Case Study: BP Texas City Explosion 23 March 2005
BP supervision decided to initiate the startup of the ISOM unit raffinate section during the night shift on March 22, 2005. However, after the startup was begun, it was stopped and the raffinate section was shut down to be re-started during the following day shift. Starting, but then stopping, the unit was unusual and not covered in the startup procedures, which only addressed one continuous startup.
The Night Lead Operator controlled filling the raffinate section from the satellite control room because it was close to the process equipment. The Night Board Operator controlled the other two process units from the central control room. The Night Lead Operator did not use the startup procedure (ERROR) or record completed steps for the process of filling the raffinate section equipment (ERROR), which left no record of the startup steps completed for the operators on the next shift.
As stated earlier, the splitter tower was equipped with a level transmitter that measured the tower’s liquid level in a 5-foot span within the bottom 9 feet of the 170-foot tall tower. The splitter tower also had two separate alarms; one was programmed to sound when the transmitter reading reached 7.6 feet in the tower, and the other was a redundant high level alarm that was designed to sound when tower level reached 7.9 feet. However, when the raffinate splitter tower was filled beyond the set points of both alarms to a level reading of 99 percent on the transmitter in the early morning on March 23, 2005, only one alarm was activated. The high level alarm was triggered at 3:09 a.m.. The redundant hardwired high level alarm never sounded. Material balance calculations conducted post-incident determined that the tower had actually filled to 13 feet , four feet over the top tap of the level transmitter. Because the failure of the high level switch was unnoticed, it was not reported by the Night Lead Operator or other operations personnel; consequently, no work order was written and the malfunction was not noted in the logbook. The high level alarm associated with the level transmitter remained in the alarmed state throughout the incident.
Filling the bottom of the tower until the level transmitter read 99 percent was not unusual, even though the startup procedure called for the level in the tower to be established at a 50 percent transmitter reading. Operations personnel explained that additional liquid level was needed in the tower because in past startups the level would typically drop significantly. To avoid losing the liquid contents of the tower and potentially damaging equipment, board operators typically operated the tower level well above 50 percent (ERROR).
Inadequate Shift Turnover and Poor Log Keeping
Shortly before 5:00 a.m. on March 23, 2005, the Night Lead Operator left the Texas City refinery approximately an hour before his scheduled shift end time and did not participate in the shift turnover (ERROR).