FCC Unit Explosion — Transient Operations Air Ingress
Husky Energy Superior Refinery Explosion and Fire
Husky Energy (now Cenovus Superior Refinery)
📍 Superior, WI
Incident: April 26, 2018  •  CSB Report: December 29, 2022
0
Fatalities
Hydrocarbon Vapors — FCC Absorber Sections
Chemical Involved
16
CSB Recommendations
📋 Incident Summary

On April 26, 2018, an explosion and fire at the Husky Energy Superior Refinery in Superior, Wisconsin, injured 36 workers and caused approximately $550 million in damage. The incident occurred during a planned FCC unit turnaround shutdown when air entered the gas concentration unit through the regenerator, mixing with trapped hydrocarbon vapors in the primary and sponge absorbers to form flammable mixtures that ignited.

The explosion propelled vessel fragments more than 1,200 feet, triggered an asphalt tank fire that burned for days, and forced the evacuation of approximately 2,500 nearby residents. The CSB found the refinery's shutdown procedures did not address the air ingress hazard and no prior PHA had identified it.

The CSB final report issued 16 recommendations to Cenovus, OSHA, EPA, API, and Honeywell UOP — all focused on transient operations hazard analysis, FCC shutdown procedure development, and regulatory improvements.

🔎 Key Findings
Finding 01
Air Ingress Hazard Not Identified in PHA
No prior process hazard analysis identified the hazard of air entering the gas concentration unit hydrocarbon sections during FCC shutdown depressurization — a known industry hazard was missed entirely.
Finding 02
Shutdown Procedures Lacked Air Ingress Controls
Written FCC shutdown procedures did not include steps to prevent or detect air ingress into the absorber vessels, leaving workers without guidance for this critical transient hazard.
Finding 03
Flammable Mixture Formed in Absorber Vessels
During depressurization, air migrated from the regenerator into the primary and sponge absorbers, mixing with residual hydrocarbons to form flammable vapor/air mixtures that ignited.
Finding 04
Explosion Propelled Fragments 1,200+ Feet
The explosion ejected vessel fragments at extreme velocities — one large fragment landed over 1,200 feet away, starting the asphalt tank fire and creating shrapnel hazards across the surrounding community.
Finding 05
No Safe Work Practices for Transient Operations
The refinery lacked documented safe work practices specifically addressing the unique hazards of FCC unit startup, shutdown, and other non-routine operating modes.
Finding 06
2,500 Residents Evacuated Due to Asphalt Tank Fire
The post-explosion asphalt tank fire burned for several days, forcing evacuation of approximately 2,500 residents — demonstrating that refinery process safety failures carry significant off-site community consequences.
🔍 Root Causes
1
PHA Failed to Identify Transient Operations Hazards
The facility's PHA methodology did not adequately evaluate non-routine, transient FCC operating conditions — leaving the air ingress hazard unrecognized and unmitigated.
2
Procedures Not Developed for Shutdown Hazards
MOC and procedure development processes did not ensure transient hazards were captured in written safeguards — the air ingress hazard was never reflected in procedures even after PHAs were conducted.
3
Industry and Regulatory Gap for Transient Operations
Neither OSHA PSM nor API standards adequately required hazard analysis covering FCC transient operating modes — allowing a known hazard to persist industry-wide.
☑ CSB Recommendations
→ Cenovus Superior Refinery
Conduct a comprehensive HAZOP specifically addressing FCC unit transient operations; develop written procedures explicitly addressing the air ingress hazard and required controls.
→ Cenovus Superior Refinery
Implement a safe work practice program identifying and controlling hazards during all non-routine and transient FCC operations.
→ Cenovus Superior Refinery
Evaluate and install engineering safeguards (check valves, automated isolation) to prevent air migration from the regenerator to GCU hydrocarbon sections during shutdown.
→ Cenovus Energy (Corporate)
Require all Cenovus refineries operating FCC units to conduct transient operations hazard analyses and develop verified shutdown procedures addressing air ingress hazards.
→ OSHA
Amend 29 CFR 1910.119 to explicitly require that PHAs address transient operating conditions including startup, shutdown, and emergency modes.
→ API
Update FCC guidance documents to provide explicit requirements for transient operations hazard analysis and shutdown procedure development for FCC units.
→ Honeywell UOP
As FCC technology licensor, issue updated process safety guidance to all licensees addressing the air ingress hazard during FCC unit shutdown and depressurization.
💡 Lessons Learned
Transient operating modes — startup, shutdown, emergency operations — often involve hazardous conditions not present during normal operation. PHAs must explicitly scope and analyze these modes, not just steady-state.
An FCC unit shutdown procedure that does not address air ingress has a critical gap that can turn a routine turnaround into a catastrophe. Procedures must be built for the specific hazards of each operating mode.
Air ingress into FCC hydrocarbon sections during shutdown is a known industry hazard. Failure to identify it in a PHA is a systemic failure of hazard recognition — not just a procedural gap.
Vessel fragments from process explosions can travel over 1,000 feet. Consequence modeling must consider fragment throw distances and potential community impacts, not just on-site blast radius.
Refinery incidents can force the evacuation of thousands of community members. Emergency response planning must include coordination with local authorities for large-scale off-site consequences.
PHA: Process Hazard AnalysisSOP: Operating ProceduresTRN: TrainingMI: Mechanical Integrity
🔨 Safety Meeting Toolbox Talk
►Does our facility's PHA scope explicitly include startup, shutdown, and emergency operating modes — or only steady-state operations?
►Can you identify a unit or process at our facility where shutdown or startup creates hazardous conditions not present during normal operation?
►When were our shutdown procedures last reviewed to verify they address all hazards specific to those transient operating modes?
►If our process introduced air into a hydrocarbon system during shutdown, would our procedures tell operators what to do?
►How do we ensure lessons learned from incidents at other facilities get incorporated into our own procedures and PHAs?
Immediate Action Items
✓Review your facility's PHA methodology to confirm it explicitly requires analysis of transient operating modes (startup, shutdown, emergency) — update if it does not.
✓Pull the last PHA report for one major unit and check whether startup and shutdown scenarios were analyzed; document any gaps and initiate action items.
✓Identify the three most hazardous transient operating modes at your facility and verify that written procedures specifically address those hazards.
✓Brief your operations team on the Husky Superior FCC air ingress mechanism and ask them to identify analogous risks in your own processes.
✓Confirm your emergency response plan includes coordination protocols with local authorities for large-scale incidents with potential off-site consequences.
🔗 PSM Failures Behind This Incident

This incident traced to breakdowns across 4 PSM elements (PHA · SOP · TRN · MI). Each represents a documented gap that process safety documentation and consulting can close before a similar event occurs at your facility.

Process Hazard Analysis (PHA)
A structured PHA or HAZOP study exists to identify exactly these scenarios before they occur. When PHA is absent, superficial, or overdue for revalidation, hazards operate unseen until they kill someone.
Supporting documents in our library →
Operating Procedures (SOPs)
Operators cannot reliably hold safe operating limits without clear, current, enforced procedures. Deviation from acceptable operating conditions — a root cause here — is a direct consequence of SOP failure.
Supporting documents in our library →
Training & Operator Competency
Workers must understand process hazards — not just the steps on the page. Training records, refresher frequency, and verified competency are all OSHA PSM requirements that gaps here violated.
Supporting documents in our library →
Mechanical Integrity (MI)
Equipment must be designed, inspected, and maintained to operate safely in its intended service. Mechanical integrity failures — degraded equipment, missed inspections, deferred repairs — contributed to loss of containment here.
Supporting documents in our library →
Process Safety Management Consulting & Document Library
📂
PSM Document Library
32 ready-to-deploy PSM documents covering all 14 OSHA elements — procedures, checklists, and audit templates built for facilities operating under 29 CFR 1910.119.
Browse the Library →
📊
Free PSM Health Score
Find out where your PSM program stands across all 14 OSHA elements. Our free health score surfaces your biggest gaps in under 10 minutes — no account required.
Check Your Score →
📞
Consulting Services
PHA facilitation, PSM program builds, compliance audits, and OSHA inspection support. Transparent flat-fee pricing — no retainer required to get started.
View Pricing →
📋 Explore the full incident library: All 132 CSB Case Studies →