How the Tesoro Anacortes Investigation Exposed a Process-Safety Verification Failure

A refinery can have a maintenance history, inspection records, and technically qualified people, yet still miss the condition that makes a catastrophic failure possible. The April 2, 2010 explosion and fire at the Tesoro Anacortes refinery in Washington illustrates that problem with unusual clarity. Seven workers died after a heat exchanger in the naphtha hydrotreater unit ruptured during startup following a maintenance shutdown, according to the U.S. Chemical Safety and Hazard Investigation Board (CSB) final report released in 2014.

The case is not useful because it offers a dramatic story. It is useful because it shows how a known asset can remain inside an operating system whose verification logic is too weak for the damage mechanism developing inside it. The central lesson is that an investigation must examine not only what failed, but also what the organization believed it had verified before the equipment returned to service.

What was the initial scenario at Tesoro Anacortes?

The incident occurred in a naphtha hydrotreater unit after a maintenance shutdown. A heat exchanger that had been in service for decades failed violently, releasing flammable material that ignited and killed seven workers. The CSB identified high-temperature hydrogen attack, known as HTHA, as the damage mechanism that severely cracked and weakened carbon-steel tubing before the rupture.

That description matters because HTHA is not the kind of condition that a routine visual check can reliably dismiss. The investigation therefore moved beyond the immediate rupture and examined inspection practices, materials knowledge, engineering assumptions, and the decisions that allowed the exchanger to remain in operation.

A useful incident review begins at this point by separating the event from the operating history. The event was the rupture and fire. The operating history included the information available about the equipment, the inspection methods selected, the way similar damage was understood, and the authority used to decide that the unit could operate. This distinction is also central to the five blind spots that hide system failure in incident reviews.

Which decision allowed the exposure to continue?

The important decision was not a single order to ignore a warning. It was the accumulated decision to treat the exchanger as sufficiently understood and sufficiently controlled, even though the inspection and engineering system did not identify the developing damage with the precision the hazard required.

The CSB found that Tesoro had not effectively evaluated the potential for HTHA in the exchanger and that the company relied on inspection and materials information that did not adequately address the mechanism. That finding changes the question an investigator should ask. Instead of asking why a component failed, ask why the organization considered the component acceptable before the failure.

That question protects the investigation from becoming a search for a final mistake. James Reason’s work on organizational accidents remains valuable here because it distinguishes the visible action from the latent conditions that make the action possible. In this case, the final rupture was visible. The weaker inspection logic, incomplete damage-mechanism evaluation, and decision assumptions were less visible, although they shaped the exposure for much longer.

How did the execution of the control fail?

The case shows that a control can exist in a procedure and still fail in execution when its technical basis does not match the hazard. Inspection is not a single activity. Its reliability depends on whether the organization has identified the relevant degradation mechanism, selected a method that can detect it, understood the limitations of that method, and assigned the decision to someone with the right evidence.

When those conditions are missing, a completed inspection record can create confidence without creating protection. The document says that an inspection occurred, but it does not prove that the inspection answered the question that mattered. For process-safety leaders, this is the difference between completion evidence and control evidence.

Andreza Araujo makes a related distinction in Safety Culture Diagnosis: Learn how to do your own. A diagnosis must compare what the organization declares with what the work system permits in practice. Applied to equipment integrity, the same principle means comparing the written inspection program with the actual decision path that determines whether a degraded asset remains in service.

The Swiss Cheese Model in incident investigation gives leaders a practical way to organize that review. The question is not whether one person made an error. The question is how equipment knowledge, inspection, engineering review, startup controls, and management assurance aligned without stopping the exposure.

What did the measured result reveal?

The measured result was not a modest variance in a dashboard. It was a fatal rupture that exposed a gap between the condition the organization believed it had controlled and the condition that actually existed inside the equipment. The CSB final report documented seven fatalities and identified management-system findings that extended beyond the heat exchanger itself.

For an investigation team, that result changes the meaning of a corrective action. Replacing the failed component may remove the immediate physical hazard, but it does not show that the organization can recognize the same damage mechanism elsewhere. A stronger result would require evidence that the company reviewed comparable assets, revised the engineering basis, improved inspection selection, and gave accountable leaders a way to verify that the new control worked.

The result should therefore be tracked in two layers. The first layer confirms that the physical condition was corrected. The second confirms that the decision system changed. Without the second layer, the organization may close the event while preserving the reasoning pattern that allowed the exposure to develop.

Why is a completed corrective action not enough?

A corrective action is complete when the stated task is finished. Risk reduction is demonstrated only when the relevant exposure has changed and someone can show how the change was verified. Those are different tests, which is why a long action list can coexist with weak prevention.

In the Tesoro case, a credible post-incident review would ask whether each action changed one of six conditions: the damage-mechanism register, the inspection method, the engineering review, the asset acceptance criteria, the startup decision, or the assurance cadence. If an action changes none of those conditions, it may improve documentation without improving protection.

Use the five checks for incident action verification to test whether an action has an owner, a completion condition, a field or technical verification method, a review trigger, and evidence that reaches the person with authority to intervene.

What can process-safety leaders generalize from this case?

Four lessons transfer beyond refineries.

• Verify the damage mechanism before choosing the inspection. A familiar inspection routine is weak when it cannot detect the failure mode that matters.
• Separate asset condition from decision quality. An asset may look acceptable while the organization is making an unacceptable decision about its continued use.
• Make technical uncertainty visible. When evidence is incomplete, the decision record should identify the uncertainty, the temporary boundary, and the person who can stop the work.
• Review comparable assets after a serious event. A local repair is not a system response if similar equipment remains governed by the same assumptions.

These lessons also explain why an incident review should not end with a training assignment. Training can be appropriate when knowledge was absent, but it is a weak response when the inspection basis, equipment design, information flow, or decision authority made the error likely.

How should an EHS manager apply this in the next review?

Start with one high-consequence asset and reconstruct the decision that kept it in service. Do not begin with the final report template. Collect the equipment history, known damage mechanisms, inspection method, engineering assumptions, maintenance scope, startup authorization, and evidence used by the accountable leader.

Then ask five questions. What condition was the control meant to detect? What evidence showed that the method could detect it? Who interpreted the result? What uncertainty remained when the asset returned to service? Which event would have forced a review earlier?

Record the answers in a decision log that can be challenged by operations, maintenance, engineering, and EHS. If the teams disagree, preserve the disagreement rather than smoothing it into a consensus sentence. Technical dissent is useful when it reaches the person who owns the exposure before the next startup.

Finally, set a verification date that is tied to evidence, not only to calendar completion. The review should show whether the new inspection basis was used, whether comparable equipment was screened, and whether leaders can explain the boundary at which the asset must be removed from service.

What should the final investigation conclusion say?

The Tesoro Anacortes case does not support a conclusion that a single worker failed to follow a rule. It supports a more demanding conclusion. The organization allowed a critical asset to remain inside a decision system that did not adequately identify, inspect, or escalate the damage mechanism capable of causing a fatal rupture.

That conclusion is harder to write because it assigns responsibility to the conditions that shaped the decision, not only to the person closest to the event. It is also more useful because it tells leaders what must change before the next startup. A process-safety investigation earns its value when the organization can demonstrate that the same exposure would now be recognized earlier, challenged more clearly, and stopped with defined authority.

For leaders building that capability, Andreza Araujo’s work connects technical controls with the culture that determines whether evidence is questioned or merely filed. Safety is about coming home, and that standard requires more than a completed inspection record. It requires proof that the decision protecting people still holds when the equipment, schedule, and information are under pressure.