Case Study: BP Texas City Explosion 23 March 2005
Higher level management did not sign off on required safety checklists or authorize the startup.
Shift turnover was a mess. Night shift left no records of where they left off in an unfinished procedure. Some people left early (so did not share what they knew) and some came late and did not systematically learn what was going on. The exchange of information between those that were present was perfunctory and incomplete. The instruction to not start the raffinate section was not communicated to the ISOM operations personnel.
The logs were a mess so day shift could not tell what had been done by the night shift from reading them.
Several members of the watch team had been working twelve hour shifts with no days off for 29 or more days. They were fatigued and probably not capable of thinking clearly if the startup was normal. They were probably completely incapable of struggling through complex thought processes if things were not normal.
Key indications and back up systems were inoperable. Maintenance that was reported as necessary was not done. Goodness knows if anyone had any maintenance records to review as part of the start up.
The training level of the day shift mechanics and operators was abysmal, a fact known to BP managers. The company had been significantly reducing the number of frontline operators since 1996.
The operators had procedures, but considered them guidelines only so they did not review them, ignored requirements, and did not use them for crew briefings. They routinely overfilled the raffinate splitter tower level well above the procedure limit of 50 percent. The frontline supervisor signed off several items on the startup procedure that were not complete.
Despite the known risks of unit startup and plant policies recommending additional supervision for the evolution, no extra personnel were assigned and no senior managers were on hand.
Hundreds of people that were not part of the startup (and thus were non-essential to the operation of the ISOM unit) were in the area unnecessarily.
At 11:16 a.m., operators lit two additional burners in the furnace. While the transmitter indicated that the tower level was at 93 percent (8.65 feet) in the bottom 9 feet of the tower, post accident analysis determined that the actual level in the tower was 67 feet. The fuel to the furnace was increased at 11:50 a.m., at which time the actual tower level was 98 feet, although the transmitter indicated that the level was 88 percent (8.4 feet) and decreasing.
At 12:41 p.m., the tower’s pressure rose to 33 psig, due to the significant increase in the liquid level compressing the remaining nitrogen in the raffinate system. The operations crew, however, believed the high pressure to be a result of the tower bottoms overheating, which was not unusual in previous startups. In response to the high pressure, the outside operations crew opened the 8-inch valve that vented directly to the blowdown drum, which reduced the pressure in the tower.