The Inevitable Cost of an Incident: BP Texas City Refinery

 

How long can management force a plant to produce without necessary resources before an incident occurs?

This unfortunate process safety incident is familiar to many working in process industries and especially in the United States where an extensive investigation and its associated report has been used to illustrate the importance of Process Safety Management.

On March 23, 2005 at the Texas City refinery, a geyser of flammable hydrocarbon liquid and vapor erupted from a blowdown stack, which ignited creating a huge fire. The result: 15 fatalities and 180 injuries. All the individuals who died were in or around a group of office trailers clustered near the blowdown drum. At the time, Texas City was operated by BP and was its largest refinery and the third largest in the U.S.

Sadly, this particular process safety incident was not a momentary lapse in a facility that otherwise had a clean history with strong safety compliance and longstanding safety culture. On the contrary, this refinery had experienced 23 fatalities over the previous 30 years, including three in 2004 alone. In addition, this equipment also had a previous safety compliance lapse. There had been eight serious releases of flammable material out of that stack in the years prior to 2005 that were not investigated. Moreover, such overfilling incidents in distillation columns had happened in other refineries, and investigations cited in industry literature stressed the importance of accurate level measurements as part of overall safety risk management programs.

After the March 23rd fire, there were two more major safety incidents resulting in more than $30 million in damage (although without fatalities) within a few months. After the March incident, OSHA investigators fined the company $21 million, the largest fine to that time in the agency’s history, for 301 willful violations. Ironically, OSHA did not undertake a comprehensive inspection of the other 29 process units at the site.

Following the March safety incident, accident analysis pointed to problems with human resources along with hardware. Follow-up investigation reports cited dozens of instances of deteriorating equipment, inadequate process control systems, inadequate safety systems, along with poorly trained and inexperienced people. Those reports also pointed out that the company had cut operating budgets substantially in 1999 and again in 2005. Staffing at the site had also been reduced.

When the Chemical Safety and Hazard Investigation Board published its investigation report of this specific incident two years after the event, it cited a very insightful comment issued by the Columbia Accident Investigation Board after that space shuttle had been lost. It said, “Many accident investigations make the same mistake in defining causes. They identify the widget that broke or malfunctioned, then locate the person most closely connected with the technical failure: the engineer who miscalculated an analysis, the operator who missed signals or pulled the wrong switches, the supervisor who failed to listen, or the manager who made bad decisions. When causal chains are limited to technical flaws and individual failures, the ensuing responses aimed at preventing a similar event in the future are equally limited: they aim to fix the technical problem and replace or retrain the individual responsible. Such corrections lead to a misguided and potentially disastrous belief that the underlying problem has been solved.” (CAIB, 2003)

In the case of this incident, it would be easy to write it off as a failure of level instrumentation and the safety instrumented system in the raffinate splitter tower that caused inexperienced operators to continue pumping flammable feedstock into the tower even when they could not account for where all that volume was going. Pumping feedstock into the tower was contrary to normal startup procedures. Still, no alarms warned the control room of what was happening, and no SIS shut off the pump.

Solving problems at the Texas City refinery would have likely required shutting down the facility for some extended period of time to make major renovations and updates, but nobody was going to force that to happen, the U.S. energy supply chain would have been hard pressed to accommodate such a loss of production (10 million gallons of gasoline daily), and shareholders would have rejected the results of a prolonged shutdown.