Case Study: BP Texas City Explosion 23 March 2005
communicated from Texas City management and supervisors to operators; and 2) the condition of the unit – specifically, the degree to which the unit was filled with liquid raffinate – was not clearly communicated from night shift to day shift.
Malfunctioning instrumentation that did not alert operators to the actual conditions of the unit.
The Board Operator’s decision-making was influenced by incorrectly calibrated instrumentation on the raffinate splitter tower. Accurate instrument readings of process conditions, such as product level, are critical during unit startup, as they provide the operator with a way to monitor the process and help the operator detect system irregularities. When instrumentation provides false or misleading information, accidents are likely.
During the March 23, 2005, startup, the level transmitter indicated that the liquid level in the splitter tower was gradually declining, although it was actually rising.75 At 1:04 p.m. (approximately 16 minutes before the explosions), the level indicator read 78 percent (a height of about 7.9 feet) in the tower); however, the tower level was actually at 158 feet. Operations personnel involved in the raffinate section startup were unaware that the transmitter’s reading was inaccurate.
The Day Board Operator stated that he saw the declining level in the tower over three hours prior to the incident and believed the level was accurate, as he expected that the level would decline as the tower heated up and the system returned to normal operating limits.
The Board Operator’s belief that the tower level was accurate was reinforced by the redundant high level alarm’s failure to activate.76 This alarm provided a redundant high level indication should the level transmitter malfunction. However, this alarm’s set-point was not known to operations personnel or provided in the procedure, control data, or training materials. The lack of a set-point at which the alarm would sound made recognizing the failure of the alarm less apparent. And because the separate alarm did not sound, the Board Operator believed this confirmed the fact that the level had actually dropped in the tower as liquid raffinate left the tower and circulated to the other unit equipment. He did not verify his conclusion about the decline in tower liquid level with any other operations personnel.
In addition, had the tower level sight glass been clean and functional, it could have provided a visual verification of the actual tower level. However, because it was dirty and unreadable the tower liquid level could not be visually verified and compared against the level transmitter reading. The Board Operator truly had no functional and accurate measure of tower level on March 23, 2005.
A poorly designed computerized control system that hindered the ability of operations personnel to determine if the tower was overfilling.
The Texas City complex is monitored and controlled via a computerized control system80 in a central control room in the AU2 unit. (Appendix K