1

OIL REFINERY FIRE AND EXPLOSION

GIANT INDUSTRIES’ CINIZA OIL REFINERY

Jamestown, NM

April 8, 2004

NO. 2004-08-I-NMOctober 2005

Case StudyU.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INSIDE . . .

IntroductionIntroductionIntroductionIntroductionIntroduction

This case study describes the sudden release of flammable liquidand subsequent fire and explosion that occurred on April 8,2004 at the Giant Industries’ Ciniza oil refinery, Jamestown,

NM. The incident injured six employees and caused evacuation ofnon-essential employees as well as customers of a nearby travel centerand truck stop. Refinery equipment and support structures weredamaged. Production at the unit was not resumed until the fourthquarter of 2004, and damage to the unit was in excess of $13 million.Because of the serious nature of the incident—injuries to employeesand extensive damages to facilities—the U.S. Chemical Safety andHazard Investigation Board (CSB) produced this Case Study to sharelessons learned so that similar occurrences might be prevented.

1.0GiantOperations

The parent company,Giant Industries

Arizona, Inc., which isheadquartered inScottsdale, AZ, owns andoperates the Ciniza re-finery in Jamestown,NM. Subsidiaries of Gi-ant Industries Inc. ownand operate refineries inBloomfield, NM andYorktown, VA.

2.0RefineryOperations

The Giant Ciniza re-finery is located 17

miles east of Gallup, NM,and processes up to22,000 barrels of crudeoil per day. The refinerywas purchased by GiantIndustries in 1982.

Process Description ...... 2

Pre-Incident Events ...... 2

Incident Description ..... 3

Analysis of Incident ...... 6

Lessons Learned ......... 11

References ................. 12

2

CSB Case Studies summarizeincident investigation data andpresent conclusions based onCSB analyses. They do notdiscuss root and contributingcauses or make safetyrecommendations—unlike themore comprehensive CSBInvestigation Reports.

U.S. Chemical Safety andHazard InvestigationBoard

Office of Investigations andSafety Programs

2175 K Street NWSuite 400Washington, DC 20037-1848

202-261-7600www.csb.gov

3.0ProcessDescription

This incident occurred at therefinery’s hydrofluoric acid

(HF) alkylation unit. HF, a highlyhazardous, toxic, and corrosivechemical, is used as a catalyst in thealkylation process. Fortunately, nosignificant amount of HF was re-leased in this incident.

In HF alkylation, olefin andisobutane feedstocks are combined,then mixed with HF in a reactorvessel, where the alkylate1 forms.(American Petroleum Institute1999)

4.0Pre-IncidentEvents

The day before the incident,alkylation unit operators at-

tempted a regularly scheduledswitch of the alkylate recirculationpumps in the Iso-Stripper unit. Theprimary electric pump would betaken out of service and the sparesteam-driven pump started up. Theswitch was scheduled because of re-

curring problems with the sparepump’s mechanical seal

2 leaking.

This was done to free the sparepump’s mechanical seal of any ma-terial that might cause it to functionimproperly. While attempting toput the spare pump in service, op-erators found it would not rotate.

1 Alkylate is a highly flammable gasolineblending component used to boost the octaneof gasoline. It forms explosive vapor/air mix-tures at above-ambient temperatures.

Fortunately, nosignificant

amount of HFwas released in

this incident.

Interviews withseveral operators

revealed thatsome operatorsused the valve

wrench’s position. . . to determinewhether the valve

was open orclosed, while

others referred tothe positionindicator . . .

2 Mechanical seals are used to keep the con-tents of rotating equipment such as pumpsand compressors from escaping. They dothis by sealing the shaft that protrudes fromthe casing.

3

5.0IncidentDescription

The next morning, the mainte-nance supervisor assigned a

mechanic specialist and a mechanicto repair the seal on the sparepump. An operator prepared awork permit that outlined the workto be done and the safeguards re-quired for a safe repair.3 The valveused to isolate the pump for mainte-nance was a ¼ turn plug valve. Aplug valve is used primarily for on/off, and some throttling services. Itcontrols flow by means of a cylin-drical or tapered plug with a hole inthe center that lines up with theflow path of the valve to permitflow. The valve is opened or closedwith the use of a valve wrench. Aquarter turn of the valve blocks theflow path.

In preparing the pump for mainte-nance, the operator relied on thevalve wrench to determine that thesuction valve was open. He movedthe wrench to what he believed was

3 The work permit is issued by the operatorand contains information on hazards in-volved in the maintenance operation, the ap-propriate personal protective equipment tobe worn, and lock-out-tag-out (LOTO) infor-mation. Lockout/tagout refers to a program tocontrol hazardous energy during the servicingand maintenance of machinery and equip-ment. Lockout refers to the placement of alocking mechanism on an energy-isolatingdevice, such as a valve, so that the equipmentcannot be operated until the mechanism isremoved. Tagout refers to the secure place-ment of a tag on an energy-isolating device toindicate that the equipment cannot be oper-ated until the tag is removed.

the closed position with the wrenchperpendicular to the flow of prod-uct. Interviews with several opera-tors revealed that some operatorsused the valve wrench’s positionrelative to the flow to determinewhether the valve was open orclosed, while others referred to theposition indicator on the valve stem.The valve was actually open.

The pump needed to be disas-sembled and the rear pump housingassembly and impeller moved to theshop for repair. Before leaving thearea to obtain materials needed toremove the pump, the mechanic no-ticed that the valve position indica-tor on the suction valve body showedthat the valve was open (See Figure1). He did not relate this informa-tion to his co-workers.

Figure 1.Suction Valve and Position Indicator as Found After Incident

Position Indicator

Valve Wrench

Valve Wrench Collar

4

The plant operator placed tags andlocks on the suction and dischargevalves to prevent inadvertent open-ing and to indicate that the valveshad been closed. The mechanicspecialist then placed tags and lockson the suction and discharge valves.When the mechanic returned, themechanic specialist told him thatthe valves had been closed, secured,tagged, and locked per the facility’sLOTO

procedure and that they

could remove the pump.

Neither mechanic observed the op-erator closing the valve. Both me-chanics believed the task had beencompleted because the wrench usedto open and close the valve was posi-tioned perpendicular to the flow,and the operator had affixed histags. (See Figure 1)

The operator then disconnected thepump’s vent hose to verify that nopressure was in the pump case.The low point drain plug was notused because it was not equippedwith a valve to isolate it from theline used for depressuring thepump. (See Figure 2) Giant lockout/tagout procedures outlining opera-tor responsibilities state:

On mechanical, pneumatic,steam and hydraulic equip-ment such as steam turbines,air pumps etc. this will in-clude locking out of the en-ergy isolating devices (i.e.valves) and verifying totalrelease of any stored orresidual energy by openingbleeders and verifying com-plete depressurization.

Pump Case Flange

Rear Pump Assembly

Figure 3.

Damage to Area of Pump

Figure 2

Depressurizing Hose

Vent Hose

Low Point Bleeder

5

After uncoupling the hose at theconnection to the flare line, astream of alkylate flowed from thepump housing through the hose andsubsided after a few seconds. Theoperator and the maintenance me-chanics believed the pump had beende-pressured and was ready for re-moval. Actually, the vent line wasplugged, and the pump was not de-pressured.

The pump shaft coupling and theflange connecting the pump to thepump case were unbolted. (SeeFigure 3) As the pump case flangewas separated, alkylate was suddenlyreleased at about 150 pounds persquare inch gauge (psig) and 350 de-grees Fahrenheit. The release pro-duced a loud roaring sound that couldbe heard throughout the refinery.

The mechanic was blown over anadjacent pump and suffered brokenribs. Material was blown into themechanic specialist’s eyes so hemade his way to an eyewash station,cleared his eyes, and then quicklyexited the unit. Alkylate, which cov-ered the plant operator’s clothing,quickly ignited, seriously burningthe operator in the ensuing fire.About 30 to 45 seconds after theinitial release, the first of severalexplosions occurred.

The refinery’s safety officer wasabout 150 yards away when the re-lease occurred. In an attempt toturn on a fire monitor to suppressescaping vapors, the officer ad-vanced towards the release. He wascaught in the fire and injured. Twoother workers suffered slight inju-ries escaping the area.

6.0Analysis ofIncident

6.1Mechanical Integrity

A review of repair work prior to theincident revealed a history of re-peated pump failures. The pri-mary, electric, and steam-drivenspare isostripper recirculationpumps had 23 work orders submit-ted for repair of seal-related prob-lems or pump seizures in the one-year period prior to the incident(See Table 1).

Giant’s mechanical integrity pro-gram did not effectively preventthese repeated failures of the pumpseals. After the incident occurred,plugging material was found in thepump discharge line, the depressur-izing line, pump housing, and theimpeller. (See Figure 4). Giant’s ap-proach to these frequent pump sealproblems was an example of break-down maintenance. In other words,pump failures were addressed whenthe equipment finally broke down,instead of identifying causes ofbreakdowns and preventing thembefore they occurred again.

The Center for Chemical ProcessSafety (CCPS) recommends thatmaintenance programs troubleshootand search for possible hidden ormultiple reasons for frequently oc-curring problems. (CCPS, Guide-lines for Safe Process Operationsand Maintenance 1995). An effec-tive mechanical integrity program

The primary,electric, and

steam-drivenspare isostripper

recirculationpumps had 23

work orderssubmitted for

repair ofseal-related

problems or pumpseizures. . .

6

would have investigated and re-solved the problems that were re-peatedly causing the recirculationpump seals to fail.

6.2Corrosion and ScaleFormation

At Giant, the isostripper pumps fre-quently had plugging problems.

A number of factors contribute tothe formation of corrosion, scale,and deposits, which in turn can leadto the fouling or scoring of pumpseals. The failure of the seals is nottypically caused by corrosion of theseal faces, but by the scoring/ero-sion (galling) of the seal faces from asolid fouling material. Carbon sealfaces such as those used for thepump involved in this incident, areprone to contaminant scoring.

Some corrosion and scale productsoccur because of operating tem-peratures and pressures at whichan HF alkylation unit is run. ManyHF alkylation units operate at 125psig or lower. The isostripper col-umn at the Giant refinery is nor-mally operated at about 150 psig.Operation at higher pressures re-quires much higher temperatures,which can result in accelerated cor-rosion of equipment.

Plugging and fouling material canalso occur as soft iron fluoride scaledevelops and forms in the toweroverhead and domes when prepar-ing to shut down the unit for

DATE PUMP PROBLEM

1. April 17, 2003 P-5A (Elec.) Seal leak

2. May 9, 2003 P-5B (Stm.) Pump spraying from seal

3. May 23, 2003 P-5A (Elec.) Repair seal

4. June 9, 2003 P-5B (Stm.) Repair seal

5. June 9, 2003 P-5A (Elec.) Repair seal

6. June 18, 2003 P-5A (Elec.) Repair seal

7. June 20, 2003 P-5A (Elec.) Replaced seal

8. July 31, 2003 P-5A (Elec.) Replaced seal

9. August 22, 2003 P-5B (Stm.) Seal leak

10. August 25, 2003 P-5B (Stm.) Replaced seal

11. September 26, 2003 P-5B (Stm.) Replaced seal

12. September 26, 2003 P-5A (Elec.) Replaced seal

13. October 14, 2003 P-5A (Elec.) Seal leak

14. December 6, 2003 P-5A (Elec.) Replaced seal

15. December 9, 2003 P-5B (Stm.) Seal leak

16. December 9, 2003 P-5A (Elec.) Seal leak

17. December 15, 2003 P-5B (Stm.) Replaced seal

18. December 15 2003 P-5A (Elec.) Seal leak

19. January 28, 2004 P-5A (Elec.) Seal leak

20 March 22, 2004 P-5A (Elec.) Seal leak

21. April 1, 2004 P-5A (Elec.) Pump seal leaking

22. April 3, 2004 P-5A (Elec.) Pump seal leaking

23. April 7, 2004 P-5A (Elec.) Repair pump seal

Figure 3

Table 1Seal-Related Repair Work for Isostripper Recycle Pumps

7

cleanup activities. Some of this soft,water-laden scale comes off whenthe unit is running. The rest cre-ates a site for extremely fast andextensive corrosion, resulting in alarge amount of scale being addedinto the process. Scale may accu-mulate and settle at low points andorifices in equipment such as sparepumps.

Giant management did not investi-gate why excessive iron fluoridegeneration in the process causedthe mechanical seals on the alkylaterecirculation pumps to fail repeat-edly.

6.3Valve Design

Examination of the 6-inch, ¼ turn,plug valve after the incident deter-mined that it was originally de-signed to be opened and closed by agear-operated actuator. The gear-driver had been removed and wasreplaced by a valve wrench. Thewrench was a two-foot-long bar in-serted into a collar. Because it hada square shape, the collar could beeasily removed and repositioned onthe valve stem in different direc-tions. (See Figure 5)

Giant did not consider the design orengineering safety implications ofchanging from a gear-operatedvalve actuator to using a wrench asa valve handle.

Interviews with operators revealedthey would sometimes determine

Figure 4

Plugging Material Found in Discharge Valve

Figure 5Spare Pump Valve Wrench Collar

8

whether the valve was open orclosed by the valve wrench position.If the wrench was perpendicular toflow through the valve, it was con-sidered closed. If the wrench wasaligned parallel to the flow, thevalve was thought to be open.

In some instances, set screws wouldbe loosened, and the wrench wouldbe removed and placed on the pumpbase to provide better clearance forpersonnel walking nearby. Whenthe valve was to be opened orclosed, the wrench would be re-placed on the valve stem. In theCiniza oil refinery incident, thevalve wrench collar was installed inthe wrong position.

Figure 6 is a drawing of the plugvalve in the open position with thewrench in the perpendicular orperceived “closed” position.

Both the plant operator who at-tached the locks and the mechanicswho removed the pump mistakenlybelieved the suction valve had beenclosed, in part because the valvewrench was perpendicular to thenormal pipe flow. After he re-turned from obtaining materialsneeded for pump removal, the me-chanic who earlier observed the po-sition indicator in the open positionbegan working on the opposite sideof the pump, so he did not realizethe valve position indicator still in-dicated the valve was open. Fromhis vantage point, he observed thevalve wrench in a perpendicularorientation and believed the valvewas closed.

Both the plant operatorwho attached the locksand the mechanics who

removed the pumpmistakenly believed thesuction valve had been

closed

Figure 6

Plug Valve in the Open Position

9

Technically, the wrench was not in-tended to indicate valve position be-cause the valve was equipped withthe position indicator, which was lo-cated on the valve stem. (See Figure7) In practice, however, some plantemployees used the wrench to de-termine valve position, partly be-cause the wrench was much morevisible than the actual valve positionindicator.

6.4Human FactorsConsideration

Donald A. Norman (The Design ofEveryday Things) states that designof a system’s controls, as seen bythe operator, must accurately re-flect the actual state of the system,and that movement of the controlsmust operate the system in themanner the operator would natu-rally expect from the visual cues.He says that:

Natural mappings are the ba-sis of what has been called“response compatibility”within the field of human fac-tors and ergonomics. The ma-jor requirement of responsecompatibility is that the spatialrelationship between the posi-tioning of controls and the sys-tem or objects upon whichthey operate should be as di-rect as possible, with the con-trols either on the objectsthemselves or arranged tohave an analogical relationship

to them. In similar fashion,the movement of the controlsshould be similar or analogousto the expected operation ofthe system. Difficulties arisewherever the positioning andmovements of the controls de-viate from strict proximity,mimicry or analogy to thethings being controlled.

Figure 7

Suction Valve & Position Indicator

. . . [T]he wrench was muchmore visible than the actual

valve position indicator

Position Indicator

10

6.5Management ofChange

OSHA’s Process Safety Manage-ment standard (1910.119) statesthat any change that may affect aprocess covered by that standardshould trigger a management ofchange (MOC) analysis. The onlyexception to this is when the changeis a “replacement in kind.”

4

In some instances, the smallest ofchanges can lead to a significantlyunexpected outcome. In Still Go-ing Wrong, safety expert, TrevorKletz cites an example in which thecentral bolt on a three-way valvewas marked by operators to indi-cate the position of the valve. Thiswas reportedly done because theoriginal markings on the valve itselfwere hard to see. The marks cor-responded to the valve position.

Two washers were placed under thebolt in subsequent maintenance,and the valve could no longer bescrewed all the way in to close it.The marks on the central bolt nolonger corresponded with the ac-tual valve position. However, op-erators set the valve according tomarks on the bolt, resulting in amisdirection of flow and a subse-quent explosion.

Giant’s use of the wrench instead ofthe original valve actuator was a

significant equipment change andshould have been included in thecompany’s MOC program.

6.6Lockout/Tagout andIsolation

While the Giant mechanics and op-erator locked and tagged the pumpinvolved in this incident, they mis-takenly believed the pump hadbeen isolated and depressured.They had not adequately verifiedthat the pump was isolated ordrained before locking and taggingit out. Effective LOTO proceduresinclude specific requirements fortesting machines to determine andverify the effectiveness of lockoutdevices, tagout devices, and otherenergy-control measures. (OSHA,2002)

Giant’s use ofthe wrenchinstead of theoriginal valveactuator was asignificantequipmentchange andshould havebeen included inthe company’sMOC program.

4“Replacement in Kind” means replacementthat satisfies the design specification

11

7.0Lessons Learned

7.1Valve Modification

Any valve position indication usedby employees to determine theopen/closed position of valves shouldcommunicate accurate informationto employees. Valve modificationshould receive MOC analysis to de-termine whether new hazards orrisks have been introduced.

Although the valve had a positionindicator, employee practice was tosometimes use the position of thevalve wrench to determine the open/closed status of the valve. The valvecollar and wrench were not perma-nently fixed to the stem and werepositioned incorrectly. When thevalve was changed from a wheel andgear-driven mechanism to a wrench,the collar could be attached in thewrong position. An MOC hazardanalysis was not conducted. If anMOC had been used, it could haverevealed the potential for the valvewrench to be oriented in the wrongdirection.

7.2Lockout/Tagout

Lockout/tagout programs should re-quire effective verification thatequipment has been isolated, de-pressurized and drained.

Although Giant employees believedthe pump was isolated before it was

locked out, the facility lacked proce-dures to verify that the pump hadbeen isolated, depressurized anddrained. Equipment being preparedfor maintenance should be drainedof all liquid at a low point drain.

7.3Mechanical Integrity

Mechanical integrity programsshould prevent breakdown mainte-nance. Identifying operating condi-tions that could be contributing toequipment failure is a critical com-ponent of mechanical integrity.

Instead of determining the cause offrequent pump malfunctions andthen implementing a program thatwould prevent problems before theyoccurred, Giant used breakdownmaintenance by making repeatedrepairs to the pump seals after fail-ure.

The valve collarand wrench werenot permanently

fixed to the stemand were

positionedincorrectly.

Instead ofdetermining the

cause of frequentpump malfunctions

and thenimplementing a

program that wouldprevent problems

before theyoccurred, Giant

used breakdownmaintenance . . .

12

CSB is an independent Federal agency whose mission is to ensure the safety of workers,the public, and the environment by investigating and preventing chemical incidents. CSBis a scientific investigative organization; it is not an enforcement or regulatory body.Established by the Clean Air Act Amendments of 1990, CSB is responsible fordetermining the root and contributing causes of accidents, issuing safety recommen-dations, studying chemical safety issues, and evaluating the effectiveness of othergovernment agencies involved in chemical safety.

No part of the conclusions, findings, or recommendations of CSB relating to any chemicalincident may be admitted as evidence or used in any action or suit for damages arising outof any matter mentioned in an investigation report (see 42 U.S.C. § 7412(r)(6)(G)). CSBmakes public its actions and decisions through investigation reports, summary reports,safety bulletins, safety recommendations, case studies, incident digests, special technicalpublications, and statistical reviews. More information about CSB may be found atwww.csb.gov.

8.0References

American Petroleum Institute1999. The Use of HydrofluoricAcid in the Petroleum RefiningAlkylation Process, RefiningDepartment Background Paper,April 1999

Center for Chemical ProcessSafety, Guidelines for SafeProcess Operations andMaintenance, 1995

Giant, Standard Safety Regulations.

Kletz, Trevor, Still Going Wrong,2003

Norman, Donald A., The Design ofEveryday Things, 1990

Occupational Safety and HealthAdministration (OSHA), ProcessManagement Standard.

OSHA, Control of HazardousEnergy Lockout/Tagout,OSHA3120, 2002

U.S. Chemical Safety andHazard InvestigationBoard

2175 K Street NW,Suite 400

Washington, DC 20037-1848(202) 261-7600