Case Study: BP Texas City Explosion 23 March 2005
Safety System Deficiencies in Unit Startup
Although actions or errors by operations personnel at the BP Texas City site, as described in the preceding section, were immediate causes of the March 23 accident, numerous latent conditions and safety system deficiencies at the refinery influenced their actions and contributed to the accident. Addressed here are the human factors that explain why feed was added to the tower for three hours without liquid being removed. While recognizing that human errors were made in the raffinate startup, this investigation goes beyond individual failures to gain a deeper understanding of why the incident occurred, which is more useful in major accident prevention. Renowned process safety expert Trevor Kletz puts it plainly: “To say accidents are due to human failing is like saying falls are due to gravity. It is true but it does not help us prevent them.” The broader aspects of this investigation revealed serious management safety system deficiencies that allowed the operators and supervisors to fail. The following underlying latent conditions contributed to the unsafe start up:
A work environment that encouraged operations personnel to deviate from procedure.
The deviations were not unique actions committed by an incompetent crew, but were actions operators, as a result of established work practices, frequently took to protect unit equipment and complete the startup in a timely and efficient manner.
Management did not watch startups or ensure that the startup procedure was regularly updated, even though the the unit’s equipment had changed over time. The procedure did not address critical events the unit experienced during previous startups, such as dramatic swings in tower liquid level, which could severely damage equipment and delay startup. In addition, specific instructions for unique startup circumstances were not included in the procedure, such as the unusual stopping and resumption of the ISOM startup or the routing of products to different storage tanks. Management had also allowed operators to make procedural changes without proper technical review, thereby encouraging unplanned (and potentially unsafe) deviations during startup. All of these managerial actions (or inactions) sent a strong message to operations personnel: the procedures were not strict instructions but were outdated documents to be used as guidance.
Operators relied on knowledge of past startup experiences (passed down by the more skilled veteran operators) and developed informal work practices to prevent future startup delays. Indeed, several procedural deviations made by the operations crew on March 23, 2005, were common practices in 18 previous raffinate splitter tower startups.
Lack of a BP policy or emphasis on effective communication for shift change and hazardous operations (such as unit startup).
Two critical miscommunications occurred among operations personnel on March 23, 2005, that led to the delay in sending liquid raffinate to storage: 1) the instructions for routing raffinate products to storage tanks were not