Third-floor platform of the crude distillation unit, 2 a.m., the atmospheric column running near 650°F at the bottom and the overhead naphtha stream pulling close to its bubble point. Twelve inches of lagging stands between the flange I’m checking and a hydrocarbon stream that would flash to vapor the instant it hit atmospheric pressure. The unit has been steady for eleven months. That’s exactly when a refinery gets you — not during the dramatic moments, but during the long quiet ones where sulfidation corrosion has been thinning piping circuits while nobody’s been paying close enough attention.
Refineries concentrate more stored energy, more pressure, and larger inventories of highly hazardous chemicals into a single footprint than almost any other industry. The consequence is that refinery hazards and safety procedures aren’t a paperwork exercise — they’re the line between a routine shift and a multi-fatality event that makes the national news. This guide breaks down the hazards you’ll actually encounter in a petroleum refinery, the procedures that control each one, and the regulatory framework that governs how the whole thing is meant to hold together.
Why Refinery Safety Sits in a Category of Its Own
The scale numbers tell most of the story. The United States operates approximately 130 petroleum refineries processing over 18 million barrels of crude oil per day, and most of those plants were built 40 or more years ago. You’re looking at piping systems that have been cycling between ambient and 900°F for four decades, pressure vessels operating above design life that depend on inspection-driven extensions, and process units that sit within a few hundred feet of each other — which means a release in one unit can ignite at another.
OSHA’s own data reflects the concentration of risk. The petroleum refining sector has recorded more fatal or catastrophic highly hazardous chemical release incidents than any other industry sector since OSHA’s Process Safety Management standard was promulgated in 1992. That’s the reason OSHA runs a dedicated Petroleum Refinery National Emphasis Program targeting PSM compliance rather than relying on general inspections.
The economic paradox is what throws new HSE professionals. Day-to-day, refinery workers are actually safer than the average factory worker by most measures — the American Petroleum Institute reports that from 2008 to 2017, refinery sector nonfatal injury/illness rates declined from 1.1 to 0.7 per 100 full-time workers, making refinery employees approximately five times less likely to be injured than average manufacturing workers. But the catastrophic event potential sits far above the industrial average. Refineries kill people in bursts of 2, 15, 23 at a time — not in the steady trickle that recordable rates capture. That’s the gap process safety management exists to close.
The Common Hazards in Petroleum Refineries
Petroleum refinery hazards don’t behave like hazards in a warehouse or a fabrication shop. They cluster into three layers — process-scale events that release huge energy or toxicity at once, chemical health hazards that act over shifts or years of exposure, and occupational hazards that injure individual workers the same way they do in any heavy-industrial setting. Competent refinery safety means controlling all three concurrently, because strong performance in one layer doesn’t guarantee anything about the others.
The fatality curve sits almost entirely in the first layer. The injury curve sits almost entirely in the third. Anyone running a refinery safety program has to measure and manage both independently — which is the single most common mistake I see when I audit plants that think a low Total Recordable Incident Rate means they’re safe.
Fire and Explosion Hazards
This is the hazard category that drives most refinery fatalities. Vapor cloud explosions happen when a loss-of-containment event releases flammable hydrocarbon into open atmosphere, the cloud finds an ignition source — often something as small as a vehicle engine or an unclassified electrical enclosure — and the pressure wave levels structures within its reach. The 2005 BP Texas City event was a textbook vapor cloud explosion; a raffinate splitter overfilled during startup, hydrocarbon vented from a blowdown stack, drifted across the unit, and ignited.
Boiling liquid expanding vapor explosions (BLEVEs) are the other major failure mode — a pressure vessel holding a liquefied gas fails catastrophically while exposed to external fire, and the superheated liquid flashes instantly to vapor. Pool fires and flash fires are the lower-energy siblings, but either can kill anyone in flame-resistant clothing if the exposure is prolonged. The 2019 Philadelphia Energy Solutions incident combined several of these modes when a corroded elbow in the alkylation unit failed, released hydrofluoric acid and hydrocarbon, and the vapor cloud ignited.
Toxic and Hazardous Chemical Exposure
A refinery runs on a chemistry set that would shut down most other industries. Benzene is a known human carcinogen with a leukemia link — its OSHA permissible exposure limit sits at 1 ppm over an 8-hour TWA, and any process that handles naphtha, reformate, or BTX streams carries a benzene exposure profile. Hydrofluoric acid in alkylation units is acutely lethal and causes deep tissue damage through skin contact at low concentrations. Sulfuric acid in competing alkylation technology destroys tissue through dehydration. Sulfur dioxide from sulfur recovery upsets, ammonia from hydrotreater effluent systems, and the naphthenic acid carryover in crude distillation are all real exposure pathways that show up in refinery industrial hygiene sampling.
The mistake I still see made by young safety officers is treating this layer as a PPE problem. It’s not. It’s a containment problem. PPE is the last line, and it fails often.
Hydrogen Sulfide and Sour Gas
H2S deserves its own treatment because of how quickly it kills and how unreliably the human nose detects it. At 1 ppm you smell rotten eggs. At around 100 ppm olfactory fatigue sets in and you stop smelling it. At 500 to 700 ppm, a single breath can cause respiratory paralysis and collapse. Any refinery processing sour crude — which today means most of them, given the trend toward heavier feedstocks — has H2S in crude overheads, sour water strippers, amine regenerators, and sulfur recovery units.
The control baseline is continuous fixed detection in process areas plus personal four-gas monitors clipped to the collar of every person in the unit. Escape respirators — typically a 5- or 10-minute pouch-carried SCBA — are required anywhere a worker could be overwhelmed before reaching fresh air. On one night-shift handover I ran, the outgoing operator reminded the incoming team: “If your monitor goes off and you don’t know why, don’t investigate. Walk upwind.” That’s the discipline that keeps H2S fatalities rare.
Mechanical Integrity Failures and Corrosion
Most OSHA PSM citations issued against refineries involve mechanical integrity deficiencies — missing inspections, inspections performed but findings not closed, or corrosion loops not covered by the inspection program at all. The 2012 Chevron Richmond fire originated from a sulfidation-corroded 52-inch line in the crude unit that had been visually inspected but never subjected to thickness testing at the corroded zone. High-temperature hydrogen attack, chloride stress corrosion cracking in stainless steels, dew-point corrosion in overhead systems, and erosion at elbows on slurry service are the recurring failure modes that mechanical integrity programs exist to catch before they become losses of containment.
High-Temperature and High-Pressure Hazards
Distillation columns run at 650–700°F at the bottom. Catalytic cracker regenerators hit 1,300°F. Hydrotreaters combine 600°F service with hydrogen at 1,500 psi — which is the condition where high-temperature hydrogen attack lives. Burn injuries from steam leaks, thermal radiation exposure during pigging operations, and pressure-retaining component failures are the occupational consequences. The process consequence of a pressure envelope failure is usually a vapor cloud.
Confined Space and Asphyxiation Risks
Columns during turnaround, storage tanks, process drums, underground sewers, and excavated trenches all meet the definition of permit-required confined spaces under 29 CFR 1910.146. The dominant atmospheric hazard during refinery turnarounds is actually oxygen deficiency from nitrogen purging — a vessel that was inerted to remove hydrocarbon before entry is lethal until it’s forced-ventilated and verified. Engulfment by catalyst bed unloading, hydrocarbon carryover from incomplete isolation, and heat stress inside dark confined spaces round out the threat list.
Working at Height and Falls
Distillation columns go up 150 feet. Tank roofs sit 50 to 60 feet above grade. Flare tip access platforms can exceed 200 feet. Scaffold platforms surround units during turnaround in configurations that change daily. Ladders account for about a quarter of all fatal falls across industry, and refinery ladders often lead to confined space openings — which means a fall is into either a hard surface or an atmosphere.
Electrical and Arc Flash Hazards
Most process areas in a refinery are electrically classified as Class I, Division 1 or Division 2 under the National Electrical Code, meaning any electrical equipment in them must be rated to avoid becoming an ignition source for a flammable atmosphere. An unclassified radio brought into a unit during a permit violation has caused more than one vapor cloud ignition. Inside motor control centers and switchgear rooms, arc flash energy can exceed 40 cal/cm² — survivable only with category-rated PPE and proper approach-boundary discipline under NFPA 70E.
Noise, Heat Stress, and Ergonomic Hazards
Compressor buildings, fired heater decks, and FCC blower houses routinely exceed 100 dBA. Dual hearing protection — plug plus muff — isn’t optional in those zones. Outdoor work during summer in southern refineries moves heat stress from an occasional concern to a daily one. Turnaround work concentrates manual material handling, awkward postures, and overhead work into four- to six-week windows of elevated ergonomic load.
Transient Operations: Startups, Shutdowns, and Turnarounds
Most competitor articles on petroleum refinery hazards skip transient operations entirely, and it’s the most important hazard category in the building. The majority of major refinery catastrophes — BP Texas City, BP-Husky Toledo, and a long list of smaller events — happened during transitions, not during steady-state operation.
There are good reasons the risk concentrates there:
- Non-routine procedures: Startup and shutdown steps are used a few times a year; operator familiarity is lower than for routine work.
- Unusual flow paths: Bypasses, purge lines, and blowdown systems see flow that doesn’t move during normal running.
- Workload spikes: A single board operator can face dozens of simultaneous setpoint changes across multiple units.
- Alarm floods: Transient upsets trigger hundreds of nuisance alarms that bury the critical ones.
- Time pressure: Each hour a unit sits down costs the refinery seven-figure margin; the pressure to compress the startup is constant.
The CSB’s June 2024 final report on the 2022 BP-Husky Toledo fire documented an alarm flood exceeding 3,700 alarms in a 12-hour window — a direct demonstration of why alarm management and transient-operations procedures now sit at the top of refinery PSM focus areas.
Watch For: Any transient operation where the operating procedure has “note” steps instead of checklist steps — that’s where operator discretion fills gaps the procedure writer didn’t close, and it’s where incidents live.
Process Safety vs Occupational Safety: The Distinction That Keeps Refineries Alive
Every refinery I’ve ever audited tracks two streams of safety performance, and confusing them is how you end up with a Baker Panel report written about you. Occupational safety is the individual-worker-event discipline: slips, trips, cuts, strains, the ladder fall, the dropped wrench. Process safety is the loss-of-containment discipline: the release, the fire, the explosion, the toxic cloud.
The Baker Panel’s finding after BP Texas City was that the site had excellent occupational metrics — TRIR well below industry average — while its process safety performance was deteriorating. Leadership used the occupational numbers to conclude the refinery was safe. It wasn’t. That single misreading of data is why the American Petroleum Institute built out API Recommended Practice 754, the Tier 1 through Tier 4 process safety indicator framework that sits alongside OSHA recordable tracking at every refinery running a mature program today.
| Dimension | Occupational Safety | Process Safety |
|---|---|---|
| Focus | Individual worker exposure | Loss of primary containment |
| Metrics | TRIR, LTIFR, DART | API RP 754 Tier 1–4 events |
| Example event | Slip resulting in fractured wrist | Vapor cloud explosion |
| Governing standards | OSHA 1904, ISO 45001 | OSHA 1910.119, Seveso III, CCPS RBPS |
The 14 Elements of OSHA Process Safety Management for Refineries
OSHA 29 CFR 1910.119 is the regulation that reorganized refinery safety after the Phillips 66 Pasadena explosion in 1989. It applies to any process that holds above-threshold quantities of listed highly hazardous chemicals — which in practice means every US refinery. OSHA’s own “Process Safety Management for Petroleum Refineries” guidance document (publication 3918) is the best single regulatory source on how the agency expects the standard to be applied on a refinery site.
The standard is built from 14 interrelated elements. Here’s the working-practitioner version:
- Employee Participation — A written plan covering how workers participate in PHAs and access PSM information.
- Process Safety Information (PSI) — Current documentation of chemical hazards, technology, and equipment design basis.
- Process Hazard Analysis (PHA) — Formal hazard studies (typically HAZOP) revalidated every five years.
- Operating Procedures — Step-by-step written instructions for startup, normal operation, shutdown, and emergency.
- Training — Initial and refresher training documented for every operating position.
- Contractors — Host-employer evaluation, hazard communication, and oversight of contractor safety performance.
- Pre-Startup Safety Review (PSSR) — Final verification gate before commissioning a new or modified process.
- Mechanical Integrity — Inspection, testing, and maintenance of critical equipment including pressure vessels, piping, relief systems, emergency shutdown systems, and controls.
- Hot Work Permit — Written authorization system for ignition-source work.
- Management of Change (MOC) — Formal review for any non-replacement-in-kind change.
- Incident Investigation — Root-cause investigation within 48 hours of any incident that could reasonably have resulted in a catastrophic release.
- Emergency Planning and Response — Written emergency action plan integrated with HAZWOPER requirements.
- Compliance Audits — Independent audits of the PSM program at least every three years.
- Trade Secrets — No restriction on PSM information access for those who need it.
The five elements where OSHA issues the most PSM citations in the refinery sector are Process Safety Information, Process Hazard Analysis, Operating Procedures, Mechanical Integrity, and Management of Change. Those are the same elements that show up in the root cause findings of almost every major CSB refinery investigation. Willful violations currently carry penalties of up to approximately $156,259 per instance under OSHA’s current penalty structure — enough that a handful of willful citations on a single unit can reach seven figures.
Critical Safety Procedures Every Refinery Must Have
The hazard map above drives the procedure stack below. Each refinery safety procedure described here exists because a specific class of hazard demanded it — and because a previous generation of refinery workers died when the procedure wasn’t there or wasn’t followed.
Permit to Work Systems
The refinery permit to work system is the day-to-day operational backbone of refinery safety. Every non-routine task — anything outside the standing operating procedure — gets authorized through a written permit. The permit types I work with daily are general cold work, hot work, confined space entry, excavation, line break, electrical isolation, and radiography. Each permit identifies the task, the location, the hazards, the controls, the authorized workers, and the validity window, which is typically a single shift. A proper PTW system includes permit issuer authorization hierarchy, clear shift-handover protocols, and an audit trail good enough that any permit can be reconstructed six months later during an incident investigation.
Hot Work Authorization and Fire Watch
Hot work — welding, grinding, cutting, torch work, anything that generates sparks or flames — is the single highest ignition-source risk in a process unit. The procedure under OSHA 29 CFR 1910.252 and NFPA 51B requires pre-work atmospheric testing for LEL, oxygen, and H2S, removal or protection of combustibles within a 35-foot radius, a dedicated fire watch during the work, and continued fire watch for at least 30 minutes after work stops. On live process sites, continuous gas monitoring runs throughout the task, and the permit is immediately void if any reading rises above set thresholds. A hot work permit that’s been written for “the whole area for the whole shift” without specific task boundaries isn’t a permit — it’s a document that transfers liability to the permit issuer.
Confined Space Entry Procedures
Under 29 CFR 1910.146, permit-required confined space entry demands atmospheric testing in a fixed hierarchy — oxygen first (19.5 to 23.5 percent), then LEL (below 10 percent of the lower flammable limit), then toxics against their PELs. Process isolation uses double block and bleed or full spectacle blinding; valve-only isolation isn’t acceptable for hydrocarbon service. An attendant stays outside with direct communication to entrants, and a rescue plan with non-entry rescue capability is in place before the first entrant steps in. Vessels purged with nitrogen present a special case — they require breathing air supply for any entry, because the atmosphere inside will asphyxiate a worker in under a minute and no amount of forced ventilation is reliable until multiple air changes and continuous monitoring confirm the space is safe to enter on air.
Lockout/Tagout and Energy Isolation
29 CFR 1910.147 requires a written energy control procedure for every machine or process capable of storing hazardous energy — electrical, mechanical, hydraulic, pneumatic, thermal, chemical, and gravitational. Group lockout boxes, individual personal locks, and contractor lockout integration are the standard practices. One distinction that matters on refinery sites: LOTO controls energy from the mechanical side — motor control, valve actuator, pump breaker — but it doesn’t control process fluids. Process fluid isolation needs blinding or double block and bleed on top of LOTO. Conflating the two is one of the ways refinery workers get killed during what they thought was a safely isolated job.
Management of Change
MOC is where most unsafe conditions enter a refinery. Any change that isn’t replacement-in-kind — a different pump model, a procedural modification, an organizational restructure, a catalyst substitution — must go through a formal review including a hazard analysis, stakeholder sign-off, training updates, and document revisions. I’ve seen refineries run clean for two years then have an incident traced directly to a valve substitution that went through purchasing but never through MOC. The element isn’t difficult to execute. It’s difficult to enforce culturally, because people resist the paperwork.
Pre-Startup Safety Review
PSSR is the final gate. After any new construction, significant modification, or shutdown lasting beyond a defined threshold, a multidisciplinary team verifies that process safety information is current, operating procedures reflect the as-built configuration, training is complete, PHA recommendations are closed, and no outstanding MOC items remain. Only then do hydrocarbons re-enter the unit. A PSSR that gets signed off under startup schedule pressure without those verifications is how you introduce vapor cloud into a unit that isn’t ready to receive it.
Facility Siting and Occupied Building Placement
This is the refinery hazards and safety procedures element most often missing from competitor articles — and the one the BP Texas City report hit hardest. API Recommended Practice 752 governs permanent buildings and RP 753 governs portable buildings, both requiring quantitative siting studies that account for blast overpressure, thermal radiation, and toxic exposure scenarios. Contractor trailers were located near the BP Texas City raffinate splitter; when the vapor cloud ignited, 15 of the fatalities occurred in or near those trailers. Every refinery rewrote its siting practices in response. Any portable building placed inside a refinery today should come with a current API 753 consequence analysis attached.
Audit Point: Ask for the most recent API 752/753 siting study for any occupied building inside the process boundary, and verify the date against the last MOC for any nearby unit. If the study predates the last unit change, the facility siting element isn’t actually closed.
Engineering Controls and Safety Systems
Administrative procedures are only as strong as the engineering defenses behind them. The principle that drives refinery safety design is inherent safety first, then passive engineering controls, then active engineering controls, then administrative controls, then PPE — in that order of priority.
Pressure relief and flare systems are the last engineered barrier before a vapor cloud event. Relief valve inspection and testing is the most-cited mechanical integrity deficiency in the OSHA refinery NEP, which tells you how often the last barrier isn’t being maintained. Fixed gas detection networks — combustible, toxic, and oxygen — provide early warning for loss-of-containment events; open-path detection covers perimeter zones that point detectors miss.
Emergency shutdown systems and safety instrumented systems designed to IEC 61511 sit behind every high-consequence process loop. Each SIS loop is assigned a Safety Integrity Level based on the risk it mitigates, and its hardware and proof-test frequency are engineered to that level. Alarm management — categorized per ISA 18.2 — has become the visible focus area since the BP-Husky Toledo investigation; a properly tuned alarm system presents the operator with fewer than six alarms in any ten-minute window during an upset, not thousands.
Fire protection layers include fixed water deluge on critical equipment, fixed foam systems on storage tanks, passive fireproofing on structural steel supporting process equipment (typically to ASTM E119 two-hour fire resistance), and monitor nozzles positioned for manual application. The goal isn’t to fight a major fire — it’s to buy enough time for safe evacuation and to prevent escalation to neighboring units.
Inherently safer design — the principle of minimizing, substituting, moderating, and simplifying — sits above all active controls. Hydrofluoric acid alkylation replaced by sulfuric acid alkylation is a substitution. Reduced inventory through improved column internals is a minimization. These decisions get made at design and revamp, not during operations, which is why process engineers who understand process safety are worth their weight in turnaround budget.
Personal Protective Equipment for Refinery Workers
Refinery PPE requirements are specific to the hazards of petroleum processing, not a generic industrial-site kit. Minimum daily dress for any process area includes the following, organized by body zone:
- Head: Hard hat rated to ANSI Z89.1 Type I Class E, with chin strap for work at height.
- Face and eyes: Safety glasses with side shields at minimum; chemical splash goggles and face shield for sampling, acid handling, or opening equipment.
- Torso: Flame-resistant clothing compliant with NFPA 2112 (garment) and NFPA 2113 (use program). FRC protects against flash fire exposure — it buys seconds to escape a vapor cloud ignition, not immunity from direct flame.
- Hands: Nitrile or neoprene for hydrocarbon contact, butyl for acid handling, leather or FR leather for hot work, cut-resistant for scaffold and sharp-edge work.
- Respiratory: Tiered by hazard — N95 for nuisance dust, half-face APR for defined particulate or vapor, full-face APR for higher-concentration toxics, SCBA or supplied-air for IDLH atmospheres or confined space with nitrogen.
- Hearing: Plug protection above 85 dBA; dual plug-plus-muff above 100 dBA.
- Feet: Steel-toe safety footwear rated EH (electrical hazard), with metatarsal guard for heavy material handling.
- Fall protection: Full-body harness with double lanyard for any work at height over six feet, with anchor rated to 5,000 lb or certified engineered anchor.
- Specialized: H2S escape respirator (5- or 10-minute SCBA pouch) mandatory in sour service areas. Acid suits for HF alkylation unit work.
Emergency Response and Crisis Management
A refinery emergency plan has to do three things at once: protect workers on site, protect the community at the fenceline, and preserve the information needed for investigation afterward. On-site emergency response teams trained to HAZWOPER Technician level under 29 CFR 1910.120 are the primary responders; mutual aid agreements with neighboring industrial facilities provide surge capacity.
Muster procedures use wind-direction logic — workers move crosswind or upwind from the release, never downwind — and accountability is managed through mustering point sign-in sheets cross-checked against site access logs. Shelter-in-place is the alternative for releases where evacuation would expose workers more than staying inside intact buildings. Fenceline community notification is governed by EPA’s Risk Management Program under 40 CFR 68 and by the LEPC framework established under EPCRA.
Drill programs should include tabletop exercises quarterly, functional drills — hot work, confined space, medical — monthly by rotation, and full-scale site emergency drills at least annually with external agency participation. Units that don’t drill don’t respond well when the real event comes.
Contractor Safety Management
Contractors perform somewhere between half and three-quarters of all work inside a running refinery, and during turnaround they make up more than 90 percent of the workforce on site. Contractor injury rates at most refineries run higher than the employee rate, which makes contractor safety management a first-order concern rather than a supporting function.
OSHA 1910.119(h) lays out the host employer’s obligations: evaluate the contractor’s safety performance before selection, inform them of hazards they’ll encounter, ensure they’re trained on site-specific procedures, and periodically evaluate their performance. Third-party pre-qualification platforms — ISNetworld, Avetta, PEC Premier — handle the safety performance evaluation for most major refineries. What those platforms don’t cover is the operational reality during turnaround: high worker density, unusual tasks, compressed schedules, and shift patterns that push crews past the point where mistakes start compounding. Owner supervision and on-site contractor safety staffing have to scale with that load, not remain at routine-operations levels.
Regulatory Framework Governing Refinery Safety
The regulatory stack that governs a petroleum refinery depends on jurisdiction but follows recognizable patterns. In the United States, OSHA 29 CFR 1910.119 controls worker-facing process safety, EPA 40 CFR 68 controls community-facing risk through the Risk Management Program, and EPA 40 CFR 63 Subparts CC and UUU — the Petroleum Refinery Sector Rule — controls emissions and fenceline monitoring. The EPA finalized amendments to the Petroleum Refinery Sector Rule in April 2024 expanding fenceline monitoring and tightening flare and pressure-relief controls, and announced a reconsideration of those amendments in March 2025. Anyone writing or reviewing a refinery compliance program in the current cycle should be tracking that reconsideration docket.
In the United Kingdom, the Control of Major Accident Hazards (COMAH) Regulations 2015 implement the EU Seveso III Directive, overseen by HSE and the Environment Agency jointly. In the European Union, Seveso III itself (Directive 2012/18/EU) sets the upper-tier and lower-tier thresholds for major accident hazard establishments. Internationally, ISO 45001:2018 provides the occupational health and safety management system framework, and IEC 61511 governs functional safety of safety instrumented systems. Industry consensus standards — API RP 752, 753, 754, 770, NFPA 30, NFPA 70E, and the CCPS Risk-Based Process Safety framework — fill the gaps regulators don’t address directly.
| Jurisdiction | Primary Standard | Focus | Notable Requirement |
|---|---|---|---|
| United States | OSHA 29 CFR 1910.119 | Worker process safety | 14 elements, 5-year PHA revalidation |
| United States | EPA 40 CFR 68 | Community risk | Off-site consequence analysis, RMP filing |
| United States | EPA 40 CFR 63 CC/UUU | Emissions | 9 µg/m³ benzene fenceline action level |
| United Kingdom | COMAH 2015 | Major accident hazard | Safety report, land-use planning |
| European Union | Seveso III (2012/18/EU) | Major accident hazard | Tiered thresholds, community notification |
| International | ISO 45001:2018 | OHSMS | Worker consultation, continual improvement |
| International | IEC 61511 | Functional safety | SIL determination for SIS loops |
Lessons Learned from Major Refinery Incidents
The refinery industry has paid for most of its modern safety practices with fatalities. Four cases keep showing up in process safety training because they closed specific regulatory and procedural loops.
BP Texas City, March 23, 2005. An explosion at the isomerization unit killed 15 workers, injured 180, and cost approximately $2.1 billion in settlements plus $200 million in property loss, making it the costliest refinery accident on record. The raffinate splitter overfilled during startup; hydrocarbon vented through a blowdown stack; the vapor cloud ignited. Contractor trailers had been placed within the blast radius. Twentieth-anniversary retrospectives published in 2025 have reinforced how completely the industry rebuilt around this single event — API RP 752/753 siting, trailer placement restrictions, and the Baker Panel’s process safety culture findings all trace back here.
Lesson Applied: No occupied trailer sits inside the process unit blast radius without a current quantitative siting study.
Chevron Richmond, August 6, 2012. A sulfidation-corroded 52-inch line in the crude unit failed during operation, releasing hydrocarbon that formed a vapor cloud and ignited. Nineteen workers escaped; 15,000 community members sought medical attention. The inspection program had the line in scope but hadn’t captured the corroded zone through thickness testing.
Lesson Applied: Inspection plans have to cover corrosion loops, not just lines — and the mechanical integrity element has to include positive materials verification for carbon steel in hydrogen and sulfur service.
Philadelphia Energy Solutions, June 21, 2019. A corroded elbow in the HF alkylation unit failed, released hydrocarbon and hydrofluoric acid, and the vapor cloud ignited in one of the most dramatic refinery fires on video record. No workers were killed; the site was permanently shut down.
Lesson Applied: HF alkylation carries a tail risk that keeps reappearing at refineries with aging equipment; inherently safer design alternatives need to be evaluated at every major revamp.
BP-Husky Toledo, September 20, 2022. Two workers were killed, property damage reached approximately $597 million, and over 23,000 pounds of naphtha were released, with CSB investigators documenting an alarm flood exceeding 3,700 alarms in 12 hours preceding the event. The CSB final report, published in June 2024, made alarm management and transient operations named focus areas for refinery PSM programs.
Lesson Applied: Alarm rationalization per ISA 18.2 and stop-work authority that’s endorsed at the top of the organization aren’t optional — they’re first-order controls.
The Fix That Works: After any PSM-reportable incident, require the root cause corrective actions to be tracked in the same MOC system that tracks engineering changes. If a corrective action can’t be closed because an MOC hasn’t been done, the system forces the problem back to the right owners rather than letting it sit in a spreadsheet.
Building a Strong Refinery Safety Culture
The organizational layer is what decides whether the hazards and procedures above actually hold together in the field. I’ve worked sites that had every PSM element documented and still missed obvious deficiencies in mechanical integrity, and I’ve worked sites with messier paperwork whose operators caught problems early because leadership had built the culture to encourage them to speak up.
Leadership commitment measured by calendar action — how many plant walk-downs per month, how many near-miss reviews attended, how often stop-work authority is visibly backed when it costs the refinery money — is the single strongest predictor of PSM maturity. Worker participation beyond the 1910.119(c) minimum shows up in PHA attendance, JSA authorship, and incident investigation roles filled by frontline operators and mechanics. Leading indicator tracking — PTW audit scores, near-miss reporting frequency per FTE, MOC backlog aging, overdue inspection counts — gives you predictive signal that lagging indicators can’t. Psychological safety, the willingness to report a near-miss or a procedural deviation without blame, is what fills the front of the incident funnel so the back of the funnel stays empty.
Frequently Asked Questions
The Lesson the Industry Keeps Relearning
Every refinery I’ve worked inside has the hazard list above somewhere in its training matrix and the procedure stack somewhere in its document control system. What separates the sites that run for a decade without a major incident from the sites that end up in a CSB report isn’t the presence of documents — it’s the working discipline behind them. Refinery hazards and safety procedures are a system, not a collection. A hot work permit only protects you if the gas testing is honest, the fire watch is present, the surrounding inventory is correctly modeled, and the operating crew isn’t drowning in alarms at the same time.
The lesson the industry keeps paying for is that transient operations, mechanical integrity, and management of change are where fatalities live — and that low recordable rates can run alongside a refinery that’s drifting toward its next major event. The single highest-impact change any refinery can make this cycle is to track process safety leading indicators with the same rigor it tracks TRIR, to close MOCs and PSSRs before startup pressure compresses them, and to listen when an operator or contractor uses stop-work authority. Those three practices do more to prevent the next catastrophic release than any new piece of equipment a capital project can deliver.
If the refinery reading this still treats process safety and occupational safety as the same discipline, the work starts tomorrow — and it starts with asking the board operator what alarms she silenced today.