Regulatory flaws, repeated violations put oil refinery workers at risk

Introduction

One evening last April at the Tesoro Corp.’s refinery in Anacortes, Washington, Matt Gumbel and six co-workers cautiously returned to service a stack of giant, radiator-like tubes filled with volatile hydrocarbons. The tubes, known as heat exchangers, tended to leak, especially during start-up, and workers sometimes armed themselves with long, steam-spewing lances to keep any escaping vapors from igniting.

Nearby, another stack of exchangers droned at full temperature and pressure.

Away from work, Gumbel, 34, enjoyed off-trail snowboarding and driving his turbocharged sports compact. On the job, he had a reputation as a meticulous worker. One has to be. Gasoline and other fuels are made from hot, sometimes barely contained brews of combustible substances. Gumbel knew the hazards intimately; he’d followed his father’s footsteps into a job at the refinery.

Not long after midnight, as the crew monitored the equipment being brought back online, welds on one of the exchangers running a few feet away suddenly blew, engulfing the seven workers in a fireball of naphtha, a mixture of liquid hydrocarbons. The inferno melted aluminum up to 100 feet away. Four of the workers died instantly, three later.

Paul Gumbel — Matt’s father — witnessed the explosion from about 150 yards away. The elder Gumbel seized his firefighting gear — refinery workers typically must know how to use it — and raced toward the blaze.

He spotted a dead man and two women — alive but badly burned. Then another man, still breathing but aflame. As Paul Gumbel tried to comfort the wounded, he kept thinking: Where’s Matt?

Matt was alive. Enshrouded in a fire blanket, he had managed to stumble away from the wreckage. Burns covered two-thirds of his body. Rushed by ambulance to the hospital, he survived 22 days before succumbing.

Events like the April 2 Tesoro explosion, as well as many harrowingly close calls, occur more often at the nation’s 148 refineries than is widely known. While public and government attention focuses on singularly catastrophic events, such as the BP oil spill in the Gulf of Mexico, problems quietly fester at the factories that refine the nation’s fuels — labyrinthine complexes full of hazardous chemicals that are plagued by often-preventable accidents, putting workers at risk and endangering nearby communities.

Documents reviewed by the Center for Public Integrity, along with interviews of top safety officials and refining industry insiders, confirm an array of contributing factors ranging from haphazard enforcement to resistance from a politically influential industry. An easily manipulated regulatory system allows companies to challenge citations for years and postpone mandated fixes. Despite calls for change, some refineries still run equipment to failure rather than maintaining it.

“We have a problem with the refinery industry,” said Rafael Moure-Eraso, chairman of the U.S. Chemical Safety Board, an independent government agency whose investigations of refinery accidents have uncovered a pattern of safety lapses.

“We have decreasing staff levels, disinvestment in safety, a lack of training, and accidents or near-misses — indicators of catastrophe — being ignored,” Moure-Eraso said.

At Anacortes, state regulators concluded, Tesoro hadn’t adequately inspected the welds that ruptured in 12 years — a charge the company disputes. The heat exchanger that blew in April “came apart because cracks had developed along its weld seams,” Steve Garey, a Tesoro machinist and president of the local United Steelworkers union, told the Center. “It opened up like a firecracker.”

A year before the incident, state authorities had criticized the company’s internal inspection program and warned that Tesoro’s failure to investigate near-misses “could lead to serious injury or death of employees.”

Investigators’ findings often go unheeded. Over the past five years, only 13 of 41 remedies urged by the Chemical Safety Board after refinery accident investigations have been adopted by oil companies, trade groups, and the U.S. Occupational Safety and Health Administration (OSHA), the government’s main workplace safety agency.

Almost four years ago, for example, the board recommended that union and oil industry leaders collaborate on standards to help identify possible precursors of serious accidents and restrict work hours to prevent fatigue-related mistakes; that recommendation remains unresolved.

Like the National Transportation Safety Board, which investigates transportation accidents, the chemical board can only suggest; it has no power to compel changes.

Though the refining industry represents a relatively small part of the board’s jurisdiction, nine of 17 open accident investigations involve refineries. All nine occurred within the past 37 months.

Even an industry insurer perceives an elevated risk. U.S. refineries have sustained financial losses from accidents at a rate much higher than their overseas counterparts — four times as high, according to a 2006 report by Swiss Re, the world’s second-largest reinsurer, obtained by the Center. The difference was due in part to U.S. companies “pushing the operating envelope,” the reinsurer said. Losses stemmed, among other things, from flaws in refinery design, safety procedures and employee “alertness.” In a briefing to the Chemical Safety Board last year, Swiss Re officials reported that the gap between U.S. refineries and those in other parts of the world had widened, according to two people who were present.

To be sure, refineries — industrial behemoths that transform crude oil into gasoline and other fuels — are inherently dangerous places. Workers navigate treacherous thickets of pipe. Hulking tanks and other vessels harbor superheated liquids and some of the most flammable vapors and toxic gases known to man.

“These are highly technical, highly complex things,” said Charles Drevna, president of the National Petrochemical & Refiners Association, a trade group. “We’re working with extremely volatile compounds, high pressures, high temperatures and rotating equipment.”

Although the refining industry’s safety record is “better than most,” Drevna said, “it’s a record that we have to improve upon.”

A six-month Center investigation suggests the industry may have a long way to go. Among the key findings:

• Little-noticed, seemingly minor incidents that occur regularly at refineries can provide telltale clues about big hazards. Since the beginning of 2009, at least 80 fires have broken out at 59 refineries. A fire causing as little as $2,500 in damage may flag “a weakness that can be corrected before a higher consequence event occurs,” the American Petroleum Institute, the oil industry’s main trade association, notes in a 2010 guidance document. Already this year, fires have been reported at refineries in North Dakota, Texas and California.
• Many accidents are associated with equipment failure and, possibly, deferred maintenance. Over the past decade, equipment failure was blamed for about half of the roughly 7,600 accidental chemical releases from refineries reported by companies to the U.S. Coast Guard’s National Response Center. Refiners are scheduling fewer top-to-bottom maintenance shutdowns, known as turnarounds, while increasing burdens on aging equipment to meet rising energy demands. This is sometimes called a “run-to-failure” approach — equipment pushed until it breaks.
• Larger populations may be at risk. Fifty U.S. refineries continue to use an extremely toxic chemical, hydrofluoric acid, even though a safer alternative exists. Worst-case scenarios outlined in obscure regulatory filings tally up the potential consequences of releases of the acid, which can swiftly move long distances in a cloud. Altogether, at least 16 million people live within its potential path, in or near cities such as Los Angeles, Chicago, Houston, Philadelphia and Minneapolis, as well as in rural areas of Oklahoma, Wyoming and Kentucky.
• Regulators have little sway over refineries. Between 2000 and mid-2010, refinery owners contested 53 percent of all violations cited by state or federal safety inspectors, allowing companies to put off improvements and save money. On average, some 20 months pass before a contested case is closed. No other industry with more than 1,000 violations appeals such a large proportion of findings. This ability to keep regulators at bay has benefits that go beyond dodging penalties: Except in Oregon, state and federal rules allow employers to avoid correcting even life-threatening hazards while they are challenging citations.

‘Catch me if you can’

The refining industry faces rising demand for gasoline while contending with aging facilities. Some date to the early 20th century, and no major refinery has been built since 1976. Despite obvious wear and tear, the factories are being pushed to their limits. Critics say this compels some companies, already operating on a razor-thin profit margin, to engage in a high-stakes guessing game: How long can a pump or section of pipe stay in service before it disintegrates? Is it better to keep equipment running, or shut down an entire system for preventive maintenance? Sometimes refinery managers guess wrong.

“All the units are working at higher capacity, higher pressure, higher throughput,” said Russ Elveston, a forensic engineer and safety consultant who retired from OSHA’s Houston office in 2007. “Hazards have increased simply because the units operating now produce more than they did 15 or 20 years ago. When there’s a release, the results tend to be a little more significant.”

With executives pushing for more production, meanwhile, workers can be “afraid to really report what’s wrong,” said Bob Cavnar, a longtime manager in the oil and gas industry. Result? “Years and years of deferred maintenance.”

Internal BP documents show that in the years leading up to a 2005 explosion at the company’s refinery in Texas City, Texas, which killed 15 workers, managers close to the scene agonized over safety practices at the refinery — but the message either didn’t reach or didn’t register with headquarters in London. “We have never seen a site where the notion ‘I could die today’ was so real for so very many hourly people,” reads a BP summary of interviews with Texas City workers three months before the blast. A business plan circulated eight days before the disaster noted “key risks” for 2005 — including “safety not being viewed as the #1 priority” and the prospect that the refinery “kills someone in the next 12-18 month[s].” (BP recently announced plans to sell the refinery, along with one in California, perhaps by 2013.)

The aftermath of a 2005 explosion at BP’s Texas City refinery, which killed 15 workers and injured at least 180 others. Credit: U.S. Chemical Safety BoardSafety rules are on the books, but enforcement, if it happens at all, frequently results in a standoff: A federal or state agency inspects a refinery, finds violations, issues citations … and waits. Oil companies routinely challenge even the most minor allegations, mindful that any admission of fault could haunt them if they were sued or prosecuted following an accident. When a refiner appeals, 609 days pass, on average, before the case is closed — a time frame almost 20 percent longer than the average for all industries, a Center analysis of a decade of enforcement data shows.

Even in incidents where people died and regulators cited companies for willful violations — defined by OSHA as those that involve either an intentional flouting of the law or “plain indifference” to it — companies almost always assert that the tragedies were unforeseeable. Sometimes, the enforcers simply give up: Nearly a quarter of all fines proposed against refiners from January 2000 through June 2010 were erased from the books, a dismissal rate 2 1/2 times that of U.S. industry as a whole, the Center found.

Michael Silverstein, who heads the Washington State Department of Labor & Industries’ Division of Occupational Safety and Health and is a former federal OSHA policy director, said the regulatory scheme at both the state and federal levels is flawed. “Right now, it’s a catch-me-if-you-can system, and the consequences of being caught are relatively small.”

After its inspection of the Tesoro refinery in October 2008 — 18 months before the fire that killed Matt Gumbel and his co-workers — Silverstein’s agency reduced an already-modest $85,700 fine to $12,250, and withdrew 14 of 17 alleged violations. He was, in effect, bargaining. His aim? To persuade the company to drop its appeal and fix problems that could lead to a catastrophic accident.

Silverstein said he chose results over a drawn-out quest for a bigger penalty. “As long as the case was in appeal, Tesoro had no legal obligation to correct the problems cited,” he said. The department insisted on an independent safety audit as part of the settlement.

The April 2 disaster in Anacortes brought far higher potential penalties for Tesoro — and expectations that they, too, will be whittled down. The company faces a fine of nearly $2.4 million for 44 alleged violations, 39 of which are classified as willful. The state agency alleged that Tesoro “disregarded a host of workplace safety regulations, continued to operate failing equipment for years, postponed maintenance [and] inadequately tested for potentially catastrophic damage.”

Once again, the company is appealing.

“We disagree with L&I’s [Labor & Industries’] characterization of Tesoro’s operations at Anacortes and believe — based on available evidence and scientific reviews — that many of the agency’s conclusions are deeply flawed,” the company said in a written statement to the Center. “We continue to cooperate with L&I and other investigative bodies and look forward to clarifying the facts as the process unfolds.”

Silverstein said the problems found at Tesoro are far from unique. “We as a nation do not have a good grip on this industry,” he said. “It would be one thing if these were just paper violations – refineries were being a little bit sloppy at keeping records – but there’s been an unending series of catastrophic explosions, fires, chemical releases and near-misses.”

The muddled regulatory system Silverstein laments didn’t evolve by chance. Fortified by enormous reserves of money, the oil and gas industry often gets its way. A notable exception last fall: Its failure to kill a California law requiring reductions in greenhouse gases.

In 2010 alone, the industry reported spending more than $146 million to lobby the federal government. During the 2009-2010 election cycle, it donated $25 million to federal campaigns — mostly Republican, data compiled by the Center for Responsive Politics show. The American Petroleum Institute reported spending $6.75 million on federal lobbying last year, the refiners’ association $2.76 million. Oil and gas interests spent another $41.5 million on campaign contributions in the states, which also oversee refineries and other oil company activities, during the 2009-2010 election cycle, according to the National Institute on Money in State Politics.

Over the years, the industry has fended off a variety of rules and reforms. In 2010, it had a hand in killing federal legislation that would have increased the size of civil penalties OSHA could impose, made it easier for the agency to build criminal cases and forced employers to correct hazards while contesting citations. The U.S. Chamber of Commerce — to which oil companies have contributed generously — led the charge against the bill.

Charles Drevna, president of the National Petrochemical & Refiners Association. Credit: ABCNow, leveraging the anti-regulatory mood in Washington, the industry is attacking a host of rules it must follow, most of which involve climate change but some of which involve health and safety. In a nine-page letter to Darrell Issa, the new Republican chairman of the House Committee on Oversight and Government Reform, on January 10, Drevna, of the refiners’ association, complained about a “tremendous onslaught of regulatory activity.”

“If left unchecked,” Drevna warned Issa, this onslaught could “threaten the continuation of a substantial portion of domestic refining and petrochemical production and well-paying existing American jobs, and the security of the nation.”

Fatal lapse in Anacortes

At a refinery, a heat exchanger transfers heat from one liquid to another without allowing them to mix, conserving energy that otherwise would be wasted. The exchanger that blew apart in Anacortes, known as Unit E, was put into service in 1972, four years before Matt Gumbel was born. According to the Washington Department of Labor & Industries, Tesoro last examined welds on the device — using a sophisticated method that could detect cracks — in 1998. This was the only time in the exchanger’s 38-year life that such an inspection had taken place, the department said; moreover, it found, Tesoro had tested fewer than 20 percent of the welds and focused on areas least susceptible to damage. Company records indicate that a planned 2008 inspection by Tesoro never took place, the department said.

In its statement to the Center, Tesoro said the heat exchanger that failed “was inspected regularly and was fully compliant with regulations and industry standards. The exchanger underwent external inspections once every two years and internal inspections in 1998 and again in 2005 . . .” State officials, however, say there is no evidence that the 2005 inspection was of the type that would have enabled the company to find cracks in the welds.

In its formal appeal of the state citation, the company denied that it had violated safety rules and said it might raise any number of defenses, including “unanticipated employee misconduct.”

A lawsuit filed against Tesoro on February 9 by families of six of the dead workers claims that the company pushed its heat exchangers too hard, for too long, scrimping on inspections and ignoring signs of trouble. Among other things, the lawsuit alleges that in 2001, an exchanger similar to Unit E “failed catastrophically as a result of thermal fatigue and crack propagation,” but that Tesoro “willfully disregarded” a company recommendation to inspect other exchangers for the same sorts of flaws.

“The plaintiffs’ allegations are incorrect,” countered Tesoro in its statement. The 2001 incident had different causes, the company said. Cracks “had formed through a degradation mechanism entirely different from that involved in the April 2, 2010, incident.”

The company declined in its statement to say whether the accident was preventable, as regulators asserted, instead stressing that it “deeply regrets the immeasurable impacts” the tragedy has had on workers’ families. Safety is “job number one” at Tesoro, the company added, “and we strive for continuous improvement in safety performance.”

Tesoro refinery worker Matt Gumbel. Credit: Photo courtesy of the Gumbel familyWhen the welds on Unit E popped, Matt Gumbel and his co-workers had been tending to the leak-prone exchangers being brought online after a maintenance shutdown. His father — who was working in the catalytic cracking unit, also known as the cat cracker — heard the explosion and felt the concussion.

Paul Gumbel remembers running toward the naphtha hydrotreater unit, where he knew Matt had been working. “One of the first people I saw inside the unit was obviously deceased,” Paul recalled. “It was a man … unrecognizable.” A woman was burned so badly “I was afraid to touch her.” As he tried to comfort her, he noticed another woman in bad shape, and then a second man — with flames on him. “We got him out,” Paul said. “Then I grabbed a fire hose and tried to knock the flames down.”

He stayed on the hose for 20 minutes, still not knowing his son’s whereabouts. “I had a feeling he was there [in the hydrotreater unit],” Paul said, “but nobody could answer my questions. They made me leave and go sit by a phone.” About 10 minutes later, the phone rang. Matt, the caller said, had somehow gotten out of the unit and was already on his way to Skagit Valley Hospital in Mount Vernon, Washington. By the time his parents and his 32-year-old sister, Amy, arrived at the hospital, Matt was being prepped for a helicopter ride to a Seattle trauma center. He never regained consciousness and died there on April 24.

When Paul went back to work at Tesoro in June, he felt angry and couldn’t concentrate. He lasted five days. “I had a humongous feeling of dread about even going through the gate,” he said. He began seeing a psychiatrist and was diagnosed with post-traumatic stress disorder, a product of his horrific experience. After taking medical leave, he returned to the refinery in October as an operator.

Then, another setback: A boiler backfired. It was nothing, really — and everything. Paul now works in the Tesoro garage, a less stressful environment than the cat cracker unit.

Lessons unlearned

Preventable tragedies keep occurring at refineries, despite abundant information on how to make them safer.

Many expected a 1989 explosion in Texas to bring about a sea change. That blast, so powerful it measured 3.5 on the Richter scale, started when a vapor cloud ignited at Phillips 66 Company’s Houston Chemical Complex. The explosion — which killed 23 workers and injured 132 — came not quite five years after a chemical leak at a Union Carbide pesticide plant in Bhopal, India, had killed thousands.

The Phillips blast prompted a key reform: OSHA’s adoption in 1992 of a rule requiring high-hazard industries such as oil refining and chemical manufacturing to identify risks and address them before an accident could kill, maim or unleash toxic chemicals into neighborhoods. Under the so-called process safety management standard, eventually copied by many states, companies must have in place a system of inspections, maintenance and emergency procedures to prevent catastrophic fires, explosions and chemical releases. Publicly, affected industries were supportive — for good reason, it seemed. “[W]e believe that the benefits of the program justify the investment of resources,” BP America wrote to OSHA in April 1991, noting that “the cost of a single incident can total millions of dollars in repair costs and lost production capacity, not to mention the potential impact on human life.”

While some major accidents may have been averted, the effect of the 1992 rule has been limited. For instance, it apparently didn’t dissuade BP from cutting corners and overlooking lessons of the past at its Texas City refinery, acquired from Amoco in 1998. On March 23, 2005, an old, poorly designed relief system at the refinery was overfilled with flammable hydrocarbon liquids and vapors, which poured out and ignited, causing a series of explosions and fires. Fifteen workers died and 180 were hurt.

Signs of trouble at the refinery had been plentiful but evidently ignored. In its investigation, the Chemical Safety Board found that the relief system had overflowed eight times between 1994 and 2004, well before the explosion. None of the eight incidents, the board found, had been properly investigated or acted upon.

After fining BP $21 million for the disaster, OSHA returned to the Texas City refinery in 2009 and discovered that the company had broken its promise to fix hundreds of hazards. Finding fresh cause for concern, the agency also cited BP for hundreds of new violations. Last August, BP agreed to pay $50.6 million for the 270 “failure to abate” violations and spend at least $500 million to upgrade the refinery. But the company is contesting a $31 million fine proposed by OSHA for the new violations. Four workers have died at the refinery since 2005, and the company has paid $65 million to settle criminal and civil Clean Air Act cases brought against it by the U.S. Department of Justice as a result of the 2005 blast.

In a written statement, BP said it had “systematically refurbished and inspected major process units” in Texas City and replaced the antiquated relief system since the accident. A “new culture of openness” exists within its workforce, the company said.

Missed warning signs

The problems aren’t limited to big refiners like BP-Texas City, which processes 437,000 barrels of crude oil per day. In February 2008, OSHA inspected a 58,000-barrel-per-day refinery in Tyler, Texas, operated by Delek U.S. Holdings Inc. The agency cited Delek for 16 violations and fined the company $68,250; Delek contested all 16. Two months later, three Delek workers were taken to the hospital after being burned by oil that spewed from a sewer drain. OSHA cited the company for two more violations and proposed an additional $6,300 in fines. Delek contested.

On November 20, 2008, a pipe ruptured and an explosion tore through two of the refinery’s control rooms, killing one worker and injuring four, one of whom died 13 days later. In May 2009, OSHA cited Delek for 30 violations — including a willful violation for operating the failed pipe more than five years beyond the retirement date set by the company — and proposed $217,350 in fines. Again, Delek contested.

In a deposition taken in February 2010 in connection with personal injury lawsuits filed against Delek, refinery manager Frank Simmons said an investigation by the company revealed that the accident was caused by a “localized point of very high corrosion” on the 31-year-old pipe, which carried naphtha and liquefied petroleum gas. “I really believe [it] was unforeseeable for us,” Simmons testified. He acknowledged under questioning, however, that portions of the pipe that failed were below structural minimums established by the American Petroleum Institute. A spokesman for the company declined to comment.

Throughout the industry, warning signs continue to be missed or disregarded.

On March 2, 2010, a month before the Tesoro accident in Anacortes, four contract workers were caught in a storage tank blast at the 105,000-barrel-per-day Navajo refinery in Artesia, N.M. Two of the men died and two were injured. In the 15 months leading up to the accident, company officials had reported 22 fires to the New Mexico Occupational Health and Safety Bureau. Eight of these fires occurred in January 2010 alone.

In a deposition last November, the refinery’s former health and safety manager, William Jones, said that Navajo should not have allowed the workers to weld on the tank without Navajo’s first testing it for flammable vapors.

“Would you agree that the definition of gross negligence has been met in this case, based on what Navajo failed to do?” one of the victims’ lawyers asked during the session.

“Yes,” Jones replied.

Last August, New Mexico regulators hit Navajo with a $707,000 fine. The company is appealing.

A spokesman for Navajo’s parent, the Holly Corp., declined to comment because of pending lawsuits.

Sometimes, it’s blind luck that no one is killed when a unit catches fire or blows up. The Silver Eagle refinery in Woods Cross, Utah, for example, had two major accidents 10 months apart in 2009. In January, a vapor cloud from a storage tank full of naphtha ignited, burning four workers in a flash fire. In November, a 10-inch hydrogen pipe burst, producing a 100-foot-high fireball and a concussion that damaged more than 100 homes, one of which was knocked off its foundation. Commuter rail lines pass near the refinery.

“Fortunately,” Chemical Safety Board investigator Don Holmstrom said shortly after the accident, “there was no train present during the blast.”

‘Run to failure’

Drevna, president of the National Petrochemical & Refiners Association, acknowledged the string of recent accidents in the refining industry. “Have there been incidents? Absolutely,” he said. “Do we need to correct those? Do we need to prevent those? Absolutely.” He insisted, however, that these episodes do not signal a pattern and that the industry “doesn’t take economics into consideration” when making decisions that could impact safety.

Workers interviewed by the Center disagree. They describe a climate in which safety takes a back seat to ramped-up production. Rather than schedule top-to-bottom maintenance outages, which take units out of operation for extended periods, equipment is being pushed hard, sometimes beyond its design life, the workers say. They have a term for it: “Run to failure.”

“They’re managing their shareholders’ investments,” Dave Campbell, secretary-treasurer of United Steelworkers Local 675, which represents workers at five refineries in the Los Angeles area, said of the oil companies. “The price we pay is with our lives and our health.”

For instance, Campbell said, increasing use of heavier, higher-sulfur crude has heightened dangers in coker units, generally the last stop in refining. Residual materials known as bottoms are extracted from crude in drums up to 90 feet high. To keep up production, refiners are filling, cooling and emptying the drums more often than they used to, Campbell said. This puts more stress on the metal, and can lead to cracking.

In 2003, OSHA and the U.S. Environmental Protection Agency issued an alert on the hazards of a practice in coker units that requires the use of high temperatures for long periods to upgrade low-quality crude. The agencies warned that such operations had resulted in a number of serious accidents, especially during procedures such as drum head removal.

In April 2009, as workers removed a drum head at the ExxonMobil refinery in Torrance, California, scalding water sprayed a 49-year-old operator named Nelson Tan. He survived 18 days before succumbing to second- and third-degree burns that covered 85 percent of his body. It was just the sort of scenario OSHA and the EPA had warned about in 2003.

After contesting three citations issued by the California Division of Occupational Safety & Health, ExxonMobil, which made a profit of $19 billion in 2009, paid a $24,200 fine for violations connected with Tan’s death.

In a statement, ExxonMobil said it “deeply regrets” the incident. “Safety is our first priority, and the loss of life at our facility is not acceptable, under any circumstances. We fully cooperated with the Cal-OSHA investigation. We are committed to ensuring the health and safety of all the workers at all our facilities.”

Misleading numbers

The refining industry has a better injury and illness rate than private industry as a whole. In 2009, the rate for refineries was one case per 100 full-time workers; the rate for all industries was 3.6 cases per 100. The rates were 2.9 for textile mills, 4.1 for coal mines and 7.8 for motor vehicle manufacturing plants. “The oil and natural gas industry is becoming an increasingly safer place to work, despite a job environment that often involves heavy equipment, hazardous materials, high temperatures and high pressure equipment,” the American Petroleum Institute said in a written statement. Officials at the institute did not respond to repeated interview requests from the Center.

Jordan Barab, deputy assistant secretary of labor. Credit: U.S. SenateBut low injury rates, for broken legs or wrenched backs, say little about systemic mechanical problems, such as leaking valves or corroded pipes, which can lead to fires and explosions. For example, the injury rate at BP’s Texas City refinery in 2004, the year before the deadly blast, was about one-third that of the entire refining sector. “I cannot say too strongly to industry leaders: Stop boasting about your safety records when you’re literally putting out fires,” Jordan Barab, a U.S. deputy assistant labor secretary, said at a May 2010 safety conference sponsored by the National Petrochemical & Refiners Association. “You’re only undermining your credibility. … Boasting about the great safety record of [the] refinery industry while widows and children are planning funerals doesn’t make you sound like a serious organization. And giving awards to your members based solely on a lack of slips, trips and falls doesn’t make you sound like a serious organization.”

Even limited to injuries and deaths, refiners’ safety records are misleading. They don’t include data on thousands of contract workers, who often perform the most hazardous jobs. All 15 workers killed in the BP-Texas City accident, for instance, were employed by contractors; the deaths, therefore, aren’t attributed to BP in OSHA records. In all, the Center identified 44 deaths at refineries during the past decade. Nearly three-quarters of those killed — 32 — were contract workers.

Despite a special inspection program launched by OSHA in 2007 — and mirrored by most states that have their own safety programs — problems continue to occur at refineries with stunning regularity. A Center analysis found that 24 of the 58 refineries examined by federal officials as of November 2010 had fires or explosions after the inspections were opened. On average, OSHA has issued 17 citations and proposed $166,000 in fines per refinery. Given the size and complexity of these operations, however, inspectors can comb only a fraction of each refinery. Nor does OSHA have many qualified personnel who can give the task their undivided attention. Only seven of 320 OSHA inspectors trained in the nuances of process safety management are dedicated to it full time, and they are only in one location: Houston. In addition, OSHA’s targeted inspection program is to end this year, though officials say they plan to maintain a presence in refineries.

Those who argue for stronger enforcement point to programs in Britain, which requires assiduous planning by companies and thorough reviews by regulators before oil and gas activities start, and California, which maintains a steady presence at refineries rather than simply dropping in, inspecting and writing citations.

‘He wasn’t frightened’

Shauna Gumbel tells a story about her son, Matt, when he was a toddler. As the two of them ran pre-Christmas errands and encountered a succession of Santa Clauses in their hometown of Oak Harbor, Washington, Matt noticed minor differences: One wore glasses, another gloves, and so on. “Santa can’t be everywhere,” his flustered mother improvised. “He has to have helpers.” Matt was skeptical.

“He always noticed little things,” she recalled. “He was never afraid to ask questions.”

Amy, Paul and Shauna Gumbel. Credit: Emma Schwartz/The Center for Public IntegrityMatt’s curiosity and attention to detail served him well when he became an operator at the Tesoro refinery in the fall of 2007. His father, Paul, who had worked there for six years, had encouraged Matt to apply. It was a job that played to Matt’s strengths. At a refinery — a place of incessant noise and action — the person who notices subtleties can make a big difference. An acrid odor, for instance, can signal the presence of a lethal gas. “You need to pay attention to everything you’re doing and everything that’s going on around you,” Paul said. “You never know what can go wrong.”

Nonetheless, Matt liked the work. “He wasn’t frightened,” his father said.

Outside the refinery, Matt was a risk-taker. He loved snowboarding — “not always in places he should have been,” his mother said — and driving his turbocharged 2008 Mazdaspeed3. Neither loud nor timid, “he was a thinker,” Shauna said. He was proud of the blue hardhat he earned in 2009, proof that he’d completed his Tesoro training. He and Paul would talk at length about work; Shauna would eavesdrop, not understanding the terminology but pleased to see the bond strengthening between father and son.

The night of the accident, as Paul battled the fire in the naphtha hydrotreater unit and waited for word about Matt, Shauna had the telephone ringer off while she slept at home. At about 2:15 a.m., her daughter, Amy, woke her. “There’s been an accident at the refinery,” Amy said. “Matt’s been hurt. Dad’s OK.” Shauna insisted on driving to Skagit Valley Hospital, to give her something else to focus on.

Matt was in the emergency room, awaiting transport by helicopter to Harborview Medical Center in Seattle, 60 miles to the south. Paul, Shauna and Amy took off for Seattle by car, arriving around 4:45 a.m. There, for the next 22 days, the family’s hopes rose and fell, as noted in Shauna’s online journal:

Matty is so strong … he will pull through this soon. (April 4)

Matt came through surgery well. They removed all the burned skin from his legs from above his ankles up to his thighs. (April 6)

Matt is out of surgery and they are pleased with how he did. (April 9)

He had his eyes open a little bit (April 14)

Matt had a rough night. (April 17)

Surgery went well. … [But] after Matt was brought up to his room they could not get his vital signs stable. He is now going back downstairs in emergency exploratory surgery to try and find out what is going on. (April 23)

They didn’t really know what caused the multiple organ failure and the swelling. … Matt fought a good fight and I think his body was telling us that it was tired and he didn’t have the fight left in him. (April 24)

On May 8, about 500 people, including many Tesoro workers, turned out for Matt’s memorial service at Oak Harbor High School. His sister and one of his closest friends scattered some of Matt’s ashes at his favorite place, a state park overlooking the water and the Olympic Mountains in the distance. The rest of the ashes are in an urn at Paul and Shauna Gumbel’s home.

Five days after the memorial service, Tesoro invited the family to the scene of the accident. They noticed the two heat exchanger banks, still mangled. A company official explained how Matt had walked away from the raging fire. “It was overwhelming to me just to see what it looked like,” Shauna said. “It was frightening and mind-boggling.”

Tesoro, meanwhile, appears to have rebounded from last April’s calamity. After a slight dip in the months immediately after the accident, the company’s stock price is nearly double what it was a year ago. In a December presentation, CEO Greg Goff assured Wall Street analysts that the refinery in Anacortes had been safely restarted and that “insurance recoveries [were] underway.” Markets for Tesoro’s products were improving, Goff observed. “Our strategic priorities are clear, our plan is focused and the organization is aligned,” state materials from the presentation. “We are committed to driving shareholder value.”