Date | March 23, 2005 |
---|---|
Time | 1:20 pm (CDT) |
Venue | BP Texas City refinery |
Location | Isomerization plant |
Coordinates | 29°22′23″N94°56′20″W / 29.37306°N 94.93889°W |
Type | Vapor cloud explosion |
Cause | Overfilling of a blowdown stack with liquid raffinate due to faulty instrumentation and poor execution of unit start-up procedure |
Deaths | 15 |
Non-fatal injuries | 180 |
Property damage | $200 million ($312 million in 2024) |
Inquiries | BP's internal investigations, Baker Panel independent investigation, Chemical Safety Board investigation |
Convicted | BP Products North America Inc. |
Charges | Violation of section 112(r)(7) of the Clean Air Act |
Verdict | BP pled guilty and settled for $50 million and a probation period of three years |
Litigation | Approximately 4,000 claims |
Costs | Approximately $2.5 billion of liabilities for BP |
The Texas City refinery explosion occurred on March 23, 2005, when a flammable hydrocarbon vapor cloud ignited and violently exploded at the isomerization process unit of the BP oil refinery in Texas City, Texas, killing 15 workers, injuring 180 others and severely damaging the refinery. All the fatalities were contractors working out of temporary buildings located close to the unit to support turnaround activities. Property loss was $200 million ($312 million in 2024). When including settlements ($2.1 billion), costs of repairs, deferred production, and fines, the explosion is the world's costliest refinery accident.
The direct cause of the explosion was the ignition of a heavy hydrocarbon vapor cloud which emanated from raffinate liquids overflowing from the top of a blowdown stack. The source of ignition was probably a running vehicle engine. The release of liquid followed the automatic opening of a set of relief valves on a raffinate splitter column caused by overfilling.
Subsequent investigation reports by BP, the U.S. Chemical Safety Board (CSB), and an independent blue-ribbon panel led by James Baker identified numerous technical and organizational failings at the refinery and within corporate BP.
The disaster had widespread consequences on both the company and the industry as a whole. The explosion was the first in a series of accidents (which culminated in the Deepwater Horizon oil spill) that seriously tarnished BP's reputation, especially in the U.S. The refinery was eventually sold as a result, together with other North American assets. In the meantime, the industry took action both through the issuance of new or updated standards and more radical regulatory oversight of refinery activities.
The refinery was established in 1933 by Pan American Refining Corporation. [1] Pan American merged with Standard Oil of Indiana in 1954 to form Amoco. [2] BP acquired the refinery as part of its merger with Amoco in 1999. [3] As of January 2005, it was the second largest oil refinery out of 23 in Texas (behind Baytown Refinery), and the fourth overall out of 142 in the United States in terms of operating capacity, which was 475,000 barrels (75,500 m3) per stream day. [4] [lower-alpha 1] At the time of the accident it was one of three refineries in Texas City, the other two belonging to Marathon Petroleum and Valero Energy. [1] [4] The refinery was also one of five BP refineries in the U.S. and BP’s largest worldwide. It could produce around 10 million gallons (38 million L) of gasoline per day, or about 2.5% of the entire volume sold in the United States. It also produced jet fuels, diesel fuels, as well as chemical feed stocks. Its 1,200-acre (490 ha) site was covered by 29 oil refining units and four chemical units. It employed around 1,800 BP workers. At the time of the accident, about 800 contractors were onsite to support turnaround works. [6]
At the time of the 1999 merger, the plant was losing money, [7] but BP was extremely successful in turning the tide. In fact, the complex had performed at an all-time record profitability in 2004, with over $1 billion in profit, "more than any other refinery in the BP system" in the words of business unit leader and complex manager Don Parus. [8] By early 2005 the refinery was making profits of around $100 million on a monthly basis. [9]
Since 1974 there had been 23 fatalities in 20 separate accidents at the refinery. Three of these occurred in 2004, the year prior to the explosion. Almost half of these fatalities were due to fires or explosions ensuing process fluid releases. [10] A very serious explosion affected the complex in July 1979, when hydrocarbons at 265 psi (1,830 kPa ) were released from a failed 12 inches (30 cm) elbow in the depropanizer overhead condensing system of the sulfuric acid alkylation unit. More than 4,000 US gallons (15 m3) of liquids were discharged. A large vapor cloud formed and traveled downwind about 640 feet (200 m) to the fluid catalytic cracking (FCC) unit, where ignition occurred. A control building, the alkylation unit, the FCC unit, and the carbon monoxide boiler sustained heavy damage. Windows were broken up to 1.5 miles (2.4 km) away. Although no fatalities occurred, property loss was very significant ($24 million, or $101 million in 2024). [11] [12] Another large explosion took place in March 2004. Although no one was injured, BP temporarily evacuated the refinery. The police closed the access roads and asked residents not to leave their houses. [13]
The plant had been poorly maintained for several years. [14] Starting in the early 1990s, Amoco and later BP made substantial budget cuts, especially affecting maintenance expenditure. Immediately after the merger, in fact, BP ordered a 25% cut in operating costs, which was achieved in part with lower spending in maintenance and training and cutting back on safety staff. [15] [16]
In 2002, BP contracted consulting firm A.T. Kearney to understand "the historical facts which have led to the deterioration of the Texas City refinery performance." The report [17] connected the significant reductions in spending with the deterioration in the refinery's integrity and reliability. [18] An internal BP audit conducted in 2003 found that a "checkbook mentality", blame, and status culture eroded HSE as well as general performance; the condition of assets and infrastructure was poor; management had not created meaningful action plans; and that there were insufficient resources. [19] A similar audit in 2004 found fault across all elements of process safety management. [20] Another external audit report was produced by consulting firm Telos in January 2005. [21] [22] It identified numerous safety issues including "broken alarms, thinned pipe, chunks of concrete falling, bolts dropping, cigarettes falling 60 feet (18 m) and staff being overcome with fumes." The report's co-author stated, "We have never seen a site where the notion 'I could die today' was so real." [23] The report also stated, "Most interviewees say that production and budget compliance gets recognized and rewarded before anything else", [24] "Most interviewees at the production level say that the pressure for production, time pressure, and understaffing are the major causes of accidents at Texas City" [25] and that
There is an exceptional degree of fear of catastrophic incidents at Texas City. People talked or wrote at length about serious hazards are in the operating units from CUI, abandoned asbestos, piping integrity issues, inadequate spare pumps and parts, and other equipment and operating hazards. Of these, piping integrity was repeated again and again. Even where there have been recent investments in piping integrity, people reported that they often could not shut the unit down to in fact replace the pipe they had fabricated. The tolerance of these kinds of risk "distracted" people from routine safe practices at the task level, or made them feel skeptical about the commitment to safety at the plant. [26]
Some key reports on the preoccupying conditions of the refinery made their way to company board level. [27] In early March 2005, mere weeks before the explosion, an internal e-mail warned, "I truly believe that we are on the verge of something bigger happening and that we must make some critical decisions [...] over getting the workforce's attention around safety." [28] Management turnover had been high in the years leading to the explosion, with the complex having had five managers in the six years since the merger, [29] with the result that employees were under the impression that any new initiative would not last and that efforts were focused on short-term profit rather than long-term sustainability. [30] The complex was still largely using Amoco safety management processes pre-dating the merger. [31]
The isomerization plant (ISOM) at the site was designed for the conversion of low-octane hydrocarbons, through various chemical processes, into hydrocarbons with higher octane ratings that could then be blended into unleaded gasoline. This is achieved by converting straight-chain hydrocarbon molecules into branched ones. [32] The main feed to the unit was a mix of n-pentane and n-hexane, with isopentane and isohexane being the main product. [33] The plant consisted of a desulfurization system, a Penex isomerization reactor, a vapor recovery and liquid recycle unit, and a raffinate splitter. [34]
The 170-foot (50 m) tall tower-shaped splitter, a distillation column, was used to separate lighter hydrocarbon components from the top of the tower (mainly pentane and hexane), which condensed and were then pumped to a light raffinate storage tank, while the heavier components (mainly C7 and C8) were recovered lower down in the splitter, then pumped to a heavy raffinate storage tank. The unit had an operational capacity of 45,000 barrels (7,200 m3) per day. [31]
Excess hydrocarbon vapors and liquids from vent and relief were sent to vessel F-20, a blowdown stack. This was designed to disperse vapors from the top and convey any liquids through a gooseneck into the plant closed sewer network. [lower-alpha 2] It was a 10-foot (3.0 m) diameter vertical drum with a 113-foot (34 m) vertical flue pipe. F-20 was put in commission in the 1950s and had gone through several modifications over the years. [31]
Remedial work had been started on the raffinate splitter from February 21, 2005. Two turnaround activities were also taking place at the adjacent ultracracker unit (UCU) and at the aromatics recovery unit (ARU) at the same time. Portable buildings and trailers were often installed for use as offices during construction and maintenance. [36] In 2004, 122 trailers were in the refinery with an estimated occupancy of 800. BP allowed trailers to be placed near process units based on the results of a screening process. [37]
In 1995 a site-wide temporary siting analysis report [38] had been created at the facility that established an acceptable layout of trailers and other temporary structures with respect to nearby hazardous process facilities. The report was revalidated in 2002, still based on Amoco's standards although more than three years had passed since the BP–Amoco merger. In turn, Amoco's Facility Siting Screening Workbook was based on the American Petroleum Institute's Recommended Practice 752. [39] [40] [lower-alpha 3] The next siting analysis was due to take place in 2007 and, therefore, any siting changes before then would have to be under the management of change (MOC) process. Plans were made late in 2004 to accommodate contractors due to work on the UCU in 2005 in nine single trailers and one double-wide trailer immediately west of the ISOM process unit. The team carrying out the MOC assessment for the placement of the double-wide trailer identified that the structure would be less than 350 feet (110 m) from the ISOM plant, a distance below which a dedicated risk analysis had to be carried out under Amoco's Workbook provisions. This team, however, lacked the expertise to complete the risk assessment. The introduction of the nine single trailers in the picture was not assessed in an MOC. Further, contrary to procedure, recommendations issued in the analysis of the change involving the placement of the double-wide trailer were still open when the trailers were occupied in November 2004. [43]
The start-up process commenced with the night-shift lead operator on March 23 carrying out the initial filling of the splitter tower. Because plant start-ups are especially prone to unexpected situations, operational practice requires the application of a controlled and approved pre-start-up safety review (PSSR) procedure. BP had one, but it was not adopted in this case. [44] The process control level transmitter was designed to indicate the raffinate level within a 5-foot (1.5 m) span from the bottom of the splitter tower to a 9-foot (2.7 m) level. A high-level alarm dependent on this transmitter sounded as intended at 3:09 am, when a level of 7.6 feet (2.3 m) from the bottom was reached. However, during start-up it was common to ignore this alarm and fill up to a level of 99% (as indicated by the transmitter) to prevent damage to the furnace heating the splitter bottom. Unbeknown to the operators, the process control level transmitter, which was used to monitor the level in the splitter during the whole start-up operation, was not calibrated and its readings were not reliable. An independent level alarm triggered by a high-level switch should also have sounded at 7.9 feet (2.4 m) but failed to. At 5:00 am, the lead operator in the ISOM satellite control room briefed the central control room and went home early. At 6:00 am, the day-shift board operator (central control room operator) arrived and started his thirtieth consecutive day on a 12-hour shift duty. By this time, the level was still believed to be below the 9-foot mark, but it was already at 13 feet (4.0 m). [45] [46] [47]
At 7:15 am, more than one hour late on the commencement of his shift (6:00 am), one of the two day-shift supervisors ("A") arrived at the central control room. Because of his lateness, he could not go through the required handover with the night shift. During the morning meeting on March 23, it was discussed that the heavy raffinate storage tanks were nearly full and, therefore, a second day-shift supervisor ("B") was told that the start-up procedure should not continue, but this information was not passed on. Therefore, the start-up procedure resumed just before 9:30 am under instructions from the day-shift supervisor A. The splitter level control valve into the heavy storage tank was placed in manual mode (rather than having its opening regulated by the level transmitter) and set at 4,300 bpd. However, the flow transmitter on this line was in error and the valve had actually been closed shut. This, coupled with the malfunctioning of all the splitter tower instruments, allowed the level of liquid in the tower to increase without anyone noticing and caused the operators to lose all situational awareness. [16] The circulation process was restarted just before 10 am and raffinate was once again fed into the tower, even though the level was already too high. Since the level-control valve was shut and, therefore, there was no circulation out of the tower (i.e. no heavy raffinate being transferred to the storage tank), the splitter tower inevitably began to fill up. The defective level transmitter continued to show the level at less than 100%, and since the external sight glass was opaque, a visual check to verify the level in the splitter tower was not possible. Day-shift supervisor A, the more experienced of the two, left at 10:50 am due to a family emergency. Contrary to the operating rules, no supervisor was left in the central control room. A single, unsupervised, and very tired board operator was now left to supervise the ISOM and two other units during a critical start-up procedure. [45] [48] [49] [lower-alpha 4]
Two burners in the furnace had been turned on at 9:55 am to pre-heat raffinate going into the tower and to heat the raffinate in the tower bottom. Two more were lit at 11:16 am. The required temperature for the tower reboiler return flow was 135 °C (275 °F) with a rate increase of 10 °C (18 °F) per hour, but this procedure was not followed: during start-up, the return flow temperature reached 153 °C (307 °F) at a rate of 23 °C (41 °F) per hour. The defective level transmitter still erroneously indicated an ongoing safe level condition in the tower. However, there was still no flow of heavy raffinate from the splitter tower to the storage tank as the level control valve remained closed; instead of the hydrocarbon liquid level being at 8.65 feet (2.64 m), i.e. 93% of the instrument range, as indicated, it had actually reached 67 feet (20 m). Just before midday, with heat increasing in the tower, the actual fluid level had risen to 98 feet (30 m). Pressure started to build up in the system as the hydrocarbon vapors and the nitrogen remaining in the tower and associated pipework from when it had been put back in service became compressed with the increasing volume of raffinate. The operations crew thought that the pressure rise was a result of overheating in the tower bottoms as this was a known start-up issue, so the pressure was released. [51] [52]
By 12:42 pm, the furnaces had been turned down and the level control valve was finally opened, draining heavy raffinate from the splitter tower. The gas fueling the furnace was shut off, but the raffinate feed into the splitter tower was not. The operators believed the level transmitter reading which was now down to 78% (7.9 feet [2.4 m]) but the fluid level in the 170-foot (52 m) tall splitter tower had now reached 158 feet (48 m). [53]
While the opening of the heavy raffinate flow should have diminished the level in the column, the fact that this hot flow was used to pre-heat the feed meant that the temperature inside the splitter increased dramatically, which led to significant increase in vaporization and the lifting of a slug of liquid over the top of the column into the overheads line. [54] At 1:13 pm, the hydrostatic head of this liquid had built to over 42 psi (290 kPa ). [55] This was sufficient to open the relief valves. [54] With the relief valves fully open, over 51,900 US gallons (196 m3) of heated raffinate passed directly into the collection header over a 6-minute period before the valves closed, as pressure within the splitter overheads pipe dropped below their minimum closing set point (37.2 psi (256 kPa) above atmospheric pressure). [56] Hot raffinate flowed into the blowdown drum and stack, and as it filled, some of the fluid started to flow into the ISOM unit sewer system via a 6-inch (15 cm) pipeline at the base of the blowdown drum. As the blowdown drum and stack filled up, hot raffinate shot out of the top of the stack and into the air, forming a 20-foot (6 m) "geyser". [57] The equivalent of a nearly full tanker truck of raffinate rained down on the ground, ran down the side of the blowdown drum and stack, and pooled at the base of the unit. [58] A radio call was received in the control room that hot hydrocarbons were overflowing from the stack. [57] The plant evacuation alarm was not sounded, a fact that prevented people in the vicinities to evacuate before ignition took place. [59] [60]
A diesel pick-up truck, with its engine left idling, had been parked about 25 feet (8 m) from the blowdown stack. The vapor cloud reached the vehicle, and hydrocarbon fumes were drawn into the engine's air intake, causing the engine to race. Nearby workers frantically tried to shut down the engine, without success. The expanding vapor cloud forced the workers who were trying to shut down the overspeeding truck engine to retreat. The cloud continued to spread across the ISOM plant, across the pipe-rack to the west and into the trailer area unimpeded. No emergency alarm sounded, and at approximately 1:20 pm, the vapor cloud was ignited by a backfire, as observed (by nearby witnesses) to be originating from the overheating truck engine. [61]
Equipment and piping congestion contributed to accelerate the flame front. This triggered a massive vapor cloud explosion that was heard for miles. [62] The blast pressure wave struck the cluster of contractor trailers located as close as 121 feet (37 m) from the blowdown stack, completely destroying them. The explosion sent debris flying, instantly killing 15 people manning the closest trailers and injuring 180 others. [lower-alpha 5] Workers in trailers received injuries as far as 480 feet (150 m) from the blowdown drum, with heavy damage reaching some trailers as far as 600 feet (180 m) away. Over 40 trailers were damaged. [41] [64] All the fatalities and many of those injured in the accident were contractors. [65] Fifty storage tanks sustained structural damage, although the largest portion of the tank farm was more than 250 feet (76 m) from the explosion. [66] Over 2,750 pounds (1,250 kg) of benzene escaped from one of the damaged tanks. [67] [68]
An area estimated at 200,000 square feet (19,000 m2) of the refinery was badly burned by the fire that followed the violent explosion, damaging refinery equipment worth millions of dollars. [69] The pressure wave was so powerful it blew out windows offsite up to three-quarters of a mile (1.2 km) away. [67]
The site emergency response team intervened immediately, mounting a search and rescue operation. [70] An order was issued for the shelter-in-place of 43,000 people. [33] Mutual aid provided by IMAS (Texas City Industrial Mutual Aid System) and Memorial Hermann Life Flight resources were mobilized by 1:45 pm. [67] [70] [71] The feed to the raffinate splitter was not shut down, but it stopped at 2:45 pm when electrical power went down. Fires were brought under control by 150–200 firefighters after two hours. Ambulances and Life Flight stood down by 4:44 pm. The final body was found under a heap of debris at about 11:00 pm. [70] [72]
BP's in-house experts as well as various authorities and committees investigated the explosion in relation to technical, organizational, and safety culture aspects. BP internal investigations included a panel (the Mogford investigation, from the name of the lead investigator) tasked with reconstructing the accident causation chain and conducting a detailed root-cause analysis, [73] and two other teams (the Bonse and Stanley investigations) who remained focused on underlying procedural and cultural factors as well as managerial accountabilities. [74] [75] An independent, high-profile panel (the Baker panel) was commissioned by BP on an urgent recommendation by the U.S. Chemical Safety Board (CSB), to look into management and safety culture issues. The CSB conducted their own detailed and extensive investigation, focused both on technical and procedural aspects. [76] [77]
The different panels and investigations found organizational failings including corporate cost-cutting, a failure to invest in the plant infrastructure, a lack of corporate oversight on both safety culture and major accident prevention programs, a focus on occupational safety as opposed to process safety, a defective management of change process (which allowed the siting of contractor trailers too close to the ISOM process unit), the inadequate training of operators, a lack of competent supervision for start-up operations, poor communication between individuals and departments and the use of outdated and ineffective work procedures which were often not followed. Technical failings included the use of a blowdown drum that was both insufficiently sized and outdated, a lack of preventive maintenance on safety-critical systems, and inoperative alarms and level sensors in the ISOM process unit. [78]
A team of experts led by John Mogford, the senior BP Group vice president for safety and operations, examined the technical aspects of the explosion and suggested corrective actions. An interim report was issued on May 12, 2005. [79] Reacting to the report, Scott Berger, director of the Center for Chemical Process Safety (CCPS) of the American Institute of Chemical Engineers (AIChE), expressed surprise at the emphasis the report put on individual responsibility by plant operators and supervisors. [80]
On December 9, 2005, BP published the final revision of the Mogford report. [73] It identified four critical factors without which the explosion would not have happened or would have had a lesser impact: "loss of containment; raffinate splitter start-up procedures and application of knowledge and skills; control of work and trailer siting; and design and engineering of the blowdown stack." [81] Furthermore, five critical underlying cultural issues were identified: [82]
The Mogford final report did not, however, find evidence that anyone intentionally made decisions or took actions that put others at risk. [82]
The company also put together a team of BP and external experts for conducting a process and operational audit review of the refinery. James W. Stanley, former deputy director of the Occupational Safety and Health Administration (OSHA), was the team leader. The audit focused on processes and operations; incident management, control of work, risk assessment, and compliance assessment; employee and contractor management; and maintenance, reliability, and integrity. The Stanley report was issued internally on June 15, 2005. It concluded that significant performance and behavior change on the part of senior and extended management would be needed, in spite of well-designed and documented procedures and processes being available and the workforce being generally capable of good performance. [83] Among the issues "preventing the successful execution of some key work processes", the team singled out: leadership factors, including failure to hold people accountable for safety and silo mentality, among other issues; risk awareness, indicated by complacency and repeated failure to heed recommendations arising from previous accidents; measures for control of work, which was found to be both insufficient and unadhered to; negative workplace conditions, as shown by poor housekeeping and insufficient plant maintenance; and a contractor management philosophy lacking diversity and inclusion values. [84]
Another internal team was led by Wilhelm Bonse-Geuking , who was BP Group vice president of Europe. The Bonse team investigated the level of compliance by plant managers with BP's management framework and corporate code of conduct. The final report –which was only released to the public after a court ordered it on May 3, 2007 –identified numerous management failures. [74] [85] [86] It further noted that management responsibilities within BP Group were unclear, and that the poor state of the plant equipment and the insufficiency of spending on maintenance were contributing factors to the accident.
In sum, the Texas City Refinery had a culture of risk taking coupled with a failure to understand the process safety implications of prior incidents [...], a long tradition of failure to comply with simple procedures, the desire to avoid conflict within its organization, and a penchant for placing persons in key roles who lacked adequate professional training. [87]
The report identified four executives for dismissal: Pat Gower, regional vice president for U.S. refining; Mike Hoffman, group vice president for North American refining and marketing; Texas City complex manager Don Parus; and Willie Willis, Texas City West plant supervisor. [86] As of the date of publication of the report none had actually been sacked. [9] [lower-alpha 6]
After the March explosion, two more serious process safety incidents occurred at the plant:
Both accidents required community shelter-in-place alerts. [97] Following these events, on August 17, 2005, the U.S. Chemical Safety and Hazard Investigation Board (CSB) issued an urgent recommendation that BP commission an independent panel to investigate the safety culture and management systems at BP North America. [98] A blue-ribbon panel was assembled, led by former U.S. Secretary of State James A. Baker III. [76] [99] A figure of this stature and curriculum was specifically selected by BP to publicly show to U.S. opinion-makers that the company was eager to learn the lesson and make strides to change. [100]
The Baker Panel differed from BP's and the CSB's investigations in that it was not charged to conduct a root cause investigation. Its scope was broader, focused on BP's corporate safety oversight, corporate safety culture, and its process safety management systems and included all five BP refineries in the United States. [101]
The Baker Panel report was released on January 16, 2007. [76] [102] [103] It cited weak safety culture driven by poor process safety leadership and low employee empowerment as underlying causes of the accidents plaguing the refinery. It also highlighted that despite BP's comprehensive safety management system, this was not sufficiently enforced in their refineries. It also showed that BP's focus in measuring its safety performance relied overwhelmingly on occupational safety indicators to the detriment of process safety performance monitoring. [104] [105] It further stressed that worker fatigue and a system that encouraged overtime had detrimental effects on safe plant operation, [106] and that the company had failed to deal with deficiencies arising from known incidents, risk assessments and audits. [107] Implementation of good engineering practices was also found lacking. [108]
Additionally, the panel interviewed a number of employees, managers and contractors at all five of BP's U.S. refineries. [109] They also created and administered to the refineries a process safety culture survey. [110] They concluded that the Toledo and Texas City plants had the worst process safety culture, while the Cherry Point refinery, located in Birch Bay, Washington, had the best process safety culture. The survey results also showed that managers and white-collar workers generally had a more positive view of the process safety culture at their plants when compared with the viewpoint of blue-collar operators and maintenance technicians. [111]
The report made 10 recommendations on various aspects of process safety (leadership; management system; competence; culture; expectations and accountability; leading and lagging performance indicators; and auditing), as well as on support for line management and industry stewardship. [112]
Given the extent of the disaster the Chemical Safety Board examined both the safety management in the Texas City refinery and the role of the BP Group as well as the role of OSHA as a regulatory body. The CSB investigation team was on site 48 hours after the accident. Some 13 CSB investigators remained onsite for three months. For its investigation, the CSB used a budget of $2.5 million and reviewed more than 30,000 documents, interviewed 370 witnesses, and performed computer modeling and testing. The results of the investigation of the agency were published on March 20, 2007 in a 341-page long report, [77] the most extensive conducted up to that point by the then nine-year-old agency. The report findings were presented on the same day at a public meeting in Texas City. [113] [114] [115]
One of the key findings of the CSB was that the blowdown system used at the ISOM unit was antiquated and totally inadequate, being located as it was amid the plant and liable to spew unignited heavy vapors down into normally manned areas. [116] The CSB found that BP had failed to heed or implement multiple warnings and safety recommendations made before the blast regarding the ISOM blowdown system. Among them were: [117]
Between 1994 and 2004, at least eight similar cases occurred in which flammable vapors were emitted by the ISOM blowdown drum/vent stack, of which two resulted in a fire. Yet no corrective action was taken. [119] Furthermore, the blowdown drum was not designed to deal with a vessel overfill. This was not necessarily attributable to Amoco or BP, but rather to a lack of guidance in the API Recommended Practice 521. [118] [120] [lower-alpha 7]
Other design issues included:
Several items, most of which safety-critical, were not operational and contributed to the chain of events. In particular, none of the four available level readings and alarms on the splitter worked. The affected instruments were the process control system displacer-type level transmitter, the two independent high- and low-level switches (although the low-level one did not play a role in the accident), and the level sight glass at the bottom of the splitter tower, [130] as well as the flow transmitter reading the flowrate of heavy raffinate. [131]
The splitter tower mechanical conditions were seen as degraded, so in 2004 the set point of the pressure relief valves was decreased from 70 psi (480 kPa) to approximately 40 psi (280 kPa). If this change had not been implemented, the valves would not have opened on the day of the accident and the explosion would not have occurred, because the static head above them would not have reached the valve set point. [132] [133]
The CSB found that organizational and safety deficiencies at all organizational levels of BP contributed to the refinery explosion, such as cost cuts and spending cuts in the safety area, although a large part of the refinery infrastructure and process equipment were in poor condition. In addition, the committee said that BP had cut the budget for training and reduced staff.
Carolyn W. Merritt, chairman and chief executive officer of the CSB, stated that findings about BP's safety culture were similar to those by the Baker Panel, [58] and that "[t]he combination of cost-cutting, production pressures, and failure to invest caused a progressive deterioration of safety at the refinery." She pointed out that, beginning in 2002, BP commissioned several studies through which it became aware of serious safety problems, including insufficient maintenance and training. Merritt highlighted that the studies were shared with key executives in London, but BP's response was inadequate, with the little investment made not addressing the real issues in Texas City. In fact, BP executives challenged their refineries to cut another 25% from their budgets for 2005. In addition, safety improvements between 2002 and 2005 were "largely focused on personal safety—such as slips, trips, falls, and vehicle accidents, rather than on improving safety performance," according to supervisory investigator Don Holmstrom. [103] [lower-alpha 9]
The CSB also issued a recommendation for the American Petroleum Institute (API) and the United Steelworkers (USW, the trade union representing refinery workers) to work together to develop a guideline for understanding, recognizing and dealing with fatigue during shift work, as well as to create performance indicators specific to process safety in the refining and petrochemical industries, [135] since measuring safety purely based on eminently occupational indicators such as lost-time incidents was seen as insufficient in the context of preventing major process accidents. [136] Other recommendations addressed to API were to update Recommended Practice 752 to include guidelines on the safe placement of trailers and temporary buildings in process plants; [137] and to update Recommended Practice 521 Guide for Pressure-Relieving and Depressuring Systems [138] to identify overfilling vessels as a potential hazard for evaluation, to mandate sizing disposal drums for credible worst-case liquid relief scenarios, to warn against the use of atmospheric blowdown drums and stacks attached to piping systems receiving flammable discharges from multiple relief valves, and to urge the use of appropriate inherently safer alternatives such as a flare system. [139]
The CSB judged that the Amoco–BP merger had negatively impacted the ability of the organization to deal with process hazards, because organizational changes occurred without getting assessed in terms of their consequences on safety. Therefore, the Board recommended to OSHA that their Process Safety Management of Highly Hazardous Chemicals regulation, [140] promulgated in 1992 and usually referred to as Process Safety Management (PSM), [141] should include a requirement for management of organizational changes, in addition to the existing rules on equipment and procedural changes. [142] A complementary recommendation was addressed to the Center for Chemical Process Safety, to the effect of developing guidelines on how to perform organizational management of change reviews. [143]
In the United States, the PSM regulation [140] is the key piece of legislation supporting the safe operation of a process facility handling hazardous materials, like the Texas City refinery (and indeed any refinery or sizeable chemical plant). OSHA is the enforcing agency for the regulation. However, the CSB found that OSHA had as supervising authority failed to carry out planned inspections of the refinery and did not enforce safety rules, although there were many warning signs. The CSB also found that only a limited number of OSHA inspectors received the specialized training and experience necessary for complex investigations in refineries. [144] The report further negatively compared OSHA's available resources with those of other agencies, like the British Health and Safety Executive or the Contra Costa County, California hazardous materials programs, that were much more prepared in spite of their smaller scope of oversight. [145]
The refinery also fell under the statutes of the Environmental Protection Agency (EPA)'s Risk Management Program (RMP) rule, a process safety management scheme similar to OSHA's. The CSB found that the EPA had not conducted any audits or inspections on RMP compliance since the rule had been promulgated. [146] However, the CSB did not issue recommendations to the EPA. Merritt stated in a Senate hearing that they were unable to do so because the EPA did not share critical information, without which meaningful recommendations could not be formulated. [147]
Property damage from the explosion amounted to $200 million ($312 million in 2024). [148] The explosion caused the shutdown of several units at the refinery. In anticipation of Hurricane Rita later in 2005, the entire refinery was shut down. BP then focused on repairing the damage caused by the explosion as well as the hurricane. Process units restart commenced in March 2006. [149] Costs of repairs and deferred production amounted to over $1 billion. [150] BP pled guilty to federal environmental crimes, for which it paid $50 million. [151] The company also paid at least around $2.1 billion in civil settlements. [150] Additionally, BP paid $84.6 million and $27 million in fines to the federal government on OSHA's and the EPA's request, respectively, [152] [153] [154] and a $50 million fine to the government of Texas for environmental violations. [155] The disaster is the world's costliest refinery accident. [156]
BP initiated a crisis management plan only six hours after the explosion. The following day, a website [157] was set up to publish updates on the accident. [158] Chief Executive Lord John Browne visited the plant on the day after the explosion. [159] In the months after the accident BP tended to put the blame on its operators and supervisors. Victims and union leaders considered this amounted to simple scapegoating. [160] At this point, the company consistently chose not to publicly apologize for the accident. [161] This changed on May 17, 2005, when Ross Pillari, president of BP Products North America, made a public apology, saying "We regret that our mistakes have caused so much suffering. We apologize to those who were harmed and to the Texas City community” and promising "financial support and compensation" to the injured and the families of the dead. [162]
On December 9, BP said they would put in place a budget of $1 billion to be spent over five years to improve safety at their Texas City refinery. [159] [163] BP also said that it would eliminate all blowdown drums/vent stack systems in flammable service, of which there were 11 at Texas City, and install new flares in line with their new policy prohibiting atmospheric venting of-heavier-than-air light hydrocarbons. [9] [164] [165] They also relocated trailers away from areas where explosions are possible [164] [166] and started a trial of an electronic integrated safe system of work (ISSOW). [164] Group-wide initiatives were also taken. [164]
Not long after the explosion and the other accidents at Texas City in 2005, however, BP's image in the U.S. was further tarnished by the near-sinking of the semi-submersible oil platform Thunder Horse PDQ in July of the same year [167] and, more crucially, in March 2006 when an oil pipeline spill was discovered in Prudhoe Bay, Alaska, while multiple investigations into the Texas City explosion were still ongoing. [168] CSB chairman Carolyn Merritt said there were striking similarities between the accidents of Texas City and Prudhoe Bay, including "long delays in implementation, administrative documentation of close-out even though remedial actions were not actually taken, or simple non-compliance" as well as "flawed communication of lessons learned, excessive decentralization of safety functions, and high management turnover." [169] A further serious accident occurred at BP Texas City in 2007, when 143 workers at the refinery claimed that they were injured when they inhaled toxic vapors released at the plant. [170] CEO John Browne resigned in 2007 over unrelated issues, [171] although he did not escape criticism for the lax safety culture and the budget cuts at BP's U.S. refineries. [28] [172] Tony Hayward took over at the helm of the company. Hayward shifted emphasis from Lord Browne's focus on alternative energy, announcing that safety would be the company's "number one priority". [173] By this time, BP had already taken a markedly apologetic stance over recent accidents, especially Texas City, with their executives and technical experts giving presentations about what went wrong and how they were working to prevent that from happening again. [174] However, only three years later, the 2010 Deepwater Horizon explosion and oil spill occurred, causing a very serious impact on the company on a global scale, again stemming from BP's operations in the U.S. As a result, Hayward resigned, and his role was taken over by American-born Bob Dudley. [175] Under Dudley, BP announced in 2011 that it was selling its Texas City refinery as part of its divestment plan to pay for ongoing compensation claims and remedial activities following the Deepwater Horizon disaster. The sale of the refinery was successfully completed at the start of 2013 to Marathon Petroleum Corporation for US$2.5 billion. [3] [176] Marathon already owned the adjoining Galveston Bay Refinery and in 2018 merged the two sites into one refining complex. [177]
Two congressional hearings were held specifically on the Texas City disaster. Among those heard were API, Baker Panel, CCPS, CSB, EPA, and USW representatives, as well as victim relatives. [141] [178] In other congressional hearings dedicated to subsequent BP accidents in the U.S., the Texas City case history was consistently presented within the pattern of degraded safety culture at BP. [179] [180] [181] [182]
BP was named in lawsuits from the victims' families and the wounded. [183] The case of Eva Rowe, a young woman who lost her parents in the explosion, attracted nationwide attention. Rowe said that she would not accept a settlement from BP and would drag the group to justice. Ed Bradley, a well-known American journalist, made her story known in the television magazine 60 Minutes . [184] On November 9, 2006, BP settled the case with Rowe as the last applicant after her lawyers had tried to invite John Browne, BP's chief executive officer at the time of the accident, as witness. The amount of compensation for Eva Rowe remained unknown. BP also paid $32 million to hospitals and education and research institutions nominated by Rowe, including the Mary Kay O'Connor Process Safety Center at Texas A&M University ($12.5 million), the University of Texas Medical Branch in Galveston and its Truman G. Blocker Adult Burn Unit ($12.5 million), the College of the Mainland in Texas City ($5 million), St. Jude Children's Research Hospital in Memphis, Tennessee ($1 million), and the Hornbeck, Louisiana school system ($1 million). [185] [lower-alpha 10] Furthermore, BP was forced to publish about seven million pages of internal documents, including the Telos and Bonse reports. [187] [188] [lower-alpha 11] Rowe would later participate in one of the congressional hearings held over the accident. [191]
As of September 2007, BP had settled at least 1,350 of around 3,000 lawsuits related to the accident. [88] By February 2008, about 4,000 claims were filed, of which half had settled, for a total exceeding $1.6 billion. [192] BP also said that they had set aside a further $525 million for other claims. [150] By August 2008 only one of the approximately 4,000 claims remained open. [193]
On February 4, 2008, U.S. district judge Lee Rosenthal heard arguments regarding BP's offer to plead guilty to a federal environmental crime for two violations of the Clean Air Act (CAA) [194] with a $50 million fine. At the hearing, blast victims and their relatives objected to the plea, calling the proposed fine "trivial". [195] However, the plea was eventually agreed, together with a three-year probation period for BP. [151] This was the first and, for several years, remained the only federal conviction for an accidental chemical release under the CAA. [196]
In September 2005, the Occupational Safety and Health Administration, which in the CSB report would be found lacking in oversight and competency, [lower-alpha 12] gave BP a record $21 million fine for committing 301 violations of the Process Safety Management rule. [29] [198] [199] In October 2009, OSHA imposed a fine of $87 million, which shattered its 2005 record, after claiming that BP had failed to implement safety improvements following the disaster and noting that four further fatal accidents occurred in the refinery since the previous fine. In its new report, OSHA cited 709 safety violations. [200] [201] BP announced that it would challenge the fine. [202] On August 12, 2010, BP announced that it had agreed to pay $50.6 million of the 2009 fine, while continuing to contest the remaining $30.7 million (the fine had been reduced by $6.1 million between when it was levied and when BP paid the first part). [203] In July 2012 OSHA and BP agreed that the outstanding $30.7 million would be reduced to $13 million, which BP paid. [152]
Following the explosion, the U.S. Environmental Protection Agency inspected the refinery for compliance with the Clean Air Act (CAA) and found BP in violation of the CAA as well as its Risk Management Program (RMP) rule. [204] Most of the violations were not directly related to the explosion but rather to other events, like the two later accidents in 2005. A first fine of $12 million was imposed on BP by the EPA in February 2009. This settlement also included BP's agreement to spend nearly $170 million to improve its environmental performance, with over $150 million dedicated to management of benzene emissions and the remainder addressing chlorofluorocarbons and asbestos. [154] In September 2010, the EPA and BP agreed on a settlement of $15 million on additional counts of violation. [94] This was both the largest civil penalty recovered for CAA violations at an individual facility and the largest ever for civil violations of the RMP. [153] [205]
At the request of the Texas Commission on Environmental Quality (TCEQ), the Texas Attorney General opened proceedings against BP for violations of the Texas Health and Safety Code [206] and Texas Water Code, [207] including the release of hydrocarbons through the blowdown stack on March 23, 2005, the prolonged release of benzene from a tank damaged in the explosion, which lasted more than 25 days, and tens of other events. [68] In a 2011 settlement, BP agreed to pay a $50 million fine covering 72 other emissions in excess of BP's operating permits. This included legal costs of $500,000. In return, the Justice Department agreed not to allow additional criminal charges against BP in connection with the refinery explosion. [155] [208]
The disaster had a notable impact in the domain of process safety. Texas City has become a classic case history used to explain failings in both management and technical barriers in process plants. [99] [209] [210] [211] [212]
The Baker Panel report became well-known among process safety engineers, who felt its findings were relevant to other plants and it was important for strengthening process safety awareness in the chemical process industry. [213] This fulfilled the Panel's wish as stated in the report:
Although we necessarily direct our report to BP, we intend it for a broader audience. We are under no illusion that deficiencies in process safety culture, management, or corporate oversight are limited to BP. Other companies and their stakeholders can benefit from our work. We urge these companies to regularly and thoroughly evaluate their safety culture, the performance of their process safety management systems, and their corporate safety oversight for possible improvements. We also urge the same companies to review carefully our findings and recommendations for application to their situations. [214]
The accident has been extensively analyzed in the specialized literature, which highlighted how several elements of process safety management (PSM) were implemented weakly and poorly managed. Observations made on PSM elements as defined in OSHA's rule [140] include:
Additional elements of process safety are defined in the Center for Chemical Process Safety's (CCPS) PSM scheme, [221] and the refinery was also lacking in some of these:
Other essential safety practices that failed included:
API actioned the recommendations from the CSB's report, thus creating new standards and guidelines for the industry:
The CCPS published an extensive guideline on organizational management of change to address another related recommendation from the CSB report. [239] [240]
After being singled out for lack of initiative and competency in assessing and inspecting large hazardous process plants, and refineries in particular, OSHA took action, initiating a refinery Process Safety Management National Emphasis Program (NEP) and enforcing a dedicated inspection audit program between 2007 and 2011. This was the most significant PSM enforcement action since the regulation [140] was issued in 1992. [241]
OSHA also issued an internal memorandum [242] to address the CSB's recommendation on updating the PSM regulation to include requirements for hazardous process facilities to extend their management-of-change procedures to capture organizational changes. However, the CSB did not deem this initiative sufficient to close the recommendation, which, as of January 2024 [ref] , was still open. [240] [243]
The accident has been featured in a number of documentaries:
Texas City is a city in Galveston County, Texas, United States. Located on the southwest shoreline of Galveston Bay, Texas City is a busy deepwater port on Texas's Gulf Coast, as well as a petroleum-refining and petrochemical-manufacturing center. The population was 51,898 at the 2020 census, making it the third-largest city in Galveston County, behind League City and Galveston. It is a part of the Houston metropolitan area. The city is notable as the site of a major explosion in 1947 that demolished the port and much of the city.
Process Safety Managementof Highly Hazardous Chemicals is a regulation promulgated by the U.S. Occupational Safety and Health Administration (OSHA). It defines and regulates a process safety management (PSM) program for plants using, storing, manufacturing, handling or carrying out on-site movement of hazardous materials above defined amount thresholds. Companies affected by the regulation usually build a compliant process safety management system and integrate it in their safety management system. Non-U.S. companies frequently choose on a voluntary basis to use the OSHA scheme in their business.
A chemical accident is the unintentional release of one or more hazardous chemicals, which could harm human health and the environment. Such events include fires, explosions, and release of toxic materials that may cause people illness, injury, or disability. Chemical accidents can be caused for example by natural disasters, human error, or deliberate acts for personal gain. Chemical accidents are generally understood to be industrial-scale ones, often with important offsite consequences. Unintended exposure to chemicals that occur at smaller work sites, as well as in private premises during everyday activities are usually not referred to as chemical accidents.
On 25 September 1998 a catastrophic accident occurred at the Esso natural gas plant in Longford, Victoria, Australia. A pressure vessel ruptured resulting in a serious jet fire, which escalated to a conflagration extending to a large part of the plant. Fires lasted two days before they were finally extinguished.
The Formosa Plastics propylene explosion was a propylene release and explosion that occurred on October 6, 2005, in the Olefins II Unit at the Formosa Plastics plant in Point Comfort, Texas, United States. The subsequent fire burned for five days.
The U.S. Chemical Safety and Hazard Investigation Board (USCSB), generally referred to as the Chemical Safety Board (CSB), is an independent U.S. federal agency charged with investigating industrial chemical accidents. Headquartered in Washington, D.C., the agency's board members are appointed by the president and confirmed by the United States Senate. The CSB conducts root cause investigations of chemical accidents at fixed industrial facilities.
A blowdown stack is an elevated vent or vertical stack that is used to vent the pressure of components of a chemical, refinery or other plant if there is a process problem or emergency. A blowdown stack can be used to complement a flare stack or as an alternative. The purpose is to prevent 'loss of containment' of volatile liquids and gases. Blowdown from several systems may be combined in a blowdown header prior to the stack. A knock-out pot may be provided at the base of the stack to remove any liquids. Blowdown stacks may either be ignited or un-ignited. The height of the blowdown stack must be tall enough to ensure the safe dispersal of vapour.
The West Pharmaceutical Plant explosion was an industrial disaster that occurred on January 29, 2003 at the West Pharmaceutical Plant in Kinston, North Carolina, United States. Six people were killed and thirty-six people were injured when a large explosion ripped through the facility. Two firefighters were injured in the subsequent blaze. The disaster occurred twelve years and 170 miles (270 km) from the 1991 Hamlet chicken processing plant fire, North Carolina's second-worst industrial disaster.
Process safety is an interdisciplinary engineering domain focusing on the study, prevention, and management of large-scale fires, explosions and chemical accidents in process plants or other facilities dealing with hazardous materials, such as refineries and oil and gas production installations. Thus, process safety is generally concerned with the prevention of, control of, mitigation of and recovery from unintentional hazardous materials releases that can have a serious effect to people, plant and/or the environment.
Diesel engine runaway is an occurrence in diesel engines, in which the engine draws extra fuel from an unintended source and overspeeds at higher and higher RPM, producing up to ten times the engine's rated output until destroyed by mechanical failure or bearing seizure due to a lack of lubrication. Hot-bulb engines and jet engines can also run away via the same process.
The San Juanico disaster involved a series of fires and explosions at a liquefied petroleum gas (LPG) tank farm in the settlement of San Juan Ixhuatepec, municipality of Tlalnepantla de Baz, State of Mexico, Mexico on 19 November 1984. The facility and the settlement, part of Greater Mexico City, were devastated, with 500–600 victims killed, and 5000–7000 suffering severe burns. It is one of the deadliest industrial disasters in world history, and the deadliest industrial accident involving fires and/or explosions from hazardous materials in a process or storage plant since the Oppau explosion in 1921.
On 7 February 2008, fourteen people were killed and thirty-six injured during a dust explosion at a refinery owned by Imperial Sugar in Port Wentworth, Georgia, United States. Dust explosions had been an issue of concern among U.S. authorities since three fatal accidents in 2003, with efforts made to improve safety and reduce the risk of reoccurrence.
BP p.l.c. is a British multinational oil and gas company headquartered in London, England. It is one of the oil and gas "supermajors" and one of the world's largest companies measured by revenues and profits. It is a vertically integrated company operating in all areas of the oil and gas industry, including exploration and extraction, refining, distribution and marketing, power generation, and trading.
The 2010 Connecticut power plant explosion occurred at the Kleen Energy Systems power station in Middletown, Connecticut, United States at 11:17 am EST on February 7, 2010. The plant had been under construction from September 2007, and was scheduled to start supplying energy in June 2010. The initial blast killed five and injured at least fifty; one of the injured later died in hospital, bringing the total death toll to six.
The Deepwater Horizon investigation included several investigations and commissions, among others reports by National Incident Commander Thad Allen, United States Coast Guard, National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, Bureau of Ocean Energy Management, Regulation and Enforcement, National Academy of Engineering, National Research Council, Government Accountability Office, National Oil Spill Commission, and Chemical Safety and Hazard Investigation Board.
On April 17, 2013, an ammonium nitrate explosion occurred at the West Fertilizer Company storage and distribution facility in West, Texas, United States, while emergency services personnel were responding to a fire at the facility. Fifteen people were killed, more than 160 were injured, and more than 150 buildings were damaged or destroyed. Investigators confirmed that ammonium nitrate was the material that exploded. On May 11, 2016, the Bureau of Alcohol, Tobacco, Firearms and Explosives stated that the fire had been deliberately set. That finding has been disputed.
The Williams Olefins Plant explosion occurred on June 13, 2013 at a petrochemical plant located in Geismar, an unincorporated and largely industrial area 20 miles (32 km) southeast of Baton Rouge, Louisiana. Two workers were killed and 114 injured. The U.S. Occupational Safety and Health Administration (OSHA) and the U.S. Chemical Safety and Hazard Investigation Board (CSB) launched investigations to determine how and why the heat exchanger failed. The Chemical Safety Board concluded that a standby heat exchanger had filled with hydrocarbon. This heat exchanger was isolated from its pressure relief; shortly after the heat exchanger was heated with hot water, the hydrocarbon flashed to vapor, ruptured the heat exchanger, and exploded.
The 2010 Tesoro Anacortes Refinery disaster was an industrial accident that occurred at the Tesoro Anacortes Refinery in Anacortes, Washington on April 2, 2010. Seven workers received fatal burns in an explosion and ensuing fire when a heat exchanger violently ruptured after a maintenance restart.
An explosion at the ARCO Chemical (ACC) Channelview, Texas petrochemical plant killed 17 people and injured five others on July 5, 1990. It was one of the deadliest industrial disasters in the history of the Greater Houston area.
{{cite AV media}}
: CS1 maint: others in cite AV media (notes) (link)