Lessons Learned from the Texas City

Refinery Explosion
Mike Broadribb
Mary Kay OConnor Process Safety Center Symposium,
College Station, Texas
October 24, 2006

Texas City Refinery

Texas City refinery is located 40 miles from

Houston in Texas, USA
1600 people work at the refinery plus
contractors
It is one of the largest refineries in the USA,
processing 460,000 barrels of crude oil/day,
around 3% of gasoline US supplies

The accident
An explosion and fire occurred at the
refinerys isomerization unit
The explosion happened at 13:20
(Houston time) on March 23, 2005
15 people died and many more were
injured
Note: The isomerization unit boosts the
octane of gasoline blendstocks.

Simplified block diagram of Raffinate Splitter

Vent Relief system

Feed Heat
Exchanger

Condensate

Bottom
Product

Blowdown
stack

Feed
Furnace
Raffinate
Splitter

Raffinate Splitter and Blowdown Drum Stack

Raffinate Splitter Tower
Blowdown Drum Stack

Aerial Photograph of Isomerization Unit

What happened ?
Prior to Feb.
15

Temporary trailers placed 150 feet from the Isomerization unit. They were
being used by personnel preparing for a turnaround at another part of the
refinery

Feb. 21

Shut down part of the Isomerization unit to refresh the catalyst in the feed
unit

March 22

March 23

On the night shift, the raffinate splitter was being restarted after the
shutdown. The raffinate splitter is part of the Isomerization unit that distils
chemicals for the Isomerization process
Splitter was over-filled and over-heated
When liquid subsequently filled the overhead line the relief valves opened
This caused excessive liquid and vapour to flow to blowdown drum and vent
at top of the stack
An explosion occurred which killed 15 people and injured many others

Texas
TexasCity
CityRefinery
RefineryMarch
March23,
23,2005
2005
15
15People
PeopleKilled
Killed
Many
Manymore
moreinjured
injured
AAcommunity
communitydevastated
devastated

Incident

Isomerization Unit

Satellite Control Room

Inside Satellite Control Room

Cooling Tower

Trailer

Catalyst Warehouse

Storage Tank

Isomerization Unit

Double-Wide Trailer

10

Double-Wide Trailer

Key Issues
Operator Inattention
Following Procedures
Supervisor Absence
Communication shift handover
Trailers Too Close to Hazards
Some Instrumentation Did Not Work
Tower Level Transmitter Worked as Designed
Abnormal Start-ups
Investigation of Previous Incidents
Blowdown Drum Vented Hydrocarbons to Atmosphere
Opportunities to Replace Blowdown Drum
Evaluation of Connection to Flare

Key events timeline - 2005

Texas City
Incident

CSB safety
recommendation:
form an
Independent
Panel

23rd March

17th May

BP Incident
Investigation Team
established

BP Incident
Investigation Teams
Interim Report
published

17th August

CRITICAL FACTORS

OSHA and BP
Products
N America BP Announces
settlement
Formation of
agreed
Independent
Panel

22nd September 24thOct 27thOct

CSB
Preliminary
Findings

9th December

BP Incident
Investigation Teams
Final Report published

UNDERLYING
CAUSES &
CULTURAL ISSUES

BP incident investigation team reports

The Interim Report identified 4 critical factors; the Final Report
confirmed the critical factors and identified underlying cultural
issues:
CRITICAL FACTORS:

UNDERLYING CULTURE:

Insufficient business context

Safety as a priority

Organizational complexity

Inability to see risk

Lack of early warning indicators

Start-up procedures and

management oversight
Loss of containment
Design and engineering of
blowdown unit
Control of work and trailer siting

Underlying Cultural Issues

Business Context

Inability to See Risk

Motivation

Hazard Identification Skills

Morale

Understanding of Process Safety

PAS Score

Facility Siting
Vehicles

(Process) Safety as a Priority

Emphasis on Environment and
Occupational Safety

Lack of Early Warning

Depth of Audit
KPIs for Process Safety

Organizational Complexity &

Capability

Sharing of Learning / Ideas

Investment in People
Layers and Span of Control
Communication

Technical Lessons Learned

Many Lessons from Texas City
Level Indication
Blowdown Systems
Relief Systems
Facility Siting

Level Transmitter
Design typical of many in the industry
Displacer type instrument
Not faulty worked as designed before, during and after the incident
Trending downwards (but other data available)

Lessons Learned
Functionality changed when top tap flooded

Raffinate Splitter Bottoms Level

Level instrument submerged early with cold raffinate
Instrument output changed from reading liquid level to indication of buoyancy
As raffinate temperature went up (green), density decreased (purple)
Level output on the DCS screen decreased (blue)
Bottoms Level Indicator Performance
100

600

Bottoms Level Indication (%)

Estimated Density (lb/ft3)
Relative Density
Bottoms Temperature (F)

500

80
400

70
300
60

200
50

Bottoms Temperature (F)

Bottoms level Indication and Bottoms Density

90

100
40

30
3/23/05 10:00 AM

0
3/23/05 11:00 AM

3/23/05 12:00 PM

3/23/05 1:00 PM

Level Transmitter
Displacer type instrument
Not faulty worked as designed before, during and after the incident
Trending downwards (but other data available)
Design typical of many in the industry

Lessons Learned
Functionality changed when top tap flooded
Critical high level alarms/trips ? LOPA
Robust testing procedures and documentation of instrument testing

Blowdown Systems
Commitment to replacing blowdown drums on light
hydrocarbon duty
Survey all sites
Lessons Learned
Design basis sometimes unclear mods. over time
Some have flammable liquids (flash < 100F)
Limited understanding of vapor dispersion
Drums may be too small
- inadequate liquid holdup
- vapor/liquid disengagement
Discharge to sewers sometimes not well
understood
Quench designs may be ineffective
- Lack of contacting internals
- Inadequate or non-existent controls
- Potential for steam explosions
Potential for stack fire/explosion due to inadequate
purge

10

Blowdown Systems
Wider Issues
Atmospheric Relief
Variable practice
More common in USA
Vent Pipe Design
Dispersion adequacy ?
Possibility of liquid under upset
conditions ?

11

Relief System Studies

Design
Sites generally have some design basis documentation
Some very good practices in place
Completeness and format vary widely, no common framework
Some not updated for current operation
ACTION: Implement common practice for relief system documentation
ACTION: Improve MOC process to capture relief system changes
Accountability
Some sites have no accountable person for relief systems process design
Expertise and technical knowledge of pressure relief systems is limited
ACTION: Appoint SPAs
Competency
Operator training is critical to understanding relief system operation and for emergency
response
ACTION: Enhance program of training and drills
12

Facility Siting
Trailers used as temporary buildings
Local practice based on API RP 752 used for siting
Adopted own occupant vulnerability correlation as
allowed by API RP 752
Predicts lower vulnerability than CCPS

Predicted Side-On Pressure Contours (in psi)

Facility Siting
Trailers used as temporary buildings
Local practice based on API RP 752 used for siting
Adopted own occupant vulnerability correlation as
allowed by API RP 752
Predicts lower vulnerability than CCPS
Overpressure at trailers: 2.5psi peak side-on
430 psi.ms impulse
At 2.5 psi (side) CCPS/API predicts 50% vul.
Lessons Learned
CCPS vulnerability correlation may not be
conservative
Long impulse duration ?
API RP 752 may not be as conservative as thought
and is currently under review
BP commitment no trailers in h-c areas
3

Reminder of the Swiss Cheese Model

Hazard

Hazards are contained by multiple

protective barriers

Protective
Barriers

Weaknesses
Or Holes

Barriers may have weaknesses or

holes
When holes align hazard energy is
released, resulting in the potential for
harm
Barriers may be physical engineered
containment or behavioral controls
dependent on people

Accident

Holes can be latent/incipient, or

actively opened by people

Texas City Explosion

Hazard Management Diagram
Hierarchy of control Bias towards hardware/inherent safety & reducing the scope for human error multi barrier defence

Relief and
Blowdown
System

Control, Alarm &

Shutdown system

Inherent Design
Plant Layout

Effective
Supervision
/ Leadership

Operations
Procedures

Learning from
the Past
Maintenance
& Inspection

Work Control

Audit & Self

Regulation
Training &
Competency

Active & Passive

Fire Protection

Communication

Rescue &
Recovery

Escape /
Access

Management
of Change

Investigation &
Lessons Learned
Support to Next
of Kin & Injured

HAZARD
REALIZATION

HAZARD
Normal
Hydrocarbon
Inventory in
Raffinate
Splitter

Loss of
containment

Ignition

Explosion

Inventory
increased
Proximity
of nonessential
personnel
to hazard
Flare not
used

Multiple fatalities
and injuries

No up to
date relief
study design
basis
unclear
Capacity
of
blowdown
drum
exceeded

Operate
outside
envelop
No failsafe
shutdown
No mass
balance or
attention
to other
data
Lost
process
control

Faulty
high level
alarm not
reported

Previous
incidents &
upsets not
reported
Admin.
rather than
ISD
solutions
Hierarchy
of control
not applied

Procedures
not followed
Steps not
signed off
Use of
local
practices

Failure to
recognize
hazard to trailers
from start-up
People not
notified of startup
Multiple sources
of ignition in
adjacent areas

Inadequate
HAZID skills
Lack of
underpinning
knowledge
Failure to
follow
procedures
Confusion
over who was
in charge
No verification
on procedures
in use
Absent from
unit at critical
times

Pre-start-up
review not
performed
Procedural
compliance not
checked
Supervisor offsite
No interventions
Inadequate KPIs
for process safety

No effective
handover
between
shifts
Unit alarm
not sounded
No / incomplete
MOCs for trailer
siting
Blowdown drum
modified without
rigorous MOC

Active &
passive fire
protection

Emergency
response by site and
external authorities
Hospitalization

Access & escape route

diversity
Access to scene

Strategic concepts
In order to reduce the potential for future major incidents and losses, three layers of protection are to
be considered:

plant engineering hardware, control systems, and layouts to eliminate, control and mitigate
potential hazards to people, and improve productivity

processes management systems to identify, control and mitigate risks, and drive continuous
operational improvement

people capability of our people in terms of leadership skills, relevant knowledge and
experience, and the organizational culture they create

In layers of protection, hard barriers are more reliable than soft barriers, but all rely on people
hazard
reduction

hard barriers

soft barriers

accident
or loss

hazard

physical
controls

procedures

generic
systems

peoples
behaviors

Principal actions
Plant
No trailers or temporary accommodation to be placed inside areas (of
refineries) containing hydrocarbons, even if the assessment of risk is
negligible
Blowdown stacks used for light hydrocarbon to be phased out as quickly as
possible
Process
Operating procedures to be clear, appropriate for their purpose, and always
followed
People
Build capability for operational leadership, supervisors, and technicians

Other Actions
Texas City
Organization, accountabilities, communication,
$1 billion investment program, off-site offices, facility siting study, trailers removed,
reduced vehicles, blowdown stacks in light h-c duty being removed, engineering
studies (relief systems and SCE),
Supervisory oversight, operator training.
BP Group
Safety & Operations organization,
Assessment of temporary buildings, removal of blowdown drums, engineering
studies of atmospheric vents
Review of operating procedures,
Development of OMS, implementation of CoW and IM standards,
External
Assisting API, sharing lessons learned

Other BP Activities Associated with the

Response
Government Agencies
Continue to cooperate with government agencies and proactively share
reports and findings
US Chemical Safety Board
Continue discussions with CSB incident investigators in an effort to achieve a
common understanding of the facts
Independent Panel
Voluntarily appointed an independent panel, comprised of world renowned
experts, chaired by Former US Secretary of State James Baker

What can we learn from this incident ?

Many lessons that can be learnt from Texas City, including:
Temporary building siting is a critical step in managing flammable / toxic
risks
Atmospheric venting needs careful design and operation
Procedures are ineffective if they are not up-to-date and routinely followed
Competency and behaviors of Operations leadership, supervision and
workforce are fundamental to safe operations
Other lessons involve management visibility and accountability, hazard
identification, hazards of startup operations, performance measures for
process safety, emergency drills, etc.
Incident investigation report available at: www.bpresponse.org

10