Fatal Naphtha Release and Fire -- Drum Overflow
BP-Husky Toledo Refinery Fatal Fire
Ohio Refining Company (BP-Husky Toledo Refinery)
📍 Oregon, OH
Incident: September 20, 2022  •  CSB Report: June 24, 2024
2
Fatalities
7
CSB Recommendations
📋 Incident Summary

At approximately 6:46 PM on September 20, 2022, an accidental release of flammable naphtha ignited at the BP-Husky Toledo Refinery in Oregon, Ohio, fatally injuring two workers and causing substantial property damage. The release originated from a Fuel Gas Mix Drum overflow -- a process vessel overfilled with liquid naphtha from the upstream crude unit. As the drum overflowed, liquid naphtha carried over into process piping not designed for liquid service, ultimately releasing to atmosphere and igniting.

The night of the incident was characterized by an extreme alarm flood -- hundreds of alarms activating in a short timeframe, making it impossible to identify and respond to the developing overflow. The refinery's alarm system was not configured to prioritize or filter alarms during upset conditions. Workers lacked a clearly established stop work authority, and the Abnormal Situation Management policy did not define when continued troubleshooting should yield to an emergency shutdown.

The CSB's final report, released June 24, 2024, issued seven recommendations. Three directed to Ohio Refining Company have been closed as completed -- covering abnormal situation management, stop work authority, and alarm philosophy. Four remain open, targeting PHA safeguard deficiencies and industry-level guidance from API and ISA on drum overflow and alarm flood management.

🔎 Key Findings
Finding 1
Fuel Gas Mix Drum Overflow
The Fuel Gas Mix Drum was overfilled with liquid naphtha. When it overflowed, liquid naphtha carried over into downstream piping not rated for liquid service, creating the release that ignited.
Finding 2
Alarm Flood Overwhelmed Operators
Operators experienced an extreme alarm flood during the incident -- hundreds of alarms activating rapidly. The alarm system was not configured to support decision-making during this condition.
Finding 3
PHA Safeguards Relied on Human Intervention
The PHA had identified high level and overflow scenarios for the Fuel Gas Mix Drum, but safeguards relied primarily on human intervention rather than engineered controls.
Finding 4
No Stop Work Authority Policy
No clearly established policy gave workers authority to stop work when they believed conditions were unsafe. Workers lacked a framework for deciding when to stop troubleshooting and escalate.
Finding 5
Abnormal Situation Management Gaps
The Abnormal Situation Management policy did not define what constituted an unmanageable situation or when operators should stop troubleshooting and initiate shutdown.
Finding 6
Two Workers Killed
The fire fatally injured two workers and caused extensive property damage. Alarm management, stop work authority, and abnormal situation management are life-safety systems -- not administrative niceties.
🔍 Root Causes
1
PHA Safeguards Not Engineered
The PHA identified the overflow scenario but relied on human intervention as the primary safeguard. Effective safeguards for high-consequence scenarios require engineered controls that do not depend on operator action during a developing upset.
2
Alarm System Not Fit for Purpose During Upsets
The alarm system was not configured to support operator decision-making during upsets. An alarm flood that presents hundreds of simultaneous alarms provides no actionable information when it is needed most.
3
Absent Stop Work Authority
Without a clear stop work authority policy, workers had no framework for deciding when a situation was too dangerous to continue troubleshooting under high-stress conditions.
4
Abnormal Situation Management Not Defined
The Abnormal Situation Management policy did not define the threshold at which shutdown was required rather than continued troubleshooting -- creating ambiguity at the most critical moment.
☑ CSB Recommendations
→ Ohio Refining Company
Revise PHA safeguards for high level and overflow scenarios. Establish effective preventive safeguards using engineered controls that do not rely solely on human intervention to prevent liquid overfill.
→ Ohio Refining Company
Revise the Abnormal Situation Management policy per CCPS and ASM Consortium guidance, including a broader definition of abnormal situations and criteria for when to stop troubleshooting and initiate shutdown. [STATUS: CLOSED]
→ Ohio Refining Company
Develop and implement a stop work authority policy giving employees authority to stop unsafe work, with detailed procedures and training on exercising this authority during abnormal situations. [STATUS: CLOSED]
→ Ohio Refining Company
Revise the Toledo Alarm Philosophy per EEMUA guidance to reduce alarm flood duration and peak rates. Include analysis of individual alarm flood events rather than monthly averages only. [STATUS: CLOSED]
→ American Petroleum Institute (API)
Develop a publication or revise API RP 556 to address process hazards from Fuel Gas Mix Drum overflow, including design/sizing criteria, high level instrumentation guidance, and safeguard selection recommendations.
→ American Petroleum Institute (API)
Develop a publication addressing prevention of pressure vessel overflow for new and existing vessels, incorporating PHA guidance, safeguard recommendations, and lessons from this and the BP Texas City CSB investigation.
→ International Society of Automation (ISA)
Revise ANSI/ISA 18.2 to include performance targets for short-term alarm flood analysis, including alarm flood count, duration, alarm count per flood, and peak alarm rate targets.
💡 Lessons Learned
⚠ An alarm flood -- where hundreds of alarms activate simultaneously -- provides no useful information. Alarm management systems must remain actionable during upsets, not only during normal operations.
⚠ Stop work authority is only effective when workers understand when to use it and are confident they will not be penalized. A stop work authority policy that exists on paper but is not trained and reinforced is not a functional safeguard.
⚠ PHA safeguards for high-consequence overflow scenarios should be engineered controls -- level switches, interlocks, automatic isolation -- not solely operator response during an alarm flood.
⚠ Abnormal Situation Management must define the line between 'continue troubleshooting' and 'shut down.' If that line is not defined in writing before the upset, operators make that call alone, under pressure, with incomplete information.
⚠ Drum and vessel overflow scenarios have caused multiple fatal incidents. Liquid carry-over into equipment not designed for liquid service is a predictable, preventable escalation path that every facility's PHA must address.
PSM Elements: PHA · SOP · MI · EP · EAP
🔨 Safety Meeting Toolbox Talk
Topic: Alarm Management, Stop Work Authority, and Vessel Overflow
💬What is your facility's stop work authority policy? Do you know the specific conditions under which you are authorized -- and expected -- to stop work without supervisor approval?
💬How many alarms did the control board in your unit generate during the most recent upset? Would your operators be able to identify critical alarms amid an alarm flood?
💬Have PHAs for vessels in your unit addressed high liquid level and overflow scenarios? Are the safeguards engineered controls or primarily operator response?
💬Does your Abnormal Situation Management policy define specifically when a situation is too difficult to manage and should proceed to shutdown? Is that threshold written down and understood by all operators?
💬What would happen if a key process drum or vessel in your unit overflowed into downstream equipment? Has that scenario been evaluated with effective safeguards in place?
💬When did your alarm management system last receive a performance review? Do you know your unit's normal alarm rate and what constitutes an alarm flood condition?
✎ Team Action Items
✓Review PHA records for vessels in your unit -- confirm that high liquid level and overflow scenarios are covered and that safeguards are engineered controls, not solely human response
✓Pull the alarm performance report for your control board -- identify peak alarm rates during the most recent upset and compare to EEMUA guidance for manageable alarm performance
✓Review your facility's stop work authority policy with your team -- confirm everyone understands the conditions for using it and that there is no penalty for exercising it
✓Review your Abnormal Situation Management procedure -- confirm it includes a specific threshold that triggers shutdown rather than continued troubleshooting
🔗 PSM Failures Behind This Incident

This incident traced to breakdowns across 5 PSM elements (PHA · SOP · MI · EP · EAP). Each represents a documented gap that process safety documentation and consulting can close before a similar event occurs at your facility.

Process Hazard Analysis (PHA)
A structured PHA or HAZOP study exists to identify exactly these scenarios before they occur. When PHA is absent, superficial, or overdue for revalidation, hazards operate unseen until they kill someone.
Supporting documents in our library →
Operating Procedures (SOPs)
Operators cannot reliably hold safe operating limits without clear, current, enforced procedures. Deviation from acceptable operating conditions — a root cause here — is a direct consequence of SOP failure.
Supporting documents in our library →
Mechanical Integrity (MI)
Equipment must be designed, inspected, and maintained to operate safely in its intended service. Mechanical integrity failures — degraded equipment, missed inspections, deferred repairs — contributed to loss of containment here.
Supporting documents in our library →
Employee Participation
OSHA PSM requires workers to be meaningfully involved in hazard analyses and procedure development — not just trained on the finished product. Active participation catches gaps that management alone misses.
Supporting documents in our library →
Emergency Planning & Response
When process safety barriers fail, emergency response capability determines whether the outcome is controlled or catastrophic. Gaps in emergency preparedness amplified the consequences here.
Supporting documents in our library →
Process Safety Management Consulting & Document Library
📂
PSM Document Library
32 ready-to-deploy PSM documents covering all 14 OSHA elements — procedures, checklists, and audit templates built for facilities operating under 29 CFR 1910.119.
Browse the Library →
📊
Free PSM Health Score
Find out where your PSM program stands across all 14 OSHA elements. Our free health score surfaces your biggest gaps in under 10 minutes — no account required.
Check Your Score →
📞
Consulting Services
PHA facilitation, PSM program builds, compliance audits, and OSHA inspection support. Transparent flat-fee pricing — no retainer required to get started.
View Pricing →
📋 Explore the full incident library: All 132 CSB Case Studies →