iDRM Home » Key Concepts » iDRM Training Modules » 6 - Accident Causation: Models and Theories » Exercise on recent accidents - BP Texas City Refinery  · 

Exercise on recent accidents - Case 1: BP Texas City Refinery

Incident:
On March 23, 2005, at 1:20 p.m., the BP Texas City Refinery suffered one of the worst industrial disasters in recent U.S. history. Explosions and fires killed 15 people and injured another 180, alarmed the community, and resulted in financial losses exceeding $1.5 billion. The incident occurred during the start-up of an isomerization (ISOM) unit when a raffinate splitter was overfilled; pressure relief devices opened, resulting in a flammable liquid geyser from a blow down stack that was not equipped with a flare. The release of flammables led to an explosion and fire. All of the fatalities occurred in or near office trailers located close to the blow down drum. A shelter-in-place order was issued that required 43,000 people to remain indoors. Houses were damaged as far away as three-quarters of a mile from the refinery.

The BP Texas City facility is the third-largest oil refinery in the United States. Prior to 1999, Amoco owned the refinery. BP merged with Amoco in 1999 and BP subsequently took over operation of the plant.

Incident Description
On the morning of March 23, 2005, the raffinate splitter tower in the refinery's ISOM unit was restarted after a maintenance outage. During the startup, operations personnel pumped flammable liquid hydrocarbons into the tower for over three hours without any liquid being removed, which was contrary to startup procedure instructions. Critical alarms and control instrumentation provided false indications that failed to alert the operators of the high level in the tower. Consequently, unknown to the operations crew, the 170-foot (52-m) tall tower was overfilled and liquid overflowed into the overhead pipe at the top of the tower.

The overhead pipe ran down the side of the tower to pressure relief valves located 148 feet (45 m) below. As the pipe filled with liquid, the pressure at the bottom rose rapidly from about 21 pounds per square inch (psi) to about 64 psi. The three pressure relief valves opened for six minutes, discharging a large quantity of flammable liquid to a blow down drum with a vent stack open to the atmosphere. The blow down drum and stack overfilled with flammable liquid, which led to a geyser-like release out the 113-foot (34 m) tall stack. This blow down system was an antiquated and unsafe design; it was originally installed in the 1950s, and had never been connected to a flare system to safely contain liquids and combust flammable vapors released from the process.

The released volatile liquid evaporated as it fell to the ground and formed a flammable vapor cloud. The most likely source of ignition for the vapor cloud was backfire from an idling diesel pickup truck located about 25 feet (7.6 m) from the blow down drum. The 15 employees killed in the explosion were contractors working in and around temporary trailers that had been previously sited by BP as close as 121 feet (37 m) from the blow down drum.


Root cause of accident:

  • BP Group Board did not provide effective oversight of the company's safety culture and major accident prevention programs. Senior executives:
  • inadequately addressed controlling major hazard risk. Personal safety was measured, rewarded, and the primary focus, but the same emphasis was not put on improving process safety performance;
  • did not provide effective safety culture leadership and oversight to prevent catastrophic accidents;
  • ineffectively ensured that the safety implications of major organizational, personnel, and policy changes were evaluated;
  • did not provide adequate resources to prevent major accidents; budget cuts impaired process safety performance at the Texas City refinery.

BP Texas City Managers did not:

  • create an effective reporting and learning culture; reporting bad news was not encouraged. Incidents were often ineffectively investigated and appropriate corrective actions not taken.
  • ensure that supervisors and management modeled and enforced use of up-to-date plant policies and procedures.
  • incorporate good practice design in the operation of the ISOM unit. Examples of these failures include:
  • no flare to safely combust flammables entering the blow-down system;
  • lack of automated controls in the splitter tower triggered by high-level, which would have prevented the unsafe level; and
  • inadequate instrumentation to warn of overfilling in the splitter tower. 0 ensure that operators were supervised and supported by experienced, technically trained personnel during unit startup, an especially hazardous phase of operation; or that
  • effectively incorporated human factor considerations in its training, staffing, and work schedule for operations personnel.

A few of the strategic recommendations made are:

Contributing Causes: BP Texas City managers:

  • lacked an effective mechanical integrity program to maintain instruments and process equipment. For example, malfunctioning instruments and equipment were not repaired prior to startup.
  • did not have an effective vehicle traffic policy to control vehicle traffic into hazardous process areas or to establish safe distances from process unit boundaries.
  • ineffectively implemented their PSSR policy; nonessential personnel were not removed from areas in and around process units during the hazardous unit startup.
  • Acted a policy for siting trailers that was sufficiently protective of trailer occupants.

 

 
Locations of visitors to this page