The Slide Valve Was Closed, So Where Did the Air Go?: Husky Superior Refinery FCC Explosion

30-Second Summary

• Investigation finding What happened: At about 9:58 a.m. on April 26, 2018, two absorber vessels exploded at the Husky Superior Refinery in Superior, Wisconsin. Operators were shutting down the fluid catalytic cracking (FCC) unit for planned maintenance.
• Consequences: 36 workers were injured. Metal fragments flew up to about 366 m (1,200 ft). One punctured an asphalt tank. About 2,700 m³ (17,000 barrels) of hot asphalt spilled and caught fire. The city evacuated 2,507 residents. Property damage was estimated at about $550 million.
• Why: Air from the regenerator flowed through the reactor and main column into hydrocarbon equipment. Two key safeguards were missing: a reactor steam barrier and a main column gas purge. A slide valve that operators had closed was badly eroded and let air through.
• Editor's note For your site: Ask what separates air from fuel during shutdowns and startups, not only during normal runs. Then ask how you verify it.

What Happened

Investigation finding The refinery held a major maintenance outage, called a turnaround, about every five years. In 2018, shutdown began on April 23 with the alkylation unit. The FCC unit was next, on the morning of April 26. About 800 to 900 employees and contractors were on site. The U.S. Chemical Safety and Hazard Investigation Board (CSB) notes that Husky had bought the refinery 170 days earlier, in November 2017.

At about 5:30 a.m., the board operator shut down the electrostatic precipitator (ESP). This step reflected lessons from a 2015 ESP explosion at the ExxonMobil Torrance refinery in California. Feed was stopped at about 5:40 a.m. The regenerated catalyst slide valve was closed at 5:45 a.m. The spent catalyst slide valve was closed at 5:48 a.m.

The control system showed the spent catalyst slide valve still 2% open. A field operator closed it by hand at about 6:05 a.m. Another operator tightened it further with the handwheel. By 6:16 a.m., the reactor level read zero. Following the site procedure, operators kept the regenerator at a higher pressure than the reactor. Apart from about 15 minutes near 9:10 a.m., the gap was at least about 21 kPa (3 psi). At times it reached about 69 kPa (10 psi).

At about 9:58 a.m., the primary absorber and sponge absorber in the gas concentration unit exploded. Process data showed no sudden pressure or temperature change beforehand. The blast shook buildings up to about 1.6 km (1 mile) away. More than 100 metal fragments flew up to about 366 m. It was a scheduled contractor break, so many workers were already inside blast-resistant buildings or away from the unit.

A fragment punctured asphalt Tank 101, about 61 m (200 ft) from the absorbers. The asphalt was stored at about 160–171 °C (320–340 °F). It flowed over the containment wall into the FCC and crude unit areas, reaching about 20–25 cm (8–10 in) deep. Responders hesitated to apply water, because water can flash violently on hot oil. Around noon, fire started inside the tank and spread across the ground.

The first community evacuation notice went out at about 1:00 p.m. By 1:35 p.m., the zone covered about 3.2 km north, 4.8 km east and west, and 16 km south of the refinery. The city evacuated 2,507 people. Duluth, Minnesota, issued a shelter-in-place advisory at 8:00 p.m. The main asphalt fire was out shortly before 7:00 p.m. All fires were out before midnight. Orders were lifted at 6:00 a.m. the next day.

Technical principles and management decisions

How the Process Works

Editor's note An FCC unit breaks heavy oil into lighter products such as gasoline and diesel. It uses a powdered catalyst that flows like a liquid when aerated. The catalyst circulates between a reactor and a regenerator. In the reactor, it meets flammable hydrocarbons. In the regenerator, air burns coke off its surface. Air and fuel share one connected system. Few refinery units work this way.

Investigation finding In normal operation, only a tight pressure balance keeps the two apart. During shutdown, steam is fed to the reactor to raise its pressure above both the regenerator (air side) and the main column (hydrocarbon side). Steam then pushes outward in both directions. This is the "reactor steam barrier." The licensor's general manual called for the regenerator to sit about 14 kPa (2 psi) below the reactor during shutdown.

A slide valve is a gate-type valve. A disc slides across an opening to control catalyst flow. Even new valves are built with gaps of about 1.0–1.5 mm (0.04–0.06 in) to allow for heat expansion. The CSB notes that most of the industry does not treat these valves as positive isolation.

Editor's note Pyrophoric material, such as iron sulfide scale, can ignite on its own when dry and exposed to air. It commonly forms inside steel equipment handling sulfur-bearing hydrocarbons. Once air entered, the ignition source was already in place.

Causes, Layer by Layer

Investigation finding The CSB found that air from the regenerator was directed through the reactor and main column into the gas concentration unit. Oxygen built up in the two absorbers and formed a flammable mixture. The same oxygen reacted with pyrophoric material inside, creating the ignition source.

The site's FCC procedure had not matched licensor guidance since the unit's 1960 design. No process engineer, licensor, or consultant had technically reviewed it for at least 25 years. Operations recertified it every year, but that review did not catch the technical errors.

The 2018 shutdown added vapor-phase chemical cleaning for the first time. It also stopped venting equipment to the atmosphere. Combined with missing purge steps, these changes made oxygen buildup more likely. The site did not identify this risk.

The explosion came less than a year after the CSB's Torrance report. Staff knew hydrocarbons had flowed into the air side at Torrance. They did not connect that the reverse, air into hydrocarbon equipment, was also possible.

Editor's note These findings do not point to one person's error. The procedure, training, hazard analysis, and equipment care all shared the same blind spot.

Why the Damage Spread

Investigation finding Brittle steel. Both absorbers were made of steels no longer recommended for new equipment. The CSB said tougher modern steel would likely have torn open, with far fewer fragments.

Layout. The punctured asphalt tank was about 61 m from the blast. The hydrofluoric acid (HF) storage tank was closer, about 46 m (150 ft) away. No HF was released. Yet the city based its evacuation partly on the risk of an HF release. The CSB urged refiners, especially those with HF alkylation units, to review the report.

Secondary hazards. Responders were unsure whether to put water on hot asphalt. They used sand and booms instead. The CSB found the likely ignition source was pyrophoric material inside the tank, exposed to air through the puncture.

Keeping reactor pressure above both sides pushes steam toward the air and hydrocarbon sides; the model labels AIR, STEAM and HYDROCARBONS identify air, steam and hydrocarbons respectively.

Some measures limited harm. Since 2013, the site had required blast-resistant trailers for contractors during turnarounds. The control room was also hardened. The explosion coinciding with the contractors’ break time also reduced harm to people.

Check what sits within fragment range on your plot plan.

Questions for Your Site

Pressure relationships and safeguards can differ by licensor and modification history. Use your plant’s licensor information and process engineering judgment.

Application at Korean Worksites

Investigation finding At the time of the Husky incident, multiple workers were already entering the FCC area before blinds had been installed.

Editor's note Residue fluid catalytic cracking (RFCC) processes at Korean refineries share the catalyst circulation and regeneration structure. Turnaround shutdowns occur too infrequently to build up regular operating experience, making procedures and training effectively the only means of retaining that knowledge. A practical approach at the pre-shutdown procedure review is to ask, step by step, what separates the air side from the hydrocarbon side.

From a work-permit perspective, the key point is when crews preparing scaffolding, instrumentation and cleaning enter the process area during shutdown. Limits on personnel access and work scope before blind installation need to be established in advance.