Texas City Refinery explosion

Fire-extinguishing operations after the Texas City refinery explosion

The Texas City Refinery explosion occurred on March 23, 2005, when a hydrocarbon vapor cloud was ignited and violently exploded at the ISOM isomerization process unit at BP's Texas City refinery in Texas City, Texas, killing 15 workers, injuring more than 170 others and severely damaging the refinery. The Texas City Refinery was the second-largest oil refinery in the state, and the third-largest in the United States with an input capacity of 437,000 barrels (69,500 m³) per day as of January 1, 2000.^[1] BP acquired the Texas City refinery as part of its merger with Amoco in 1999.^[2][3]

BP's own accident investigation report^[4] stated that the direct cause of the accident was "[...]heavier–than-air hydrocarbon vapors combusting after coming into contact with an ignition source, probably a running vehicle engine. The hydrocarbons originated from liquid overflow from the F-20 blowdown stack following the operation of the raffinate splitter overpressure protection system caused by overfilling and overheating of the tower contents." Both the BP and the U.S. Chemical Safety and Hazard Investigation Board reports^[5] identified numerous technical and organisational failings at the refinery and within corporate BP.

In 2011 BP announced that it was selling the refinery as part of its ongoing divestment plan to pay for ongoing compensation claims and remedial activities following the Deepwater Horizon disaster in 2010. The sale of the refinery was successfully completed at the start of 2013 to Marathon Petroleum Corporation for US$2.5 billion.^[6]

Background

The refinery was built in 1934, but had not been well maintained for several years.^[7] Consulting firm Telos had examined conditions at the plant and released a report in January 2005 which found numerous safety issues, including "broken alarms, thinned pipe, chunks of concrete falling, bolts dropping 60 ft and staff being overcome with fumes." The report's co-author stated, "We have never seen a site where the notion 'I could die today' was so real."^[8][9] The refinery had also had five managers in the six years since BP inherited it in its 1999 merger with Amoco.^[10]

Typical isomerisation reaction

The ISOM plant isomerization at the site was designed for the conversion of low octane hydrocarbons, through various chemical processes, into higher octane rating hydrocarbons that could then be blended into unleaded petrol. One component of this ISOM site was a unit called the raffinate splitter. When operational, this 170-foot tall tower was used to separate out lighter hydrocarbon components from the top of the tower (mainly pentane and hexane), which condensed and were then pumped to the light raffinate storage tank, while the heavier components were recovered lower down in the splitter, then pumped to a heavy raffinate storage tank. It had an operational capacity of 45,000 barrels (7,200 m³) per day.

Remedial work had been started on the raffinate splitter from February 21, 2005. Two other turnaround^[11] activities were also taking place at the adjacent Ultracracker Unit (UCU) and at the Aromatics Recovery Unit (ARU) at the same time.

In 1995 and again in 2002, site-wide temporary siting analysis reports had been created at the facility that established the agreed layout of trailers and other temporary structures. The next siting analysis was due to take place in 2007 and, therefore, any siting changes before then would be under the management of change (MOC) process. Plans were made late in 2004 to accommodate contractors due to work on the UCU in 2005 in nine single trailers and a single double-wide trailer adjacent to the ISOM process unit. Although the team carrying out this assessment had identified that the double-wide trailer would be less than 350 feet (110 m) from the ISOM plant (and therefore had the potential to be susceptible to severe damage in the event of an explosion), they did not have the expertise to complete the Amoco workboat siting analysis, which was based upon the American Petroleum Institute standard "API 752".^[12] A number of action items were created from this assessment, and according to the procedure, these had to be closed before the MOC could be approved and prior to the double-wide trailer being used. These two actions were still pending in March, 2005 but nevertheless, the double-wide trailer had already been in use by contractors from November, 2004. The remaining nine UCU contractor trailers arrived on site at the start of 2005, but these had not been included in the 2004 MOC, so the additional exposure risk of these new trailers being occupied in close proximity to the ISOM plant was never assessed.

Circumstances of the accident

The diagram shows the effects of the raffinate splitter tower overfilling, with subsequent release of flammable hydrocarbons into the environment through the blowback stack.

After works had been completed on the raffinate splitter, consideration was given to the impending start-up of the plant. One of the primary safety critical steps in the prestart-up process was the use of the BP Pre-Startup Safety Review (PSSR) procedure. The purpose of the review was to ensure that complete and thorough technical checks were carried out and that all non-essential personnel were clear during the start-up operation. Once completed, the PSSR would be signed off by refinery operations and safety managers, authorising the start-up work but this essential safety procedure was not completed.^[13] In addition, there were a number of serious issues with items of safety critical equipment which had not been resolved prior to the start-up commencing including an inoperative pressure control valve (PV-5002), a defective high level alarm in the splitter tower (LSH-5102), a defective sight glass used to indicate fluid levels at the base of the splitter tower and the vital splitter tower level transmitter had not been calibrated.

Start-up early morning

Nevertheless, the start-up process commenced with the Night Lead Operator on the March 22 with the initial filling of the splitter tower. The level transmitter was designed to indicate the raffinate level within a 5-foot (1.5 m) span from the bottom of the splitter tower to a 9-foot (2.7 m) level, i.e., 72% level indication would be 7.6 feet (2.3 m) from the bottom, but it was common practice to fill up to an indicated level of 99%, even though the procedural requirement was stated as 50%. The Day Supervisor arrived late for work and did not have a hand-over with the night shift. During the morning meeting on March 23, it was discussed that the heavy raffinate storage tanks were nearly full and, therefore, the second Day Supervisor was told that the start-up procedure should not continue, but this information was not passed on. The start-up procedure resumed just before 9:30 a.m. under instructions from the other Day Supervisor. Before recommencing the tower refill and circulation process, heavy raffinate was drained from the bottom of the tower via the level control valve into the heavy storage tank and was then shut off in "manual" mode and not the required "automatic" mode, with a 50% flow rate. The circulation process was restarted just before 10 a.m. and raffinate was once again fed into the tower, even though the level was already too high. Since the level control valve was shut and, therefore, there was no circulation out of the tower, i.e. no heavy raffinate being transferred to the storage tank, the splitter tower inevitably began to fill up. The defective level transmitter continued to show the level at less than 100%, and since the external sight glass was opaque, a visual check to verify the level in the splitter tower was not possible.

Late morning

Burners in the furnace were turned on to pre-heat raffinate going into the tower and to heat the raffinate in the tower bottom, two more were lit at 11:16am. The required temperature for the tower reboiler return flow was 135 °C (275 °F) at 10 °C (18 °F) per hour but the procedure was not followed. During this start-up, this return flow temperature reached 153 °C (307 °F) with a rate increase of 23 °C (41 °F) per hour.^[14] The erroneous 93% reading from the defective level transmitter still indicated an ongoing safe level condition in the tower but there was still no flow of heavy raffinate from the splitter tower to the storage tank as the level control valve remained closed; instead of the hydrocarbon liquid level being at 8.65 feet (2.64 m), i.e. 93% level, as indicated, it had actually reached 67 feet (20 m). Just before midday, with heat increasing in the tower, the actual fluid level had risen to 98 feet (30 m). Pressure started to build up in the system as the remaining nitrogen in the tower and associated pipework became compressed with the increasing volume of raffinate. The operations crew thought that the pressure rise was a result of overheating in the tower bottoms as this was a known start-up issue, so the pressure was released.

At noon

By 12:42 p.m., the furnaces had been turned down and the level control valve was finally opened, draining heavy raffinate from the splitter tower. The operators believed the level transmitter reading which was now down to 78% (7.9 feet [2.4 m]) but the fluid level in the 170-foot (52 m) tall splitter tower had now reached 158 feet (48 m). Although the raffinate flow into and out of the tower were now matching (as the heated raffinate was now leaving the bottom of the tower), heat from this outflow was being transferred via a heat exchanger back into the liquid flowing into the tower from the feed pipe, raising the average temperature inside the column close to the liquid's boiling point. The liquid, already close to the top of the tower but continuing to expand due to the heat, finally entered the overhead vapor line and flowed into the relief valve system.

Pressure built up in the system as fluid filled the pipework running to the safety relief valves and the condenser. At 1:13 p.m., the three pressure relief valves were forcibly opened as the hydrostatic head pressure of the raffinate built to over 60 psi (410 kPa) above atmospheric pressure. With the relief valves fully open, over 196,000 litres (52,000 US gal) of heated raffinate passed directly into the collection header over a 6 minute period before closing, as pressure in the system dropped to their closing or blowdown pressure of 37.3 psi (257 kPa) above atmospheric pressure.

Explosion

Investigating this pressure spike, the Day Board Operator fully opened the level control valve to the heavy raffinate storage tank and shut off of the gas fueling the furnace, but the raffinate feed into the splitter tower was not shut off. Hot raffinate flowed into the blowdown drum and stack and as it filled, some of the fluid started to flow into the ISOM unit sewer system via a 6-inch (15 cm) pipeline at the base of the blowdown drum, but the high level alarm for the blowdown drum didn't sound. As the blowdown drum and stack filled up, hot raffinate shot out of the top of the stack and into the air, forming a 20-foot (6 m) "geyser".^[15] The hot raffinate rained down on the ground and ran down the side of the blow-down drum and stack and pooled at the base of the unit. A radio call was received in the control room that hot hydrocarbons were overflowing from the stack. A pick-up truck, with its engine running, had been carelessly parked within 30 feet (9 m) of the blowdown stack; the vapor cloud reached the vehicle, and hydrocarbon fumes were drawn directly into the air intake valve, causing the engine to race. Nearby workers frantically tried to shut down the engine, without success. The expanding vapor cloud forced the workers who were trying to shut down the overspeeding truck engine to retreat. The cloud continued to spread across the ISOM plant, across the pipe-rack to the West and into the trailer area unimpeded. No emergency alarm sounded, and at approximately 1:20 p.m., the vapor cloud was ignited by a backfire seen from the overheating truck engine by nearby witnesses, producing a massive explosion that was heard for miles.^[16] The blast pressure wave struck the contractor trailers, either completely destroying or severely damaging many of them. The force of the explosion sent debris flying, instantly killing 15 people in and around the trailers and severely injuring 180 others. The pressure wave was so powerful it blew out windows off site up to a distance of three-quarters of a mile (1.2 km) away. An area estimated at 200,000 square feet (19,000 m²) of the refinery was badly burned by the subsequent fire that followed the violent explosion, damaging millions of dollars worth of refinery equipment.^[17] The entire ISOM unit was severely damaged by the explosion and subsequent fire, and as a result, remained out of operation for more than 2 years.

Investigation reports

Both BP-house experts as well as various authorities and committees investigated the explosion in relation to technical, organizational, and safety culture aspects. The results of the technical investigation of a team of BP-experts were summarized in the so-called Mogford report, the findings with regard to the organizational aspects and the responsibility of management in the so-called Bonse report. The U.S. Chemical Safety and Hazard Investigation Board examined both the technical aspects and the responsibility of the supervisory authorities. The Occupational Safety and Health Administration (OSHA) reviewed in the aftermath the compliance in relation to the various legal requirements.

Organisational failings included corporate cost-cutting, a failure to invest in the plant infrastructure, a lack of corporate oversight on both safety culture and major accident prevention programs, a focus on occupational safety and not process safety, a defective management of change process (which allowed the siting of contractor trailers too close to the ISOM process unit), the inadequate training of operators, a lack of competent supervision for start-up operations, poor communications between individuals and departments and the use of outdated and ineffective work procedures which were often not followed. Technical failings included a blowdown drum that was of insufficient size, a lack of preventative maintenance on safety critical systems, inoperative alarms and level sensors in the ISOM process unit and the continued use of outdated blowdown drum and stack technology when replacement with the safer flare option had been a feasible alternative for many years.^[18]

Mogford Report

A team of experts led by John Mogford, the Senior Group Vice President, Safety and Operations, examined the technical aspects of the explosion and suggested corrective actions. On December 9, 2005, BP published this accident investigation report.^[19] The report identified as main causes four critical factors. Without those factors, the event would not have happened or would have had a considerably lower impact. The factors included the unintentional release of substance, the operating instructions as well as their compliance with the commissioning of the rectification column, the work control policies, and the structure of the trailers and the design of the blow out vessel.

Bonse report

Another internal report (known as the Bonse report, led by the chairman of BP Germany, Wilhelm Bonse-Geuking) that was issued identified numerous management failures. On May 3, 2007, a court ordered the release of the report, that was intended to be used only for internal purposes.^[20] The report investigated the compliance of management to internal management instructions (BP management framework, BPMF) and the BP Code of Conduct. The Refinery division of BP had issued these instructions in accordance with the Group-wide regulations. The so-called Blue Book was published in 2005. In addition to personal failings, the report noted unclear responsibilities within the Group at all management levels. As another contributing factor, the report noticed the poor state of the plants and to low spending on maintenance.

CSB report

U.S. Chemical Safety and Hazard Investigation Board (CSB) logo

Given the extent of the disaster the U.S. Chemical Safety and Hazard Investigation Board examined both the safety management in the Texas City refinery and the role of the BP Group as well as the role of the Occupational Safety and Health Administration (OSHA) as a regulatory body. The results of the investigation of the agency were published in a three hundred page long report on 20 March 2007.^[21]

The CSB found that organizational and safety deficiencies at all organizational levels of BP contributed to the refinery explosion, such as cost cuts and spending cuts in the safety area, although a large part of the refinery infrastructure and process equipment were in poor condition. In addition, the committee said that BP had cut the budget for training and reduced staff. Furthermore, the CSB found that OSHA had as supervising authority failed to carry out planned inspections of the refinery and did not enforce safety rules, although there were many warning signs. After the explosion, OSHA found 301 violations of requirements and imposed a fine of US$21 million. The CSB found that only a limited number of OSHA inspectors received the specialized training and experience necessary for complex investigations in refineries.

The CSB issued a recommendation to develop a guideline for understanding, recognizing and dealing with fatigue during shift work. The directive API Recommended Practice 755 provided guidance for refineries, petrochemical and chemical plants and other facilities on how to deal with fatigue syndromes (Fatigue Risk Management System, FRMS). These guidelines include recommendations for work on rotating shifts, such as for the maximum number of overtime hours and the number of days to be worked on without interruption.

Aftermath

The CSB report found that BP had failed to heed or implement safety recommendations made before the blast. Among them were:

• In 1991, the Amoco refining planning department proposed eliminating blowdown systems that vented to the atmosphere, but funding for this plan was not included in the budget.
• In 1992, OSHA issued a citation to Amoco for unsafe design of similar pressure-relief systems at the plant. However, Amoco successfully persuaded OSHA to drop this citation by relying on the less-stringent requirements in API Recommended Practice 521.
• In 1993, the Amoco Regulatory Cluster project proposed eliminating atmospheric blowdown systems, but again, funding was not approved.
• In 1995, a refinery belonging to Pennzoil suffered a disaster when two storage tanks exploded, engulfing a trailer and killing five workers. The conclusion was that trailers should not be located near hazardous materials. However, BP ignored the warnings, and they believed that because the trailer where most of the deaths happened was empty most of the year, the risk was low.
• Despite Amoco's process safety standard No. 6, which prohibited new atmospheric blowdown systems and called for the phasing out of existing ones, in 1997, Amoco replaced the 1950s-era blowdown drum/vent stack that served the raffinate splitter tower with an identical system, instead of upgrading to recommended alternatives that were safer.
• In 2002, engineers at the plant proposed replacing the blowdown drum/vent system as part of an environmental improvement initiative, but this line-item was cut from the budget, due to cost pressures.
• Also in 2002, an opportunity to tie the ISOM relief system into the new NDU flare system was not taken, due to a US$150,000 incremental cost.
• During 2002, BP's Clean Streams project proposed converting the blowdown drum to a flare knock-out tank, and routing discharges to a flare. When it was found that a needed relief study of the ISOM system had not been completed due to budget constraints, the Clean Streams project proposed adding a wet/dry system to the ISOM instead.
• Between 1994 and 2004, at least eight similar cases occurred in which flammable vapors were emitted by a blowdown drum/vent stack. Effective corrective action was not taken at the BP plant.

As a result of the accident, BP said that it would eliminate all blowdown drums/vent stack systems in flammable service. The CSB, meanwhile, recommended to the American Petroleum Institute that guidelines on the location of trailers be made.

OSHA ultimately found over 300 safety violations and fined BP US$21 million — the largest fine in OSHA history at the time.^[10]

Legal action

BP was charged with criminal violations of federal environmental laws, and has been named in lawsuits from the victims' families. The Occupational Safety and Health Administration gave BP a record fine for hundreds of safety violations,^[22] and in 2009 imposed an even larger fine after claiming that BP had failed to implement safety improvements following the disaster.^[23]

On February 4, 2008, U.S. District Judge Lee Rosenthal heard arguments regarding BP's offer to plead guilty to a federal environmental crime with a US$50 million fine. At the hearing, blast victims and their relatives objected to the plea, calling the proposed fine "trivial". So far, BP has said it has paid more than US$1.6 billion to compensate victims.^[24] The judge gave no timetable on when she would make a final ruling.^[25]

Ed Bradley, 1978

The case of Eva Rowe, a young woman who lost her parents in the explosion, attracted nationwide attention. She let it be known that she would not accept a settlement and would drag the group to justice. Ed Bradley, a well-known American journalist who made history in the television magazine 60 Minutes, published her case.

On 9 November 2006 BP settled the case with Rowe as the last applicant after her lawyers had tried to invite John Browne as witnesses. The amount of compensation for Eva Rowe remained unknown. BP also paid US$32 million to universities and hospitals nominated by Rowe including the Mary Kay O'Connor Process Safety Center at Texas A & M University, the Medical Faculty of the University of Texas in Galveston, the Truman G. Blocker Adult Burn Unit and the College of the Mainland in Texas City. Furthermore, BP published about seven million pages of internal documents, including the Telos and Bonse report.^[26]

On October 30, 2009, OSHA imposed an US$87 million fine on the company for failing to correct safety hazards revealed in the 2005 explosion. In its report, OSHA also cited over 700 safety violations. The fine was the largest in OSHA's history, and BP announced that it would challenge the fine.^[27]

On August 12, 2010, BP announced that it had agreed to pay US$50.6 million of the October 30 fine, while continuing to contest the remaining US$30.7 million; the fine had been reduced by US$6.1 million between when it was levied and when BP paid the first part.^[28]

Subsequent incidents

After the March explosion, other safety incidents occurred at the plant:

• On July 28, 2005, a hydrogen gas heat exchanger pipe on the resid hydrotreater unit ruptured, causing a release of hydrogen that erupted into a large fireball. One person received minor injuries. The Chemical Safety Board found that a contractor had accidentally switched a low-alloy steel elbow with carbon steel pipe elbow during maintenance, causing a failure mode known as "high temperature hydrogen attack" (HTHA).

View of the ultracracker unit – location of January 14, 2008, accident.

The CSB found that BP had not informed the maintenance contractor that the elbows were different, and the maintenance contractor had not used any procedure (such as tagging) to ensure that the elbows were re-installed into their original locations.

• On August 10, 2005, there was an incident in a gas-oil hydrotreater that resulted in a community order to shelter. This incident occurred when a hole developed in the bottom of a valve that handles high-pressure gas and oil.
• On January 14, 2008, William Joseph Gracia, 56, a veteran BP operations supervisor, died following head injuries sustained as workers prepared to place in service a water filtration vessel at the refinery's ultracracker unit.^[29]
• On September 21, 2010, an incident in the Pipestill 3B unit left two workers with serious steam burns.^[30]

Baker Panel report

James A. Baker III

Following the 2005 incidents, on August 17, 2005, the CSB recommended that BP commission an independent panel to investigate the safety culture and management systems at BP North America.^[31] The panel was led by former U.S. Secretary of State James Baker III. The Baker panel report was released on January 16, 2007.^[32][33]

The Baker report cited a weak safety culture, and reported that BP did not adequately follow the Department of Energy's published safety recommendations.^[34] The report suggested that cost-cutting and production pressure from BP executives may have resulted in a lack of needed safety measures across the board.^[35] Carolyn W. Merritt, Chairman and Chief Executive Officer of the CSB stated, "The combination of cost-cutting, production pressures, and failure to invest caused a progressive deterioration of safety at the refinery. Beginning in 2002, BP commissioned a series of audits and studies that revealed serious safety problems at the Texas City refinery, including a lack of necessary preventive maintenance and training. These audits and studies were shared with BP executives in London, and were provided to at least one member of the executive board. BP's response was too little and too late. Some additional investments were made, but they did not address the core problems in Texas City. In 2004, BP executives challenged their refineries to cut yet another 25% from their budgets for the following year."^[32] In addition, safety improvements between 2002 and 2005 were "largely focused on personal safety — such as slips, trips, falls, and vehicle accidents, rather than on improving safety performance," according to Supervisory Investigator Don Holstrom.^[32]

Additionally, the panel created and administered, to all five of BP's North American refineries, an employee survey focusing on various aspects of "process safety". From the survey results, they concluded that the Toledo and Texas City, Texas plants had the worst process safety culture, while the Cherry Point Refinery, located in Birch Bay, Washington, had the best process safety culture. The survey results also showed that managers and white-collar workers generally had a more positive view of the process safety culture at their plants when compared with the viewpoint of blue-collar operators and maintenance technicians. The director of the Cherry Point refinery was promoted to oversee better implementation of process safety at BP.

In popular culture

• The explosion was featured on History Channel's series Modern Marvels, on Season 12, episode 47 "Engineering Disasters 20."^[36]
• The explosion was also featured on National Geographic's television series Seconds From Disaster, on the episode "Texas Oil Explosion".

See also

• National Geographic Seconds From Disaster episodes
• Deepwater Horizon oil spill

References

External links

• U.S. Chemical Safety Board
• BP: Texas City Refinery Incident – March 23, 2005
• BP Accident Investigation Report (Archive)
• Baker Panel Report
• BP America Refinery Explosion - Chemical Safety Board
• Brent Coone website – hosts documents released to the public by BP as one of the terms of settlement with Eva Rowe
• Special Report: 2005 Texas City Explosion. Houston Chronicle.
• Lessons from Texas City: A case history, Loss Prevention Bulletin, Issue 192, 2006, IChemE, UK.
• Remember the 15 Memorial site for those lost in the explosion with ongoing information on the aftermath.
• Anatomy of a Disaster (2008). A film produced by the U.S. Chemical Safety and Hazard Investigation Board detailing the sequence of events and cause of the explosion. Based on the CSB's public report the film also features interviews with members of the investigative team and commentary by outside safety experts (running time 55:34).

Coordinates: 29°22′29″N 94°56′01″W / 29.37472°N 94.93361°W / 29.37472; -94.93361