HEAT EXCHANGER TUBE RUPTURE — ATMOSPHERIC RELEASE — EXPLOSION
CITGO Petroleum Corporation Heat Exchanger Rupture
CITGO Petroleum Corporation
📍 Corpus Christi, TX
Incident: June 19, 2009  •  CSB Report: June 2012
0
Fatalities
Isobutane / Naphtha (FCCU Heat Exchanger Tube Rupture — Large Flammable Vapor Cloud)
Chemical Involved
7
CSB Recommendations
📋 Incident Summary

On June 19, 2009, a large explosion and fire occurred at the CITGO Petroleum refinery in Corpus Christi, Texas. Multiple workers suffered injuries, and the explosion caused extensive property damage. Fortunately, no fatalities resulted, but the incident produced a significant flammable vapor cloud that ignited, causing an explosion felt throughout the surrounding community.

The explosion originated when heat exchanger tubes in the Fluid Catalytic Cracking Unit (FCCU) ruptured, releasing a large quantity of isobutane and naphtha into the atmosphere. The flammable vapors formed a large vapor cloud that found an ignition source and exploded.

The CSB investigation identified deficiencies in CITGO's mechanical integrity program for heat exchanger tubes and a failure to adequately assess the hazard of tube failure in the FCCU exchangers as a potential large-scale flammable release scenario.

🔎 Key Findings
Finding 01
Heat Exchanger Tubes Ruptured — Large Flammable Vapor Cloud Released
Tubes in the FCCU heat exchanger ruptured, releasing a large quantity of isobutane and naphtha into the atmosphere. The flammable vapors formed a vapor cloud that ignited and exploded.
Finding 02
MI Program Did Not Adequately Address FCCU Heat Exchanger Tube Integrity
CITGO's mechanical integrity program had not adequately addressed the inspection, monitoring, and acceptance criteria for the FCCU heat exchanger tubes. Tube degradation progressed to failure without detection.
Finding 03
Tube Failure Scenario Not Fully Analyzed in PHA
The large-scale flammable release scenario resulting from FCCU heat exchanger tube rupture had not been fully analyzed in the facility's PHA with respect to consequences and safeguard adequacy.
Finding 04
Large-Scale Community Impact from Flammable Vapor Cloud Explosion
The explosion caused by the vapor cloud was felt throughout the Corpus Christi community. Large-scale flammable vapor cloud explosions from refinery process equipment have community-scale consequences.
Finding 05
Refinery Heat Exchangers Present Large Inventory Release Scenarios
FCCU heat exchangers can contain large inventories of flammable hydrocarbons. Tube failures represent a direct, large-scale release pathway that must be specifically addressed in PHA and MI programs for these units.
🔍 Root Causes
1
FCCU Heat Exchanger Tube Degradation Not Detected by MI Program
The heat exchanger tubes degraded over time due to a damage mechanism that was not adequately addressed by CITGO's inspection program. The tubes failed without prior detection of the advancing damage.
2
Inadequate Inspection Frequency and Technique for Tube Damage Mechanism
The inspection methods and frequency applied to the FCCU heat exchanger tubes were not sufficient to detect the applicable damage mechanism before failure. The MI program did not match the inspection approach to the specific tube degradation mechanism.
3
PHA Hazard Analysis Gap for Large-Scale Flammable Release from Tube Failure
The consequence and safeguard analysis for a large-scale tube rupture releasing a flammable vapor cloud had not been completed to the level needed to identify safeguard gaps for this high-consequence scenario.
☑ CSB Recommendations
→ CITGO / Refinery Operators
Update mechanical integrity programs for FCCU heat exchangers to include damage mechanism-specific inspection methods and frequencies; include large-scale tube failure as a PHA scenario for FCCU units with large flammable inventories.
→ API / Refining Industry
Provide specific guidance on inspection methods and frequencies for FCCU heat exchanger tubes; address large-scale flammable release scenarios from tube failures in FCCU-specific process safety guidance.
→ OSHA
Conduct targeted PSM enforcement inspections at refineries with FCCUs; evaluate adequacy of MI programs for heat exchangers in high-pressure, high-temperature flammable hydrocarbon service.
💡 Lessons Learned
Mechanical integrity programs must match inspection methods to the specific damage mechanisms that apply to each piece of equipment. Generic inspection schedules applied to all heat exchangers regardless of service conditions, damage mechanisms, or consequence of failure are not adequate MI programs. For FCCU heat exchangers with large flammable inventories, the inspection program must be specifically designed to detect the applicable tube damage mechanisms before they lead to failure.
Heat exchanger tube failures in high-pressure flammable hydrocarbon service represent a direct, large-quantity release pathway — a vapor cloud explosion potential that must be included in PHA consequence and safeguard analysis. The safeguards needed to prevent tube failure detection and to mitigate a large-scale tube rupture release are different from those for other release scenarios. PHAs must address this specific failure mode with appropriate consequence analysis.
No fatalities in an explosion that caused community-scale impact is a reminder that the absence of fatalities is not the same as acceptable process safety performance. The CITGO Corpus Christi explosion caused community disruption, environmental impact, property damage, and worker injuries. The potential for fatalities was significant. Near-misses of this scale must be treated with the same rigor as actual fatality events in the facility's incident investigation and corrective action program.
MI: Mechanical IntegrityPSI: Process Safety InformationMOC: Management of ChangePHA: Process Hazard Analysis
🔨 Safety Meeting Toolbox Talk
►Does your MI program for heat exchangers in FCCU or other high-pressure flammable hydrocarbon service include damage mechanism-specific inspection methods and acceptance criteria? When were these methods last reviewed against current API and industry guidance?
►Has your PHA specifically addressed large-scale tube failure as a release scenario for heat exchangers with large flammable inventories? What safeguards are analyzed, and are they adequate for the consequence scale?
►What is the consequence of a full tube bundle failure in your highest-inventory heat exchangers in flammable service? Has this scenario been quantified in a consequence analysis?
Immediate Action Items
✓Review MI programs for all heat exchangers in high-pressure, high-temperature flammable or toxic service; verify that inspection methods are matched to the applicable damage mechanisms for each exchanger.
✓Add heat exchanger tube bundle failure as a PHA node for all FCCU and equivalent high-inventory heat exchangers in flammable service; quantify consequence and evaluate safeguard adequacy.
✓Conduct a consequence analysis for worst-case tube rupture release for your highest-inventory heat exchangers; compare results against current safeguard coverage and update as needed.
✓Update MI inspection frequencies for FCCU heat exchangers based on current damage mechanism analysis and applicable API inspection standards.
🔗 PSM Failures Behind This Incident

This incident traced to breakdowns across 4 PSM elements (MI · PSI · MOC · PHA). Each represents a documented gap that process safety documentation and consulting can close before a similar event occurs at your facility.

Mechanical Integrity (MI)
Equipment must be designed, inspected, and maintained to operate safely in its intended service. Mechanical integrity failures — degraded equipment, missed inspections, deferred repairs — contributed to loss of containment here.
Supporting documents in our library →
Process Safety Information (PSI)
Accurate, complete Process Safety Information is the foundation every other PSM element depends on. When PSI is missing or wrong — chemistry data, equipment specs, P&IDs — the entire hazard analysis is built on a flawed base.
Supporting documents in our library →
Management of Change (MOC)
Changes to equipment, chemistry, operating limits, or procedures that bypass formal review create new hazard pathways your PHA never evaluated. MOC failures open the door to incidents like this one.
Supporting documents in our library →
Process Hazard Analysis (PHA)
A structured PHA or HAZOP study exists to identify exactly these scenarios before they occur. When PHA is absent, superficial, or overdue for revalidation, hazards operate unseen until they kill someone.
Supporting documents in our library →
Process Safety Management Consulting & Document Library
📂
PSM Document Library
32 ready-to-deploy PSM documents covering all 14 OSHA elements — procedures, checklists, and audit templates built for facilities operating under 29 CFR 1910.119.
Browse the Library →
📊
Free PSM Health Score
Find out where your PSM program stands across all 14 OSHA elements. Our free health score surfaces your biggest gaps in under 10 minutes — no account required.
Check Your Score →
📞
Consulting Services
PHA facilitation, PSM program builds, compliance audits, and OSHA inspection support. Transparent flat-fee pricing — no retainer required to get started.
View Pricing →
📋 Explore the full incident library: All 132 CSB Case Studies →