This year marks the 20th anniversary of the deadly refinery explosion at the Texas City BP refinery. While the event was incredibly tragic, it did teach us some very important engineering lessons.
On March 23, 2005, an explosion and fire occurred at the refinery’s isomerization unit. The raffinate splitter was restarted after a month-long shutdown. The raffinate splitter is part of the isomerization unit. The splitter was over-filled and over-heated. A vapor cloud formed at the blowdown drum and vent at the top of the stack. A running engine from a vehicle parked at the unit was all the spark needed to ignite the cloud and cause the explosion, killing 15 people and injuring 180 others.
The U.S. Chemical Safety Board (CSB) determined that “organizational and safety deficiencies at all levels of the BP Corporation caused the March 23, 2005, explosion at the BP Texas City refinery.” Ultimately, BP’s negligence resulted in $21 million in penalties. CSB also reported that OSHA needed to step up inspection and enforcement efforts at U.S. oil refineries and chemical plants—especially to ensure companies appropriately address and analyze safety impacts following mergers, reorganizations, downsizing, and budget cuts.
Three key lessons learned from this event include:
- Lesson 1: Prioritize Safety Culture
- Lesson 2: Improve Process Safety Management
- Lesson 3: Implement Redundancy Protocols
This article will take a closer look at each and explore how engineers can be a catalyst for change and advocate for safety in ensuring that an accident such as this does not occur out of negligence.
Lesson 1: Prioritize Safety Culture
Critical safety alarms were inoperable and others that worked were ignored. Previous near misses from prior startups were swept under the rug. There was a general lack of sufficient leadership, failed communication, and inadequate training that was attributed as the primary cause of the BP explosion in Texas City.
High Turnover in Leadership
Following the BP Amoco merger, the company experienced sufficient turnover leading to a lack of experience and poor decision-making during operational crises. BP did not have a dedicated safety officer at the executive level to provide adequate oversight and resources to implement and promulgate an effective Process Safety Management (PSM) system.
BP Lacked a Learning Culture
The company lacked a learning culture where previous investigations could be used as training moments to prevent repeated mistakes. A learning culture investigates accidents or incidents in such a way to determine the root cause beyond “human/operator error.” Operator errors can be skill-based errors, mistakes, or negligence/violations. It is important to understand the difference. Skills can be taught, and mistakes can be avoided. A learning culture encourages professional development and an openness to change.
Out-of-Date Operational Procedures
Operational procedures were not up-to-date, and startup procedures relied on tribal knowledge known as having previous experience and knowledge based on informal work practices. Field operators must be included in the development of operating procedures. Procedure must also include automations and inclusion of modern technologies.
Process safety metrics were not measured
Leading and lagging indicators should be used to determine organizational health. Lagging indicators examine historical data to highlight areas for improvement. Leading indicators use routine checks or audits to improve future performance. When these measures are adequately evaluated, they will expose any issues with faulty alarms or other processes.
Lesson 2: Improve Process Safety Management
The purpose of the PSM system is to prevent unwanted release of chemicals or energy into the environment or business that could harm human health and life. PSM systems are tailored to the specific operations, hazards, and business strategy of organizations, meaning they are site and company specific. PSM is required by OSHA. In this case, BP was driven by production over safety, and as a consequence, there was a breakdown of many of the PSM components.
Negligent Review of Management of Change
Management of change (MOC) is a component of OSHAs 29 CFR 1910.119 PSM regulation. Changes in management and organizational structure occur often at chemical plants and should trigger an MOC. Even small changes can introduce new hazards. The MOC process includes identifying changes, assessing hazards, developing controls, implementing changes, and documentation.
In Texas City, the contractor trailers (non-essential personnel) were placed in a hazardous zone without MOC approval. Budget cuts, which did not require a MOC had a trickledown effect on the mechanical integrity of the plant. The MOC should include:
- Anything that is not like-for-like replacement.
- A regular review and assessment.
- Testing MOC effectiveness using leading and lagging key performance indicators (KPIs).
- Provisions that temporary changes must be included and reviewed and reassessed for continuation.
- Peer-reviewed changes and authorization before implementation.
Inadequate Pre-startup Safety Review (PSSR)
A Pre-startup Safety Review (PSSR) is another component of the PSM. It is a systematic and thorough checklist to identify and manage any potential risks before hazardous materials are introduced to a process. The PSSR is the final check to make sure that the system is “a go” and the necessary safety components are in place.
Lesson 3: Implement Redundancy Protocols and Equipment
Poor maintenance practices and testing contributed to the disaster, including multiple mechanical failures. Many facets associated with the explosion should have been caught with redundant systems in place. The raffinate splitter tower level indicator was incorrectly calibrated. Redundant high-level alarms were not functioning and did not sound. The sight glass was not maintained, which prevented the manual verification of the raffinate level. The manual vent valve was not operational, nor was the high-level alarm on the blowdown drum.
BP lacked a mechanical integrity program to ensure equipment was maintained and in safe condition and operational. This includes training, so workers know how to inspect the equipment regularly and what to look for when systems need upgrades or repairs. Automation should be employed where applicable to act as one more layer of protection.
Lack of modernization and neglect of routine maintenance and inspection led to the disaster on March 23, 2005
Conclusion
The alarms that were operational fell on untrained ears. Critical level alarm on the raffinate tower was known to be unreliable. The equipment that should have been working was not. Redundancy was either not functioning or not built into the system. And at 1:20 pm on March 23, 2005, there was a deadly explosion at the Texas City BP refinery. Despite multiple long-term PSM deficiencies, no changes were made.
A tragedy like this can be avoided with proper training and adherence to modern engineering practice. The goal of continuous learning and ongoing training is to prevent similar disasters.
McKissock Learning takes a deep dive into preventable tragedies to identify areas where engineers can make improvements that affect lives. We are committed to learning from events like the Kansas City Hyatt Regency Walkway Collapse and the BP Refinery Explosion. These types of elective courses are shaping our industry and having a positive impact.
