Tesoro Anacortes made heat-exchanger metallurgy and process-hazard review an industrial accountability test

Summary

• At about 12:30 a.m. on 2 April 2010, a nearly forty-year-old heat exchanger in the Anacortes refinery's naphtha hydrotreater ruptured while workers were switching a process stream between parallel exchanger banks. Hot hydrogen-rich hydrocarbons released and ignited. Seven Tesoro employees died.
• The U.S. Chemical Safety Board concluded that high-temperature hydrogen attack severely cracked and weakened carbon steel in the exchanger shell. Its investigation found that actual temperature and hydrogen conditions were not adequately verified, process-hazard analyses did not effectively control the hazard, difficult-to-detect damage was addressed through inspection rather than inherently safer metallurgy, and too many workers were exposed during a hazardous non-routine operation.
• Washington issued extensive workplace-safety citations that Tesoro contested and that changed through a long administrative and judicial process. Federal prosecutors separately closed a criminal investigation without charges for limited public evidence evidence. Those outcomes must remain distinct from the CSB's preventive safety findings.
• Industry guidance and company programmes changed, but the CSB regarded part of API's response as unacceptable. Washington's refinery-specific PSM requirements became effective in December 2024. Durable accountability now requires equipment-level proof that actual operating envelopes, damage reviews, material choices, inspection competence, worker participation and exclusion zones function in the field.

A maintenance switch exposed an aging pressure boundary

The Anacortes refinery processed crude oil on March Point in Washington State. In the naphtha hydrotreater, process streams containing hydrogen passed through parallel banks of heat exchangers. Operators periodically switched flow from one bank to another so equipment could be cleaned or returned to service. The activity was familiar, but it created a transient: pressures, temperatures, flow and leakage behaviour changed while people manipulated valves and watched equipment.

At about 12:30 a.m. on 2 April 2010, the shell of heat exchanger E ruptured catastrophically. The federal Chemical Safety Board's investigation page records that hot, flammable hydrogen and naphtha were released and ignited during the switching operation. Seven employees were fatally injured. The equipment had been in service for nearly four decades.

The event was not an ordinary maintenance injury magnified by chance. A pressure boundary lost strength over years, the degradation was not reliably identified, and the switching task placed a group of workers close enough to the release for consequences to be catastrophic. Prevention therefore required several linked controls: suitable metallurgy, representative process data, damage-mechanism review, effective inspection, leak response, task design, staffing, isolation and exclusion.

The immediate fire demanded emergency command, medical response, isolation and environmental assessment. Yet the long accountability test begins before ignition. Who knew the exchanger's material and heat treatment? Which temperatures and hydrogen partial pressures represented its life? How were excursions captured? What did earlier leaks mean? Which standard governed the assessment? Who could replace carbon steel, stop the switch or keep nonessential personnel away?

These questions were distributed among Tesoro management, engineers, inspectors, operators and contractors; Washington's occupational-safety regulator; federal environmental and investigative agencies; industry standards organisations; and worker representatives. Distribution of work can add expertise, but it cannot leave the integrity decision ownerless.

High-temperature hydrogen attack was the central damage mechanism

High-temperature hydrogen attack, or HTHA, occurs when atomic hydrogen diffuses into susceptible steel at elevated temperature and pressure and reacts with carbides to form methane. Methane cannot diffuse readily out of the metal. It forms voids and fissures, decarburises material and progressively reduces strength. Damage often concentrates near welds and heat-affected zones, where residual stress and microstructure matter.

The CSB's final investigation report concluded that HTHA had severely cracked the carbon-steel exchanger shell and led to rupture. Metallurgical examinations found extensive damage. The conclusion was a safety-investigation finding based on physical evidence, process history and expert analysis. It was not a criminal verdict, and the CSB does not assign criminal guilt.

The exchanger's carbon steel had not been post-weld heat treated. The refinery had treated its operating conditions as below the carbon-steel line in API Recommended Practice 941, commonly represented by Nelson curves. Yet HTHA occurred. That made two weaknesses visible: actual equipment exposure was not captured adequately by a comfortable nominal point, and the empirical industry boundary did not guarantee immunity for non-PWHT carbon steel.

A damage mechanism that can progress internally for years demands a lifecycle record. The record should include material certificates, weld maps, heat treatment, repairs, actual metal temperature, hydrogen partial pressure, transients, excursions, previous inspection coverage and any industry alerts. Each component needs an equipment-specific susceptibility decision rather than inheritance of a generic unit label.

The safest response is not always better detection. HTHA can be difficult to find and size before advanced damage. Higher-alloy metallurgy that resists the mechanism can eliminate or substantially reduce dependence on uncertain inspection. Where replacement cannot occur immediately, conservative operating limits, validated specialised examination and a time-bound retirement plan should be explicit interim controls.

Nominal conditions concealed the history that steel experienced

Pressure equipment does not experience the value printed on a simplified process diagram. It experiences temperature and hydrogen partial pressure that vary with throughput, feed, fouling, control performance, startups, shutdowns and switching. Skin temperature may differ from a nearby stream indicator. Historical databases may average away peaks. A single selected point can therefore place equipment below a curve while its real life includes more damaging exposure.

The CSB found weaknesses in how actual process conditions were verified for the Anacortes exchangers. A defensible assessment should identify each relevant data tag, location, calibration and sampling interval; calculate hydrogen partial pressure from representative composition and pressure; establish metal-temperature uncertainty; and include credible transients. Missing periods should increase uncertainty rather than be filled with benign assumptions.

Data governance matters because long-latency mechanisms outlive software and personnel. Tag names change, historians are replaced, instruments move and retention windows expire. A refinery should preserve integrity-critical raw data for the equipment life plus a justified period. Migrations need reconciliation, and calculation code needs version control. An engineer revisiting a 35-year-old exchanger must be able to reconstruct exposure without trusting a chart whose origin is unknown.

Integrity operating windows convert the analysis into action. Limits should state normal, alert and shutdown bands; identify the responsible role; define response time; and record every excursion through closure. If a limit depends on metal rather than process temperature, the measurement or conservative translation must be documented. Repeated alerts should trigger a damage review and management of change, not become a tolerated operating pattern.

Management also needs aggregation. One exchanger near a susceptibility boundary is a component issue; dozens indicate a portfolio and capital issue. The board-level view should show inventory completeness, unresolved condition uncertainty, time above limits, inspection confidence and replacement schedule. It should not average high-risk aging equipment with newer alloy units until the signal disappears.

Nelson curves were guidance, not a guarantee of immunity

API RP 941 has long organised industry experience on steels in hot hydrogen service. Nelson curves plot temperature and hydrogen partial pressure boundaries associated with reported experience. Such guidance is valuable, but its empirical basis depends on the quality, completeness and representativeness of reports. Voluntary reporting can miss failures, near misses and operating histories.

After reports of unexpected cracking below the then-current carbon-steel curve, API issued an industry alert describing concerns for non-PWHT carbon steel and highly stressed equipment. The alert encouraged owners to reconsider inspection plans and risk assessments and to report experience. It was a warning, not a mandatory replacement order or an admission concerning a particular company.

An operating point below a curve should never be read as proof of no HTHA. The horizontal and vertical uncertainty in actual conditions, metallurgical variability, weld residual stress and exposure duration all matter. A design margin can reduce risk, but an undocumented customary margin is not an enforceable barrier. Existing equipment may have accumulated damage before a new margin is adopted.

Standards governance should disclose the status of each provision. “Should” guidance allows judgement; a mandatory regulatory incorporation may change legal effect. Owner procedures can be more conservative. Engineers need to record which edition applied, which curve and margin were used, and how later incident data affected the decision. Silent reliance on an older edition is a configuration failure.

The CSB's 2016 status analysis of its API recommendation concluded that the eighth edition did not meet the recommendation's intent and closed the item as unacceptable action. API had revised the curve for non-PWHT carbon steel, but the Board remained concerned about permissive language, unquantified margins and reliance on inspection rather than inherently safer material. “Closed” in that category did not mean the safety objective was achieved.

Inspection could not carry a burden beyond its capability

Advanced ultrasonic methods can identify HTHA, but detection and characterisation depend on equipment geometry, access, surface condition, damage stage, procedure and examiner skill. Early microstructural damage can be difficult to distinguish. A sample of accessible points may not represent welds or heat-affected zones elsewhere. Inspection therefore needs a defined probability of detection and consequence-informed coverage.

The Anacortes lesson is not that inspection has no value. It is that inspection should not be the sole control for a catastrophic mechanism that may evade it. A programme needs a susceptibility assessment, qualified procedures, appropriately trained examiners, calibration blocks, blind quality checks and independent review of ambiguous signals. Repeating a weak method more often does not create confidence.

Coverage maps should show the exact area scanned and limitations. Raw data should be retained, not only a “no relevant indications” summary. Later technology or expert review may reveal patterns that the original analyst could not. Equipment repairs and insulation removal should update the map. Areas that remain inaccessible need a separate disposition.

Inspection intervals should be derived from damage rate and detection threshold with uncertainty, rather than copied from a generic table. If the time from reliably detectable damage to rupture cannot be bounded with margin, inspection is not a suitable primary barrier. Replacement, operating reduction or engineered containment becomes necessary.

The same principle applies to regulator review. An inspector cannot validate every waveform during a site visit, but can test whether the owner has a complete susceptible-equipment inventory, qualified methods, raw records, independent competence and timely disposition. Sampling should focus on equipment where the company's analysis is most consequential or uncertain.

Process-hazard analysis failed when assumptions were not challenged

Process hazard analysis is intended to assemble process knowledge, identify scenarios, evaluate safeguards and assign actions. It fails when the team starts from an unsupported assumption that equipment is not susceptible, treats a standard boundary as absolute, or focuses on immediate operational deviations without considering gradual materials degradation.

At Anacortes, the CSB found that PHA assumptions contributed to ineffective hazard evaluation and that damage-mechanism review, integrity operating windows and PHA needed stronger cross-linking. The Board's current recommendation record shows the different addressees and statuses across 16 recommendations. A status page is important traceability, but it must be read item by item: closure categories do not all mean the same thing.

A damage mechanism review should precede or inform the PHA. Corrosion and materials specialists identify credible degradation based on material, fabrication, service and actual exposure. The PHA then asks how loss of containment can develop, what detects it, who may be exposed and which safeguard is independent. Integrity operating windows carry the assumptions into daily control. Management of change feeds process or material changes back through all three.

Actions must retain their original hazard context. A recommendation to verify temperature cannot close merely because a new tag was installed; the tag must represent the relevant metal condition, enter the historian, drive an alarm and affect the HTHA assessment. A recommendation to review metallurgy cannot close with a meeting minute; each susceptible component needs disposition.

Independent facilitation helps challenge normalisation. Teams should include operators, maintenance, inspection, materials, process engineering, emergency response and worker representatives. The strongest question is often simple: what evidence would make this assumption wrong? When a prior leak, below-curve industry failure or uncertain data answers that question, the hazard analysis must change.

Maintenance switching needed transient analysis and worker exclusion

Switching between exchanger banks changed the process and required coordinated valve movements. Leaks during startup or switching had become familiar enough that multiple workers gathered to observe or respond. Familiarity can reduce sensitivity even when each recurrence is evidence of degraded containment or an unstable procedure.

Non-routine operating procedures should identify line-up, valve sequence, pressure equalisation, expected response, abnormal indicators, communication and abort criteria. A competent person should verify the configuration. Where possible, the task should be automated or performed remotely, with instrumentation allowing diagnosis outside the release zone.

Staffing is a barrier decision. Only essential people should enter a credible fire or explosion radius. Each person needs a defined role. Supervisors should challenge congregation around a leaking or changing system. Exclusion zones can be based on consequence analysis and marked or controlled during the task. The need for extra observers may indicate that instrumentation or procedure is inadequate.

Leak response must be conservative. A recurring small leak is not a normal startup feature when hot hydrogen and flammable hydrocarbons are present. The system should stop, isolate, depressurise and investigate under predefined conditions. Workarounds and clamps need engineering approval and life limits. Recurrence should trigger root-cause and equipment-family review.

Drills should test loss of containment during switching, including ignition and instrument failure. Operators need authority to abort without production penalty. Emergency isolation should be reachable from a protected location, and drainage, firewater and detection should reflect the actual release. The objective is to prevent rupture, while ensuring a rupture does not require workers to approach the source.

Safety culture was visible in accepted leaks and exposure decisions

Safety culture is not a survey score detached from equipment. It appears in which anomalies become normal, whether conservative material choices receive capital, whether operators can stop a unit, and whether bad news reaches senior leaders. The CSB treated accepted leakage, worker congregation, unverified process conditions and ineffective assumptions as connected organisational evidence.

The Board recommended a process-safety culture continuous-improvement programme with tripartite oversight involving management, worker representatives and regulators. Its status record for the union participation recommendation documents closure as acceptable action in 2018. That finding supports implementation of the specified participation action; it does not prove permanent cultural effectiveness at every shift or successor operation.

Surveys can reveal fear of reporting, production pressure and weak learning, but they require protection, representative participation and follow-up. Results should be analysed by role and work group without identifying individuals. Leaders must publish actions and return to the workforce with evidence of completion. Repeated surveying without visible change increases cynicism.

Hard indicators should accompany perceptions: overdue PHA actions, repeated leaks, temporary repairs, operating-window excursions, stop-work use, near-miss quality, maintenance deferral and time to replace susceptible equipment. Incentives should reward hazard elimination and reporting, not low injury counts that can suppress disclosure.

Contractors and union representatives need access to relevant process-safety information. They often see scaffolding constraints, insulation damage, abnormal vibration or procedural drift. Reporting channels should route observations into the same equipment record as formal inspections. Protection against retaliation and a documented response make participation operational rather than ceremonial.

State enforcement and appeals required procedural precision

Washington's Division of Occupational Safety and Health investigated under the state plan and issued 44 citations with an initial proposed penalty of approximately $2.39 million. The federal OSHA public inspection record currently displays five serious and 39 willful initial items, later procedural events and materially reduced current penalty values. The page also says the inspection has not been indicated as closed.

Those fields must not be frozen at issuance or simplified into a claim that all initial allegations became final. Tesoro contested the citations. Administrative and court proceedings addressed which items and classifications could stand, with procedural decisions over many years. An initial willful classification is an agency allegation until final order; a reduced penalty may reflect litigation, legal rulings or settlement and does not rewrite the CSB's technical findings.

The accurate accountability ledger records each citation, standard, alleged conduct, classification, proposed penalty, contest, decision, remand, settlement or final disposition. It should also record abatement independently, because a company can correct a condition while contesting legal characterisation. Conversely, a legal win on wording does not prove the equipment was adequately controlled.

Enforcement duration is a governance risk. Long appeals protect due process but can obscure the public record and delay precedent. Regulators should publish clear case status, final orders and which safety actions remain required. Employers should preserve evidence and continue protective measures rather than treating a contest as permission to defer obvious risk reduction.

Inspection databases also contain limitations and occasional narrative anomalies. Users should rely on citation documents and decisions for precise holdings, not infer more than the fields establish. The current public values are valuable traceability, but they do not replace the full administrative record.

Federal prosecutors closed the criminal investigation without charges

Federal criminal investigators reviewed the explosion, interviewed employees, examined documents and consulted experts. In August 2014, the U.S. Attorney's Office announced that it had closed the investigation without charges because evidence did not meet the standard for a federal criminal prosecution. The official DOJ release explicitly described limited public evidence evidence to support charges under federal environmental and worker-safety law.

That is a consequential legal outcome. It must not be rewritten as a conviction, deferred prosecution or proof of criminal conduct. It also does not overturn the CSB's safety findings, which answer a preventive question under a different statute and evidentiary purpose. Safety recommendations can be well founded even where prosecutors cannot prove each criminal element beyond a reasonable doubt.

Civil claims, workers' compensation, workplace citations and recommendation implementation occupy still other lanes. A family may receive a remedy without a public trial admission. A regulator may establish a violation under an administrative standard that would not support criminal charges. A company may improve equipment while disputing causation or classification. Combining them into a single verdict weakens accuracy.

Evidence sharing should preserve these boundaries. Prosecutors can use technical reports, but make independent charging decisions. Safety investigators need candid cooperation and focus on prevention. Regulators need enforceable records. Families deserve clear explanations of why outcomes differ. Institutional legitimacy depends on stating that a tragic, preventable safety failure is not automatically a prosecutable federal crime.

The no-charge decision also reinforces the need for noncriminal accountability tools. Equipment standards, inspection authority, worker participation, public recommendation tracking and civil remedies protect people without waiting for proof of criminal intent. Their effectiveness should be measured directly rather than judged by whether a prosecution occurred.

Emergency and environmental response supplied a separate evidence stream

The rupture released hot hydrocarbons and created a refinery fire. Facility responders and public agencies had to account for workers, control the unit, protect adjacent equipment and assess releases. EPA's official incident response page records federal mobilisation under environmental authorities and coordination at the site. Its early wording reflected information available while three injured workers remained hospitalised; later all seven deaths were established.

Emergency records should preserve alarm times, isolation, firewater, air and water monitoring, agency notifications and command decisions. These data can help reconstruct event progression, but response activity is not the same as causal investigation. An environmental agency's presence does not itself establish a statutory violation or quantify every release.

Responder safety requires preplans for hydrogen-service units, isolation points, vessel inventories and escalation. A damaged exchanger can expose adjacent equipment to flame and heat. Remote depressurisation, drainage and fireproofing should be tested. Mutual-aid partners need current site information without depending on readable labels in smoke or darkness.

Community communication should distinguish immediate protective advice from investigation updates. Early facts will change; agencies should timestamp corrections. Nearby businesses and residents need contact points for odor, debris or damage reports and later access to monitoring results. Confidential business information can be protected without withholding the meaning of public-health measurements.

Environmental compliance history should not be casually used to prove the explosion. A later national Tesoro and Par Clean Air Act settlement covered multiple refineries, including Anacortes, and alleged air-program violations with extensive controls. It is a negotiated consent decree addressing specified environmental claims, not an adjudication that those claims caused the 2010 rupture.

Recommendation status required reading beyond open and closed

The CSB issued recommendations to Tesoro, API, Washington institutions and the United Steelworkers. Some sought equipment and programme changes; others sought revisions to RP 941, refinery-specific PSM rules, safer-material evaluation and culture oversight. Tracking their status allows the public to see response, but category meaning is crucial.

Tesoro's recommendation to implement future API action was later designated no longer applicable after the Board rejected API's response to the linked recommendation. The status-change summary explains that Tesoro revised procedures, while the underlying industry response remained reliant on inspection and did not satisfy the CSB's desired prevention approach. “No longer applicable” was not a declaration that HTHA risk disappeared.

Recommendation assurance should preserve original text, recipient response, staff evaluation, Board vote, status rationale and supporting evidence. A dashboard that shows only a green closed icon can equate acceptable action with unacceptable action or administrative closure. That is materially misleading.

The owner should maintain a local crosswalk even after a federal recommendation closes. Which exchangers were replaced? Which remain carbon steel? What actual condition data were recovered? Which PHA and damage-review links were tested? Which operating limits trigger shutdown? Closure at the Board level does not retire the equipment-level safety case.

Standards bodies also need incident-data governance. Reports should capture material, heat treatment, weld condition, complete exposure history, damage location, detection method and consequence. Confidentiality can protect proprietary detail while allowing independent technical learning. A voluntary database with unknown underreporting cannot support a claim of zero risk below a line.

Washington's refinery PSM reform shifted toward prevention

The Anacortes explosion became part of a wider argument that generic process-safety rules had not kept pace with refinery knowledge. Federal OSHA's 2013 process-safety request for information cited the disaster and Washington's enforcement while seeking views on modernisation. A request for information is not a final rule and should not be described as one.

Washington later completed refinery-focused changes. L&I's rulemaking status page records that updated safety standards became effective on 27 December 2024. The rules introduce or strengthen refinery-specific systems including damage mechanism review, hierarchy-of-controls analysis, human factors, root cause, safety culture and programme management, with implementation schedules.

The reform's preventive value lies in integration. A damage review identifies HTHA susceptibility; a hierarchy analysis asks whether metallurgy can eliminate it; the PHA evaluates release and exposure; operating windows preserve conditions; mechanical integrity verifies the barrier; management of change updates the record; and worker participation supplies challenge. Missing links should be auditable violations, not informal coordination gaps.

L&I's adoption announcement described the goal as proactive elimination and reduction of risk rather than reaction. Regulatory aspiration is not field outcome. Refineries need trained people, capital, data and time to complete required assessments. The regulator needs specialists able to examine metallurgy, human factors and complex safeguards.

Implementation reporting should use staged denominators: covered processes, damage reviews due and completed, hierarchy analyses, overdue actions, susceptible equipment retired, worker-participation findings and regulator sampling. Transitional deadlines should be visible. “Rule effective” must not be confused with “every required programme fully mature.”

Inherently safer design changed the burden of proof

The hierarchy of controls asks first whether a hazard can be eliminated or reduced at the source. For HTHA, more resistant alloy metallurgy can remove dependence on finding small internal damage in susceptible carbon steel. Lower temperature or hydrogen partial pressure may reduce exposure if the process can reliably stay within a conservative envelope. Inspection and alarms remain useful, but they sit lower in the hierarchy because they depend on detection and response.

An inherently safer decision is not automatic. Higher-alloy equipment has fabrication, welding and other degradation considerations. Replacement work introduces shutdown and construction risk. The comparison should examine lifecycle risk, not imply that one material is immune to every mechanism. The conclusion needs materials expertise, verified service conditions and quality assurance.

Where the owner rejects replacement, the record should state the alternatives, consequence, uncertainty, cost, schedule and accountable approval. “Industry practice” is not enough when incident evidence has undermined the underlying assumption. A time-limited deferral should identify interim operating margin, inspection technique and shutdown threshold. Renewal of the deferral requires new evidence.

Capital governance should group susceptible equipment. Replacing one exchanger after failure is obvious; finding every component with similar material, heat treatment and exposure is preventive learning. The inventory should include piping, vessels and exchangers across units and sites. Acquired refineries require the same review even when records are incomplete.

The CSB's final-report approval announcement described the Board's public vote and prevention emphasis. A public meeting and adopted report make the agency's findings authoritative within its safety mandate, but they do not make the Board a court or impose every recommendation directly as law.

Procurement specifications should carry the decision into hardware. Purchase orders need material grade, heat treatment, positive material identification, weld procedures, examination, data books and acceptance hold points. Field substitutions require management of change. A resistant-material strategy fails if an undocumented carbon-steel component enters the system during repair.

Oversight capacity had to match refinery complexity

Refinery process safety is difficult to inspect because risk resides in interactions among materials, process history, procedures and organisation. A regulator needs more than a walk-through checklist. It needs inspectors or technical support capable of testing a damage review, reproducing an operating-envelope assumption and distinguishing a documented programme from an effective barrier.

Washington's initial enforcement was publicly described at the federal level in an OSHA enforcement bulletin, which reported 44 citations and the then-proposed penalty. That contemporary release captures issuance, not final disposition. Later contest and penalty fields must be read from the evolving case record rather than using the original headline as permanent fact.

A risk-based inspection starts with the susceptible-equipment inventory. The regulator can select high-consequence components near HTHA boundaries, ask for actual exposure and scan records, and interview operators about excursion response. It can compare PHA actions with maintenance work and observe whether a switch procedure establishes an exclusion zone. This vertical slice reveals interface failure better than counting binders.

Regulator independence requires adequate staffing, training, access and escalation. State-plan arrangements divide federal and state roles, so the public should know which agency enforces which standard. Joint work with EPA or the CSB can improve knowledge, but each institution keeps its statutory purpose. Safety investigation should not be misrepresented as citation adjudication.

Enforcement quality needs its own metrics: time from inspection to citation, time to abatement, repeat findings, contested-case age, final classification and field verification. A low final penalty can reflect statutory limits or legal rulings, not low physical consequence. Publication should explain that distinction without prejudicing appeals.

Regulators also need learning systems. Findings at one refinery should trigger a documented screen of similar equipment elsewhere. Industry bulletins and CSB reports should enter inspection planning. When a standard changes, inspectors need a crosswalk and owners need time-bound transition evidence. Otherwise the system learns only at the facility that already suffered harm.

Families and communities needed remedies without evidentiary overreach

Seven families lost relatives who were working a scheduled refinery task. Colleagues experienced trauma and a changed workplace. The surrounding community confronted fire, agency activity and uncertainty about refinery risk. Accountability must recognise these effects without using grief to overstate a technical or legal conclusion.

Workers' compensation, private settlements, insurance and employment benefits can provide different remedies. Their terms may be confidential. Absence of a public amount is not evidence that no remedy occurred; a settlement is not necessarily an admission; and a payment cannot restore a life. A public ledger should state only verified categories and avoid adding confidential estimates to regulatory penalties or environmental investments.

Families need understandable access to investigation progress. Four years elapsed before the CSB final report and federal no-charge announcement. Complex metallurgy and parallel proceedings explain some duration, but agencies should communicate milestones, preserve family liaison and distinguish delay from inactivity. Draft findings should not be promised before evidence review is complete.

The community also needs continuity information. A refinery supports employment, contractors, fuel supply and local tax activity while presenting major-hazard risk. Shutdown and restart decisions should therefore state safety prerequisites and agency roles. Economic importance cannot lower the integrity threshold; safe continuity comes from alternate supply planning and controlled restart.

Washington's formal cost-benefit analysis for the refinery PSM rule documented the state's regulatory rationale, expected requirements, costs and benefits, and the history of fatal refinery events. Such an analysis supports rulemaking and shows considered tradeoffs. Its projected benefits are estimates, not proof that a specific future incident will be prevented or that each refinery has completed implementation.

Remembrance and workforce learning can coexist. Memorial activity should be family-led and separate from compliance claims. Training can explain the mechanism and control lessons without reenacting suffering or assigning unadjudicated blame. The most meaningful institutional respect is verified elimination of similar exposure.

Durable control begins with an equipment-level proof set

Each hot-hydrogen component should have a proof set that survives ownership, personnel and system changes. It begins with identity, drawings, material and weld records. It adds actual operating history, calculation of hydrogen partial pressure, temperature uncertainty, excursion record, HTHA susceptibility, applicable standard edition and conservative margin. It then links inspection raw data, competence, limitations, repairs and retirement decision.

The proof set connects to operations. Procedures reference the correct equipment and operating windows. Alarms have response owners. Switching tasks define line-up, remote monitoring, exclusion and abort. Leaks generate work orders and damage review. Changes in feed, throughput, control or metallurgy reopen analysis. Every action carries evidence of field completion.

Independent assurance samples the chain from database to plant. A verifier can select an exchanger, inspect its nameplate and weld map, reproduce exposure calculations, review scan data, observe an operating task and trace an overdue action. Discrepancies are graded by consequence and corrected across the equipment family.

Leadership receives residual risk, not compliance volume. It should see which components remain susceptible, which rely on hard-to-detect damage, where actual data are missing, where replacement is deferred and which interim controls are degrading. Capital decisions should state whose risk acceptance allows continued service and until when.

Assurance must survive commercial change. A refinery may change name, owner, software vendor, inspection contractor or maintenance strategy while the steel retains its exposure history. Transaction due diligence should therefore test whether equipment records are complete and portable. The buyer should not reset an integrity clock because a database starts fresh. Missing historic data should create a conservative disposition, funded in the acquisition plan, with regulatory visibility.

Performance review should include precursors rather than wait for another rupture. Useful measures include unexplained hydrogen-service leaks, time outside integrity windows, ambiguous scans awaiting disposition, repeat temporary repair, overdue damage reviews, exclusion-zone deviations and worker stop-work interventions. A rising count of reported near misses can reflect healthier reporting, so leaders should examine severity, response and recurrence instead of rewarding silence.

Emergency barriers also require periodic proof. Remote isolation valves need functional testing under representative conditions. Firewater, detection and communications must remain available during maintenance outages. Muster records should account for contractors and visitors. Exercises should include a release that makes the normal access route unusable and requires decision-making from incomplete instrumentation. Corrective actions then join the same accountable system as equipment-integrity actions.

Finally, public regulators need enough retained evidence to examine whether reform endures beyond an inspection campaign. Sampling plans, enforcement decisions and rule-transition milestones should be published in aggregate. A period without a major accident is welcome but statistically weak evidence for rare catastrophic hazards. Confidence comes from observing the barriers themselves and challenging the assumptions that support them.

Worker representatives and regulators need meaningful access. Proprietary process details can be controlled, but people exposed to the hazard must understand mechanism, warning, limits and stop-work rights. Public reporting can aggregate progress and enforcement without revealing security-sensitive layouts.

The Anacortes accountability test endures because every barrier was individually plausible: an industry curve, inspection, a PHA, familiar switching, experienced workers and regulatory oversight. Their assumptions did not form a reliable whole. Durable safety requires the opposite—actual conditions rather than nominal points, resistant material rather than optimistic detection, challenged analysis rather than inherited belief, and proof that no worker is asked to stand inside the consequence of an uncertainty the institution chose not to resolve.