BP Texas City: The Refinery's Own Plan Said It Would Probably Kill Someone. It Did.

As flammable hydrocarbons overfilled the blow-down drum, ▸ The stack was 113 feet tall; only 40% of the liquid it spewed landed directly on the ground. operators nearby saw a geyser of liquid and vapor erupt from the top of the stack. The equivalent of nearly a tanker truck full of hot gasoline fell to the ground and began forming a huge flammable vapor cloud. The vapor cloud expanded in just 90 seconds, engulfing the unit and the nearby trailers full of workers.

▸ Wind was out of the northwest at 5 mph, but vapor also drifted upwind, over the trailers. About 25 feet from the base of the blow-down drum, two workers were parked in a pickup truck with the engine idling. As flammable vapor entered the air intake, the diesel engine began to race. The two workers fled, unable to shut off the engine.

Moments later, witnesses saw the truck backfire and ignite the vapor cloud. Powerful explosions swept through the area. ▸ Of the 180 injured, 66 seriously; 14 were BP employees, the rest from 13 contract firms The blast pressure wave accelerated through the ISOM unit, causing heavy destruction and igniting fires. The workers inside the trailers were right in the path of the explosions.

The fires continued to burn for hours. Twelve of the twenty occupants of the double-wide trailer were killed, along with three workers in a trailer nearby. ▸ About 70 vehicles damaged or destroyed; more than 40 trailers damaged, 13 destroyed One hundred eighty workers were injured, many with serious burns, fractures or other traumatic injuries. The wood and metal frame trailers were blown apart by the blasts.

Firefighters struggled to rescue the injured and recover the victims. Fifty large chemical storage tanks were damaged and the ISOM unit remained shut down for more than two years. The Chemical Safety Board approved its report two years later, five votes to nothing. Three hundred and forty-one pages.

This film is about what is in them. Holmstrom During the early stages of our investigation, ▸ BP directed Texas City to cut 2005 capital spending by an additional 25 percent our team had noted there were multiple safety system deficiencies at the Texas City plant. We also found there was a history of fatalities at the plant. Prior to the March 2005 accident, twenty-three people died in accidents over a thirty-year period at the Texas City Refinery.

▸ The 2005 HSSE plan warned the refinery will likely "kill someone in the next 12-18 months" Beginning when it was owned by Amoco and continuing after BP acquired the refinery in 1999. Holmstrom The CSB wanted to know what the connection was between this history of fatal incidents and the organizational and cultural factors. ▸ Nov 2004 site meeting showed photos of "the 23 workers killed at the site since 1974" BP Corporation's lack of focus on preventing major accidents allowed budget cuts to be made without assessing the impact on process safety. ▸ Its 2004 rate was "nearly one-third the oil refinery sector average" Holmstrom The CSB found that cost-cutting, production pressures and failure to invest significantly impacted the process safety performance at the Texas City Refinery and left the refinery vulnerable to catastrophe.

The drum the liquid went into was older than most of the people standing near it. In 1992 no separate funding was set aside for the work. The report gives the reason: regulations were unlikely to require it in the foreseeable future. Two years later the stack caught fire again and burned across five twelve-hour shifts.

No investigation was conducted then either. The CSB examined 19 previous startups in the five years prior to the ISOM incident ▸ In eight of those startups the tower was operated out of range for more than one hour and found in the vast majority of these startups, the operators ran a high level above the range of the level transmitter. The problem with running the level above the reading is that you don't know how high the level really is. This can lead to grossly overfilling the tower.

▸ High level alarm set-point exceeded 65 times in 19 startups; over 50 hours in high alarm But even though high levels and pressures could have led to a catastrophic accident, the previous startups were never investigated as near misses and procedural deviations became accepted as normal. The CSB investigation also found eight serious releases of flammable vapor from the ISOM blowdown drum, two of which caught fire between 1994 and 2004. Only three of the incidents were ever investigated. ▸ Two startups since 2003 likely lifted relief valves to the stack; neither was investigated Well, it's widely recognized now that you should investigate near misses, really near accidents that are called near misses, as thoroughly as you investigate accidents.

For all it's only a matter of luck whether a leak of flammable liquid or gas catches fire or not. The February 1994 release was written up. The Board says it was misreported in the event log as a much smaller incident, and that no safety investigation was conducted. Holmstrom After the merger with Amoco, ▸ Texas City's strategy: "aggressively drive costs out of the system at an accelerated pace" BP ordered a twenty-five percent reduction in fixed costs at all its refineries.

Holmstrom This impacted important process safety systems such as staffing, training and mechanical integrity. The effects of the budget cuts became apparent in a number of internal BP documents made public following the accident. In one, the refinery manager was quoted as having observed in 2002 that the infrastructure at Texas City was in complete decline. ▸ BP managers increased site performance bonuses despite the three 2004 fatalities He ordered a study of the refinery's safety and mechanical integrity, a study which was shown to BP executives in London.

That study warned of serious concerns about the potential for a major site incident following more than 80 hydrocarbon releases in the previous two years. The study also concluded that its own findings were urgent and far-reaching. A follow-up BP study in 2002 found the refinery's integrity and reliability issues were clearly linked to the reduction in maintenance spend over the last decade. The Board's finding, in its own words: budget cuts impaired process safety performance at the Texas City refinery.

In 2003, a maintenance assessment stated that ▸ Its findings were "urgent and far-reaching"; the study was shared with London executives cost-cutting measures have intervened with the group's work to get things right. Usually, reliability improvements are cut. And later that year, a company audit found the current condition of the infrastructure and assets is poor at Texas City and that maintenance spending was limited by a checkbook mentality. Only the money on hand would be spent, rather than increasing the budget.

In March 2004, BP auditors in London concluded that 35 business units around the world, including the Texas City Refinery, suffered from a host of common safety problems, ▸ In 2004 alone three major incidents at Texas City caused three fatalities including widespread tolerance of non-compliance with basic HSE or health safety and environmental rules, poor implementation of safety management systems and lack of leadership competence and understanding. There were a number of reports that were coming up to as high as the board level that indicated serious problems throughout the BP system. During 2004, the Texas City Refinery had three major accidents. In addition to this process unit fire that caused 30 million dollars in damage, two other accidents in 2004 resulted in three fatalities.

▸ Telos: "Production and budget compliance gets recognized and rewarded before anything else" Yet this same year, the refinery had its lowest ever recordable injury rate, a statistic that does not include fatalities. The CSB found that maintenance spending increased between 2003 and 2004, but most of the increases were for responding to serious accidents and complying with environmental requirements, not for preventive maintenance. Late in 2004, the Texas City Refinery manager made a presentation to supervisors titled, Safety Reality, reviewing fatalities at the plant over the past 30 years. One of the slides was entitled, Texas City is Not a Safe Place to Work.

B.P. did its own safety culture survey that was done just prior to the accident. That survey indicated there was an exceptional degree of fear among employees of a major catastrophe. Among the findings of the survey, the pressure for production, time pressure and understaffing are the major causes of accidents at Texas City.

Critical events like failures or breakdowns are generally not attended to. Production and budget compliance gets recognized and rewarded above anything else. Sociology professor Dr. Andrew Hopkins has written extensively on the causes of industrial disasters.

Nineteen ninety-nine was the first cut. The second was ordered for 2005. In between, the company wrote down what was happening to it. Eight days after that, it did.

▸ The Telos Group surveyed 1,080 employees and interviewed 112, reporting in January 2005 My feeling is that the solution to this problem of cost cutting by senior people is to hold them responsible for the safety implications of those cost cuts, so that when they order a cost cut, they should personally be able to certify that these things will not have adverse safety consequences. The safety culture survey also pointed to the exceptionally high executive turnover at the Refinery. Six different business unit leaders or BULs in seven years prior to the accident. The authors of the survey report concluded, we have never seen an organization with such a history of leadership changes over such a short period of time.

Many managers are in and out within a space of two years and what they are assessed on the basis of is the profit they make on an annual basis. Now, am I, as a manager, am I going to spend a large amount of money to deal with some remote risk that is very unlikely to generate a major accident during my year or two on, on my watch here? The survey of Texas City employees ▸ Shop test: alarm parts "worn, misaligned, and binding," likely stopping it on March 23. also found concern about safety and equipment checks potentially left undone.

There was a check the box mentality, which indicated that personnel would go through the motions with various policies and procedures, but the work would not be conducted. For example, the tower high-level alarm had been reported as not functioning several times in the two years prior to the accident. ▸ Failed at startup: transmitter, tower alarm, sight glass, vent valve, blowdown drum alarm. But maintenance work orders for this alarm were closed, although the repairs were never actually made.

Work orders could be closed out as completed, even though the work hadn't been performed. This is important because we found that on the day of the incident during the ISOM startup, there were a number of instruments and equipment that were not functioning properly. ▸ Executives cut Texas City's 2005 capital budget a further 25% despite three 2004 fatalities On February 20, 2005, a company safety manager wrote, I truly believe we are on the verge of something bigger happening. Then, three weeks later, a BP business plan recognized a number of key safety risks, including that TCS or Texas City site kills someone in the next 12 to 18 months.

Eight days later, those fears were realized. Here were these warnings. These audits were sounding very clear warnings. So why weren't they attended to?

I think my feeling is that Texas City was virtually paralyzed by the cost cutting which had occurred at that site, BP had positioned a number of portable trailers, ▸ The double-wide stood about 120 feet from the ISOM blowdown drum, with 11 contractor offices close to process units, for the use of contractors and other maintenance workers. Over a period of months, BP had located ten trailers for workers servicing the Ultra Cracker unit, including a double-wide wood-frame trailer that contained eleven offices and was regularly used for meetings. Though these trailers were located near the isomerization unit, the occupants were not warned the ISOM unit was about to start up a potentially hazardous operation. On 25 October 2005 the Board issued an urgent recommendation: get occupied trailers away from the hazardous areas of process plants.

The American Petroleum Institute agreed to write the guidelines. The first choice after an accident is to say, how can we improve the design so this can't happen? How can we remove the opportunity for errors? Even as releases occurred over many years in the ISOM Unit, BP continued using equipment based on outdated designs.

The raffinate splitter tower lacked modern design safeguards. Such as redundant level indicators and alarms, a differential pressure indicator and automatic interlocks to prevent overfilling. In a well-designed plant, a simple error at closing their own valve shouldn't result in an accident. The design of the emergency pressure relief system was also outdated.

Relief valves vented hydrocarbons directly to the atmosphere through an antiquated blowdown drum, which was first installed in the 1950s. The CSB report said the hydrocarbon should have been routed to an inherently safer disposal system, such as a flare to contain the hydrocarbon liquid and burn off flammable vapor. In fact, the investigation found that Amoco's own safety standards, later adopted by BP, stated that new blowdown stacks, which discharge directly to the atmosphere, are not permitted. As facilities were upgraded, existing blowdown systems, which are still necessary, should be replaced.

Several occasions prior to the incident, BP had seriously considered connecting a flare to the ISOM Unit. In the early 1990s, when Amoco owned the refinery, three proposals were made to replace blowdown stacks at Texas City. At 2.15 a.m. on March 23rd, overnight operators began introducing flammable liquid hydrocarbons, ▸ The transmitter read only a 5-foot span within the bottom 9 feet of the 170-foot tower known as raffinate, into a 170-foot-tall raffinate splitter tower used to distill and separate gasoline components.

Near the base of the tower, there was a single instrument that measured how much liquid was inside. It transmitted this information to both a satellite control room and a central control room located away from the ISOM unit. But this level indicator was not designed to measure liquid above the nine-foot mark. ▸ Only one of 19 startups kept level within transmitter range and pressure within alarm limits During normal operation, the tower was only supposed to contain about six and one-half feet of liquid.

But during start-ups, operators routinely deviated from written procedures and filled the tower above the nine-foot mark, concerned that if the liquid level fluctuated too low, it would cause costly damage to the furnace. At 3.09 a.m., as the liquid neared the eight-foot mark, a high-level alarm activated and sounded in the control rooms. But a second high-level alarm, slightly further up the tower, failed to go off. ▸ CSB concluded "fatigue of the operations personnel contributed to overfilling the tower" By 3.30 a.m., the level indicator showed that liquid had filled the bottom nine feet of the tower and the feet was stopped.

The CSB later estimated that the liquid was, in fact, at a height of 13 feet. But operators could not know the actual level, because the indicator only measured up to nine feet. The lead operator had been overseeing the start-up from a satellite control room within the ISOM unit. At 5 a.m., he briefly updated the night board operator in the central control room about the start-up activities.

The lead operator then left the refinery early, an hour before the end of the shift. ▸ Report: "none of the PSSR procedural steps were undertaken for the ISOM startup" A new board operator arrived in the control room around 6 a.m. to start his 30th day in a row, working a 12-hour shift. He spoke briefly with the departing night shift operator and then read the logbook to prepare for the start-up.

But the logbook did not clearly indicate how much liquid was already in the tower and equipment and it left no instructions on routing of the liquid feed and products when the start-up resumed. Instead, the control board operator only found a one-line logbook entry ▸ BP cut Texas City capital spending 25% for 2005, after three fatal accidents there in 2004 that said, ISOM brought in some RAF to unit to pack RAF with. At 7.15 a.m., the day shift supervisor arrived. Because he was more than an hour late, he received no formal briefing from personnel on the night shift about conditions in the ISOM unit.

At 9.51 a.m., operators resumed the start-up. They began recirculating the liquid feed and adding more liquid to the already overfilled tower. As new feed was added, start-up procedures called for regulating the liquid level in the tower ▸ BP had no operator fatigue program — only a method for truck drivers' road accidents using the automatic level control valve. But the board operator and others had received conflicting instructions on routing the product.

As a result, this critical valve was left closed for several hours, blocking the flow of liquid from the tower. A few minutes later, operators lit burners on the furnace to begin heating up the feed, part of the normal start-up process. While the start-up was underway, the day supervisor left the refinery on short notice, just before 11 a.m., to attend to a family medical emergency. Everything above is the ground the day was standing on.

This is the day. Contrary to BP's own procedures, no experienced supervisor was assigned to replace him. ▸ The transmitter read only a 5-foot span in the bottom 9 feet of the 170-foot tower. This left a single control board operator, now without a qualified supervisor, to run three refinery units, including the ISOM unit, which needed close attention.

The refinery had eliminated a second board operator position following corporate budget cuts in 1999, after BP acquired Amoco. As the start-up continued, the tower steadily filled with liquid, reaching a height of 98 feet shortly before noon, more than 15 times the normal level. ▸ Level sight glass "had been nonfunctional for several years"; no backup to check the tower. But the improperly calibrated level indicator told operators in the control room that the liquid was at 8.4 feet and gradually falling.

Furthermore, the control panel was not configured to clearly warn operators of the growing danger. It did not display flows into and out of the tower on the same screen, nor did it calculate the total liquid in the tower. Meanwhile, the maintenance contractors, who were not involved in the operation of the ISOM unit, left their work trailers to attend a company lunch, celebrating a month without a lost time injury. At 1241 p.m., an alarm activated as the rising liquid compressed the gases remaining in the top of the tower.

▸ At 12:41 p.m. tower pressure rose to 33 psig; the crew blamed the bottoms overheating. Unable to understand the source of the high pressure, operators opened a manual chain valve to vent gases to the unit's emergency relief system, a 1950s-era blow-down drum that vented vapor directly into the atmosphere. Operators also turned off two burners in the furnace to lower the temperature inside the tower, believing this would reduce the pressure.

Nobody knew the tower was dangerously full. The operators did become concerned about the lack of flow out of the tower ▸ Procedure allowed 50°F per hour; from 10 a.m. to 1 p.m. the feed heated at 73°F per hour.

and began opening the valve to send liquid from the bottom of the tower to storage tanks. But this liquid was very hot. As it flowed through the heat exchanger, it suddenly raised the temperature of the liquid entering high up the tower by 141 degrees Fahrenheit. It was now about 1 p.m.

Contract workers, unaware of the start-up and the looming danger, returned from lunch and began a meeting in the double-wide trailer, in the corner room closest to the blow-down drum. Over the next few minutes, the hot feed entering the tower caused the liquid inside to start to boil and swell. ▸ The drum's only high level alarm failed: a damaged level displacer, or "float". Liquid filled the tower completely and began spilling into the overhead vapor line, exerting great pressure on the emergency relief valves 150 feet below.

At 1.14 p.m., the three emergency valves opened, sending nearly 52,000 gallons of flammable liquid to the blow-down drum at the other end of the ISOM unit. Liquid rose inside the blow-down drum and overflowed into a processed sewer, setting off alarms in the control room. But the high-level alarm on the blow-down drum failed to go off. None of the operators knew of the catastrophe unfolding in the ISOM unit.

In particular, the board operator was likely suffering from fatigue, ▸ Day Board Operator had worked 12-hour shifts, seven days a week, for 29 consecutive days including acute sleep loss and a cumulative sleep debt of more than 43 hours. We determined that BP had no fatigue prevention policy and in fact there was no fatigue prevention policy in the industry as a whole. Companies and employees may believe they benefit from overtime schedules, particularly during maintenance turnarounds, but operator fatigue can have deadly consequences. Our final report recommended that the United Steel Workers and the American Petroleum Institute develop new guidance on preventing fatigue in the petrochemical industry, including limits on hours and days at work.

OSHA's 1992 Standard on Process Safety Management, or PSM, requires thousands of oil and chemical facilities to implement 14 management elements to prevent catastrophic releases. The Environmental Protection Agency has similar requirements under its Risk Management Program. The CSB investigation revealed many long-standing deficiencies in the BP refinery's compliance with federal process safety regulations. Preventive maintenance and testing procedures were inadequate for key alarms, instruments and equipment.

Required safety studies of pressure relief systems were years overdue. Operating procedures were out of date and there were other flaws. Management of change reviews were not conducted for critical design, equipment and procedural changes. Hazard analyses were poor, overlooking serious fire and explosion risks.

Audits revealed many process safety problems, but they were never resolved. Nine months after Texas City, at BP's refinery in Whiting, Indiana, a distillation tower was overfilled during a startup. There was a fire, and there was damage. The Board's timeline records it as the last entry, on 13 December 2005, and says nothing more about it.

It was headed by former Secretary of State James A. Baker III. The panel found that BP did not ensure, as a matter of best practices, that its management implemented a comprehensive and effective process safety management system. The report, issued in 2007, concluded there were instances of a lack of operating discipline, toleration of serious deviations from safe operating practices and apparent complacency towards serious process safety risks at each of BP's North American refineries.

The Baker panel also voiced concern that other companies share similar problems. Ladies and gentlemen, we are under no illusion that such deficiencies are in fact limited to BP. One of the things that I'd like to see personally, after having served on the Baker panel, is that we will never have another incident of this magnitude, the number of people that were killed, the number of lives that were changed. So many good, hard-working people go to work every day, and too often some never return.

I think the work that we did in the Baker panel, I believe that if our work is applied within our industry, we will not see another BP explosion. The Baker panel report concluded that the restructuring following BP's merger with Amoco had resulted in a significant loss of people, expertise and experience in the refining sector. Only much later did BP recognize the negative impact of these changes. The CSB's final report said all hazardous chemical operations should be required to review the safety impact of major organizational changes.

The Board recommended that OSHA amend its Process Safety Management Standard to require management of change reviews for mergers, acquisitions, personnel reductions, There is a saying that organizations have no memory. Only people have memory. ▸ Process safety expert Trevor Kletz: "The lost time rate is not a measure of process safety" Once they leave the plant, the accident, the code there is forgotten about. And what companies must do in the petrochemical industry is realize that the fact that you've had 20 years without a catastrophic event is no guarantee that there won't be one tomorrow.

You have to keep your eye on the ball constantly. All oil and chemical businesses should seek to learn from the tragedy at BP. The CSB believes there are key lessons to be drawn from our investigation. The CSB said managers, executives and boards of directors should do the following.

▸ Baker Panel: BP "does not effectively measure and monitor process safety performance" Monitor process safety performance using appropriate indicators. Invest sufficient resources to correct problems. Maintain an open and trusting safety culture where near misses are reported and investigated. Ensure that non-essential personnel and work trailers are located a safe distance from hazardous process areas.

Ensure equipment and procedures are maintained and up to date. Carefully manage organizational changes and budget decisions to ensure safety is not compromised. Analyze and correct the underlying causes of human errors, ▸ Jan. 16, 2007 Baker Report: issues exist "at all five U.S.

refineries, not just Texas City" including fatigue and miscommunication. Finally, boards of directors must exercise their duty to ensure that the highest standards of safety are met. The BP tragedy was years in the making, but it was by no means inevitable. We hope our investigation will provide all of industry with valuable lessons to assure such a tragedy will not be repeated.

For the CSB's final report, key investigation documents, the Baker Panel Report and other ▸ BP's Chief Executive and Board "did not exercise effective safety oversight." information, please visit the Chemical Safety Board website at CSB.gov. BP cooperated with the CSB investigation and provided documents and witnesses voluntarily. After the Texas City accident, BP acted to relocate trailers, eliminate blowdown drums and invest billions of dollars to upgrade the condition of its U.S. refineries.

In 2007, BP accepted the recommendations of the Baker Panel, including a call to become a recognized industry leader in process safety management.