Husky Superior Refinery: When a Turnaround Exposed a Transient Hazard

On April 26, 2018, an explosion at the Husky Superior Refinery injured 36 workers and caused roughly $550 million in damage. The U.S. Chemical Safety and Hazard Investigation Board also reported the release of approximately 39,000 pounds of flammable hydrocarbon vapor. The event happened during a planned turnaround, which makes the case especially important because the risk was not limited to routine production.

A turnaround changes the plant while people are still expected to control it. Equipment is isolated, vessels are opened, contractors arrive, temporary arrangements appear, and operating assumptions move from one phase to another. The central lesson from the CSB final report, published in 2022, is that a temporary operating state needs its own decision architecture. Normal safeguards and familiar roles cannot simply be carried forward without checking whether they still fit.

Initial scenario: the refinery was entering a different operating state

The Husky Superior Refinery was shutting down its fluid catalytic cracking unit for a planned maintenance turnaround when the explosion occurred. Approximately 800 to 900 people, including employees and contractors, were on site, according to the CSB final report.

The work was planned, scheduled, and expected. That description can create a false sense of control because a planned event still contains changing inventories, temporary boundaries, incomplete work, and decisions that depend on the current state of the process. The question is not whether the turnaround has a plan. The question is whether the plan remains valid after the plant enters the next state.

Andreza Araujo's work on safety culture makes this distinction practical. In The Illusion of Compliance, compliance is not treated as proof that the operation is controlled. A permit, procedure, or checklist matters when it changes the quality of the decision. During a turnaround, the quality test is whether the document helps people see what is different now.

Decision: the temporary hazard needed a named owner

The first leadership decision in a changing plant is to name the hazard that exists only because the plant is changing. If nobody owns that question, each group can assume that another group has already addressed it.

Transient hazards do not fit neatly inside a single discipline. Process engineering may understand the inventory, maintenance may understand the equipment condition, operations may understand the isolation sequence, and contractors may understand the workface. The risk becomes controllable only when someone with authority connects those views before the next irreversible step.

This is where a management-of-change process must do more than approve a form. The decision owner should identify what changed, which barrier is affected, what assumption is weakest, and what evidence permits continuation. If the answer is only that the work appears in the schedule, the review has not reached the hazard.

The principle also appears in Headline's guide to control ownership. A critical control is not owned by the department named in an organization chart. It is owned by the person who can keep it available, verify its condition, respond when it fails, and escalate the exposure without waiting for a meeting.

Execution: the work sequence created new interfaces

Turnaround execution produces interfaces that normal operations do not have. Contractors work beside employees, equipment changes hands, temporary configurations are installed, and multiple work fronts compete for access, isolation, and supervision.

Each interface adds a question that the operating plan must answer. Who knows the current process state? Who can confirm that the isolation still matches the work? Who can stop a job that is safe in isolation but unsafe beside another job? Who decides when the site has moved from shutdown work to restart readiness?

The CSB case is useful because it resists the comforting explanation that one worker simply made a bad choice. A refinery turnaround is a system of linked decisions. When an interface is weak, the worker at the end of the chain may be acting with incomplete information that was created much earlier by planning, supervision, engineering, or governance.

James Reason's analysis of organizational accidents gives leaders a disciplined way to read that chain. Active decisions matter, but latent conditions can sit in design assumptions, communication pathways, supervision, and assurance. An incident review that stops at the final action leaves the conditions that made the action likely in place.

Measured result: the event made the cost of transient risk visible

The measured result was not a small deviation that could be closed through a refresher briefing. The CSB reported 36 injured workers, approximately $550 million in damage, and about 39,000 pounds of flammable hydrocarbon vapor released into the air.

Those figures describe consequence, but they do not fully describe the control problem. A major-hazard event can be preceded by many decisions that look ordinary when separated from one another. The useful question is which evidence should have changed the sequence before the event, and who had the authority to require that change.

That is why leaders should not evaluate turnaround safety only through injury counts or completed actions. A credible review also examines whether isolation boundaries were verified at the right time, whether temporary configurations had owners, whether contractor interfaces were visible, and whether emergency assumptions matched the process state.

Control assurance outside the audit provides a practical companion to this case. The key test is not whether a control exists in a procedure. It is whether the control is present, understood, available, and capable of reducing the intended exposure while the work is actually changing.

What failed before the explosion: the hazard moved faster than governance

The deeper failure in a turnaround is often a timing failure. The organization may have a risk assessment, a permit system, and a management-of-change process, yet the work can move into a new state before the control review catches up.

That gap has four recognizable features. First, the plan describes the job but not the transitions between job phases. Second, ownership is assigned to a function rather than a decision-maker. Third, temporary conditions are treated as exceptions even though they are the normal reality of the turnaround. Fourth, assurance checks confirm paperwork after the exposure has already begun.

These features do not mean that every form is useless. They mean that paperwork cannot be the final proof. The proof is a timely decision supported by field evidence, a clear boundary, and an owner who can pause the work without negotiating through several layers of hierarchy.

In Safety Culture: From Theory to Practice, Andreza Araujo describes the difference between declared culture and operated culture. The Husky case makes that difference concrete. An organization may declare that safety has priority, while its operating rhythm still treats a schedule, a contractor commitment, or a restart target as harder to change than the hazard.

Generalizable lessons for high-hazard leaders

The Husky Superior Refinery case can be translated into several leadership lessons without turning it into a generic checklist.

• Review the transition, not only the task. The highest exposure may appear while the plant moves from production to shutdown, from maintenance to testing, or from isolation to restart.
• Assign decision ownership. A function can support a control, but a named person must own the decision to continue, pause, withdraw, or restart.
• Make temporary conditions visible. A temporary line, blind, vessel condition, contractor interface, or emergency assumption deserves the same seriousness as a permanent design feature when people are exposed.
• Test evidence close to the exposure. A review performed after the work is complete cannot prove that the barrier was available when it mattered.
• Escalate uncertainty as information. An unresolved condition should not be translated into confidence simply because the schedule has already been approved.

These lessons are compatible with a strong safety culture because they convert values into decision rights. They also help senior leaders distinguish between a site that has many controls and a site that can still use those controls under pressure.

What to apply in your next turnaround

Before the next turnaround begins, ask the leadership team to map the process states rather than only the work packages. For each state, record the hazardous inventory, critical isolation, temporary configuration, contractor interface, emergency assumption, and person who can stop or restart the work.

Then test one transition in the field. Choose the moment when the plant changes state and ask the responsible supervisor to explain what changed, which control is now carrying the exposure, what evidence confirms it, and who can make the next decision. If the answer depends on finding a document or calling a person who is not present, the control is not ready.

Use the first 24-hour evidence review after drills, near misses, and abnormal conditions, not only after an injury. Early evidence shows whether the organization can recognize a changed state while the sequence is still recoverable.

The Headline Podcast exists to keep these leadership questions in the open. The Husky Superior Refinery case is not a story about an unusual plant that has nothing to teach other operations. It is a reminder that planned work can create unplanned exposure when governance does not move at the same speed as the process.

A turnaround is controlled when the organization can see the transition, name the changing hazard, assign authority, and require evidence before the next step. That is how a temporary operating state remains a managed state rather than becoming the place where a latent weakness finally becomes visible.