Tesoro Anacortes Refinery Naphtha Hydrotreater Explosion

📋 Incident Summary

On April 2, 2010, an explosion and fire at the Tesoro Anacortes refinery in Anacortes, Washington, killed seven workers — the deadliest refinery accident in the United States in decades. The blast destroyed the naphtha hydrotreater unit and the facility's emergency response trailer, preventing an effective initial response.

The CSB investigation, one of its most technically complex ever, determined that a carbon steel heat exchanger failed due to High Temperature Hydrogen Attack (HTHA) — a phenomenon in which hydrogen at high temperatures and pressures diffuses into steel, reacting with carbon to form methane bubbles that crack and weaken the metal from the inside. HTHA damage is invisible to conventional inspection and progresses without warning until sudden, catastrophic failure.

Tesoro had been operating the heat exchanger outside the safe operating limits defined by API RP 941 Nelson Curves — the industry standard for HTHA resistance — and had not conducted an adequate HTHA assessment of its equipment. The seven workers who died were in or near the unit during a startup when the exchanger failed.

🔎 Key Findings

Finding 01

High Temperature Hydrogen Attack (HTHA) Caused Heat Exchanger Failure

The carbon steel heat exchanger failed due to HTHA — a damage mechanism in which hydrogen at high temperature and pressure diffuses into steel and reacts with carbon to form methane, creating internal cracks invisible to conventional inspection. The failure was sudden and catastrophic.

Finding 02

Equipment Operated Outside Safe HTHA Limits — API RP 941 Nelson Curves Not Applied

Tesoro operated the heat exchanger outside the safe temperature and hydrogen partial pressure limits defined by API RP 941 Nelson Curves, the industry standard for establishing HTHA-resistant materials. The company had not conducted an adequate HTHA assessment of the unit.

Finding 03

HTHA Damage Is Invisible to Conventional Inspection

HTHA damage progresses inside the steel without surface indication detectable by standard inspection methods. Conventional inspection — including visual and standard ultrasonic testing — cannot detect HTHA damage until catastrophic failure is imminent or has occurred.

Finding 04

Seven Workers Killed — Emergency Response Trailer Destroyed

All seven fatalities were workers in or near the naphtha hydrotreater during startup. The explosion also destroyed the facility's emergency response trailer, severely hampering the initial emergency response to the disaster.

Finding 05

CSB Issued 27 Recommendations — Most Extensive in CSB History at the Time

The Tesoro investigation produced 27 recommendations — among the most extensive in CSB history — addressing HTHA assessment, inspection program adequacy, process safety culture, and the role of corporate management systems in refinery safety.

🔍 Root Causes

HTHA Damage Progressed Undetected — No Adequate HTHA Assessment Conducted

Tesoro had not conducted an adequate HTHA assessment for the heat exchanger using API RP 941 Nelson Curves. The exchanger had been operating outside safe limits for an extended period, accumulating HTHA damage that was invisible to conventional inspection.

Carbon Steel Heat Exchanger Operated Outside HTHA-Safe Process Conditions

The operating temperature and hydrogen partial pressure of the heat exchanger exceeded the limits for carbon steel established by API RP 941, placing the equipment in the HTHA damage zone during normal operations.

Startup Placed Workers in Blast Zone of Failed Exchanger

Seven workers were in or immediately adjacent to the naphtha hydrotreater unit during startup operations when the HTHA-damaged heat exchanger failed catastrophically, with no opportunity for evacuation.

☑ CSB Recommendations

→ Tesoro / Refinery Operators

Conduct a comprehensive HTHA assessment for all equipment in hydrogen service; apply API RP 941 Nelson Curves to establish safe operating envelopes; replace carbon steel equipment operating outside safe HTHA limits with HTHA-resistant alloys.

→ API

Update API RP 941 to reflect current knowledge of HTHA damage at conditions near the Nelson Curve boundary; provide explicit guidance on inspection methods capable of detecting HTHA damage, including advanced ultrasonic testing techniques.

→ OSHA / Refining Industry

Require refineries to conduct HTHA assessments as part of PSM mechanical integrity programs; ensure that HTHA assessment and advanced inspection capabilities are standard refinery practice, not optional enhancements.

→ Refining Industry — Process Safety Culture

Address the systemic process safety culture and management system factors identified in the Tesoro investigation; ensure that corporate management systems actively support and verify the adequacy of site-level process safety programs.

💡 Lessons Learned

High Temperature Hydrogen Attack (HTHA) is a damage mechanism that kills without warning. Unlike corrosion or fatigue, HTHA damage is largely invisible to conventional inspection until the moment of catastrophic failure. Every refinery with equipment in high-temperature hydrogen service must conduct a formal HTHA assessment using API RP 941 Nelson Curves and must use advanced inspection methods capable of detecting HTHA damage — not assume that absence of visible damage means absence of damage.

Process safety information must include the damage mechanisms applicable to each piece of equipment — not just the design specifications and materials of construction. HTHA is a recognized damage mechanism in hydrogen service. If HTHA assessment was not conducted when PSI was established, that is a gap in the PSI program that must be corrected. PSI must be living documents that reflect current understanding of the damage mechanisms the equipment is exposed to.

Operating equipment outside the safe process limits established for its material and damage mechanism is one of the most direct paths to catastrophic failure. The safe operating limits established by API RP 941 Nelson Curves for HTHA resistance are engineering boundaries — operating above them is not a risk to be managed operationally, it is a design problem that requires a material upgrade or a process change.

Seven people died because they were near a heat exchanger during startup when HTHA-weakened steel suddenly failed. Startup and shutdown operations consistently appear in process safety fatality investigations as the time when workers are most exposed to catastrophic process failures. Worker positioning during high-hazard startup operations must be evaluated and minimized.

PSI: Process Safety InformationPHA: Process Hazard AnalysisMI: Mechanical IntegrityMOC: Management of Change

🔨 Safety Meeting Toolbox Talk

►Does your facility have any equipment in high-temperature hydrogen service? If so, has an HTHA assessment been conducted for each piece of equipment using API RP 941 Nelson Curves? When was the assessment last reviewed?

►Are your inspection programs for equipment in hydrogen service capable of detecting HTHA damage? Do they include advanced ultrasonic testing (UT) methods, or are they limited to conventional UT and visual inspection?

►Does your PSI for hydrogen service equipment document HTHA as an applicable damage mechanism? Are operating limits specifically defined to keep equipment within HTHA-safe process conditions?

►What is the worker positioning policy during startup of high-hazard process units? Are non-essential workers excluded from the unit area during startup, and are essential workers positioned to minimize exposure to potential catastrophic failure?

Immediate Action Items

✓Identify all equipment in high-temperature hydrogen service at your facility and verify that an HTHA assessment has been conducted using API RP 941 Nelson Curves; schedule assessments for any equipment without a current HTHA evaluation.

✓Review inspection programs for hydrogen service equipment; confirm that advanced UT methods capable of detecting HTHA damage are included, not just conventional UT and visual inspection.

✓Update PSI for all hydrogen service equipment to document HTHA as an applicable damage mechanism and to specify safe operating temperature and hydrogen partial pressure limits.

✓Establish or review worker positioning requirements for startup of high-hazard process units; document which personnel must be present during startup and ensure all non-essential personnel are excluded from the immediate unit area.

🔗 PSM Failures Behind This Incident

This incident traced to breakdowns across 4 PSM elements (PSI · PHA · MI · MOC). Each represents a documented gap that process safety documentation and consulting can close before a similar event occurs at your facility.

Process Safety Information (PSI)

Accurate, complete Process Safety Information is the foundation every other PSM element depends on. When PSI is missing or wrong — chemistry data, equipment specs, P&IDs — the entire hazard analysis is built on a flawed base.

Supporting documents in our library →

Process Hazard Analysis (PHA)

A structured PHA or HAZOP study exists to identify exactly these scenarios before they occur. When PHA is absent, superficial, or overdue for revalidation, hazards operate unseen until they kill someone.

Supporting documents in our library →

Mechanical Integrity (MI)

Equipment must be designed, inspected, and maintained to operate safely in its intended service. Mechanical integrity failures — degraded equipment, missed inspections, deferred repairs — contributed to loss of containment here.

Supporting documents in our library →

Management of Change (MOC)

Changes to equipment, chemistry, operating limits, or procedures that bypass formal review create new hazard pathways your PHA never evaluated. MOC failures open the door to incidents like this one.

Supporting documents in our library →

SafeGuard PSM

Process Safety Management Consulting & Document Library

📂

PSM Document Library

32 ready-to-deploy PSM documents covering all 14 OSHA elements — procedures, checklists, and audit templates built for facilities operating under 29 CFR 1910.119.

Browse the Library →

📊

Free PSM Health Score

Find out where your PSM program stands across all 14 OSHA elements. Our free health score surfaces your biggest gaps in under 10 minutes — no account required.

Check Your Score →

📞

Consulting Services

PHA facilitation, PSM program builds, compliance audits, and OSHA inspection support. Transparent flat-fee pricing — no retainer required to get started.

View Pricing →

📋 Explore the full incident library: All 132 CSB Case Studies →