Focusing on the Wrong Safety Metrics: BP Texas City Refinery

When the corporate culture ignores safety, what do you think about going to work each day?

Looking at the 2005 Texas City refinery fire with the benefit of nearly 10 years of reflection and much discussion of what was going on at the facility, it is difficult to imagine how anybody working there could have had any sense of personal security. Those individuals who spend most of their waking hours surrounded by flammable and explosive products in enormous quantities must become desensitized to the ever-present danger or they would not be able to walk through the gate to begin a shift. Hopefully, rational individuals find a way to let their knowledge of the danger inform their actions and motivate them to work safely. BP had created a safety culture that stressed behavioral issues but did not dedicate the same resources to process safety. Perhaps to many of the 1,800 employees and 800 contractors on the site, the notion of behavioral safety was enough to keep them coming to work every day.

Investigations after the fire on March 23, 2005, (Calling it the 2005 incident implies that there was only one that year. In fact, there were several other incidents before and after.) offered numerous citations of safety culture failures at the company’s corporate level, along with safety management failures at its refineries in general and Texas City in particular. Quoting from the Chemical Safety and Hazard Investigation Board report:

1.6.2: The Board of Directors did not provide effective oversight of BP’s safety culture and major accident prevention programs. The Board did not have a member responsible for assessing and verifying the performance of BP’s major accident hazard prevention programs.

1.6.3: Reliance on the low personal injury rate at Texas City as a safety indicator failed to provide a true picture of process safety performance and the health of the safety culture.

1.6.7: Safety campaigns, goals, and rewards focused on improving personal safety metrics and worker behaviors rather than on process safety and management safety systems. While compliance with many safety policies and procedures was deficient at all levels of the refinery, Texas City managers did not lead by example regarding safety.

That’s not to say there was no discussion of safety at the facility, but the stress was on occupational safety. Wear your safety glasses, don’t leave trip hazards, etc. In that regard, the environment was relatively safe and plant management encouraged participation at every level. A program was launched in 2001 called the “Texas City Refinery Safety Challenge,” which told employees that unsafe acts were responsible for 90% of injuries at the site. In general, employees got behind the program and turned in 48,000 safety observations in 2004. Unfortunately, as cited in 1.6.3 above, the program effectively ignored process safety systems and process-safety related activities.

So where did that leave individual employees? On one hand they were pushed to report unsafe acts of individuals, but ignored the fact that the sight glass on the bottom of the raffinate splitter tower was so dirty nobody had been able to read it for years.

How about the operator that was doing the unit startup for the first time in his career, and yet had to perform this critical procedure with nobody else around the control room that was experienced. Some years before, Amoco had calculated that safety incidents were 10 times more likely to happen during startups. Similarly, basic concepts of safety risk management have made it clear that the best and most experienced operators should have been on the boards when the raffinate splitter was going back online after a turnaround.  If after pumping feedstock into the tower for three hours, the operator would have told a supervisor, “I really can’t figure out where all this liquid is going. I can’t account for it from any of the instrumentation readings. Something is wrong. We must be filling the tower,” it may have produced different results. In addition, pumping feedstock into the tower was contrary to established startup procedures.

If a plant is in bad condition such as this one was, the only way to compensate is to have very clever people that can create their own work-arounds for malfunctioning or missing equipment. A more experienced operator would never keep pumping feedstock into the tower if he or she couldn’t verify that an equal amount is going out. An experienced operator understands the process can look at the instruments and say, “That can’t be right.” Of course, that approach only goes so far. Eventually even the most gifted people can’t make up the difference. Those that are struggling don’t stand a chance.

Learn more about our global Safety Systems operations