended operation lowered their availability (by operating them beyond their predicted safe operating life) and could result in negative safety consequences. In the event safety-critical equipment is operated beyond its inspection and/or maintenance interval (e.g. extended turnaround interval), require all ExxonMobil U.S. refineries to perform a risk evaluation (e.g. MOC or risk assessment) to identify the safety consequences of the extended operation. Require that each mode of operation, including but not limited to normal operation, start up, shut down, and “Safe Park” modes of operation is evaluated during the risk evaluation. Status: Closed - Acceptable Action
ExxonMobil extended the maintenance interval of the spent catalyst slide valve and the inspection interval of the pumparound heat exchanger without analyzing whether the extended operation lowered their availability (by operating them beyond their predicted safe operating life) and could result in negative safety consequences. In the event safety-critical equipment is operated beyond its inspection and/or maintenance interval (e.g. extended turnaround interval), require all ExxonMobil U.S. refineries to perform a risk evaluation (e.g. MOC or risk assessment) to identify the safety consequences of the extended operation. Require that each mode of operation, including but not limited to normal operation, start up, shut down, and “Safe Park” modes of operation is evaluated during the risk evaluation.
2015-02-I-CA-5
Electrostatic precipitators create potential ignition sources during normal operation, and have historically caused explosions within the refining industry. At all U.S. ExxonMobil refineries, require a siting risk analysis be performed of all electrostatic precipitators and implement appropriate safeguards to minimize the consequences of an electrostatic precipitator explosion. Status: Closed - No Longer Applicable
Electrostatic precipitators create potential ignition sources during normal operation, and have historically caused explosions within the refining industry. At all U.S. ExxonMobil refineries, require a siting risk analysis be performed of all electrostatic precipitators and implement appropriate safeguards to minimize the consequences of an electrostatic precipitator explosion.
2015-02-I-CA-6
Implement protective systems that prevent ignition of flammable gases (including hydrocarbons not in the presence of CO) inside of the electrostatic precipitator, for each mode of operation. Status: Closed - Acceptable Action
Implement protective systems that prevent ignition of flammable gases (including hydrocarbons not in the presence of CO) inside of the electrostatic precipitator, for each mode of operation.
2015-02-I-CA-7
The spent catalyst slide valve, specified as a safety-critical device for normal operation, could not perform its safety-critical function of preventing air and hydrocarbons from mixing while the FCC unit was in its “Safe Park” mode of operation. Require identification of all safety critical equipment and consequence of failure for each mode of operation and ensure safety-critical devices can successfully function when needed. Develop and implement a policy that requires the Torrance refinery to: (1) specify each safety-critical device’s safety function; (2) identify the consequences of failure of each safety-critical device; (3) specify the testing strategy used to verify whether the safety-critical device can function as intended to perform its required safety function; and (4) maintain target availability (e.g. safe operating life) for each safety-critical device through inspection and maintenance. Require that items (1) through (4) above consider each mode of operation, including but not limited to normal operation, start up, shut down, and “Safe Park” modes of operation. Status: Closed - Acceptable Action
The spent catalyst slide valve, specified as a safety-critical device for normal operation, could not perform its safety-critical function of preventing air and hydrocarbons from mixing while the FCC unit was in its “Safe Park” mode of operation. Require identification of all safety critical equipment and consequence of failure for each mode of operation and ensure safety-critical devices can successfully function when needed. Develop and implement a policy that requires the Torrance refinery to: (1) specify each safety-critical device’s safety function; (2) identify the consequences of failure of each safety-critical device; (3) specify the testing strategy used to verify whether the safety-critical device can function as intended to perform its required safety function; and (4) maintain target availability (e.g. safe operating life) for each safety-critical device through inspection and maintenance. Require that items (1) through (4) above consider each mode of operation, including but not limited to normal operation, start up, shut down, and “Safe Park” modes of operation.
2015-02-I-CA-8
The Torrance refinery extended the maintenance interval of the spent catalyst slide valve and the inspection interval of the pumparound heat exchanger without analyzing whether the extended operation lowered their availability (by operating them beyond their predicted safe operating life) and could result in negative safety consequences. In the event safety critical equipment is operated beyond its inspection and/or maintenance interval (e.g. extended turnaround interval), require the Torrance refinery to perform a risk evaluation (e.g. MOC or risk assessment) to identify the safety consequences of the extended operation. Require that each mode of operation, including but not limited to normal operation, start up, shut down, and “Safe Park” modes of operation is evaluated during the risk evaluation. Status: Closed - Acceptable Action
The Torrance refinery extended the maintenance interval of the spent catalyst slide valve and the inspection interval of the pumparound heat exchanger without analyzing whether the extended operation lowered their availability (by operating them beyond their predicted safe operating life) and could result in negative safety consequences. In the event safety critical equipment is operated beyond its inspection and/or maintenance interval (e.g. extended turnaround interval), require the Torrance refinery to perform a risk evaluation (e.g. MOC or risk assessment) to identify the safety consequences of the extended operation. Require that each mode of operation, including but not limited to normal operation, start up, shut down, and “Safe Park” modes of operation is evaluated during the risk evaluation.
2015-02-I-CA-9
Electrostatic precipitators create potential ignition sources during normal operation, and have historically caused explosions within the refining industry. At the Torrance refinery, require a siting risk analysis be performed of the FCC unit electrostatic precipitator and implement appropriate safeguards to minimize the consequences of an electrostatic precipitator explosion. Status: Closed - Acceptable Action
Electrostatic precipitators create potential ignition sources during normal operation, and have historically caused explosions within the refining industry. At the Torrance refinery, require a siting risk analysis be performed of the FCC unit electrostatic precipitator and implement appropriate safeguards to minimize the consequences of an electrostatic precipitator explosion.