Could a small leak become a rupture during diagnosis?: The Chevron Richmond refinery fire
Where should the evacuation boundary have been while workers examined a small leak that could become a rupture?
30-second summary
On August 6, 2012, piping ruptured in the crude unit at Chevron’s Richmond refinery. A vapor cloud engulfed 19 employees near the leak and ignited about two minutes later. They escaped, but six employees sustained minor injuries during the incident and response. Approximately 15,000 nearby residents sought medical treatment in the following weeks.
The CSB identified sulfidation thinning of carbon-steel piping as the cause of rupture. Corrosion rates varied between components in the same circuit, and the inspection system missed a vulnerable component between measurement locations. Insulation removal continued while the unit remained in service. The first questions concern the condition of the whole circuit and when to stop approaching it, before considering a leak repair.
Work background and incident sequence
The crude column separates fractions with different boiling ranges for further processing. The 4-sidecut carried light gas oil. A 52-inch-long component in the 8-inch branch downstream of a 20-inch column outlet ruptured. The line operated near 640°F and approximately 55 psig at the rupture location. On release, some of the hot liquid could vaporize and form a flammable cloud.
At about 3:50 p.m., an operator found a puddle and liquid dripping from overhead insulated piping. The supervisor and shift team leader considered the situation serious but did not believe it required an immediate shutdown. Insulation obscured the source. The operator determined that the line could not be isolated from the process, yet personnel continued considering an on-line repair.
The refinery fire department was called shortly after 4:00 p.m.; firefighters began arriving around 4:07 p.m. Operations, inspection and process personnel gathered. At about 5:00 p.m., the shift team leader directed a reduction in flow. Inspectors knew of sulfidation thinning but believed recent measurements supported operation until the next turnaround. Local abrasion near a support was suspected, and a leak-repair contractor was called.
Pulling insulation bands from the ground with a pike pole moved the pipe. Personnel abandoned that method as dangerous, then erected a scaffold so firefighters could remove the sheathing directly. White vapor emerged, and insulation soaked in hot process fluid ignited. Hose teams extinguished the fire and the firefighters descended. The unit had not first been shut down while work continued near the leak.
Around 6:30 p.m., a catastrophic rupture formed a vapor cloud that ignited about two minutes later. Personnel engulfed by the cloud escaped close to the ground. A fire engine about 65 feet from the leak burned. The initially small exclusion area and the assumption that areas beyond it were safe did not account for the cloud following a rupture.
Equipment and work principles
Sulfidation is wall loss caused by the reaction of sulfur compounds with iron at elevated temperatures. The final report identifies sulfur content, sulfur species, temperature and flow conditions as factors affecting corrosion. Age alone is insufficient: the actual operating conditions matter. Changes in feed or temperature call for reassessment of remaining-life estimates based on previous conditions.
Components described as carbon steel need not have equal corrosion resistance. The failed circuit used ASTM A53B material without a minimum silicon specification. The ruptured component contained 0.01 wt% silicon; the upstream elbow contained 0.16 wt% and showed substantially less thinning. Adequate thickness at an elbow or accessible location cannot establish the condition of an intervening straight section.
Six of 12 samples from the 8-inch and 12-inch piping contained less than 0.10 wt% silicon. A vulnerable component thus raises a circuit-wide inspection question. Inspection drawings should identify components between welds and show which have verified composition and thickness, rather than displaying measurement points alone. Results from known material should not stand in for an unverified section.
Inspection scope must connect to decision authority. The CSB examined unimplemented turnaround recommendations and failures to apply technical guidance. A deferred repair record needs more than a reason: it should show who reviewed the risk and the conditions permitting further operation. If those closing recommendations and authorizing operation rely on different records, the decision needs reconciliation.
Remaining-life assessment of leaking piping is not equivalent to an inspection judgment during normal operation. Drips beneath insulation do not reveal the opening or extent of adjacent thinning. Removing insulation or disturbing supports can load weakened piping. Before bringing people and scaffolds closer to locate a leak, assess remote shutdown, depressurization, isolation and the consequences of rupture.
Adding measurement locations differs from inspecting every component. Convenient repeat locations may continue to miss a short section of different material between them. The CSB’s recommendation for complete component inspection targets this gap. Component identity, weld history and partial replacements help reveal omissions better than total line length alone. Inaccessible sections also require decisions on operating conditions and access work before the next inspection.
Minimum alert thickness is a trigger for assessment or replacement, not merely a database number. The CSB recommended technical review before lowering it. A lower setting may remove an alert without adding metal. Records of a change should identify design conditions, loads, measurement uncertainty and approval, and allow inspectors to compare the previous and new thresholds.
A larger response group may bring expertise but also increases exposure. Forty people accumulated at the leak over the hours before the incident. Departing and incoming shifts overlapped, and people assessing work scope stood nearby. Incident command needs to determine who must remain, which analysis can be done from a safe location and whether scaffold contractors receive the same withdrawal warning.
After hose streams were used to remove insulation, the leak worsened to a spray. Shutdown was then decided, but required time. Planning must cover the interval between a shutdown instruction and cessation of flow and pressure. Where immediate isolation is unavailable, prioritize broader exclusion and remote operation rather than keeping people close while waiting. The presence of firefighters and repair personnel does not itself justify continued operation.
Deferred turnaround recommendations must carry forward into the next plan. A new inspection team receiving thickness results alone may miss why a component was proposed for replacement. Linking damage warnings, site findings and cost or scheduling decisions in one equipment history helps keep unresolved recommendations visible. Completion means verified replacement or inspection and technical review, rather than merely issuing a work order.
It is useful to separate repair feasibility from the need for emergency shutdown. A contractor’s ability to make a clamp does not establish that damaged piping can withstand its installation. Assess temperature, flammability, mechanical integrity and isolation first, then define permissible work. Needing to expose insulation before making a decision can itself be a reason to stop approaching and review shutdown options.
Published chronology and investigation findings
| When | Established account | Source |
|---|---|---|
| Before the incident | Inspection and replacement recommendations were not adequately implemented through operating and turnaround decisions | CSB final pp.50–83 |
| 2012-08-06 about 15:50 | Liquid dripping from insulated piping discovered | Final p.22 |
| From about 16:07 | Refinery firefighters arrived; personnel gathered for leak analysis | Final pp.23–25 |
| During insulation removal | Vapor appeared; soaked insulation ignited and was extinguished | Final pp.26–28 |
| Around 18:30 | Catastrophic rupture and cloud formation; ignition about two minutes later | Final pp.28–29 |
| After the incident | Investigation of sulfidation, silicon variation, inspection coverage and leak response | Final pp.34–45,92–100 |
Consequences and emergency response
The CSB describes a narrow escape. A firefighter inside the burning engine also escaped while wearing protective equipment. Positioning apparatus requires consideration of rupture, vapor spread, wind and withdrawal routes, not only the initial leak. Reducing personnel near a release remains necessary after firefighters arrive.
A shelter-in-place alert was issued at 6:38 p.m. and lifted at 11:12 p.m. after the fire was under control. The approximately 15,000 residents seeking care are a separate count from injured employees. Refinery emergency plans need a defined route for requesting community warnings and communicating information when consequences extend beyond the site.
Recommendations went beyond additional inspections. The CSB called for API improvements in sulfidation inspection and leak evaluation and response, and for Chevron improvements in implementation of technical guidance and review of deferred equipment work. At a site, technical recommendations need tracked work items; operation with an unresolved item requires clear authorization conditions.
Questions for your site
| Question | How to check |
|---|---|
| Which components in the circuit remain uninspected? | Compare a weld-to-weld component inventory with thickness maps. |
| What evidence identifies low-silicon components? | Link material certificates, composition testing and replacement history. |
| Can the leaking line actually be isolated? | Check isolation and depressurization routes on drawings and at valves. |
| Could insulation removal load the pipe or worsen the release? | Obtain technical review of access and contact work before shutdown. |
| Does the exclusion area account for catastrophic rupture? | Review boundaries and apparatus positions against dispersion, wind and escape routes. |
| Who re-evaluates deferred turnaround recommendations? | Review the deferral reason, risk assessment and authorization for continued operation. |
Application at Korean sites
Comparable work in Korea is subject to the Rules on Occupational Safety and Health Standards, MOEL Ordinance No. 450, effective 2026-03-02. The following concerns present work; findings about the incident depend on its investigation and proceedings.
For chemical equipment and associated systems, determine the investigation and planning scope under Article 38. The method should address whether leaking piping can be isolated and how remaining fluid and pressure are removed after shutdown.
Article 277 specifies checks before use after repair or alteration and for changes of use, including feedstock. Connect corrosion review and maintenance records to return-to-service authorization.
Article 278 addresses task direction, prevention of hazardous material or hot-steam leakage, and flammable atmosphere testing during specified disassembly or internal work. First determine whether the proposed task falls within its scope.
Article 279 requires immediate work stoppage and evacuation where an imminent fire or explosion danger exists. It also requires restricted access and signs until the danger is confirmed absent.