On this day in in 2005 and tragic accident at the BP Texas City refinery claimed the lives of 15 workers, injured many others and caused significant damage tothe reinfery and nearby property.  Like many incidents this one has leanrings in leadership/management, human factors, safety culture, and process safety.

Background:

As a brief reminder, the incident occurred on the raffinate splitter (the splitter), used for processing gasoline blending components, and involved an associated blow-down drum and stack. The nightshift established levels in the splitter using cold feed. They shut off the feed before the end of shift with the splitter level indication showing 100%(10 ft 3 in. in a 164 ft tower). The high level alarm activated and was acknowledged at 72%, but an independent highlevel alarm (set at 78%) did not activate.

The dayshift on March 23 re-introduced feed and started circulation and heating. The bottoms valve was closed and the splitter became overfilled and overheated. During this period the tower base temperature was increasing but the hydraulic head of cold liquid above meant no fractionation occurred. The splitter level gauge showed a slight decrease as the liquid density changed due to the tower base temperature increasing.

When the operator finally opened the bottom outlet(circa 3 hours after feed restarted) a rapid increase in feed temperature resulted causing vapourisation, and shortly after-wards liquid was released into the overhead relief system.

The relief system was not designed for such high liquid hydrocarbon flows and liquid hydrocarbon was emitted from the blowdown drum and stack. A vapour cloud developed and ignited. The resulting explosion killed fifteen people, injured many others, and damaged property nearby.

Lessons Learned:

Startup and Management Oversight
Failure to follow the startup procedure contributed to theloss of process control. Key individuals (management and operators) did not apply their level of skills and knowledge,and there was a lack of supervisory presence and oversightduring this startup.

Loss of Containment
Actions taken or not taken led to overfilling of the splitter andsubsequent overpressurisation and pressure relief. Hydro-carbon flow to the blowdown drum and stack resulted inliquids overflowing the stack, causing a vapour cloud,which was ignited by an unknown source.

Design & Engineering of Blowdown Drum and Stack
The use of a blowdown drum and stack as part of the reliefand venting system for the splitter, after several design andoperational changes over time, close to uncontrolled areas.

Control of Work Area and Trailer Placement
Numerous personnel working elsewhere in the refinery were too close to the hazard at the blowdown drum and stack during the startup operation. They were congregated in and around temporary trailers and were neither evacuated nor alerted.

For each critical factor, possible immediate causes and possible management system causes (root causes) were analysed. A significant number of possible management system causes were identified indicating many linked issues requiring further evaluation.

SAFETY CULTURAL ISSUES
In order to understand which recommendations wouldprevent recurrence it was decided to explore more deeplythe underlying safety cultural issues that were identified.The following issues were distilled from the system causesand illustrate a number of lessons learned, some of whichwill be applicable to a wider cross-section of the industry.

Business Context
There was a lack of clearly defined and broadly understoodcontext and business priorities for the Texas City site. A clear view of the key process safety priorities for the site or a sense of a vision or future for the long term could notbe identified.

“Safety” as a Priority
Process safety, operations performance and systematic risk reduction priorities had not been set and consistently reinforced by management.

Organisational Complexity and Capability
Many changes in a complex organisation had led to the lack of clear accountabilities and poor communication, which together resulted in confusion in the workforce over rolesand responsibilities.

Inability to See Risk
A poor level of hazard awareness and understanding of process safety on the site resulted in people accepting levels of risk that were considerably higher than comparable installations.

Lack of Early Warning
Given the poor vertical communication and performancemanagement process, there was neither an adequate earlywarning system of problems, nor any independent meansof understanding certain deteriorating conditions at theplant.