Case Study: BP Texas City Explosion 23 March 2005
procedure required the level control valve to be placed in “automatic” and set at 50 percent to establish heavy raffinate flow to storage (ERROR). The Day Board Operator said that, from his experience, when the splitter tower bottoms pumps were started and associated equipment filled, the tower level dropped. Operations personnel stated that if the level was maintained at only 50 percent, a drop in liquid level could result in losing heavy raffinate flow from the bottom of the tower, and that loss of flow from the tower bottom’s pump to the furnace would shut down the furnace and the startup process. The Day Board Operator observed a 97 percent level when he started circulation and thought that this level was normal (ERROR); he said he did not recall observing a startup where the level was as low as 50 percent. At 10:10 a.m., 20,000 bpd of raffinate feed was being pumped into the tower.. The Day Board Operator said he was aware that the level control valve was shut. There was likely no flow out of the tower at this time.
The tower instrumentation continued to show a liquid level slightly less than 100 percent of the range of the transmitter (it was over ranged and apparently indicating incorrectly). The level sight glass, as stated previously, could not be used to visually verify the tower level since it had been nonfunctional for several years. Knowing the condition of the sight glass, the Day Board Operator did not ask the outside crew to visually confirm the level. Even though the tower level control valve was not at 50 percent in “automatic” mode, as required by the startup procedure, the Day Board Operator said he believed the condition was safe as long as he kept the level within the reading range (span) of the transmitter.
The Day Board Operator continued the liquid flow to the splitter tower, but was unaware that the actual tower level continued to rise. At 9:55 a.m., two burners were lit in the raffinate furnace, which pre-heated the feed flowing into the splitter tower and served as a reboiler, heating the liquid in the tower bottom. As the unit was being heated, the Day Supervisor, an experienced ISOM operator, left the plant at 10:47 a.m. due to a family emergency and did not get a relief. The second Day Supervisor was devoting most of his attention to the final stages of the startup of another unit at the plant; he had very little ISOM experience and, therefore, did not get involved in the ISOM startup. No experienced supervisor or ISOM technical expert was assigned to the raffinate section startup after the Day Supervisor left, although BP’s safety procedures required such oversight (ERROR).
Brief Pause to Review
The Safety Culture of Texas City was broken. Despite numerous audits since 1999 telling senior managers about serious deficiencies and unsafe practices, nothing of substance was done, operators lived with critical equipment deficiencies, and managers at the facility had a poor record of following up on problems to find their causes and correct them.