The CSB's BP-Husky safety video: 3,712 alarms, a 24-hour abnormal operation, and a release the operators mistook for water

On 30 September 2026 the U.S. Chemical Safety Board released a new safety video, Alarming Mistakes, Deadly Decisions: Fatal Fire at BP-Husky, on the fire that killed two workers — brothers employed at the refinery — at the BP-Husky refinery in Oregon, Ohio on 20 September 2022. The video distils the agency’s investigation into a sequence that process-safety teams will recognise, because none of its individual pieces is exotic.

What happened

A process upset developed in the refinery’s naphtha hydrotreater unit and was allowed to run for roughly a day before it became catastrophic. Liquid naphtha backed up and overflowed into a fuel gas mix drum — equipment meant to handle gas, not liquid hydrocarbon. Workers then drained liquid from the system to the ground, apparently having mistaken the flammable naphtha for an amine-water solution. The resulting vapour cloud travelled to a furnace and ignited at 6:46 p.m., producing a flash fire.

The detail that frames the CSB’s account is the alarm count. Between early morning and the evening of the ignition — a span of about 24 hours — operators received 3,712 alarms. As CSB Board Member Sylvia Johnson put it, “this tragic incident unfolded over 24 hours with more than 3,700 alarms that sounded.” The investigation points to four contributing threads: an alarm flood that outran the operators’ capacity to distinguish the signal that mattered; the management of a prolonged abnormal situation; a communication breakdown in which decisions reached in a leadership discussion never reached the incoming night shift; and safeguards — procedural and organisational — that were not adequate to the stress of the event.

Reading the findings as a study checklist

The transferable lessons sit at the boundary where a hazard study meets the control room and the shift.

The first is alarm rationalisation as a safeguard-integrity question. Studies routinely credit “operator responds to high-level/high-pressure alarm” as a layer of protection. That credit is only as good as the operator’s ability to see and act on the alarm in the conditions the scenario actually produces. An upset that generates thousands of alarms is precisely the condition in which a single credited alarm disappears into the flood. It is worth asking, where a team leans on alarm-plus-operator-response, whether the alarm has been rationalised and prioritised, whether the plant has a defined response to an alarm flood, and whether the credited action survives the degraded state the deviation creates.

The second is the abnormal operation as its own study object. The failure here did not unfold at steady state; it unfolded over a long, deteriorating upset with liquid going where the design never intended it. Non-routine and degraded modes — a unit limping through an upset, a drum receiving the wrong phase, material being drained manually to an unexpected destination — are exactly the states a node-by-node, normal-operation HAZOP can under-examine. Bringing prolonged upset scenarios and manual intervention explicitly into scope, and asking what the operator is expected to do and whether they can, is where this case earns its place.

The third is human factors at the point of action. Draining a line to grade on the belief that the liquid is a benign water solution is a misidentification failure: labelling, sampling before draining, destination controls, and the clarity of what any given line actually contains in an off-normal line-up. The CSB’s emphasis on stop-work authority and on “adequate policies, procedures, and safeguards to effectively manage highly stressful abnormal situations” is a reminder that the organisational layer — who can halt the job, and whether the oncoming shift inherits an accurate picture — is part of the safeguard set a study implicitly assumes is sound.

The CSB’s full investigation materials and the video are available through the agency’s release. For facilitators and revalidation teams, it is a compact case on the difference between a safeguard that exists on paper and one that holds in the conditions the hazard actually creates.