3. The Need for Process Safety
3.1 Process Safety Culture: BP Refinery Explosion, Texas City, 2005
3.1.1 Summary
An explosion occurred within the Isomerization Unit (ISOM) of BP’s Texas City Refinery during a startup after a turnaround in March 2005. Fifteen contractors were killed and over 170 people harmed. There was major damage to the ISOM and adjacent plant and equipment.
The portable plant buildings where the contractors were located were being used to support an adjacent plant turnaround. They were in an area operated as an uncontrolled area, i.e., a safe area without any Hot Work Permit/Electrical controls imposed (CCPS, 2008).
3.1.2 Detailed Description
See Figure 3.2 for a diagram of the ISOM system. The following excerpt from the CSB report describes the incident:
During the startup, operations personnel pumped flammable liquid hydrocarbons into a distillation tower for over three hours without any liquid being removed, which was contrary to startup procedure instructions. Critical alarms and control instrumentation provided false indications that failed to alert the operators of the high level in the tower.
Consequently, unknown to the operations crew, the 170-foot (52-m) tall tower was overfilled and liquid overflowed into the overhead pipe at the top of the tower.
The overhead pipe ran down the side of the tower to pressure relief valves located 148 feet (45 m) below. As the pipe filled with liquid, the pressure at the bottom rose rapidly from about 21 pounds per square inch (psi) to about 64 psi. The three pressure relief valves opened for six minutes, discharging a large quantity of flammable liquid to a blowdown drum
Figure 3.2. Process flow diagram of the Raffinate Column and blowdown drum, source (CCPS, 2008).
with a vent stack open to the atmosphere. The blowdown drum and stack overfilled with flammable liquid, which led to a geyser-like release out the 113-foot (34 m) tall stack. This blowdown system was an antiquated and unsafe design; it was originally installed in the 1950s, and had never been connected to a flare system to safely contain liquids and combust flammable vapors released from the process.
The released volatile liquid evaporated as it fell to the ground and formed a flammable vapor cloud. The most likely source of ignition for the vapor cloud was backfire from an idling diesel pickup truck located about 25 feet (7.6 m) from the blowdown drum. The 15 employees killed in the explosion were contractors working in and around temporary trailers that had been previously sited by BP as close as 121 feet (37 m) from the blowdown drum (CSB, 2007).
Figures 3.3 and 3.4 show the damage to the unit and the portable buildings, respectively.
3.1.3 Causes
The BP investigation concluded “that while many departures to the startup procedure occurred, the key step that was instrumental in leading to the incident
Figure 3.3. Texas City Isom Unit aftermath, courtesy CSB.
Figure 3.4. Portable buildings destroyed where contractors were located, courtesy CSB.
was the failure to establish Heavy Raffinate rundown to tankage, while continuing to feed and heat the tower. By the time the Heavy Raffinate flow was eventually started, the Splitter bottoms temperature was so high, and the liquid level in the tower so high, that this intervention made matters worse by introducing significant additional heat to the feed.” (CCPS, 2008).
The investigation team concluded that the Splitter was overfilled and overheated because “the Shift Board Operator did not adequately understand the process or the potential consequences of his actions or inactions on March 23.”
3.1.4 Key Lessons
Many Risk Based Process Safety Elements were involved in the BP Texas City explosion. Five are listed here. The bulleted findings below are taken directly from the CSB report unless noted otherwise.
Process Safety Culture (Section 2.2). Process safety culture is the first of 20 risk based process safety elements (see Chapter 2). Perhaps most striking of the CSB findings are those with respect to the process safety culture at BP and the Texas City plant. Listed below are some of the CSB’s findings regarding BP’s process safety culture. Some of these findings could easily apply to other companies. The CSB recommended that BP create an “independent panel of experts to examine BP’s corporate safety management systems, safety culture, and oversight of the North American refineries.” This became known as the Baker Panel. The Baker Panel report focused on safety management systems at BP and resulted in ten recommendations to the BP Board of Directors (BP Review Panel, 2007).
Selected CSB findings:
“Cost-cutting, failure to invest and production pressures from BP Group executive managers impaired process safety performance at Texas City.
The BP Board of Directors did not provide effective oversight of BP’s safety culture and major incident prevention programs. The Board did not have a member responsible for assessing and verifying the performance of BP’s major incident hazard prevention programs.
Reliance on the low personal injury rateat Texas City as a safety indicator failed to provide a true picture of process safety performance and the health of the safety culture.
A “check the box” mentality was prevalent at Texas City, where personnel completed paperwork and checked off on safety policy and procedural requirements even when those requirements had not been met.”
Selected Baker Panel finding:
“BP has not instilled a common, unifying process safety culture among its U.S. refineries. Each refinery has its own separate and distinct process safety culture. While some refineries are far more effective than others in promoting process safety, significant process safety culture issues exist at all five U.S. refineries, not just Texas City. Although the five refineries do not share a unified process safety culture, each exhibits some similar weaknesses. The Panel found instances of a lack of operating discipline, toleration of serious deviations from safe operating practices, and apparent complacency toward serious process safety risks at each refinery.”
Process Knowledge Management (Section 2.7). BP acquired the Texas City refinery as part of its merger with Amoco in 1999. Neither Amoco (the previous facility operator) nor BP replaced blowdown drums and atmospheric stacks, even though a series of incidents warned that this equipment was unsafe. In 1992, OSHA cited a similar blowdown drum and stack as unsafe, but the citation was withdrawn as part of a settlement agreement and therefore the drum was not connected to a flare as recommended. Amoco, and later BP, had safety standards requiring that blowdown stacks be replaced with equipment such as a flare when major modifications were made. In 1997, a major modification replaced the ISOM blowdown drum and stack with similar equipment but Amoco did not connect it to a flare. In 2002, BP engineers proposed connecting the ISOM blowdown system to a flare, but a less expensive option was chosen.
Training and Performance Assurance (Section 2.13)
A lack of supervisory oversight and technically trained personnel during the startup, an especially hazardous period, was an omission contrary to BP safety guidelines. An extra board operator was not assigned to assist, despite a staffing assessment that recommended an additional board operator for all ISOM startups.
Supervisors and operators poorly communicated critical information regarding the startup during the shift turnover; BP did not have a shift turnover communication requirement for its operations staff. ISOM operators were likely fatigued from working 12-hour shifts for 29 or more consecutive days.
The operator training program was inadequate. The central training department staff had been reduced from 28 to eight, and simulators were unavailable for operators to practice handling abnormal situations, including infrequent and high hazard operations such as startups and unit upsets.
Management of Change (Section 2.14)
BP Texas City did not effectively assess changes involving people, policies, or the organization that could impact process safety. For example, the control room staff was reduced from 2 people to one, who was overseeing three units.
Local site Management of Change rules required that where a portable building was to be placed within 100 meters (350 ft) of a process unit a Facility Siting Analysis had to be carried out. However, this location had already been used many times for these trailers. Not doing an effective MOC put all the people in the portable buildings at unnecessary risk (CCPS, 2008).
Asset Integrity and Reliability (Section 2.11)
The process unit was started despite previously reported malfunctions of the tower level indicator, level sight glass, and a pressure control valve.
Deficiencies in BP’s mechanical integrity program resulted in the “run to failure” of process equipment at Texas City.
3.1.5 References and Links to Investigation Reports
CSB, 2007. U.S. Chemical Safety and Hazard Investigation Board, Investigation Report, Report No. 2005-04-I-TX, Refinery Explosion and Fire. BP Texas City, Texas. March 23,
2007(http://www.csb.gov/investigations).
U.S. Chemical Safety and Hazard Investigation Board, Video - Anatomy of a Disaster, (http://www.csb.gov/videos).
BP Review Panel, 2007. The Report of the BP U.S. Refineries Independent Safety Review Panel, January 2007, (Baker Panel).
(http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english /SP/STAGING/local_assets/assets/pdfs/Baker_panel_report.pdf).
CCPS, 2008. “Incidents That Define Process Safety”, Center for Chemical Process Safety, New York 2008.
CCPS, Process Safety Beacon, Facility Siting, March 2010 (http://sache.org/beacon/products.asp)
CCPS, Process Safety Beacon, Instrumentation – Can You Be Fooled By It?, (http://sache.org/beacon/products.asp)