FCC UNIT ESP EXPLOSION — SAFETY CRITICAL EQUIPMENT FAILURE IN STANDBY MODE
ExxonMobil Torrance Refinery Explosion
ExxonMobil Corporation / Torrance Refining Company
📍 Torrance, CA
Incident: February 18, 2015  •  CSB Report: May 3, 2017
0
Fatalities
Hydrocarbons (FCC Unit Electrostatic Precipitator -- Air/HC Mixing)
Chemical Involved
10
CSB Recommendations
📋 Incident Summary

On February 18, 2015, an explosion in the electrostatic precipitator (ESP) of the fluid catalytic cracking (FCC) unit at the ExxonMobil Refinery in Torrance, California, caused minor injuries to two workers and dispersed debris into the surrounding community. The explosion also created a serious near miss involving the adjacent hydrofluoric acid (HF) alkylation unit -- debris landing in the HF unit area could have caused a catastrophic HF release.

The CSB found that hydrocarbons entered the ESP during Safe Park standby mode because the spent catalyst slide valve (SCSV) -- a safety-critical device -- failed to prevent air and hydrocarbons from mixing. The SCSV had been operating beyond its maintenance interval without a risk assessment, and its failure mode during Safe Park mode had never been evaluated in a PHA. ExxonMobil had no written operating procedure for Safe Park mode.

The May 2017 CSB final report issued 10 recommendations to ExxonMobil Corporation, Torrance Refining Company, and the American Fuel and Petrochemical Manufacturers (AFPM) -- focused on Variance review processes, operating procedures covering all operating modes, safety-critical device identification and testing, MOC for extended maintenance intervals, and FCC transient operations industry knowledge sharing.

🔎 Key Findings
Finding 01
Hydrocarbons Mixed with Air in ESP During Safe Park Mode
During FCC unit Safe Park standby, hydrocarbons entered the electrostatic precipitator because the spent catalyst slide valve failed to prevent air/hydrocarbon mixing -- creating a flammable mixture that ignited inside the ESP.
Finding 02
Safety Critical Slide Valve Operated Beyond Maintenance Interval
The spent catalyst slide valve had been operating beyond its specified maintenance interval because the turnaround was extended -- no risk assessment was performed to evaluate the safety consequence of operating the safety-critical device beyond its safe operating life.
Finding 03
No Written Operating Procedure for Safe Park Mode
ExxonMobil Torrance had no written operating procedure for the Safe Park mode of FCC unit operation -- a non-routine standby mode with unique hazards received no procedural guidance.
Finding 04
PHA Did Not Evaluate Safety Critical Equipment Failure in Safe Park Mode
The facility's PHAs had not evaluated the consequences of safety-critical device failure in Safe Park mode -- hazard analysis focused on normal operation rather than all modes including standby.
Finding 05
Serious Near Miss -- HF Alkylation Unit Almost Struck by Debris
ESP explosion debris landed in the adjacent HF alkylation unit area, creating a serious near miss potential for a catastrophic HF release that could have severely impacted the surrounding community.
🔍 Root Causes
1
Safety Critical Equipment Not Identified for All Operating Modes
ExxonMobil did not have a program to identify safety-critical equipment and their required functions in each mode of operation including Safe Park. A safety-critical device cannot be effectively maintained or tested if its safety function in non-routine modes is not documented.
2
Extended Turnaround Interval Not Evaluated for Safety Critical Devices
The decision to extend the FCC turnaround -- operating the SCSV beyond its maintenance interval -- was not evaluated in a MOC process that would have identified the heightened risk of safety-critical device failure during the extended service period.
3
PHA and Operating Procedures Did Not Address Transient Operating Modes
Both the PHA and operating procedure programs failed to address non-routine, transient modes like Safe Park -- a systemic gap in coverage that allowed the air ingress hazard to remain unanalyzed and unproceduralized.
☑ CSB Recommendations
→ ExxonMobil Corporation
Revise corporate and refinery standards to require multidisciplinary team review of any Variance from safety policy or procedure before management approval, including technical process, operations, and health and safety representatives.
→ ExxonMobil Corporation
Develop a program ensuring written operating procedures cover all modes of FCC unit operation -- including startup, shutdown, Safe Park, and other non-routine modes -- at all U.S. ExxonMobil refineries.
→ ExxonMobil Corporation
Develop and implement a policy requiring all U.S. refineries to identify safety-critical equipment and failure consequences for every mode of operation; specify testing strategies and availability targets for each device across all modes.
→ ExxonMobil Corporation
Require a formal risk evaluation (MOC or risk assessment) whenever safety-critical equipment is operated beyond its inspection or maintenance interval, evaluating consequences across all operating modes.
→ ExxonMobil Corporation
Require a siting risk analysis for all electrostatic precipitators at U.S. ExxonMobil refineries and implement safeguards to minimize community consequences of an ESP explosion.
→ Torrance Refining Company
Implement protective systems to prevent ignition of flammable gases inside the FCC unit ESP in all modes of operation.
→ Torrance Refining Company
Identify all safety-critical equipment and their failure consequences across all operating modes; ensure testing strategies and availability targets are defined and maintained.
→ Torrance Refining Company
Require formal risk evaluation whenever safety-critical equipment is operated beyond its maintenance interval, evaluating safety consequences across all operating modes.
→ Torrance Refining Company
Conduct a siting risk analysis for the FCC unit ESP and implement safeguards to minimize consequences of an ESP explosion to the surrounding community.
→ American Fuel and Petrochemical Manufacturers
Convene a forum of FCC engineers from member companies to share practices for preventing ESP explosions and safe FCC transient operations, including Safe Park mode hazards.
💡 Lessons Learned
Every safety-critical device must have its safety function identified for every mode of operation -- including standby, Safe Park, startup, and shutdown. A device identified as safety-critical in normal operation may fail differently or have different consequences in non-routine modes that have never been analyzed.
Extending a turnaround interval means operating safety-critical equipment beyond its designed service life. This is a management of change event -- it requires a formal risk assessment evaluating whether the extended interval raises the probability of safety-critical device failure to unacceptable levels.
Non-routine operating modes are not optional topics for PHAs and operating procedures. Safe Park, unit standby, emergency shutdown, and startup modes often involve hazardous conditions not present during normal operation -- and they are frequently the conditions under which incidents occur.
An ESP explosion at a refinery can scatter debris hundreds of feet. When HF alkylation units or other high-consequence processes are located nearby, the community consequences of an explosion extend far beyond the initial blast -- siting risk analysis must account for escalation to adjacent high-hazard processes.
Variance processes that bypass safety procedures must involve independent multidisciplinary review before management approval. A Variance approved without technical and operations input creates a pathway for safety barriers to be bypassed without adequate scrutiny.
MI: Mechanical IntegrityPHA: Process Hazard AnalysisSOP: Operating ProceduresMOC: Management of Change
🔨 Safety Meeting Toolbox Talk
►Can you name three pieces of safety-critical equipment in your process area? Do you know what their safety function is, and whether that function has been tested recently?
►If a turnaround is extended and equipment operates beyond its planned maintenance interval, what is your process for evaluating whether safety-critical devices can safely continue in service?
►Do our operating procedures cover all modes of operation -- startup, shutdown, standby, emergency shutdown -- or only normal operation? What happens during a non-routine mode our procedures do not address?
►Has our PHA ever analyzed what happens if a safety-critical device fails during startup, shutdown, or standby rather than only during normal operation?
►If a major explosion occurred in one of our process units, which adjacent units or community areas could be affected by debris or escalating fires? Has that escalation scenario been analyzed?
Immediate Action Items
✓Initiate a safety-critical device inventory for your most hazardous process units: identify each device, its safety function, the consequences of failure in each operating mode, and when it was last tested.
✓Review your MOC procedure and confirm it captures extended turnaround intervals as a change requiring formal hazard review for safety-critical devices that will operate beyond their specified maintenance intervals.
✓Pull operating procedures for one high-hazard unit and verify they include specific guidance for all non-routine modes (startup, shutdown, standby, emergency) -- not just normal operation.
✓Check your last PHA report for a critical unit and verify that safety-critical device failures in non-routine operating modes were specifically analyzed.
✓Identify any high-consequence processes adjacent to equipment with explosion potential and confirm the siting risk analysis addresses explosion debris as a credible escalation scenario.
🔗 PSM Failures Behind This Incident

This incident traced to breakdowns across 4 PSM elements (MI · PHA · SOP · MOC). Each represents a documented gap that process safety documentation and consulting can close before a similar event occurs at your facility.

Mechanical Integrity (MI)
Equipment must be designed, inspected, and maintained to operate safely in its intended service. Mechanical integrity failures — degraded equipment, missed inspections, deferred repairs — contributed to loss of containment here.
Supporting documents in our library →
Process Hazard Analysis (PHA)
A structured PHA or HAZOP study exists to identify exactly these scenarios before they occur. When PHA is absent, superficial, or overdue for revalidation, hazards operate unseen until they kill someone.
Supporting documents in our library →
Operating Procedures (SOPs)
Operators cannot reliably hold safe operating limits without clear, current, enforced procedures. Deviation from acceptable operating conditions — a root cause here — is a direct consequence of SOP failure.
Supporting documents in our library →
Management of Change (MOC)
Changes to equipment, chemistry, operating limits, or procedures that bypass formal review create new hazard pathways your PHA never evaluated. MOC failures open the door to incidents like this one.
Supporting documents in our library →
Process Safety Management Consulting & Document Library
📂
PSM Document Library
32 ready-to-deploy PSM documents covering all 14 OSHA elements — procedures, checklists, and audit templates built for facilities operating under 29 CFR 1910.119.
Browse the Library →
📊
Free PSM Health Score
Find out where your PSM program stands across all 14 OSHA elements. Our free health score surfaces your biggest gaps in under 10 minutes — no account required.
Check Your Score →
📞
Consulting Services
PHA facilitation, PSM program builds, compliance audits, and OSHA inspection support. Transparent flat-fee pricing — no retainer required to get started.
View Pricing →
📋 Explore the full incident library: All 132 CSB Case Studies →