Robert Gomez December 9 2013 INDT 44240 Fall 2013 Final Assignment Brett Coomer AP Table of Contents Executive Summary System Description Accident Description Manprint Application to Refinery ID: 556414
Download Presentation The PPT/PDF document "BP Texas City Refinery Accident" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Slide1
BP Texas City Refinery Accident
Robert GomezDecember 9, 2013INDT 442-40Fall 2013 Final Assignment
Brett
Coomer
,
APSlide2
Table of Contents
Executive SummarySystem DescriptionAccident DescriptionManprint
Application to Refinery OperationErgonomicsBad Apple Theory
Errors or Violations?
Recommended Corrective Actions
Resources and ReferencesSlide3
Executive Summary
On March 23, 2005 at 1:20 PM a massive fire and a series of explosions erupted at the BP Refinery in Texas City, Texas. Fifteen workers were killed and 180 others were injured. The accident occurred during the startup of the Isomerization
(Isom) unit, which had been down for maintenance for a month, when the raffinate tower was overfilled resulting in a flammable liquid geyser erupting out of the
blowdown
stack. Flammable liquids and vapors spilled out throughout the area until an ignition source ignited the vapors. Approximately
43,000 residents of Texas City were told to stay indoors as the thick, black smoke billowed out from the refinery. The accident cost BP billions of dollars in victims’ compensation, property damage, and lost production.Slide4
Executive Summary
The Texas City accident was the worst industrial accident in the United States over the previous 15 years. It was the result of organizational and safety deficiencies throughout the company.
BP management had failed to respond to warning signs of a potential catastrophic accident for many years.
Chemical Safety BoardSlide5
System Description:
The BP Texas City Refinery is the third largest refinery in the United States with a refining capacity of 475,000 barrels of crude per day. It is located on a 1,200-acre facility in Texas City, southeast of Houston in Galveston County.
Isomerization UnitSlide6
Accident Description
March 23, 2005:
02:15 AM: The Night Lead Operator begins filling the tower with raffinate feed from the satellite control room.
03:09 AM
: The tower high level alarm sounds when the level in the tower reaches 7.6
ft
in the tower. A second high level alarm failed to sound when the level reached 7.9
ft
in the tower.
05:00 AM
: After completion of filling the tower when the transmitter reads 8.95
ft
(level is actually 13.3
ft
), the Night Lead Operator leaves the refinery an hour before his scheduled shift. He is not there to provide a turnover brief to the oncoming Day Lead Operator.
06:00 AM
: The Day Lead Operator arrives, reviews logbook for system status but only finds one cryptic entry in the logbook. Operator is unsure of the status of the plant.
09:15 AM
: Startup of the unit recommences with the tower receiving more feed. A 8.5
ft
level reading is observed.
09:55 AM
: Two burners are fired up in the furnace.Slide7
10:47 AM
: Day Supervisor leaves refinery early due to a family emergency.
11:16 AM
: Two additional burners in the furnace are lit; the level transmitter indicates a tower level of 8.65
ft
, but it is actually 67 ft.
11:50 AM
: Fuel to the furnace is increased. The tower level indicator reads 8.4
ft
, but the actual level is 98 ft.
12:41 PM
: The tower's pressure rises to 33 psig, high pressure alarm is received. Operator is unsure of system status; reduces pressure by opening the 8-inch NPS chain valve.
12:42 PM
: Fuel gas to the furnace is reduced. The tower level indicator reads 8
ft
, but the actual level is 140 ft.
1:04 PM
: The tower level indicator reads 7.9
ft
, but the actual level is 158 ft.
1:11 PM
: Day Shift Supervisor Lead Operator discuss opening a bypass valve to relieve tower pressure
Accident DescriptionSlide8
Accident Description
1:14 PM: Hydrocarbon flows out of the top of the tower into overhead piping. Tower pressure spikes to 63 psig. All three relief valves open, sending 52,000 gallons of flammable liquid to a blowdown drum, which overflowed into a process sewer, sending alarms to the control board. A geyser of liquid and vapor erupt from the top of the
blowdown stack, forming a huge, flammable vapor cloud.
Chemical Safety BoardSlide9
Accident Description
1:20 PM: A nearby pickup truck ignites the vapors, releasing a powerful explosion. Secondary explosions soon followed.Workers inside nearby temporary construction trailers were caught in the path of the explosions. 15 were killed, others suffered serious burns, fractures, and other traumatic injuries
.
The damaged trailers are in the foreground
Chemical Safety BoardSlide10
Manprint Application to Refinery Operations
Manpower – the number of personnel required and available to operate and maintain a system
A number of training personnel was sharply reduced due to budget cuts.
A 2nd operator position was eliminated at the control board. Later, a 3rd processing unit was added to the remaining operator’s responsibilities. The 2nd operator position was not reinstated, even though an internal audit recommended doing so for process safety.Slide11
Personnel
Organization needs to establish an Organizational Culture, set expectations for personnel behaviors and attitudes, and set minimum requirements in education/experience for personnel roles. Personnel need to be responsible, accountable, and adhere to the culture.
Management failed to deliver expectations for disciplined operations to supervisors and operators. It is unclear if management themselves were familiar with these expectations:
The Night Lead Operator left his shift one hour early, not giving a turnover brief to the oncoming Lead Operator.
Contrary to established procedures, the Night Shift Supervisor told maintenance personnel to stop checking critical alarms because the unit is starting up and there was not enough time to complete the checks.
The Day Shift Supervisor arrived more than one hour late for his shift. He also did not get a turnover from the night shift.
The Day Shift Supervisor left due to a family emergency. Contrary to BP procedures, an experienced supervisor was not assigned to replace him . BP policy required a supervisor to be present on startup due to the hazardous nature of the evolution. This left a single control board operator to operate three refinery units, with no supervision .Slide12
Management failed to deliver expectations (
con’t.)Shift Relief – There were limited communications between night shift and day shift on tower level and no face to face shift relief between night and day shift occurred. The communication in the
logbook was incomplete and ambiguous. Quality shift relief is vital in
maintaining
safe and reliable
plant operations.
Manprint
Applications to Refinery Operations
PersonnelSlide13
Training
The Organization needs to recognize the amount/fidelity of training that is needed in order to operate and maintain the equipment/systems and then ensure personnel are properly trained and knowledgeable to operate and maintain the equipment/systems
BP had transitioned to computer based training instead of face to face training, reducing training effectiveness.
Operators did not understand how the level indicator worked. It was improperly calibrated, based on 1975 data for a different process liquid.
Due to the initial investment for them, simulators were not used although they were recommended for process upset training.
There was little effort made towards supervisor and management training
It doesn’t take a lot of training for someone to operate a system when everything goes well. However, training and experience are crucial to be able to recognize when something doesn’t look right, and then to be able to respond correctly.Slide14
Human Factors
EngineeringOrganization should be “people” oriented and focus on quality in all aspects of work which will, in effect, optimize personnel performance, equipment reliability, and safe operations. To optimize the human-machine interface, people should be considered as a “part” of the entire system under development.
The Day Lead Operator was starting his 30
th
day in a row working a 12 hour shift. He was most assuredly mentally fatigued, impairing his decision making ability and cause delays in his response time. His
judgement
was most likely impaired and he was probably not fit for duty.Slide15
System
SafetyOrganization should use quality equipment/systems that are designed and engineered to optimize efficiency and personnel safety.
A single instrument was installed for ISOM unit level indication. There was no built in redundancy for level indication.
The level instrument was not designed to indicate level throughout the tower, only the bottom 9 feet.
Repairs were never made to the 2
nd
high level alarm, even though it had not operated correctly over the last 2 years. Operators accepted that as the norm.
The
blowdown
drum high level alarm failed.
The sight glass on the tower was also dirty and couldn’t be used to verify level.Slide16
Health Hazards – The organization needs to thoroughly identify, evaluate, and understand the hazards associated with the equipment/systems and then implement mitigation for the hazards. Finally, the organization needs to communicate the hazards/mitigations to personnel. Personnel need to understand the hazards, the mitigation of the hazards, and incorporate the mitigations into their work routine.
The operators were not aware of the hazards associated with tower overfilling. Atmospheric reliefs for flammable liquids and vapors are inherently dangerous. They should be routed through a safer path such as a flare. BP considered replacing the
blowdown
stack and connection to a flare, but numerous proposals were rejected due to the high cost.
D
uring start-ups, operators routinely deviated from procedures to maintain > 9 feet liquid in the tower because they were concerned with damage to the furnace if liquid level dropped too low. Operators thought they were erring on the side of caution by overfilling the unit. Slide17
Ergonomics
Control board indications were not user friendly. Inlet & Outlet flows for the tower were not on the same screen and there was no on-screen calculation for total liquid in the tower.
Chemical
S
afety BoardSlide18
Bad Apple Theory
The In-house BP Fatal Accident Investigation Report stated:“Although the Raffinate Splitter is arguably one of the simplest process units in the
refinery, the absence of an automatic emergency shutdown system places reliance upon sound operating practices and procedures to maintain operating parameters within the safe upper
and
lower limits of the operating envelope. Nevertheless, the design was typical of many
older
fractionating towers in
the industry
, and was relatively easy to operate safely if
normal standards
of operation were observed. The
Raffinate
Splitter had been started up safely on
many
previous occasions when the operating procedures were followed correctly to avoid
high
heatup rates and high furnace outlet temperatures. To overflow the tower required feed/rundown imbalance, high temperatures, and 3 to 4 hours of operator inattention”
They basically stated it was ok to have antiquated systems and no provisions for emergency shutdown capability. They also overlooked the many times previously that there were issues with the startup of this same tower.
Placing the fault squarely on the operatorsSlide19
“While the site management had introduced improvement programs, such as the 1000-day program, had completed a site-wide Major Accident Risk assessment exercise (MAR) and, following previous incidents, had begun to introduce many improvements in the areas of training, audit, and culture, the team found many areas where procedures, policies, and expected behaviors were not met.”
Bad Apple Theory
The BP In-House Fatal Accident Report also stated:
The truth is, BP management was great at performing audits and surveys.
They were horrible at following up and correcting issuesSlide20
Bad Apple Theory
While the accident was directly due to a series of human errors, these errors were made more likely due to the latent organizational weaknesses at Texas City. The conditons for operations at the Isom unit encouraged operators to deviate from procedures. Supervision and management did not step in, deliver expectations, and stop the practice. When they fail to intervene on this type of behavior, it becomes a condoned behavior.
The BP Final Report pointed directly at operators and supervisors as the main cause of the accident instead of focusing on the organizational culture, which was significantly eroded, as the main cause.
The weak organizational culture was clearly evident as two additional accidents occurred only a few months after the March accident. Ironically, these additional accidents also occurred prior to submission of the BP final report. Yet the BP final report did not take this into account.
There was a gross history of fatalities at the refinery. Prior to this accident, 23 people had died at the Texas City Refinery in the last 30 years.Slide21
Error or Violation
Error - An action that unintentionally departs from expected behavior, without malice or forethought.
Human Error – The inevitable by-product of the pursuit of success in an imperfect, unstable, resource-constrained world.Violation - Deliberate, intentional
act
to evade a known policy or procedure requirement for personal advantage usually adopted for fun, comfort, expedience or convenience
Operations personnel had gotten very sloppy. Disciplined operations did not occur. Management needs to show up and observe evolutions in the field to reinforce expectations for disciplined operations, or else “shortcuts” and “work-
arounds
” will be prevalent.
Nobody shows up for work with the thought that they are going to mess up and get a co-worker hurt (or worse). It happens, usually because of bad behaviors that have been going on for some time.Slide22
Organizational Culture
BP merged with Amoco in 1999. Although BP turned a profit of $19 billion in 2005, cost-cutting measures at Texas City soon followed and were made without regard to process safety of the refinery. This left the refinery vulnerable to a major accident, especially when combined with production pressure and a failure to invest in improvements to people and equipment.
The Chemical Safety Board Final Report on the accident revealed findings that included:
Maintenance and operating procedures were inadequate
S
afety studies were years overdue
H
azard analysis was poor
Site leadership let the standards slip and didn’t prioritize Process Safety
Production and budget compliance were found to be rewarded above everything elseSlide23
Cost-Cutting measures without regard to process safety:
A 2nd operator position was eliminated at the control board. Later, a 3rd processing unit was added to the remaining operator’s responsibilities. The 2nd operator position was not reinstated, even though an internal audit recommended doing so for process safety.
The number of training personnel were cut significantly.
Portable trailers were sited too close to process units (within 120 feet of
blowdown
drum). Contrary to BP established procedures, an analysis was not performed to determine if trailer
sitings
were safe. People in trailers were injured as far away as 479 feet.
Again, contrary to established procedures, occupants of the trailers were not notified of the
Isom
unit startup. The startup was considered a high hazard activity.
The occupants in the trailers were celebrating completion of a 9 week maintenance cycle, accident free.
Organizational CultureSlide24
Organizational Culture
BP management had performed several audits in the year prior to the accident.One audit revealed a
host of common safety problems including noncompliance with basic ES&H rules, poor implementation of safety management systems, and lack of leadership competence and understanding. A safety culture survey performed at the refinery just before the accident revealed that there was a great deal of fear among employees of a major
accident.
In addition, it found that the pressure for production, time pressure, and understaffing are the major causes of accidents at Texas City. The survey also found that production and budget compliance were recognized and rewarded above anything
else
In late 2004, the refinery Safety Manager gave a presentation to
supervisors, titled “Safety
Reality”, reviewing the fatalities over the last years, where one slide was titled “Texas City is not a safe place to work”.Slide25
Organizational Culture
Management had many warnings about the impending disaster, yet failed to take action.Management
did not have an effective reporting culture. Instead of having an effective learning culture, it was more of a punitive culture.Management did not have a trusting environment. Many critical incidents were not reported over the years, therefore there were no lessons learned to prevent making the same mistakes.
The workforce was poorly motivated
There was a lack of role models at the supervisor level
Lack of teamwork evidenced by many poor behaviors and attitudes
All the issues at the refinery lined up like holes in
swiss
cheese.
Creating a perfect recipe for a bad accident.
IAGC.orgSlide26
Corrective Action Recommendations
Safety Stand-down so that management, supervisors, operators, maintenance, etc. can meet and discuss expectations for disciplined operations. This could have been performed during the month long time the Isom unit was down for maintenance.
Verbatim procedure compliance. This still requires “thinking” compliance, not maliciously complying with a procedure even if you know it is incorrect. Stop and fix the procedure if it is incorrect.
Review procedures for accuracy with operators and safety professionals. Ensure hazard analysis and hazard mitigation is incorporated into procedures. Make corrections as needed.
Ensure adequate staffing is available to enable effective training. Invest in a simulator so supervisors and operators can undergo effective “abnormal operations” training.
Establish a fitness-for-duty policy.
Establish (and enforce) a communications policy for pre-job briefings, shift change and turnovers, and logbook requirements.
Invest in equipment upgrades that make sense.
Re-iterate to employees that it is ok to “Stop Work” if something doesn’t look right. Do not make these punitive. Reward employees for bringing up safety concerns. Ask for their input on how to resolve their concerns.
Follow through and fix the problem.
Establish an open and trusting safety culture.
Begin an initiative to monitor and trend performance. Take action on negative trends in order to be forward-looking, not reactionary. Don’t let the
swiss
cheese line up again.Slide27
References
Stack, Theresa. Block assignment information powerpoint presentations. INDT 442-40. University of Idaho. Fall 2013
Dekker, Sidney. The Field Guide to Understanding Human Error.
Burlington:
Ashgate
Publishing, 2006. Print.
United States
, Investigation Report, Refinery Explosion and Fire
, U.S. Chemical Safety and Hazard Investigation Board, March 2007, Print.
www.csb.gov
BP,
Fatal
Accident Investigation
Report,
Isomerization Unit Explosion Final Report
, Texas City, Texas,
December 9th 2005, Print.