The BP Texas City facility is the third-largest oil refinery in United States. The refinery had been in operation since 1934 and had not been well maintained for several years. BP acquired the Texas City refinery as part of its merger with Amoco in 1999 and subsequently took over operation of the plant.
On March 23, 2005, a fire and explosion occurred at the refinery, killing 15 workers and injuring more than 170. The explosion occurred during the start-up of an isomerization unit14. The sequence of events started with a raffinate splitter tower15 which overfilled and led to the opening of relief valves. This allowed flammable liquid to escape through the blowdown stack system which was not equipped with a flare. The release of flammable products on the ground caused a vapour cloud which ignited near mobile office trailers.
Figure 8 Tower overfill and blowdown drum hydrocarbons release
Despite the numerous previous fatalities at the Texas City Refinery, 23 fatalities over 30 year with 3 in 2004 alone, BP had failed to take necessary measures to identify various failings in equipment, risk management, staff management, working culture at the site, maintenance and inspection, and general health and safety assessments.
14
The isomerization unit converts the chemicals pentane and hexane into isopentane and isohexane in order to boost the octane rating of gasoline.
15
Synopsis of the event
An overnight shift crew stopped the start-up of a raffinate splitter tower before the operation was completed which was contrary to established procedures. In the process, the tower level control valve was left closed. In addition, the night shift start-up activities were not properly communicated to the following crew.
On the morning of March 23, 2005, the raffinate splitter tower was restarted for the second time. Operators began to pump hydrocarbon liquid while ignoring that an “open maintenance order” had been issued for the tower’s instrumentation system. During pumping, critical alarms and control instrumentation provided false indications and failed to alert operators of high levels in the tower.
Figure 9 Heating of feed in the splitter tower
Overfilling and rapid heating of the column caused the sub-cooled hydrocarbon liquid to flow out of the top of the tower into an overhead line. The pressure in the line triggered three relief valves which discharged into a blowdown drum. When the blowdown system filled, flammable liquid was discharged to the atmosphere from the stack and fell to the ground.
The liquid falling onto process equipment, structural components and piping enhanced the evaporation and the formation of the flammable vapour cloud. An idling diesel truck served as ignition point. The vapour cloud explosion created a blast pressure wave which killed 15 contract employees and injured 180.
Key Findings
A series of events, miscommunication and lack of observance of existing procedures contributed to the overfilling of the tower.
1. Poor shift turnover communication
BP did not have a shift turnover communication requirement for the operation. Thus, the morning shift was not properly informed of the initial start-up and the condition the unit was left in.
2. Deficient mechanical integrity program
Mechanical integrity deficiencies led to the start-up of the tower without proper equipment.
The mechanical integrity program did not incorporate necessary training, tools and oversight.
Equipment data sheets were not kept up-to-date. Inadequate instrumentation:
The tower level indicator and redundant high level alarm did not activate and it was not equipped with automatic safety devices.
The instrumentation was malfunctioning and did not provide the control room with adequate information.
Problems with instruments were not tracked so proper corrective actions were not taken.
Appropriate methods and procedures were not used for testing the instruments. 3. The lack of supervisory / management job knowledge
The lack of supervisory oversight and technically trained personnel led to the omission of the Pre Start-up Safety Review (PSSR) checklist which needed to be completed and signed to authorize start-up. Experienced supervision and personnel is critical after a turnaround.
4. Work overload
Fatigue was also a factor. Isomerization unit operators had worked 12-hour shifts for 29 consecutive days or more.
Operators and maintenance personnel had excessive overtime rates over an extended period prior to the accident.
5. Poor training and competence The Board Operator Training16
program did not adequately provide a simulator and the tools to practice abnormal operations such as start-ups, overfill scenarios and unit upsets. In 2004 a Competency audit revealed that isomerization unit operators had no individual
operator development plan.
In response to cost reduction requests from London executives, Texas City refinery management implemented a series of cost-reduction actions that resulted in the elimination of a budget allowance for increasing the competency of current operators. 6. Outdated procedures and deviation
Outdated and ineffective procedures did not address the changes that were made to the start-up process over time; encouraging operators to deviate from established procedures. Operators relied on knowledge passed down from veteran operators and developed informal work practices.
In addition, the isomerization unit start-up procedures did not specifically indicate that the process had to be reinitiated if stopped.
The day of the accident, managers did not effectively implement the Pre Start-up Safety Review policy to ensure nonessential personnel were removed from the area during the start-up.
Managers relied on an ineffective compliance-based system to complete paperwork with a “check the box” tendency for safety procedure. Whether the procedure was followed or not, once an item was checked off it was forgotten.
7. Poor design
The Blowdown drum was undersize and the design did not address the potential of a large liquid release.
Several projects proposed to remove the blowdown stack that vented directly to the atmosphere to replace it by connections to a flare system; however none were implemented mainly due to cost reductions.
16
BP Board Operator Training consisted of new-hire basic operator training; a two-day generic troubleshooting course; computer-base tutorials; and on-the-job training.
8. Failure to learn from past incidents
Similar overfill incidents occurred previous to the accident with eight serious releases of flammable material from the isomerization unit blowdown stack but the incidents were not investigated.
9. Confusion between occupational safety and process safety
The use of personal injury rate as a safety measure was not the proper indicator to prevent and reduce process safety incidents.
10. Ineffective management of change
Trailers which were located close to process units for convenience during turnaround were transitioned from temporary to semi-permanent without the necessary management of change (MOC) procedure and approval.
BP Group and Texas City management did not effectively evaluate the safety implications of major changes. Changes were informally assessed or not assessed at all for their potential impact on safety and health.
Cost-cutting measures and failures to invest in infrastructure, equipment, safety, training and staff, combined with production pressures, contributed to the deterioration of integrity and reliability at the refinery.
11. Deficient corporate oversight
The board of directors did not provide proper oversight of BP’s safety culture. Throughout the refinery, the reporting of bad news was not encouraged and incidents were not effectively investigated and corrective actions were not taken.
Numerous surveys, studies and audits identified safety problems but BP managers at all levels did not respond accordingly.
12. Regulatory issues
Lack of enforcement by OSHA (Occupational Safety and Health Administration) and EPA (US Environmental Protection Agency) which had an infrequent inspection plan. Planned inspections were based on high frequency, low consequence injury data. OSHA
did not conduct inspections which would identify high consequence accidents related to process issues.
Insufficient numbers of inspectors were qualified to conduct Program Quality Validation (PQV). As a result unqualified inspectors were used to inspect the refinery.
Analysis
Policy and Commitment - The “Getting Health, Safety, and the Environment Right” policy was
intended to provide a business-wise management system and its performance was the responsibility of Business Unit Leaders. The policy did not require process safety performance reporting and therefore, serious safety failures were not reported to top management. Policies and procedures were generally not followed. Overall, leadership demonstrated a lack of commitment to safety.
Planning - Although a HAZOP study and following revalidations were performed in the
isomerization unit, the hazard identification and risk assessment were poor and failed to provide identification of and protection against major hazards. The hazards of overfilling distillation towers were not well understood by management and operation personnel.
The design and setting of the safety controls resulted in risk management being focused on reducing high-frequency, low consequence personal injuries. In addition, incentives were geared toward production performance indicators and with poor attention to process safety.
Implementation - Mergers and cost-cutting measures served as a platform where the
organizational structure was decentralized and responsibilities delegated to business segments. However these changes led to a reduction of management and protection programs.
Management of change assessment should have been followed to analyze the safety impact of major reorganizations, reduction of personnel, changes in roles and responsibilities, upgrade and modifications to the plant and occupied trailers. When used, the management of change process led to findings which were not effectively implemented.
The training program for operations personnel was inadequate and did not provide the appropriate tools to manage abnormal situations, or to verify operators’ knowledge and qualifications. Budget and staff reductions directly affected the delivery of training by eliminating the central training organization of the refinery.
Miscommunications during the start-up were the result of a lack of emphasis from management on the importance of safety in communications. The absence of a communication policy meant that information was not clearly and appropriately communicated at shift changes.
Procedures were used as guidance and were not enforced. Management encouraged deviations to established procedure by allowing changes without Management of Change analysis. Procedures often had insufficient instructions or were outdated and did not reflect changes made over time. A deficient documentation control of protection programs put at risk the safety of operations.
Process unit start-ups and shutdowns are significantly more hazardous periods compared to normal operations. They require that all policies, management and protection programs to be implemented.
The normal operations did not provide for a safe environment. The computerized control system was poorly designed and had malfunctioning instrumentation. In addition, there was no policy that took into account human fatigue. Procedures were not appropriately updated which led to the development of informal practices to prevent delays. Also, procedures for upsets or abnormal operations were incomplete; there was inadequate training for start-up conditions and insufficient staffing to handle the workload during start-up.
Checking and Corrective Actions - The maintenance management software was implemented
without advanced features for feedback, reporting and detailed tracking, and preparation of trend reports or verification that work had been completed. There was not adequate equipment inspection and maintenance of monitoring instrument.
Numerous warning signals were received by management regarding mechanical integrity, process safety and negative impact of budget cuts. However, no effective corrective and preventive actions were developed from the reports. Complete historical records for process review or accident investigations were not available. BP had no formal process of communicating lessons learned from accidents.
Even though BP implemented a computational program to report process parameters to management and implement corrective action if required, the reporting feature was never activated. In addition, the frequency and duration of operating out of limit parameters that could trigger actions were not recorded as part of the program. A poor record management system is a platform to deviate from procedures.
Audits primarily focused on management systems, not verifications of actual practices at the refinery. The results of the audits were reported to management but no corrective action plan was developed.
Management Review - The lack of oversight and safety leadership led to the development of
informal practices which did not adequately assess safety issues. There was a lack of decisions, actions and commitment which led to an ineffective safety program.
REFERENCES
[1] Royal Commission on the Ocean Ranger Marine Disaster. Report One: The Loss of the
Semisubmersible Drill Rig Ocean Ranger and its Crew. St. John's: The Royal Commission,
(1984-1985).
[2] International Nuclear Safety Advisory Group, Safety Series No. 75-INSAG-7, The
Chernobyl Accident: Updating of INSAG-1, International Atomic Energy Agency, Vienna,
(1992)
[3] Commission to the USSR State Committee for the Supervision of Safety in Industry and Nuclear Power (SCSSINP), Causes and Circumstances of the Accident at Unit 4 of the
Chernobyl Nuclear Power Plant on 26 April 1986, Moscow, (1991).
[4] The Hon Lord Cullen, The Public Inquiry into the Piper Alpha Disaster, Vol. 1-2, (November 1990)
[5] Justice K. Peter Richard, Report of the Westray Mine Public Inquiry, The Westray story:
a predictable path to disaster, Vol. 1-2, (November 1997)
[6] Sir Daryl Michael Dawson, Mr Brian John Brooks, Longford Royal Commission, The
Esso Longford Gas Plant Accident, (June 1999)
[7] Columbia Accident Investigation Board, Report Volume 1, (August 2003)
[8] U.S. Chemical Safety and Hazard Investigation Board, Investigation Report: Refinery