Husky Superior Refinery Report 2022-12-23

FCC Unit Explosion and Asphalt Fire
U.S. Chemical Safety and at Husky Superior Refinery

Hazard Investigation Board Superior, WI | Incident Date: April 26, 2018 | No. 2018-02-I-WI
Investigation Report SAFETY ISSUES:

Published: December 23, 2022 • Transient Operation Safeguards
• Process Knowledge
• Process Safety Management Systems
• Industry Knowledge and Guidance
• Brittle Fracture During Extreme Events
• Emergency Preparedness
Investigation Report
U.S. Chemical Safety and Hazard Investigation Board
The mission of the U.S. Chemical Safety and Hazard Investigation Board (CSB) is to
drive chemical safety change through independent investigations
to protect people and the environment.
The CSB is an independent federal agency charged with investigating, determining, and reporting to the
public in writing the facts, conditions, and circumstances and the cause or probable cause of any
accidental chemical release resulting in a fatality, serious injury, or substantial property damages.
The CSB issues safety recommendations based on data and analysis from investigations and safety
studies. The CSB advocates for these changes to prevent the likelihood or minimize the consequences
of accidental chemical releases.
More information about the CSB and CSB products can be accessed at www.csb.gov or obtained by
contacting:

1750 Pennsylvania Ave. NW, Suite 910
Washington, DC 20006
(202) 261-7600
The CSB was created by the Clean Air Act Amendments of 1990, and the CSB was first funded and
commenced operations in 1998. The CSB is not an enforcement or regulatory body. No part of the
conclusions, findings, or recommendations of the Board relating to any accidental release or the
investigation thereof shall be admitted as evidence or used in any action or suit for damages arising out
of any matter mentioned in such report. 42 U.S.C. § 7412(r)(6)(G).
1
CONTENTS
FIGURES ............................................................................................................................................... 5
ABBREVIATIONS ................................................................................................................................... 8
EXECUTIVE SUMMARY ....................................................................................................................... 11
1 BACKGROUND ............................................................................................................................ 22
1.1 Husky Energy ............................................................................................................................ 22
1.2 Husky Superior Refinery ........................................................................................................... 22
1.3 Surrounding Area ..................................................................................................................... 23
1.4 Fluid Catalytic Cracking (FCC) Unit ........................................................................................... 26
1.4.1 Reactor and Regenerator .................................................................................................. 27
1.4.2 Catalyst Slide Valves .......................................................................................................... 29
1.4.3 Main Column and Gas Concentration Unit ........................................................................ 32
1.4.4 FCC Units in the United States ........................................................................................... 33
1.5 FCC Unit Shutdown Steps ......................................................................................................... 34
1.5.1 Typical UOP FCC Unit Shutdown Sequence ....................................................................... 35
1.5.2 Changes to 2018 Shutdown Procedure ............................................................................. 36
2 INCIDENT DESCRIPTION .............................................................................................................. 38
2.1 FCC Unit Shutdown................................................................................................................... 38
2.1.1 Start of Shutdown ............................................................................................................. 38
2.1.2 Catalyst Levels ................................................................................................................... 39
2.1.3 System Pressures and Flows .............................................................................................. 40
2.1.4 Process Gas System Fluctuations ...................................................................................... 43
2.1.5 Main Air Blower Shutdown and System Depressure.......................................................... 44
2.1.6 Concurrent Work in the Plant ............................................................................................ 44
2.2 Explosion in the Gas Concentration Unit .................................................................................. 45
2.2.1 Primary and Sponge Absorber Explosion ........................................................................... 45
2.2.2 Asphalt Storage Tank Damage .......................................................................................... 46
2.2.3 Refinery’s Initial Emergency Response .............................................................................. 48
2.3 Asphalt Spill and Fire ................................................................................................................ 49
2.3.1 Asphalt Spill Response ....................................................................................................... 49
2.3.2 Asphalt Fire ....................................................................................................................... 50
2.3.3 Community Evacuations .................................................................................................... 52
2.4 Incident Consequences ............................................................................................................ 54
2
3 TECHNICAL ANALYSIS .................................................................................................................. 56

3.1 The Explosion ........................................................................................................................... 56
3.2 Transient Operation Safeguards in FCC Units........................................................................... 60
4 SAFETY ISSUES ............................................................................................................................ 64
4.1 Transient Operation Safeguards ............................................................................................... 65
4.1.1 Reactor Steam Barrier ....................................................................................................... 65
4.1.2 Main Column Gas Purge .................................................................................................... 73
4.1.3 Catalyst Slide Valves .......................................................................................................... 83
4.1.4 Hierarchy of Controls for FCC Transient Operation ........................................................... 98
4.2 Process Knowledge ................................................................................................................. 102
4.2.1 Factual Information ......................................................................................................... 102
4.2.2 Analysis ........................................................................................................................... 105
4.3 Process Safety Management Systems .................................................................................... 109
4.3.1 Process Safety Information.............................................................................................. 109
4.3.2 Operating Procedures ..................................................................................................... 111
4.3.3 Process Hazard Analysis .................................................................................................. 118
4.3.4 Operator Training ............................................................................................................ 126
4.4 Industry Knowledge and Guidance ......................................................................................... 135
4.4.1 FCC Knowledge and Competency Management in Industry ............................................ 135
4.4.2 FCC Standards ................................................................................................................. 141
4.4.3 Technical Publications ..................................................................................................... 142
4.5 Brittle Fracture During Extreme Events .................................................................................. 144
4.5.1 Factual Information......................................................................................................... 144
4.5.2 Analysis ........................................................................................................................... 149
4.6 Emergency Preparedness ....................................................................................................... 154
4.6.1 Factual Information ......................................................................................................... 154
4.6.2 Analysis ........................................................................................................................... 156
5 CONCLUSIONS .......................................................................................................................... 161
5.1 Findings .................................................................................................................................. 161
5.2 Cause ...................................................................................................................................... 167
6 RECOMMENDATIONS................................................................................................................ 168
6.1 Cenovus Superior Refinery ..................................................................................................... 168
6.2 Cenovus Energy ...................................................................................................................... 170
3
6.3 U.S. Occupational Safety and Health Administration (OSHA) ................................................. 171
6.4 U.S. Environmental Protection Agency (EPA) ......................................................................... 171
6.5 American Petroleum Institute (API)........................................................................................ 171
6.6 Honeywell UOP ....................................................................................................................... 172
7 KEY LESSONS FOR THE INDUSTRY .............................................................................................. 173
8 REFERENCES ............................................................................................................................. 175
APPENDIX A—CAUSAL ANALYSIS (ACCIMAP) .................................................................................... 184
APPENDIX B—TIMELINE ................................................................................................................... 187
APPENDIX C—DEMOGRAPHIC INFORMATION FOR SURROUNDING AREA ......................................... 191
APPENDIX D—METALLURGICAL ANALYSIS ........................................................................................ 194
4
Figures
Figure 1. Air flow through the FCC unit that caused the explosion..................................................................... 16
Figure 2. Aerial image of Superior, Wisconsin. ................................................................................................... 24
Figure 3. Census blocks in an approximately three-mile distance from Husky Superior Refinery. .................... 25
Figure 4. Left: FCC catalyst. Right: A bubbling fluidized bed. ........................................................................... 26
Figure 5. Simplified process flow diagram of Husky Superior Refinery’s FCC unit. ......................................... 27
Figure 6. Husky Superior Refinery’s stacked FCC reactor/regenerator configuration showing flow paths during
normal operation. .................................................................................................................................................. 28
Figure 7. Catalyst slide valves. Left: Side view. Right: View from the downstream side looking up. ................ 30
Figure 8. Husky Superior Refinery’s FCC reactor differential pressure instruments (person for scale). ............ 31
Figure 9. Simplified block flow diagram of the GasCon. .................................................................................... 33
Figure 10. Catalytic cracking units and their capacities in the United States. ..................................................... 34
Figure 11. UOP-recommended pressure relationships and flow directions during an FCC unit shutdown. ........ 36
Figure 12. Notes added to the FCC unit shutdown procedure for the 2018 turnaround. ..................................... 37
Figure 13. Simplified main column and sponge absorber pressure control scheme used during the shutdown. . 40
Figure 14. Pressure profile in the first few hours of the shutdown. ..................................................................... 41
Figure 15. Pressure trends from 5:00 a.m. until the explosion. ............................................................................ 43
Figure 16. Surveillance camera image of the explosion....................................................................................... 45
Figure 17. Locations of equipment involved in the incident. ............................................................................... 47
Figure 18. Asphalt tank puncture and leak. .......................................................................................................... 48
Figure 19. Asphalt spill shortly before it ignited.................................................................................................. 49
Figure 20. Tank fire during and after extinguishment. ......................................................................................... 51
Figure 21. Smoke from the fire at Husky Superior Refinery. .............................................................................. 52
Figure 22. Evacuation Zone on April 26, 2018. ................................................................................................... 53
5
Figure 23. Air flow paths from the regenerator to the reactor on the day of the incident. ................................... 57
Figure 24. Comparison of UOP-recommended and actual flow directions during the shutdown. ....................... 58
Figure 25. FCC unit steam barrier and instrument configuration in typical industry practice. ............................ 66
Figure 26. Excerpt from the shutdown procedure used on the day of the incident. ............................................. 68
Figure 27. Husky Superior Refinery’s pressure instruments on the reactor, regenerator, and main column
systems. ................................................................................................................................................................. 69
Figure 28. Comparison of flow directions through the reactor and regenerator without the steam barrier (left)
and with the steam barrier (right). ......................................................................................................................... 70
Figure 29. Missing steam barrier instrumentation at Husky Superior Refinery. .................................................. 72
Figure 30. Continual gas purge at the main column during a typical FCC shutdown per UOP guidelines. ........ 75
Figure 31. Typical main column pressure control scheme with the wet gas compressors shut down. ................ 76
Figure 32. Process gas routing to the main column at Husky Superior Refinery’s FCC unit. ............................. 77
Figure 33. Spent catalyst slide valve in-situ. ........................................................................................................ 85
Figure 34. Spent catalyst slide valve view of the upstream side. ......................................................................... 86
Figure 35. Spent catalyst slide valve as found in the 2013 turnaround. ............................................................... 87
Figure 36. Sketch of a standpipe with a closed slide valve. ................................................................................. 92
Figure 37. Potential undetectable catalyst levels within the reactor and regenerator during a shutdown. ........... 94
Figure 38. Hierarchy of controls. ......................................................................................................................... 99
Figure 39. Generic risk matrix. .......................................................................................................................... 119
Figure 40. Excerpt from the 1995 PHA. ............................................................................................................ 121
Figure 41. Effects of practice on skills. .............................................................................................................. 131
Figure 42. Process flows that caused FCC explosions in Torrance and Superior Refineries. ............................ 136
Figure 43. Hierarchy of standards terminology.................................................................................................. 141
Figure 44. Primary absorber, sponge absorber, and stripper before and after the incident. ............................... 145
Figure 45. Primary and sponge absorbers after the incident. ............................................................................. 146
6
Figure 46. Large primary and sponge absorber fragments found throughout the refinery................................. 147
Figure 47. Examples of brittle fracture (left) and ductile fracture (right). ......................................................... 147
Figure 48. An example ductile-to-brittle fracture transition curve..................................................................... 150
Figure 49. ASME impact test exemption curves. ............................................................................................... 151
Figure 50. Example of a siting and layout approach. ......................................................................................... 157
Figure 51. Census blocks in an approximately three-mile distance from Husky Superior Refinery ................. 191
7
Abbreviations
°F degrees Fahrenheit
AFPM American Fuel and Petrochemical Manufacturers
ANSI American National Standards Institute
API American Petroleum Institute
ASME American Society of Mechanical Engineers
ASTM American Society of Testing and Materials
CCPS Center for Chemical Process Safety
COIMS Cenovus Operations Integrity Management System
COPS Control Override Protection System
CSB U.S. Chemical Safety and Hazard Investigation Board
DCS distributed control system
DTS Downstream Technical Service
EPA Environmental Protection Agency
ESP electrostatic precipitator
FAA Federal Aviation Administration
FCC fluid catalytic cracking
FCCU fluid catalytic cracking unit
FEMA Federal Emergency Management Agency
FFS fitness-for-service
GasCon gas concentration unit
HAZOP Hazard and Operability Study
HF hydrofluoric acid
8
HMSC Husky Marketing and Supply Company
HOIMS Husky Operation and Integrity Management System
IPL independent protection layer
ISA International Society of Automation
LLC limited liability company
LOPA Layer of Protection Analysis
LPG liquefied petroleum gas
MOC management of change
NEP National Emphasis Program
NFPA National Fire Protection Association
NIMS National Incident Management System
NIOSH National Institute for Occupational Safety and Health
O&SHA Operating and Support Hazard Analysis
OSHA Occupational Safety and Health Administration
PES Philadelphia Energy Solutions
PHA process hazard analysis
PSI process safety information
psi pounds per square inch
psig pounds per square inch gauge
PSM Process Safety Management
RAGAGEP recognized and generally accepted good engineering practices
RMP Risk Management Plan
RP recommended practice
SCSV spent catalyst slide valve
9
SDS safety data sheet
SIL safety integrity level
SRC Superior Refining Company
UOP Universal Oil Products
WDNR Wisconsin Department of Natural Resources
WGC wet gas compressor
WHMIS Workplace Hazardous Materials Information System
10
Executive Summary
On April 26, 2018, at approximately 9:58 a.m., an explosion and subsequent fire occurred at Husky Energy’s
Superior Refining Company LLC refinery in Superior, Wisconsin (“Husky Superior Refinery”).a The incident
occurred during a planned maintenance event, called a turnaround, with approximately 800-900 people on site,
including employees and contractors. As a result of the explosion and fire, 36 refinery and contract workers
were injured and sought medical attention, including 11 people who suffered Occupational Safety and Health
Administration (“OSHA”) recordable injuries. In addition, the chemical disaster caused approximately $550
million in property damage. Husky Superior Refinery reported that it released 39,000 pounds of a flammable
hydrocarbon vapor mixture during the event.b
The explosion occurred while the refinery was shutting down its fluid catalytic cracking (“FCC”) unit for the
turnaround.c Two FCC unit vessels, the primary absorber and the sponge absorber, exploded at approximately
9:58 a.m., shaking buildings up to a mile away and propelling over 100 metal fragments, some several feet long,
up to 1,200 feet from their original location into the surrounding operating areas. Explosion debris punctured a
nearby asphalt tank at the refinery, spilling hot asphalt that flowed outside of the tank’s containment area.
Approximately 17,000 barrels of hot asphalt spread through the refinery and ignited at approximately 12:00
p.m., causing fires to erupt at multiple operating areas of the refinery. The City of Superior evacuated 2,507
residents within 2 miles north, 3 miles to the east and west, and 10 miles south of the refinery. To protect its
residents, the City of Duluth, Minnesota, issued a shelter-in-place advisory at 8:00 p.m. The fires were
extinguished before midnight. The shelter-in-place and evacuation orders were lifted at 6:00 a.m. the next day.
In addition to concerns about smoke from the fires at the refinery, the City of Superior evacuation was based on
the potential risk of a release of highly toxic hydrofluoric acid (“HF”), which was stored at Husky Superior
Refinery and used in the refinery’s HF alkylation unit.d Although the HF storage tank was not damaged by
debris from the explosion and no release of HF occurred, the asphalt tank punctured by the explosion debris was
located farther away from the point of the explosion than the refinery’s HF storage tank. Debris from the
explosion could have punctured the HF storage tank, given its closer proximity to the point of explosion.e
The Superior Fire Department, the City of Superior, the U.S. Coast Guard, the U.S. Environmental Protection
Agency (“EPA”), and the Wisconsin Department of Natural Resources (“WDNR”) responded to the incident.
Additionally, OSHA and the U.S. Chemical Safety and Hazard Investigation Board (“CSB”) investigated the
accident.
a
The incident occurred on the day shift. The refinery worked in two 12-hour shifts, a day shift and a night shift.
b
Husky Superior Refinery reported that the flammable mixture contained methane, ethane, ethylene, propane, propylene, butane,
isobutane, 1-butene, 2-butene-cis, 2-butene-trans, pentane, and isopentane.
c
The FCC process described in this investigation was covered by OSHA’s Process Safety Management (“PSM”) Standard and the EPA’s
Risk Management Plan (“RMP”) Rule.
d
HF is a highly toxic chemical that can fatally damage major internal organs if contacted through breathing [167].
e
The CSB extensively addressed issues associated with facilities with HF alkylation units, including “near-miss” incidents, in the CSB’s
report on the 2019 explosion and fires at the Philadelphia Energy Solutions refinery [151].
11
Safety Issues
The CSB’s investigation identified the following safety issues:
1. Transient Operation Safeguards
At the time of the incident, Husky Superior Refinery was shutting down the FCC unit, a transient operation
mode. Transient operations are a grouping of operating modes, such as shutdowns, startups, standby, and
emergencies, where a process is changing over and is not in its normal operation mode. Transient operations can
pose unique hazards that may not occur during normal process operations.
During an FCC unit shutdown, it is critical to separate air from hydrocarbons to prevent an explosive mixture,
because unlike most refinery operations, an FCC unit processes both air and flammable hydrocarbons inside
interconnected process equipment, increasing the likelihood of an explosion. This separation is typically
achieved using FCC technology-specific safeguards. Most of these safeguards were either not implemented or
not effective at Husky Superior Refinery during its April 26, 2018, FCC unit shutdown. This report discusses the
following safeguards:
• Reactor steam barrier: Husky Superior Refinery did not establish or maintain a reactor steam barrier
between air and hydrocarbons during the shutdown. By controlling the steam flow into the reactor
during a shutdown, the FCC reactor can be maintained at a higher pressure than both the air side and the
hydrocarbon side of the process and keep the air and hydrocarbons separated. In doing so, the reactor
can serve as a “steam barrier” to help prevent the dangerous mixing of air with flammable
hydrocarbons.
• Main column gas purge: Husky Superior Refinery did not properly purge the main column overhead
receiver during the shutdown to remove oxygen from the system. By adding a continual supply of non-
condensable gas to the main column, this safeguard helps sweep air out of the system to prevent the
potential hazard of accumulating flammable concentrations of oxygen within this hydrocarbon-filled
equipment.
• Catalyst slide valves: Husky Superior Refinery relied entirely on catalyst slide valves to keep the air and
hydrocarbon systems separated during the shutdown. FCC catalyst slide valves are known in most of the
refining industry as insufficient safeguards to stop all flow between the air and hydrocarbon systems,
because they are not designed to act as positive isolation devices. In addition, despite their ample
physical size and the robust thickness of their metal components, one of the slide valves between the
regenerator and the reactor at Husky Superior Refinery had worn from five years of operation. As a
result, even though refinery operators properly closed this valve, the valve had eroded and provided an
open path that allowed a large flow of air to enter the reactor and migrate into the hydrocarbon-filled
equipment. The refinery’s process hazard assessments and layer of protection analysis study did not
identify that the slide valves alone were not adequate safeguards to prevent an incident of this
magnitude.
Had Husky Superior Refinery implemented the safeguards above, the incident could have been prevented. All
the safeguards discussed would have required adequately trained operators following a technically accurate
12
written operating procedure to shut down the FCC unit (discussed further in the following safety issues). In
general, most safeguards necessary for safe transient FCC unit operations are procedure-based and rely heavily
on operator actions, because not every action can be automated during an FCC shutdown. These procedural
safeguards offer weaker protection compared with engineered safeguards. In such cases, hands-on operator
training, such as drills and simulators, is crucial for hazardous operations that are controlled primarily by
procedural safeguards, such as transient FCC operation. In addition, the petroleum refining industry should
continue to design and implement safeguards that are higher on the “hierarchy of controls”a to improve process
safety in FCC units during transient operation.
2. Process Knowledge
Husky Superior Refinery’s FCC technology-specific process knowledge was not sufficient to safely shut down
the FCC unit for a turnaround. The refinery’s employees did not adequately understand or know how to
effectively control the FCC unit’s transient operation hazards. As a result, Husky Superior Refinery was not
aware that its FCC unit shutdown procedure was not aligned with the technology licensor’s guidance that had
been in place and provided to the refinery since the unit was designed in 1960. For example, contrary to the
technology licensor’s guidance which required pressure in the reactor to be higher than in the regenerator, the
refinery’s shutdown procedure instructed operators to do the opposite and maintain the regenerator at a higher
pressure than the reactor, which drove air into process equipment that contained flammable material and created
the dangerous conditions that enabled the explosion to occur.
For much of Husky Superior Refinery’s history, its FCC expertise was mostly in-house, and with minimal
engagement with other refineries. While key individuals attended the licensor’s FCC training classes, this
individual training did not establish sufficient knowledge or competency within Husky Superior Refinery to
prevent the April 2018 incident. Husky Superior Refinery’s management encouraged individuals to attend
industry events, but such participation was not mandatory. In addition, Husky Superior Refinery’s use of
external technical experts was limited to assessing the FCC unit’s performance during normal operation.
Although Husky Superior Refinery required its operations department to review and recertify its operating
procedures annually, Husky Superior Refinery did not perform a technical review of its FCC unit operating
procedures with its process engineers, the licensor, or outside consultants for at least 25 years prior to the
incident, and possibly since the unit was commissioned around 1960. Had a multidisciplinary team reviewed the
operating procedures, with guidance from a subject matter expert, the technical errors and omissions could have
been identified and resolved to match the process technology information provided by the licensor, and the
explosion could have been prevented.
3. Process Safety Management Systems
OSHA’s Process Safety Management (“PSM”) Standard and the EPA’s Risk Management Plan (“RMP”) Rule
require facilities like Husky Superior Refinery to implement process safety management systems to identify,
a
The National Institute for Occupational Safety and Health (“NIOSH”) defines the hierarchy of controls as “a way of determining which
actions will best control exposures [to hazards in the workplace].” According to NIOSH: “The hierarchy of controls has five levels of
actions to reduce or remove hazards. The preferred order of action based on general effectiveness is: 1. Elimination; 2. Substitution; 3.
Engineering controls; 4. Administrative controls; and 5. Personal protective equipment (PPE). Using this hierarchy can lower worker
exposures and reduce risk of illness or injury” [79]. Procedural safeguards fall under the category of administrative controls [69, p. 10].
13
evaluate, and control their process hazards. This report discusses the following elements of Husky Superior
Refinery’s process safety management systems that contributed to the incident:
• Process safety information: Husky Superior Refinery did not maintain some of the FCC licensor’s
critical safety technology as part of its process safety information (“PSI”) package, which provides the
fundamental basis for identifying and evaluating process hazards. Essential information describing how
to shut down an FCC unit safely was not incorporated into the refinery’s operating procedures, process
hazard analysis (“PHA”), and operator training material.
• Operating procedures: Husky Superior Refinery’s FCC unit shutdown procedure did not provide clear
instructions for safely conducting activities consistent with the PSI. In addition, Husky Superior
Refinery did not identify that recent changes to the operating procedure that were designed to minimize
venting to the atmosphere during this shutdown, along with the absence of steps to purge oxygen out of
the system, made it even more likely that oxygen would accumulate in the FCC unit. As a result, during
the April 2018 FCC unit shutdown, use of the FCC unit’s most recent shutdown procedure created
dangerous conditions that led to the explosion.
• Process hazard analysis: Husky Superior Refinery’s FCC unit PHA teams did not specifically evaluate
the hazards of following the refinery’s most recent shutdown procedure or otherwise use a methodology
that enhanced identification of transient operations hazards. As a result, the refinery did not identify,
analyze, and control transient operation hazards that led to the explosion.
• Operator training: Husky Superior Refinery’s operator training program did not prepare the FCC
operators to shut down the unit safely or respond to abnormal situations properly. The lack of known
FCC-related safety concepts in the refinery’s written training manual, combined with the lack of trainer
qualifications and hands-on practice opportunities, led to poor operator training and contributed to the
incident.
4. Industry Knowledge and Guidance
Husky Superior Refinery incident occurred less than one year after the CSB released its investigation of another
FCC unit transient operation explosion in California. In 2015, an explosion occurred in the ExxonMobil
Torrance, California refinery while workers were attempting to isolate equipment for unscheduled maintenance
while the FCC unit was in an idled mode of operation. Preparations for the maintenance activity caused a
pressure deviation that disturbed the reactor steam barrier, allowing flammable hydrocarbon to backflow from
the main column through the regenerator, and into the electrostatic precipitator (“ESP”), a pollution control
device, where it ignited and exploded.
After the CSB released its ExxonMobil Torrance Refinery investigation report and a safety video in 2017, the
American Fuel and Petrochemical Manufacturers’ (“AFPM”) association helped disseminate the lessons from
the ExxonMobil Torrance Refinery incident through its industry conference later that year. Despite these
educational efforts, Husky Superior Refinery employees were not aware of or did not learn lessons from the
ExxonMobil Torrance Refinery incident in a way that could have helped them to prevent the April 2018
incident. The workforce appeared to understand that flammable hydrocarbons had flowed from the ExxonMobil
Torrance Refinery’s main column into the regenerator and exploded in the electrostatic precipitator, but they did
14
not recognize that the reverse—air flowing into hydrocarbon systems downstream of the main column—was
also possible. In addition, employees responsible for Husky Superior Refinery FCC unit did not discuss or
appear to understand that the failure of the reactor steam barrier was a cause of the ExxonMobil Torrance
Refinery explosion. A recent industry survey covering FCC operating practices suggests that similar process
knowledge gaps may exist at other refineries.
FCC technology is developed and licensed by more than six companies, each with its own designs and
configurations. Furthermore, portions of many older FCC units in the United States have been revamped by
multiple technology licensors. Currently, there is no industry publication that establishes common basic process
safety expectations for all FCC units. In addition, FCC process safety messages from publicly available industry
publications are inconsistent. Most refinery technology textbooks do not adequately cover FCC unit process
hazards or critical safety learnings from past FCC unit incidents. To prevent future chemical disasters, the
refining industry must address the FCC unit process safety knowledge gaps that may still exist at other facilities.
5. Brittle Fracture During Extreme Events
The primary absorber and sponge absorber vessels in the Husky Superior Refinery FCC unit failed by brittle
fracture (shattering like breaking glass), which sent more than a hundred pieces of metal debris throughout the
refinery, striking workers and operating equipment. These vessels were constructed of the American Society of
Testing and Methods (“ASTM”) A-212 and A-201 grade steels, which are no longer recommended for new
equipment. Had the vessels been constructed of a newer grade of steel with better toughness properties, they
should have ruptured by ductile fracture (tearing open like a zipper or fish mouth) with a reduced impact on the
surrounding area.
6. Emergency Preparedness
The explosion debris struck an upper portion of an asphalt tank, which caused asphalt to spill outside the
containment area and into the refinery. The likely ignition source that ignited the asphalt was pyrophoric
material inside the storage tank that smoldered when exposed to the air that entered through the punctured tank
wall. Husky Superior Refinery could not prevent the hot asphalt from igniting due to the unexpected extent of
the spill, competing priorities of responding to the FCC unit explosion, and uncertainty by refinery employees
about how to properly mitigate a large area of spilled hot, ignitable asphalt.
Cause
The CSB determined that Husky Superior Refinery explosion, which occurred during the shutdown of the FCC
unit, was caused by inadvertently directing air inside the regenerator through the reactor, and the main column,
and then into the gas concentration unit. As the air continued flowing into the gas concentration unit, oxygen
accumulated and formed a flammable mixture inside the primary and sponge absorbers. The oxygen also reacted
with existing pyrophoric material inside this equipment, creating the ignition source for the explosion (Figure
1).
The failure to control the air flow during the shutdown was the result of Husky Superior Refinery’s deficiencies
in FCC unit process knowledge about critical FCC unit transient operation safeguards that could have prevented
the inadvertent mixing of air and hydrocarbons during a shutdown. These safeguards include establishing a
15
reactor steam barrier to separate the air from the rest of the hydrocarbon-filled equipment and purging the main
column to the flare system with a non-condensable gas to prevent oxygen accumulation. These vital FCC unit
safeguards are generally known and broadly applied within the refining industry. Not applying these safeguards
allowed oxygen to enter and accumulate in process equipment containing flammable material, which ignited and
exploded. Husky Superior Refinery also failed to ensure the integrity of its FCC unit slide valves for use during
transient operation. A severely eroded slide valve contributed to the incident by allowing more air to pass from
the regenerator into the reactor.
Husky Superior Refinery did not effectively implement process safety management systems, which also
contributed to the incident. These ineffective management systems included Husky Superior Refinery’s process
safety information which did not include the FCC technology licensor’s operating manual, process hazard
analyses that did not effectively identify or control hazards inherent in FCC unit transient operation, operating
procedures that omitted key steps, lacked clear instructions, and were not technically evaluated, and an operator
training program that did not effectively prepare the operators to shut down the FCC unit safely.
The process vessels that exploded were constructed from a grade of steel that was susceptible to brittle fracture,
contributing to the severity of the incident. The force of the explosion shattered these steel vessels and sent large
metal fragments throughout the refinery, one of which struck and punctured the nearby asphalt tank. Had the
process vessels been made of a more ductile steel, the explosion would more likely have torn open (fish
mouthed) the vessels with fewer, if any, dangerous metal projectiles. Also contributing to the severity of the
incident was the fire that resulted from the refinery’s inability to contain and control the hot, ignitable asphalt
spill.
Figure 1. Air flow through the FCC unit that caused the explosion. (Credit: CSB)
16
Recommendations
To Cenovus Superior Refinery
2018-02-I-WI-R1
Establish safeguards to prevent explosions in the FCC unit during transient operation (including startup,
shutdown, standby, and emergency procedures). Incorporate these safeguards into written operating procedures.
At a minimum establish the following specific safeguards:
a) Implementation of the reactor steam barrier, or a similar inert gas flow, to maintain an inert barrier at an
elevated pressure between the main column (containing hydrocarbon) and the regenerator (containing
air);
b) Purging the main column with a non-condensable gas as needed to prevent a dangerous accumulation of
oxygen in the main column overhead receiver;
c) Monitoring to ensure that there is a sufficient non-condensable gas purge of the main column to prevent
a dangerous accumulation of oxygen in the main column overhead receiver (either through direct
measurement of the oxygen concentration and/or through engineering calculation);
d) Monitoring of critical operating parameters for flows, pressures, pressure differences, and catalyst
levels;
e) Documentation of consequences of deviating from the transient operation safe operating limits and of
predetermined corrective actions; and
f) Inclusion of the above items in the appropriate FCC operator training curricula.
2018-02-I-WI-R2
Based on licensor input and good industry practices, determine the appropriate point(s) in the FCC unit’s
shutdown procedures to shut down all wet gas compressor(s). Incorporate this information into all FCC unit
shutdown procedures and operator training material.
2018-02-I-WI-R3
Develop and implement a slide valve mechanical integrity program that addresses erosion and ensures proper
functioning of the slide valves during a shutdown. The program must include, at a minimum:
a) A slide valve mechanical integrity standard that defines monitoring and inspection requirements, with
acceptance criteria, required for the safe operation of the FCC unit during transient operation (such as a
startup, shutdown, standby, and emergency).
b) Monitoring that includes process data analysis and mechanical preventive activities to evaluate the
mechanical condition of the slide valves during the operation of the FCC unit between turnarounds;
c) Quarterly presentations of process data and mechanical preventive maintenance data to refinery
operations management and maintenance management to drive key decisions such as shortening the
turnaround cycle and/or planning a maintenance outage;
d) During turnarounds and other potential slide valve maintenance outages, evaluate the adequacy of the
slide valve mechanical integrity program for the safe operation of the FCC unit during transient
operation. If the inspection demonstrates unsuccessful performance, make appropriate corrections.
17
During the next major FCC unit turnaround at Cenovus Superior Refinery, demonstrate that the slide valve
mechanical program is adequate for the safe operation of the FCC unit during transient operation. If the
inspection demonstrates unsuccessful performance, make appropriate corrections to the slide valve mechanical
integrity program.
2018-02-I-WI-R4
Develop emergency procedures for responding to a loss of catalyst slide valve function (for example, when it
leaks excessively or fails to close on demand).
2018-02-I-WI-R5
Develop guidance for analyzing operating procedures to improve transient operation hazard evaluations during
PHAs. Refer to section Chapter 9.1 in the CCPS publication Guidelines for Hazard Evaluation Procedures, 3rd
Ed. or an appropriate equivalent resource to develop the guidance. Incorporate the guidance into the appropriate
Cenovus Superior Refinery PHA procedural documents and policies.
2018-02-I-WI-R6
Develop and implement an FCC unit operator, supervisor, and manager training program based on the licensor’s
guidance and on available industry guidance. Elements of the training program shall include:
a) A set of written training materials (such as a manual) consistent with the licensor’s technology
information, encompassing:
i) FCC equipment;
ii) Normal operations;
iii) Transient operations (including startup, shutdown, standby, and emergency); and
iv) Case studies of industry FCC industry incidents, including ExxonMobil Torrance (2015) and this
incident; and
b) Training delivery methods including:
i) Group and individual training; and
ii) Simulator training for board operators.
2018-02-I-WI-R7
Incorporate lessons learned from this incident into the appropriate training materials for the Cenovus Superior
Refinery Emergency Response Team. At a minimum, topics shall include the proper response to liquids
potentially stored above their flash point, such as asphalt, and the ignition risk of pyrophoric material inside
asphalt storage tanks.
To Cenovus Energy
2018-02-I-WI-R8
For all Cenovus operated refineries with FCC units, develop and implement an FCC unit-specific PHA guidance
document as part of each FCC unit’s ongoing PHA update/revalidation cycle, including the Cenovus Superior
Refinery. The PHA guidance document should be updated with new industry knowledge as it becomes available
(for example, from AFPM, CCPS, and API). The PHA guidance document should include a requirement to
18
review available licensor and industry guidance for FCC unit PHA scenarios and recommended safeguards and
at a minimum, include information related to transient operation safeguards listed in CSB Recommendation
2018-02-I-WI-R1.
2018-02-I-WI-R9
Develop and implement a technology-specific knowledge-sharing network program across all Cenovus operated
refineries, which at a minimum includes an FCC technology peer network. The peer network(s) must include
engineers, operations management, and operations staff from each site that uses the technology, including the
Cenovus Superior Refinery. The network(s) must meet at least annually to discuss process safety topics in the
technology including:
a) Relevant incidents and near-misses at the refineries and/or in industry;

b) Refinery learnings in implementing process safety improvements;
c) Relevant industry tools, bulletins, and knowledge-sharing documents, such as those published by
AFPM, CCPS, and API; and
d) Relevant updates to industry publications and standards.
2018-02-I-WI-R10
Include and maintain the FCC technology licensors’ operating manuals in the process safety information
packages for all FCC units, including the FCC unit at Cenovus Superior Refinery.
To U.S. Occupational Safety and Health Administration (OSHA)
2018-02-I-WI-R11
Develop guidance documents for performing process hazard analysis on operating procedures to address
transient operation hazards in facilities with Process Safety Management (PSM) covered processes.
To U.S. Environmental Protection Agency (EPA)
2018-02-I-WI-R12
Develop a program that prioritizes and emphasizes inspections of FCC units in refineries that operate HF
alkylation units (for example, under EPA’s National Compliance Initiative called Reducing Risks of Accidental
Releases at Industrial and Chemical Facilities). As part of this program, verify FCC unit safeguards that prevent
explosions during transient operation (including startup, shutdown, standby, and emergency procedures). At a
minimum the program will verify the following specific safeguards:
air);
19
levels;
e) Documentation of consequences of deviating from the transient operation safe operating parameters and
of predetermined corrective actions; and
This recommendation is in addition to the recommendations to EPA relating to hydrofluoric acid outlined in the
CSB’s report on the 2019 fire and explosions at the Philadelphia Energy Solutions refinery. In that report, the
CSB recommended (1) that the EPA prioritize inspections of refinery HF alkylation units to ensure units are
complying with API good practice guidance, (2) to require petroleum refineries with HF alkylation units to
evaluate inherently safer technology, and (3) to initiate prioritization and, as applicable, risk evaluation of HF
under the Toxic Substances Control Act.
To American Petroleum Institute (API)
2018-02-I-WI-R13
Using API’s processes to determine the appropriate safety product, develop a publicly available technical
publication for the safe operation of fluid catalytic cracking (FCC) units. The document should be applicable to
both new and existing units. Include the following topics at a minimum:
a) Description of typical FCC unit hazards, including air leaks into hydrocarbon systems or hydrocarbon
leaks into air systems that could form a flammable mixture during transient operation (startup,
shutdown, standby, and the actions required to transition between these modes). If needed, include
differences between possible reactor/regenerator configurations;
b) Recommended practices for safeguards to control FCC unit hazards;
c) Recommended monitoring for process safety during FCC unit transient operations;
d) Recommended emergency operating procedures for FCC-specific scenarios;
e) PHA guidance for key FCC-specific scenarios, including transient operation;
f) Recommended FCC-specific field and board operator process safety training topics and methods;
g) Guidelines for process safety assessments of FCC units; and
h) Incorporate lessons learned from this CSB investigation and the CSB’s ExxonMobil Torrance Refinery
Electrostatic Precipitator Explosion investigation throughout the document and include references in the
document’s bibliography.
2018-02-I-WI-R14
Modify the appropriate existing recommended practice (for example, API RP 553, Refinery Valves and
Accessories for Control and Safety Instrumented Systems) to include information about the purpose, design,
maintenance, and testing of additional FCC catalyst slide valve components, including the slide valve body. If
an API product other than API RP 553 is modified, API RP 553 should guide the reader to that reference.
2018-02-I-WI-R15
Incorporate lessons learned from the FCC Unit Explosion and Asphalt Fire at Husky Superior Refinery incident
into the appropriate API products (for example, API RP 2023, Guide for Safe Storage and Handling of Heated
Petroleum-Derived Asphalt Products and Crude Oil Residua, or API RP 2021, Management of Atmospheric
20
Storage Tank Fires). At a minimum, topics shall include the flammability of heated material such as asphalt and
the ignition risk of pyrophoric material inside asphalt storage tanks. Include a reference to this CSB
investigation in the document’s bibliography.
To Honeywell UOP (Universal Oil Products, UOP)
2018-02-I-WI-R16
Participate in the API committee that develops a technical publication for the safe operation of FCC units.
21
1 Background
1.1 Husky Energy
Husky Energy Inc. (“Husky”), founded in 1938, was an integrated energy company headquartered in Calgary,
Alberta [1]. It had two core businesses: (1) the Integrated Corridor, which included Upstream and Downstream
operations in Western Canada and the United States; and (2) Offshore production in the Asia Pacific and
Atlantic Canada Regions [2]. The company marketed and distributed a range of petroleum-based products,
including crude oil, natural gas, gasoline, diesel, jet fuel, asphalt, lubricants, and ancillary products [3].
The Integrated Corridor business produced heavy oil from Husky’s assets in Saskatchewan and Alberta, and
refined them into marketable products at the company’s Downstream assets in Canada and the United States [4,
5]. Husky’s Downstream business included three refineries in the United States: Lima, Ohio; Superior,
Wisconsin; and Toledo, Ohio [6]. Husky has a 50 percent ownership of the BP-Husky Toledo refinery through a
joint venture with BP p.l.c. [7]. Husky Marketing and Supply Company (HMSC), based in Ohio, bought and
sold the petroleum products produced by affiliates and purchased from third parties [3].
Cenovus Energy Inc. (“Cenovus”), a Canadian oil and natural gas company, merged with Husky Energy on
January 1, 2021. Husky was amalgamated into Cenovus on March 1, 2021 [8, 9, 10]. In addition to the Lima,
Superior, and Toledo refineries, Cenovus has a 50 percent stake in two additional U.S. refineries in Roxana,
Illinois and Borger, Texas through a joint venture with Phillips 66 [7].
1.2 Husky Superior Refinery

Husky Superior Refinery (now called Cenovus Superior Refinery), built in 1950 [11], is the only refinery in
Wisconsin and processes up to 50,000 barrels per day of crude oil [12]. It employs about 200 workers and
allowed Husky to service the U.S. Midwest market with its products including asphalt, gasoline, and diesel [13,
14]. Murphy Oil Corporation owned the Superior Refinery from 1958 until its sale to Calumet Specialty
Products Partners, LLP (“Calumet”) in 2011 [15, 16]. Husky’s subsidiary, Superior Refining Company (“SRC”),
acquired the Superior Refinery from Calumet on November 8, 2017, 170 days before the April 26, 2018 incident
[17].
The Superior Refinery operated under multiple owners throughout its history. Calumet described in a letter to
the U.S. Chemical Safety and Hazard Investigation Board (“CSB”) its previous relationship with the refinery:
During the time that Calumet owned Calumet Superior, LLC, the vast majority
of policies and standards addressing process safety [...] were maintained at the
local Superior level by the plant management team of Calumet Superior, LLC,
not Calumet Specialty. Murphy Oil, which owned the refinery before Calumet
(as well as all of the prior owners of the refinery), took a similar, local approach
to such policies and procedures. As a result, the refinery-specific policies and
procedures were consistently and continuously maintained by local leadership
since 1958. These policies and procedures were part of the Calumet Superior,
22
LLC books and records which transferred, along with the entire workforce, to
Husky upon the sale.
When Husky’s subsidiary SRC bought the Superior Refinery in 2017, it brought into the refinery Husky’s
policies, which included corporate standards for controlling the risk of major accidents. According to Husky’s
corporate standard documents, “Husky’s Operational Integrity Management System (HOIMS) create[d] a
framework for identifying hazards and establishing processes to eliminate, mitigate or control them.” Since the
Husky and Cenovus merger, Cenovus reported applying a similar operational excellence management system
across its organization, referring to it as Cenovus Operations Integrity Management System (COIMS) in a 3rd
quarter 2021 corporate presentation [18, p. 7] and on its website in 2022 [19].
Wisconsin is under federal Occupational Safety and Health Administration’s (“OSHA”) jurisdiction, which
means that Cenovus Superior Refinery (formerly known as Husky Superior Refinery) is subject to federal
OSHA regulations including the Process Safety Management (“PSM”) Standard [20].a Cenovus Superior
Refinery is also regulated under EPA’s Risk Management Plan (“RMP”) Rule.
1.3 Surrounding Area

Husky Superior Refinery is located in the city of Superior, Wisconsin, which covers 45 square miles and has a
population of over 27,000 [21]. Superior shares a harbor with Duluth,b Minnesota, and both cities form a single
metropolitan area called the Twin Ports [22] (Figure 2).
a
29 C.F.R. § 1910.119
b
Duluth has a population of about 87,000 [190].
23
Figure 2. Aerial image of Superior, Wisconsin. (Credit: Google Maps with annotations by CSB)
While Husky Superior Refinery is surrounded primarily by industrial facilities, there are some residences, a golf
course, and an airport within approximately one mile of the refinery. Figure 3 shows the census blocks within
approximately three miles of Husky Superior Refinery. Table 1 summarizes the demographic information of the
population residing within the labeled blocks. There are more than 18,000 people residing in more than 8,500
housing units, approximately two-thirds of which are single units, within three miles of Husky Superior
Refinery. In general, the population in the area is predominantly white, with 12 percent of the population below
the poverty level. Appendix C contains further demographic information for each census block.
24
Figure 3. Census blocks in an approximately three-mile distance from Husky

Superior Refinery. (Source: Census Reporter [23] with annotations by CSB)
Table 1. Summarized demographic data for the populations within the census blocks
shown in Figure 3. (Source: Census Reporter [23])
Number
Race and Per Capita % of
Population Types of Housing Units
Ethnicity Income Poverty Housing
Units
White 90% Single Unit 66%
Black 1% Multi-Unit 31%
Native 1% Mobile Home 3%
Asian 1% Boat, RV, Van, etc. 0%
18,625 $ 27,738 12% 8,538
Islander 0%
Other 0%
Two+ 4%
Hispanic 2%
25
1.4 Fluid Catalytic Cracking (FCC) Unit

The explosion at Husky Superior Refinery occurred in the refinery’s fluid catalytic cracking (“FCC”) unit. The
FCC unit converts heavy, low-value hydrocarbons into lighter, high-value products such as gasoline and diesel
using a chemical reaction.a The chemical reaction that breaks large hydrocarbon molecules into smaller
molecules is called a cracking reaction [24, p. 120].
FCC technology uses a powder-like catalyst that behaves like a liquid when it is aerated, or “fluidized” (Figure
4) [24, pp. 1, 233, 25, p. 5]. Catalyst continually circulates between a reactor, where it interfaces with flammable
hydrocarbons, and a regenerator, where carbon byproducts burn off the catalyst’s surfaces at high temperatures
in the presence of air. Figure 5 shows the catalyst circulation loop with blue arrows [25, p. 5]. During normal
operation, the only thing that separates the mixing of flammable hydrocarbons from the air within the
regenerator is a tightly controlled pressure balance that enables a continual catalyst circulation between the
reactor and the regenerator [24, p. 245].
Figure 4. Left: FCC catalyst. Right: A bubbling fluidized bed. (Credit: [26], [27])b
a
In a typical refinery, the crude unit separates crude oil into various products by boiling ranges. Transportation fuels, such as gasoline
and diesel, have lower boiling points than heavier material such as gas oils and residuum. Typical FCC feed is called gas oil. In addition
to gasoline and diesel, the FCC produces olefinic gases such as propylene and butylene, which are building blocks for alkylate, a high-
octane gasoline component, and/or other petrochemicals. Refiners optimize their FCC units’ operation to meet the refinery’s production
goals [29, pp. 1, 164-165, 28, pp. 1-9].
b
This short video demonstrates the fluid behavior of the aerated catalyst.
26
Figure 5. Simplified process flow diagram of Husky Superior Refinery’s FCC unit. (Credit: CSB)
The cracking reaction takes place inside the reactor riser (Figure 6) [25, p. 5]. After the reactor separates the
catalyst from the products, the hydrocarbon product vapor continues to the main column. The main column and
gas concentration unit (“GasCon”) separate the hydrocarbons coming out of the reactor into various product
streams. The explosion occurred in the gas concentration unit.
1.4.1 Reactor and Regenerator

Husky Superior Refinery licenses its FCC technology from Honeywell UOP (Universal Oil Products, “UOP”).
Husky Superior Refinery’s FCC unit, designed in 1960, used UOP’s stacked design technology, meaning that
the reactor vessel is on top of the regenerator [28, p. 210]. See Figure 6 for Husky Superior Refinery’s reactor
and regenerator configuration. The reactor is depicted in blue, and the regenerator is depicted in purple. Arrows
show catalyst, hydrocarbon, air, and steam flow paths for normal operation. Approximate catalyst operating
levels are shown in yellow.
27
Figure 6. Husky Superior Refinery’s stacked FCC reactor/regenerator

configuration showing flow paths during normal operation. (Credit: CSB)
During normal operation, liquid hydrocarbon feed enters the bottom of the riser, a tall vertical pipe where the
liquid vaporizes as it contacts hot catalyst. The hydrocarbon cracks into smaller molecules while it flows with
the catalyst to the top of the riser over about two seconds. Cyclones separate the vapors from the catalyst at the
28
top of the reactor. Vapor reactor products flow into the main column for further processing, while the catalyst
collects at the bottom of the reactor, called the stripper. Inside the stripper, steam removes, or “strips,” additional
hydrocarbon products from the catalyst’s surface. Catalyst coming out of the stripper, called spent catalyst, is
less active due to coke (carbon-rich solid material) deposits that accumulate on the catalyst’s surface during the
reaction. Before returning to the reactor, these coke deposits are removed to “regenerate” the spent catalyst.
The spent catalyst slide valve, located beneath the stripper, controls the level of catalyst inside the reactor by
adjusting catalyst flow into the regenerator. In the regenerator, air supplied from the atmosphere through an air
blowera fluidizes the catalyst and provides the oxygen to burn the coke off the catalyst at about 1300 to 1350
degrees Fahrenheit. Air and combustion products, called flue gas, are routed to the atmosphere. The regenerated
catalyst slide valve controls the flow of hot catalyst back into the riser, where steam or process gas conveys the
catalyst up the riser to repeat the cycle. The unit operates in a tightly controlled pressure balance where the
catalyst loops continually throughout the system, driven by differential pressure between the regenerator and
reactor vessels [29, p. 39, 25, p. 8].b
A differential pressure instrument measures the “regenerator-reactor differential pressure,” which is the
difference between the pressure inside the regenerator and the pressure inside the reactor, measured at the top of
each vessel (Figure 8). During normal operation, Husky Superior Refinery’s regenerator operates at a higher
pressure than the reactor, meaning that the regenerator-reactor differential pressure is a positive value (greater
than zero), similar to FCC units in other refineries [30, p. 11].c
The flue gas system downstream of the regenerator cools down and removes particulate matter from the gas
before it is routed to atmosphere. Husky Superior Refinery uses an electrostatic precipitator (“ESP”)d to remove
flue gas particulate matter.
1.4.2 Catalyst Slide Valves

Slide valves are a typical feature of most FCC unit designs [31, p. 444, 25, p. 8]. They are gate-type valves that
open and close by sliding a disc across an orifice (Figure 7) [32, p. 1354]. According to UOP’s FCC Unit
General Operating Manual, the primary purpose of the FCC spent and regenerated catalyst slide valves is to
control catalyst flow. FCC catalyst slide valve components need to move freely, allowing for thermal expansion
at high temperatures; therefore, their design requires clearances that allow for a certain amount of leakage, even
when they are brand new and fully closed [33, pp. 5-7, 34, p. 10, 35, p. 12]. The locations of some of the
clearances, typically around 0.04 to 0.06 inches wide, are indicated in yellow dashed lines in Figure 7 [33, p. 6,
30, p. 12].
a
Husky Superior Refinery’s FCC unit had a main air blower and an auxiliary air blower.
b
During normal operation, process control instrumentation typically controls flow, temperature, pressure, and catalyst levels in FCC
units to maintain stable, continuous operation. A board operator typically monitors the process continually and intervenes as needed [29,
p. 40].
c
Multiple FCC technology licensors indicated to the CSB that they also typically design for the regenerator to operate at a higher
pressure than the reactor during normal operation.
d
The ESP is a pollution control device that removes catalyst particles using charged plates that produce sparks—potential ignition
sources—as catalyst passes through during normal operation [29, p. 289, 83, p. 4].
29
Figure 7. Catalyst slide valves. Left: Side view. Right: View from the downstream
side looking up. (Credit: TapcoEnpro [36] [37] with CSB annotations)
UOP provides design specifications, including standards for slide valves, in its basic engineering design
packages. According to UOP representatives, some companies develop their own standards on top of UOP’s
specifications.
Refineries typically use differential pressure instruments to estimate the fluidized catalyst’s levels and densities
because FCC catalyst exerts a hydraulic pressure, similar to a liquid, when fluidized [30, pp. 8, 13, 24, pp. 154-
160].a See Figure 8 for the instruments that Husky Superior Refinery operators used to estimate catalyst
locations, with example catalyst levels depicted in yellow. The reactor level instrument measured the pressure
difference across the fluidized catalyst layer and displayed the catalyst height in inches. The reactor level
instrument could detect catalyst levels if they were more than 45 feet above the spent catalyst slide valve, and
the typical catalyst operating level fell within the instrument’s detection range during normal operation.
a
When FCC catalyst is not fluidized, it does not exert hydraulic pressure; it behaves as a solid like fine sand [30, p. 9, 29, p. 154].
30
Figure 8. Husky Superior Refinery’s FCC reactor differential pressure

instruments (person for scale). (Credit: CSB)
At the bottom of the spent catalyst standpipe, the slide valve differential pressure instrument reported the
pressure difference (also known as the “pressure drop,” “pressure differential,” and “differential pressure” [29,
pp. 155-159]) across the spent catalyst slide valve. The differential pressure across both slide valves was
positive during normal operation [29, pp. 155, 245]. The level of fluidized catalyst above the slide valves
31
created a pressure force, contributing to the differential pressure across the valves and driving the catalyst
circulation [29, pp. 154-156]. In a 2015 operating study, refinery employees measured that during typical
normal operation:
• the regenerator pressure operated 3 pounds per square inch (“psi”) higher than the reactor pressure;
• the pressure at the top of the spent catalyst slide valve was higher than the pressure at the top of the
reactor by about 9 psi; and
• the differential pressure across the spent catalyst slide valve was about 6 psi.a
The differential pressure across the catalyst slide valves should always be a positive (greater than zero) value
during normal operation, and the catalyst should flow in the direction indicated in Figure 5 and Figure 6. If
slide valve differential pressures are too low to sustain catalyst circulation, the plant could be at risk of a
“reversal” event: where the catalyst and its fluidization medium flow in the reverse direction of intended flow,
potentially forming a dangerous explosive mixture of air and hydrocarbon [29, p. 245].b The control system was
configured with “advisory low” alarms at 3.3 psic and “critical low” alarms at 2.8 psi to alert the board operators
to a low pressure differential condition across each of the two catalyst slide valves. If a slide valve differential
pressure reached 2 psi, Husky Superior Refinery FCC unit’s computer control system was designed to
automatically start closing the spent and regenerated slide valves to reduce the risk of a reversal, and completely
closing the valve once differential pressure reached 0 psi to stop catalyst circulation. This automated safeguard
was called the Control Override Protection System (“COPS”).
1.4.3 Main Column and Gas Concentration Unit

During normal operation, hydrocarbons flowed from Husky Superior Refinery’s FCC reactor into the main
column, which condensed and separated the products into liquid and vapor streams.d Gasoline and lower boiling
point products left the main column as a vapor into the overhead system. Up to three compressors, called the wet
gas compressors (“WGC”),e ran in a parallel configuration to increase the main column overhead products’
pressure from 15 to about 200 pounds per square inch gauge (psig) into the GasCon (Figure 5).
Husky Superior Refinery’s gas concentration unit further separated gasoline from the lighter hydrocarbon
products, such as process gas,f propane, and butane (Figure 9). Gasoline and lighter products flowed from the
high-pressure receiver vessel through the primary absorber, sponge absorber, and stripper columns. These
a
During the 2015 operating study, an FCC consultant visited the site and noted in the final report: “The pressure gain across the spent
catalyst standpipe was less than half of the industry average. The catalyst is de-fluidized [...] along this rather long standpipe.”
b
In a reversal, the slide valve differential pressure is a negative value (less than zero) [29, p. 245].
c
The “advisory low” alarms were configured at 3.3 psi for the spent catalyst slide valve and 3.2 psi for the regenerated catalyst slide
valve.
d
Similar to other FCC units of its kind, there were no valves or other pressure control devices between the reactor and the main column
during normal operation [29, pp. 41-42].
e
Husky Superior Refinery’s FCC unit used reciprocating wet gas compressors. Reciprocating compressors are positive displacement type
compressors with pistons, unlike centrifugal compressors, which use impeller blades. Reciprocating compressors can achieve higher
compression ratios and their performance is not as likely to be adversely affected by changes in molecular weight or excessively low
flow rates [203].
f
FCC process gas contains hydrogen, methane, ethane, ethylene, some propane, propylene, butylene and hydrogen sulfide, and trace
amounts of oxygen, nitrogen, carbon monoxide, and carbon dioxide.
32
vessels worked together to extract ethane and lighter materials and sent them to the refinery process gas (or fuel
gas) system, which fueled boilers and fired heaters in other refinery operating areas. The debutanizer separated
the rest of the liquid products into gasoline and a liquefied petroleum gas (“LPG”) mixture that the downstream
units processed further into gasoline components.
Figure 9. Simplified block flow diagram of the GasCon. (Credit: CSB)
The vapor outlet of the primary absorber was connected to the inlet of the sponge absorber (Figure 9). The
explosion occurred inside these two vessels during the incident.a
1.4.4 FCC Units in the United States

As of 2017, FCC gasoline accounted for 35 to 40 percent of the United States gasoline pool [38, p. 7]. In 2018,
the United States had a total refining capacity of about 20 million barrels per stream day, of which catalytic
cracking units processed almost 6 million barrels (Figure 10) [39, pp. 4-5]. With the projected increase in
worldwide petrochemical demand, many refineries also use FCC technology to produce petrochemicals [40].
Global FCC capacity exceeded 21 million barrels per day in 2020, with further capacity expansions anticipated
in Asia and Africa [41].
a
According to Husky Superior Refinery’s documents, a pressure relief valve set to relieve at 250 psig on the high pressure receiver
protected this system. The two vessels that exploded both had a design pressure of 250 psig. Process data from the day of the incident
did not record a pressure increase at the sponge absorber immediately before the explosion, and according to Husky Superior Refinery,
the FCC unit process instruments stopped providing process data when the explosion occurred at approximately 9:58 a.m.
33
Figure 10. Catalytic cracking units and their capacities in the United States.
(Source: Canada Energy Regulator [42])
The first commercial FCC unit came on stream in 1942 in Baton Rouge, Louisiana [25, p. 1]. Since then,
numerous companies have developed multiple reactor/regenerator configuration designs, which they license
others to operate.a As FCC technology evolves and facilities age, refineries have revamped many older FCC
designs to incorporate modern features [43, pp. 17-16, 17-17, 25, p. 5]. About 500 FCC units operate globally,
with about 90 in the United States [44, 12].
1.5 FCC Unit Shutdown Steps

The explosion that initiated the incident on April 26, 2018, occurred while Husky Superior Refinery operators
were shutting down the FCC unit for planned maintenance activities.
a
Some of the companies that have participated in FCC development include ExxonMobil Research & Engineering Company, Honeywell
UOP, Kellogg Brown and Root, Technip Stone and Webster, Lummus Technology, Shell Global Solutions, and others [43, pp. 17-16,
29, p. 1].
34
1.5.1 Typical UOP FCC Unit Shutdown Sequence

In its General Operating Manual for a generic UOP-licensed FCC unit of this configuration,a UOP describes the
typical shutdown steps as follows:
1. Hydrocarbon feed is diverted from the reactor to the bottom of the main column. Steam flow to the
reactor is increased to assist catalyst circulation, control the reactor pressure, and clear the catalyst from
the riser.
2. With steam flowing into the reactor, the regenerator-reactor differential pressure is slowly decreased
until the regenerator pressure is about two pounds per square inch lower than the reactor pressure. This
vital move raises the pressure inside the reactor—above both the main column and the regenerator—to
establish the reactor steam barrier, an essential safeguard. The steam-filled reactor provides an inert
barrier separating the air (regenerator) and hydrocarbon (main column) systems (Figure 11).
Establishing and maintaining the reactor steam barrier is a critical safeguard to prevent an explosion.
3. A small flow of non-condensable gas, such as natural gasb or vaporized LPG, is sent into the main
column to control its pressure as gas production from the reactor stops (Figure 11).
4. Wet gas compressors are shut down as needed as gas production from the reactor stops (Figure 11).
5. Catalyst continues circulating for regeneration. Once the catalyst is adequately regenerated, the
circulation is stopped by closing the regenerated catalyst slide valve.
6. The catalyst in the reactor is transferred into the regenerator through the spent catalyst slide valve. Once
the reactor is emptied as much as possible, the spent catalyst slide valve is closed. Outside operators
transfer as much of the regenerator’s catalyst inventory as possible into catalyst hoppers. During this
time, the air blower gradually cools the regenerator’s contents from about 1,250 to 300 degrees
Fahrenheit (°F) over several hours. The air blower is shut down when temperature measurements inside
the regenerator reach about 300 °F.
7. The following is done concurrently with the step above: As the main column cools down, with steam
from the reactor flowing to the main column, liquid hydrocarbons are pumped out of the main column
into storage tanks. Hydrocarbon liquid levels in the pressurized gas concentration vessels are routed into
the main column or directly to storage tanks. The remainder of the hydrocarbon in the main column and
associated piping is depressured and then steamed out to the flare system through steam lines that attach
to the equipment.c
8. When the reactor and main column are sufficiently steamed out and the air blower can be shut down, a
spectacle blindd is inserted between the reactor and the main column to isolate the reactor and
regenerator from the main column and gas concentration unit.
a
The General Operating Manual relevant to this investigation applies to UOP licensees with the “Stacked FCC Unit with Bubbling Bed
Regenerator, Main Column and Gas Concentration Unit” configuration, including Husky Superior Refinery, and is not site-specific.
More background on UOP’s manual is further discussed later in this report (in Section 4.2.1.2).
b
Natural gas consists primarily of methane [197].
c
The term “steam out” refers to purging out a vessel’s contents using steam, typically performed on equipment to purge hydrocarbons
before opening, or air before commissioning.
d
A blind is a metal plate inserted between flanges to ensure positive isolation of a vessel from the process. A spectacle blind is a
combination of a ring spacer and a blind. The spectacle blind is usually permanently installed in the piping system and rotated as needed
[191].
35
9. After the spectacle blind is inserted, the main column can be further steamed out and cleaned while the
reactor and regenerator manways are opened to continue cooldown and catalyst removal. The gas
concentration unit vessels are depressured and steamed out to the flare system. Once the vessels are
depressured, steamed out, and water flushed as needed, the equipment can be isolated from hazardous
energy sourcesa and opened for maintenance work.
On the day of the incident, the shutdown appeared to be progressing as planned. Operators were working on
items 6 and 7 above, approximately two hours away from inserting the spectacle blind, when the incident
occurred.
Figure 11. UOP-recommended pressure relationships and flow directions during

an FCC unit shutdown. (Credit: CSB)
1.5.2 Changes to 2018 Shutdown Procedure

Husky Superior Refinery incorporated vapor-phase chemical cleaning into many of its units’ shutdown
procedures, including the FCC unit, for the first time during the 2018 turnaround. Chemical cleaning typically
removes residual hydrocarbons using a detergent-like chemicalb and neutralizes pyrophoric material in the
equipment.c
a
OSHA requires performing lockout/tagout to protect employees performing servicing and maintenance activities [187].
b
Chemical cleaning is typically performed by injecting chemicals into the equipment along with steam or water. The cleaning solution
removes volatile hydrocarbons from the equipment more effectively than steam or water alone, reducing the turnaround downtime
[174].
c
Pyrophoric materials are chemicals that ignite spontaneously when dry and exposed to oxygen [63, p. 14]. They form as deposits in
many hydrocarbon refining processes in the presence of sulfur compounds in iron and steel equipment [63, p. 1]. It is a common
practice in industry to keep pyrophoric-contaminated equipment wetted with water to avoid spontaneous combustion when exposed to
oxygen [63, pp. 15-17]. Typically, refineries also use chemical cleaning to neutralize pyrophoric materials [174, p. 77]. UOP’s general
operating manual does not mention chemical cleaning but requires water flushing the main column and gas concentration unit
equipment that would be opened for entry and work.
36
According to Husky Superior Refinery employees, the updated procedures would have helped establish how the
refinery would comply with EPA’s new Petroleum Refinery Sector Rule, which they anticipated would take
effect later that year.a Changes to the FCC unit’s shutdown procedure for this turnaround included the following:
1. Husky Superior Refinery no longer allowed steaming equipment out through atmospheric vents as in
previous shutdowns. Instead, most equipment needed to be steamed out to the refinery’s relief system
and the flare.
2. Liquids had to be drained out of the equipment. This led the refinery to attach temporary piping and
hoses so that refinery operators could drain and route liquids to tanks through enclosed systems.
3. A chemical cleaning contractor would inject chemicals into the equipment after the unit was shut down
by refinery operators. The chemicals, which circulated through the equipment with steam, would
remove residual hydrocarbons from inside the equipment before they could be opened and vented to the
atmosphere.
The chemical cleaning contractor developed the chemical injection portion of the procedure using information
provided by the refinery’s process engineers. Husky Superior Refinery employees developed the shutdown steps
to prepare the equipment for chemical cleaning, which included shutting down, steaming, venting, and draining
the equipment. Figure 12 is an example of new information added to the FCC unit’s shutdown procedure that
explains the venting and chemical cleaning changes.
Figure 12. Notes added to the FCC unit shutdown procedure for the 2018 turnaround.b
(Credit: Husky Superior Refinery)
a
EPA first published its Petroleum Refinery Sector rule in 2015 and finalized it in 2020. On its website, the EPA stated that this rule
“will further control toxic air emissions from petroleum refineries and provide important information about refinery emissions to the
public and neighboring communities” [177].
b
The valve and instrument identification numbers are redacted.
37
2 Incident Description
2.1 FCC Unit Shutdown
The incident occurred on Thursday, April 26, 2018, at approximately 9:58 a.m. while operators were shutting
down the refinery for maintenance.a The planned event, called a turnaround, typically occurs once every five
years at Superior Refinery.b Operators had started to shut down and de-inventory the units in a planned order
beginning with the alkylation unit, on Monday, April 23, 2018.
At the beginning of the day shiftc on April 26, the FCC unit was operating normally, except that several of its
products were directed to storage tanks instead of other process units downstream. The alkylation unit was
nearly finished shutting down, and the downstream gasoline treating unit was in the final steps of shutting down
the morning of the incident. The next unit to be shut down was the FCC unit.
2.1.1 Start of Shutdown

The operations team had one board operator working that shift. This was his first time shutting down the FCC
unit, and the head operator assisted him through the initial shutdown steps. “I pulled up a chair and we hooked
up two keyboards and we had three screens and [we] were the ones that had brought everything down for the
first hour-and-a-half together,” the head operator told CSB investigators. The two operators split the work so
that the board operator could focus on the reactor/regenerator system, and they stayed in communication as they
checked off completed steps in their copies of the FCC unit’s shutdown procedure. The head operator explained,
“He dealt with mainly the structured and the slide valves, and I dealt with the main column.”
Eventually, the head operator left the control board area to troubleshoot a pump issue, talk to the contractors
about work permits, and assist with the alkylation unit’s turnaround activities. Through the morning, she would
periodically check in with the board operator and review the screens with him.
A manager was overseeing various activities at the FCC unit that morning, both inside and outside the control
room. As a former FCC operator and superintendent, he had more than thirty years of experience on the unit,
including previous turnaround experience. “I wanted to be kind of watching over a lot of the aspects,” he said,
“[...] answering questions and things like that.” He would occasionally check in with the board operator and talk
through what to expect while performing some of the shutdown procedure steps.
Operators began shutting down the FCC unit immediately after their shift turnover meetings on the morning of
April 26. Husky Superior Refinery’s shutdown procedure directed the operators to shut down the ESP before
stopping feed to the reactor. This was Husky Superior Refinery’s first turnaround since the 2015 FCC unit
incident in a Torrance, California refinery where an ESP had exploded [45, p. 6]. In the 2015 California
a
See Appendix B for a timeline summary of the incident.
b
According to a paper summarizing current FCC process technology challenges, the typical industry average run length between FCC
unit turnarounds was four to five years as of 2011 [170, p. 3].
c
The FCC unit operating crews transitioned from night shift to day shift starting at 5:00 a.m.
d
Husky Superior Refinery referred to “the structure” as the reactor, the regenerator, and their associated equipment such as slide valves
and steam connections.
38
incident, while the FCC unit was down for maintenance, hydrocarbon backflowed from the main column into
the regenerator, found an ignition source inside the ESP that was still energized, and exploded [45, p. 15].
The board operator at the Husky Superior Refinery shut down the ESP at around 5:30 a.m. He explained to CSB
investigators why it was important to shut down the ESP early in the shutdown:
[E]specially after the incident in California, when the ESP blew up, it was much
reiterated to us over and over again by [management] and everybody that if
anything bounces or anything kind of seems weird, to...don’t hesitate to just shut
that off. We’d rather fill out the paperwork with environmental and get penalized
than blow it up. So pretty much first thing, like when we’re shutting down, that
was like first thing you do.a
The board operator stopped feed to the reactor at about 5:40 a.m. by closing a control valve and increasing
steam flow to the riser.b He allowed the catalyst to continue circulating, then sent signals through the control
system to close the regenerated catalyst slide valve at 5:45 a.m. and the spent catalyst slide valve at 5:48 a.m.
The main air blower continued running to cool down the regenerator system while operators transferred catalyst
into a hopper for the next several hours as part of the shutdown procedure.
2.1.2 Catalyst Levels

In the control room, the control system indicated that the spent catalyst slide valve had not closed successfully.
The board operator noticed that it was still two percent open, and that the reactor catalyst level was decreasing.
At the board operator’s request, a field operator went to the valve to close it manually at about 6:05 a.m., but the
reactor level continued to drop. Another operator went out and tightened the valve further using its hand wheel.
By 6:16 a.m., the reactor level indicator showed that there was no catalyst remaining in the reactor. Though the
reactor level instrument indicated close to zero during most of the shutdown, it also occasionally indicated some
level readings, sometimes up to almost 40 inches, later in the shutdown.c The board operator recalls:
I know I looked at [the reactor level] a couple more times. […] [I]t went up and
down a couple times. So like in my mind, it was just kind of there and that when
it gets so low, a lot of indications stop working. […] So I just kind of assumed,
okay, there was something there but I’m not sure exactly what the level is. But
the temperature in the reactor looks good. All the temperatures in the unit looks
good. So I’m not going to worry about it anymore because everything looks good.
So nothing to worry about.
a
The CSB’s report from the 2015 ExxonMobil Torrance Refinery incident can be found here [108].
b
The reactor had continual steam injection into the riser and the stripper through the shutdown.
c
According to Husky Superior Refinery’s documentation, the reactor operated at 110 inches of level during normal operation.
39
2.1.3 System Pressures and Flows

As the catalytic cracking reaction stopped and gas production dropped, operators turned off two of the three wet
gas compressors. See Figure 13 for a simplified pressure control scheme that the board operator used during the
shutdown. Pressure controllers (yellow squares) adjust control valve positions to achieve the target pressures
measured at the corresponding pressure indicators (yellow circles).
Figure 13. Simplified main column and sponge absorber pressure control scheme used
during the shutdown. (Credit: CSB)
The board operator controlled the main column’s pressure using one wet gas compressor and the spillback
pressure controller. The spillback pressure controller is typically configured to adjust the amount of gas recycled
through the wet gas compressor to achieve the target pressure in the main column overhead receiver [46, p.
120]. The FCC shutdown procedure specified a main column pressure target of 2 to 3 psig. In case of high
pressure upsets, the main column butterfly valve, which was normally closed, was configured to automatically
open to the refinery relief system to relieve pressure quickly (purple section in Figure 13).a
The sponge absorber’s pressure controller vented to the process gas system (green section in Figure 13). During
normal operation, the sponge absorber typically operated at about 190 psig.
When the board operator initially stopped feed to the reactor, he had introduced “emergency steam”b to the riser
at around the same time. After feed had been out of the unit for about 15 minutes, the refinery’s procedure said
to “Cut Steam to Riser to 85% open.” The board operator reduced this steam flow just before 6:00 a.m. He
explained his understanding of the intent of this step to the CSB investigators:
The oil’s out, everything’s out. We shouldn’t have to worry about plugging
issues. We don’t need catalyst anymore because we’re not [...] reacting anymore.
a
A butterfly valve is a valve that stops, regulates, and starts flow using a disk that rotates [172].
b
Emergency steam is an additional steam supply to the reactor riser that is typically only used in startups and shutdowns.
40
So close the spent, close the regen, cut the steam back to 85%, [...] and then move
on with the rest of [...] the shutdown.
The shutdown procedure continued: “keep Main Column Receiver Pressure 1 pound [psi] lower than the
Regenerator pressure.” While the board operator discussed this procedure step with the CSB, he explained how
challenging it was to control the reactor, main column, and regenerator pressures in the first few hours of the
shutdown: “It’s hard with the air blowers blowing [...] and the pressure of the regen section and the pressure of
the main column, [...] it’s hard to just keep like a one pound perfect balance.”
Husky Superior Refinery’s FCC unit shutdown procedure was organized by various sections of the FCC unit,
where operators had to perform actions in the reactor/regenerator, main column, gas concentration unit, and
other areas concurrently as discussed in Section 1.5.1. The main column section of the shutdown procedure
instructed: “Bring Main Column pressure down to 2 -3 [psig].” At first, the board operator had difficulty
keeping the main column pressure lower than even 5 psig. After some troubleshooting, operators identified that
hydrocarbon vapors were inadvertently directed from the sponge absorber into the main column through a liquid
return pipe that had been drained. Once the operators closed the sponge absorber’s liquid outlet valve, at around
7:30 a.m., the board operator was able to reduce the main column’s pressure using the pressure controllers.
Figure 14 shows a representative snapshot of the pressure profile in the first few hours of the shutdown. The
arrows point in the flow direction. The air blower directed air into the regenerator, and the flue gas valve
directed flow out of the regenerator into the flue gas system. Steam was entering the reactor, condensing in the
main column overhead system, and coming out as water from the main column overhead receiver. The wet gas
compressor was continually directing flow from the main column overhead receiver into the gas concentration
unit. The sponge absorber pressure controller was closed during most of the shutdown and only opened when the
sponge absorber pressure was greater than 175 psig.
Figure 14. Pressure profile in the first few hours of the shutdown. (Credit: CSB)
The refinery’s shutdown procedure instructed operators to “always keep the regenerator pressure a couple
pounds higher than the reactor pressure” when closing the spent catalyst slide valve. The board operator used the
flue gas valve and the air blower to control the regenerator pressure. He maintained the regenerator pressure
41
between 10 and 15 psig from the time feed was pulled around 5:40 a.m. until the main air blower was shut down
sometime after 9:00 a.m. (Figure 15). During this time, the regenerator pressure remained higher than the
reactor’s pressure by at least 3 psi, and up to 10 psi higher at times.
The board operator explained that he wanted to keep the main column’s pressure low “so that we don’t have to
worry about reversal or anything, because there’s not enough pressure [...] to do that.” He described how he
managed the system’s pressures to CSB investigators:
It was more so just keep the main column at like two or three pounds of pressure
rather than like watching both the main column and [...] the regen and like [...]
tweaking them and trying to maintain a one pound [difference]. Because you still
have your main air blower and your aux blower going into the regen. So you still
have quite a bit of pressure. So as long as you’re at single digits on the main
column, [...] you’re fine. That you’re well below the at least one pound [...]
pressure of the regen section.
[...]
[T]he pressure [of the main column and regenerator is] bouncing quite a bit. [...]
So I figure as long as [the main column pressure is] at least lower than
[regenerator pressure], the trend should be at least one pound.
[...]
I kind of just rather err on the side of caution than try to maintain a perfect
balance.
Figure 15 shows the pressure trends of the regenerator, reactor, and main column overhead receiver from 5:00
a.m. until the explosion.a During the approximately four-hour period between when the hydrocarbon feed was
diverted from the reactor until the explosion, the reactor pressure operated at about one psi higher than the main
column overhead receiver pressure,b and the regenerator pressure was higher than the reactor pressure almost the
entire time.c The yellow triangles mark notable events during the morning of the incident:
1) System pressures drop (as expected) when operators stop feed to the FCC reactor.
2) Operators regain stable main column pressure control.
a
According to Husky Superior Refinery, the explosion prevented the process instruments from providing process data detailing the
conditions of the plant immediately after the explosion.
b
From available process data, the CSB calculated the median one-minute averaged pressure difference from the top of the reactor to the
main column overhead receiver, over the time range from 5:43 a.m. to 9:59 a.m., to be 0.9 psi.
c
The only time the reactor was at a higher pressure than the regenerator was for a total of about 15 minutes at around 9:10 a.m. when
operators shut down the main air blower and increased the auxiliary air blower rate to regain pressure control.
42
3) Two pressure spikes occur in the main column overhead receiver.a
4) Operators shut down the main air blower and continue to maintain the regenerator pressure higher
than the reactor pressure using the auxiliary air blower.
Figure 15. Pressure trends from 5:00 a.m. until the explosion. (Credit: CSB)
2.1.4 Process Gas System Fluctuations

On the morning of the incident, the refinery was operating four boilers in a different operating area. The boiler
operator reported to his superintendent that sometime before 8:00 a.m., all four boilers’ excess oxygen
concentration, which typically operated at three percent, had increased up to six percent. The boiler operator
called the instrument technician to troubleshoot the oxygen analyzers, but the problem had subsided, and the
oxygen readings had come back down and were stable by 8:30 a.m.
According to the instrument technician, “the only times that [Husky Superior Refinery has] problems with [the
oxygen analyzers] is when the fuel gas composition changes in the plant. [...] So something was going on with
the gas system.”
According to FCC unit process trends, the sponge absorber pressure controller, which remained closed for most
of the morning, opened between 6:49 and 7:06 a.m. and between 7:38 and 9:00 a.m. The vapor from the sponge
absorber is routed into the refinery process gas system, where it combines with process gas from other plants.
Boilers and furnaces in other refinery operating areas use this refinery process gas as a fuel source. The CSB did
a
FCC unit operators were purging liquid hydrocarbons into the main column using steam for the first time, when two “bangs” were
heard. The main column’s overhead vapor temperature was around 430 °F just before this activity began and decreased suddenly during
both pressure spikes, indicating hydrocarbon vaporization but no ignition. The CSB determined that this process anomaly was not
causal to the subsequent explosion and fire, because had Husky Superior Refinery prevented hydrocarbon vaporization inside the main
column, the explosion and fire likely would have still occurred based on the safety issues detailed in this report.
43
not identify other nonroutine activity outside of the FCC unit shutdown that morning that could have contributed
to changes in process gas composition.
2.1.5 Main Air Blower Shutdown and System Depressure

Shortly after 9:00 a.m., operators shut down the main air blower and continued cooling down the regenerator
with the auxiliary air blower. The auxiliary air blower had a lower flow capacity than the main blower, but the
board operator was able to maintain the regenerator pressure greater than the main column pressure over the
next hour. At this point, operators were in a holding pattern, waiting for the regenerator temperature to cool
down so that they could shut down the auxiliary air blower.
Meanwhile, field operators began to depressure the debutanizer to the flare system using a vent. Pressure inside
the interconnected GasCon equipment, including the sponge absorber, decreased as operators vented its
contents. The sponge absorber’s pressure control valve remained shut from about 9:00 a.m. until the explosion.
The one wet gas compressor was still running during this operation.
Process data from the shutdown did not indicate any sudden changes in pressure or temperature in the GasCon
prior to the explosion. An employee who was in the control room at the time told CSB investigators that “there
really [was] no indication [that] there was anything wrong on the GasCon until it blew up.”
2.1.6 Concurrent Work in the Plant

Operators were lowering temperatures, draining liquids, steaming out equipment, and venting pressure to the
relief system to prepare for inserting the spectacle blind. The blind would isolate the main column from the
reactor, at which point the chemical cleaning could begin. Husky Superior Refinery employees estimated that
they might have been ready to install the blind around noon. Multiple refinery personnel and contractors told the
CSB that they understood not to hook up the chemical cleaning equipment and open them to the process until
after the spectacle blind was installed.
In the GasCon, field operators drained liquid levels out of most of the vessels but had not yet finished
depressuring the rest of the flammable hydrocarbons to the flare.
Husky Superior Refinery management staff and the FCC unit operators allowed some maintenance staff and
contractors to enter the FCC unit operating area during the shutdown. Maintenance brought in scaffold builders
to help them access a chemical cleaning injection point on the sponge absorber. Operators requested
instrumentation technicians to enter the unit to troubleshoot level instrumentation issues at the main column
overhead receiver. Husky Superior Refinery employees were adding fittings to pumps, unlocking valves on low
point drains, and preparing to deenergize the level indicators on the primary and sponge absorbers.
Additional work continued as normal in other units in the FCC unit operating area,a such as the alkylation unit
and flare area, which refinery personnel considered outside the FCC unit itself. Adjacent operating areas, such
a
According to Husky Superior Refinery’s documents and employee statements, the FCC Area operations included the FCC unit, the gas
concentration unit, the alkylation unit, a gasoline hydrotreater, the flare, the caustic scrubber, and a cooling tower.
44
as the crude unit and utility plants, continued to operate. Husky Superior Refinery estimated that approximately
800 to 900 people including employees and contractors were working at the refinery on the day of the incident.
2.2 Explosion in the Gas Concentration Unit
2.2.1 Asphalt Storage Tank Damage

Explosion debris punctured asphalt storage Tank 101, which was approximately 200 feet away from the primary
absorber.a Figure 17 shows the relative positions of the damaged equipment.
Figure 17. Locations of equipment involved in the incident. (Credit: Google Maps with annotations by CSB)
a
The HF tank was 150 feet away from the explosion location.
45
The resulting hole was sufficiently below the tank's liquid level, but high enough above the ground for the
asphalt to gush out onto the surrounding berm (Figure 18). The hot asphalt, typically maintained between 320
and 340 °F, began to pour out the tank and over the containment wall, and spread into the FCC and crude unit
operating areas.
Figure 18. Asphalt tank puncture and leak. (Credit: CSB [left], Duluth News Tribune [right])
2.2.2 Refinery’s Initial Emergency Response

Soon after the explosion, Husky Superior Refinery employees began to evacuate contractors from the operating
areas and their offices in the blast-resistant modules to emergency muster points.
As the FCC operators were evacuating all workers from the unit, a refinery manager shut down the one running
wet gas compressor using the emergency stop button. Operators around the refinery began to depressure their
equipment safely to the flare. The FCC operators assisted in transporting injured workers to a safe location,
walked through the plant to assess additional leaks or damage, then reconvened at a muster point. The crude unit
operators shut down the crude unit and depressured their equipment to the flare. The oil movement operators
shut down the natural gas supply to the heaters in the asphalt tank farm.
Husky Superior Refinery emergency responders focused on putting out initial fires from hydrocarbons leaking
from damaged piping at the FCC process area. The initial fire was limited to the general area where the primary
and sponge absorbers had been and took about 45 minutes to extinguish. While refinery emergency responders
were extinguishing the initial fire, their fire truck got stuck in the asphalt.
Within an hour of the explosion, Husky Superior Refinery personnel set up an incident command system in the
refinery’s administration building. The incident command team was communicating with the contractor
companies, the refinery emergency response team, the Superior Fire Department, and other agencies to make
notifications, collect information, account for people, manage logistics, and allocate resources where needed.
46
When the Superior Fire Department arrived on scene, its primary responsibility was to manage the injured.
Within about an hour, all injured people were either cared for or taken to another facility, including six who
were transported by ambulance to hospitals.
2.3 Asphalt Spill and Fire
2.3.1 Primary and Sponge Absorber Explosion

Process trends confirm that the refinery operators had drained liquid from the major pieces of the gas
concentration unit, including the sponge absorber, high pressure receiver, and debutanizer reboiler and
overhead. The sponge absorber pressure continued to decrease during the hour leading up to the explosion and
had reached 166 psig. Then, just before 10:00 a.m., the primary and sponge absorber vessels exploded. Persons
near the refinery felt the explosion shake buildings up to a mile away [47].
One operator, who was facing the absorbers approximately 30 yards away from the explosion, heard a “ka-
boom” and saw a fireball (Figure 16). Another nearby employee on an overhead platform remembered hearing
a sharp “crack.” The shockwave knocked nearby people down and rolled them over the ground several times.
Figure 16. Surveillance camera image of the explosion. (Credit: WDIO ABC News)
Falling debris forced workers around the refinery to find shelter. An operator recounted:
I ducked and I hid underneath [a vessel] for a couple of seconds, for everything
to pass. And then I ran to the control room. […] Before I went in the control
room, I turned around and it was a big ball of fire.
47
In the FCC control room, witnesses reported hearing two nearly simultaneous explosions that shook the
building. The lights went out, and their immediate response was to go outside to see what happened. An
operator recounted the initial moments in the control room:
[I] went to the north door of the control room, opened it up. One of the operators
screamed, “Gas!” We didn’t know if it was HF or a vapor cloud. [...] We all met
in the middle of the control room and thought we were trapped in there. One of
our operators [...] came stumbling in. He was outside during the time of the blast.
[...] So we opened the north door. We saw a crack of daylight. We saw the asphalt
coming from [Tank] 101 hitting the road to our left, vapor cloud to the right,a and
ran.
The explosion happened to occur during a scheduled contractor break time, and many workers had already
moved into blast resistant buildings or away from the process unit.b The explosion knocked down and injured
workers in the FCC unit and propelled metal debris across the entire refinery. Approximately a hundred metal
pieces, some up to several feet in length, were thrown up to 1200 feet from their original location. Contractors
and refinery employees evacuated to muster points around the refinery.
2.3.2 Asphalt Spill Response

Hot asphalt continued to spread into a large portion of the refinery while emergency responders completed their
firefighting in the FCC area and managed the injured. The asphalt spill, outlined in the solid yellow line in
Figure 19, covered the entirety of the FCC unit and a portion of the alkylation and crude units.
a
There were white vapors coming from the spilled hot asphalt (Figure 18).
b
Husky Superior Refinery completed several facility siting projects, which included building upgrades in 2010-2011. In addition, Husky
Superior Refinery had moved contractor trailers out of the refinery in the early 2000s, and beginning in 2013, required blast-resistant
trailers for contractor use during turnarounds. This was an industry recommendation from the CSB as a result of the 2005 BP Texas
City incident, where a series of explosions killed 15 workers and injured 180 others during a startup from a turnaround [192]. An FCC
operator told CSB investigators, “I happened to be on a good spot when it went off. I was in the thick wall control room when it went
off. [...] The money they spent right away we said was worth it.”
48
Figure 19. Asphalt spill shortly before it ignited. (Credit: Husky Superior Refinery with modifications by CSB)
As Husky Superior Refinery personnel and emergency responders convened to discuss the next steps, they
hesitated to spray water onto the asphalt due to the water's potential to vaporize violently upon contact with hot
oil.a A manager recalls,
[T]here was discussion on whether or not we’d deploy water on the hot asphalt.
You know, we’ve all been trained not to [...] [I]t’s a violent reaction, 1700 times
expansion, and so we were agonizing over to put water on or not. [...] [I]t was a
tough call, because you’ve got asphalt in your units.
Refinery employees attempted to contain the asphalt leak by transferring some of the liquid level out of Tank
101. An operator opened a valve on a transfer line to drain as much asphalt as possible from Tank 101 into a
nearby, empty storage tank. A witness recalled, “The refinery employees were concerned about the
accumulation of asphalt on the ground and were focused on applying sand and containment booms to limit the
a
Water is more dense than oil, and expands up to 1700 times its volume when it vaporizes. Adding water to hot oil is dangerous because
the water could vaporize almost instantaneously and spray the hot oil to its surroundings, creating a more dangerous situation. See this
video by The Royal Institution for a demonstration of what happens when a small amount of water is added to burning oil [193].
49
spread.” However, asphalt continued to spread through the refinery, up to 8 to 10 inches thick in the FCC
operating area.
With no more apparent means left to stop the leak and unsure of how to manage the hot asphalt, refinery
employees decided to retreat and reassess the situation.
2.3.3 Asphalt Fire

Around 12:00 p.m., the asphalt ignited at the storage tank. A witness who had evacuated the FCC unit to a
muster point and was watching the asphalt spread across the refinery recalled,
[A]ll of a sudden, [a coworker] looks over and he goes, “What’s that?” And right
where that hole is, there was fire coming out of it. [...] It was coming out of the
hole [on the storage tank]. [...] It wasn’t going up into it. It was coming out of it.
Because there was a lot of volume still coming out. But all of a sudden, it was
coming out in like lumps of fire.
An emergency responder recounted,
The fire was inside the tank in the very beginning. As I was watching it, we had
discussion about what to do and how to introduce [a fire extinguishing] agent
into the tank because it was never on the ground.
The flames then began to spread across the ground, around asphalt storage tanks, throughout the crude unit, and
in the FCC unit. Upon seeing the asphalt fire begin, a refinery manager activated the deluge system around the
HF tanksa and evacuated the area. Around this time, the incident command team called for a full evacuation of
the refinery.
Once the asphalt caught fire, Superior Fire Department personnel joined Husky Superior Refinery’s incident
command post at the administration building.b There, the team reviewed the police department’s live drone
footage to assess the fires and develop a firefighting strategy.
Shortly after the asphalt ignited, wind blew the smoke from the incident towards the command post at the
refinery’s administration building, which was located to the east-southeast of the fire. The incident command
team moved its command post upwind to offices behind a shopping center, about two miles north of the
refinery.
a
The deluge system is a safety device that creates a flowing water curtain around the tank, preventing it from overheating. The water
mitigation system is also designed to minimize the amount of HF released to the atmosphere in a loss of containment event. Husky
Superior Refinery reported that no HF was released during this incident [55].
b
The National Incident Management System (“NIMS”) defines a unified command as follows: “When more than one agency has
incident jurisdiction, or when incidents cross political jurisdictions, the use of Unified Command enables multiple organizations to
perform the functions of the Incident Commander jointly. Each participating partner maintains authority, responsibility, and
accountability for its personnel and other resources while jointly managing and directing incident activities through the establishment of
a common set of incident objectives, strategies, and a single Incident Action Plan (IAP).” Organizations represented in a unified
command may include law enforcement, fire, public health, public works, and other entities [169, pp. 22, 35].
50
The widespread, burning, spilled asphalt drove back the emergency response teams. The spilled asphalt kept
them from driving firefighting apparatuses in from the north, and the firefighters believed that the intense heat
from the fire would have evaporated their foam solution so quickly that it would have been ineffective at
smothering the fire.
For the remainder of the afternoon, the Superior Fire Department and Husky Superior Refinery’s emergency
response team worked to extinguish the smaller fires around the refinery, brought in additional foam and
firefighting apparatuses from a nearby airport, and contained the large fire in the FCC and crude units.
At about 5:00 p.m., the wind changed direction, and the Superior Fire Department and Husky Superior
Refinery’s emergency response team seized the opportunity to attack the large tank fire. Their initial attack
cooled the spilled materials and surrounding areas with water. Then they switched to foam to smother the fire
(Figure 20). The main asphalt fire was extinguished shortly before 7:00 p.m. [48] . The massive fire had been
extinguished in a matter of hours, as opposed to days as initially anticipated.
Figure 20. Tank fire during and after extinguishment. (Credit: Left: CSB, Right: Superior Police Department [49])
In 2019, the CSB released an Emergency Response Safety Message video about the firefighting strategy and the
collaboration between Husky Superior Refinery and the Superior Fire Department [49]. The video addressed the
difficulties of extinguishing an asphalt fire as well as the benefits experienced from a close working partnership
between the Superior Fire Department and Husky Superior Refinery.
2.3.4 Community Evacuations

As the asphalt burned that afternoon, the plume (Figure 21) was visible from Duluth, Minnesota. One resident
reported smelling burnt rubber from the University of Minnesota Duluth campus [50, pp. 93-94].
51
Figure 21. Smoke from the fire at Husky Superior Refinery. (Credit: WDIO ABC News)
The incident occurred on a clear day with an average temperature of approximately 48 °F. Wind speed was 15
mph towards the east-southeast direction at the time, but shifted to the south direction by the time the asphalt
fire began at around 12:00 p.m. Wind gusts ranging from 21 to 26 mph began around 10:00 a.m. and did not
subside until after 5:00 p.m., when firefighters could make better progress on extinguishing the large fire [51].
The Douglas County Emergency Management System issued its first community evacuation notice at around
1:00 p.m. [52]. By 1:35 p.m., based on plume modeling, the unified command updated the evacuation zone to
span 2 miles north, 3 miles to the east and west, and 10 miles south of the refinery (Figure 22) [53]. The
evacuation zone served two purposes: to protect the public from the smoke plume, and as a precautionary
measure in case the incident escalated and compromised the refinery’s HF equipment [54]. After the incident,
Husky Superior Refinery reported that the safety measures for its HF Alkylation unit operated as designed
during the incident and that no HF was released [55].
52
Figure 22. Evacuation Zone on April 26, 2018. (Credit: Douglas County, Wisconsin)
Husky Superior Refinery reported that the City evacuated 2,507 people. Many of the Superior residents gathered
at the Duluth Entertainment Convention Center. At 8:00 p.m., the city of Duluth issued a shelter-in-place
advisory, as winds were predicted to shift overnight [48].a
The incident command post relocated several times after the asphalt fire began, upwind of the smoke. By
evening, the unified command had set up its emergency operations center at the Superior Government Center,
about three miles away from the refinery. The unified command, which included representatives from Husky
Superior Refinery, Superior Fire Department, Superior Police Department, EPA, and others, monitored air
quality overnight. The evacuation orders were lifted at 6:00 a.m. the next morning [54].
a
Wind direction was predicted to shift in the direction of Duluth in the evening [48]; however, this shift did not occur until 6:00 a.m. the
next morning, after the Superior evacuation and Duluth shelter-in-place advisories were lifted [162, 54].
53
2.4 Incident Consequences

Injuries
Husky Superior Refinery reported that the explosion and fire on April 26, 2018 resulted in 11 OSHA recordable
injuries, none of which were life threatening.a Overall, 36 refinery and contract workers received medical
treatment, predominantly for complaints of lacerations, contusions, fractures, blast injuries, and symptoms
related to smoke inhalation. There were no fatalities.
Environmental impact
Husky Superior Refinery reported that it released 39,000 pounds of a flammable hydrocarbon vapor mixture as
well as approximately 17,000 barrels of asphalt during the event.
Husky Superior Refinery collaborated with the Environmental Protection Agency (“EPA”) and the Wisconsin
Department of Natural Resources (“WDNR”) to address the incident's environmental impacts, including air and
water monitoring. The EPA also worked with the Agency for Toxic Substances and Disease Registry,
Wisconsin Department of Health Services, and the Douglas County Health Department to provide information
to the public.
Husky Superior Refinery conducted a significant community monitoring program and shared results of that
monitoring with the public through the Douglas County Department of Emergency Management. Air monitoring
readings were collected 24 hours/day, 7 days/week in the community and at the refinery through May 25, 2018.
Through June 19, 2018, Husky Superior Refinery collected over 88,000 air monitoring readings in the
community and over 48,000,000 readings at the refinery. All results from this air monitoring were within
regulatory guidelines.
Some of the firefighting foamb and petroleum compounds migrated into Newton Creek, which feeds into Lake
Superior. Husky Superior Refinery captured and, with WDNR’s approval, treated around 21 million gallons of
firefighting water used on the day of the incident to remove contaminants and prevent a larger release. A year
after the incident, WDNR reported that impacts to aquatic life appear to have been minimal [56].
Refinery impact
Husky Superior Refinery reported that this incident resulted in $550 million of on-site and $110,000 of off-site
property damage. In its 2022 report, Marsh JLT Specialty listed Husky Superior Refinery incident in its 100
a
OSHA requires many employers with more than 10 employees to keep a record of serious work-related injuries and illnesses.
Recordable injuries are fatalities or injuries and illnesses requiring medical treatment beyond first aid. More details can be found on
OSHA’s website [188].
b
Some formulations of firefighting foam contains per- and polyfluoroalkyl substances, known as PFAS, which EPA is evaluating as a
water contaminant that may be linked to cancer and other health issues [189]. Newton Creek is not a source of drinking water for the
city of Superior [56].
54
Largest Losses in the Hydrocarbon Industry report as having the 33rd largest adjusted property damage lossa in
the hydrocarbon extraction, transport, and processing industry since 1974 [57, p. 50]b
Husky sent additional resources to Husky Superior Refinery to help the refinery recover from the damage over
the next several months. Husky Superior Refinery personnel spent the following months stabilizing and
chemically cleaning the refinery equipment. In addition, EPA worked with the State of Wisconsin and the
Husky Superior Refinery to help clean up the asphalt and other petroleum streams from damaged piping that
spilled into the refinery.
SRC obtained a permit to rebuild Husky Superior Refinery in September 2019 and began construction soon after
[58]. As of 2022, the Superior Refinery had spent $1.2 billion on its rebuild project to start up in 2023 [59, 60,
18, p. 21, 61].
a
The Marsh report explains how the adjusted property damage loss is determined: “Adjusted property damage loss, based on the value of
loss as of December 31, 2021. This involves the use of cost indices to allow like-for-like comparison of losses that have occurred years
apart” [57, p. 4].
b
The Marsh report explains how the incident ranking is determined: “Losses are ordered according to the adjusted property damage loss
values. These loss amounts include property damage, debris removal, and clean-up costs. However, costs related to business
interruption, extra expenses, workforce injuries or fatalities, and any liability claims are excluded” [57, p. 4].
55
3 Technical Analysis
3.1 The Explosion
Below is a discussion of the oxygen, fuel, and ignition sources that combined inside the FCC unit during the
shutdown, making the explosion possible.
Oxygen source
The regenerator operates with air during normal FCC operation and uses air to cool down the regenerator as part
of the normal shutdown process. Most of the air exits through flue gas piping into the atmosphere.
In an FCC unit, the air inside the regenerator is typically separated from flammable hydrocarbon inside the
reactor by pressure differences created during catalyst circulation. On the day of the incident, after the shutdown
began and catalyst circulation stopped, the regenerator continued to operate at a higher pressure than the reactor.
Because gas flows from high to low pressure, air from the regenerator entered the reactor past the catalyst slide
valves through the flow paths pictured in Figure 23.
56
Figure 23. Air flow paths from the regenerator to the reactor on the day of the
incident. (Credit: CSB)
Steam was also being injected into the reactor during the shutdown. The air and steam continued through the
reactor and flowed into the main column. See Figure 24 for a comparison between UOP-intended and actual
flow paths during the shutdown. As is typical during the initial hours of an FCC unit shutdown, the reactor and
the main column were still interconnected without a means to block flow between them. In the main column
overhead system, the steam condensed to water within the main column overhead condensers (not pictured), but
the air remained in the vapor phase and migrated into the gas concentration unit through the wet gas compressor,
57
along with other non-condensable, but flammable hydrocarbon gases. During this four-hour period (described in
Section 2.1.3), the air entering the gas concentration unit mixed with the flammable hydrocarbon vapors. As
refinery operators were lowering the pressure within the gas concentration unit as part of the shutdown process,
the sponge absorber’s pressure control valve closed, stopping the flow of non-condensable vapor exiting the
system and trapping the air entering the gas concentration unit from the main column overhead receiver to
remain in the system. With nowhere to go, the air accumulated and mixed with the flammable hydrocarbon
gases, creating the dangerous conditions for an explosion.
Figure 24. Comparison of UOP-recommended (above) and actual (below) flow directions
during the shutdown. (Credit: CSB)
58
Hydrocarbon source
During normal operation, most of the propane and heavier hydrocarbons are in a liquid phase within the gas
concentration unit. At the time of the explosion, the primary and sponge absorbers had been emptied of liquid
but were pressured up to about 166 psig with a dangerous gas mixture that likely contained methane, ethane,
some propane, oxygen, and nitrogen. Methane, ethane, and propane, which are all flammable gases, can only
ignite if the oxygen concentration is greater than about 11 percent of the vessel’s volume [43].a The CSB
calculated that if only about 0.2 percent of the cumulative air flowing into the regenerator was able to migrate
into the gas concentration unit throughout the first four hours following the start of the FCC unit shutdown,
sufficient oxygen could accumulate inside the primary and sponge absorber vessels to develop explosive
conditions.b
Ignition source
Husky Superior Refinery had planned to chemically clean the gas concentration unit to remove hazards before
opening up the equipment for maintenance or inspection work. One of these hazards to be removed was
pyrophoric materials, such as iron sulfide (FeS), which can smolder when exposed to air and generate enough
heat to start a fire or trigger an explosion inside equipment. In 2003, an investigation by Koch-Glitschc into 56
incidents of fires inside distillation columns during maintenance activities found that most of them involved
pyrophoric ignition [62].
Refineries typically inject an oxidizer, such as sodium permanganate, into equipment to neutralize pyrophoric
material that has accumulated inside equipment before it is opened and air can enter [62]. At the time of the
incident, Husky Superior Refinery had not yet started this chemical treatment step. In this case, the air came not
from opened equipment but from the air blowers supplying air to the FCC regenerator. Post-incident chemical
analysis confirmed the presence of iron sulfide compounds on the explosion debris from the primary absorber.d
Some of the iron sulfide compounds that were found, such as troilite, pyrrhotite, and mackinawite, are known to
be pyrophoric substances, meaning that they are subject to spontaneous combustion when dry and exposed to
oxygen [63, pp. 8-9].
The CSB concludes:
• The primary absorber and sponge absorber explosion resulted from the ignition of a flammable mixture
of oxygen and hydrocarbon vapors that formed inside the process equipment.
a
The limiting oxygen concentration (expressed in units of volume percent of oxygen) is defined as the minimum concentration of oxygen
below which combustion is not possible, independent of the fuel concentration. The limiting oxygen concentration depends on pressure,
temperature, and the type of inert gas [43]. Some experimental studies show that the limiting oxygen concentration for a flammable gas
could be lower at higher pressures [171].
b
Because some of the gases were purged out of the system prior to 9:00 a.m., CSB also calculated that about 1.4 percent of the total
regenerator air in the final hour leading up to the incident would have been enough to accumulate up to a minimum explosive limit of
11 percent oxygen in the vessels and piping in the gas concentration unit up to the explosion location.
c
Koch-Glitsch provides equipment and services related to mass transfer and separations equipment in chemical, petrochemical, refining,
gas processing, pharmaceutical, and specialty chemical industries, such as refinery distillation columns [202].
d
Chemical analysis indicated the presence of multiple iron and sulfur-bearing compounds in the scale samples as well as the iron-oxide
compound magnetite (Fe3O4) and maghemite (Q * Fe2O3). No scales were identified on the sponge absorber fragments.
59
• While Husky Superior Refinery’s FCC unit was shutting down, the regenerator continued operating at a
higher pressure than both the reactor and the main column. As a result, some air continually flowed
from the regenerator, through the reactor, and into the main column for approximately four hours.
• During the shutdown, while air was entering the main column, the FCC unit’s wet gas compressor
continued operating and directed the air collecting inside the main column’s overhead receiver into the
gas concentration unit, where it accumulated until it created an explosive mixture with the flammable
hydrocarbons. Oxygen from the air likely reacted with the pyrophoric deposits inside the primary and
sponge absorbers, generating heat and providing the ignition source for the catastrophic explosion inside
the equipment.
3.2 Transient Operation Safeguards in FCC Units

Shutting down a process unit is one type of operating mode known as “transient operations.” The Center for
Chemical Process Safety (“CCPS”) defines transient operations as:
The operating mode when the process is in transition and is not in its normal
operations mode.
Note: Transient operations include process start-ups and shut-downs, product

transitioning in between normal operations, non-routine activities performed
during normal operations, and activities associated with the project life cycle
(e.g. commissioning and start-up of new capital projects, mothballing, and
decommissioning) [64, p. 5].
Transient operations include “procedure-based operations,” as they typically involve implementing a stepwise
procedure [65, p. 28], such as in a startup or shutdown. In an article titled, “Tame Your Transient Operations,”
two authors from the ExxonMobil Chemical Company also include “non-routine operations” and “abnormal or
unplanned operations” under their definition of transient operations. They explain:
A common element in transient operations is the requirement for increased

human interaction with the process. Often the operator and the procedural
controls are the key layer of protection in preventing an incident [66].
Transient operations can pose unique hazards that are not applicable during the normal operations of a process
unit. A series of studies by I. M. Duguid (1998, 2005) showed that although a typical refining or petrochemical
facility spends less than 10 percent of its time in transient operations, about half of major process safety
incidents occur during these transitions [66, 67].
A typical FCC unit can operate safely for years during normal, continual operation; however, transitioning the
unit down during a turnaround introduces unique and potentially hazardous conditions. During normal,
continual FCC unit operation, pressure differences created and controlled in part through catalyst circulation
keep the air and hydrocarbon systems mostly separated [25, p. 8, 29, p. 42]. During a shutdown, catalyst
circulation typically stops, equipment pressures change, and the potential for an explosive mixture of air and
hydrocarbon remains a hazard until the reactor can be physically isolated from the main column.
60
A typical FCC unit shutdown requires a number of operational steps before maintenance workers can
mechanically isolate the FCC unit’s air and hydrocarbon systems by inserting a blind (a metal plate) in the
piping connecting the two systems. Until mechanical isolation is possible, operational practices are necessary to
prevent the hazardous mixing of air and hydrocarbons.
Table 2 compiles some of the most common industry practices and UOP’s General Operating Manual guidance
to protect against the air and hydrocarbon mixing hazard during FCC unit transient operations, such as startups,
shutdowns, and standbya operation [68]. Though some of the safeguards are active (automated) controls, some
of the most important safeguards are procedural, meaning that they require operator actions to implement [69, p.
10].b
a
FCC units can transition to various “standby” postures while hydrocarbon feed is stopped to the FCC reactor for troubleshooting or
maintenance [194].
b
Board and field operator actions vary based on the FCC unit technology and unit configuration, but some field operator action examples
may include: field-verification that the valves required to close are closed; opening the reactor vapor line vent valves; opening the main
air blower discharge vents; starting a natural gas injection into the main column; switching purge media on reactor catalyst differential
pressure instruments between nitrogen and natural gas.
61
Table 2. Typical FCC unit safeguards to prevent explosive process conditions during transient operations.
Safeguard Description Implementation Control Type
Reactor steam Sufficient steama flow into the reactor Operators set the pressure inside the Procedural
barrier maintains the pressure inside the reactor higher than both the regenerator
reactor as the highest pressure point in and main column pressures using flow and
the system. This critical steam barrier pressure control valves [35, p. 11].
separates the air and hydrocarbon Operators take emergency actions if
systems on either side of the reactor target pressure differences between the
by flowing outward from the reactor, equipment cannot be achieved. These
preventing the air and hydrocarbons actions are not automated in most FCC
from forming an explosive mixture. units.
Main column A continual vapor flow through the Operators introduce non-condensable gas Procedural
gas purge main column into the flare system to the main column to maintain a slightly
prevents oxygen accumulation in the open position on the main column’s
main column system. pressure control valve. Some sites monitor
the equipment's oxygen content during
this operation.
Catalyst slide Closed slide valves reduce gas flow Spent and regenerated catalyst slide Active/
valvesb between the reactor and the valves close automatically based on Procedural
regenerator. These valves are not predetermined process conditions (such
designed to be gas-tight. Small as low differential pressure across the
amounts of vapor continue to flow valves). During shutdowns, operators also
through the valves from high to low close the valves manually.
pressure.
Catalyst levels Catalyst remaining in the reactor, Typically, it is difficult to monitor and Passive/
regenerator, and standpipes reduces control unfluidized catalyst. Procedural
gas flow between the reactor and the The effectiveness of catalyst levels, and
regenerator. Small amounts of vapor whether they are fluidized, depends on
continue to flow through the catalyst the unit’s configuration.
from high to low pressure.
Wet gas Stops vapor flow from the main Operators shut down the wet gas Procedural
compressor column to downstream equipment. An compressor soon after gas production
shutdown explosion hazard could still exist in the inside the FCC reactor stops.
main column, but is eliminated in
downstream equipment.
Electrostatic Eliminate ignition sources from the Automated or operator-initiated Active/
precipitator electrically charged equipment in the shutdown of the electrostatic precipitator Procedural
shutdown flue gas system. (ESP) during transient operation.c
Process block Various valves isolate hydrocarbon In many units, the isolation valve(s) close Active/
valves sources from entering the reactor, automatically when the unit shuts down. Procedural
such as liquid feed. Operators can also close them manually.
Before its FCC unit shutdown on April 26, 2018, Husky Superior Refinery had not developed or implemented
some essential safeguards needed to shut down an FCC unit safely, which are discussed further in the Safety
Issues section of this report:
a
Steam is most commonly used, but any inert gas, such as nitrogen, could also be used to create an inert barrier inside the reactor.
b
The applicability of the catalyst slide valve safeguard varies by unit configuration; some FCC designs do not have slide valves.
c
Applicability depends on unit configuration; some FCC units do not have ESPs.
62
• Using the reactor as a “steam barrier” to prevent inadvertent oxygen flow from the regenerator into the
main column (Section 4.1.1).
• Adding non-condensable gas flow into the main column to purge oxygen from the system and to prevent
oxygen from concentrating (Section 4.1.2).
• Monitoring the amount of oxygen in the process equipment to provide an alert of potentially dangerous
oxygen accumulation (Section 4.1.2).
• Shutting down the wet gas compressor to prevent sending oxygen into the downstream gas
concentration unit (Section 4.1.2).
The only safeguard that Husky Superior Refinery implemented on the day of the incident was use of the catalyst
slide valves, which limited but did not prevent air flow from the regenerator into the rest of the FCC unit. The
lack of the other essential FCC safeguards listed above allowed air and hydrocarbon to create a flammable
mixture inside process equipment and explode upon finding an ignition source inside the gas concentration unit.
63
4 Safety Issues
This section discusses the safety issues the CSB identified in its investigation, which include:
1. Transient Operation Safeguards. At the time of the incident, Husky Superior Refinery was shutting
down the FCC unit, a transient operation mode. During an FCC unit shutdown, it is critical to separate
air from hydrocarbons to prevent an explosive mixture, because unlike most refinery operations, an FCC
unit processes both air and flammable hydrocarbons inside interconnected process equipment,
increasing the likelihood of an explosion. This separation is typically achieved using FCC technology-
specific safeguards. Most of these safeguards were either not implemented or not effective at Husky
Superior Refinery during its April 26, 2018, FCC unit shutdown. In general, most safeguards necessary
for safe transient FCC unit operations are procedure-based and rely heavily on operator actions, because
not every action can be automated during an FCC shutdown. These procedural safeguards offer weaker
protection compared with engineered safeguards. In such cases, hands-on operator training, such as
drills and simulators, is crucial for hazardous operations that are controlled primarily by procedural
safeguards, such as transient FCC operation. In addition, the petroleum refining industry should
continue to design and implement safeguards that are higher on the hierarchy of controls to improve
process safety in FCC units during transient operation. (See Section 4.1)
2. Process Knowledge. Husky Superior Refinery’s FCC technology-specific process knowledge was not
sufficient to safely shut down the FCC unit for a turnaround. Its employees did not adequately
understand or know how to effectively control the FCC unit’s transient operation hazards. As a result,
Husky Superior Refinery was not aware that its FCC unit shutdown procedure was not aligned with the
technology licensor’s guidance that had been in place and provided to the refinery since the unit was
designed in 1960. For much of Husky Superior Refinery’s history, its FCC expertise was mostly in-
house, and with minimal engagement with other refineries. While key individuals attended the
licensor’s FCC training classes, this individual training did not establish sufficient knowledge or
competency within Husky Superior Refinery to prevent the April 2018 incident. Husky Superior
Refinery’s management encouraged individuals to attend industry events, but such participation was not
mandatory. In addition, Husky Superior Refinery’s use of external technical experts was limited to
assessing the FCC unit’s performance during normal operation. (See Section 4.2)
3. Process Safety Management Systems. OSHA’s PSM Standard and the EPA’s RMP Rule require
facilities like Husky Superior Refinery to implement process safety management systems to identify,
evaluate, and control their process hazards. Husky Superior Refinery did not effectively implement
process safety management systems, which also contributed to the incident. These included Husky
Superior Refinery’s process safety information that did not include the FCC technology licensor’s
operating manual, process hazard analyses that did not effectively identify or control hazards inherent to
FCC unit transient operation, operating procedures that lacked clear instructions and were not
technically evaluated, and an operator training program that did not properly prepare the operators to
shut down the FCC unit safely. (See Section 4.3)
4. Industry Knowledge and Guidance. Husky Superior Refinery incident occurred less than one year
after the CSB released its investigation of another FCC unit transient operation explosion in California.
Despite the refining industry’s education efforts, Husky Superior Refinery employees were not aware of
or did not learn lessons from the 2015 Torrance incident that could have helped them to prevent the
April 2018 incident. FCC technology is developed and licensed by more than six companies, each with
64
its own designs and configurations. Furthermore, portions of many older FCC units in the United States
have been revamped by multiple technology licensors. Currently, there is no technical industry safety
document that establishes common basic process safety expectations for all FCC units. To prevent
future chemical disasters, the refining industry must address the FCC unit process safety knowledge
gaps that may still exist at their facilities. (See Section 4.4)
5. Brittle Fracture During Extreme Events. The primary absorber and sponge absorber vessels failed by
brittle fracture (shattering like breaking glass), which sent more than 100 pieces of metal debris
throughout the refinery, striking workers and operating equipment. These vessels were constructed of
the American Society of Testing and Methods (“ASTM”) A-212 and A-201 grade steels, which are no
longer recommended for new equipment. Had the vessels been constructed of a newer grade of steel
with better toughness properties, they should have ruptured by ductile fracture (tearing open like a
zipper or fish mouth) with a reduced impact on their surroundings. (See Section 4.5)
6. Emergency Preparedness. The explosion debris struck an upper portion of an asphalt tank, which
caused asphalt to spill outside the containment area and into the refinery. The likely ignition source that
set fire to the asphalt was pyrophoric material inside the storage tank that smoldered when exposed to
the air that entered through the punctured tank wall. Husky Superior Refinery could not prevent the hot
asphalt from igniting due to the unexpected extent of the spill, competing priorities of responding to the
FCC unit explosion, and uncertainty by refinery employees about how to properly mitigate a large area
of spilled hot, ignitable asphalt. (See Section 4.6)
The graphical causal analysis (AcciMap) is in Appendix A.
4.1 Transient Operation Safeguards

The following sections discuss key deficiencies in Husky Superior Refinery’s safeguards surrounding its FCC
unit’s shutdown that contributed to the explosion. The safeguards discussed in this report are:
1) Reactor steam barrier (Section 4.1.1);
2) Main column gas purge (Section 4.1.2); and
3) Catalyst slide valves (Section 4.1.3).
4.1.1 Reactor Steam Barrier
4.1.1.1 Factual Information

UOP recommends adding steam to ensure the reactor pressure remains above the regenerator pressure during
FCC unit startups and shutdowns. This action creates the reactor steam barrier between the main column and the
regenerator. Figure 25 illustrates how the reactor steam barrier (in gray) works during a typical FCC shutdown.
Steam is continually added to the reactor to keep the pressure inside the reactor above the regenerator pressure
and slightly above the main column pressure. By doing so, the steam pressure in the reactor works as a barrier,
keeping the air (in blue) and hydrocarbon (in yellow) away from each other [30, p. 11]. Adjusting steam and air
65
flows to ensure the reactor is held at a higher pressure than the regenerator (a negative regenerator-reactor
differential pressure) is typically controlled by operator actions [30, p. 13, 70, p. 6].
Figure 25. FCC unit steam barrier and instrument configuration in typical industry practice. (Credit: CSB)
In the 2016 version of UOP’s General Operating Manual—the most recent version Husky Superior Refinery had
at the time of the April 2018 incident—UOP provides the following guidance in the shutdown procedure section
after removing the oil feed and injecting steam into the riser:
• “Slowly decrease the regenerator-reactor differential pressure to get a slightly higher

pressure in the reactor than in the regenerator.”
• “Keep the regenerator pressure lower than the reactor pressure by maintaining a negative
differential pressure between the regenerator and reactor at all times.”
UOP does not specifically call out the reactor steam barrier safeguard or otherwise explain the safety purpose
behind its guidance to maintain the reactor at a higher pressure than the regenerator in the shutdown section of
its manual; however, UOP states that “The shutdown of the FCC unit is essentially the reverse of the startup.”
As discussed previously, the transient operation safeguards discussed in Section 3.2 typically apply to both
shutdowns and startups. UOP provides the following explanation in the startup procedure section:
The differential pressure between the reactor and regenerator should be

maintained at a negative 0.10-0.20 kg/cm2 [1.4-2.8 psi]a (reactor pressure higher
than regenerator). This will ensure that any leakage through the slide valves will
put steam into the regenerator rather than air into the reactor.
NOTE: The steam in the riser and stripper acts as a buffer between the
regenerator containing air and the main column which contains some fuel gas.
a
0.1-0.2 kg/cm2 converts to 1.4-2.8 psi.
66
Husky Superior Refinery’s files included an older FCC unit manual. Though the CSB was unable to determine
what year it was published and by whom, similarities to UOP’s 2016 document suggest that this was an earlier
version of UOP’s General Operating Manual possibly dating back to the plant’s original design in 1960. This
older manual, referred to as the “1960 manual” in this report, also described the safety purpose for establishing
and maintaining a reactor steam barrier during a typical startup:
The differential pressure between the reactor and regenerator should be

maintained at a negative 1.5 psig.a This will [ensure] that any leakage of the slide
valves will put steam into the regenerator rather than air into the reactor.
In the shutdown procedure section, the 1960 manual first instructed operators to reduce the regenerator-reactor
differential pressure (but keeping it above zero), empty the reactor (including the spent catalyst standpipe), and
then to further reduce the regenerator-reactor differential pressure to obtain a negative differential:
With 1 psi differential pressure between the reactor and regenerator, milk the
remaining catalyst out of the stripper until the spent catalyst slide valve will no
longer build any differential pressure. Adjust the vessel differential pressure to
assist this procedure.
Close the spent catalyst slide valve and leave the flue gas slide valve on automatic
control to obtain a negative [Regenerator-Reactor] differential [...].
Refer back to Figure 25 for typical instrumentation used to manage the steam barrier [30, p. 11]. The
regenerator-reactor differential pressure controller adjusts the flue gas valve’s position as needed to maintain a
desired difference between the regenerator pressure and the reactor pressure. When hydrocarbon feed is diverted
from the FCC reactor, UOP representatives told the CSB that UOP currently recommends raising the reactor
pressure approximately 2 psi above the regenerator pressure.b UOP discusses these concepts in its week-long
classroom training that it offers its clients. UOP representatives also told the CSB that FCC operators should
take emergency actions if they cannot maintain the reactor steam barrier when needed.
Some of Husky Superior Refinery employees did not appear to be aware of using the reactor steam barrier as a
safeguard during an FCC unit shutdown. In fact, employees told CSB investigators that the reason for injecting
steam into the FCC reactor during a shutdown was just for “blasting the riser out” to prevent it from plugging up
with oil. Operators, engineers, and managers who had worked on the FCC unit did not mention or appear to
understand the safety purpose of establishing and maintaining the reactor steam barrier to prevent the dangerous
mixing of air and flammable hydrocarbons. Some employees found out about UOP’s recommendation to keep
the reactor pressure higher than the regenerator pressure with steam only after the explosion, likely after Husky
completed its incident investigation.
As an example of one refinery operator who did not appear to understand the concept of the reactor steam
barrier, a board-qualified operator described the initial steps used during the shutdown. The operator stated to
CSB investigators that after “blasting” the oil out of the riser at the beginning of the shutdown, “at some point
a
“Negative 1.5 psig” means that the reactor pressure is 1.5 psig higher than the regenerator pressure.
b
If the differential pressure is outside of the instrument’s range, the reactor and regenerator pressure readings could be monitored
individually.
67
you can cut that back and then, at that point, I’m not...I’m not exactly sure why you just keep having steam
going in.”
Below are Husky Superior Refinery’s operating procedure steps that instructed operators to adjust steam flows
into the reactor during the FCC unit shutdown:
• “Blast Riser with steam a few times to drive catalyst out of Riser into the Stripper.”
• “Raise Reactor Stripping Steam to maximum for 10 minutes, then back to 100 [pounds per hour].”
• “Cut Steam to the Riser to a minimum (1000 [pounds per hour]).”
In addition to specifying constant steam flow rates, Husky Superior Refinery’s shutdown procedure instructed
the board operator to set the regenerator pressure higher than the reactor and main column pressures, the
opposite of what the UOP guidance prescribes. Figure 26 is an excerpt from the shutdown procedure used on
the day of the incident. The highlighted sections are the only places that mention pressure relationships between
the regenerator, reactor, and main column in the shutdown procedure.
Figure 26. Excerpt from the shutdown procedure used on the day of the incident. (Credit:
Husky Superior Refinery with annotations by CSB)
Figure 27 illustrates the pressure instruments available to the board operators: pressure instruments at the
regenerator and at the main column overhead receiver, and a differential pressure instrument that measured the
pressure difference between the regenerator and the reactor.
68
Figure 27. Husky Superior Refinery’s pressure instruments on the reactor, regenerator, and
main column systems. (Credit: CSB)
Husky Superior Refinery’s FCC unit normally operated with a higher regenerator pressure than the reactor
during its continuous, steady-state operation. The original instrument data sheets from 1961 specified a
regenerator-reactor differential pressure instrument that did not read negative ranges; that is, the indicator would
display zero if the regenerator pressure was lower than the reactor pressure.a This instrument’s range remained
unchanged from 1961 to 2018. The instruments did not functionally change over the life of the plant,b and the
refinery did not add new pressure instrumentation around the reactor and the regenerator.
4.1.1.2 Analysis
The reactor steam barrier is created by increasing the steam flow to the reactor so that the reactor’s operating
pressure is kept higher than the pressures inside both the regenerator and main column. The higher-pressure
steam inside the reactor should ensure that the air and hydrocarbon systems do not mix within the FCC unit;
however, the refinery’s shutdown procedure used on the day of the incident instructed the board operator to
“maintain the regenerator at a higher pressure than the reactor at all times,” which contradicted UOP’s technical
guidance. In addition, the shutdown procedure said to “keep Main Column Receiver pressure 1 pound lower
than the regenerator pressure.” Following these instructions set the refinery on a path towards disaster. Instead
of separating the air and hydrocarbon equipment using a reactor steam barrier, following the refinery’s
shutdown procedure directed air from the regenerator into the main column and the gas concentration unit:
equipment filled with flammable hydrocarbons.
Figure 28 compares the steam and air flow directions through Husky Superior Refinery’s reactor and
regenerator as they were on the day of the incident (left) and as they would have been had a steam barrier been
established per UOP’s guidance (right). In the left image, steam flow (black arrows) is confined to the reactor
and downstream equipment, because the pressure inside the regenerator is too high for steam to enter it. In the
a
UOP representatives told the CSB that UOP had been specifying its reactor-regenerator differential pressure instruments to read down
to -5 psi for at least the past 15 years prior to the incident.
b
During the revamp project in 1994, the refinery upgraded the FCC unit’s controls to a computerized distributed controls system
(“DCS”). The project included instrumentation upgrades to meet the specifications of the new control system. A Husky Superior
Refinery employee told the CSB that the new instrumentation calibration and range information was likely copied from the original
design data sheets. The instrument ranges at the time of the incident matched those originally specified by the original project’s
instrument data sheets in 1960.
69
right image, the air (turquoise arrows) is confined to the regenerator, because the steam pressure inside the
reactor is too high for air to enter. As a result, when there is a reactor steam barrier, the steam pressure directs
the air inside the regenerator towards the atmosphere through the flue gas system.
Figure 28. Comparison of flow directions through the reactor and regenerator
without the steam barrier (left) and with the steam barrier (right). (Credit: CSB)
70
According to industry FCC experts, the reactor steam barrier is the

KEY LESSON most important FCC unit safeguard to prevent a catastrophic explosion
During FCC unit transient during transient operation [68]; however, this safeguard was missing
operations, which include entirely from Husky Superior Refinery’s institutional knowledge and
startup, standby, and shutdowns, operating procedures.
the reactor should be the point
Based on the 1960 manual and discussions with UOP representatives
of highest pressure in the system
and other industry FCC experts, the reactor steam barrier appeared to
until it is isolated from the main
have been part of UOP’s technology and operating philosophy when
column to prevent inadvertent
the Superior Refinery’s FCC unit was designed in 1960. However,
air and hydrocarbon mixing. critical safety information in UOP’s 1960 and 2016 manuals, which
Operators should understand were both in Husky Superior Refinery’s possession, was not reflected
how to manage pressures and in the refinery’s current operating procedures.
flows to avoid entering explosive
process conditions. The CSB concludes that Husky Superior Refinery’s FCC unit
shutdown procedure contradicted UOP’s technical guidance by
instructing refinery personnel to operate the regenerator at a higher pressure than both the reactor and the main
column. Following this procedure directed air into the hydrocarbon-filled main column and downstream
equipment, creating an explosive atmosphere within the equipment. Had Husky Superior Refinery aligned its
shutdown procedure with UOP’s guidelines or industry good practice, the procedure would have properly
instructed operations personnel to keep the air and hydrocarbon systems separate using a reactor steam barrier,
which could have prevented the incident.
Establishing and maintaining an effective reactor steam barrier safeguard to shut down an FCC unit safely
requires a certain minimum-level of instrumentation to allow operators to closely monitor and control the
pressure inside the reactor, the regenerator, and the main column (Figure 29).a Many FCC units have a
differential pressure instrument that measures the difference between the reactor and regenerator pressures, but
this instrument is not required if the operators can compare independent pressure measurements for both vessels.
a
For the steam barrier to be effective, the pressure inside the reactor must also be higher than the pressure inside the main column.
Typically, the FCC unit’s main column pressure controllers reference the pressure measured in the main column’s overhead. However,
industry experts recommend monitoring the pressure near the column’s reactor vapor inlet piping to prevent potential hydrocarbon
inside the main column from backflowing into the reactor, as was the case in the 2015 Torrance refinery FCC incident [45, 68].
71
Figure 29. Missing steam barrier instrumentation at Husky Superior Refinery. (Credit: CSB)
Husky Superior Refinery’s FCC unit was designed to normally operate with the regenerator pressure higher than
the reactor pressure, and the refinery’s differential pressure instrument was not configured to measure or display
the negative numbers needed to establish and maintain the steam barrier during a shutdown. The original UOP
project files specified an independent pressure transmitter for the regenerator, but not for the reactor. Without an
independent reactor pressure instrument, and with a regenerator-reactor differential pressure instrument that did
not measure values lower than zero psi, the original plant design did not allow for operators to establish a proper
reactor steam barrier as UOP described in its General Operating Manual. This instrumentation deficiency was
never identified and corrected before the April 2018 explosion. The CSB concludes that UOP’s original design
for Husky Superior Refinery’s FCC unit lacked a minimum level of instrumentation to shut down its FCC unit
safely using a reactor steam barrier as a safeguard.
In a post-incident discussion in 2020, UOP representatives told the CSB that both the reactor and the regenerator
pressure measurements are viewable from the console in UOP’s current FCC unit designs. In addition, UOP
representatives stated that UOP has been specifying regenerator-reactor differential pressure instruments that
should measure down to -5 psi for at least the past 15 years.
Because Husky Superior Refinery had developed its own practice for shutting down its FCC unit that did not
include the reactor steam barrier, the site likely never tried to maintain the reactor with a higher pressure than
the regenerator during a shutdown.a Had Husky Superior Refinery identified the need to incorporate the reactor
steam barrier into its operating procedures, the gaps in instrumentation should have become apparent, because it
would not have been possible to set the regenerator-reactor differential pressure to a negative value. To meet its
minimum instrumentation needs, the refinery could have changed the existing differential instrument’s
configuration or added a separate pressure instrument for the reactor.
Had Husky Superior Refinery incorporated the reactor steam barrier safeguard into its operating procedures
sometime between the original commissioning around 1960 and the incident in 2018, it likely would have
equipped the FCC unit with the critical pressure instrumentation needed for the refinery’s operators to ensure
a
The Husky Superior Refinery did not retain process data from previous shutdowns; therefore, the CSB could not make comparisons
with past shutdowns.
72
that air and hydrocarbon could not mix during a shutdown, and the April 2018 explosion could have been
prevented.
Since this incident, the Superior Refinery’s FCC rebuild project team plans to install additional instrumentation
to allow operators to establish and maintain a reactor steam barrier, including but not limited to the following:
• an independent reactor pressure transmitter
• a new regenerator-reactor differential pressure instrument that will measure from approximately -5 psi
to +7 psi
• instrumentation to monitor the pressure of the main column and the reactor with an alarm; and
• safety instrumented system to place the reactor/regenerator in a negative regenerator-reactor pressure

difference.
According to the Superior Refinery’s updated 2019 process hazard analysis (“PHA”), training will also be in
place “for Operations to verify there is a proper pressure differential between the Regenerator [...] and the
Reactor” for transient scenarios.
In CSB Recommendation 2018-02-I-WI-R1, the CSB makes a recommendation to Cenovus Superior Refinery
to demonstrate that the new FCC unit equipment, operating procedures, and operator training incorporate the
transient operation safeguards discussed in this report. Part (a) of this recommendation specifically addresses the
implementation of a reactor steam barrier during transient operation.
4.1.2 Main Column Gas Purge

UOP and Husky Superior Refinery Requirements for Wet Gas Compressors
UOP’s 2016 General Operating Manual describes the importance of purging gases into the flare system to
prevent air accumulation in the main column during startups and shutdowns. During normal operation, the wet
gas compressor controls the main column’s pressure by removing gas from the overhead receiver and sending it
to the gas concentration unit. In its shutdown guidance, UOP recommends shutting down the wet gas
compressors early in the shutdown sequence and controlling the main column’s pressure using a continual purge
of non-condensable gas such as fuel gas.a
UOP’s 2016 manual recommends shutting down the wet gas compressor (“WGC”) soon after feed is stopped to
the unit:
a
Non-condensable gases are gases that do not change phase from vapor to liquid in the process. In this application, typical non-
condensable gas sources include natural gas, nitrogen, and vaporized LPG [175]. Steam is a condensable gas in the main column system
because it condenses to water when it passes through the main column overhead coolers [30, p. 13].
73
When oil is bypassed, the gas production in the reactor will decrease very
rapidly.a Shut down the wet gas compressor according to the manufacturer’s
instructions and block it in.
The 1960 manual was more specific about when to shut down the wet gas compressor and how to control the
system pressure:
When both catalyst slide valves are shut, and the flue gas slide valve is on control,
the gas compressor can be shut down. Continue controlling reactor main column
pressure with the makeup gas from the fuel system.
Husky Superior Refinery’s FCC unit was equipped with three reciprocating wet gas compressors configured in
parallel. The refinery’s shutdown procedure did not specify when to shut down each of the three wet gas
compressors. In addition, it did not specify how to control the main column pressure during the shutdown. The
following Husky Superior Refinery shutdown procedure step, after stopping feed to the reactor, states:
As gas make drops off, unload Gas Compressors. Take one off the line when it
is no longer required. Shut it down and block it in.
UOP representatives told CSB investigators that the wet gas compressor shutdown timing was unit-specific and
depended on the compressor’s performance. UOP representatives confirmed that there are other FCC units that
use reciprocating wet gas compressors, which they can run for longer into the shutdown because they are not
susceptible to surge.b
UOP and Husky Superior Refinery Requirements for Main Column Gas Purge
UOP’s typical FCC designs included a natural gas or vaporized LPG connection to the main column to
specifically provide pressure control and purging capability during startups and shutdowns.c Refer to Figure 30
for a simplified illustration of the main column gas purge. Adding a small stream of natural gas or other non-
condensable gas into the main column (orange arrow) is typically a manual operator action. This non-
condensable gas allows a pressure control valve, typically on the main column overhead receiver outlet, to
a
UOP does not define “very rapidly” but it can be interpreted as “within minutes.” Husky Superior Refinery employees explained that
they perform many of the initial shutdown steps “right off the bat” or “pretty much the same time” as when they divert feed from the
reactor, such as increasing steam flow to the riser and shutting down wet gas compressors. Another employee estimated that these and
other initial actions occur within approximately 15 minutes after feed is diverted.
b
While most FCC units in industry use centrifugal compressors, some older FCC units still use reciprocating wet gas compressors [160,
29, p. 27]. Reciprocating compressors are positive displacement type compressors with pistons, unlike centrifugal compressors, which
use impeller blades [176, pp. 22, 29]. Centrifugal compressors are more reliable than reciprocating compressors during normal
operation, but stable operation is limited at low flow rates due to an aerodynamic condition known as surge [203, 178]. Extended
operation in surge can cause serious damage to a centrifugal compressor [176, pp. 69, 82-83]. In contrast, reciprocating compressors do
not experience surges and are less likely to be adversely affected by changes in gas composition or excessively low rates [203, 43, pp.
10-44, 10-45, 176, pp. 70, 81]. UOP’s 2016 General Operating Manual states, “A centrifugal compressor is used for [the wet gas
compressor] service.” Although the older manual does not explicitly state whether the wet gas compressor is centrifugal, it refers to
surge conditions in various instances with terms such as “anti-surge” compressor controls. Both versions of the manual refer the reader
to the manufacturer’s instructions for operating the compressors.
c
During normal operation, gases produced from the FCC reaction provide pressure into the main column, and a supplemental gas is not
needed.
74
continually vent a small gas flow to the flare. In doing so, small amounts of air that may have entered this
system are swept or otherwise purged out of the system “to ensure that an air concentration does not build up.”a
Figure 30. Continual gas purge at the main column during a typical FCC shutdown per UOP
guidelines.b (Credit: CSB)
Figure 31 shows a more detailed depiction of the pressure control scheme that UOP recommends during
transient operation. Vapors from the reactor enter the main column and pass through the condensers at the top of
the column. During a typical FCC unit shutdown, this vapor flow mostly consists of steam, which condenses to
water and comes out the bottom of the overhead receiver vessel. The small stream of natural gas injected into
the main column does not condense. This non-condensable gas exits the system through the pressure control
valve, along with other non-condensable gases such as oxygen and nitrogen.
a
UOP representatives told CSB investigators that this pressure control valve is typically sized for finer control of small gas rates during
startups and shutdowns.
b
WGC stands for wet gas compressor.
75
Figure 31. Typical main column pressure control scheme with the wet gas
compressors shut down. (Credit: CSB)
In its 2016 General Operating Manual, UOP described the intent of the fuel gas injection in the startup
procedure section (emphasis in original):
NOTE: Fuel gas injection [...] should be enough that the pressure transmitter on
the main column receiver will automatically keep the overpressure control valve
to the flare open a small amount (~3-5%) at all times. This will ensure that any
air that might still remain in the system will be purged out to the flare.
In addition, Husky Superior Refinery’s 1960 manual included these additional notes in the corresponding step:
Also, the air from the aeration pointsa on the reactor will be carried by the steam
in the reactor into the main column and into the [overhead] receiver. If this air is
not purged out, the concentration of oxygen can build up in the receiver to a high
level. (Some units use dry nitrogen or fuel gas instead of air in these aeration
points so as not to introduce air into the reactor.)b
In its shutdown section, Husky Superior Refinery’s original manual included the guideline to “[a]dd fuel gas to
main column and control pressure with [the controller] to flare,” and later in the section, “[...] the gas
compressor can be shut down. Continue controlling reactor main column pressure with the makeup gas from the
a
FCC units typically require aeration points in their standpipes to optimize catalyst circulation, and aeration in instrument purge points to
measure pressure near the slide valves [184, pp. 420, 423-424].
b
Husky Superior Refinery’s FCC unit used air to purge the instruments.
76
fuel system.” This guidance is also mentioned in the 2016 UOP manual as, “[s]tart fuel gas flow into the [main
column] if needed to maintain main column pressure control as the unit is shut down.”
Husky Superior Refinery’s shutdown procedure did not include instructions for purging air out of the main
column. Furthermore, this was the first turnaround where operators were steaming the main column’s contents
entirely into the flare system. In previous shutdowns, they had steamed out the equipment to the atmosphere
instead of into the flare system.a
Husky Superior Refinery’s FCC unit was equipped to purge air from its main column during a startup or a
shutdown. For example, this could have been done by routing a small stream of process gas from the sponge
absorber’s outlet piping into the main column. According to the refinery’s FCC operator training manual:
How can pressure be maintained on the Main Column when oil is out of the riser
and we want to keep the Main Column [in] standby condition with a Wet Gas
Compressor in service?
Crack open the [2-inch] gas line from the High Pressure header at the outlet of
the Sponge Absorber Pressure control valve into the Sponge oil return line to the
Main Column. Adjust as needed to maintain pressure.
Figure 32 illustrates the setup for controlling the main column overhead receiver’s pressure per the UOP
guidelines. The green arrows represent the sponge oil piping to and from the main column, which circulates
liquid during normal operation. The blue dotted line indicates piping for routing process gas into the main
column. This piping is typically isolated or otherwise removed from service during normal operation.
Figure 32. Process gas routing to the main column at Husky Superior Refinery’s FCC unit. (Credit: CSB)
a
Husky Superior Refinery changed the way it vented its equipment due to EPA’s Petroleum Refinery Sector Rule, which was first issued
in 2015 with amendments due to be finalized later in 2018 at the time of the incident [100].
77
Only the startup procedure referred to the use of this piping, in the following step:
Open gas line from the Sponge Absorber to the Main Column a couple of [valve]
turns with gas compressor running which will give us a constant pressure on the
Receiver.
Neither the refinery’s startup nor its shutdown procedure described using this gas to continually purge the main
column into the flare system.
Operators shutting down the FCC unit on the day of the incident did not talk about controlling the main
column’s pressure using the sponge oil return piping. In fact, operators saw the sponge oil return piping not as
an aid, but as an impediment to controlling the main column’s pressure. One operator described their thought
process:
Once the liquid [in the sponge absorber]’s gone, we would have had 180 pounds
[psi] of pressure going back into the main column, which we’re trying to hold
like 3, 4, 5 pounds of pressure. And we couldn’t hold it. So we were trying to
mess with the compressor, the spill back, trying to get it, and it wasn’t working,
wasn’t working. And then after a while of, I don’t know, maybe like a half an
hour, about that much, we were like, “Wait a minute. If the sponge absorber’s
empty, that pressure’s coming back. Let’s close that.” Once we closed it, then it
was like, oh, everything’s flatlined, looks good.
Husky Superior Refinery personnel told the CSB that they have typically controlled the main column pressure
with one wet gas compressor at minimum rates until they are ready to isolate the column with a blind (a metal
plate). One employee described the typical shutdown practice in further detail:
Historically, we’ve always kept the gas compressors running when we pull feed
from the unit. Now, naturally, you know, you’ll get down to about one
compressor just barely off and on [...].
[W]ith the flaring regulations and everything, you try to minimize any flaring
you do. So […] as you’re gassing off, as you shut down, you try to, you know,
bump that gas to its normal route [...] until you get to a certain point after you’ve
steamed off for a while [...] just before you’re going to [...] put the spectacle blind
in. Then the gas compressors would be shut off and […] you [...] wouldn’t need
them anymore.
[...]
We were getting close to the point where we were going to be shutting the
blowers off, shutting off the...the gas compressors. And then, you know,
continuing on with the shutdown process of, you know, getting ready to put the
blind in.
78
Operators continued to run one of the three wet gas compressors at a minimum rate well past the explosion at
approximately 10:00 a.m., until they shut it down during the unit evacuation.
4.1.2.2 Analysis
Main Column Gas Purge
The regenerator normally operates with a continual supply of air during normal FCC operation, and air is used
to cool down the regenerator as part of the normal shutdown process. According to available industry guidance,
many FCC units implement safeguards to limit air accumulation in the main column overhead system during
transient operation. A typical method is to purge the main column with a non-condensable gas, such as natural
gas or nitrogen [30, p. 13].
Both versions of the UOP General Operating Manual in Husky Superior Refinery’s possession refer to purging
the main column with fuel gas during startups and shutdowns. One source of available non-condensable gas that
the refinery could have used was the process gas from the sponge absorber. Husky Superior Refinery’s
procedure and operator training material called for using this process gas source for controlling pressure in the
main column overhead receiver only during startups. The shutdown procedure did not contain steps to purge air
from the main column using this non-condensable gas source. In addition, Husky Superior Refinery’s operating
procedures and training documents lacked information about the risk of accumulating air within the main
column and its interconnected equipment during an FCC unit shutdown.
UOP’s General Operating Manual recommended shutting down the wet gas compressors early in the shutdown
sequence and controlling the system pressure by establishing a main column gas purge. The purge gas would
exit the system from the main column overhead receiver into the refinery’s relief system, and from there to the
flare. Husky Superior Refinery instead used its wet gas compressor to control the main column’s pressure during
the shutdown. Because the wet gas compressor continually directed the contents of the main column overhead
receiver into the gas concentration unit, the pressure control valve on the main column overhead receiver
remained closed and did not vent gases into the flare system. In doing so, the wet gas compressor operation
inadvertently moved the air from the main column into the gas concentration unit, leading to the explosion.
The CSB concludes that Husky Superior Refinery had the ability to purge air out of its main column during a
shutdown to prevent oxygen accumulation inside the FCC unit, but the refinery had not incorporated this
safeguard into its operating procedures or its operator training program. Had Husky Superior Refinery
established a non-condensable gas purge of the main column during the FCC unit shutdown, as recommended
by UOP, the oxygen could have been swept out of the system, preventing the explosion.
Post-incident, Cenovus Superior Refinery plans to add a natural gas or an equivalent stream routed to the main
column to control the pressure during transient operation and update its operating procedures accordingly as part
of the FCC unit rebuild project.
transient operation safeguards discussed in this report. Part (b) of this recommendation specifically addresses the
implementation of a main column gas purge during transient operation.
79
Oxygen Monitoring
In the hours leading up to the explosion, there were a few process indicators that oxygen was accumulating
within the FCC unit equipment; however, Husky Superior Refinery operators were not equipped to recognize
and monitor for oxygen within their process.
When the boiler operator reported problems with excess oxygena to his supervisor prior to 8:30 a.m. on the
morning of the incident, the FCC unit had already begun shutting down—with the regenerator operating at a
higher pressure than the reactor and the main column (Figure 15). Process gas from the FCC unit was routed to
the refinery process gas system via the sponge absorber (Figure 13 and Figure 14), and process trend data
showed that the sponge absorber pressure control valve was open during part of that time. The CSB is not aware
of other process abnormalities at the refinery on the morning of the incident, so the FCC unit activities were
likely causing the oxygen fluctuations in the process gas system. Given the complexity of a typical refinery’s
interconnected utility systems, employees may not immediately recognize that an anomaly in one process unit
could be related to a potentially hazardous event in another unit in a different operating area. The CSB
concludes that on the morning of the incident, Husky Superior Refinery did not recognize the elevated oxygen
readings in the boiler flue gas as a potential indication of oxygen entering the refinery process gas system from
the FCC unit as it was shutting down.
About an hour before the explosion, when operators began to slowly

KEY LESSON depressure the system from a debutanizer vent downstream, the sponge
During transient operation for absorber’s pressure control valve closed. With this control valve
any process involving flammable closed, air would no longer be exiting the sponge absorber into the
materials, operators need to refinery process gas system. At this point, the refinery process gas
understand how air (or oxygen) system likely stopped having fluctuating oxygen concentrations, while
could enter and accumulate oxygen continued to accumulate in the gas concentration unit without
inside equipment, and how affecting the rest of the refinery systems.
oxygen should be purged out of
Husky Superior Refinery did not have a means to detect the presence
the system to prevent the of oxygen in its equipment during the FCC unit shutdown. Some
development of a flammable refineries measure the oxygen concentration at or near the main
mixture. The effectiveness of a column overhead receiver during FCC unit transient operation to
purge should be verified by ensure that dangerous levels of oxygen are not accumulating inside the
engineering calculations or direct system.b Based on industry discussions, many refineries do not test for
measurements of oxygen oxygen inside the main column overhead system, while others have
content inside the equipment. mandatory testing requirements. The industry does not appear to have
data for how many refineries measure the oxygen content, but the CSB
is aware that it is not yet a widespread safety practice [68].
Furthermore, not all FCC technology licensors currently recommend oxygen analyzers. In 2021 and 2022, the
American Fuel and Petroleum Manufacturers (“AFPM”) association,c a trade association that represents fuel and
petrochemical manufacturers in the United States, hosted multiple online webinars and issued good practice
a
Typically, some excess oxygen in the flue gas is required to ensure proper combustion of the fuel in boilers, but too much excess
oxygen could lower the boiler’s efficiency [198].
b
Operators can reduce high oxygen rates by changing the purge rate or by making other operational adjustments.
c
AFPM is a trade association that represents fuel and petrochemical manufacturers in the United States. http://www.afpm.org
80
guidance documents that raised awareness around methods for calculating purge requirements and measuring
the oxygen concentration in the main column overhead system during FCC unit transient operations.a While
there is currently no industry-accepted limit and each company is expected to set its own process limits, many
sites target less than two percent oxygen in the main column overhead receiver gas, whether that is a calculated
or a measured value.
The CSB concludes that had Husky Superior Refinery had the ability to monitor the oxygen concentration in the
main column and established a safe operating limit for oxygen, operators could have identified the dangerous
oxygen levels accumulating inside the process equipment and taken the predetermined actions needed to prevent
the incident.
Post-incident, Cenovus Superior Refinery plans to install an oxygen analyzer at the main column receiver to
detect potential oxygen accumulation in the main column overhead system.
transient operation safeguards discussed in this report. Part (c) of this recommendation specifically addresses the
implementation of oxygen monitoring during transient operation.
Wet Gas Compressor Operation
Husky Superior Refinery employees expressed to the CSB that they wanted to minimize flare activity while
shutting down the FCC unit to comply with environmental regulations limiting allowable flaring activity. Husky
Superior Refinery had been accustomed to running the wet gas compressors for as long as possible during the
shutdown, avoiding the need to route gases from the main column to the flare. While this decision likely resulted
in less flaring, it ultimately routed oxygen to the gas concentration unit, creating a dangerous explosive
atmosphere inside equipment.
One regulation that affected flaring at facilities such as Husky Superior Refinery took effect in 1990, when the
EPA revised and expanded the Clean Air Act to implement and enforce regulations reducing air pollutant
emissions [71, p. 2]. Many U.S. refineries faced challenges complying with these regulations, and had to reach
individual settlements, called consent decrees, with the EPA. According to the EPA:
Since March 2000, EPA entered into 37 settlements with U.S. companies that
refine over 95 percent of the Nation’s petroleum refining capacity. These
settlements cover 112 refineries in 32 states and territories, and on full
implementation will result in annual emissions reductions of more than 95,000
tons of nitrogen oxides and more than 260,000 tons of sulfur dioxide. [...] EPA’s
investigations focused on the four most significant Clean Air Act compliance
challenges for this industry and the emissions units that are the source of most of
its pollution [72].
a
Webinars that AFPM hosted include “FCC Startup, Shutdown and Standby Monitoring Best Practices – Oxygen Monitoring,” “FCC
Non-Routine Operations Standby Checklist,” and “FCC: Flareless Startup.” Documents that AFPM published include “Process Safety
Bulletin: Flammable Mixture Accumulation in FCC Units during Non-routine Operations” and “O2 Monitoring in FCCs during Non-
Normal Operations.”
81
In 2010, Murphy Oil entered a Consent Decree with the EPA, the Louisiana Department of Environmental
Quality, and the State of Wisconsin to resolve compliance challenges of the Clean Air Act at its petroleum
refineries in Meraux, Louisiana and Superior, Wisconsin [73]. The consent decree document describes how
Murphy Oil should follow the EPA’s Good Air Pollution Controlling Practices:
Murphy shall at all times and to the extent practicable, including during periods
of Startup, Shutdown, and/or Malfunction, implement good air pollution control
practices to minimize emissions from its Flaring Devices as required by 40
C.F.R. § 60.11(d) [74, p. 36].
Many refineries, like Husky Superior Refinery, are typically expected to minimize flaring both during
shutdowns and startups to comply with EPA’s good air pollution control practice requirements.a However,
refineries also need to find ways to abide by their environmental agreements without jeopardizing the process
safety of their units, as flare systems are primarily designed as safety devices to vent process equipment safely
and help prevent catastrophic incidents. The regulation allows for “minimizing” emissions rather than
eliminating them. Ultimately, each refinery needs to evaluate its own units for environmental and process safety
considerations based on its units’ equipment and flare system configurations. The CSB concludes that Husky
Superior Refinery’s approach to minimize flaring likely contributed to the wet gas compressor’s continued
operation during the shutdown, which directed oxygen from the main column into the gas concentration unit
containing flammable hydrocarbon, creating the dangerous conditions that enabled this explosion.
UOP’s general operating manuals were written mainly for FCC units
with centrifugal wet gas compressors, which could not operate well at KEY LESSON
low flow rates. Since Husky Superior Refinery’s wet gas compressors During FCC unit shutdowns,
were reciprocating compressors, they could continue operating at low facilities should assess the timing
rates through the shutdown. The CSB concludes that Husky Superior of shutting down the wet gas
Refinery did not identify or control the potential explosion hazard from compressor to minimize or
accumulating air within the gas concentration unit containing otherwise prevent sending air
flammable hydrocarbon when its reciprocating wet gas compressors into the gas concentration unit.
operate for extended periods during transient operation.
Most FCC units have centrifugal
According to Cenovus Superior Refinery, the new version of its FCC compressors, which are typically
unit’s shutdown procedure will instruct operators to shut down the wet shut down earlier due to surge
gas compressors earlier in the process; however, the operating concerns; however, reciprocating
procedures are not yet finalized. The CSB makes CSB compressors can operate at low
Recommendation 2018-02-I-WI-R2 to Cenovus Superior Refinery to rates for prolonged periods.
incorporate wet gas shutdown timing guidance into all FCC unit
The refining industry is moving towards minimizing flaring, especially during FCC unit transient operations.
“Flareless startup is far more common today than it has been historically,” said a presenter in the February 2020
AFPM FCC transient operations webinar. During the 2021 AFPM Summit, a speaker from UOP presented a talk
titled, “FCC: Flareless Startup – Reducing the Duration and Magnitude of the Flare During Cold Startup.”
a
The good air pollution control practices are referenced in 40 C.F.R. § 60.11(d) and 40 C.F.R. § 63.6(e).
82
Though the talk focused on an FCC unit’s startup—another type of transient operation—many of the hazards
also apply to a shutdown. The talk included discussions on purging the main column with fuel gas, venting
entrained oxygen to the flare, main column overhead pressure control, and wet gas compressor operation—the
same considerations that are needed for safely shutting down an FCC unit. The CSB concludes that the refining
industry should address both shutdowns and startups in FCC unit flare minimization discussions by first
identifying and providing the controls needed to prevent explosions before focusing efforts on minimizing the
environmental impact of these operations.
4.1.3 Catalyst Slide Valves

According to UOP’s 2016 General Operating Manual, catalyst slide valves have two purposes:
1. control catalyst flow between the reactor and regenerator during normal operation; and,
2. stop catalyst circulation when needed.
In a discussion with the CSB, UOP representatives also commented that during a shutdown, the main purpose of
closing catalyst slide valves is to minimize the steam flow into the regenerator.
4.1.3.1.1 Husky Superior Refinery’s Slide Valve Standard
Superior Refinery developed its own FCC unit slide valve engineering standard, a document titled “FCCU Slide
Valves,” in 2016. Husky Superior Refinery told the CSB that the standard, which contained “mandatory
requirements governing the design, fabrication, inspection, and testing of new slide valves for Fluid Catalytic
Cracking Units,” was based on UOP’s specifications. The engineering standard also referenced Calumet
Engineering Practices, American Society of Mechanical Engineers (“ASME”) codes, and American Society of
Testing and Materials (“ASTM”)a specifications.
Husky Superior Refinery’s slide valve standard described the spent and regenerated slide valves to be in
“throttling and blocking service,” and “designed for complete shut-off of flow.”b It required that “[a]ll
components subject to erosion due to direct impingement, by-pass, turbulence, or any other source shall be
provided with erosion protection suitable for the design life at the design conditions.” In addition, “[t]he
minimum corrosion/erosion allowance shall be 1/8 inch” for the slide valve body, which includes the orifice (the
opening across which the disc slides).
a
ASTM International, formerly known as the American Society for Testing and Materials, is an international standards organization that
develops and publishes voluntary consensus standards [165].
b
The refinery’s engineering standard also referred to “clearances between disc, slide, and orifice plate” and “horizontal and vertical
clearances between the disc and the guides and orifice plate (hot and cold).” According to this document, “the maximum tolerance on
these clearances shall be +0.010 inch to -0.0 inch.”
83
4.1.3.1.2 Slide Valve Use During the Shutdown
When the CSB asked Husky Superior Refinery employees how they kept the air inside the regenerator separate
from the hydrocarbon in the main column during an FCC unit shutdown, each of them responded with slide
valves or catalyst levels. One operator explained, “There is no air on that side because we just have this spent
slide valve and the regen slide valve shut. So it’s just the flue gas that’s going out [...] to atmosphere, out the
stack.” Several other employees whom the CSB interviewed, from FCC operators to senior managers, told the
CSB that closing slide valves formed a catalyst “seal” or a “solid [...] plug” that prevented air from flowing from
the regenerator into the reactor.
In preparation for closing the spent catalyst slide valve, Husky Superior Refinery’s shutdown procedure warned,
“You may have to have some catalyst in the reactor stripper to hold a seal across the spent slide valve.” One
Husky Superior Refinery employee explained that he would typically look at the differential pressures across the
slide valves and ensure that “they’re positive, you know, if they’re anything over zero.” He explained, “on the
spent, for instance, the differential pressure is important. It takes into account your reactor pressure plus your
catalyst head, [...] and anything positive would mean you’re higher than the regenerator pressure.” This
instrumentation was not configured to measure negative differential pressures and could not report any
differential pressure less than zero.
On the morning of the incident, the spent catalyst slide valve differential pressure instrument displayed readings
ranging from 0 to 7.8 psi. In the 4 hours and 20 minutes from the beginning of the shutdown until the explosion,
the differential pressure across the spent catalyst slide valve was 0 for about 34 percent of the time.
Operators told the CSB that the instrument air and differential pressure instruments had been mostly reliable
during normal operation; however, it was normal to lose readings on the spent catalyst slide valve differential
pressure during a shutdown. “It’s been my experience over the years,” said an experienced refinery employee,
that “in a shutdown […] usually the differential in the spent [catalyst slide valve] just goes away. We sometimes
have a hard time reestablishing it until we get some fluidization in the standpipe.”
84
4.1.3.1.3 History of Known Slide Valve Erosion
Superior Refinery management had planned to replace the spent catalyst slide valve with its spare in the 2018
turnaround. The refinery owned several spare spent catalyst slide valves, which it repaired between turnarounds
and replaced during each turnaround every five years due to some expected erosion damage.a
After the incident, in July 2018, the CSB coordinated with the refinery to inspect the valve in-situ before
sending it to a third-party laboratory for further examination. Before dismantling piping to extract the valve, the
investigation teams had a probe with a camera inserted into the spent catalyst standpipe to look at the slide valve
from above. There was only a thin layer of debris remaining on top of the slide valve (Figure 33).
Figure 33. Spent catalyst slide valve in-situ. (Credit: Husky Superior Refinery with annotations by CSB)
Laboratory testing included non-destructive and destructive materials evaluation, including chemical analysis.
Figure 34 shows the extent of erosion damage found on the upstream side of the slide valve. According to the
laboratory report, visual examination indicated that “the Orifice Port was eroded with numerous visible cracks
showing.”
a
Superior Refinery’s FCC unit typically shut down for equipment inspections once every two to three years until the early 2000s.
Beginning in 2003, the FCC unit turnarounds occurred once every five years. See Appendix B for a historical timeline.
85
Figure 34. Spent catalyst slide valve view of the upstream side. (Credit: CSB)
Husky Superior Refinery employees recalled that the spent catalyst slide valve (SCSV) had a history of similar
erosion wear in past turnarounds. In its own investigation report of the 2018 incident, Husky Superior Refinery
concluded that “The SCSV removed during the 2013 FCCU turnaround had experienced a similar level of
erosion as the SCSV involved in this incident.” Figure 35 is a photograph of the spent catalyst slide valve as
found during the 2013 turnaround.a
a
The CSB noted that refractory was missing from the slide valve when it was removed in 2018 and had likely not been installed on the
valve during the 2013 turnaround. Because the extent of damage was similar to that reported from previous turnarounds, this report does
not further discuss this finding.
86
Figure 35. Spent catalyst slide valve as found in the 2013 turnaround. (Credit: Husky Superior Refinery)
The 2013 turnaround slide valve inspection report documented that the “spent valve disc was in very poor
condition.” In addition, the “[s]pent valve orifice had severe erosion in the 0 to 30 percent area of the seating of
the orifice, approximately 85 percent of the metal and hard facing in this area was eroded away.”
A refinery employee told the CSB that they did not notice adverse impacts of erosion on the slide valve control
during normal operation. According to interviews, this was the only time in the site’s institutional memory that
all catalyst in the standpipe was inadvertently lost during a shutdown. Husky Superior Refinery did not retain
process data from previous shutdowns to confirm this history.
Upon completing its post-incident inspection in 2018, OSHA cited Husky Superior Refinery for “[d]uring the
2008 and 2013 turnarounds, where inspection findings by outside contractor on the spent catalyst slide valve
showed erosion, the employer did not ensure generally accepted good engineering practices before placing the
spent catalyst slide valve back in service.”
4.1.3.1.4 Layer of Protection Analysis
Husky Superior Refinery began to require Layer of Protection Analysis (“LOPA”) starting in 2010. LOPA uses
a semi-quantitative, risk-based approach to analyze the effectiveness of a process’s protection layers [75, pp. 1-
2].
87
Husky Superior Refinery conducted a LOPA in 2016 as part of the FCC unit’s PHA.a The LOPA study report
explained:
The LOPA study was conducted in order to ensure adequate Independent

Protection Layers (IPLs) have been specified in the equipment design, and to
determine the Safety Integrity Level (SIL) requirements of any Safety
Instrumented Functions (SIFs) that may be required to reduce process risk to a
tolerable level.b
The Calumet LOPA procedure that Husky Superior Refinery used for this 2016 study recommended initiating
event frequencies and risk reduction credits for independent protection layers (“IPL”s). According to the
guidance, any IPL tied to human intervention was assumed to fail at least 10 percent of the time. In addition, the
procedure provided the following guidance for operator intervention using standard operating procedures:
If an operator action is the initiating cause, no IPL should be assigned to any

operator action that solely relies on the same operator to recognize the problem
and quickly correct it. [...] In all cases, the operator must have sufficient time to
recognize the problem, determine the solution, and take action.
The 2016 study team performed a LOPA on each of the PHA scenarios that they qualitatively ranked as having
the most severe consequences. Husky Superior Refinery defined an FCC reverse flow (reversal) incident to
potentially cause lost time injuries, evacuations, and equipment damage between $500,000 and $5 million, or an
extended plant shutdown, making it a “significant risk” consequence. Out of the 126 scenarios that the LOPA
team studied, initiated by events such as equipment malfunction and human error, the team identified 39
scenarios that could cause “upset of pressure differentials resulting in reverse flow” or “reversal” during normal
operation. None of these reverse flow scenarios covered startup or shutdown operations.c Most of these reverse
flow scenarios only listed the COPS as an IPL (automated closing of the slide valves below a certain slide valve
differential pressure value, as discussed in Section 1.4.2), with operator responses to slide valve differential
pressure alarms as additional safeguards.
Regarding the adequacy of its IPLs, the LOPA team reported,
When existing IPLs were insufficient, a recommendation was typically suggested

by the team as a possible course of action to improve an existing safeguard to
a
The 2016 PHA is further described later in this report (Section 4.3.3).
b
Definitions of IPL, SIF, and SIL from the CCPS glossary [103]:
Independent Protection Layer (IPL): A device, system, or action that is capable of preventing a scenario from proceeding to the
undesired consequence without being adversely affected by the initiating event or the action of any other protection layer associated
with the scenario.
Note: There are specific functional criteria for protection layers that are designated as “independent.” A protection layer meets the
requirements of being an IPL when it is designed and managed to achieve the following seven core attributes: Independent;
Functional; Integrity; Reliable; Validated, Maintained and Audited; Access Security; and Management of Change [179].
Safety Instrumented Functions (SIF): A system composed of servers, logic servers, and final control elements for the purpose of
taking the process to a safe state when predetermined conditions are violated [181].
Safety Integrity Level (SIL): Discrete level (one out of four) allocated to the SIF [Safety Instrumented Functions] for specifying
the safety integrity requirements to be achieved by the SIS [Safety Instrumented System] [180].
c
Husky Superior Refinery PHA teams did identify some other transient operation scenarios, further discussed in Section 4.3.3.1.2.
88
qualify as an IPL, or to add new devices, instrumentation, or administrative

controls that could qualify as an IPL.
For 33 of the “reverse flow” scenarios, where the LOPA team identified the COP system as an IPL, the team
made the following recommendation:
In the Emergency Operating Procedure for the FCCU – Describe the conditions
under which the COP takes over and the operator’s response when it does take
over.
In 2017, Husky Superior Refinery developed a new procedure titled “Slide Valve Over-rides (Cops)” that
directed operators to shut down the FCC unit in the event of automatic slide valve closure. These new
procedures did not incorporate UOP-recommended safeguards such as the reactor steam barrier.
Husky Superior Refinery had also had an operating procedure titled, “Slide Valve Operation: Normal,
Emergency, and Troubleshooting,” since at least 1994. While this procedure explained the operation,
troubleshooting, and emergency procedures (such as loss of power) of the actuator system for the slide valves, it
did not contain guidance for what steps to take in the FCC unit’s operation in the event that a slide valve lost its
functionality or was otherwise not available when needed.
4.1.3.2 Analysis
4.1.3.2.1 Catalyst Slide Valve Purpose
Catalyst slide valves are an FCC-unit-specific technology, used to control catalyst flow during normal operation.
In FCC units that have catalyst slide valves, the valves are typically configured to close automatically to stop
catalyst circulation during abnormal conditions. Some refinery FCC units also have redundant slide valves
whose only function is to close during an emergency. However, slide valves typically act in concert with other
safeguards, such as the reactor steam barrier, to transition the FCC unit to a safer posture during transient
operation [70].
The catalyst-facing slide valve parts are typically protected with erosion-resistant material because some
erosion, caused by the flowing catalyst during normal operation, is expected over the life of the valve [76].
Some slide valve components cannot be serviced on an operating unit; therefore, refineries typically inspect,
repair, or replace the slide valves during each turnaround, typically once every four to six years.a
Following the FCC safe operating practices industry survey that AFPM facilitated after Husky Superior
Refinery incident,b AFPM summarized the respondents’ view of slide valves as follows:
a
In the 1970s and 1980s, the industry average run length between scheduled maintenance shutdowns for an FCC unit was about two
years; by 2011, typical turnaround run lengths had increased to four to five years [170, p. 3]. There are numerous factors that determine
the interval between FCC unit turnarounds, such as FCC cyclone and refractory reliability, rotating equipment reliability, regulatory
inspection requirements, and others. In a 2006 FCC industry survey by Solomon Associates, slide valve reliability determined
turnaround timing only three percent of the time [170, p. 4].
b
The AFPM survey is discussed in further detail later in this report (in Section 4.4.1.2.1).
89
The responses indicate that slide valves are expected to close on demand but are
not designed to seal gas tight. The majority of responses [indicates that refineries]
manage gas leakage of the slide valve by controlling the pressure balance and
maintaining an inert [such as steam] barrier in the reactor.
The petroleum refining industry uses terms like “pressure balance,” “pressure profile,” or “pressure
differentials” to describe the relative pressure differences between various locations across an FCC unit, such as
the regenerator, reactor, main column, and others. In its summary of the survey results, AFPM stated,
“[i]ndustry uses a variety of techniques to maintain the pressure differential” between the FCC unit components.
AFPM concluded, “[i]t is important to understand that the majority of the responses make use of the entire
pressure profile [across the FCC unit], not just a single element [such as a slide valve, to prevent the hazardous
migration of hydrocarbons and oxygen].”
4.1.3.2.2 Slide Valve Standards
Typically, the slide valve manufacturer is responsible for the mechanical design of the slide valve, incorporating
the FCC technology licensor’s specifications, company-specific specifications, and its own internal
specifications. Husky Superior Refinery’s FCC unit slide valves engineering standard described the slide valves
to be in “throttling and blocking service” and “designed for complete shut-off of flow.” Elsewhere, however, the
document mentioned valve clearances between the slide disc and associated parts, implying they could not be
gas-tight.
The CSB concludes that Husky Superior Refinery’s slide valve standard did not properly describe the flow
isolation capability of slide valves, indicating the refinery’s incomplete knowledge and contributing to the lack
of recognition by most Husky Superior Refinery employees associated with the FCC unit that catalyst slide
valves were not an adequate safeguard for preventing a catastrophic explosion.
The CSB makes CSB Recommendation 2018-02-I-WI-R3 to Cenovus Superior Refinery to develop and
implement a slide valve mechanical integrity program that addresses erosion and ensures proper functioning of
the slide valves during a shutdown. Part (a) of this recommendation addresses developing a slide valve
mechanical integrity standard that defines monitoring and inspection acceptance criteria for the safe operation of
the FCC unit during transient operations.
The Calumet Engineering Practices, ASME codes, and ASTM specifications that Husky Superior Refinery’s
engineering standard referenced do not apply to FCC catalyst slide valve bodies. The American Petroleum
Institute (“API”)a Recommended Practice (“RP”) 553, Refinery Valves and Accessories for Control and Safety
Instrumented Systems, contains recommendations for FCC catalyst slide valves, but these recommendations
focus only on the actuating systems of the valve, not the valve body itself. API could improve this guidance to
better explain their purpose, function, capabilities, and limitations to ensure that refineries understand the design
intent of FCC catalyst slide valves. The CSB concludes that had industry guidance effectively described the
function and limitations of FCC unit slide valve bodies, Husky Superior Refinery may have not relied on the
slide valve as a gas-tight barrier, which could have helped prevent the incident.
a
API is a standards-setting organization that represents all segments of America’s natural gas and oil industry [195].
90
The CSB issues CSB Recommendation 2018-02-I-WI-R14 to API to include further information on FCC
catalyst slide valve body design, maintenance, and testing in API RP 553 or another appropriate API product.
4.1.3.2.3 History of Known Spent Catalyst Slide Valve Erosion
Although Husky Superior Refinery’s slide valve standard required a “minimum corrosion/erosion allowance [of]
1/8 inch” for the slide valve body, photos from the 2013 turnaround and after the 2018 incident showed severe
erosion on these components far exceeding 1/8 inch. Since the erosion exceeded the allowance set by Husky
Superior Refinery, either the components protecting the valve from erosion were possibly not suitable for its
design life, or the normal operating environment was more severe than the design conditions had accounted for.
Husky Superior Refinery accepted and normalized the excessive slide valve erosion wear damage seen over
consecutive five-year runs even though the erosion exceeded the engineering standard’s specifications. Though
the erosion did not appear to employees to impact normal operation, it compromised the slide valve’s ability to
stop catalyst flow during the incident shutdown. Husky Superior Refinery’s management had planned to replace
the slide valve components during every turnaround, knowing that the slide valve had a history of erosion. Yet,
according to Husky Superior Refinery’s hazard analysis studies, the only safeguards to protect from many of the
reverse flow scenarios during the turnaround was automatically closing the slide valves, which needed to be
replaced.
The CSB concludes that Husky Superior Refinery’s spent catalyst slide valve was eroded and damaged such that
it could no longer maintain a catalyst level in the reactor. In addition, the severely eroded slide valve allowed
more air to pass through from the regenerator into the reactor than it would if it were in good condition. Husky
Superior Refinery had normalized or otherwise accepted the spent catalyst slide valve’s erosion rate over its
five-year turnaround cycles likely because its staff believed that it did not impair normal operation.
Cenovus Superior Refinery is redesigning the spent catalyst slide valve as part of the rebuild project. The
refinery informed the CSB that the new slide valves will have different construction materials suited to the new
FCC design conditions. Further changes related to slide valve management are discussed in Section 4.1.3.2.6.
Cenovus Superior Refinery plans to implement additional testing and monitoring on the slide valves, but these
plans are not yet finalized. The CSB makes CSB Recommendation 2018-02-I-WI-R3 to Cenovus Superior
Refinery to develop and implement a slide valve mechanical integrity program that addresses erosion and
ensures proper functioning of the slide valves during a shutdown. Part (b) of this recommendation addresses
developing monitoring and preventive maintenance activities to evaluate the condition of the slide valves during
operation, and part (c) addresses using this data to drive maintenance outage decisions. Part (d) of the
recommendation addresses the refinery’s evaluation of the effectiveness of its slide valve mechanical integrity
program based on turnaround and maintenance inspections of the slide valve bodies.
4.1.3.2.4 The “Catalyst Seal” Misnomer
Many of Husky Superior Refinery personnel that the CSB interviewed, from FCC operators to management,
believed that closing slide valves formed a “catalyst seal” or a “solid plug” that would prevent air from flowing
into the reactor, even with the regenerator operating above the reactor pressure. The term “catalyst seal” is often
used within the petroleum refining industry to describe the flow restriction that FCC catalyst can cause between
91
two vessels. However, unlike what the term implies, FCC catalyst does not positively “seal” or isolate this
equipment.
“Catalyst seal” can have multiple meanings depending on the unit’s configuration and operating mode. In some
contexts, the CSB found this “seal” described as a fluidized catalyst level controlled inside the vessel above a
slide or a plug valve. Other sources define it as defluidized (or “slumped”) FCC catalyst that accumulates in the
standpipes when slide valves close and catalyst circulation stops.a This investigation report refers to the latter
definition, which both UOP and Husky Superior Refinery personnel described as the “catalyst seal” to CSB
investigators.
Figure 36 provides a sketch of catalyst in a vertical standpipe. During normal operation of a typical FCC unit,
due to its physical properties, fluidized catalyst creates a pressure difference across the standpipe (P2 is greater
than P1). This pressure difference keeps gases below the slide valve from flowing against the catalyst flow
direction. However, when FCC catalyst is defluidized, there is little to no pressure difference across the catalyst
(P2 becomes the same as P1) within minutes [77, 78],b and vapor will always flow from higher to lower
pressure.
Figure 36. Sketch of a standpipe with a closed slide valve. (Credit: AFPM [68])
a
The term “catalyst seal” is also mentioned in FCC cyclone discussions, which refer to a different process within the FCC unit that is out
of the scope of this investigation [173].
b
Unaerated FCC catalyst typically defluidizes in minutes [78].
92
Representatives from multiple FCC technology licensors have told CSB investigators that catalyst and slide
valves are known to allow the flow of gases through them, even when the equipment is in new or good
condition.a Based on this understanding, industry experts advise managing vessel pressure differences and flows
as the primary method for safeguarding the unit, such as through the reactor steam barrier and the main column
gas purge.b Though a stagnant level of catalyst could create a restriction that limits the rate of air flowing
through the standpipe, referring to FCC catalyst as forming a “seal” might mislead some refinery employees,
including operators, engineers, process safety practitioners, and managers, into thinking that the catalyst acts as
a barrier that prevents all flow, leading to inadequate process risk assessments.
The CSB concludes that FCC practitioners should eliminate or

otherwise dispel the misleading term “catalyst seal” from future safety KEY LESSON
discussions. This term contributed to the lack of understanding at FCC catalyst slide valves and
Husky Superior Refinery. The employees at Husky Superior Refinery catalyst levels are not gas-tight.
took this term at face value and believed that closing the slide valves They should not be relied upon
would create a “solid plug” or “catalyst seal” that would provide as an independent protection
adequate protection from inadvertent reverse flow events. Their flawed layer in hazard assessments.
understanding of the slide valves’ purpose resulted in their overreliance
on a single safeguard, which alone proved incapable of preventing
oxygen accumulation in the main column and contributed to this catastrophic event.
To improve the Cenovus Superior Refinery workers’ understanding of important FCC concepts, the CSB makes
CSB Recommendation 2018-02-I-WI-R6 to Cenovus Superior Refinery to develop and implement training for
FCC unit operators, supervisors, and managers that is based on the licensor’s guidance and on available industry
guidance.
4.1.3.2.5 Understanding Process Indicators
Based on interviews, available equipment information, and process trend data, the reactor catalyst level was
likely below the instrument’s detection range during most of the incident shutdown. Figure 37 illustrates the
approximate detection range of the reactor level instrument. The yellow shaded areas show potential locations
where catalyst could be present but undetectable during the shutdown: up to 45 feet above the spent catalyst
slide valve and up to 20 feet above the regenerated catalyst slide valve.
a
Industry experts stress that some vapor flow is inevitable even when FCC catalyst is tightly packed [68]. Defluidized FCC catalyst
typically has a void fraction of around 40 percent: the spaces around the tiny catalyst particles make up about 40 percent of the total
volume [78]. Fluidized catalyst beds, such as the levels of catalyst in the reactor and regenerator during normal operation, could have a
vapor space of up to 70 percent [68]. If the pressure beneath the slide valve is higher, gases will flow up through the slide valve and
catalyst, passing between the small, spherical particles regardless of how tightly packed they are.
b
UOP representatives told the CSB that UOP specifies more than enough steam to be able to maintain the reactor at a higher pressure
than the rest of the system even in the absence of catalyst in the standpipes during transient operations.
93
Figure 37. Potential undetectable catalyst levels within the reactor and
regenerator during a shutdown (person for scale). (Credit: CSB)
Some of the refinery’s operators were accustomed to using slide valve differential pressure as a proxy for level
indication during transient operation. Based on interviews with the board operator (Section 2.1.2), because the
board operator saw nonzero numbers, he believed that some catalyst still remained on top of the slide valve and
that it was keeping the air out of the reactor.
94
During trend analysis, the CSB could not account for many of the fluctuations in the slide valve differential
pressure measurements in the four hours leading to the incident.a Catalyst in the standpipes could have
defluidized minutes after circulation stopped [78], making the instrument readings inaccurate. However, even
the positive slide valve differential pressures the board operator observed, which ranged from 0 to 5 psi, would
not have been able to overcome the 9 psi vessel pressure difference between the regenerator and the reactor.
In February 2020, AFPM hosted an hour-long recorded webinar where two FCC industry experts discussed
challenges and good practices for safeguarding the FCC unit during transient operation [68]. The webinar
featured the safeguards outlined in Table 2 and the rest of this report. FCC industry experts cautioned the
webinar attendees about misleading instrumentation while the FCC is in transient operation [68]. In their
presentation, they explained that it may not be possible to verify the presence of catalyst while it does not
circulate as in normal operation. The differential pressure instrumentation, designed for fluidized catalyst, may
not adequately reflect the pressures in the standpipes and the vessels, especially around the slide valves. One
presenter said:
There are times when our instrumentation […] can sort of fool us a little bit. It
can give us bias into what we think is going on. […] Even things like the gas
flow through these [differential pressure instruments] starts to affect our readings
[68].
Regarding instrumentation typically used to assess catalyst presence in a spent catalyst standpipe, the speaker
explained:
These standpipes are large. […] It’s back to how much information do you really
have on this catalyst phase in these shutdown modes. The instrumentation you’ve
got might work fine, but it only tells you what’s going on in the local area where
you’ve got it. And a lot of the times […] it’s really not the place that we really
want the information at. And so, seeing what’s going on at the bed level
instrument for the stripper may not tell us what’s going on down at the slide valve
[68].
The CSB concludes that FCC catalyst differential pressure instruments, such as catalyst level and slide valve
differential pressure indicators, may not be reliable process indicators during a shutdown. Husky Superior
Refinery’s operations staff’s reliance on these instruments led them to believe that both standpipes were full of
catalyst and air was not entering the reactor. Had operators understood the limitations of these instruments and
been trained on monitoring other process indicators, such as regenerator, reactor, and main column pressure
indicators, they may have been able to recognize that a substantial amount of air was entering the main column
and taken the necessary steps to prevent this incident.
transient operation safeguards discussed in this report. Part (d) of this recommendation specifically addresses
monitoring of critical operating parameters during transient operation. Parts (e) and (f) address defining
a
The instrument connection points have constant air purges on them to keep catalyst from plugging the tubing; however, Husky Superior
Refinery did not have process trend data available for instrument purge analysis.
95
predetermined corrective actions for remaining within safe operating limits during transient operation and the
incorporation of this information into FCC operator training at the refinery.
4.1.3.2.6 Safeguard Analysis
Husky Superior Refinery’s 2016 LOPA study team identified 39 potential reverse flow scenarios. For most of
them, the only independent protection layers or safeguards available were automated slide valve closures and
operator actions in response to alarms. For 33 of these scenarios, the LOPA team made a recommendation to
improve the operators’ response to automated slide valve closures (the COP system), presumably because the
team decided that the COP by itself was not a strong enough safeguard to bring the process risk to a tolerable
level.
Typically, human response safeguards have the highest probability of failure compared with more robust
engineered and automated safeguards. Furthermore, Calumet’s LOPA guidance directed the team to assume that
human error is possible 100 percent of the time while performing a non-routine task. Shutting down the unit for
a turnaround or responding to an emergency are typical non-routine tasks. If slide valves failed to function as
required and no additional safeguards were considered, the only safeguard that remained was an effective
response by the operator.
The CSB concludes that because Husky Superior Refinery depended on catalyst slide valves to ensure safety by
keeping the air and hydrocarbon systems separated during all operating modes, the refinery lacked adequate
safeguards to reduce process risks to a tolerable level in the PHA scenarios that they identified. During the April
2018 FCC unit shutdown, Husky Superior Refinery’s overreliance on catalyst slide valves and the absence of
more robust safeguards, such as the reactor steam barrier and main column gas purges, resulted in the ingress of
air from the regenerator into downstream gas concentration equipment containing hydrocarbons, and ultimately
caused the explosion.
During most FCC unit transient operations, the spent and regenerated catalysts are closed and operators
performing process moves are likely the same operators to respond to resulting issues. The PHA and LOPA
study did not evaluate these non-routine operation scenarios that could lead to process upsets resulting in
unintended flow of air from the regenerator into the reactor.a For example, the automated slide valve override
safeguard would not apply because the valves are already closed. Additionally, an operator response would not
have been a valid independent protection layer since the operator making the process moves would likely be the
same operator to respond to the moves. Because the PHA and LOPA studies did not include these scenarios, the
studies did not address gaps in safeguards for transient operations.
Evaluating the consequences of a PHA scenario and the effectiveness of the relevant safeguards may sometimes
require quantitative analysis.b During the 2022 AFPM Summit conference, a presentation titled Slide Valve
Malfunctions provided example mitigation strategies for a failure of a slide valve to close on demand. For
example, if the spent catalyst slide valve failed to close on demand during a critical event (such as during an
emergency shutdown initiated by the safety instrumented system), one refinery defined the safety scenario as
“Air ingress to Reactor and downstream equipment.” This refinery had calculated that if the spent catalyst slide
a
Scenario identification is further discussed in Section 4.3.3.1.2.
b
Some companies perform safety-based maximum allowable leakage rate calculations to confirm the effectiveness of a valve as an IPL,
as discussed in a paper co-authored by employees at the Dow Chemical Company [199].
96
valve did not close on demand in this scenario, the time it would take to drain the catalyst from the spent catalyst
standpipe into the regenerator and equalize pressure across the spent catalyst slide valve could typically be 90-
240 seconds. This speaker recommended that refineries “understand the hazards, critical levels, and process
safety timesa specific to [their] system,” and “set appropriate action levels in emergency procedures.” In the
presenter’s example, this refinery determined that the hazard could sometimes be mitigated by increasing the
reactor pressure to 1 or 2 psi above the regenerator pressure with steam and monitoring for air ingress into the
main column. In other, more severe cases, the presenter recommended shutting down the air blower, though this
action presents additional hazards.b Husky Superior Refinery’s hazard evaluations and emergency procedures
did not contain this type of information before the April 2018 shutdown.
The CSB concludes that Husky Superior Refinery did not identify safeguards beyond operator action to prevent
unintended flow from the regenerator into the reactor during transient operation, because both catalyst slide
valves—the only other safeguards that Husky Superior Refinery identified—would already be closed. Although
Husky Superior Refinery identified its catalyst slide valves as an important safeguard to prevent catastrophic
scenarios, it had not evaluated nor defined necessary actions to take in the FCC unit’s operation in the event that
a slide valve lost its assumed functionality or was otherwise not available when needed.
Since the incident, Husky Superior Refinery conducted a new PHA/LOPA study as part of the FCC unit rebuild
project and involved the technology licensor for input. These studies resulted in new recommendations to
incorporate into the Superior Refinery’s FCC unit rebuild project. The Superior Refinery stated that the new
FCC unit will include a safety instrumented system that automatically brings the unit to a safer operating mode
in response to scenarios that could cause a reverse flow or low slide valve differential pressure. Additional
recommendations included classifying the slide valves as Safety Critical Equipmentc and ensuring that operators
are trained to verify a proper pressure difference between the regenerator and the reactor.
transient operation safeguards discussed in this report. In addition, CSB makes CSB Recommendation 2018-02-
I-WI-R3 to Cenovus Superior Refinery to develop and implement a slide valve mechanical integrity program
that addresses erosion and ensures proper functioning of the slide valves during a shutdown. Furthermore, the
CSB issues CSB Recommendation 2018-02-I-WI-R4 to Cenovus Superior Refinery to develop emergency
procedures for responding to a loss of catalyst slide valve function, for example, when it leaks excessively or
fails to close on demand.
a
In one 2016 process safety paper, the authors define “process safety time” as “the amount of time that is available to take action on the
process to move it to a safe state after an out-of-control condition has been observed to occur in the process” [185, p. 3].
b
The hazards of shutting down the air blower may include accumulation of hydrocarbon in the regenerator, lack of sufficient steam flow
from the reactor to the main column, and the generation of flammable hydrogen inside the regenerator when steam is injected into the
regenerator for an extended time.
c
According to its corporate risk management policies, Husky required its business units to implement a barrier management system for
safety critical elements. Husky defined a safety critical element as a “[barrier] whose failure will either cause or contribute to a [major
accident event], or the purpose of which is to prevent or limit the effect of a [major accident event].” According to the standard, “[t]he
Safety Case provides a comprehensive document that demonstrates that the appropriate plans have been developed and implemented to
manage significant risks to as low as reasonably practicable (ALARP).” Husky’s barrier management systems included performance,
assurance, and verification activities that the facility personnel monitor, follow up on, and possibly improve throughout the equipment’s
lifecycle.
97
4.1.4 Hierarchy of Controls for FCC Transient Operation

“Hierarchy of controls” and “prevention through design” are two industry concepts that highlight the
prioritization of engineered controls over procedural controls as more robust safeguards for controlling process
hazards. The National Institute for Occupational Safety and Health (“NIOSH”) defines the hierarchy of controls
as “a way of determining which actions will best control exposures [to hazards in the workplace]” (Figure 38)
[79]. The NIOSH website explains:
The hierarchy of controls has five levels of actions to reduce or remove hazards.
The preferred order of action based on general effectiveness is:
1. Elimination
2. Substitution
3. Engineering controls
4. Administrative controls
5. Personal protective equipment (PPE).
Using this hierarchy can lower worker exposures and reduce risk of illness or
injury [79].
Procedural safeguards fall under the category of administrative controls [69, p. 10].
98
Figure 38. Hierarchy of controls. (Credit: NIOSH [79])
“Prevention through design” was a concept first introduced by the American Society of Safety Professionals
(“ASSP”) in 1994 (as “safety through design”) and was later defined as an industry standard through the
American National Standards Institute (“ANSI”) in ANSI/ASSP Z590.3, Prevention through Design:
Guidelines for Addressing Occupational Hazards and Risks in Design and Redesign Processes [80, p. 5]. The
standard provides guidance for “design and redesign” processes to avoid, eliminate, reduce, and control hazards
through a system’s life cycle, from its initial design through its end of service. A system’s life cycle
encompasses the pre-operational stage (design and construction), operational stage (intended use of the system),
and post-operational stage (decommission). CCPS also discusses these concepts in its publication Inherently
Safer Chemical Processes – A Life Cycle Approach [69].
U.S. refinery units have a long operational stage—according to a 2014 article, most U.S. refineries were
between 50 and 120 years old, and the newest U.S. refinery with significant downstream unit capacity was built
in 1977 [81, 82]. About 90 of these refineries operate FCC units, many of which were likely initially constructed
many decades ago. For example, Husky Superior Refinery’s FCC unit operated from about 1961 to 2018, about
57 years, with at least one major revamp in 1994 since its initial construction. The prevention through design
concepts should be applied continually through the entire life of these aging refinery units.a
a
The CSB has advocated for inherently safer design (prevention through design) in several of its previous investigations, including
Williams olefins plant explosion and fire (2016) [107], Tesoro refinery explosion (2010) [106], Chevron Richmond refinery fire (2012)
[164], Exxon Baton Rouge chemical release and fire (2016) [166], and others.
99
The refining industry has significantly improved safety in FCC units since UOP designed the Superior
Refinery’s FCC unit in 1960. Many FCC units are now armed with automated safety shutdown systems that
bring the unit to a safer standby mode in certain scenarios by stopping hydrocarbon feed, closing the catalyst
slide valves, and injecting additional steam into the riser [70]; however, subsequent actions to maintain the unit
in that modea or to transition it to another mode (such as shutdown, startup, or another standby mode) still rely
on human (procedural) controls. For example, once a typical modern automated shutdown system closes catalyst
slide valves and injects a large amount of steam into the reactor, it is then up to the operators to establish and
control the desired pressure differences between the reactor, the regenerator, and the main column. Most of
these systems currently do not automatically control pressure differences between equipment to establish an
effective reactor steam barrier [70].b UOP representatives told CSB investigators that the reactor steam barrier,
which it considers to be one of the primary safeguards during transient operation, is difficult to automate due to
the controlled manner required for adjusting the vessel pressures. During transient operation, the board operators
are expected to adjust the reactor and regenerator pressures in small increments until they achieve a target
pressure difference between the reactor and the regenerator. If vessel
pressures are adjusted too quickly, the fluidized catalyst could “lift” KEY LESSON
out of the regenerator or reactor, sending large amounts of catalyst into
Technology licensors should seek
the main column or out of the atmospheric flue gas stack, causing
to continually improve the
further process upsets and environmental impacts. Other FCC
technology licensors expressed similar concerns over completely inherent safety of their
automating a shutdown sequence where many actions involving equipment designs and clearly
different parts of the entire unit require outside operators to manually communicate process safety
c
perform certain tasks. The particulars of FCC operations are unit- hazards to the owners and
specific, and any automation would need to be engineered specifically operators of their technology.
for that unit’s design.
Although FCC technology has matured significantly since its first commercialization in the 1940s, the refining
industry continues to find prevention through design opportunities. For example, after the 2015 Torrance
incident, where flammable hydrocarbons ignited inside the ESP in the FCC unit’s flue gas system, the industry
responded with some facilities automating ESP shutdowns in the event of upset conditions. In doing so, these
refineries shifted from a procedural safeguard (operator-initiated ESP shutdown in response to process
conditions) to an engineered safeguard (automatic ESP shutdown based on pre-defined criteria), moving towards
a more robust approach that is higher within the hierarchy of controls [83]. This transition influenced the EPA to
update its air emissions regulations, acknowledging that emissions may need to be higher in certain FCC
transient operations to enable safer operation [84, p. 18, 85, 86, pp. 75218-75222].d
a
In the ExxonMobil Torrance Refinery incident, the FCC unit was initially in a “safe park” mode. Refinery employees changed steam
rates during safe park, which compromised the reactor steam barrier and caused hydrocarbons to backflow from the main column into
the regenerator [108, p. 21].
b
The CSB is aware of at least one refinery that has added automation capability to continually control the main column pressure below
the reactor pressure during transient operation.
c
Board and field operator actions vary based on the FCC unit technology and unit configuration, but some field operator action examples
may include: field-verification that the valves required to close are closed; opening the reactor vapor line vent valves; opening the main
air blower discharge vents; starting a natural gas injection into the main column; switching purge media on reactor catalyst differential
pressure instruments between nitrogen and natural gas.
d
40 C.F.R. § 63.1564(a)(5)
100
In addition to the new safeguards Husky Superior Refinery is planning to implement in its FCC unit rebuild
project, as discussed in previous sections, Husky Superior Refinery is installing a new positive isolation valve
between its new FCC reactor and the main column, a more advanced engineering control.a This valve, intended
for startup, shutdown, and standby use, could allow the reactor-regenerator system to be isolated from the main
column earlier in the shutdown procedure. This would reduce the amount of time that the refinery needs to rely
on the reactor steam barrier to separate the air and hydrocarbon systems, which is a weaker safeguard than a
mechanical positive isolation valve or blind.b “There [are] a few suppliers now that supply [reactor overhead
isolation valves],” a presenter explained in AFPM’s February 2020 webinar. “They're getting to be more
common, and they do offer a lot of flexibility in your [startup, shutdown, and standby] procedures” [68].
As discussed previously in this section and in Section 3.2, generally accepted practices for safe FCC transient
operation rely heavily on operator actions. In fact, an FCC unit is a dynamic, complex system comprising
chemicals, hardware, software, humans, and the interfaces between these components. The discipline that
incorporates human factors within the engineering process is called human factors engineering [87, p. 13]. The
Prevention Through Design standard defines human factors engineering as:
The application of human factors information to the design of tools, machines,

systems, tasks, jobs, and environments for safe, comfortable, and effective
human use. Human Factors is a body of knowledge about human abilities, human
limitations, and other human characteristics that are relevant to design [80, p. 14].
When a hazardous process is primarily controlled by procedural safeguards, such as transient operation at an
FCC unit, training the operators to understand and execute the procedures with high reliability becomes crucial.
Furthermore, FCC units typically shut down for a turnaround approximately once every five years, limiting the
opportunity for operators to acquire hands-on experience in performing the required procedural steps used to
shut down the FCC unit safely. Although operational competence can be strengthened by employing a robust
operator training program, Husky Superior Refinery’s operator training program lacked hands-on practice
opportunities, such as using simulators, to prepare operators for planned shutdowns. See Section 4.3.4 for
further discussion on operator training at Husky Superior Refinery.
Console and alarm design is an important element of human factors engineering and should be considered for all
operating modes. Effective human-machine interfaces can help operators identify and address process problems
quickly. For example, if a process technology requires a separate set of operating limits during a transient
operating mode, alarms that are in effect only when they are applicable in those modes may help the operators’
performance. Facilities could improve human-machine interfaces during transient operation with state-based
alarms that are only active during transient operation, special graphics for transient operation, control logic to
allow or prevent certain actions in transient modes, or other solutions. These alarms would need to be evaluated
uniquely for each unit and align with the operating procedures and operator training. The ANSI and the
International Society of Automation (“ISA”) standard published in 2016, ANSI/ISA-182.-2016: Management of
a
Typically, a major driver for installing this valve is to reduce human exposure to the dangerous flammable atmosphere inside the
process as the large blind is being inserted. On its website, TapcoEnpro (one manufacturer of this type of FCC unit valve) states, “The
manual insertion and removal of the blind flange is one of the most threatening operations in the refinery” [200].
b
While the reactor isolation valve is a good practice, the CSB did not conclude that not having this valve was causal to the incident. A
typical FCC unit shutdown still involves steps that require transient operation safeguards before the reactor isolation valve can be
closed; therefore, the incident might have still occurred if Husky Superior Refinery’s FCC unit had a reactor isolation valve.
101
Alarm Systems for the Process Industries, is an industry standard that provides guidelines for implementing an
effective process alarm system, including enhanced and advanced alarm methods [88]. Some refineries are
already implementing dynamically managed alarm systems, including in FCC units [89]. In 2022, AFPM hosted
a webinar titled FCC Dynamic Alarm Management, which discussed topics such as implementing “Dynamic
Alarming to automatically enable or disable certain alarms when the unit is in startup, recycle, run, or other
operating modes” [90]. Post-incident, Husky Superior Refinery reported upgrading its alarm management
systems and processes, and its investigation report of its April 2018 incident recommended that Husky Superior
Refinery prepare critical alarm lists specifically for shutting down its FCC unit.
The CSB concludes that the petroleum refining industry should continue to design and implement safeguards
that are higher on the hierarchy of controls to improve process safety in FCC units during transient operation. To
document and inform the refining industry of current practices in FCC unit design for prevention, the CSB
makes a recommendation to API to develop a technical publication for the safe operation of FCC units,
including a discussion of recommended safeguards for transient operation (CSB Recommendation 2018-02-I-
WI-R13).
4.2 Process Knowledge
4.2.1 Factual Information
4.2.1.1 FCC Technology Licensor

Husky Superior Refinery licensed its FCC technology from Honeywell UOP (“UOP”), which designed the unit
in 1960. UOP’s service agreement with Husky Superior Refinery included periodic visits, reviews, and
consultations with UOP’s service representatives. According to Husky Superior Refinery and UOP
representatives, UOP would typically assist the refinery with engineering studies, small scope projects,
turnaround inspection support, and general consultation by e-mail. Neither Husky Superior Refinery nor UOP
employees could recall a time when UOP reviewed the FCC unit’s existing operating procedures.
UOP offers various training courses for its FCC technology [91]. Training material typically covers startup,
shutdown, and emergency procedures as described in the UOP General Operating Manuals for its FCC units.
The CSB identified at least three Husky Superior Refinery employees who had individually attended UOP’s
one-week FCC Fundamentals training course over the past 20 years: one in the 1990s, one in the early 2000s,
and one in 2014. These employees were either engineers who were not involved in overall operating procedure
and operator training development, or former operators without a technical degree. Although some refinery
technical staff had attended the one-week UOP FCC Fundamentals training course, most recently in 2014, they
were not involved in writing or reviewing the operating procedures.
4.2.1.2 UOP’s General Operating Manual

According to UOP representatives, UOP includes a General Operating Manual as part of the basic engineering
package for each new FCC unit or major FCC revamp project. This document provides a general operating
philosophy for the FCC unit, including generic procedure descriptions that clients use to adapt to their units.
Over a fifth of the 300-plus-page manual discusses normal startup, normal shutdown, emergency, and special
102
procedures, incorporating guidelines to prevent inadvertent air or hydrocarbon reversals during transient
operations. According to UOP representatives, the General Operating Manual itself is part of the UOP
technology.
UOP representatives asserted that the client is responsible for writing its own operating procedures that are
based on the guidance within the UOP General Operating Manual. The client could consult with UOP or an
alternate technology expert to review its procedures to ensure that key points are highlighted; however, UOP
does not require this review. UOP’s approach is similar to those of other FCC technology licensors who spoke
with the CSB. Typically, the FCC technology licensors provide similar FCC manuals as part of their technology
license agreements but the licensor is typically not responsible for developing or overseeing the site-specific
operating procedures.
In 1994, Husky Superior Refinery revamped a portion of the FCC unit to improve its regenerator efficiency and
emissions performance.a A refinery employee told the CSB that the revamp project did not change the FCC
unit’s overall operation and that the project did not require extensive procedure rewrites. In addition, the CSB
did not find evidence that UOP included a new General Operating Manual with its 1994 revamp project.
UOP had been keeping technical information in its General Operating Manual updated and making it available
to its clients, by request, as part of the technical license agreements.b Sometime during or after 2016, UOP sent
Husky Superior Refinery an updated General Operating Manual in response to a general request; however, the
CSB could not determine the purpose of this request. Furthermore, the CSB did not find evidence that the 2016
manual was used to evaluate or update the operating procedures at Husky Superior Refinery before the incident.
The 2016 manual was not mentioned in the process safety information checklist for the 2016 PHA study.
Prior to receiving UOP’s 2016 manual, Husky Superior Refinery also had the 1960 version of UOP’s manual.
Similar to the 2016 version, the 1960 manual described a generic stacked UOP FCC technology design and
contained discussions of normal startup, normal shutdown, emergency, and special procedures. A refinery
manager told CSB investigators that in recent years, this previous manual was used as “a reference manual” that
contained “general information” on the unit that operators could review. In addition, this 280-page document
was not cited as part of the process safety information package documented for the unit nor was it referenced in
the refinery’s FCC operator training program.
a
The revamp project, designed by UOP, improved heat integration in the flue gas section and improved flue gas emissions control with a
new ESP and flue gas stack. This project enabled the regenerator to operate in a “full burn” mode, meaning that it could now fully
regenerate the catalyst without requiring additional downstream combustion equipment [25, p. 9].
b
UOP representatives informed the CSB that UOP’s practice is to send an advisory to its clients when it makes safety-critical updates to
the General Operating Manual. UOP requires each client to acknowledge that it received the advisory. UOP issued only two service
advisories to its licensees that owned/operated “Stacked FCC unit with bubbling bed regenerator, main column, and gas concentration
unit[s]” since around 2020. According to UOP, neither of these advisories applied to Husky Superior Refinery unit.
103
4.2.1.3 Husky Superior Refinery’s FCC Unit Operating Procedures

Husky Superior Refinery’s policiesa held the area superintendents responsible for operating procedures in their
areas. The area superintendents were typically former operators, like in the FCC unit. A refinery employee
characterized procedure management as “primarily an operations group function.”b
Husky Superior Refinery required its operating procedures to be developed “by the Subject Matter Experts with
inputs from qualified operators or personnel with direct experience and knowledge regarding the process in
which the procedures are being developed.” According to Husky Superior Refinery’s policies, the area
superintendent reviewed, approved, and initially certified the operating procedures. After initial certification, the
area superintendent annually re-certified all operating procedures in his or her area.c
Many of Husky Superior Refinery’s FCC unit procedures used leading up to the day of the incident indicated
that they were written in 1993; in reality, some of their content was potentially much older. According to one
employee, some FCC unit procedures already existed in paper format prior to 1993.d “[I]n the early ‘90s, you
had two things: you had PSM coming ine plus you had the computer age,” he explained. In 1993, “the procedure
writers were basically taking [the old procedures that had been in place for many years] from the typewriter
version into a computerized version so that we could fulfill our PSM requirements,” the employee explained.
Murphy Oil’s Superior Refinery operations department took some operators off shift to write formal procedures
in the 1990s. At the time, according to a Husky Superior Refinery employee, the operations department did not
solicit further input from its engineers or from UOP on the procedures. Engineer involvement in reviewing or
contributing to the procedures during this period in the 1990s was “probably minimal.”
For the 2018 turnaround, the process engineer was responsible strictly for the chemical cleaning portion of the
shutdown procedures in the FCC area and was not monitoring the rest of the FCC unit shutdown on the day of
the incident. The CSB did not find evidence that the key process safety-related steps in other parts of the FCC
shutdown procedure used on the day of the incident had been reviewed by UOP or by other entities outside of
the operations department for at least 25 years leading up to the 2018 incident.
Husky Superior Refinery provided the following explanation regarding the refinery’s policies and operating
procedures at the time of the incident:
Please note that the shutdown procedures were ones that [Superior Refining
Company] SRC inherited from Calumet and, prior to that, Murphy Oil. As the
planning for the 2018 turnaround was well underway when Husky purchased the
Refinery, SRC did not have sufficient time to implement the Husky HOIMS
a
The Superior Refinery had last updated its PSM Policy and Procedure for operating procedures in December 2016.
b
Operators at Husky Superior Refinery typically did not have technical or engineering backgrounds.
c
Both OSHA’s PSM Standard and EPA’s RMP Rule have similar requirements for reviewing operating procedures: “The operating
procedures shall be reviewed as often as necessary to assure that they reflect current operating practice, including changes that result
from changes in process chemicals, technology, and equipment, and changes to [facilities (PSM Standard)/stationary sources (RMP
Rule)]. The [employer (PSM Standard)/owner or operator (RMP Rule)] shall certify annually that these operating procedures are current
and accurate.” 29 C.F.R. § 1910.119(f)(3); 40 C.F.R. § 68.69(c).
d
Husky Superior Refinery did not provide procedures that dated earlier than 1993 for the investigation.
e
The OSHA regulation 29 C.F.R. § 1910, “Process Safety Management of Highly Hazardous Chemicals” was issued in 1992 [168].
104
[Husky Operation and Integrity Management System] or thoroughly review and

revise the FCCU (and other SRC) shutdown procedures prior to the
commencement of the 2018 turnaround.
4.2.1.4 External Knowledge-Sharing

While Murphy Oil operated Superior Refinery for 53 years, it owned only one other refinery in the United States
with minimal communication between the two facilities [15]. When Calumet acquired Superior Refinery in
2011, it was the only fuels refinery that the company owned. Calumet bought an additional refinery in Montana
in 2012, which also had an FCC unit [92, 93]. Husky Superior Refinery employees indicated that little to no
FCC knowledge-sharing was conducted with their new sister refinery while working under Calumet.
While Husky owned two other refineries when it acquired Superior Refinery, there was minimal knowledge
sharing across sites before the incident. Cenovus provided the following explanation regarding Husky’s
acquisition of Husky Superior Refinery prior to the April 2018 turnaround:
While Husky had a culture of sharing technical services across sites, Husky
elected not to implement its processes and procedures into the Superior Refinery
immediately post acquisition because a substantial change in such processes and
procedures immediately prior to a turnaround was deemed a safety risk.
When the refinery brought outside experts to evaluate the FCC unit, its surveys focused mainly on process
optimization during normal operation. “The feedback we always got is [that] the unit’s pretty well optimized for
being such an old unit,” a refinery employee told the CSB.
4.2.2 Analysis
4.2.2.1 Discrepancy Between UOP Guidance and Husky Superior Refinery

Operations
The CSB could not determine whether the original FCC unit procedures had been reviewed by UOP. In
addition, the CSB did not find evidence that the procedures ever underwent a technical review to confirm that
they were consistent with UOP’s operating philosophy. For example, the refinery’s operating practice of setting
the regenerator pressure higher than the reactor pressure during a shutdown, which contradicted UOP guidance,
possibly existed since its original version from 1960.
Even if the original procedures had not initially been consistent with UOP’s guidance, or if the procedures
deviated from the original design intent over time, Husky Superior Refinery could have identified the
discrepancy between the General Operating Manual and its operating procedures at some point during the 57
years from the initial commissioning until the explosion. However, Husky Superior Refinery’s procedure
management policies did not require robust, periodic technical reviews. Had technical staff reviewed the
refinery’s shutdown procedure and compared it with UOP’s guidance, they could have identified the
discrepancies and incorporated UOP’s shutdown guidance, which could have prevented the dangerous mixing of
air and hydrocarbon during the shutdown. Furthermore, had Husky Superior Refinery audited its procedures
105
with an FCC technical subject matter expert, the refinery could have identified and addressed critical gaps in its
shutdown procedure many years before the incident.
OSHA asserts in its PSM guidelines that “operating procedures should be reviewed by engineering staff and
operating personnel to ensure their accuracy” [94]. However, Husky Superior Refinery’s engineers were not
expected to be familiar with startup and shutdown procedures of their assigned units, because refinery
management considered procedures as primarily an operations group function.
For many years, Husky Superior Refinery relied solely on the

operations staff to ensure operating procedure accuracy. However, a KEY LESSON
facility’s operating practice can deviate from industry operating Subject matter experts’ and
practices over time for various reasons. Facilities are more likely to consultants’ reviews of a process
proactively catch technical errors in critical proceduresa if they engage unit’s performance should not be
multidisciplinary teams to review the procedures periodically, ideally limited to normal operations.
with a technical subject matter expert. Some refineries are supported Even old and established
by central FCC subject matter expert personnel associated with their operating procedures might
parent company. Others are limited in FCC expertise and rely on local
contain errors, inadequacies, or
staff to be the technical authority. These refineries could consider
deviations from current generally
hiring consultants for periodic, independent procedure reviews.b
accepted industry practices. For
The CSB concludes that because Husky Superior Refinery’s policies specialized technologies,
did not require periodic technical review of its critical operating companies should consider
procedures by multidisciplinary teams, major errors and omissions periodic audits of a unit’s existing
remained undetected in the FCC unit’s operating procedures for process safety information, such
decades. Had a multidisciplinary team reviewed the operating as operating procedures, by
procedures, with guidance from a subject matter expert, the technical subject matter experts.
errors and omissions could have been identified and resolved to match Companies that do not have
the process technology information provided by the licensor, and the centralized subject matter expert
explosion could have been prevented. departments to review process
safety information should
In 2020, Husky Superior Refinery updated its operating procedures
consider hiring consultants.
policy to require technical reviews by the unit engineer on all
procedures. In addition, the new policy now requires a PHA for unit
startup and shutdown procedures and recommends the use of available vendor technical or instruction manuals
to develop the procedures, with a LOPA as needed to address risks above an acceptable threshold. Adding
operating procedures to the PHA cycles should ensure that the study teams evaluate the risks in these procedures
at least once every five years, keeping them relevant and continually improving.
a
Critical procedures may include startup, shutdown, standby, emergency, and other non-routine procedures deemed by the facility to
have severe process safety consequences if not executed properly.
b
Refinery personnel brought in an independent consultant to assess the health of the FCC unit operation in 2015; this was a one-time
visit and procedure review was not part of the scope.
106
4.2.2.2 Transforming Information into Knowledge and Competency

To effectively identify and control hazards, process safety information must be transformed into knowledge and
competency at the worker level. The CCPS publication Guidelines for Risk Based Process Safety asserts,
“Knowledge management, not information management, helps organizations understand and manage risk and
remain competitive” [95, p. 91].
Although maintaining a reactor steam barrier to separate the air and hydrocarbon systems is a critical safeguard
in an FCC shutdown, the refinery employees that the CSB interviewed were not familiar with this concept
(discussed in Section 4.1.1). None of the employees mentioned the need to purge the main column with a gas to
prevent air from accumulating in the overhead system (discussed in Section 4.1.2). In addition, many employees
believed that slide valves and catalyst levels completely isolated the air from the hydrocarbon within the unit
(discussed in Section 4.1.3). These shortcomings were apparent in the procedures, training, and hazard
assessments that Husky Superior Refinery had in place.
The CSB concludes that Husky Superior Refinery’s FCC technology-specific process knowledge did not
adequately address unit safety in transient operations, including shutting down the unit for a turnaround. Gaps in
knowledge management filtered through procedures, training, and hazard assessments, leaving refinery
employees unequipped with the knowledge necessary to control the FCC unit’s potential transient operation
hazards, such as the inadvertent mixing of air and hydrocarbon that could lead to an explosion inside process
equipment.
Husky Superior Refinery had employees with many years of

KEY LESSON experience working at the FCC unit. Multiple levels of operations
Facilities should participate in supervisors, superintendents, and managers had started their careers as
process safety knowledge- FCC unit operators or engineers. As these employees gained
sharing with their peers. Each experience and advanced in their careers, they were promoted into the
site should focus on expanding roles responsible for managing the training programs and procedure
its process knowledge and draw revisions. As a result, the erroneous procedures—not aligned with
on sister sites and industry UOP’s General Operating Manual guidance—were institutionalized as
part of the training program for all FCC unit operators for decades.
organizations to avoid siloes. The
refining industry has many An organization’s competency depends on more than individual
opportunities for technology- training. In Guidelines for Risk Based Process Safety, CCPS says, “The
specific process safety competency element focuses primarily on organizational learning,
information-sharing networks. whereas the training element addresses efforts to develop and maintain
the competence of each individual worker” [95, p. 91]. Though Husky
Superior Refinery’s management encouraged individuals to attend training classes and industry events, the
training was not enough to increase the organization’s FCC competency at the worker level.
The CSB concludes that for much of Husky Superior Refinery’s history, its FCC expertise was mostly in-house,
with minimal engagement with other refineries. Though Husky Superior Refinery’s management encouraged
individuals to attend industry events and UOP’s training classes, this individual training did not establish
sufficient knowledge or competency within the organization to prevent the April 2018 incident.
107
For some technologically advanced processes, CCPS recommends allocating “technology stewards” responsible
for transforming information into organizational knowledge:
In some cases, more advanced portions of the [process] knowledge are developed
and maintained by a “technology steward” who may also be responsible for
understanding and documenting this information for all of the company’s
facilities that operate a particular type of unit [95, p. 174].
Many companies that operate multiple refineries have technology stewards responsible for the FCC competence
of their organizations. In companies that do not have centralized technical resources, such as Murphy Oil and
Calumet, the technology steward is typically a local employee who has experience working with the technology.
However, relying solely on in-house expertise may lead to blind spots in the organization’s competency. Even
mature operating procedures might contain errors, inadequacies, or deviations from current generally accepted
industry practices unbeknownst to the technology steward. To overcome siloes, CCPS recommends:
Solicit knowledge from external sources. A single individual or single

organization rarely has a monopoly on knowledge or possesses all of the answers
related to a particular operation. Even if a facility has no direct counterpart,
management systems and approaches used to manage risk can be benchmarked
against those of other organizations, both within the company and within the
industry [95, p. 99].
When the Superior Refinery brought outside experts to evaluate the FCC unit, their surveys focused mainly on
optimization during normal operation. While refinery employees believed that the FCC unit operated well, the
process safety competence gaps for transient operations became a blind spot for the organization, ultimately
leading to a catastrophic incident.
The CSB concludes that Husky Superior Refinery’s use of external technical experts was limited to efforts
aimed at assessing and improving the FCC unit’s performance during normal operation. Had the refinery
effectively assessed its FCC unit’s operating procedures with UOP or an FCC subject matter expert with
comparable industry knowledge, it should have identified and addressed the long-standing process knowledge
gaps around its FCC unit’s major transient operation hazards, and the incident could have been prevented. To
aid refineries in identifying process safety opportunities in FCC units, the CSB recommends that API develop
guidelines for process safety assessments of FCC units in a new industry technical publication for the safe
operation of FCC units in CSB Recommendation 2018-02-I-WI-R13.
Cenovus Superior Refinery is rebuilding its FCC unit with the support of UOP, Cenovus Superior Refinery
engineers, Cenovus senior engineers, and external consultants. Furthermore, Cenovus Superior Refinery is now
part of a larger network of expertise and experience within the company. In a letter to the CSB, Cenovus
explained:
Post-incident, Superior has been incorporated into the company’s technical

collaboration and safety culture, which included sharing information and
technical expertise across the company’s multiple operating facilities through a
collaborative culture and technical expertise located in the company’s
108
Downstream Technical Service function (“DTS”). DTS functions to safely and

reliably run the company’s [facilities]. DTS leverages and supports
implementation of common improvement efforts as well as enhancing local
capabilities across the company’s downstream manufacturing operations. This
function also provides a broad range of services, including technical expertise
relating to FCCUs and other refinery process units.
Connecting Cenovus Superior Refinery to a wider support network that was not available under Murphy Oil or
Calumet should help strengthen its workforce’s overall competency. The CSB makes two recommendations to
improve FCC competence and knowledge-sharing across Cenovus refineries, including Cenovus Superior
Refinery: developing an FCC unit PHA guidance document to be implemented at all refineries with FCC units,
drawing from available industry guidance (CSB Recommendation 2018-02-I-WI-R8), and implementing
technology peer networks (including an FCC technology peer network) where engineers, operations
management, and operations staff meet to discuss relevant process safety topics at least annually (CSB
Recommendation 2018-02-I-WI-R9).
4.3 Process Safety Management Systems
4.3.1 Process Safety Information

In its process safety information (“PSI”) policy, Husky Superior Refinery requires that process technology
information be documented for each process. Husky Superior Refinery defines process technology as
“information concerning the methodology (technology) used in the chemical conversions which are
accomplished in the designated process.” Documentation types that fall under this category may include
“process flow diagrams, process chemistry description, maximum inventories, safe upper and lower limits with
consequences of deviation, and material and energy balance tables.”
The refinery’s PHA policy also stated, “Process Safety Information (PSI) for the unit to be studied must be
available and up-to-date.” Husky Superior Refinery maintained these documents for the FCC unit. However,
neither the 1960 nor the 2016 UOP manuals were cited as process safety information referenced in any of the
PHA studies.
4.3.1.2 Analysis
Federal process safety regulations require refineries to keep records of “process safety information” that pertain
to the hazards, the technology, and the equipment in their processes. The OSHA PSM Standard explains:
109
The compilation of written process safety information is to enable the employer

and the employees involved in operating the process to identify and understand
the hazards posed by those processes involving highly hazardous chemicals.a
OSHA, EPA, and CCPS define three types of process safety information:
• information pertaining to chemical hazards;
• information pertaining to process technology; and,
• information pertaining to process equipment [95, p. 176].b
In its Process Safety Management Guidelines for Compliance, OSHA advises,
The process safety information package helps to ensure that the operating
procedures and practices are consistent with the known hazards of the chemicals
in the process and that the operating parameters are correct [94].
While the regulations provide minimum requirements, OSHA has indicated that the standards’ performance-
based nature allows facilities to determine the appropriate set of process safety information needed for their safe
operation, including process safety information beyond the minimum requirements specifically called out in the
PSM Standards. For example, OSHA contended that for facilities at risk of flooding, flood-related documents
such as Federal Emergency Management Agency (“FEMA”) flood maps and Flood Insurance Studies could be
considered process safety information. Furthermore, modifications to this process safety information could
prompt a management-of-change review [96, pp. 98-99].c
The CSB met with three FCC technology licensors to understand how they communicate process technology
information to their clients. These licensors told the CSB that, similarly to UOP, they provide an operating
philosophy document that describes their technology, process hazards, and recommended operating methods.
The licensees are expected to use this information to develop their own procedures, hazard assessments, and
training programs.
OSHA issued its PSM Standard in 1992; in response, Husky Superior Refinery likely compiled the FCC unit’s
process safety information package sometime before the initial PHA study in 1995. At the time, the 1960
manual was likely the only written document at Husky Superior Refinery that described general FCC
a
29 C.F.R. § 1910.119(d) (2019)
b
29 C.F.R. § 1910.119(d) (2019), 40 C.F.R. § 68.65 (2020)
c
The CSB discusses this topic further in its investigation of the chemical decomposition, release, and fire incident at the Arkema Inc.
chemical plant in Crosby, Texas following a hurricane in 2017 [96].
110
technology concepts, such as specialty equipment, catalyst circulation, and general procedure guidance.a This
manual may have been used as a reference book in the past, but it appeared to have been phased out when the
refinery developed its own training materials in later years. Had UOP’s manual been maintained as process
safety information, Husky Superior Refinery could have ensured that its FCC technology information was up-to-
date and available to its employees.
The CSB concludes that most FCC technology safety information in UOP’s General Operating Manuals—
including a previous version likely published around 1960 and the more recent manual published in 2016—
applied to the current configuration of the FCC unit at the time of the incident and should have been included in
the unit’s process safety information. Had Husky Superior Refinery incorporated UOP’s technology knowledge
into its process safety management systems for the FCC unit, such as operating procedures, process hazard
analyses, and training material, more appropriate safeguards should have been available during the FCC unit’s
shutdown to prevent the explosion and fire.
The CSB issues CSB Recommendation 2018-02-I-WI-R10 to Cenovus Energy to include and maintain its FCC
technology licensors’ operating manuals in its FCC units’ process safety information packages, including the
Cenovus Superior Refinery.
4.3.2 Operating Procedures

The explosion occurred while the FCC unit was proceeding through a normal (planned) shutdown. In one
publication, CCPS defines a normal shut-downb as “a planned series of steps to stop the process at the end of
normal operations, taking the process equipment from its normal operating conditions to an idle, safe, and at-rest
state” [97, p. 20]. For activities such as normal shutdowns, federal safety regulations require companies to
“develop and implement written operating procedures that provide clear instructions for safely conducting
activities [...] consistent with the process safety information,” and that companies address “operating limits,
consequences of deviation, and steps required to correct or avoid deviation.”c FCC unit shutdowns involve a
complicated sequence of steps and typically occur only once every five years.
a
While UOP’s General Operating Manual includes procedure guidance designed to protect against inadvertent air and hydrocarbon
mixing, it does not always explain why the guidance is important. The operating manual is written in a way that assumes that the person
reading about the shutdown procedure has already read the process hazard information contained in the startup procedure section. For
example, the startup procedure section discusses keeping air and hydrocarbon systems segregated and keeping air from accumulating in
the main column; however, the shutdown procedure section does not mention the same inadvertent air or hydrocarbon reversal hazards.
In addition, the manual’s Emergency Procedures section limits its reversal discussions to those that occur during normal, continuous
operation only. While UOP offers classroom training to its clients to teach them the importance of its technology-specific process
safeguards, such as establishing the reactor steam barrier during transient operation, this information is scattered throughout the
operating manual.
b
In the cited reference, CCPS differentiates between the word “shutdown,” which is the mode where the process is not operating, and
“shut-down” (with a hyphen), which refers to the activity of shutting down the process [97, p. 4].
c
29 C.F.R. § 1910.119(f) (2019) and 40 C.F.R. § 68.52 (2020).
111
4.3.2.1 Clear Instructions

4.3.2.1.1 Factual Information
During interviews, CSB investigators asked refinery employees about their individual understanding of the
following instructions in the FCC unit shutdown procedure:
• “Always keep the Regenerator pressure a couple pounds higher than the Reactor pressure.”
• “You may have to have some catalyst in the reactor stripper to hold a seal across the spent slide valve.”
• “Maintain even pressure between Main Column and Regenerator.”
Refinery employees had slightly different explanations for what these instructions meant. One employee said
that the regenerator needed to be at least one pound higher than the main column. Another employee said that he
would expect the regenerator-reactor pressure difference to be “somewhere around a couple pounds, a pound or
two” during a shutdown (with the regenerator operating at the higher pressure), but was not aware of a pressure
difference that would be too high. One other said that the aim was “[...] making sure your pressure is such that
they’re...they’re pretty close, so that you’re not sending anything overhead through the reactor, hydrocarbon or
air.”
According to Husky Superior Refinery’s PSM Policy and Procedure, the refinery was required to hire a
professional third-party team to audit its chemical Process Safety Management and Risk Management Programs
at least once every three years. The last two audits from 2013 and 2016 both contained operating procedure
findings across the site. The 2013 audit findings included the lack of “clear instructions (observable and
measurable steps)” and “consequences of deviation” from the procedure steps. The 2013 report, however, made
no recommendations. In the 2016 report, the auditors reported that the 2013 audit findings concerning the lack
of clear instructions had “not been addressed.” The 2016 audit team made several recommendations, including
developing and implementing a standard template and format for the refinery’s operating procedures.
Following the 2016 audit, in 2017, Husky Superior Refinery converted its FCC unit shutdown procedure into a
new format. Compared with its previous 2014 version, some of the longer steps were broken down into smaller
actionable steps, but the instructions for the beginning of the shutdown remained the same.
4.3.2.1.2 Analysis
Husky Superior Refinery’s FCC unit shutdown procedure did not give clear instructions on separating the air
and hydrocarbon systems that could prevent an explosion. For instance, the shutdown procedure did not define
pressure relationship targets for the reactor, the regenerator, and the main column to create a steam barrier,
leaving vague statements up to each operator’s interpretation. The refinery’s shutdown procedure also did not
describe how to purge and control the main column pressure with non-condensable process gas.
While UOP did not prescribe specific equipment operating pressures in its General Operating Manual and
training material, it did explain how to achieve certain relative pressure differences between multiple pieces of
equipment during shutdowns. For example, because the reactor and the main column are typically
112
interconnected during the start of a shutdown, they operate as one system, and their pressures cannot be
controlled individually. Therefore, one factor that contributes to a stable pressure inside the reactor is a stable
pressure inside the main column. UOP’s 2016 manual said to maintain the reactor at a higher pressure than the
regenerator. In addition, UOP said to maintain the main column pressure control using fuel gas at various points
in its General Operating Manual and classroom training material.
Husky Superior Refinery’s FCC shutdown procedure did not address or otherwise cover how to maintain steady
control of the main column’s pressure using a process gas stream from the sponge absorber. Instead, it simply
defined a main column pressure target of 2 to 3 psig. On the morning of the incident, the board operator could
not lower the main column pressure below 5 psig most of the time, and his attempts to lower the pressure
resulted in unstable main column pressure control (Figure 15). Given the unstable main column pressure
control, the board operator set the regenerator pressure conservatively high to prevent potential hydrocarbon
backflow from the main column.
In the absence of clear instructions for managing pressure differences between the regenerator, the reactor, and
the main column during a shutdown, the board operator set a steady regenerator pressure that was at least 3 psi
higher than the reactor at all times, and at some points up to 10 psi higher, potentially resulting in a greater than
typical driving force that pressured air into the reactor.a Had Husky Superior Refinery prioritized steady main
column pressure control instead of exact pressure targets, the unit could have operated with a lower regenerator-
reactor pressure difference, thereby reducing the driving force for inadvertent air flow into the system. Thus, the
same amount of air would have taken longer to accumulate in downstream equipment, and the explosion might
have been avoided.
Husky Superior Refinery could not provide data from previous shutdowns for comparison, but one reason that a
similar incident did not occur in the unit’s history could have simply been due to differences in operators’
interpretation for “maintaining even pressure between [the] Main Column and [the] Regenerator.”
The CSB concludes that Husky Superior Refinery had not determined safe operating limits for pressure
differences between the regenerator, the reactor, and the main column during a shutdown. In addition, the
refinery’s shutdown procedure provided vague instructions for pressure differences and difficult-to-achieve
main column pressure targets. The absence of implementable guidance in the refinery’s shutdown procedure
likely contributed to the regenerator operating up to approximately 10 psi above the main column’s pressure,
without a reactor steam barrier, and driving a dangerously large amount of air from the regenerator into the main
column.
In 2019, post-incident, Husky Superior Refinery adopted a new approach called Usability Mapping for its
operating procedures. According to Usability Mapping, this approach uses language simplification and
document formatting to help comprehension [98]. In 2020, Husky Superior Refinery updated its operating
procedures standard (policy) to require this Usability Mapping technology. The Superior Refinery has since
been rewriting over 1,200 of its procedures using this approach. The CSB makes no further recommendations on
this topic.
a
Husky Superior Refinery could not provide data to compare typical main column pressure during previous shutdowns. Therefore, the
CSB could not conclude whether the main column pressures observed on the day of the incident were abnormal.
113
4.3.2.2 Operating Limits for Transient Operation

KEY LESSON
4.3.2.2.1 Factual Information Transient operations, such as
startups, shutdowns, and
Husky Superior Refinery kept safe upper and lower limits, standby operation, may require a
consequences of deviation, and corrective actions for each unit on a different set of safe operating
spreadsheet that operators could access through a refinery information limits compared with normal
server, along with other process safety information. The spreadsheets
operation. For startup,
contained normal operating levels, pressures, temperatures, and flows
shutdown, and standby
for each equipment as well as their design upper and lower limits.
operating modes, consider
According to Husky Superior Refinery’s operating procedures, these
creating separate console
spreadsheets were “troubleshooting guidelines” used “in conjunction
with the Operating Procedures to respond to process deviations that screens and state-based alarms
have initiated a [console] alarm.” to help operators manage critical
process variables for transient
The FCC unit shutdown procedure included warning language for operation. These parameters
recognizing a hydrocarbon reverse flow into the regenerator but did not should be incorporated into
provide guidance for steps required to correct or avoid the deviation. operator training and operating
The following procedure excerpts describe abnormal situations procedures.
warning of air in the reactor and hydrocarbon in the regenerator:
• “A sharp temperature rise in the reactor will indicate a reversal.”a
• “Watch Flue Gas Stack for color. If yellow, check for leakage back from the Main Column.”
During CSB interviews, some current and former operators could not explain how air could have entered the
main column during a shutdown. One operator said that he monitored the temperature indicators to detect
reverse flow during the shutdown. Others explained that due to the reactor and regenerator equipment’s
configuration, the air inside the regenerator would flow out of the atmospheric stack, not into the reactor. These
operators did not mention how they could detect air flow into the main column.
In its post-incident 2018 inspection, OSHA cited Husky Superior Refinery for several violations related to
operating procedures, including:
[...] the standard operating procedures did not contain the operating parameters, consequences of
deviation from those parameters, and the steps required to avoid and correct the deviations [...]
[...]the operating procedures referred the operators to other documents that were not always readily
available [...] [99, pp. 13, 15].
a
A Refinery employee clarified that this note applied to the initial stages of the shutdown, and that after an hour or two into the
shutdown, “there’s no real indicator.”
114
While most of OSHA’s recommended abatements were specifically for the FCC unit, its recommendation for
operating procedures was to “include consequences of deviation in the operating procedures at the refinery, as
well as, the steps required to correct or avoid deviations,” (emphasis added) [99, p. 13].
4.3.2.2.2 Analysis
Husky Superior Refinery made its FCC unit’s process safety information, such as safe upper and lower
operating limits, consequences of deviation, and corrective actions, available for the operators to reference.
However, this information only applied to normal operation and resided in documents outside of the shutdown
procedure. According to the UOP General Operating Manual, the FCC reactor, which operates at a lower
pressure than the regenerator during normal operation, should have been at a higher pressure than the
regenerator during transient operation. This information was missing from the operating procedure and its
associated troubleshooting tools.
OSHA’s PSM compliance guidelines explain the importance of specifying transient operating parameters in
procedures:
Operating procedures provide specific instructions or details on what steps are to

be taken or followed in carrying out the stated procedures. The specific
instructions should include the applicable safety precautions and appropriate
information on safety implications. For example, the operating procedures
addressing operating parameters will contain operating instructions about
pressure limits, temperature ranges, flow rates, what to do when an upset
condition occurs, what alarms and instruments are pertinent if an upset condition
occurs, and other subjects. Another example of using operating instructions to
properly implement operating procedures is in starting up or shutting down the
process. In these cases, different parameters will be required from those of
normal operation. These operating instructions need to clearly indicate the
distinctions between startup and normal operations [...] [94] (emphasis
added).
Husky Superior Refinery’s FCC shutdown procedure did not specify some of the basic and essential operating
limits for the shutdown, such as keeping the reactor pressure higher than the regenerator. The shutdown
procedure should have explained why this step was important and what to do if it was not achievable. Had
Husky Superior Refinery’s operating procedures specified UOP’s recommended criteria for maintaining the
reactor at a higher pressure than the regenerator, with the appropriate warnings, operators could have established
and maintained a reactor steam barrier, and the explosion could have been prevented.
Vague language and missing information in the FCC unit’s shutdown procedure were symptoms of a refinery-
wide operating procedure quality problem for many years before the incident. Husky Superior Refinery’s
operating procedures were known to lack clear instructions, consequences of deviation, and the steps required to
correct and avoid deviations. The past two PSM and RMP compliance audits in 2013 and 2016 had highlighted
these concerns to refinery management. Despite finding these previous safety gaps, on the day of the incident,
Husky Superior Refinery’s FCC unit shutdown procedure still did not provide effective safe operating limits,
identify the consequence of deviating from these limits, or provide clear shutdown instructions to workers. The
115
CSB concludes that Husky Superior Refinery’s response to the 2013 and 2016 PSM and RMP compliance audit
findings regarding the overall quality of the refinery’s operating procedures was ineffective and ultimately did
not improve the quality of the FCC unit’s operating procedures enough to help prevent this incident.
In its PSM Guidelines, OSHA explains the importance of operating procedures during training:
Operating procedures and instructions are important for training operating

personnel. The operating procedures are often viewed as the standard operating
practices (SOPs) for operations [94].
Husky Superior Refinery’s training material and shutdown procedures did not discuss how to prevent dangerous
air and hydrocarbon mixtures from forming in accordance with UOP’s guidance. Because the written procedures
did not include clear instructions, consequences of deviation, and steps to avoid or correct deviations, operator
discussions about procedures also lacked this depth of detail.
The CSB concludes that Husky Superior Refinery’s FCC unit operating procedures were not an effective
training tool. Not only did the refinery’s procedures omit major industry-known safeguards, but they also lacked
clear instructions, consequences of deviation, and steps required to correct or avoid deviations that operators
should be able to discuss during their training.
Husky Superior Refinery’s 2020 update to its operating procedures policy included additional requirements for
operating limits and consequences of deviation. According to the updated policy, operating limits and
consequences of deviation will be contained within operating procedure steps, as notes, cautions, and warnings
within the operating procedures, unit key operating variable tables, and pre-job reviews, and within the
refinery’s computer control system help logs.
transient operation safeguards discussed in this report. Part (e) of this recommendation specifically addresses the
documentation of consequences of deviating from the transient operation safe operating limits and of
predetermined corrective actions. Part (f) applies to incorporating this information into operator training
material.
4.3.2.3 Changes to Operating Procedures

4.3.2.3.1 Factual Information
Husky Superior Refinery’s operating procedure policies required change management for new or modifications
to existing operating procedures. The policy required the same process for changing its operating procedures as
developing a new operating procedure—the subject matter expert would review/edit the procedure, the area
superintendent would certify and approve the procedure, and the procedure would be distributed and filed upon
approval. The area superintendent would forward the certified and approved operating procedures to the PSM
Administrator for archiving.
116
According to the refinery’s operating procedure policy, the area superintendent determined the level of training
required for operators after procedure changes. Training on both minor and major changes to operating
procedures required, at minimum, written instruction with sign-off documentation.
The refinery’s operating procedure change management policy did not specifically address or otherwise mention
a need to create Management of Change (“MOC”) tracking for changes to procedures, even though the
refinery’s separate MOC policy described changes to operating procedures as being within its scope. In addition
to area superintendent approval and training (as mentioned in the operating procedure policy), the separate MOC
policy would have also required a design review and safety and health review for MOCs, had refinery
employees deemed an MOC applicable for this type of change.a
Husky Superior Refinery told the CSB that it used its operating procedure policy to incorporate the refinery’s
new venting requirements and for the contractor’s chemical cleaning procedure planned for the 2018 FCC unit
turnaround. However, the refinery was unable to provide sign-off documentation confirming that the employees
involved in the 2018 shutdown acknowledged communication and training on changes to the shutdown
procedure. While some operators reported receiving the updated shutdown procedure ahead of time, at least one
operator said that he did not realize that they would not be able to vent the equipment out to the atmosphere, like
in previous shutdowns, until the morning of the incident.
4.3.2.3.2 Analysis
The EPA’s Refinery Sector Rule, first published in 2015 and finalized in 2020, issued requirements to further
control toxic air emissions from petroleum refineries [100].b Some of the updated provisions applied to potential
emission points that the EPA characterized as maintenance vents. In April 2018, the EPA described the new
requirements for maintenance vents in a Federal Register publication about its proposed rule:
Under 40 CFR 63.643(c) an owner or operator may designate a process vent as a

maintenance vent if the vent is only used as a result of startup, shutdown,
maintenance, or inspection of equipment where equipment is emptied,
depressurized, degassed, or placed into service. The rule specifies that prior to
venting a maintenance vent to the atmosphere, process liquids must be removed
from the equipment as much as practical and the equipment must be depressured
to a control device, fuel gas system, or back to the process until one of several
conditions, as applicable, is met (40 CFR 63.643(c)(1)) [101, p. 15463].
The EPA initially set the refineries’ compliance date for maintenance vents to February 2016, but then revised it
to August 2017, and later, January 2019. At the time of the incident in April 2018, the EPA’s compliance date
was August 1, 2017, but according to the EPA, “many refineries [had] made good faith efforts to achieve
compliance, including applying for and receiving an additional 12-month compliance extension. This [made]
their compliance deadline August 1, 2018” [102, p. 31942] Husky Superior Refinery was one of these refineries
a
According to Husky Superior Refinery, it did not have MOCs relevant to the turnaround.
b
40 C.F.R. Part 60 Subpart J, 40 C.F.R. Part 60 Subpart Ja, 40 C.F.R. Part 63 Subpart CC, and 40 C.F.R. Part 63 Subpart UUU.
117
to receive the 12-month compliance extension. In July 2018, the EPA proposed extending the compliance date
to January 2019. The rule became effective in February 2020.
Driven by anticipated EPA Refinery Sector Rule requirements, the 2018 turnaround was the first time that
Husky Superior Refinery required its equipment to be vented to the flare system instead of venting directly into
the atmosphere while shutting down. According to employee interviews, this was a proactive action to prepare
for compliance when the rule became effective, anticipated at the time as August 2018.
In previous shutdowns, FCC operators used to vent some of the

contents of the main column directly to the atmosphere using steam. KEY LESSON
During these venting activities in previous shutdowns, some of the The piping from process
oxygen that had likely migrated to the main column during Husky equipment to a refinery flare
Superior Refinery’s shutdown sequence likely vented to the system is a critical safety system,
atmosphere, instead of being routed to the gas concentration unit as especially during startups and
occurred during this incident. The CSB did not find evidence that shutdowns. Refineries should
Husky Superior Refinery employees recognized how venting changes
understand why and how to vent
to its FCC unit shutdown procedure impacted the air accumulation risk
and purge equipment to their
inside the main column overhead receiver.
flare system to start up and shut
The CSB concludes that while changing its FCC unit shutdown down a process unit safely.
procedure for the 2018 turnaround, Husky Superior Refinery did not Changes to venting and purging
recognize that eliminating the use of atmospheric vents made it more procedures must be evaluated
likely for oxygen to accumulate in the main column and increase the for their impacts on the process
potential for an explosion. Because the refinery’s staff did not have units.
process knowledge of oxygen accumulation risk in the FCC unit during
transient operation, they may not have identified the risk even had they completed a management of change or
risk assessment on their procedure changes.
Cenovus Superior Refinery’s FCC rebuild project, updates to its process safety management systems post-
incident, and the CSB recommendations for the refinery should address some of the knowledge gaps that
previously existed regarding FCC unit operations that led to the April 2018 incident. In addition, the refinery’s
updated operating procedures policy in 2020 requires all changes to approved procedures to follow the
refinery’s standard MOC process, and any changes to a procedure step to be risk assessed. The CSB makes no
further recommendations.
4.3.3 Process Hazard Analysis

PHA is a systematic, team-based effort to identify and evaluate hazards associated with processes to enable their
control [103]. PHAs became a federally regulated requirement for certain processes in the United States,
including all refineries, as part of OSHA’s PSM Standard and EPA’s RMP Rule in the 1990s.a A PHA must
identify and control process hazards that could occur during normal routine operations and non-routine
a
29 C.F.R. § 1910.119 (e) and 40 C.F.R. § 68.67 [168].
118
(transient) operations, such as startups and shutdowns. Companies must use an appropriate hazard analysis
methodology to identify, evaluate, and control process hazards, such as explosions and fires.

4.3.3.1.1 Refinery Policies
Husky Superior Refinery used a risk matrix, similar to the one shown in Figure 39 below, to relate each PHA
scenario to defined risk boundaries and risk reduction requirements [104, p. 220]. Husky Superior Refinery’s
severity criteria were based on potential injuries, environmental impacts, cost of equipment damage, or
production/quality impacts. Severity was ranked as high, significant, medium, or low risk.
Figure 39. Generic risk matrix. (Credit: Process Improvement Institute [105])
In its 2016 PHA and LOPA study, the team performed LOPA for PHA scenarios that the team identified to have
a “significant” to “high” severity consequence (regardless of likelihood).
Calumet Superior Refinery’s 2015 PHA policy required all PHA studies to include “[d]ocumentation of the
hazards of the process during all modes of operation.” The policy stated that all existing plant process units had
undergone an initial PHA, covering the hazards of the process or area during all modes of operation, utilizing
119
the Hazards and Operability (HAZOP) technique as defined in the CCPS publication, Guidelines for Hazard
Evaluation Procedures [104, p. 115].a
4.3.3.1.2 Husky Superior Refinery’s FCC Unit PHAs
Murphy Oil’s Superior Refinery completed the FCC unit’s initial PHA study in 1995. The subsequent three
studies in 2000, 2005, and 2011 were revalidations of the original study. In 2016, the refinery conducted a PHA
“re-do” and its first LOPA study on the FCC unit.b
The initial (1995) PHA team included four current FCC operators, a process engineer, and one former FCC
operator with at least 10 years of experience, totaling many years of collective experience operating the Murphy
Oil Superior Refinery’s FCC unit. This core team also called upon additional personnel from maintenance,
engineering, and operations to participate as needed. The team consisted of only Murphy Oil employees except
for a third-party PHA facilitator. The report described the study team’s approach for identifying scenarios for
analysis:
The scope of the hazard analysis was limited to a review of the process [piping]
and instrumentation diagrams (P&ID’s) under steady state normal operating
conditions for the FCCU. Certain start-up, standby and emergency shutdown
conditions were considered if they presented additional hazards not identified
during the discussion of steady state conditions.
The 1995 PHA team identified the following scenarios that could cause air to flow from the regenerator into the
reactor under steady state normal operating conditions:
• “Reversal of flow from the regen to the reactor via the spent slide valve (pressure, level, or spent slide
valve malfunction)”
• “Reactor level controller or spent slide valve malfunction or misoperation”
• “Reactor/regen [differential pressure] controller or flue gas slide valve malfunction” (Figure 40)
a
HAZOP is one method that can be used to conduct PHA studies. In its online glossary, CCPS defines HAZOP as: “A systematic
qualitative technique to identify process hazards and potential operating problems using a series of guide words to study process
deviations. A HAZOP is used to question every part of a process to discover what deviations from the intention of the design can occur
and what their causes and consequences may be. This is done systematically by applying suitable guidewords. This is a systematic
detailed review technique, for both batch and continuous plants, which can be applied to new or existing processes to identify hazards”
[103].
b
The OSHA PSM Standard requires that PHAs are updated and revalidated at least once every five years (29 C.F.R. 1910.119(e)(6)
(2019)). Companies use several approaches to keep PHAs up-to-date based on their needs. A “reval” is updating a previously completed
PHA document, and a “redo” is developing a new PHA as if it were an initial PHA [196].
120
Figure 40. Excerpt from the 1995 PHA.a (Credit: Husky Superior Refinery)
The 1995 PHA team did identify several transient operation scenarios, which included issues such as
“insufficient draining of water/moisture prior to startup,” “spent catalyst line plugged during startup,” and
“adding fuel gas to the [startup heater] ignitor with the ignitor blocked in.”b The PHA report did not describe
how the team identified these and other startup, standby, and shutdown scenarios.
The next three PHA studies were revalidations and updates of the initial PHA study, where the documented
scenarios were similar to those from the original study. The 2016 PHA re-do study report defined the following
scope: “Startup, normal operation (steady-state), shutdown, and emergency shutdown operations were implicitly
studied in the PHA” (emphasis added). The 2016 PHA team, comprised of five Calumet Superior Refinery
employees representing management, process engineering, operations, and safety, did not identify additional
scenarios relevant to the April 2018 incident than those already mentioned in this section.
4.3.3.2 Analysis
4.3.3.2.1 Transient Operation Hazard Identification in Husky Superior Refinery
The April 26, 2018, explosion occurred while the FCC unit was shutting down. Table 3 summarizes some of the
major process differences between an FCC unit in its normal operating mode and a transient mode in which
catalyst circulation is stopped during a shutdown. Differences between the two operating modes include flows,
pressures, properties and behavior of defluidized catalyst, and the positions and configuration of equipment such
as slide valves.
a
Instrument names are redacted.
b
The study team identified that:
• Inadequate draining of water/moisture prior to a startup could lead to a possible overpressure of the main column.
• A plugged spent catalyst line during startup could lead to “possible filling of the reactor and carryover of catalyst to the main
column” and “possible regen reversal [hydrocarbon from the reactor entering the regenerator] and overheating of the
regenerator – equipment damage.”
• Adding fuel gas to the startup heater with the ignitor blocked in could cause “possible flow [of] fuel gas to the heater via the air
line and flammable mixture in the heater-fire hazard.”
121
Table 3. Process differences between normal and transient FCC unit operations at Husky Superior Refinery.
Normal Operation Transient Operation
(During the Shutdown)
Catalyst circulation Continual Stopped
Slide valves Open, controlling Closed
Reactor catalyst level Normal operating level Low or empty
Catalyst fluidization Fluidized Not fluidized
Standpipe flow direction Spent: From reactor to regenerator Both standpipes flow in the same
Regenerated: From regenerator to direction: from the vessel with the higher
reactor pressure to the vessel with the lower
pressure
Reactor contents Mostly vaporized hydrocarbon Mostly steam
Regenerator contents Mostly air Mostly air
Regenerator-reactor Regenerator pressure is higher than Operator sets a constant flue gas valve
differential pressure reactor pressure. Automatic controller position and adjusts as neededa
adjusts flue gas valve position
While the Superior Refinery’s PHA teams studied disturbances during normal operation that could lead to
catastrophic events, such as a flow reversal of air from the regenerator to the reactor, the studies did not evaluate
hazards during the transient operation conditions. For example, as discussed in Section 4.1.3.2.6, the PHA
identified automatic slide valve closures as a safeguard, but during a shutdown, the slide valves would already
be closed. Similarly, the reactor low level alarm and catalyst slide valve low differential pressure alarms
designed to alert operators to abnormal conditions during normal operation may not be meaningful during a
shutdown, because the reactor level may already be empty and the catalyst may be defluidized. As this incident
shows, analyzing the hazards in the context of these altered conditions is necessary for controlling hazards
during all modes of plant operation.
OSHA cited Husky Superior Refinery based on requirements in 29 C.F.R. § 1910.119(e)(3)(i): identifying “the
hazards of the process” in PHA studies. OSHA wrote,
[T]he employer did not adequately address the hazards associated with
shutdowns, including but not limited to, the hazards associated with operation in
manual mode, [...] deviations from procedures, inerting and purging of
equipment, and other abnormal conditions and situations experienced during
shutdowns [99].
Prior to the incident, Husky Superior Refinery’s PHA policy required study teams to include “documentation of
the hazards of the process during all modes of operation,” though it provided no further information about how
to evaluate all modes. Though the most recent 2016 PHA study report said that the team considered startups and
shutdowns, most of the scenarios appeared to be derived from normal operating conditions. None of the PHA
study reports explained how the team identified transient operation hazards. In the absence of a formally
documented method, the PHA study teams likely generated the startup, standby, and emergency shutdown
a
Husky Superior Refinery’s shutdown procedure instructed the operators to manually control the flue gas valve position.
122
conditions based on personal experiences and team discussions. While the PHA teams identified some transient
operation hazards, they did not identify and discuss other possible scenarios involving flow reversals that may
occur during startups, standby, and shutdowns.
Husky Superior Refinery could have benefited from UOP or an FCC process technology expert to participate in
its PHA studies to identify additional transient operation hazards and guide them on how to address them in a
PHA. According to the CSB’s discussion with several FCC technology licensors, though they typically offer
PHA participation as an additional service, the decision to involve the technology licensor in a PHA has been up
to the clients. UOP did not participate in any of the Superior Refinery’s PHA studies prior to the incident. PHA
studies were not a common practice when UOP designed the Superior Refinery’s FCC unit in 1960, and PHAs
did not become a federal requirement until 1992. After the April 26, 2018, incident, UOP did participate in
Husky Superior Refinery’s PHA for its FCC rebuild project.
Husky Superior Refinery could have also benefited from written guidance outlining common FCC unit scenarios
that should be evaluated in PHAs. At the time of the incident, this information was not available in UOP’s
manual or in a more general consolidated industry document that Husky Superior Refinery could have
referenced.
The CSB concludes that the Superior Refinery’s PHA study teams lacked adequate licensor or industry guidance
to evaluate its FCC unit’s technology-specific transient operation hazards.
In 2021, AFPM developed a resource for its members titled “FCC PHA Scenario Reference List.” To ensure
that more refineries are aware of common transient operation hazards in FCC units, industry groups should
continue to develop general guidance documents for analyzing common FCC transient operation hazards in
PHAs. In CSB Recommendation 2018-02-I-WI-R13, the CSB recommends that API develop PHA guidance for
FCC units in a new industry technical publication for the safe operation of FCC units.
To ensure that Cenovus refineries, including Cenovus Superior Refinery, incorporate available industry
knowledge into their PHAs, the CSB makes CSB Recommendation 2018-02-I-WI-R8 to Cenovus to develop
and implement an FCC PHA guidance document that is updated with new industry knowledge as it becomes
available (for example, from AFPM, CCPS, and API) to be applied at all its refineries that operate FCC units.
4.3.3.2.2 Transient Operation Hazard Identification in Industry
Transient operation hazards exist in many chemical processing technologies, not just FCC units. The CSB has
investigated numerous incidents in the past that occurred due to an incomplete analysis of process hazard risks
during non-routine and transient operations [106, 107, 108, 109]. In 2018, the CSB published a safety digest
summarizing lessons learned specifically from incidents during startups and shutdowns [110]. In January 2021,
CCPS published Guidelines for Process Safety During the Transient Operating Mode: Managing Risks During
Process Start-ups and Shut-downs due to the prevalence of process safety incidents during transient operations
[97].
In 2008, CCPS added guidance specifically for transient operations in its Guidelines for Hazard Evaluation
Procedures [104], with the following justification:
123
During the period 1970 to 1989, 60 to 75% of major incidents in continuous

processes occurred during “non-routine” modes of operation; i.e. in operating
phases other than the continuous operation of the process after start-up. [...] Many
facilities have applied hazard evaluation techniques only to the continuous
operation of a process and not to procedure-based aspects such as start-up,
shutdown, emergency operations, sampling, and catalyst change-out. [...]
Personnel may have less operating experience with procedure-based operations

that are heavily dependent on task performance and operator decision-making. In
addition, safeguards may be bypassed or not fully functional during some modes
of operation such as start-up of a continuous process [104, p. 257].
A 2016 paper written jointly by authors from Process Improvement Institute, Inc. and OSHA highlights the gap
between the intent of the OSHA PSM regulation to address “the hazards of the process” and its interpretation by
process facilities. The paper, titled “Necessity of Performing Hazard Evaluations (PHAs) of Non-normal Modes
of Operation (Startup, Shutdown, & Online Maintenance)” makes a case for performing PHAs on operating
procedures. The authors identify that most PHA studies limit the majority of their analysis to the normal (steady-
state mode for continuous) operations despite OSHA’s implicit requirement that all modes of operation need to
be analyzed. They explain:
Paragraph (e) of the US OSHA regulation on PSM, 29 CFR 1910.119 and similar
requirements in US EPA's rule for risk management programs (RMP), 40 CFR
68.24 specifically require that PHAs consider and address hazards of the process,
i.e., all hazards regardless of the mode of operation (routine or non-routine).
29 CFR 1910.119(e)(1) states that the PHA, “shall identify, evaluate, and control
the hazards involved in the process”
29 CFR 1910.119(e)(3)(i) states that the process hazard analysis shall address
“The hazards of the process”.
29 CFR 1910.119(e)(3)(vi) states that the process hazard analysis shall address
human factors.
Appendix C to the OSHA PSM Standard states that both routine and non-routine
activities need to be addressed by the PHA of the covered process.
There is no qualifier that limits the OSHA PHA requirement to only routine
modes of operation. PSM requires that all hazards related to the process be
addressed, regardless of the mode of operation or activity (routine or non-routine)
[111].
Thorough analysis of all operating modes is an industry-wide challenge—one author estimates that non-routine
modes are not analyzed at all in possibly more than 80 percent of facilities [111]. CCPS and others recommend
performing HAZOP study, simplified HAZOP study, or What-If Analysis on procedures to analyze process
hazards during all modes of operation [66, 112, 104, p. 258]. PHAs on procedures are more commonly
124
performed on batch chemical processes, where there is more human involvement in the process on a frequent
basis [113]; however, most refinery processes are continuous processes that shut down for maintenance once
every several years.
As mentioned in Section 4.1.4, human factors engineering is an important part of evaluating transient operations
that require significant operator involvement. Some industries use systems engineering approaches to plan for
operational safety [114, 115]. For instance, the U.S. Department of Defense military standard MIL-STD-882E
(System Safety), Task 206 requires an Operating and Support Hazard Analysis (“O&SHA”) in all system safety
fields, such as flight testing and munitions manufacturing facilities,a that have high reliance on administrative
(procedural) controls. The O&SHA’s purpose is specifically to “identify and assess hazards introduced by
operational and support activities and procedures.” The task description emphasizes human factors as integral to
this type of analysis: “The human shall be considered an element of the total system, receiving both inputs and
initiating outputs within the analysis” [114, p. 57]. Hazard Analysis Techniques for System Safety by Clifton A.
Ericson, II is one source that provides further guidance for how to perform an O&SHA [116, pp. 177-198]. The
chemical processing industry could draw on these and other systems engineering hazard analysis methods to
improve hazard identification during transient operation.
The CSB concludes that Husky Superior Refinery’s policies did not
KEY LESSON include requirements or guidelines for performing PHAs on its
Most process hazard analysis operating procedures. Had the refinery performed a PHA on its FCC
(PHA) studies for continuously shutdown procedure with a multidisciplinary team, it could have
operating processes focus on identified and controlled transient operation hazards such as
hazards during normal operation. inadvertent air and hydrocarbon mixing during a shutdown.
However, a significant portion of
The CSB makes CSB Recommendation 2018-02-I-WI-R11 to OSHA
process safety incidents occur
to develop guidance documents for performing process hazard analysis
during transient operations, such
on operating procedures to address transient operation hazards in
as startups, shutdowns, and facilities with PSM-covered processes.
standby. Companies should
perform PHAs on critical Since the incident, the Superior Refinery updated its policies to require
operating procedures to better PHAs for startup and shutdown procedures for each process unit. To
identify hazards that arise during ensure that transient operations are adequately evaluated in PHAs, the
transient operations with an CSB makes CSB Recommendation 2018-02-I-WI-R5 to Cenovus
interdisciplinary team of Superior Refinery to develop guidance for analyzing operating
operators, engineers, procedures during PHAs using available industry guidance and
maintenance, management, and incorporating this into its PHA policy.
other relevant disciplines.
a
PSM-covered Department of Defense facilities are required to follow both MIL-STD-882E and the OSHA PSM Standard.
125
4.3.4 Operator Training

4.3.4.1.1 Operator Training Curriculum
Husky Superior Refinery’s training policy in place at the time of the incident required all operators to go
through three weeks of on-the-job training and pass a written test before qualifying for their jobs. The policy
required each operating area to develop an operator training curriculum for “three weeks of on-the-job training
with access to process flow diagrams, piping and instrument drawings, operating and emergency procedures,
and training manuals that are available.” All operators were trained in-house by other operators.
One operator described that when he was being trained for a new assignment, he came in for work every
weekday during the three-week training period, following the curriculum and learning from each of the four
rotating crews. The FCC unit had five levels of operator assignments. The least experienced operators started as
a field operator, and gradually advanced to board operator, then head operator positions, typically over the
course of several years per assignment. Husky Superior Refinery’s FCC unit training manual outlined a
curriculum for each level of FCC unit operator assignments. The manual included reading material, lists of tasks
to be learned from more senior operators through discussions and field demonstrations, and training questions
and answers about the process.
According to Husky Superior Refinery’s PSM Policy and Procedure, at the end of the three-week on-the-job
training, a trainee was supposed to take a written test to qualify for the job. If the trainee passed the test and the
area supervisor believed the trainee was ready to take full responsibility, the operator took another test after 30
days on the job to ensure training retention. In addition, the policy gave the supervisor the ability to retest the
trainee any time after taking over the job or to disqualify an operator. Thereafter, operators were expected to
receive refresher training at least once every three years. According to one operator, each operator had to gain
proficiency in one assignment to qualify for the next level, building up to the board operator, then the head
operator positions.
Operators would begin to learn fundamentals of operating an FCC unit beginning with the board operator
curriculum, where they learned about the pressure relationships between the reactor, regenerator, slide valves,
main column, and other equipment. While the refinery’s FCC operator training manual described typical
refinery equipment, such as pumps, valves, distillation columns, and vessels, it did not explain FCC-specific
concepts, such as specialized FCC equipment, pressure balance, and catalyst circulation, in writing. Neither
UOP’s 2016 General Operating Manual nor the 1960 manual, which explained key FCC-specific technology,
equipment, chemistry, and operational concepts, was incorporated into the refinery’s formal training curriculum.
Instead, the training manual served as a checklist of topics to cover each day, relying on the trainer to teach the
FCC concepts to the trainee verbally and through live demonstrations.
4.3.4.1.2 Trainer Qualifications
Husky Superior Refinery’s training policy stated that the operator training “will be conducted by the unit head
operator and the operator working in the position the employee is training for.” The policy allowed for operators
126
to train others as soon as they had qualified for the assignment themselves. A refinery employee illustrates how
this policy could sometimes lead to inexperienced operators training others on their current job:
Let’s just say, for instance, I just trained and…and passed my test and now I’m
working the job. It’s my first day. Now they have another guy who wants to train.
I could be his trainer.
[...]
I’m also very inexperienced so there’s a lot of things I’m not going to know that
you’re only going to learn from years and time on the job.
The 2013 PSM and RMP compliance audit reported one training-related finding, regarding refresher training.
The audit team reported that the refinery’s training documentation was up-to-date, and field interviews indicated
that “the employees feel adequately trained to safely perform the job functions assigned.” In 2016, the PSM
audit team appeared to have only interviewed contractors and emergency responders, not operators or other
refinery employees, about training.
After its on-site inspection following the 2018 incident, OSHA described its observations of the refinery’s
training program in its Citation and Notification of Penalty letter to the refinery:
The inspection team identified through interviews and documentation that

training of operator personnel was not adequate. It was noted that newer and less
experienced operators were training new operators, and that training was not
always consistent as the most experienced operator would not always train the
new individual for the entire period of training [99, p. 24].
An OSHA lettera attached to OSHA’s 2018 Citation and Notification of Penalty identified the issues with
training and urged the refinery to implement recommendations that Husky Superior Refinery had previously
issued after a 2016-2017 non-PSM internal incident investigation, noting:
- consider a “train-the-trainer” program to certify trainers;

- strong operators should be trainers;
- there should be some type of performance evaluation;
- the head operators should be responsible for proper training, operator
performance, and monitoring of the training process;
- consider developing a competency test in addition to the written test for
operator training [99, p. 24].
a
In addition to issuing its citations following the 2018 incident, OSHA issued a letter with recommendations to enhance employee safety
and health for situations to which it felt no OSHA standard applied and it did not believe it was appropriate at that time to invoke
OSHA’s General Duty Clause [99, p. 22].
127
4.3.4.1.3 Training on Operating Procedures
Husky Superior Refinery’s 300-page in-house FCC unit operator training manual dedicated only half of a page
to operating procedures:
Knowing and using the FCCU Operating Procedures are the primary ingredient
to becoming a successful FCCU Operator. You must read and understand these
procedures, ask questions about areas that are unclear, and know how to apply
these practices to real situations.
An operator described the procedure training he received during the three-week training program for qualifying
as a board operator:
[Y]ou have the [...] procedures for [startup and shutdown], and you look through
them, and [...] everybody kind of orally describes, you know, “This is what you're
going to do for shutdowns, and startups, and if you... we need you for anything
else then we’ll let you know.”
But we have the...the procedures all written up, and then you kind of just read
through them. You...we’re not actually officially trained on shutdowns or
startups. That’s just kind of a part of—a small part of—the training.
An operator described how his crew reviewed the shutdown procedure one week before the 2018 turnaround:
And then the week before, at least on our shift, [...] we printed one off for
everybody and went through it, just ourselves.
[...]
And then we basically just kind of went through it page by page, like, “Okay, [...]
do you understand what you’ll be doing? You understand what you’ll be doing?”
[...]
[K]ind of just talked about what each of the steps were [...] so we have an idea,
at least, of what we’re doing.
Husky Superior Refinery’s FCC unit area management did not schedule a formal meeting with the operating
crews to review the updated FCC unit shutdown procedure. One operator told the CSB that his crew informally
reviewed the procedure together to familiarize themselves with the steps. This unofficial review was limited to a
general overview of the steps, with the underlying assumption that all the steps would happen correctly, and that
the unit would respond as anticipated. For most of the operators, this was the first time they had worked a
turnaround in their current role.a An operator recalls:
a
The turnarounds at Husky Superior Refinery were typically scheduled once every five years. The FCC operators that the CSB
interviewed appeared to be advancing into their next operator assignment typically once every two to three years.
128
A lot of the like head operators and stuff have been through it a lot. So, I mean,
in [...] at least in my mind, it was just, “Okay, this is going to happen. So, you
know, this is what we’ll do.” It wasn’t like, “Okay, if this happens, then look for
this,” or, you know, “If something goes bad here, then we need to do this.” We
didn’t really go into detail about that because none of that has really ever
happened. I mean that...that’s kind of what the...job hazard...JHAs [job hazard
analyses] are kind of for. We do that on some projects, but for this it wasn’t really
like an official go-through and...and do step by step, understanding of exactly
what to do.
It was more so, “We’ve shut down before, you know, this is what we’re going to
be doing. You know, this is what you should see. And then, you know, this is
what’ll happen.” But nothing like, you know, “If a reversal happens, you should
look for this,” or anything like that, no.
Regarding training he received for console alarms, he explained:
[N]obody ever went through specific alarms like, “this alarm is very important,
this one’s not so much important.” But it was kind of just a “general high alarms
and low alarms are kind of an indication that something is starting to go bad or
is not quite in the parameters we want it to be. And then the high-high and low-
low alarms are the critical. You need to just do a double take and see what’s
going on.” [...]
But startup and shutdown I’ve never really been a part of. So I never really got
to see ones I feel like were more critical versus less critical. And so, in my mind,
it was always just…just keep an eye on all of them and if you see anything, try
to go to that…whatever that page is and just try to figure out what’s going on.a
During a turnaround, Husky Superior Refinery doubled the operator staffing by adjusting the schedule so that
there was one 12-hour day shift and one 12-hour night shift instead of four rotating 12-hour shifts. The increased
staffing allowed newer and senior operators to team up as they performed the increased workload involved with
shutting down the unit and preparing the equipment for maintenance.
The board operator assigned to shut down the FCC unit the day of the incident had only been a board operator
since the previous year, as of February 2017. The acting head operator, who was assisting him in shutting down
the plant the morning of the incident, had been a board operator for four years. Similarly, a supervisor
overseeing turnaround activities both inside and outside the control room had never acted as a board operator
during previous turnarounds. The manager who was also overseeing the activities and advising the board
operator had not personally worked a console job since the refinery had upgraded its computer control system
a
In its post-incident investigation, Husky Superior Refinery determined that its inability to manage critical alarms contributed to the
incident. According to the investigation report, practical alarm management was difficult in part due to the old console technology,
which “did not provide the technical capability for operators to address [...] the issue of alarm management.”
129
and consoles in 1994. Other head operators with more years of board operator experience were assigned to
outside or pre-planning tasks for the turnaround.
4.3.4.2 Analysis
FCC unit shutdowns introduce unique process safety hazards that are not present during normal operation.
Furthermore, a typical FCC unit shutdown occurs approximately once every five years at many refineries. To
prepare their operators for these rare and higher-risk activities, many companies emphasize crucial procedure-
related process safety concepts in their training programs, typically using simulator training, drills, and
hypothetical exercises. In the AFPM February 2020 FCC webinar, a presenter explained the challenges behind
training FCC operators for abnormal conditions:
In a lot of ways, as long as you've got stable circulation [normal operation], to

me that’s lower risk than the standby operation where you’ve got no circulation,
but it’s hard. All these scenarios are difficult for the operations people, because
there’s not a lot of exposure to these modes, right? The FCCs are very reliable.
And there are numerous locations around the world, where, if you’ve got a
turnaround run length ...[of] about five years, you've got cases where operations
departments haven’t seen outages. They've not seen feed trips in years. And so,
we have to practice these things, sort of offline, [with] simulators, and upskilling,
and those sorts of training classes. That's when we have to really hammer out
these procedures to get people some practice doing it. We just don’t have much
exposure to it. [...]
These operation times represent greater risk than normal operation. This is the
moment where we make a mistake, and I mean, it can have ramifications that last
for months [68].
To ensure that FCC unit operators can safely and successfully shut down the unit, they need to review crucial
process safety concepts during initial training, through hands-on practice opportunities, and through refresher
training at appropriate intervals. In Guidelines for Risk Based Process Safety CCPS recommends:
Consider timing. Training, particularly refresher training, is best scheduled just

before the task will be performed. Thus, the best time for refresher training on
unit shutdown procedures is just before a planned shutdown [95].
Not only did Husky Superior Refinery’s operator training program not appear to provide initial training for its
transient operating procedures, but the refinery also did not provide just-in-time refresher training in preparation
for the turnaround, leaving the crews to study the shutdown procedure on their own. According to operators, the
discussions were limited to a cursory review of the steps without fully understanding what actions to take if they
do not go as planned.
Furthermore, Husky Superior Refinery had no console training available outside of on-the-job training for
shutting down the FCC unit. On the day of the incident, neither the head operator nor the board operator had
shut down the FCC unit for a turnaround before, because they were not yet qualified to be board operators
130
during the previous turnaround five years prior in 2013. Due to the lack of hands-on practice opportunities
available between the five-year turnaround intervals at Husky Superior Refinery, none of the employees
working on the day of the incident had sufficient board operator experience for safely shutting down the FCC
unit for a turnaround.
API Publication 770, “A Manager’s Guide to Reducing Human Errors,” illustrates the effects of practicing
skills, such as through drills, talk-throughs, what-if challenges, and simulator training (Figure 41), and asserts:
If workers only receive on-the-job training, they will not be prepared to deal with
problems they have not yet seen. ... Practice will not only arrest the rapid loss of
a worker’s new skills, but will also enhance those skills beyond the initial training
[117, p. 41].
Figure 41. Effects of practice on skills. (Credit: API [117])
While OSHA PSM regulations do not require process simulators as part of operator training, its PSM Guidelines
for Compliance stress the benefits of providing hands-on training in simulated situations:
Hands-on training, where employees actually apply lessons learned in simulated

or real situations, will enhance learning. For example, operating personnel, who
131
will work in a control room or at control panels, would benefit by being trained
at a simulated control panel. Upset conditions of various types could be displayed
on the simulator, and then the employee could go through the proper operating
procedures to bring the simulator panel back to the normal operating parameters.
A training environment could be created to help the trainee feel the full reality of
the situation but under controlled conditions. This type of realistic training can
be very effective in teaching employees correct procedures while allowing them
also to see the consequences of what might happen if they do not follow
established operating procedures. Other training techniques using videos or
training also can be very effective for teaching other job tasks, duties, or
imparting other important information. An effective training program will allow
employees to fully participate in the training process and to practice their skills
or knowledge [94].
Simulators can be one of the most effective training tools for board operators. In a Control Engineering
magazine and newsletter article titled “The Role of Simulator Technology in Operator Training Programs,” the
authors explain:
In most cases, [on-the-job training] without the use of a training simulator is

inadequate because startup, shutdown, and hazardous conditions are only
covered if they occur during a training session. [On-the-job] Training is often
conducted after an experienced operator takes over required actions and the
process is under control. This after-the-fact approach may prevent detailed
discussions of actions and what-if scenarios. Also, trainees may not have [the]
chance to perform critical tasks themselves, and actions cannot be repeated at a
later time [118].
Without a simulator or other hands-on training exercises where operators could practice going through
procedures, board operators at Husky Superior Refinery could only learn how to execute procedures on-the-job.
In addition, the scarcity of practice opportunities also meant that the operations department did not have as many
opportunities to identify and correct procedure steps that could be confusing or misleading in a real scenario.
The CSB concludes that Husky Superior Refinery did not provide its board operators with sufficient training for
them to safely shut down the FCC unit on the day of the incident. Had Husky Superior Refinery provided
simulator training into its training curriculum, especially with technical experts helping to develop the simulator
scenarios, its board operators could have been better equipped with the necessary hands-on practice
opportunities to shut the FCC unit down safely.
The CSB also concludes that Husky Superior Refinery could have identified and corrected long-standing gaps in
its FCC unit procedures and instrumentation by incorporating qualified trainers and simulators into its operator
training program.
132
The FCC process in particular is known in the refining industry as a

relatively complex process. According to one company that develops KEY LESSON
refinery simulators, the FCC is one of “three processes [that] represent Operator training should include
the most critical, demanding and common practice processes in terms hands-on training opportunities
of complexity of operation [...] in the refinery process industry” [119, for rare but critical tasks, such as
p. 2]. In their discussions with the CSB, multiple FCC technology shutting down a process unit
licensors stressed the importance of operator training for transient safely for a turnaround, which
operations in FCC units. In addition, several said that they offer typically occurs once every five
simulators as an add-on to their license agreements. Because human
years in many refineries.
evaluation of process conditions as well as human response actions are
critical for procedural safeguards, many companies ensure the
competency of their FCC operators and other staff through training programsa that reinforce vital safety
concepts such as the reactor steam barrier. Currently, each operating company or refinery decides on the
particulars of its own operator training programs, which may or may not include training simulators.
The CSB concludes that hands-on operator training, such as drills and simulators, is crucial for hazardous
operations that are controlled primarily by procedural safeguards, such as transient FCC operation. The CSB
recommends that API discuss suggested training topics and methods for FCC operators in a new technical
publication for the safe operation of FCC units (CSB Recommendation 2018-02-I-WI-R13).
CCPS mentions the importance of trainer qualifications in several of its publications. According to the
Guidelines for Risk Based Process Safety, “[t]he training itself is typically conducted by subject matter experts
(SMEs) or outside specialists who have been trained and qualified as trainers” [95]. Additionally, Plant
Guidelines for Technical Management of Chemical Process Safety advises:
Selection of instructors is critical to the success of a training program, whether

the individual is either an employee who delivers training programs on a full- or
part-time basis or if it is a qualified employee who has received a ‘train the
trainer’ course [120].
Husky Superior Refinery’s training program relied entirely on experienced operators providing on-the-job
training to peers on their crew. As a result, according to refinery employees, training quality varied and
depended greatly on the operators’ experience level on that crew. The refinery’s written FCC operator training
manual did not describe FCC-specific operating concepts, such as pressure balance and catalyst circulation. The
curriculum relied only on verbal explanations to teach these concepts. Without written descriptions of FCC
concepts in its training curriculum, Husky Superior Refinery had no way of ensuring consistency in its operator
training content.
As discussed previously, Husky Superior Refinery did not use training simulators in its operator training
program to reinforce what operators had learned theoretically.
The CSB concludes that Husky Superior Refinery’s operator training program did not effectively prepare the
FCC operators to shut down the unit safely and respond to abnormal situations properly. The lack of known
a
Training material may include procedure reviews, drills, past industry incident discussions, and simulator exercises for board operators.
133
FCC-related safety concepts in the written training manual, combined with the lack of trainer qualifications and
hands-on practice opportunities, led to poor operator training and contributed to the incident.
Federal safety regulations do not have explicit requirements for trainer qualifications or hands-on practice
opportunities; therefore, these areas may not be addressed in compliance audits that are strictly designed to
identify compliance gaps. The CCPS publication Guidelines for Auditing Process Safety Management Systems
offers audit guidance for “related criteria” that exceed the strict compliance requirements [121, p. 559].
According to the CCPS, these related criteria “[...] in large part represent industry good practices in process
safety knowledge, or in some cases practices in process safety knowledge that have become common.” Some
recommended related criteria include the qualification levels of the instructors that conduct operator training,
and how the contents of an operator training program is “based on the risk as identified in [...] analytical
activities that are designed to identify and prioritize the hazards/risk associated with the equipment and its
operation” [121, pp. 561, 565]. The CCPS asserts that “some of the related criteria have reached the status of a
level of acceptable practice because of their widespread, accepted, and successful use over an extended period of
time,” though it does not specify which of the related criteria fall into this category [121, p. 559].
In 2013, the third-party consultant that performed a PSM and RMP audit on Husky Superior Refinery found
little issue with the training program. The audit team reported that the refinery’s training documentation was up
to date, and field interviews indicated that “the employees feel adequately trained to safely perform the job
functions assigned.” In 2016, the audit team appeared to have only interviewed contractors and emergency
responders, not operators or other refinery employees. These audits did not identify signs that the FCC unit
operators may not have been prepared to respond to non-routine or abnormal conditions that occurred during the
April 2018 incident.
The CSB concludes that the 2013 and 2016 PSM and RMP compliance audits’ evaluation of the refinery’s
training element did not identify training and instructor quality issues in its operator training program.
Cenovus Superior Refinery informed the CSB that it has been overhauling its training programs since the
incident. The refinery has been rewriting its training manuals and the written tests. The training department
plans to include process flow diagram tests and formalized field walk-through tests, as well as documentation of
assessment decisions. In addition, according to its new training and competency standard, the refinery is now
incorporating training simulators into its operator training program “to provide both initial and refresher training
to Control Room Operators” for multiple areas, including the FCC unit, as part of its refinery rebuild project.
Cenovus Superior Refinery’s new training policy, updated in 2021, requires training assessors to conduct
competency assessments of operators. The new training policy also defines requirements for competency gap
assessments, training plan development, and continuous improvement of the training program.
Cenovus Superior Refinery’s FCC unit training program is not yet complete due to outstanding items, such as
operating procedures, that are still being developed as part of the rebuild project. The CSB makes CSB
Recommendation 2018-02-I-WI-R6 to Cenovus Superior Refinery to develop and implement an FCC unit
operator, supervisor, and manager training program, based on available licensor and industry guidance, with
training delivery that includes written material, in-person training, and simulator training for board operators.
134
4.4 Industry Knowledge and Guidance
4.4.1 FCC Knowledge and Competency Management in Industry

The 2018 Husky Superior Refinery explosion occurred just three years after another FCC unit explosion in
Torrance, California. The discussion below investigates FCC knowledge and competency at the refinery level,
company level, and industry level in the context of these two incidents.
4.4.1.1 2015 ExxonMobil Torrance Refinery FCC Unit Explosion

On February 18, 2015, an explosion occurred in the ExxonMobil Torrance, California, refinery’s ESP, a
pollution control device in the FCC unit that removes catalyst particles using charged plates that produce sparks
during normal operation [108]. The incident occurred when ExxonMobil was attempting to isolate equipment
for unscheduled maintenance while the unit was in an idled mode of operation. Preparations for the maintenance
activity caused a pressure deviation that disturbed the reactor steam barrier, allowing hydrocarbon to backflow
from the main column into the regenerator and ignite in the ESP.a
Figure 42 compares the process flows that caused the explosions in both the Torrance and Superior refineries.
In Torrance, hydrocarbon flowed from the main column, through the reactor and the regenerator, into the flue
gas system, where it mixed with air and exploded inside the ESP. In Superior, air flowed from the regenerator,
through the reactor and main column, into the gas concentration unit, where it mixed with hydrocarbon and
exploded inside the equipment.
a
In the Superior incident, the ESP had been shut down and was not involved in the explosion.
135
Figure 42. Process flows that caused FCC explosions in Torrance and Superior Refineries. (Credit: CSB)
Upon completion of its Torrance investigation report in 2017, the CSB issued a recommendation to AFPM to
share the incident learnings with the greater FCC community, including “topics such as design, maintenance,
and procedural practices that can prevent a similar incident” [108].a AFPM fulfilled the CSB’s recommendation
by hosting several presentations that addressed these topics during its Operations and Process Technology
Summit in October 2017. During the Summit, a CSB investigator presented facts and conclusions from the
Torrance Refinery FCC explosion investigation. Immediately after the CSB presentation, two industry experts
presented on “FCC Standby Operations and Safety Concerns.” AFPM also hosted a panel of experts that
discussed safety shutdown systems during the FCC Question and Answer panel. The panelists emphasized that
the key to keeping hydrocarbon and air safely separated in an FCC unit involves multiple actions, such as
isolating hydrocarbon sources and injecting steam, to prevent the explosion hazard. Some of the panelists’
statements included:
Realize that these [slide] valves are not gas-tight valves. We should always
assume that they leak. So, it is only through isolation of hydrocarbon, adjusting
a
See CSB Recommendation 2015-02-I-CA-R10 in the Torrance report [108].
136
the pressure balance, and the introduction of steam that we are able to control
what and how much leaks from these valves.
We do not consider the slide valve closure as the final elementa in the safety
system. We require that parallel actions occur that put the unit in a safe place.
Husky Superior Refinery’s 2018 shutdown was its first planned FCC unit shutdown after the Torrance incident
in 2015. According to employee interviews, Husky Superior Refinery employees had heard of the 2015
Torrance incident. One main message that refinery management communicated to the employees was the
importance of de-energizing ESPs to prevent ESP explosions. The workforce appeared to understand that
flammable hydrocarbons had flowed from the Torrance refinery’s main column into the regenerator and
exploded in the ESP, but they did not recognize that the reverse—air flowing into hydrocarbon systems
downstream of the main column—was also possible. In addition, Husky Superior Refinery did not discuss or
appear to understand that the failure of the reactor steam barrier was a cause of the Torrance explosion.
Husky Superior Refinery did not have historical process data available to compare the 2018 shutdown to
previous ones; however, based on documents and witness interviews, the reactor steam barrier was likely not
implemented in previous shutdowns, either. The CSB could not determine if lessons from the ExxonMobil
Torrance Refinery incident influenced the board operator to set a higher than historical regenerator pressure to
avoid a similar incident; however, the Husky Superior Refinery board operator told the CSB that he was
concerned about preventing hydrocarbon from leaking into the regenerator during this shutdown, which is how
the Torrance explosion had occurred.
The CSB concludes that before the April 2018 incident, Husky Superior Refinery employees did not effectively
learn and apply key lessons from the CSB’s ExxonMobil Torrance Refinery investigation report, released in
2017, that could have prevented Husky Superior Refinery explosion.
4.4.1.2 Industry Response to Torrance and Superior Incidents

The 2015 Torrance and 2018 Superior FCC unit incidents exposed FCC process safety competency gaps within
both companies operating many refineries (ExxonMobil)b and companies with only one or a few refineries
(Calumet and Husky Energy). Both events occurred, in part, due to the workforce’s misunderstanding or
unawareness of fundamental flow and pressure relationships in an FCC unit in transient operating modes.
Furthermore, crucial findings and lessons from the Torrance Refinery explosion were not learned and did not
help prevent Husky Superior Refinery’s catastrophic incident. Husky Superior Refinery disaster, which occurred
just months after the extensive FCC knowledge-sharing at the October 2017 AFPM conference, revealed that
more work needed to be done to protect workers and the public from FCC incidents during transient operations.
Both incidents adversely affected their surrounding communities. Members of the Superior community were
ordered to evacuate, and in Torrance, FCC catalyst drifted and spread throughout the nearby community. In
addition, both incidents sent explosion debris throughout the refineries, including the adjacent HF alkylation
a
Definition of final element from the CCPS Process Safety Glossary: “Process control or safety device that implements the physical
action necessary to achieve or maintain a safe state; e.g., valves, switch gear, and motors, including their auxiliary elements (such as the
solenoid valve used to operate a valve)” [182].
b
In 2015, ExxonMobil operated 23 refineries across the globe [183, p. 61].
137
units. Though neither incident resulted in an HF release, these events raised concerns among community
residents of the possibility of a catastrophic HF release.
4.4.1.2.1 Industry FCC Survey
Following Husky Superior Refinery incident, AFPM assisted the CSB in collecting information on safe FCC
operating practices used throughout the refining industry. AFPM worked with industry experts to create a survey
on safe FCC operating practices during startup, shutdown, and standby operation that would:
1) prevent the flow of air from the regenerator into the reactor and downstream equipment; and,
2) prevent the flow of unwanted hydrocarbons into the regenerator.
According to the survey results, “a significant majority of industry” achieves these objectives by “monitor[ing]
process flows to purge hydrocarbons and oxygen” and “manag[ing] the pressure balance.” AFPM defines some
of these methods as follows:
A) Monitor Process Flows to Purge Hydrocarbon and Oxygen:
• Inject steam or nitrogen into the reactor to purge hydrocarbons
• Maintain proper vapor flow to build pressure and prevent ingress of air
and hydrocarbons [into] the reactor
• Maintain an inert barrier between the main fractionator (hydrocarbon)

and the regenerator (air)
B) Manage the Pressure Balance:
• Understand the pressure profile between Reactor and Regenerator to

ensure inert gas flows from the Reactor to the Regenerator
• Understand the pressure profile between the Reactor and Main

Fractionator [Column] to ensure forward flow of inerts from the
reactor/stripper to the main fractionator,
• Clos[e] the spent and regenerated catalyst slide valves when adverse
conditions exist or when catalyst circulation is not desired
• Monitor catalyst levels and leakage across the spent and regenerated
catalyst slide valves
UOP’s guidance to maintain a reactor steam barrier and provide a main column gas purge—the two most
important safeguards highlighted in this report—follow these key principles.
138
The AFPM survey represented the FCC operating practices of nearly 75 percent of U.S. refineries.a Its
conclusion that “a significant majority of industry” uses the above methods suggests that some refineries may
still not be aware of key FCC process safety concepts.
4.4.1.2.2 FCC Process Safety Resources
The 2015 Torrance incident spurred industry discussions around FCC process safety during all operating modes.
These discussions further intensified following the 2018 Husky Superior Refinery explosion. While the reactor
steam barrier safeguard seemed to have been part of existing FCC operating practices for decades prior to these
major incidents, the Torrance and Superior incidents highlighted its criticality and gaps within the industry. As a
result, more recent FCC process safety discussions and presentations are now emphasizing the essential reactor
steam barrier and the main column gas purge, as well as other important safeguards.b
In February 2020, AFPM hosted an hour-long recorded webinar where two FCC industry experts discussed
challenges and good practices for safeguarding the FCC unit during transient operation [68]. The webinar
featured the safeguards outlined in Table 2 and the rest of this report. AFPM has since hosted several other
webinars and provided practice sharing documents over 2021 and 2022 focusing on FCC unit transient operation
process safety topics.
Industry conferences, such as the annual AFPM meetings, users’ conferences, and seminars hosted by catalyst
vendors, are good forums for sharing recommended practices and lessons learned. These forums have
strengthened the industry’s overall FCC competence. Participating in these meetings and applying the learnings,
however, are voluntary.c Safety information shared in conferences, seminars, and other proceedings, where
participation is voluntary, may not reach all facilities that need the information. Even after the 2017 AFPM
conference, where FCC experts shared good practices for how to avoid incidents like Torrance, some key Husky
Superior Refinery technical and operations staff were still unfamiliar with the reactor steam barrier concept prior
to the incident. Other refineries may similarly still be at risk of having inadequate safeguards for their FCC units
during transient operation, and they may be unaware that such safeguards exist—making them more vulnerable
to catastrophic accidents.
In 2010, AFPM and API jointly began the Advancing Process Safety programs to strengthen general knowledge
sharing across the refining industry [122]. These programs, which include practice sharing documents, training,
industry safety bulletins, and other tools, form a library of resources that provide “more frequent and effective
opportunities to share experiences and knowledge” [123]. In a letter to the CSB in October 2020, AFPM and
API wrote about developing a suite of FCC process safety tools available to industry:
a
AFPM anonymized the survey results; therefore, the CSB does not know whether Husky Superior Refinery participated in the survey.
b
The FCC Industrial Safety Committee, chartered in 2014, is one venue for refiners to freely exchange information specific to FCC
safety topics in a private, non-competitive setting. Participation is closed to third parties, such as vendors and licensors. The Committee
typically meets during AFPM conferences, but is an ad-hoc group not affiliated with AFPM. The Committee encourages participation
from all refineries that own and operate FCCs.
c
“The problem with voluntary programs is not everybody volunteers.” – Carolyn Merritt, former CSB chair [186].
139
a) There are many existing resources within the Associations [...]; however,
they are not consolidated into one location (e.g., decade’s worth of [question
and answer panel] transcripts, webinars, and conference presentations, etc.).
b) By developing a compendium suite of tools and practices that have already

been shared, sites can become more educated on various topics by choosing
from a variety of practices that best meet their needs. [...]
c) These tools can focus on the procedures a site should consider and point site
managers to a variety of resources to help them develop instructions,
procedures, and materials specific to their unit.
d) The process of assembling the compendium will allow us to identify gaps

and convene a working group of FCC unit [subject matter experts] to develop
additional tools.
e) A joint Association suite of safety tools (including a safety bulletin with

lessons-learned from the two recent incidents [Torrance and Superior])
would ensure the U.S. refining industry would have access to this important
information.
AFPM’s and API’s joint letter to the CSB highlights that the problem resides not in the availability of
knowledge, but in its complexity and accessibility. AFPM’s and API’s approach to consolidate this information
in a compendium should simplify the technical stewards’ search for relevant information to apply to their sites.
In Guidelines for Risk Based Process Safety, CCPS warns that the real work is in translating a wealth of
knowledge into workforce competency at each facility:
Collecting information is often relatively inexpensive – it includes activities such

as attending meetings, reading papers, supporting collective projects [...], or
participating in industry-wide technical committees. [...] Regardless, a work
product that consists solely of a pile of technical papers that are routed to
managers, supervisors, and technical personnel at operating facilities is likely to
provide little benefit. To maximize return on investment, the information must
be evaluated, made relevant to operating units, and stored in a format that will
support learning, remembering, and when appropriate, action [95, p. 92].
The CSB concludes that although the refining industry has accumulated many years of FCC process safety
knowledge from its members, this information is scattered, complex, and not easily accessible to some refinery
employees.
AFPM has already begun developing and disseminating more specific FCC process safety knowledge to its
members. In 2021, AFPM published two new documents into its Safety Portal: a process safety bulletin entitled
Flammable Mixture Accumulation in FCC Units During Non-Routine Operations and a hazard identification
document titled Flammable Mixture Accumulation in FCC Units. In addition, AFPM recorded a webinar titled
“FCC Process Safety Resources” in June 2021, with announcements of new FCC process safety resource
documents being developed, such as an FCC PHA scenario reference list [124]. In September 2022, AFPM
140
announced a list of FCC process safety resources in a newsletter with additional documents titled FCC Non-
Routine Operations Standby Checklist, Shift Handover Checklist for FCC While in Non-Routine Operations, O2
Monitoring in FCCs during Non-Normal Operations, and Simplified DCS Screen for FCC Non-routine
Operations, which AFPM members can access in the AFPM Safety Portal.
4.4.2 FCC Standards

Federal safety regulations require the owners and operators of FCC units to document that their process
equipment meets recognized and generally accepted good engineering practices (“RAGAGEP”) and is operating
in a safe manner.a OSHA and EPA consider widely adopted codes, consensus documents, non-consensus
documents, and internal standards as examples of RAGAGEP sources [125]. Unlike codes, which define
requirements under the law, compliance with standards is voluntary unless a regulation specifically incorporates
the standards [126]. At the time of writing this report, there is no common consensus document or standard for
the safe operation of FCC units.
The flowchart on the left side of Figure 43 shows how various standards, specifications, and guidance
documents typically interconnect within a technology framework. Performance standards typically state
requirements in terms of goals that the technology should achieve, but without explicitly stating how to achieve
them. Technical or design standards then define specific methods for achieving the performance requirements.
Guidance documents provide supplemental information, such as recommendations and additional “how-to”
guidance for users of technical standards [127, 128].
Figure 43. Hierarchy of standards terminology. (Credit: CSB, adapted from a

Wisconsin Department of Natural Resources workshop presentation [127])
a
29 C.F.R. § 1910.119(d)(3), 40 C.F.R. § 68.65(d)(2), and 40 C.F.R. § 68.65(d)(3).
141
In the FCC technology landscape, each technology licensor defines a particular set of performance and technical
standards for its proprietary designs. For specialty equipment, such as slide valves, the manufacturers develop
additional technical standards to meet the licensor’s performance requirements. In addition, some operating
companies develop, implement, and maintain internal FCC unit performance and technical standards of their
own. These FCC-specific standards can inform their facilities’ safety performance requirements, such as safety
risk mitigation requirements and safety instrumented system designs [70].
While all FCC units have similar air and hydrocarbon mixing hazards, each technology licensor controls these
hazards differently using its own standards, specifications, and operating philosophies. According to the CSB’s
discussions with several technology licensors, these licensing companies improve their design standards over
time based on operating feedback they obtain from their users by hosting technology users’ conferences,
attending FCC industry events, and interfacing directly with the clients.
At present, there are about 90 FCC units in the United States, and most of the newer units are now being built
overseas [41, 129]. Not only are many of the U.S. FCC units aging, they also employ different technologies.
Some, often older, FCC units may be using a combination of various licensors’ technology through several
equipment upgrades or modifications. For these units, the refineries interface with two or three licensors to
create their unit’s overall operating philosophy. Therefore, each facility might refer to a variety of FCC
standards and specifications to ensure that it follows good industry practices, though there is not one common
FCC resource available for reference.
The CSB concludes that the diversity of FCC technology designs in the market has been a barrier for developing
an industry consensus document to help ensure safe FCC unit operation. As a result, there is no publication that
defines common process safety considerations for the design and operation of FCC units.
4.4.3 Technical Publications

Although there is a great diversity of FCC unit designs in the industry, the fundamental concept of a fluidized
catalyst that continually circulates between air-rich and hydrocarbon-rich systems to crack heavy hydrocarbons
is common to all FCC units. FCC catalyst has unique fluidization properties and behaviors, and each FCC unit
needs robust safeguards to prevent the inadvertent mixing of air and hydrocarbons during all operating modes.
The Torrance and Superior explosions highlighted similar FCC safety performance gaps in the refining industry.
The Superior incident, which occurred after the CSB and the refining industry widely shared the Torrance
incident’s causes, showed that safety bulletins alone did not effectively communicate key messages to all
relevant stakeholders. A more robust approach is needed to prevent serious FCC incidents.
While the CSB has identified various textbooks dedicated to understanding refinery FCC technology, these
resources are mainly tailored for understanding its history, chemistry, catalyst, and yield optimization methods.
These books have little discussion dedicated to hazard analysis or learnings from past catastrophic incidents [29,
31, 130]. Some FCC books, which were even published after both the Torrance and Superior incidents, contain
information that contradicts some of the industry safety presentations referenced in this report. One book states,
“[t]he slide valve [...] provides a positive seal against a flow reversal of the hydrocarbons into the regenerator or
hot flue gas into the reactor” [29, p. 224]. Another book explains (emphasis added):
142
Recent incidents at the Husky Energy Refinery in Superior, Wisconsin and the
ExxonMobil Refinery in Torrance, California had explosions occur in the FCC
unit while it was shut down. Both incidents occurred due to the spent slide valve
being eroded and not maintaining a catalyst barrier between the reactor and
regenerator.
During shutdown, it is common to reverse the differential pressure between the

regenerator and reactor to prevent air from leaking into the downstream process.
With the spent slide valve not holding catalyst level, a flow path was open for
hydrocarbons from downstream to reverse flow into the regenerator and ignite
[...] [131, p. 140].a
The CSB concludes that FCC process safety messages from publicly available industry publications are
inconsistent. Most textbooks do not adequately cover FCC unit process hazards and learnings from past FCC
unit incidents. Some publications place too much emphasis on slide valves and do not adequately discuss other
safeguards necessary to prevent major accidents during transient operation, deviating from current industry
discussions.
As discussed previously, companies can adopt industry consensus and non-consensus documents as RAGAGEP
to guide their approach to improving process safety at their operating facilities. In a paper titled “Performance
Standards vs. Design Standards: Facilitating a Shift toward Best Practices” by the Mercatus Center at George
Mason University [128], the authors describe how the Federal Aviation Administration (FAA) replaced its
existing design standards with performance-based regulations in 2017. While the Mercatus paper is focused on
regulatory standards set by government agencies, it describes how the FAA’s new performance-based standards
allow regulated parties to use industry consensus standards to permit compliance flexibility [132]. In fact,
according to the U.S. Department of Energy’s website, the President signed into law the National Technology
Transfer and Advancement Act (“NTTAA”)b in 1996 to continue “transitioning the Executive Branch of the
Federal Government from a developer of internal standards to a customer of external standards” [133]. This is
the same approach OSHA and EPA take in their regulations by allowing the regulated entities (such as
refineries) to define their own RAGAGEP sources, which could include industry consensus and non-consensus
documents [96, p. 99]. The Mercatus paper comments:
A key benefit of the FAA’s approach is that the means of compliance are
adaptable over time. Industry-created standards are malleable and can adjust to
changing market conditions and technological advancement. This approach also
better accounts for decentralized knowledge about technologies and innovations.
[...] Consensus standards can be replaced or accompanied by other means of
compliance. Even if consensus standards are more useful for well-established
industries, they allow emerging industries to develop and utilize norms that align
with safety objectives [128, p. 30].
a
At the time of this publication, the CSB’s Husky Superior Refinery investigation was ongoing, and the details behind how the Husky
Superior Refinery’s FCC unit exploded on April 2018 was not known to the public.
b
Pub.L. 104-113
143
Within the refining industry, AFPM and API are now developing FCC technology-specific guidance documents
based on the operating knowledge and experience of their member companies to increase sharing safety
knowledge between companies. In addition, CCPS identified FCC operations as a potential technology to
include in its “Project 289: Golden Rules of Process Safety for Specific Technologies.” According to CCPS’s
website, the golden rules are “a set of rules and [tenets] that serve the foundation for process safety” developed
by a team of process safety and process technology experts [134]. This activity indicates the refining industry’s
willingness to share safety knowledge to improve FCC unit safety across the industry.
API develops and maintains numerous refinery-related consensus documents, including recommended practices,
with diverse committees of subject matter experts. API has systems in place to review its publications
periodically to ensure that they reflect current industry practices and remain relevant to the industry [135, p. 14].
API and CCPS publications are publicly available, whereas the AFPM material, such as the Advancing Process
Safety tools, can only be accessed by its member companies.
The CSB concludes that a publicly available technical publication outlining recognized and generally accepted
good engineering practices for safe FCC operation could help drive important safety improvements in FCC units
across the United States.
The CSB issues CSB Recommendation 2018-02-I-WI-R13 to the American Petroleum Institute (API) to
develop a technical industry publication for the safe operation of FCC units. To promote and ensure technology
licensor participation, the CSB issues CSB Recommendation 2018-02-I-WI-R16 to Honeywell UOP to
participate in the development committee for this document.
4.5 Brittle Fracture During Extreme Events

The explosion inside the primary and sponge absorbers released a large amount of energy that fractured the
vessels and propelled over 100 metal fragments into the refinery,a puncturing a 54,800-barrel (2.3 million-
gallon) asphalt storage tank.
Figure 44 and Figure 45 show the aftermath of the explosion site. Only the bottom parts of the primary and
sponge absorbers remained after the explosion. The remaining portions of the vessels were blown into
surrounding units of the refinery (Figure 46).
a
A total of 106 vessel fragments were collected in addition to other pieces of metallic debris from the interior of the vessels, such as trays
and other items.
144
Figure 44. Primary absorber, sponge absorber, and stripper before and after the incident.a
(Credit: Husky Superior Refinery and Google Earth with annotations by CSB)
a
Before the incident, the primary absorber was approximately 82 feet tall with a 3-foot diameter, and the sponge absorber was
approximately 50 feet tall with a 30-inch diameter.
145
Figure 45. Primary and sponge absorbers after the incident. (Credit: CSB)
146
Figure 46. Large primary and sponge absorber fragments found throughout the refinery. (Credit: BakerRisk)
Fracture is the separation of a solid material, such as steel, into two or more pieces under stress. Fracture can
broadly be classified into two modes known as brittle fracture and ductile fracture. Brittle fractures occur
suddenly with little or no plastic deformation (like breaking glass), whereas ductile fractures exhibit extensive
plastic deformation as the material cracks (tearing open like a zipper or fish mouth) (Figure 47) [136, p. 221].
Figure 47. Examples of brittle fracture (left) and ductile fracture (right). (Credit: [137], [138])
147
4.5.1.1 Post-Incident Primary and Sponge Absorber Metallurgical Testing

After the incident, a third-party metallurgical laboratory examined and tested the explosion debris from the
primary and sponge absorbers. The evaluation included chemical composition, tensile testing, Charpy V-Notch
impact testing, optical microscopy, and fracture assessment.
The laboratory reported that most of the fragments had a brittle fracture pattern. According to the report, some
fragments showed localized areas of ductile fracture, and some showed a mixed-mode failure of ductile and
brittle fracture features. These fractures initiated at multiple locations for both vessels, coinciding with a weld,
tray, penetration, or weld seam. The laboratory did not note unusual features at these locations to cause the
fracture initiation. Thickness measurements of the fragments did not indicate excessive wall thinning. In
addition, “no pre-existing cracking such as fatigue, hydrogen cracks, or other environmental cracking
mechanisms were observed on [the] Vessels [...].” Both vessels had evidence that some sections bulged and
yielded before they failed.
The primary and sponge absorbers had been part of the original FCC unit project’s construction in 1961. UOP
had specified A-212 Grade B steel for the primary absorber and A-201 Grade A steel for the sponge absorber.
Metallurgical testing confirmed that the primary absorber’s base metal samples matched the A-212 Grade B
specification, but the sponge absorber’s base metal matched A-201 Grade B specifications.
4.5.1.2 Husky Superior Refinery’s Mechanical Integrity Policies

After the incident, OSHA cited Husky Superior Refinery for not having performed a fitness for service analysis
on equipment constructed of ASTM A-212 steel, citing:
• 29 C.F.R. § 1910.119(d)(3)(iii): “For existing equipment designed and constructed in accordance

with codes, standards, or practices no longer in general use, the employer did not determine and
document that the equipment in the process was designed, maintained, inspected, tested, and
operating in a safe manner (i.e. fit-for-service)” [99, p. 9], and
• 29 C.F.R. § 1910.119(j)(4)(ii): “The employer’s inspection and testing procedures did not follow
recognized and generally accepted good engineering practices” [99, p. 10].
Husky Superior Refinery’s mechanical integrity policy required fitness for service analyses “[w]hen deemed
necessary by the Chief Inspector, Maintenance Manager or Engineering Manager, or as required by applicable
code.” Husky Superior Refinery had not performed fitness-for-service evaluations on its equipment constructed
of A-212 and A-201 steel. According to the FCC unit’s safe operating limits table, the normal operating
temperatures for the primary and sponge absorber ranged from 98 °F to 120 °F, with a minimum design
temperature limit of -20 °F. A refinery employee told CSB investigators that these vessels’ minimum design
temperature was -20 °F and that their operating conditions met exemption criteria defined in the ASME Code.
OSHA had previously inspected Husky Superior Refinery in 2008 as part of the agency’s Petroleum Refinery
National Emphasis Program (“NEP”) [139]. The NEP was established in 2007 to “reduce or eliminate
workplace hazards associated with the catastrophic release of highly hazardous chemicals at petroleum
refineries” [140]. OSHA published an instruction with policies and procedures for OSHA inspectors to audit
petroleum refineries [140]. The NEP inspection protocol included examinations of fitness-for-service
148
documentation for randomly selected equipment. In its 2008 inspection, OSHA cited Husky Superior Refinery
for findings related to its mechanical integrity program; however, these citations focused on activities such as
piping and vessel thickness measurement monitoring. While many of the citations pertained to findings in the
FCC and alkylation units, the OSHA citations did not include fitness-for-service findings prior to the April 2018
incident.
4.5.2 Analysis
4.5.2.1 History of A-201 and A-212 Steels

The primary and sponge absorbers were constructed of A-212 and A-201 grade steels, which were typical steel
grades used for pressure vessels at the time. Steel plates manufactured in accordance with the A-201 and A-212
steel specifications were assumed to have a minimum design temperature of -20 °F; however, they are now
known to have a low resistance to low-temperature brittle fracture at temperatures well above -20 °F [141].
ASTM withdrew the A-201 and A-212 specifications in 1967 and replaced them with A-516 (low temperature
service) and A-515 specifications [142, p. 461]. If the primary and sponge absorbers had been newly fabricated
prior to the incident, their material of construction would likely have been A-516.
Metallurgists can perform impact testing to measure materials’ resistance to brittle fracture over a range of
temperatures. For example, a common test method, called the Charpy V-Notch test, can help determine the
temperature at which a material transitions from a ductile to a brittle fracture mode [136, p. 226].a Figure 48
shows an example ductile-to-brittle fracture transition curve, which metallurgists determine empirically.
Materials in a ductile fracture mode can absorb more energy than those in a brittle fracture mode before they fail
[136, p. 223].
a
Temperature affects the amount of energy that a material can absorb before failure – materials that fail in ductile fracture at high
temperatures could transition to a brittle failure mode at lower temperatures [136, pp. 225-226].
149
Figure 48. An example ductile-to-brittle fracture transition curve. (Credit: [143])
In 1988, ASME made changes to its Boiler and Pressure Vessel Code to set toughness requirements for the
prevention of brittle fracture [141]. The 1988 ASME Code update included Impact Test Exemption Curves A
through D (Figure 49) to determine the minimum design metal temperature of existing older equipment without
the need for additional impact testing.
150
Figure 49. ASME impact test exemption curves. (Source: API and ASME, [144])
The primary and sponge absorbers’ materials of construction fit into the Curve A category. In the absence of
impact testing prior to the explosion, the ASME exemption curves could be used to show that these vessels
could operate at their full design pressure down to 30 °F.a Post-incident metallurgical testing showed that the
vessel fragments’ tensile properties exceeded the minimum requirements, and their Charpy properties met
expectations for Curve A materials. The CSB concludes that the primary and sponge absorbers’ materials of
construction likely met current industry standards for toughness under normal operating conditions.
4.5.2.2 Fracture Analysis

The CSB contracted a third-party metallurgist to analyze the results of the post-incident testing (Appendix D).
According to a simplified analysis, based on the estimated fracture area and the measured toughness properties
a
Though the primary and sponge absorbers’ minimum design temperature is well below the vessels’ normal operating temperatures of
around 100 °F, Husky Superior Refinery had not identified potential issues with certain cold startup scenarios where ambient
temperatures in Superior, Wisconsin could drop below 30 °F. Post-incident, Husky Superior Refinery identified and mitigated these and
other scenarios in a refinery-wide auto-refrigeration/brittle fracture evaluation.
151
of the fragments, the energy released during the explosion far exceeded the energy that the primary and sponge
absorbers could dissipate. The metallurgist summarized the findings:
• A large amount of energy was generated from the ignition of hydrocarbon vapor in
the system.
• The energy dissipation capacity during brittle crack propagation was very limited
compared to the available energy. This resulted in numerous crack branching events,
which fragmented the [primary and sponge absorbers’] shells.
• Kinetic energy from the explosion propelled the shell fragments outward. [...]
The CSB concludes that the explosion inside the primary and sponge absorbers provided enough energy to
create numerous crack branching events, fragment the vessel shells, and propel the pieces outward with enough
force to puncture the asphalt tank.
The third-party metallurgist’s analysis also included a simplified model that compared energy dissipated in
ductile versus brittle fracture. This analysis showed that a more ductile material, such as normalized A-516 steel,
would still likely not have contained the explosion. However, significant crack branching and fragmentation
would not have occurred. Instead, a fish-mouth rupture event would have been more likely. Simply stated,
continued use of the A-201 and A-212 steel for these vessels resulted in large metal projectiles endangering
people and equipment, where a vessel using a more ductile steel grade would more likely rip open like a zipper
with fewer dangerous projectiles.
The CSB concludes that had the primary and sponge absorbers’ materials of construction been upgraded to a
more ductile pressure vessel steel, such as A-516, the explosion would have likely caused a fish-mouth rupture
event instead of brittle fracture; therefore, the tank puncture, asphalt release and fire, and injuries caused by the
vessel fragments striking nearby workers should not have occurred.
In its post-incident rebuild project, Cenovus Superior Refinery fabricated the new primary and sponge absorbers
with A-516 grade steel.
4.5.2.3 Inherently Safer Design for Extreme Events

For equipment constructed in accordance with codes, standards, or practices no longer in general use, federal
safety regulations require facilities to determine and document that the process equipment is designed,
maintained, inspected, tested, and operating in a safe manner.a In 2000, API published a recommended practice
for performing fitness-for-service evaluations on existing process equipment (API RP 579) [145]. The following
year, API and ASME formed the Fitness-for-Service Joint Committee to develop and maintain a fitness-for-
service standard, first published in 2007 (API 579-1/ASME FFS-1 [144]). Though not a specific requirement,
the current good engineering practice is to use the ASME Code to determine minimum design temperatures
when performing fitness-for-service evaluations and reassess and re-rate vessels whose Code requirements have
changed [141]. In some cases, some companies evaluating the suitability of existing equipment have found it
a
29 C.F.R. § 1910.119(d)(3)(iii) and 40 C.F.R. Part 68.65(d)(3).
152
necessary to proactively replace the equipment [146, 147]. Husky Superior Refinery had not performed fitness-
for-service on its older equipment prior to the April 2018 incident.
Industry experts recommend that facilities perform brittle fracture assessments on equipment constructed before
the 1988 ASME Code revisions came into effect. By the time of the 1988 ASME Code revisions, the primary
and sponge absorbers had already been in service for over 25 years. In a paper titled “ASTM A-212 Pressure
Vessel Steel – A Case Against Continued Use,” Alejandro Vega writes,
Pressure vessels manufactured from ASTM A-212 are still in use and the re-
assessment for use under Fitness-for-Service rules requires that [minimum design
metal temperature] be calculated under the newer ASME Code rules. Such
evaluations will render the vessels, in all likelihood, not suitable for service under
their original design specifications. The use of A-212 vessels under these
temperature conditions is therefore not recommended and should only be pursued
through the use of extensive risk assessment and additional hazard mitigation
practices, such as employing operational controls (engineering and
administrative) by limiting personnel exposure to the area of probable hazard and
containing the effects of such a hazard if it were to occur. The question of
continued use should not be considered on the basis of need, but rather personnel
safety and liability [141].
This incident shows the potential detrimental effects that the superseded steel grades, which are more
susceptible to brittle fracture, can cause in an extreme event. Industry standards such as API 579-1/ASME FFS-
1 pertain to expected operating conditions, and do not guard against failure from extreme events like the rapid
ignition of hydrocarbons inside process equipment. Explosions inside process vessels could release large
amounts of energy that exceed what the equipment can absorb. A vessel that cannot dissipate this energy could
rapidly crack and fragment. Even if old equipment meets requirements for standard operations, a modern
material of construction will perform better and reduce the likelihood of brittle fracture in the case of an extreme
event. Selecting material that remains in the ductile zone ensures that the vessel can absorb more stress and is
less likely to fail catastrophically [141]. Therefore, risk assessments
KEY LESSON should consider relatively rare events.
Fitness-for-service assessments
The CSB concludes that although the primary and sponge absorbers’
do not always evaluate extreme
construction met industry standards for normal operating parameters,
events, such as an explosion
these materials were known to underperform during extreme events
inside the vessel. Selecting
like rapid hydrocarbon ignition inside the equipment. Because fitness-
materials that remain in a ductile
for-service standards do not require evaluating extreme events, fitness-
zone in all modes of operation for-service assessments may still have been inadequate to justify a
can be an inherently safer vessel upgrade to prevent this incident.
design, because should the
equipment fail, a fish-mouth Following its post-incident 2018 inspection, OSHA issued a citation to
rupture is likely preferred over a Husky Superior Refinery and required the refinery to perform fitness-
more dangerous brittle fracture for-service analysis on vessels constructed of A-212 in accordance with
failure. RAGAGEP including but not limited to API 510 and API 579-1/ASME
FFS-1 prior to returning them to service [99, p. 10]. In response, the
153
refinery completed an auto-refrigeration and brittle fracture process hazards analysis to identify, evaluate, and
mitigate vessels subject to auto-refrigeration and brittle fracture in the refinery. The evaluation team identified
35 scenarios requiring further action, resulting in 132 recommendations 20 of which were for the FCC and
GasCon units. Cenovus Superior Refinery provided its rebuild plans to address the recommendations, which
OSHA has accepted as abatement. The CSB does not make further recommendations.
4.6 Emergency Preparedness

Facilities like Husky Superior Refinery employ both preventive safeguards to prevent accidental releases, and
mitigative safeguards to reduce the impact of accidental releases. CCPS defines one type of mitigative
safeguards, called receptive-mitigative safeguards, as:
Those measures related to features such as facility siting, fire-and blast-resistant

design, personal protective equipment, and emergency response that serve to
reduce loss event impacts if they are effective at intervening between the source
of the released material or energy and the receptors (people, property,
environment) that could be affected [104, p. 216].
Husky Superior Refinery’s explosion incident escalated into a large fire that contributed to the severity of the
April 26, 2018, incident. This section examines some elements that affected the fire consequences.
4.6.1.1 Fire Plan

Husky Superior Refinery had performed multiple studies to evaluate existing hazards and implement projects to
protect its workers from fire, explosion, and toxic release hazards. These studies included a fire incident action
plan in 2006 and facility siting studies in 1998, 2000, 2003, and 2009 through 2010.
The fire incident action plan (“fire plan”) evaluated six asphalt tanks, of identical sizes, that resided inside the
same containment dike. According to the document, the containment dike had the capacity to hold all contents
of the failed Tank 101. The fire plan for these asphalt tanks, a one-page overview document, contained bullet
points about the tank’s contents and general instructions for responding to a fire at the tanks.
According to the fire plan, the asphalt was a semi-liquid stored at 320 °F and had a flash pointa of 100-150 °F.
Husky Superior Refinery had classified Tank 101’s contents as a combustible semi-liquid with an NFPA
flammability hazard ranking of 2.b NFPA 704 describes flammability hazard 2 materials to “under moderate
heating ... could release vapor in sufficient quantities to produce hazardous atmospheres with air” [148, pp. 704-
8]. The fire plan stated, “Asphalt does not normally ignite without prolonged direct flame impingement.”
a
The National Fire Protection Association (NFPA) defines flash point as: “the minimum temperature of a liquid at which sufficient vapor
is given off to form an ignitible mixture with the air, near the surface of the liquid or within the vessel used” [154].
b
The National Fire Protection Association Standard 704, Standard System for the Identification of the Hazards of Materials for
Emergency Response (NFPA 704) defines a classification system for health, flammability, and instability hazards of chemicals [161].
154
The fire plan recommended against using foam for heavy oils stored at high temperatures (above 200 °F) and
had the following warning for using water as an extinguishing agent:
Water must be used with caution for liquids above 200 °F and may be used only
on the surface of the liquid as a light spray. Light fog patterns can be effective in
cooling the liquids surface to remove heat, but may cause “frothing.”
4.6.1.2 Emergency Response

Once the explosion occurred, refinery responders initially focused on accounting for all workers, tending to the
injured, and putting out the smaller fires in the FCC unit. The hot asphalt spreading throughout the refinery was
initially a lower concern. Some employees were “agonizing over [whether] to put water on [the hot asphalt] or
not” while others believed that hot asphalt “should not [ignite]” under the incident conditions. The CSB did not
find evidence that the incident command team referenced the fire plan on the day of the incident.
Husky Superior Refinery’s safety data sheet (SDS) for asphalt indicated its flash point as greater than 200 °F
and that it was “not flammable or combustible by OSHA/WHMIS [Workplace Hazardous Materials Information
System] criteria.” Flammability information, such as its lower and upper flammability limits and autoignition
temperature was “Not available” on the SDS; however, it advised that asphalt was “sensitive to static discharge
at temperatures at or above the flash point” and to “ELIMINATE all ignition sources” upon accidental release.
Husky Superior Refinery’s Emergency Response Team had been training monthly, and with the Superior Fire
Department at least three times a year, including exercises that were site-specific to the refinery. A year before
the incident, Husky Superior Refinery had begun leading site-specific drills to employ the incident command
structure to identify improvement opportunities.
4.6.1.3 Hydrofluoric Acid (HF)

Husky Superior Refinery used HF in its alkylation unit. The HF storage tank was about 150 feet from the
primary and sponge absorbers that exploded, which was about 50 feet closer than the asphalt storage tank that
was damaged. Husky Superior Refinery reported that there was no damage to the HF tank from this incident.
After the asphalt fire began, the incident command team monitored the status of the HF tank through drone
surveillance. Refinery personnel told the CSB that they verified that the water curtain around the HF tank, which
provides water suppression in the event of a leak, was still operating past 11:00 p.m. that evening and was left
on through the night. According to Husky Superior Refinery’s website, the HF safety systems in place operated
as designed during the incident and no HF was released [55].
In April 2019, Husky Superior Refinery announced that it decided to continue using HF alkylation after
reviewing alternatives for the refinery rebuild project. The refinery determined that alternative technologies
were not yet proven or involved significant risks. On its website, Husky Superior Refinery committed to
periodically reviewing new technologies and safety features that may be incorporated in the future [55].
After the incident, Husky Superior Refinery and the EPA amended the Consent Decree that the refinery had
entered into under Murphy Oil in 2011 (refer back to Section 4.1.2.2 for more background on the consent
155
decree) [73]. The two amendments filed in 2019 and 2020 [149, 150] include an HF Unit Upgrade Project to
“provide safety enhancements to the design, maintenance, and operation of Husky Superior Refinery’s HF
alkylation process” [149, p. 7]. Safety enhancements proposed include the addition of a rapid acid transfer
system, enhancements to the existing water mitigation system, and additions and modifications of other safety
features [149, p. Appendix C]. According to its website, Cenovus Superior Refinery plans to incorporate the
additional HF safety enhancements into its refinery rebuild project [55].
4.6.2 Analysis
4.6.2.1 Risk Prevention Near Hydrofluoric Acid Storage Vessels

The refining industry has experienced multiple HF incidents and near-misses in recent history. Near-misses
include the 2015 ExxonMobil Torrance Refinery incident and the 2018 Husky Superior Refinery incident,
where the explosions at the FCC units released metal debris near the vicinity of HF storage vessels but did not
compromise the equipment [108]. In 2019, an explosion at the Philadelphia Energy Solutions (PES) refinery’s
HF alkylation unit resulted in the release of over 5,000 pounds of HF [151, p. 24]. These three major incidents
drove updates to API RP 751, Safe Operation of Hydrofluoric Acid Alkylation Units, most recently updated in
2021, which now sets out more stringent requirements for preventive and mitigative safeguards for HF
alkylation units [152].
Though the updated API RP 751 should increase safety in HF alkylation units, catastrophic events such as
explosions could damage the critical safety systems designed to mitigate potential HF releases. For example, in
the 2019 PES incident, the ignition of a flammable vapor cloud damaged the control system and power supply to
the water pumps required for the HF mitigation water cannons. The system had to be manually turned on in the
field by a shift supervisor wearing firefighting protective gear [151, pp. 27-28].
FCC and alkylation processes are closely linked. An FCC unit produces much of the feed for an alkylation unit,
and because of this, the FCC unit is typically located physically near the alkylation unit.a This proximity
highlights the importance of operating FCC units safely, in a manner that prevents hydrocarbon and oxygen
from forming a flammable mixture, especially in those FCC units that operate near stored volumes of HF. The
Torrance and Superior incidents are near-misses that serve as a warning for industry. The CSB concludes that
FCC units in the U.S. do not currently ensure an effective, minimum level of safeguards to prevent an explosion
during transient operation, creating an elevated risk of hazardous material releases from nearby equipment. The
risk is greater at refineries that store and use HF in their alkylation units. The CSB issues CSB Recommendation
2018-02-I-WI-R12 to the EPA to assess basic FCC unit safety elements mentioned in this report in U.S.
refineries that operate HF alkylation units. This recommendation is in addition to the recommendations to the
EPA relating to HF in the CSB’s PES investigation report.
a
HF is not the only hazard near FCC and alkylation units. Other equipment near FCC and alkylation units could include LPG storage
tanks, which store the highly flammable LPG feeds and intermediate products used in the alkylation process.
156
4.6.2.2 Tank Siting

Federal safety regulations require facilities like Husky Superior Refinery to evaluate facility siting in their PHA
studies. The layout of process units at a facility, the layout of the equipment within a process unit, and the siting
of a facility can act as safeguards to manage process safety risks. Figure 50, from the CCPS publication
Guidelines for Siting and Layout of Facilities, shows how facility siting elements and emergency response can
act as safeguards to protect a facility’s surroundings from potential hazards.
Figure 50. Example of a siting and layout approach. (Credit: CCPS [153, p. 4])
Husky Superior Refinery’s fire incident action plan characterized the contents of the nearby asphalt storage
tanks as a combustible semi-liquid. The NFPA Standard 30, Flammable and Combustible Liquids Code (NFPA
30) includes guidance on storage tanks containing combustible semi-liquid materials like asphalt [154]. This
code defines general requirements for storage of ignitable liquids in a broad range of occupancies and operations
[155]. According to available information, the punctured asphalt storage Tank 101 was sufficiently far away
from important buildings, such as the FCC control room, as required by NFPA 30.a In addition, Husky Superior
Refinery’s fire plan indicated that the containment dike had the capacity to hold all contents of the failed Tank
101, as specified by NFPA 30, which would have limited the area of the spill and fire.
a
NFPA 30 defines minimum separation distances between aboveground storage tanks storing ignitable liquids and the “nearest important
building on the same property.”
157
The NFPA 30 tank siting standards do not specify a failure mode for tanks; the codes and standards do not
account for cases where damage to an upper region of tank wall could cause its liquids to be pressured beyond
the containment dike. In its handbook accompanying the 2018 edition of the code, NFPA explains:
The separation distances specified in the tables were developed through

evaluation of storage tank fire incidents over the 70 or more years since this Code
was first conceived. The minimum distances to adjoining property and between
adjacent tanks [...] have occasionally been decreased over the years as the
mechanism of fire spread has become better understood through experiment and
experience [156].
The CSB concludes that available industry guidance for tank designs
does not consider loss of containment scenarios due to a failure of a KEY LESSON
tank’s walls. Had the explosion debris not struck the upper part of the When siting storage tanks and
asphalt tank, the spill would likely have been contained to the diked designing secondary
area, and the ensuing fire would not have damaged surrounding containment dikes, consider
process units. evaluating tank head pressure
where a tank leak could be above
4.6.2.3 Asphalt Ignition the dike wall, as needed.
API RP 2021, Management of Atmospheric Storage Tank Fires,

discusses the importance of emergency preparedness for tank incidents. These activities include surveying the
facility, reviewing hazards, developing a fire protection and firefighting philosophy, and developing tank-
specific tank fire plans. Incident management resources responding to an emergency can then use this planning
documentation to respond to the incident properly [157].
NFPA and OSHA categorize ignitable liquids based on flash point. NFPA defines flash point as: “the minimum
temperature of a liquid at which sufficient vapor is given off to form an ignitiblea mixture with the air, near the
surface of the liquid or within the vessel used” [154]. OSHA defines flammable liquid as any liquid having a
flash point at or below 199.4 °F.b At the time of the incident, NFPA 30 defined any liquid that had a flash point
below 100 °F as flammable (Class I), and above 100 °F as combustible (Class II and III). As of 2021, NFPA
updated its classifications to introduce the definition of an “ignitible liquid” that is better described by the
liquid’s physical state and properties for all liquids that can be ignited.c Furthermore, NFPA 30 requires that
“Storage of Class II and Class III liquids heated at or above their flash point shall follow the requirements for
Class I liquids [154]”; in other words, any liquid at a temperature above its flash point is considered a flammable
liquid, susceptible to ignition.
a
Both spellings of ignitible and ignitable are acceptable [201].
b
29 C.F.R. § 1910.106(a)(19) (2016).
c
NFPA explains: “For the 2021 edition of NFPA 30, the committee introduced a sweeping change in the classification scheme for
liquids. The term ignitible liquid has been introduced to initiate a process whereby the terms flammable liquid and combustible liquid
are no longer used. This causes the requirements in NFPA 30 and other codes and standards to adopt a scheme based exclusively on the
liquid physical state and property (i.e., the liquid flash point), for all liquids that can be ignited. The necessity for this change stems
from the existence of multiple regulatory systems that use the terms flammable liquid and combustible liquid inconsistently, leading to
confusion in how to apply regulations properly among overlapping regulatory authorities, such as fire officials, occupational safety
officials, and transportation officials” [154, p. Origin and Development].
158
Husky Superior Refinery’s fire plan documented that the asphalt had a
KEY LESSON flash point between 100-150 °F. Because the asphalt was stored above
Materials such as asphalt, which its flash point, at temperatures exceeding 300 °F, it was a flammable
have high (>200 °F) flash points, material at risk of igniting. The CSB concludes that the asphalt that
are ignitable when stored, spilled out of the storage tank was being stored above its flash point,
handled, or processed above and the asphalt was therefore ignitable and should have been
their flash point. For ignitable considered a flammable liquid. Had emergency responders been aware
liquids with high flash points that that the asphalt was a flammable liquid, they could have taken more
effective actions sooner to control the asphalt spill before it ignited.
are stored at temperatures near
or above their flash points, Husky Superior Refinery’s SDS for asphalt indicated its flash point as
companies should ensure that greater than 200 °F, making it “not flammable or combustible by
the safety data sheet includes OSHA/WHMIS criteria.” The SDS contained no flammability
relevant flammability information under the physical and chemical properties section, which
information. did not match the information in the fire plan.
The CSB could not find evidence that the incident command team referenced the fire plan on the day of the
incident. Without referring to the fire plan, the incident command team may not have recognized that the asphalt
was likely to ignite on the day of the incident.a In addition, there appeared to be confusion around how best to
respond to the extensive spill. As time passed and hot asphalt covered a greater area of the refinery, emergency
responders had a lower chance of containing and mitigating the spill.
The CSB concludes that the flammability information contained in Husky Superior Refinery’s asphalt safety
data sheet and fire incident action plan documents was not consistent. This inconsistency in its process safety
information may have contributed to emergency responders not being adequately prepared to respond to a hot
asphalt spill of this magnitude.
The spilled asphalt caught fire approximately two hours after the initial explosion from an ignition source within
the tank, according to witness observations. In 2021, the Asphalt Institute, an international trade association of
petroleum asphalt producers, manufacturers, and affiliated businesses, published a technical paper titled,
“Pyrophoric Material Formation in Heated Asphalt Storage Tanks” [158]. This paper presented two asphalt
storage tank fire incidents that were both caused by the ignition of pyrophoric material inside the tanks when
exposed to air. According to the paper, “Heated asphalt storage tank pyrophoric materials are most often
deposited in the ‘coke’ that forms on the sides and top of the asphalt storage tank,” and that “pyrophoric
materials can serve as the source of ignition for heated asphalt storage tank fires” [159]. On its website, the
Asphalt Institute stated,
The idea behind the document arose as a result of a presentation by staff from the
National Fire Protection Association. During that presentation, it became
apparent that the asphalt industry lacked information on pyrophoric material
formation in heated asphalt storage tanks [158].
a
The CSB discussed the importance of communicating relevant knowledge to the Incident Commander during industrial process fluid
leak emergency situations in its report on the Chevron Richmond Refinery Fire (2012) [164].
159
The CSB concludes that pyrophoric material inside the punctured asphalt tank, which would have begun to
smolder upon contact with air, was the likely ignition source for the asphalt fire.
API first published asphalt safety precautions in the Guide for Safe Storage and Handling of Heated Petroleum-
Derived Asphalt Products and Crude Oil Residua in 1977. API published updated editions in 1988, and then in
2001 as API RP 2023. This recommended practice was specifically geared toward heated tanks and included an
appendix that discussed lessons learned from actual asphalt tank spill and/or in-tank fire incidents. API last
reaffirmed RP 2023 in 2006 and withdrew it in 2020. The CSB issues CSB Recommendation 2018-02-I-WI-
R15 for API to incorporate Husky Superior Refinery asphalt spill and fire incident learnings, including the
flammability of heated asphalt and the ignition risk of pyrophoric material inside asphalt storage tanks, into the
appropriate API products that address safe storage and handling of asphalt.
Following this incident, Husky Superior Refinery told the CSB that it plans to improve its corporate fire school
training for both firefighters and incident command coordination. The refinery plans to improve its emergency
response procedures and training to better address the ignition of leaking substances during emergencies. For
example, additional training may focus on how to create a fog spray pattern with water to reduce the
temperature of a hot asphalt or hot crude oil spill, reducing its volatility and chances of ignition. In addition, in
2020, Husky Superior Refinery and the Superior Fire Department developed a new guideline to outline response
protocols for emergencies at the refinery. The CSB makes CSB Recommendation 2018-02-I-WI-R7 to
incorporate lessons learned from this incident into the appropriate materials for the Cenovus Superior Refinery
Emergency Response Team.
160
5 Conclusions
5.1 Findings
1. The primary absorber and sponge absorber explosion resulted from the ignition of a flammable mixture
of oxygen and hydrocarbon vapors that formed inside the process equipment.
2. While Husky Superior Refinery’s FCC unit was shutting down, the regenerator continued operating at a
higher pressure than both the reactor and the main column. As a result, some air continually flowed
from the regenerator, through the reactor, and into the main column for approximately four hours.
3. During the shutdown, while air was entering the main column, the FCC unit’s wet gas compressor
continued operating and directed the air collecting inside the main column’s overhead receiver into the
gas concentration unit, where it accumulated until it created an explosive mixture with the flammable
hydrocarbons. Oxygen from the air likely reacted with the pyrophoric deposits inside the primary and
sponge absorbers, generating heat and providing the ignition source for the catastrophic explosion inside
the equipment.
4. Husky Superior Refinery’s FCC unit shutdown procedure contradicted UOP’s technical guidance by
instructing refinery personnel to operate the regenerator at a higher pressure than both the reactor and
the main column. Following this procedure directed air into the hydrocarbon-filled main column and
downstream equipment, creating an explosive atmosphere within the equipment. Had Husky Superior
Refinery aligned its shutdown procedure with UOP’s guidelines or industry good practice, the procedure
would have properly instructed operations personnel to keep the air and hydrocarbon systems separate
using a reactor steam barrier, which could have prevented the incident.
5. UOP’s original design for Husky Superior Refinery’s FCC unit lacked a minimum level of
instrumentation to shut down its FCC unit safely using a reactor steam barrier as a safeguard.
6. Had Husky Superior Refinery incorporated the reactor steam barrier safeguard into its operating
procedures sometime between the original commissioning around 1960 and the incident in 2018, it
likely would have equipped the FCC unit with the critical pressure instrumentation needed for the
refinery’s operators to ensure that air and hydrocarbon could not mix during a shutdown, and the April
2018 explosion could have been prevented.
7. Husky Superior Refinery had the ability to purge air out of its main column during a shutdown to
prevent oxygen accumulation inside the FCC unit, but the refinery had not incorporated this safeguard
into its operating procedures or its operator training program. Had Husky Superior Refinery established
a non-condensable gas purge of the main column during the FCC unit shutdown, as recommended by
UOP, the oxygen could have been swept out of the system, preventing the explosion.
8. On the morning of the incident, Husky Superior Refinery did not recognize the elevated oxygen
readings in the boiler flue gas as a potential indication of oxygen entering the refinery process gas
system from the FCC unit as it was shutting down.
161
9. Had Husky Superior Refinery had the ability to monitor the oxygen concentration in the main column
and established a safe operating limit for oxygen, operators could have identified the dangerous oxygen
levels accumulating inside the process equipment and taken the predetermined actions needed to prevent
the incident.
10. Husky Superior Refinery’s approach to minimize flaring likely contributed to the wet gas compressor’s
continued operation during the shutdown, which directed oxygen from the main column into the gas
concentration unit containing flammable hydrocarbon, creating the dangerous conditions that enabled
this explosion.
11. Husky Superior Refinery did not identify or control the potential explosion hazard from accumulating
air within the gas concentration unit containing flammable hydrocarbon when its reciprocating wet gas
compressors operate for extended periods during transient operation.
12. The refining industry should address both shutdowns and startups in FCC unit flare minimization
discussions by first identifying and providing the controls needed to prevent explosions before focusing
efforts on minimizing the environmental impact of these operations.
13. Husky Superior Refinery’s slide valve standard did not properly describe the flow isolation capability of
slide valves, indicating the refinery’s incomplete knowledge and contributing to the lack of recognition
by most Husky Superior Refinery employees associated with the FCC unit that catalyst slide valves
were not an adequate safeguard for preventing a catastrophic explosion.
14. Had industry guidance effectively described the function and limitations of FCC unit slide valve bodies,
Husky Superior Refinery may have not relied on the slide valve as a gas-tight barrier, which could have
helped prevent the incident.
15. Husky Superior Refinery’s spent catalyst slide valve was eroded and damaged such that it could no
longer maintain a catalyst level in the reactor. In addition, the severely eroded slide valve allowed more
air to pass through from the regenerator into the reactor than it would if it were in good condition.
Husky Superior Refinery had normalized or otherwise accepted the spent catalyst slide valve’s erosion
rate over its five-year turnaround cycles likely because its staff believed that it did not impair normal
operation.
16. FCC practitioners should eliminate or otherwise dispel the misleading term “catalyst seal” from future
safety discussions. This term contributed to the lack of understanding at Husky Superior Refinery. The
employees at Husky Superior Refinery took this term at face value and believed that closing the slide
valves would create a “solid plug” or “catalyst seal” that would provide adequate protection from
inadvertent reverse flow events. Their flawed understanding of the slide valves’ purpose resulted in their
overreliance on a single safeguard, which alone proved incapable of preventing oxygen accumulation in
the main column and contributed to this catastrophic event.
17. FCC catalyst differential pressure instruments, such as catalyst level and slide valve differential pressure
indicators, may not be reliable process indicators during a shutdown. Husky Superior Refinery’s
operations staff’s reliance on these instruments led them to believe that both standpipes were full of
catalyst and air was not entering the reactor. Had operators understood the limitations of these
162
instruments and been trained on monitoring other process indicators, such as regenerator, reactor, and
main column pressure indicators, they may have been able to recognize that a substantial amount of air
was entering the main column and taken the necessary steps to prevent this incident.
18. Because Husky Superior Refinery depended on catalyst slide valves to ensure safety by keeping the air
and hydrocarbon systems separated during all operating modes, the refinery lacked adequate safeguards
to reduce process risks to a tolerable level in the PHA scenarios that they identified. During the April
2018 FCC unit shutdown, Husky Superior Refinery’s overreliance on catalyst slide valves and the
absence of more robust safeguards, such as the reactor steam barrier and main column gas purges,
resulted in the ingress of air from the regenerator into downstream gas concentration equipment
containing hydrocarbons, and ultimately caused the explosion.
19. Husky Superior Refinery did not identify safeguards beyond operator action to prevent unintended flow
from the regenerator into the reactor during transient operation, because both catalyst slide valves—the
only other safeguards that Husky Superior Refinery identified—would already be closed. Although
Husky Superior Refinery identified its catalyst slide valves as an important safeguard to prevent
catastrophic scenarios, it had not evaluated nor defined necessary actions to take in the FCC unit’s
operation in the event that a slide valve lost its assumed functionality or was otherwise not available
when needed.
20. The petroleum refining industry should continue to design and implement safeguards that are higher on
the hierarchy of controls to improve process safety in FCC units during transient operation.
21. Because Husky Superior Refinery’s policies did not require periodic technical review of its critical
operating procedures by multidisciplinary teams, major errors and omissions remained undetected in the
FCC unit’s operating procedures for decades. Had a multidisciplinary team reviewed the operating
procedures, with guidance from a subject matter expert, the technical errors and omissions could have
been identified and resolved to match the process technology information provided by the licensor, and
the explosion could have been prevented.
22. Husky Superior Refinery’s FCC technology-specific process knowledge did not adequately address unit
safety in transient operations, including shutting down the unit for a turnaround. Gaps in knowledge
management filtered through procedures, training, and hazard assessments, leaving refinery employees
unequipped with the knowledge necessary to control the FCC unit’s potential transient operation
hazards, such as the inadvertent mixing of air and hydrocarbon that could lead to an explosion inside
process equipment.
23. For much of Husky Superior Refinery’s history, its FCC expertise was mostly in-house, with minimal
engagement with other refineries. Though Husky Superior Refinery’s management encouraged
individuals to attend industry events and UOP’s training classes, this individual training did not
establish sufficient knowledge or competency within the organization to prevent the April 2018
incident.
24. Husky Superior Refinery’s use of external technical experts was limited to efforts aimed at assessing
and improving the FCC unit’s performance during normal operation. Had the refinery effectively
163
assessed its FCC unit’s operating procedures with UOP or an FCC subject matter expert with
comparable industry knowledge, it should have identified and addressed the long-standing process
knowledge gaps around its FCC unit’s major transient operation hazards, and the incident could have
been prevented.
25. Most FCC technology safety information in UOP’s General Operating Manuals—including a previous
version likely published around 1960 and the more recent manual published in 2016—applied to the
current configuration of the FCC unit at the time of the incident and should have been included in the
unit’s process safety information. Had Husky Superior Refinery incorporated UOP’s technology
knowledge into its process safety management systems for the FCC unit, such as operating procedures,
process hazard analyses, and training material, more appropriate safeguards should have been available
during the FCC unit’s shutdown to prevent the explosion and fire.
26. Husky Superior Refinery had not determined safe operating limits for pressure differences between the
regenerator, the reactor, and the main column during a shutdown. In addition, the refinery’s shutdown
procedure provided vague instructions for pressure differences and difficult-to-achieve main column
pressure targets. The absence of implementable guidance in the refinery’s shutdown procedure likely
contributed to the regenerator operating up to approximately 10 psi above the main column’s pressure,
without a reactor steam barrier, and driving a dangerously large amount of air from the regenerator into
the main column.
27. Husky Superior Refinery’s response to the 2013 and 2016 PSM and RMP compliance audit findings
regarding the overall quality of the refinery’s operating procedures was ineffective and ultimately did
not improve the quality of the FCC unit’s operating procedures enough to help prevent this incident.
28. Husky Superior Refinery’s FCC unit operating procedures were not an effective training tool. Not only
did the refinery’s procedures omit major industry-known safeguards, but they also lacked clear
instructions, consequences of deviation, and steps required to correct or avoid deviations that operators
should be able to discuss during their training.
29. While changing its FCC unit shutdown procedure for the 2018 turnaround, Husky Superior Refinery did
not recognize that eliminating the use of atmospheric vents made it more likely for oxygen to
accumulate in the main column and increase the potential for an explosion. Because the refinery’s staff
did not have process knowledge of oxygen accumulation risk in the FCC unit during transient operation,
they may not have identified the risk even had they completed a management of change or risk
assessment on their procedure changes.
30. The Superior Refinery’s PHA study teams lacked adequate licensor or industry guidance to evaluate its
FCC unit’s technology-specific transient operation hazards.
31. Husky Superior Refinery’s policies did not include requirements or guidelines for performing PHAs on
its operating procedures. Had the refinery performed a PHA on its FCC shutdown procedure with a
multidisciplinary team, it could have identified and controlled transient operation hazards such as
inadvertent air and hydrocarbon mixing during a shutdown.
164
32. Husky Superior Refinery did not provide its board operators with sufficient training for them to safely
shut down the FCC unit on the day of the incident. Had Husky Superior Refinery provided simulator
training into its training curriculum, especially with technical experts helping to develop the simulator
scenarios, its board operators could have been better equipped with the necessary hands-on practice
opportunities to shut the FCC unit down safely.
33. Husky Superior Refinery could have identified and corrected the long-standing gaps in its FCC unit
procedures and instrumentation by incorporating qualified trainers and simulators into its operator
training program.
34. Hands-on operator training, such as drills and simulators, is crucial for hazardous operations that are
controlled primarily by procedural safeguards, such as transient FCC operation.
35. Husky Superior Refinery’s operator training program did not effectively prepare the FCC operators to
shut down the unit safely and respond to abnormal situations properly. The lack of known FCC-related
safety concepts in the written training manual, combined with the lack of trainer qualifications and
hands-on practice opportunities, led to poor operator training and contributed to the incident.
36. The 2013 and 2016 PSM and RMP compliance audits’ evaluation of the refinery’s training element did
not identify training and instructor quality issues in its operator training program.
37. Before the April 2018 incident, Husky Superior Refinery employees did not effectively learn and apply
key lessons from the CSB’s ExxonMobil Torrance Refinery investigation report, released in 2017, that
could have prevented Husky Superior Refinery explosion.
38. Although the refining industry has accumulated many years of FCC process safety knowledge from its
members, this information is scattered, complex, and not easily accessible to some refinery employees.
39. The diversity of FCC technology designs in the market has been a barrier for developing an industry
consensus document to help ensure safe FCC unit operation. As a result, there is no publication that
defines common process safety considerations for the design and operation of FCC units.
40. FCC process safety messages from publicly available industry publications are inconsistent. Most
textbooks do not adequately cover FCC unit process hazards and learnings from past FCC unit
incidents. Some publications place too much emphasis on slide valves and do not adequately discuss
other safeguards necessary to prevent major accidents during transient operation, deviating from current
industry discussions.
41. A publicly available technical publication outlining recognized and generally accepted good engineering
practices for safe FCC operation could help drive important safety improvements in FCC units across
the United States.
42. The primary and sponge absorbers’ materials of construction likely met current industry standards for
toughness under normal operating conditions.
165
43. The explosion inside the primary and sponge absorbers provided enough energy to create numerous
crack branching events, fragment the vessel shells, and propel the pieces outward with enough force to
puncture the asphalt tank.
44. Had the primary and sponge absorbers’ materials of construction been upgraded to a more ductile
pressure vessel steel, such as A-516, the explosion would have likely caused a fish-mouth rupture event
instead of brittle fracture; therefore, the tank puncture, asphalt release and fire, and injuries caused by
the vessel fragments striking nearby workers should not have occurred.
45. Although the primary and sponge absorbers’ construction met industry standards for normal operating
parameters, these materials were known to underperform during extreme events like rapid hydrocarbon
ignition inside the equipment. Because fitness-for-service standards do not require evaluating extreme
events, fitness-for-service assessments may still have been inadequate to justify a vessel upgrade to
prevent this incident.
46. FCC units in the U.S. do not currently ensure an effective, minimum level of safeguards to prevent an
explosion during transient operation, creating an elevated risk of hazardous material releases from
nearby equipment. The risk is greater at refineries that store and use hydrofluoric acid (HF) in their
alkylation units.
47. Available industry guidance for tank designs does not consider loss of containment scenarios due to a
failure of a tank’s walls. Had the explosion debris not struck the upper part of the asphalt tank, the spill
would likely have been contained to the diked area, and the ensuing fire would not have damaged
surrounding process units.
48. The asphalt that spilled out of the storage tank was being stored above its flash point, and the asphalt
was therefore ignitable and should have been considered a flammable liquid. Had emergency responders
been aware that the asphalt was a flammable liquid, they could have taken more effective actions sooner
to control the asphalt spill before it ignited.
49. The flammability information contained in Husky Superior Refinery’s asphalt safety data sheet and fire
incident action plan documents was not consistent. This inconsistency in its process safety information
may have contributed to emergency responders not being adequately prepared to respond to a hot
asphalt spill of this magnitude.
50. Pyrophoric material inside the punctured asphalt tank, which would have begun to smolder upon contact
with air, was the likely ignition source for the asphalt fire.
166
5.2 Cause
The CSB determined that Husky Superior Refinery explosion, which occurred during the shutdown of the FCC
unit, was caused by inadvertently directing air inside the regenerator through the reactor, and the main column,
and then into the gas concentration unit. As the air continued flowing into the gas concentration unit, oxygen
accumulated and formed a flammable mixture inside the primary and sponge absorbers. The oxygen also reacted
with existing pyrophoric material inside this equipment, creating the ignition source for the explosion.
The failure to control the air flow during the shutdown was the result of Husky Superior Refinery’s deficiencies
in FCC unit process knowledge regarding critical FCC unit transient operation safeguards that could have
prevented the inadvertent mixing of air and hydrocarbons during a shutdown. These safeguards include
establishing a reactor steam barrier to separate the air from the rest of the hydrocarbon-filled equipment and
purging the main column to the flare system with a non-condensable gas to prevent oxygen accumulation. These
vital FCC unit safeguards are generally known and broadly applied within the refining industry. Not applying
these safeguards allowed oxygen to enter and accumulate in process equipment containing flammable material,
which ignited and exploded. Husky Superior Refinery also failed to ensure the integrity of its FCC unit slide
valves for use during transient operation. A severely eroded slide valve contributed to the incident by allowing
more air to pass from the regenerator into the reactor.
Husky Superior Refinery did not effectively implement process safety management systems, which also
contributed to the incident. These ineffective management systems included Husky Superior Refinery’s process
safety information that did not include the FCC technology licensor’s operating manual, process hazard analyses
that did not effectively identify or control hazards inherent in FCC unit transient operation, operating procedures
that omitted key steps, lacked clear instructions, and were not technically evaluated, and an operator training
program that did not effectively prepare the operators to shut down the FCC unit safely.
The process vessels that exploded were constructed from a grade of steel that was susceptible to brittle fracture,
contributing to the severity of the incident. The force of the explosion shattered these steel vessels and sent large
metal fragments throughout the refinery, one of which struck and punctured the nearby asphalt tank. Had the
process vessels been made of a more ductile steel, the explosion would more likely have torn open (fish
mouthed) the vessels with fewer, if any, dangerous metal projectiles. Also contributing to the severity of the
incident was the fire that resulted from the refinery’s inability to contain and control the hot, ignitable asphalt
spill.
167
6 Recommendations
To prevent future chemical incidents, and in the interest of driving chemical safety change to protect people and
the environment, the CSB makes the following safety recommendations:
6.1 Cenovus Superior Refinery

2018-02-I-WI-R1
Establish safeguards to prevent explosions in the FCC unit during transient operation (including startup,
shutdown, standby, and emergency procedures). Incorporate these safeguards into written operating procedures.
At a minimum establish the following specific safeguards:
air);
levels;
e) Documentation of consequences of deviating from the transient operation safe operating limits and of
predetermined corrective actions; and
2018-02-I-WI-R2
Based on licensor input and good industry practices, determine the appropriate point(s) in the FCC unit’s
shutdown procedures to shut down all wet gas compressor(s). Incorporate this information into all FCC unit
2018-02-I-WI-R3
Develop and implement a slide valve mechanical integrity program that addresses erosion and ensures proper
functioning of the slide valves during a shutdown. The program must include, at a minimum:
a) A slide valve mechanical integrity standard that defines monitoring and inspection requirements, with
acceptance criteria, required for the safe operation of the FCC unit during transient operation (such as a
startup, shutdown, standby, and emergency).
b) Monitoring that includes process data analysis and mechanical preventive activities to evaluate the
mechanical condition of the slide valves during the operation of the FCC unit between turnarounds;
168
c) Quarterly presentations of process data and mechanical preventive maintenance data to refinery
operations management and maintenance management to drive key decisions such as shortening the
turnaround cycle and/or planning a maintenance outage;
d) During turnarounds and other potential slide valve maintenance outages, evaluate the adequacy of the
slide valve mechanical integrity program for the safe operation of the FCC unit during transient
operation. If the inspection demonstrates unsuccessful performance, make appropriate corrections.
During the next major FCC unit turnaround at Cenovus Superior Refinery, demonstrate that the slide valve
mechanical program is adequate for the safe operation of the FCC unit during transient operation. If the
inspection demonstrates unsuccessful performance, make appropriate corrections to the slide valve mechanical
integrity program.
2018-02-I-WI-R4
Develop emergency procedures for responding to a loss of catalyst slide valve function (for example, when it
leaks excessively or fails to close on demand).
2018-02-I-WI-R5
Develop guidance for analyzing operating procedures to improve transient operation hazard evaluations during
PHAs. Refer to section Chapter 9.1 in the CCPS publication Guidelines for Hazard Evaluation Procedures, 3rd
Ed. or an appropriate equivalent resource to develop the guidance. Incorporate the guidance into the appropriate
Cenovus Superior Refinery PHA procedural documents and policies.
2018-02-I-WI-R6
Develop and implement an FCC unit operator, supervisor, and manager training program based on the licensor’s
guidance and on available industry guidance. Elements of the training program shall include:
a) A set of written training materials (such as a manual) consistent with the licensor’s technology
information, encompassing:
i) FCC equipment;
ii) Normal operations;
iii) Transient operations (including startup, shutdown, standby, and emergency); and
iv) Case studies of industry FCC industry incidents, including ExxonMobil Torrance (2015) and this
incident; and
b) Training delivery methods including:
i) Group and individual training; and
ii) Simulator training for board operators.
169
2018-02-I-WI-R7
Incorporate lessons learned from this incident into the appropriate training materials for the Cenovus Superior
Refinery Emergency Response Team. At a minimum, topics shall include the proper response to liquids
potentially stored above their flash point, such as asphalt, and the ignition risk of pyrophoric material inside
asphalt storage tanks.
6.2 Cenovus Energy

2018-02-I-WI-R8
For all Cenovus operated refineries with FCC units, develop and implement an FCC unit-specific PHA guidance
document as part of each FCC unit’s ongoing PHA update/revalidation cycle, including the Cenovus Superior
Refinery. The PHA guidance document should be updated with new industry knowledge as it becomes available
(for example, from AFPM, CCPS, and API). The PHA guidance document should include a requirement to
review available licensor and industry guidance for FCC unit PHA scenarios and recommended safeguards and
at a minimum, include information related to transient operation safeguards listed in CSB Recommendation
2018-02-I-WI-R1.
2018-02-I-WI-R9
Develop and implement a technology-specific knowledge-sharing network program across all Cenovus operated
refineries, which at a minimum includes an FCC technology peer network. The peer network(s) must include
engineers, operations management, and operations staff from each site that uses the technology, including the
Cenovus Superior Refinery. The network(s) must meet at least annually to discuss process safety topics in the
technology including:
a) Relevant incidents and near-misses at the refineries and/or in industry;
b) Refinery learnings in implementing process safety improvements;
c) Relevant industry tools, bulletins, and knowledge-sharing documents, such as those published by
AFPM, CCPS, and API; and
d) Relevant updates to industry publications and standards.
2018-02-I-WI-R10
Include and maintain the FCC technology licensors’ operating manuals in the process safety information
packages for all FCC units, including the FCC unit at Cenovus Superior Refinery.
170
6.3 U.S. Occupational Safety and Health Administration (OSHA)

2018-02-I-WI-R11
Develop guidance documents for performing process hazard analysis on operating procedures to address
transient operation hazards in facilities with Process Safety Management (PSM) covered processes.
6.4 U.S. Environmental Protection Agency (EPA)

2018-02-I-WI-R12
Develop a program that prioritizes and emphasizes inspections of FCC units in refineries that operate HF
alkylation units (for example, under EPA’s National Compliance Initiative called Reducing Risks of Accidental
Releases at Industrial and Chemical Facilities). As part of this program, verify FCC unit safeguards that prevent
explosions during transient operation (including startup, shutdown, standby, and emergency procedures). At a
minimum the program will verify the following specific safeguards:
air);
levels;
e) Documentation of consequences of deviating from the transient operation safe operating parameters and
of predetermined corrective actions; and
This recommendation is in addition to the recommendations to EPA relating to hydrofluoric acid outlined in the
CSB’s report on the 2019 fire and explosions at the Philadelphia Energy Solutions refinery. In that report, the
CSB recommended (1) that the EPA prioritize inspections of refinery HF alkylation units to ensure units are
complying with API good practice guidance, (2) to require petroleum refineries with HF alkylation units to
evaluate inherently safer technology, and (3) to initiate prioritization and, as applicable, risk evaluation of HF
under the Toxic Substances Control Act.
6.5 American Petroleum Institute (API)

2018-02-I-WI-R13
Using API’s processes to determine the appropriate safety product, develop a publicly available technical
publication for the safe operation of fluid catalytic cracking (FCC) units. The document should be applicable to
both new and existing units. Include the following topics at a minimum:
171
a) Description of typical FCC unit hazards, including air leaks into hydrocarbon systems or hydrocarbon
leaks into air systems that could form a flammable mixture during transient operation (startup,
shutdown, standby, and the actions required to transition between these modes). If needed, include
differences between possible reactor/regenerator configurations;
b) Recommended practices for safeguards to control FCC unit hazards;
c) Recommended monitoring for process safety during FCC unit transient operations;
d) Recommended emergency operating procedures for FCC-specific scenarios;
e) PHA guidance for key FCC-specific scenarios, including transient operation;
f) Recommended FCC-specific field and board operator process safety training topics and methods;
g) Guidelines for process safety assessments of FCC units; and
h) Incorporate lessons learned from this CSB investigation and the CSB’s ExxonMobil Torrance Refinery
Electrostatic Precipitator Explosion investigation throughout the document and include references in the
document’s bibliography.
2018-02-I-WI-R14
Modify the appropriate existing recommended practice (for example, API RP 553, Refinery Valves and
Accessories for Control and Safety Instrumented Systems) to include information about the purpose, design,
maintenance, and testing of additional FCC catalyst slide valve components, including the slide valve body. If
an API product other than API RP 553 is modified, API RP 553 should guide the reader to that reference.
2018-02-I-WI-R15
Incorporate lessons learned from the FCC Unit Explosion and Asphalt Fire at Husky Superior Refinery incident
into the appropriate API products (for example, API RP 2023, Guide for Safe Storage and Handling of Heated
Petroleum-Derived Asphalt Products and Crude Oil Residua, or API RP 2021, Management of Atmospheric
Storage Tank Fires). At a minimum, topics shall include the flammability of heated material such as asphalt and
the ignition risk of pyrophoric material inside asphalt storage tanks. Include a reference to this CSB
investigation in the document’s bibliography.
6.6 Honeywell UOP

2018-02-I-WI-R16
Participate in the API committee that develops a technical publication for the safe operation of FCC units.
172
7 Key Lessons for the Industry

To prevent future chemical incidents, and in the interest of driving chemical safety change to protect people and
the environment, the CSB urges companies to review these key lessons:
1. Transient operations, such as startups, shutdowns, and standby operation, may require a different set of
safe operating limits compared with normal operation. For startup, shutdown, and standby operating
modes, consider creating separate console screens and state-based alarms to help operators manage
critical process variables for transient operation.a These parameters should be incorporated into operator
training and operating procedures.
2. During transient operation for any process involving flammable materials, operators need to understand
how air (or oxygen) could enter and accumulate inside equipment, and how oxygen should be purged
out of the system to prevent the development of a flammable mixture. The effectiveness of a purge
should be verified by engineering calculations or direct measurements of oxygen content inside the
equipment.
3. The piping from process equipment to a refinery flare system is a critical safety system, especially
during startups and shutdowns. Refineries should understand why and how to vent and purge equipment
to their flare system to start up and shut down a process unit safely. Changes to venting and purging
procedures must be evaluated for their impacts on the process units.
4. Most process hazard analysis (PHA) studies for continuously operating processes focus on hazards
during normal operation. However, a significant portion of process safety incidents occur during
transient operations, such as startups, shutdowns, and standby. Companies should perform PHAs on
critical operating procedures to better identify hazards that arise during transient operations with an
interdisciplinary team of operators, engineers, maintenance, management, and other relevant disciplines.
5. Subject matter experts’ and consultants’ reviews of a process unit’s performance should not be limited
to normal operations. Even old and established operating procedures might contain errors, inadequacies,
or deviations from current generally accepted industry practices. For specialized technologies,
companies should consider periodic audits of a unit’s existing process safety information, such as
operating procedures, by subject matter experts. Companies that do not have centralized subject matter
expert departments to review process safety information should consider hiring consultants.
6. Facilities should participate in process safety knowledge-sharing with their peers. Each site should focus
on expanding its process knowledge and draw on sister sites and industry organizations to avoid siloes.
The refining industry has many opportunities for technology-specific process safety information-sharing
networks.
7. Operator training should include hands-on training opportunities for rare but critical tasks, such as
shutting down a process unit safely for a turnaround, which typically occurs once every five years in
many refineries.
a
The CSB’s investigation of the Pryor Trust gas well blowout and fire included discussion, analysis, and recommendations on using
state-based alarming [151].
173
8. FCC catalyst slide valves and catalyst levels are not gas-tight. They should not be relied upon as an
independent protection layer in hazard assessments.
9. During FCC unit transient operations, which include startup, standby, and shutdowns, the reactor should
be the point of highest pressure in the system until it is isolated from the main column to prevent
inadvertent air and hydrocarbon mixing. Operators should understand how to manage pressures and
flows to avoid entering explosive process conditions.
10. During FCC unit shutdowns, facilities should assess the timing of shutting down the wet gas compressor
to minimize or otherwise prevent sending air into the gas concentration unit. Most FCC units have
centrifugal compressors, which are typically shut down earlier due to surge concerns; however,
reciprocating compressors can operate at low rates for prolonged periods.
11. Technology licensors should seek to continually improve the inherent safety of their equipment designs
and clearly communicate process safety hazards to the owners and operators of their technology.
12. Fitness-for-service assessments do not always evaluate extreme events, such as an explosion inside the
vessel. Selecting materials that remain in a ductile zone in all modes of operation can be an inherently
safer design, because should the equipment fail, a fish-mouth rupture is likely preferred over a more
dangerous brittle fracture failure.
13. When siting storage tanks and designing secondary containment dikes, consider evaluating tank head
pressure where a tank leak could be above the dike wall, as needed.
14. Materials such as asphalt, which have high (>200 °F) flash points, are ignitable when stored, handled, or
processed above their flash point. For ignitable liquids with high flash points that are stored at
temperatures near or above their flash points, companies should ensure that the safety data sheet
includes relevant flammability information.
174
8 References
[1] Husky Energy, "History," [Online]. Available:
https://web.archive.org/web/20200505114103/https://huskyenergy.com/about/history.asp. [Accessed 27 April 2020].
[2] Husky Energy, "About Husky: Overview," [Online]. Available:
https://web.archive.org/web/20200505125426/https://huskyenergy.com/operations. [Accessed 12 May 2020].
[3] Cenovus Energy, "Products," [Online]. Available: https://www.cenovus.com/Our-operations/Value-chain-and-products. [Accessed
3 December 2022].
[4] Husky Energy, "Operations - Husky Energy," [Online]. Available:
https://web.archive.org/web/20200505125426/https://huskyenergy.com/operations/. [Accessed 27 April 2020].
[5] Husky Energy, "Operations / Thermal," [Online]. Available:
https://web.archive.org/web/20200505073844/https://huskyenergy.com/operations/thermal.asp. [Accessed 5 May 2020].
[6] Husky Energy, "Downstream - Husky Energy," [Online]. Available:
https://web.archive.org/web/20200505123455/https://huskyenergy.com/operations/downstream.asp. [Accessed 27 April 2020].
[7] Cenovus Energy, "Upgrading & refining," [Online]. Available: https://www.cenovus.com/operations/refineries.html. [Accessed 2
December 2021].
[8] Reuters, "Cenovus to buy Husky for $2.9 billion to create No.3 Canadian energy firm; more deals seen," 25 October 2020. [Online].
Available: https://www.reuters.com/article/us-husky-energy-m-a-cenovus-energy-idUSKBN27A0DS. [Accessed 28 October 2020].
[9] Cenovus Energy, "Cenovus completes amalgamation with Husky Energy Inc.," 31 March 2021. [Online]. Available:
https://www.cenovus.com/news/news-releases/2021/03-31-2021-cenovus-completes-amalgamation-with-husky-energy-inc.html.
[Accessed 7 April 2021].
[10] Cenovus Energy, "Cenovus closes transaction to combine with Husky," 4 January 2021. [Online]. Available:
https://www.cenovus.com/News-and-Stories/News-releases/2021/2152436. [Accessed 30 September 2022].
[11] Superior Public Library, "Aerial view of the Lake Superior Refinery, 1951," [Online]. Available:
https://www.facebook.com/SuperiorPublicLibrary/photos/a.239542799436053/1208875455836111. [Accessed 12 May 2020].
[12] U.S. Energy Information Administration, "Capacity of Operable Petroleum Refineries by State as of January 1, 2021," [Online].
Available: https://www.eia.gov/petroleum/refinerycapacity/table3.pdf. [Accessed 2 December 2021].
[13] Husky Energy, "Husky Receives Approval to Begin Superior Refinery Rebuild," 30 September 2019. [Online]. Available:
https://huskyenergy.com/news/release.asp?release_id=1922377. [Accessed 27 April 2020].
[14] Superior Chamber & Visitors Bureau, "Husky Energy Superior Refinery," [Online]. Available:
https://www.superiorchamber.org/list/member/husky-energy-superior-refinery-252. [Accessed 27 April 2020].
[15] Murphy Oil Corporation, "Our History," [Online]. Available:
https://web.archive.org/web/20200808150623/https://www.murphyoilcorp.com/About-Us/Our-History/. [Accessed 27 April 2020].
[16] PR Newswire, "Calumet Specialty Products Partners, L.P. Announces Agreement to Acquire Superior, Wisconsin Refinery Assets
from Murphy Oil Corporation for Approximately $475 Million," 25 July 2011. [Online]. Available:
https://www.prnewswire.com/news-releases/calumet-specialty-products-partners-lp-announces-agreement-to-acquire-superior-
wisconsin-refinery-assets-from-murphy-oil-corporation-for-approximately-475-million-126140573.html. [Accessed 29 March
2022].
[17] Calumet Specialty Products Partners, L.P., "Filing with the U.S. Securities and Exchange Commission," 8 November 2017.
[Online]. Available:
http://app.quotemedia.com/data/downloadFiling?webmasterId=101533&ref=11880738&type=HTML&symbol=CLMT&company
Name=Calumet+Specialty+Products+Partners+L.P.&formType=8-K&dateFiled=2017-11-08. [Accessed 27 April 2020].
[18] Cenovus Energy, "Q3 Corporate Presentation," November 2021. [Online]. Available:
https://www.cenovus.com/invest/docs/corporate-presentation.pdf. [Accessed 3 December 2021].
[19] Cenovus Energy, "Healty & safety," [Online]. Available: https://www.cenovus.com/Our-company/Health-and-Safety. [Accessed 29
July 2022].
[20] U.S. Occupational Safety and Health Administration, "State Plans," [Online]. Available: https://www.osha.gov/stateplans.
[Accessed 22 November 2021].
[21] City of Superior, "History of Superior," [Online]. Available: https://www.ci.superior.wi.us/57/History-of-Superior. [Accessed 27
April 2020].
[22] WDIO, "Twin Ports continue to lead most Minnesota metro areas in job growth," [Online]. Available:
https://www.wdio.com/duluth-minnesota-news/twin-ports-continue-to-lead-most-minnesota-metro-areas-in-job-growth/6276718/.
[Accessed 2 February 2022].
175
[23] Census Reporter, "Census Tract 208, Douglas, WI," [Online]. Available: https://censusreporter.org/profiles/14000US55031020800-
census-tract-208-douglas-wi/. [Accessed 26 August 2022].
[24] R. Sadeghbeigi, Fluid Catalytic Cracking Handbook (Fourth Edition), Oxford, UK: Elsevier, 2020.
[25] W. Letzsch, "Fluid Catalytic Cracking (FCC) in Petroleum Refining," Handbook of Petroleum Processing, January 2014. [Online].
Available: https://link.springer.com/content/pdf/10.1007%2F978-3-319-05545-9_2-1.pdf. [Accessed 2 September 2020].
[26] RDC Solutions, "Fluid Catalytic Cracking 2107 excerpt (video)," YouTube, 6 September 2016. [Online]. Available:
https://www.youtube.com/watch?v=3qSVikFG8hU. [Accessed 24 September 2020].
[27] Synergie Nederland, "Synergie Nederland Air Fluidised Care Systems The Products," 25 October 2013. [Online]. Available:
https://www.youtube.com/watch?v=4WLeAb6lYG0. [Accessed 11 May 2021].
[28] M. A. Fahim, T. A. Alsahhaf and A. Elkilani, Fundamentals of Petroleum Refining, Oxford, UK: Elsevier, 2010.
[29] R. Sadeghbeigi, Fluid Catalytic Cracking Handbook (Fourth Edition), Oxford, UK: Elsevier, 2020.
[30] American Fuel and Petrochemical Manufacturers Association, "Safeguarding the FCCU During Transient Operations (Webinar
Slides)," 27 February 2020. [Online]. Available: https://www.afpm.org/system/files/docs/events/FebruaryWebinarSlides.pdf.
[Accessed 17 December 2021].
[31] Wiley Critical Content, Petroleum Technology - Volume 1-2, Hoboken, NJ: John Wiley & Sons, Inc., 2007.
[32] B. G. Lipták, Instrument Engineers' Handbook (4th Edition) - Process Control and Optimization, Volume 2, Boca Raton, FL: CRC
Press, 2006.
[33] A. Pusceddu, "Safety Considerations on FCC Valves Design," September 2019. [Online]. Available:
https://catalysts.basf.com/files/literature-library/20_IMI_FCC-Valves-Design_Pusceddu.pdf. [Accessed 17 June 2020].
[34] M. Natalini, "Presentation: FCC Special Valves - Best practices to increase performance, reliability, and service life," May 2014.
[Online]. Available: https://refiningcommunity.com/wp-content/uploads/2014/05/FCC-Special-Valves-Best-Practices-to-Increase-
Performance-Reliability-Service-Life-Natalini-Remosa-FCCU-Galveston-2014.pdf. [Accessed 11 June 2020].
[35] American Fuels and Petrochemical Manufacturers Association, "AFPM Webinar Series: Safeguarding the FCCU During Transient
Operations (slides)," 27 February 2020. [Online]. Available:
https://www.afpm.org/system/files/docs/events/FebruaryWebinarSlides.pdf. [Accessed 14 January 2022].
[36] TapcoEnpro, "Fluid Catalytic Cracking Slide Valves (Brochure)," TapcoEnpro, 2020.
[37] TapcoEnpro, "FCCU Boltless Slide Valves," [Online]. Available: http://www.tapcoenpro.com/fccu-boltless-slide-valves/.
[Accessed 3 March 2021].
[38] D. Clary, "Helping Refiners Drive Down Sulfur Content," Albemarle Catalyst Courier Issue 86, pp. 6-9, 2017.
[39] American Fuel and Petroleum Manufacturers, "AFPM United States Refining and Storage Capacity Report," August 2019.
[Online]. Available: https://www.afpm.org/system/files/attachments/AFPM-Capacity-Report-2019.pdf. [Accessed 24 September
2020].
[40] A. H. Tullo, "Why the future of oil is in chemicals, not fuels," Chemical & Engineering News, 20 February 2019. [Online].
Available: https://cen.acs.org/business/petrochemicals/future-oil-chemicals-fuels/97/i8. [Accessed 24 September 2020].
[41] Petroleum Australia, "Asia expected to lead global FCCU capacity growth by 2024," 14 August 2020. [Online]. Available:
https://petroleumaustralia.com.au/news_article/asia-expected-to-lead-global-fccu-capacity-growth-by-2024/. [Accessed 17
September 2020].
[42] Canada Energy Regulator, "North American Crude Oil Refinery and Upgrader Capacity," 29 September 2020. [Online]. Available:
https://www.cer-rec.gc.ca/en/data-analysis/energy-commodities/crude-oil-petroleum-products/north-american-crude-oil-
refinery/index.html. [Accessed 13 May 2022].
[43] D. W. Green and R. H. Perry, Perry's Chemical Engineers' Handbook (8th Ed.), The McGraw-Hill Companies, Inc., 2007.
[44] Globe Newswire, "Global $6.49 Billion Refinery Catalysts Market - Shares, Strategies, and Forecasts 2017-2023," 16 May 2017.
[Online]. Available: https://www.globenewswire.com/news-release/2017/05/16/985468/0/en/Global-6-49-Billion-Refinery-
Catalysts-Market-Shares-Strategies-and-Forecasts-2017-2023.html. [Accessed 2 September 2020].
[45] U.S. Chemical Safety Board, "ExxonMobil Torrance Refinery Electrostatic Precipitator Explosion Investigation Report," May
2017. [Online]. Available: https://www.csb.gov/file.aspx?DocumentId=6023. [Accessed 3 December 2022].
[46] N. P. Lieberman, Troubleshooting Process Plant Control, Hoboken, NJ: John Wiley & Sons, Inc., 2009.
[47] J. L. Jana Hollingworth, "Witnesses and residents recount Superior refinery explosion," 26 April 2018. [Online]. Available:
https://www.duluthnewstribune.com/news/fires/4437549-witnesses-and-residents-recount-superior-refinery-explosion. [Accessed
30 April 2020].
[48] Duluth News Tribune, "Superior oil refinery rocked by explosions, fire," [Online]. Available:
https://www.duluthnewstribune.com/news/4437298-superior-oil-refinery-rocked-explosions-fire. [Accessed 29 April 2020].
[49] U.S. Chemical Safety Board, "Emergency Response Safety Message," 25 October 2018. [Online]. Available:
https://www.youtube.com/watch?v=grOA7iUIxGY. [Accessed 3 December 2020].
176
[50] U.S. Chemical Safety and Hazard Investigation Board, "Husky Public Meeting (Transcript)," 12 December 2018. [Online].
Available: https://www.csb.gov/assets/1/20/csb_-_husky_meeting_-_121218_pdf.pdf?16451. [Accessed 2 March 2022].
[51] Weather Underground, "Duluth, MN Weather History - April 26, 2018," [Online]. Available:
https://www.wunderground.com/history/daily/us/mn/duluth/KDLH/date/2018-4-26. [Accessed 28 May 2021].
[52] WDIO-TV, "Evacuation Messages Contained Conflicting Information," 30 April 2018. [Online]. Available:
https://web.archive.org/web/20180711235601/https://www.wdio.com/news/superior-refinery-fire-evacuation-timeline/4887300/.
[Accessed 2 March 2022].
[53] FOX21 Local News, "Multiple Explosions at Oil Refinery in Superior: 11 Injuries; No Fatalities Being Reported," 26 April 2018.
[Online]. Available: https://www.fox21online.com/2018/04/26/explosion-oil-refinery-superior/. [Accessed 2 March 2022].
[54] Wisconsin Public Radio, "Fire Out, Evacuation Orders Lifted After Explosions At Superior Oil Refinery," 27 April 2018. [Online].
Available: https://www.wpr.org/fire-reignites-evacuation-orders-continue-after-explosions-superior-oil-refinery. [Accessed 2
March 2022].
[55] Husky Energy, "Superior Refinery - Hydrogen Fluoride (HF)," [Online]. Available: https://huskyenergy.com/superior/hf.asp.
[Accessed 28 May 2021].
[56] Wisconsin Public Radio, "Water Sampling Shows Low Levels of Petroleum, Firefighting Foam In and Around Superior Refinery,"
26 February 2019. [Online]. Available: https://www.wpr.org/water-sampling-shows-low-levels-petroleum-firefighting-foam-and-
around-superior-refinery. [Accessed 10 August 2020].
[57] Marsh JLT Specialty, "100 Largest Losses in the Hydrocarbon Industry," 2022. [Online]. Available:
https://www.marsh.com/us/insights/research/100-largest-losses-hydrocarbon-industry.html. [Accessed 5 October 2022].
[58] Wisconsion Public Radio, "Husky Given Green Light to Rebuild Superior Refinery," [Online]. Available:
https://www.wpr.org/husky-given-green-light-rebuild-superior-refinery. [Accessed 30 April 2020].
[59] Husky Energy, "Superior Refinery Rebuild," [Online]. Available: https://huskyenergy.com/superior. [Accessed 30 April 2020].
[60] WDIO News, "Husky Refinery in Superior receives major new equipment, moves one step closer in rebuilding process," 23
November 2020. [Online]. Available: https://www.wdio.com/superior-wisconsin-news/husky-vacuum-tower/5932869/. [Accessed 3
December 2020].
[61] Wisconsin Public Radio, "As Wisconsin’s only oil refinery comes back online, Superior residents will see a decrease in water
rates," 15 September 2022. [Online]. Available: https://www.wpr.org/wisconsins-only-oil-refinery-comes-back-online-superior-
residents-will-see-decrease-water-rates. [Accessed 25 November 2022].
[62] C. Ender and D. Laird, "Minimize the Risk of Fire During Column Maintenance," Chemical Engineering Progress, pp. 54-56,
September 2003.
[63] D. E. Powell, R. H. Winters and M. A. Mercer, Field Guide to Managing Iron Sulfide (Black Powder) Within Pipelines or
Processing Equipment, Houston, TX: NACE International, 2019.
[64] B. K. Vaughen, "Understanding and Managing the Risk during Transient Operations," in American Institute of Chemical Engineers
2020 Spring Meeting and 16th Global Congress on Process Safety, Houston, TX, 2020.
[65] Center for Chemical Process Safety, Guidelines for Enabling Conditions and Conditional Modifiers in Layer of Protection
Analysis, New York, NY: John Wiley & Sons, Inc., 2014.
[66] S. W. Ostrowski and K. K. Keim, "Tame Your Transient Operations," 23 June 2010. [Online]. Available:
https://www.chemicalprocessing.com/articles/2010/123/. [Accessed 17 July 2020].
[67] I. M. Duguid, "Analysis of past incidents in the process industries," 2008. [Online]. Available:
https://www.icheme.org/media/9781/xx-paper-87.pdf. [Accessed 3 December 2020].
[68] American Fuel and Petrochemical Manufacturers Association, "Webinar: Safeguarding the FCCU during transient operations," 27
February 2020. [Online]. Available: https://register.gotowebinar.com/recording/4589687396045083649. [Accessed 10 June 2020].
[69] Center for Chemical Process Safety, Inherently Safer Chemical Processes - A Life Cycle Approach (2nd Ed.), New York, New
York: John Wiley & Sons, Inc., 2009.
[70] L. Pettengill, "FCC emergency interlock system application," May 2011. [Online]. Available: https://refiningcommunity.com/wp-
content/uploads/2017/07/FCC-Emergency-Interlock-System-Application-Pettengill-UOP-FCCU-Galveston-2011.pdf. [Accessed 10
June 2020].
[71] U.S. Environmental Protection Agency, "The Plain English Guide to the Clean Air Act," April 2007. [Online]. Available:
https://www.epa.gov/sites/production/files/2015-08/documents/peg.pdf. [Accessed 14 December 2020].
[72] U.S. Environmental Protection Agency, "Petroleum Refinery National Case Results," [Online]. Available:
https://www.epa.gov/enforcement/petroleum-refinery-national-case-results. [Accessed 14 December 2020].
[73] U.S. Environmental Protection Agency, "Murphy Oil USA Clean Air Act Settlement," [Online]. Available:
https://www.epa.gov/enforcement/murphy-oil-usa-clean-air-act-settlement. [Accessed 23 September 2020].
[74] Consent Decree: Murphy Oil USA, Inc., Civil Action No. 3:10-cv-00563-bbc, 2010.
177
[75] Center for Chemical Process Safety, Layer of Protection Analysis - Simplified Process Risk Assessment, New York, NY: American
Institute of Chemical Engineers, 2001.
[76] C. Argiolas, "FCC Erosion Monitoring (presentation slides)," 2020.
[77] R. Cocco, S. B. R. Karri and T. Knowlton, "Introduction to Fluidization," November 2014. [Online]. Available:
https://www.aiche.org/resources/publications/cep/2014/november/introduction-fluidization. [Accessed 3 December 2022].
[78] E. Santos, M. Hémati, R. Andreux and G. Ferschneider, "Gas and solid behaviours during defluidisation of Geldart-A particles,"
Powder Technology, vol. 211, pp. 156-164, 2011.
[79] The National Institute for Occupational Safety and Health (NIOSH), "Hierarchy of Controls," [Online]. Available:
https://www.cdc.gov/niosh/topics/hierarchy/default.html. [Accessed 30 November 2022].
[80] American Society of Safety Professionals, "ANSI/ASSP Z590.3-2021: Prevention through Design - Guidelines for Addressing
Occupational Hazards and Risks in Design and Redesign Processes," American National Standards Institute, Park Ridge, IL, 2021.
[81] D. Eberhart, "Are the Stresses of Middle Age too Much for Today's Refineries?," 20 February 2014. [Online]. Available:
https://canaryusa.com/stresses-of-middle-age-for-todays-refineries/. [Accessed 6 December 2022].
[82] U.S. Energy Information Administration, "When was the last refinery built in the United States?," 8 July 2022. [Online]. Available:
https://www.eia.gov/tools/faqs/faq.php?id=29&t=6. [Accessed 6 December 2022].
[83] S. Challis, "FCC Process Safety: Prevention of ESP Fires and Explosions," September 2019. [Online]. Available:
https://www.scribd.com/document/476110706/19-CHALCAT-ESP-Safety-BSF-Challis#. [Accessed 21 December 2022].
[84] B. Soyars, M. Lockhart, J. Corbit and G. Neve, "Understanding the Refinery Risk and Technology Review Regulation," 2016.
[Online]. Available: https://www.burnsmcd.com/~/media/files/insightsnews/insights/tech-paper/risk-and-technology-review-
regulation/riskandtechnologyreviewunderstandingrefineryrtrregulationwhitepaper12200.pdf. [Accessed 14 September 2020].
[85] A. Wright, R. Ohmes and J. Lipkowitz, "Rationalisation of and mitigation options for proposed EPA-HQ-OAR-2010-0682, Part 2:
Impact on FCC units.," July 2016. [Online]. Available: https://www.digitalrefining.com/article/1001262/rationalisation-of-and-
mitigation-options-for-proposed-epa-hq-oar-2010-0682#.X1_7aUBFwfk. [Accessed 14 September 2020].
[86] U.S. Federal Register, "40 CFR Parts 60 and 63 [EPA-HQ-OAR-2010-0682; FRL-9935-40-OAR] RIN 2060-AQ75 Petroleum
Refinery Sector Risk and Technology Review and New Source Performance Standards; Final Rule," 1 December 2015. [Online].
Available: https://www.govinfo.gov/content/pkg/FR-2015-12-01/pdf/2015-26486.pdf. [Accessed 29 November 2022].
[87] The Energy Institute, Report 454: Human Factors Engineering in Projects, 2nd Ed., London, UK: The Energy Institute, 2020.
[88] International Society of Automation, "ANSI/ISA-182.-2016: Management of Alarm Systems for the Process Industries," ISA,
Research Triangle Park, NC, 2016.
[89] American Fuel & Petrochemical Manufacturers, "Dynamically Managed Alarms - Panel Session," 19 October 2022. [Online].
Available: https://vmp-resources-summit22-prod-mediabucket-1m0kc43gcdpfp.s3.amazonaws.com/slides/wednesday/10-
19+8+am+Dynamic+Alarming+Panel+with+slido.pdf. [Accessed 6 December 2022].
[90] American Fuel & Petrochemical Manufacturers, "FCC Dynamic Alarm Management," 15 November 2022. [Online]. Available:
https://www.afpm.org/events/329c5200000087. [Accessed 6 December 2022].
[91] Honeywell UOP, "Training - All Courses," [Online]. Available: https://uoptraining.secure.force.com/UOPTrainingCourseListPage.
[Accessed 26 May 2021].
[92] Calumet Specialty Products Partners, L.P., "Production & Refinery Facilities," [Online]. Available:
https://www.calumetspecialty.com/facilities/#production. [Accessed 30 November 2021].
[93] Reuters, "Exclusive: Calumet retains bank to sell Montana refinery: sources," 11 March 2020. [Online]. Available:
https://www.reuters.com/article/us-refinery-sale-calumet-splty-exclusive/exclusive-calumet-retains-bank-to-sell-montana-refinery-
sources-idUSKBN20Y2KL. [Accessed 30 November 2021].
[94] U.S. Occupational Safety and Health Administration, "OSHA 3133: Process Safety Management Guidelines for Compliance,"
1994. [Online]. Available: https://www.osha.gov/Publications/osha3133.html. [Accessed 11 September 2020].
[95] Center for Chemical Process Safety, Guidelines for Risk Based Process Safety, Hoboken, NJ: John Wiley & Sons, Inc., 2007.
[96] U.S. Chemical Safety Board, "Arkema Inc. Chemical Plant Fire," 24 May 2018. [Online]. Available: https://www.csb.gov/arkema-
inc-chemical-plant-fire-. [Accessed 9 December 2020].
[97] Center for Chemical Process Safety, Guidelines for Process Safety During the Transient Operating Mode: Managing Risks During
Process Start-ups and Shut-downs, Hoboken, NJ: John Wiley & Sons, 2021.
[98] Usability Mapping, "The Science of Usability Mapping," [Online]. Available: https://usabilitymapping.com/the-science. [Accessed
3 December 2021].
[99] U.S. Occupational Safety and Health Administration, "Citation and Notification of Penalty," 02 October 2018. [Online]. Available:
https://www.dol.gov/sites/dolgov/files/OPA/newsreleases/OSHA20181543.pdf. [Accessed 18 August 2020].
[100] U.S. Environmental Protection Agency, "Petroleum Refinery Sector Rule (Risk and Technology Review and New Source
Performance Standards)," [Online]. Available: https://www.epa.gov/stationary-sources-air-pollution/petroleum-refinery-sector-rule-
risk-and-technology-review-and-new. [Accessed 11 March 2022].
178
[101] U.S. Federal Register, "National Emission Standards for Hazardous Air Pollutants and New Source Performance Standards:
Petroleum Refinery Sector Amendments," Federal Register / Vol. 68, No. 69, pp. 15458-15490, 10 April 2018.
[102] U.S. Federal Register, "National Emission Standards for Hazardous Air Pollutants and New Source Performance Standards:
Petroleum Refinery Sector Amendments," Federal Register / Vol. 83, No. 132, pp. 31939-31944, 10 July 2018.
[103] Center for Chemical Process Safety, "CCPS Process Safety Glossary," [Online]. Available:
https://www.aiche.org/ccps/resources/glossary. [Accessed 20 July 2020].
[104] Center for Chemical Process Safety, Guidelines for Hazard Evaluation Procedures (3rd Edition), Hoboken, NJ: John Wiley & Sons,
Inc., 2008.
[105] B. Bridges, "More on the Use of Risk Matrices in PHAs/HAZOPs," 14 July 2014. [Online]. Available: https://www.process-
improvement-institute.com/use-risk-matrices-phashazops/. [Accessed 2 March 2021].
[106] U.S. Chemical Safety Board, "Tesoro Refinery Fatal Explosion and Fire," 1 May 2014. [Online]. Available:
https://www.csb.gov/tesoro-refinery-fatal-explosion-and-fire. [Accessed 14 September 2020].
[107] U.S. Chemical Safety Board, "Williams Olefins Plant Explosion and Fire," 19 October 2016. [Online]. Available:
https://www.csb.gov/williams-olefins-plant-explosion-and-fire-. [Accessed 14 September 2020].
[108] U.S. Chemical Safety Board, "ExxonMobil Refinery Explosion," 3 May 2017. [Online]. Available:
https://www.csb.gov/exxonmobil-refinery-explosion-. [Accessed 3 December 2022].
[109] U.S. Chemical Safety Board, "Bayer CropScience Pesticide Waste Tank Explosion," 20 January 2011. [Online]. Available:
https://www.csb.gov/bayer-cropscience-pesticide-waste-tank-explosion/. [Accessed 14 September 2020].
[110] U.S. Chemical Safety Board, "Safety Digest: CSB Investigations of Incidents during Startups and Shutdowns," 2018. [Online].
Available: https://www.csb.gov/assets/1/6/csb_digest_-_startup_shutdown.pdf. [Accessed 14 September 2020].
[111] W. Bridges and M. Marshall, "Necessity of Performing Hazard Evaluations (PHAs) of Non-normal Modes of Operation (Startup,
Shutdown, & Online Maintenance)," Process Improvement Institute, Inc. "PII", 2016. [Online]. Available: https://www.process-
improvement-institute.com/_downloads/Necessity_of_PHA_of_Non-Normal_Modes_of_Operation-R0.pdf. [Accessed 31 July
2020].
[112] R. Tew and W. G. Bridges, "Recipe for a Complete Process Hazard Analysis - Especially Addressing the Key Demands from US
CSB," 2017. [Online]. Available: https://www.process-improvement-
institute.com/_downloads/Recipe_for_a_Complete_Process_Hazard_Analysis_R4.pdf. [Accessed 31 July 2020].
[113] PrimaTech, "PHA for Batch Processes and Procedures," [Online]. Available: https://www.primatech.com/training/pha-for-batch-
processes-and-procedures. [Accessed 8 December 2022].
[114] U.S. Department of Defense, "Military Standard (MIL-STD)-882E, System Safety," 2012.
[115] N. Leveson, "STPA (System-Theoretic Process Analysis) Compliance with MIL-STD-882E and other Army Safety Standards,"
[Online]. Available: http://sunnyday.mit.edu/compliance-with-882.pdf. [Accessed 3 December 2022].
[116] I. Clifton A. Ericson, Hazard Analysis Techniques for System Safety, Hoboken, NJ: John Wiley & Sons, Inc., 2016.
[117] American Petroleum Institute, "A Manager's Guide to Reducing Human Errors (API Publication 770)," American Petroleum
Institute, Washington, DC, 2001.
[118] A. Roe, J. Mason and J. Alamo, "The Role of Simulator Technology in Operator Training programs," 2 November 2010. [Online].
Available: https://www.controleng.com/articles/the-role-of-simulator-technology-in-operator-training-programs/. [Accessed 6
October 2022].
[119] GSE Systems, "Refinery Unit Simulator for Operator Training," 2016. [Online]. Available: http://www.gses.com/wp-
content/uploads/GSE-Refinery-brochure.pdf. [Accessed 6 October 2022].
[120] Center for Chemical Process Safety, Plant Guidelines for Technical Management of Chemical Process Safety (Revised Edition),
New York, NY: American Institute of Chemical Engineers, 1995.
[121] Center for Chemical Process Safety (CCPS), Guidelines for Auditing Process Safety Management Systems, 2nd Ed., New York,
NY: John Wiley & Sons, Inc., 2011.
[122] CCPS - Center for Chemical Process Safety, "AFPM/API Advancing Process Safety - Practical Tools for Process Safety
Performance Improvement," AIChE Academy, 24 April 2018. [Online]. Available:
https://www.aiche.org/academy/videos/conference-presentations/afpmapi-advancing-process-safety-practical-tools-process-safety-
performance-improvement. [Accessed 1 December 2021].
[123] American Fuel & Petrochemical Manufacturers, "Advancing Process Safety Programs," [Online]. Available:
https://www.afpm.org/safety-programs/advancing-process-safety-programs. [Accessed 1 December 2021].
[124] American Fuel and Petroleum Manufacturers Association, "FCC Process Safety Resources," 17 June 2021. [Online]. Available:
https://www.afpm.org/events/2bd2bd00000169. [Accessed 24 January 2022].
[125] U.S. Occupational Safety and Health Administration, "Standard Interpretation: Recognized and generally accepted good
engineering practices in Process Safety Management enforcement," 11 May 2016. [Online]. Available: https://www.osha.gov/laws-
regs/standardinterpretations/2016-05-11-0. [Accessed 25 June 2020].
179
[126] M. Johnson, "The legal difference between standards, specifications, and code," Glass Magazine, 25 September 2020. [Online].
Available: https://www.glassmagazine.com/article/legal-difference-between-standards-specifications-and-code. [Accessed 26
February 2021].
[127] Wisconsin Department of Natural Resources, "Distinguishing between Performance Standards, Technical Standards, and Guidance
Documents," 2004. [Online]. Available: https://dnr.wi.gov/topic/Stormwater/documents/StandardsandGuidance.pdf. [Accessed 26
January 2021].
[128] L. Montgomery, P. McLaughlin, T. Richards and M. Febrizio, "Performance Standards vs. Design Standards: Facilitating a Shift
toward Best Practices," Mercatus Center at George Mason University, Arlington, VA, 2019.
[129] W. S. Letzsch, "The future of fluid catalytic cracking," 1997. [Online]. Available:
https://www2.afpm.org/forms/store/ProductFormPublic/am-97-65-the-future-of-fluid-catalytic-cracking. [Accessed 17 September
2020].
[130] J. W. Wilson, Fluid Catalytic Cracking Technology and Operations, Tulsa, Oklahoma: PennWell Publishing Company, 1997.
[131] Icarus-ORM Academy, Process Hazard Identification Guidebook, Icarus-ORM, 2021.
[132] Federal Aviation Administration, "Advisory Circular 23.2020-1 - FAA Accepted Means of Compliance Process for 14 CFR Part
23," 27 March 2017. [Online]. Available:
https://www.faa.gov/regulations_policies/advisory_circulars/index.cfm/go/document.information/documentid/1030946. [Accessed
1 March 2021].
[133] U.S. Department of Energy, "National Technology Transfer and Advancement Act of 1995 [Public Law (PL) 104-113]," [Online].
Available: https://www.standards.doe.gov/tsm-resources/national-technology-transfer-and-advancement-act-of-1995-public-law-pl-
104-113. [Accessed 3 December 2022].
[134] Center for Chemical Process Safety, "CCPS Projects," [Online]. Available: https://www.aiche.org/ccps/projects. [Accessed 20
December 2022].
[135] American Petroleum Institute, "Procedures for Standards Development, Sixth Edition," July 2019. [Online]. Available:
https://www.api.org/-/media/Files/Publications/2019-API-Procedures-for-Standards-
Development.pdf?la=en&hash=A2937795DB1A5FFF656CEFF566FA2AA3780745F3. [Accessed 16 December 2020].
[136] F. C. Campbell, Elements of Metallurgy and Engineering Alloys, Materials Park, OH: ASM International, 2008.
[137] J. Knott, "Brittle fracture in structural steels: perspectives at different size-scales," The Royal Society Publishing, 28 March 2015.
[Online]. Available: https://royalsocietypublishing.org/doi/10.1098/rsta.2014.0126. [Accessed 30 November 2020].
[138] Babcock & Wilcox, "Finding the Root Cause of Boiler Tube Failures," [Online]. Available:
https://www.babcock.com/resources/learning-center/finding-the-root-cause-of-boiler-tube-failure. [Accessed 30 November 2020].
[139] U.S. Occupational Safety and Health Administration, "Inspection Detail: Inspection: 307043505 - Murphy Oil Usa, Inc.,"
Occupational Safety and Health Administration, 20 February 2008. [Online]. Available:
https://www.osha.gov/pls/imis/establishment.inspection_detail?id=307043505. [Accessed 1 March 2021].
[140] U.S. Occupational Safety and Health Administration, "Petroleum Refinery Process Safety Management National Emphasis
Program," 7 June 2007. [Online]. Available: https://www.osha.gov/enforcement/directives/cpl-03-00-004#I. [Accessed 8 January
2021].
[141] A. Vega, "ASTM A-212 Pressure Vessel Steel - A Case Against Continued Use," PV Newsletter, vol. 4, no. 1, pp. 1-9, 2011.
[142] J. E. Bringas, Handbook of Comparative World Steel Standards, Third Edition, West Conshohocken, PA: ASTM International,
2004.
[143] Polymer Properties Database, "Impact Testing and Ductile-Brittle Transition," [Online]. Available:
http://polymerdatabase.com/polymer%20physics/ImpactTest.html. [Accessed 25 January 2021].
[144] American Petroleum Institute (API) and American Society of Mechanical Engineers (ASME), "Fitness-For-Service (API 579-
1/ASME FFS-1)," API Publishing Services, Washington, D.C., 2016.
[145] American Petroleum Institute Publications Store, "API RP 579-1 / ASME FFS-1, Fitness-For-Service," Techstreet, 1 December
2021. [Online]. Available: https://www.techstreet.com/api/standards/api-rp-579-1-asme-ffs-1?product_id=2245593. [Accessed 3
May 2022].
[146] E. Comeaux, "Evaluation and Prevention of Potential Cold Embrittlement Hazards in Petrochemical Facilities," in AIChE Spring
Meeting and Global Congress on Process Safety, Houston, TX, 2016.
[147] J. R. Dugas, D. G. Damin, J. E. Aller and D. Williams, "Impact Toughness Evaluation of Cold-Service Ethylene Plant Vessels," in
Proceedings of the 5th Ethylene Producers' Conference, Houston, TX, 1993.
[148] National Fire Protection Association, "NFPA 704: Standard System for the Identification of the Hazards of Materials for
Emergency Response," Quincy, MA, 2007.
[149] U.S. District Court for the Western District of Wisconsin, "Civil Action No. 3:10-cv-00563-bbc: Third Amendment to Consent
Decree," 21 February 2020. [Online]. Available: https://www.epa.gov/sites/production/files/2020-
03/documents/thirdamendmurphy-cd.pdf. [Accessed 3 December 2022].
180
[150] U.S. District Court for the Western District of Wisconsin, "Civil Action No. 3:10-cv-00563-bbc: Fourth Amendment to Consent
Decree," 1 December 2020. [Online]. Available: https://www.epa.gov/sites/production/files/2021-
01/documents/fourthamendmurphy-cd.pdf. [Accessed 3 December 2022].
[151] U.S. Chemical Safety and Hazard Investigation Board, "Philadelphia Energy Solutions (PES) Refinery Fire and Explosions," 12
October 2022. [Online]. Available: https://www.csb.gov/philadelphia-energy-solutions-pes-refinery-fire-and-explosions-/.
[Accessed 21 October 2022].
[152] American Petroleum Institute (API), Recommended Practice 751 - Safe Operation of Hydrofluoric Acid Alkylation Units, 5th Ed.,
2021.
[153] Center for Chemical Process Safety, Guidelines for Siting and Layout of Facilities (2nd Edition), New York, NY: Wiley, 2018.
[154] National Fire Protection Association, "NFPA 30: Flammable and Combustible Liquids Code," Quincy, MA, 2021.
[155] National Fire Protection Association, "NFPA 30, Flammable and Combustible Liquids Code," [Online]. Available:
https://catalog.nfpa.org/NFPA-30-Flammable-and-Combustible-Liquids-Code-P1164.aspx?icid=D535. [Accessed 21 January
2022].
[156] National Fire Protection Association, Flammable and Combustible Liquids Code Handbook, National Fire Protection Association,
2018.
[157] American Petroleum Institute, "API Recommended Practice 2021: Management of Atmospheric Storage Tank Fires," Washington,
D.C., 2020.
[158] Asphalt Institute, "New paper released on pyrophoric material formation in tanks," 2021. [Online]. Available:
http://asphaltmagazine.com/new-paper-released-on-pyrophoric-material-formation-in-tanks/. [Accessed 21 January 2022].
[159] Asphalt Institute, "Pyrophoric Materials Formation in Heated Asphalt Storage Tanks," 2021.
[160] G. R. Martin, "FCC unit revamps at minimum cost," October 2016. [Online]. Available:
https://www.digitalrefining.com/article/1001322/fcc-unit-revamps-at-minimum-cost#.XyDHu0BFyaU. [Accessed 28 July 2020].
[161] National Fire Protection Association, "NFPA 704: Standard System for the Identification of the Hazards of Materials for
Emergency Response," Quincy, MA, 2017.
[162] Weather Underground, "Duluth, MN Weather History - April 27, 2018," [Online]. Available:
https://www.wunderground.com/history/daily/us/mn/duluth/KDLH/date/2018-4-27. [Accessed 28 May 2021].
[163] Honeywell UOP, "About UOP," [Online]. Available: https://uop.honeywell.com/en/about-uop. [Accessed 2 September 2020].
[164] U.S. Chemical Safety Board, "Chevron Refinery Fire," 28 January 2015. [Online]. Available: https://www.csb.gov/chevron-
refinery-fire/. [Accessed 14 September 2020].
[165] ASTM International, "Detailed Overview," [Online]. Available: https://www.astm.org/ABOUT/full_overview.html. [Accessed 12
November 2020].
[166] U.S. Chemical Safety Board, "ExxonMobil Refinery Chemical Release and Fire," 18 September 2017. [Online]. Available:
https://www.csb.gov/exxonmobil-refinery-chemical-release-and-fire. [Accessed 14 September 2020].
[167] Centers for Disease Control and Prevention, "Facts About Hydrogen Fluoride (Hydrofluoric Acid)," [Online]. Available:
https://emergency.cdc.gov/agent/hydrofluoricacid/basics/facts.asp. [Accessed 9 September 2020].
[168] U.S. Federal Register, "Final Rule on Process Safety Management of Highly Hazardous Chemicals; Explosives and Blasting
Agents," 24 February 1992. [Online]. Available: https://www.osha.gov/laws-regs/federalregister/1992-02-24. [Accessed 19 June
2020].
[169] Federal Emergency Management Agency, "National Incident Management System, Third Edition," [Online]. Available:
https://www.fema.gov/sites/default/files/2020-07/fema_nims_doctrine-2017.pdf. [Accessed 27 October 2020].
[170] Y.-M. Chen, "Evolution of FCC - Past Present and Future and the Challenges of Operating a High Temperature CFB System," in
10th International Conference on Circulating Fluidized Beds and Fluidization Technology - CFB-10, 2011.
[171] L. e. a. Huang, "Effect of elevated pressure on the explosion and flammability limits of methane-air mixtures," Energy, vol. 186,
2019.
[172] W. Sölken, "Introduction to Butterfly valves," [Online]. Available: http://www.wermac.org/valves/valves_butterfly.html. [Accessed
15 January 2021].
[173] American Fuel and Petroleum Manufacturers Association (AFPM), "Q&A Search - Question 12: For FCC units with closed riser
termination device," [Online]. Available: https://www.afpm.org/data-reports/technical-papers/qa-search/question-12-fcc-units-
closed-riser-termination-device. [Accessed 18 November 2021].
[174] B. Otzisk, "Chemical cleaning and degassing refinery equipment," 2008. [Online]. Available:
http://www.eptq.com/articles/kurita_28012008132918.pdf. [Accessed 17 December 2021].
[175] McGraw-Hill Dictionary of Scientific & Technical Terms, 6E, "noncondensable gas," 2003. [Online]. Available:
https://encyclopedia2.thefreedictionary.com/noncondensable+gas. [Accessed 3 March 2022].
[176] T. Giampaolo, Compressor Handbook: Principles and Practice, Lilburn, GA: The Fairmont Press, 2010.
181
[177] U.S. Environmental Protection Agency, "Petroleum Refinery Sector Rule (Risk and Technology Review and New Source
Performance Standards)," 10 September 2021. [Online]. Available: https://www.epa.gov/stationary-sources-air-
pollution/petroleum-refinery-sector-rule-risk-and-technology-review-and-new. [Accessed 4 May 2022].
[178] P. Gallick, G. Phillippi and B. F. Williams, "What's Correct for My Application -- A Centrifugal or Reciprocating Compressor?,"
Proceedings of the Thirty-Fifth Turbomachinery Sumposium, pp. 113-122, 2006.
[179] Center for Chemical Process Safety, "CCPS Process Safety Glossary: Independent Protection Layer (IPL)," [Online]. Available:
https://www.aiche.org/ccps/resources/glossary?title=independent+protection+layer#views-exposed-form-glossary-pagesafety.
[Accessed 28 July 2022].
[180] Center for Chemical Process Safety, "CCPS Process Safety Glossary: Safety Integrity Level," [Online]. Available:
https://www.aiche.org/ccps/resources/glossary?title=safety+integrity+level#views-exposed-form-glossary-page. [Accessed 28 July
2022].
[181] Center for Chemical Process Safety, "CCPS Process Safety Glossary: Safety Instrumented Function," [Online]. Available:
https://www.aiche.org/ccps/resources/glossary?title=safety+instrumented+function#views-exposed-form-glossary-page. [Accessed
28 July 2022].
[182] Center for Chemical Process Safety, "CCPS Process Safety Glossary: Final Element," [Online]. Available:
https://www.aiche.org/ccps/resources/glossary/process-safety-glossary/final-
element#:~:text=Process%20control%20or%20safety%20device,used%20to%20operate%20a%20valve).. [Accessed 1 September
2022].
[183] ExxonMobil, "2015 Financial & Operating Review," 2015. [Online]. Available: https://corporate.exxonmobil.com/-
/media/Global/Files/investor-relations/investor-relations-publications-archive/2015-FNO-new.pdf. [Accessed 1 September 2022].
[184] A. Nag, Distillation & Hydrocarbon Processing Practices, Tulsa, OK: PennWell Corporation, 2016.
[185] A. Akintoye and S. Harrow, "Determination of Alarm Safety Response Time," in Hazards 26, Edinburgh, UK, 2016.
[186] U.S. Government Printing Office, "The BP Texas City Disaster and Worker Safety Hearing before the Committee on Education and
Labor - One Hundred Tenth Congress, First Session," 22 March 2007. [Online]. Available:
https://www.govinfo.gov/content/pkg/CHRG-110hhrg33902/html/CHRG-110hhrg33902.htm. [Accessed 1 November 2022].
[187] U.S. Occupational Safety and Health Administration, "OSHA Fact Sheet - Lockout/Tagout," 2002. [Online]. Available:
https://www.osha.gov/sites/default/files/publications/factsheet-lockout-tagout.pdf. [Accessed 10 February 2022].
[188] U.S. Occupational Safety and Health Administration, "OSHA Injury and Illness Recordkeeping and Reporting Requirements,"
[Online]. Available: https://www.osha.gov/recordkeeping/. [Accessed 10 September 2020].
[189] U.S. Environmental Protection Agency, "Our Current Understanding of the Human Health and Environmental Risks of PFAS," 16
March 2022. [Online]. Available: https://www.epa.gov/pfas/our-current-understanding-human-health-and-environmental-risks-pfas.
[Accessed 29 June 2022].
[190] U.S. Census Bureau, "QuickFacts Duluty city, Minnesota," [Online]. Available:
https://www.census.gov/quickfacts/fact/table/duluthcityminnesota/PST045221. [Accessed 4 February 2022].
[191] Piping Designer, "Spectacle Blind," [Online]. Available: http://www.piping-
designer.com/index.php/disciplines/mechanical/stationary-equipment/pipe-flanges/92-spectacle-blind. [Accessed 11 May 2020].
[192] U.S. Chemical Safety and Hazard Investigation Board, "BP America Refinery Explosion," 20 March 2007. [Online]. Available:
https://www.csb.gov/bp-america-refinery-explosion/. [Accessed 25 November 2022].
[193] The Royal Institution, "Creating a Fireball - Pouring Water on an Oil Fire," 25 March 2013. [Online]. Available:
https://www.youtube.com/watch?v=NC45vREoEOg.
[194] S. Thierbacker, "FCC Standby Posturing," Refining Community, 5 May 2021. [Online]. Available:
https://refiningcommunity.com/presentation/fcc-standby-posturing/. [Accessed 30 November 2022].
[195] American Petroleum Institute, "About API," [Online]. Available: https://www.api.org/about. [Accessed 2 December 2022].
[196] W. G. Bridges, R. Tew and M. A. Massello, "Best Practices for PHA Revalidations," in 14th Global Congress on Process Safety,
Orlando, FL, 2018.
[197] National Geographic, "Natural Gas," [Online]. Available: https://education.nationalgeographic.org/resource/natural-gas. [Accessed
5 December 2022].
[198] U.S. Department of Energy, "Improve Your Boiler's Combustion Efficiency," January 2012. [Online]. Available:
https://www.energy.gov/sites/prod/files/2014/05/f16/steam4_boiler_efficiency.pdf. [Accessed 5 December 2022].
[199] K. Study, P. Allan, A. Cozat, K. Meliefste, E. Roche and T. Wagner, "Good Till the Last Drop: How Much is Too Much Valve
Leakage?," Wiley Online Library, 2015.
[200] TapcoEnpro, "FCCU Fractionator Isolation Valves," [Online]. Available: https://www.tapcoenpro.com/fccu-isolation-valves/.
[Accessed 6 December 2022].
[201] Merriam-Webster.com Dictionary, "Ignite," [Online]. Available: https://www.merriam-webster.com/dictionary/ignite. [Accessed 9
December 2022].
182
[202] Koch-Glitsch, "About | Koch-Glitsch," [Online]. Available: https://koch-glitsch.com/about. [Accessed 13 December 2022].
[203] Turbomachinery International Magazine, "Centrifugal vs reciprocating compressor," [Online]. Available:
https://www.turbomachinerymag.com/centrifugal-vs-reciprocating-compressor/. [Accessed 8 May 2020].
183
Appendix A—Causal Analysis (AcciMap)
184
185
186
Appendix B—Timeline
Husky Superior Refinery History Prior to Incident
1950 Lake Superior Refining Company refinery built [11]

1958 Murphy Oil acquires Husky Superior Refinery [15]
1992 OSHA promulgates Process Safety Management standarda
Early 1990s Operations department converts operating procedures from paper to digital format; creates
and rewrites new procedures as needed.
1998 Superior Plant Facility Siting Study
2006 Tank fire plans created
2007-2008 OSHA National Emphasis Program inspection of Husky Superior Refinery
2009 Facility Siting Study
2011 Calumet acquires Husky Superior Refinery [16]
2013 Refinery PSM and RMP compliance audit
2016 Refinery PSM and RMP compliance audit
2017 Indirect subsidiary of Husky Energy acquires Husky Superior Refinery [17]
FCC Unit History
1960 FCC unit designed

1961 FCC unit constructed
1963 Turnaround and equipment inspections
1967 ASTM withdraws A-212 and A-201 specifications [142, p. 461]
a
29 C.F.R. Part 1910
187

1988 ASME updates Boiler and Pressure Vessel Code with new low-temperature toughness
requirements [141]
1993-94 Turnaround and FCC unit revamp: UOP redesigns the flue gas system with a new ESP and
other flue gas equipment. In addition, the refinery upgrades instrumentation and control
rooms to digitized distributed control systems (DCS).
1995 Initial PHA study
2000 PHA revalidation
2000 API publishes Recommended Practice 579, Fitness for Service [144]
2013 Turnaround. Husky Superior Refinery replaces the reactor’s stripper with new UOP design.
2016 PHA redo and LOPA study
2018 Turnaround. Explosion while shutting down the FCC unit.
Day of incident – April 26, 2018
5:00 a.m. Start of day shift.

5:40 a.m. Board operator stops feed to the reactor.
5:48 a.m. Board operator attempts to close spent and regenerated catalyst valves from the board. The
regenerated catalyst slide valve indicates that it is closed. Board operator notices that the spent
catalyst slide valve is stuck open at 2 percent valve opening indication. He asks outside
operators to close the valve manually.
5:58 a.m. Board operator reduces the reactor riser steam and increases the stripper steam.
6:04 a.m. Outside operators fully close the spent catalyst slide valve.
6:16 a.m. Reactor level indication drops to zero for the first time.
6:52 a.m. Sponge absorber bottoms level controller opens, and the liquid level drops to zero percent.
Main column overhead receiver pressure begins to rise and reaches 10 psig at 6:56 a.m.
6:53 a.m. Board operator reduces the reactor stripping steam rate.
188
~7:30 a.m. Head operator leaves the control room to assist with outside troubleshooting, permitting, and
other tasks.
7:37 a.m. Board operator closes the sponge absorber bottoms level control valve to resolve main column
pressure control issue. Within the next two minutes, main column overhead receiver comes
back down to below 5 psig, and sponge absorber pressure controller opens to vent to the
process gas system.
Sometime Boiler operator observes high excess oxygen readings on all four boilers. The excess oxygen,
between set to be controlled at three percent, fluctuates up to six percent. He notifies the instrument
5:00 a.m. - technician, but the problem subsides. The boiler operator informs the utilities area
8:30 a.m. superintendent afterward.
8:10 a.m. Field operators begin to steam contents of heavy cycle oil piping into the main column.
8:21 a.m. Main column overhead receiver pressure spikes, high pressure alarm is active for 17 seconds.
People in the area hear a “bang” sound.
8:40 a.m. Field operators begin to steam contents of light cycle oil piping into the main column.
8:52 a.m. Main column overhead receiver pressure spikes, high pressure alarm is active for three
seconds. People in the area hear a “bang” sound. Witnesses hear a rumbling from the FCC
relief piping and see a fireball come out the refinery flare. Several operators and managers
perform a walk-through of the plant to investigate the sound. They hear on the radio that the
sulfur recovery unit has tripped. They resume work at the FCC unit.
9:01 a.m. Sponge absorber pressure drops to less than 175 psig, and the pressure control valve closes.
9:08 a.m. Operators turn off the main air blower.
9:09 a.m. Regenerator pressure drops below the reactor pressure (regenerator-reactor differential
pressure reads zero psi).
9:14 a.m. Board operator increases the auxiliary air blower rate to manage regenerator pressure.
9:19 a.m. Regenerator-reactor pressure difference measurement returns to positive indication.
9:37 a.m. Regenerator-reactor pressure difference measurement indicates zero for approximately seven
minutes, then returns to positive indication. The regenerator pressure remains steady during
this time.
9:41 a.m. Operators continue to vent the debutanizer to the flare system.
~10:00 a.m. Primary and sponge absorber vessels explode. Debris strikes asphalt storage Tank 101 and
punctures a hole in the tank wall.
~11:00 a.m. Firefighters extinguish fires near the FCC explosion area. Emergency responders transport the
injured to hospitals.
~12:00 p.m. Asphalt spill ignites.
1:02 p.m. Douglas Country Emergency Management System issues a community evacuation notice [52].
189
1:35 p.m. Douglas Country Emergency Management System updates the evacuation zone to 2 miles
north, 3 miles to the east and west, and 10 miles south of the refinery [53, 52].
~6:45 p.m. Firefighters extinguish the bulk of the large asphalt fire [48].
8:00 p.m. City of Duluth issues a shelter-in-place advisory [48].
4/27/2018 Douglas County Emergency Management System lifts evacuation orders [54].
6:00 a.m.
190
Appendix C—Demographic Information for Surrounding Area

Figure 51 shows the census blocks within approximately three miles of Husky Superior Refinery. Table 4
summarizes the demographic information of the population residing within the labeled blocks. Table 5 contains
further demographic information for each census block.
Figure 51. Census blocks in an approximately three-mile distance from Husky

Superior Refinery (Source: Census Reporter [23] with annotations by CSB)
191
Table 4. Summarized demographic data for the populations within the census blocks shown in
Figure 51 (Source: CensusReporter [23])
Number
Race and Per Capita % of
Ethnicity Income Poverty Housing
Units
White 90% Single Unit 66%
Black 1% Multi-Unit 31%
Native 1% Mobile Home 3%
Asian 1% Boat, RV, Van, etc. 0%
$ 27,738 12%
18,625 Islander 0% 8,538
Other 0%
Two+ 4%
Hispanic 2%
Table 5. Tabulation of demographic data for the populations within the census blocks shown
in Figure 51 (Source: CensusReporter [23])
Block Median Race and Per Capita % Number of

Number Age Ethnicity Income Poverty Housing Units
93% White 71% Single Unit

1% Black 19% Multi-Unit
1% Native 10% Mobile Home
0% Asian 0% Boat, RV, Van, etc.
1 3,340 45.1 $ 32,424 7.0% 1,563
0% Islander
0% Other
2% Two+
4% Hispanic
98.0% White 69% Single Unit
0.0% Black 28% Multi-Unit
0.0% Native 3% Mobile Home
0.0% Asian 0% Boat, RV, Van, etc.
2 2,077 42.2 $ 31,080 10.5% 1,147
0.0% Islander
0.0% Other
2.0% Two+
0.0% Hispanic
3 3,441 37.5 $ 29,503 8.7% 1,425
192
Block Median Race and Per Capita % Number of

Number Age Ethnicity Income Poverty Housing Units
0% Islander
0% Other
3% Two+
2% Hispanic
4 3,240 29.8 $ 25,611 9.4% 1,120
0% Islander
0% Other
2% Two+
4% Hispanic
5 3,884 33.6 $ 25,626 13.7% 1,887
0% Islander
0% Other
6% Two+
1% Hispanic
6 2,643 30.1 $ 22,600 25.8% 1,396
0% Islander
0% Other
7% Two+
3% Hispanic
193
Appendix D—Metallurgical Analysis
Appendix D can be downloaded from the CSB’s investigation website:
https://www.csb.gov/husky-energy-superior-refinery-explosion-and-fire
194
Members of the U.S. Chemical Safety and Hazard Investigation Board:
Steve Owens
Interim Executive Authority
Sylvia Johnson, PhD

Member
195

Husky Superior Refinery Report 2022-12-23

Uploaded by

Copyright:

Available Formats

Husky Superior Refinery Report 2022-12-23

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Husky Superior Refinery Report 2022-12-23

Uploaded by

Copyright:

Available Formats

FCC Unit Explosion and Asphalt Fire

U.S. Chemical Safety and at Husky Superior Refinery

Investigation Report SAFETY ISSUES:

U.S. Chemical Safety and Hazard Investigation Board

U.S. Chemical Safety and Hazard Investigation Board

3 TECHNICAL ANALYSIS .................................................................................................................. 56

Figure 2. Aerial image of Superior, Wisconsin. ................................................................................................... 24

Figure 4. Left: FCC catalyst. Right: A bubbling fluidized bed. ........................................................................... 26

Figure 9. Simplified block flow diagram of the GasCon. .................................................................................... 33

Figure 16. Surveillance camera image of the explosion....................................................................................... 45

Figure 17. Locations of equipment involved in the incident. ............................................................................... 47

Figure 18. Asphalt tank puncture and leak. .......................................................................................................... 48

Figure 19. Asphalt spill shortly before it ignited.................................................................................................. 49

Figure 20. Tank fire during and after extinguishment. ......................................................................................... 51

Figure 22. Evacuation Zone on April 26, 2018. ................................................................................................... 53

Figure 33. Spent catalyst slide valve in-situ. ........................................................................................................ 85

Figure 36. Sketch of a standpipe with a closed slide valve. ................................................................................. 92

Figure 38. Hierarchy of controls. ......................................................................................................................... 99

Figure 39. Generic risk matrix. .......................................................................................................................... 119

Figure 40. Excerpt from the 1995 PHA. ............................................................................................................ 121

Figure 41. Effects of practice on skills. .............................................................................................................. 131

Figure 43. Hierarchy of standards terminology.................................................................................................. 141

Figure 48. An example ductile-to-brittle fracture transition curve..................................................................... 150

Figure 49. ASME impact test exemption curves. ............................................................................................... 151

Figure 50. Example of a siting and layout approach. ......................................................................................... 157

AFPM American Fuel and Petrochemical Manufacturers

ANSI American National Standards Institute

API American Petroleum Institute

ASME American Society of Mechanical Engineers

ASTM American Society of Testing and Materials

CCPS Center for Chemical Process Safety

COIMS Cenovus Operations Integrity Management System

COPS Control Override Protection System

CSB U.S. Chemical Safety and Hazard Investigation Board

DCS distributed control system

DTS Downstream Technical Service

EPA Environmental Protection Agency

ESP electrostatic precipitator

FAA Federal Aviation Administration

FCC fluid catalytic cracking

FCCU fluid catalytic cracking unit

FEMA Federal Emergency Management Agency

GasCon gas concentration unit

HAZOP Hazard and Operability Study

HMSC Husky Marketing and Supply Company

HOIMS Husky Operation and Integrity Management System

IPL independent protection layer

ISA International Society of Automation

LLC limited liability company

LOPA Layer of Protection Analysis

LPG liquefied petroleum gas

MOC management of change

NEP National Emphasis Program

NFPA National Fire Protection Association

NIMS National Incident Management System

NIOSH National Institute for Occupational Safety and Health

O&SHA Operating and Support Hazard Analysis

OSHA Occupational Safety and Health Administration