BP Texas City Refinery Accident - PowerPoint Presentation

Slide1

BP Texas City Refinery Accident

Robert GomezDecember 9, 2013INDT 442-40Fall 2013 Final Assignment

Brett

Coomer

,

APSlide2

Table of Contents

Executive SummarySystem DescriptionAccident DescriptionManprint

Application to Refinery OperationErgonomicsBad Apple Theory

Errors or Violations?

Recommended Corrective Actions

Resources and ReferencesSlide3

Executive Summary

On March 23, 2005 at 1:20 PM a massive fire and a series of explosions erupted at the BP Refinery in Texas City, Texas. Fifteen workers were killed and 180 others were injured. The accident occurred during the startup of the Isomerization

(Isom) unit, which had been down for maintenance for a month, when the raffinate tower was overfilled resulting in a flammable liquid geyser erupting out of the

blowdown

stack. Flammable liquids and vapors spilled out throughout the area until an ignition source ignited the vapors. Approximately

43,000 residents of Texas City were told to stay indoors as the thick, black smoke billowed out from the refinery. The accident cost BP billions of dollars in victims’ compensation, property damage, and lost production.Slide4

Executive Summary

The Texas City accident was the worst industrial accident in the United States over the previous 15 years. It was the result of organizational and safety deficiencies throughout the company.

BP management had failed to respond to warning signs of a potential catastrophic accident for many years.

Chemical Safety BoardSlide5

System Description:

The BP Texas City Refinery is the third largest refinery in the United States with a refining capacity of 475,000 barrels of crude per day. It is located on a 1,200-acre facility in Texas City, southeast of Houston in Galveston County.

Isomerization UnitSlide6

Accident Description

March 23, 2005:

02:15 AM: The Night Lead Operator begins filling the tower with raffinate feed from the satellite control room.

03:09 AM

: The tower high level alarm sounds when the level in the tower reaches 7.6

ft

in the tower. A second high level alarm failed to sound when the level reached 7.9

ft

in the tower.

05:00 AM

: After completion of filling the tower when the transmitter reads 8.95

ft

(level is actually 13.3

ft

), the Night Lead Operator leaves the refinery an hour before his scheduled shift. He is not there to provide a turnover brief to the oncoming Day Lead Operator.

06:00 AM

: The Day Lead Operator arrives, reviews logbook for system status but only finds one cryptic entry in the logbook. Operator is unsure of the status of the plant.

09:15 AM

: Startup of the unit recommences with the tower receiving more feed. A 8.5

ft

level reading is observed.

09:55 AM

: Two burners are fired up in the furnace.Slide7

10:47 AM

: Day Supervisor leaves refinery early due to a family emergency.

11:16 AM

: Two additional burners in the furnace are lit; the level transmitter indicates a tower level of 8.65

ft

, but it is actually 67 ft.

11:50 AM

: Fuel to the furnace is increased. The tower level indicator reads 8.4

ft

, but the actual level is 98 ft.

12:41 PM

: The tower's pressure rises to 33 psig, high pressure alarm is received. Operator is unsure of system status; reduces pressure by opening the 8-inch NPS chain valve.

12:42 PM

: Fuel gas to the furnace is reduced. The tower level indicator reads 8

ft

, but the actual level is 140 ft.

1:04 PM

: The tower level indicator reads 7.9

ft

, but the actual level is 158 ft.

1:11 PM

: Day Shift Supervisor Lead Operator discuss opening a bypass valve to relieve tower pressure

Accident DescriptionSlide8

Accident Description

1:14 PM: Hydrocarbon flows out of the top of the tower into overhead piping. Tower pressure spikes to 63 psig. All three relief valves open, sending 52,000 gallons of flammable liquid to a blowdown drum, which overflowed into a process sewer, sending alarms to the control board. A geyser of liquid and vapor erupt from the top of the

blowdown stack, forming a huge, flammable vapor cloud.

Chemical Safety BoardSlide9

Accident Description

1:20 PM: A nearby pickup truck ignites the vapors, releasing a powerful explosion. Secondary explosions soon followed.Workers inside nearby temporary construction trailers were caught in the path of the explosions. 15 were killed, others suffered serious burns, fractures, and other traumatic injuries

.

The damaged trailers are in the foreground

Chemical Safety BoardSlide10

Manprint Application to Refinery Operations

Manpower – the number of personnel required and available to operate and maintain a system

A number of training personnel was sharply reduced due to budget cuts.

A 2nd operator position was eliminated at the control board. Later, a 3rd processing unit was added to the remaining operator’s responsibilities. The 2nd operator position was not reinstated, even though an internal audit recommended doing so for process safety.Slide11

Personnel

Organization needs to establish an Organizational Culture, set expectations for personnel behaviors and attitudes, and set minimum requirements in education/experience for personnel roles. Personnel need to be responsible, accountable, and adhere to the culture.

Management failed to deliver expectations for disciplined operations to supervisors and operators. It is unclear if management themselves were familiar with these expectations:

The Night Lead Operator left his shift one hour early, not giving a turnover brief to the oncoming Lead Operator.

Contrary to established procedures, the Night Shift Supervisor told maintenance personnel to stop checking critical alarms because the unit is starting up and there was not enough time to complete the checks.

The Day Shift Supervisor arrived more than one hour late for his shift. He also did not get a turnover from the night shift.

The Day Shift Supervisor left due to a family emergency. Contrary to BP procedures, an experienced supervisor was not assigned to replace him . BP policy required a supervisor to be present on startup due to the hazardous nature of the evolution. This left a single control board operator to operate three refinery units, with no supervision .Slide12

Management failed to deliver expectations (

con’t.)Shift Relief – There were limited communications between night shift and day shift on tower level and no face to face shift relief between night and day shift occurred. The communication in the

logbook was incomplete and ambiguous. Quality shift relief is vital in

maintaining

safe and reliable

plant operations.

Manprint

Applications to Refinery Operations

PersonnelSlide13

Training

The Organization needs to recognize the amount/fidelity of training that is needed in order to operate and maintain the equipment/systems and then ensure personnel are properly trained and knowledgeable to operate and maintain the equipment/systems

BP had transitioned to computer based training instead of face to face training, reducing training effectiveness.

Operators did not understand how the level indicator worked. It was improperly calibrated, based on 1975 data for a different process liquid.

Due to the initial investment for them, simulators were not used although they were recommended for process upset training.

There was little effort made towards supervisor and management training

It doesn’t take a lot of training for someone to operate a system when everything goes well. However, training and experience are crucial to be able to recognize when something doesn’t look right, and then to be able to respond correctly.Slide14

Human Factors

EngineeringOrganization should be “people” oriented and focus on quality in all aspects of work which will, in effect, optimize personnel performance, equipment reliability, and safe operations. To optimize the human-machine interface, people should be considered as a “part” of the entire system under development.

The Day Lead Operator was starting his 30

th

day in a row working a 12 hour shift. He was most assuredly mentally fatigued, impairing his decision making ability and cause delays in his response time. His

judgement

was most likely impaired and he was probably not fit for duty.Slide15

System

SafetyOrganization should use quality equipment/systems that are designed and engineered to optimize efficiency and personnel safety.

A single instrument was installed for ISOM unit level indication. There was no built in redundancy for level indication.

The level instrument was not designed to indicate level throughout the tower, only the bottom 9 feet.

Repairs were never made to the 2

nd

high level alarm, even though it had not operated correctly over the last 2 years. Operators accepted that as the norm.

The

blowdown

drum high level alarm failed.

The sight glass on the tower was also dirty and couldn’t be used to verify level.Slide16

Health Hazards – The organization needs to thoroughly identify, evaluate, and understand the hazards associated with the equipment/systems and then implement mitigation for the hazards. Finally, the organization needs to communicate the hazards/mitigations to personnel. Personnel need to understand the hazards, the mitigation of the hazards, and incorporate the mitigations into their work routine.

The operators were not aware of the hazards associated with tower overfilling. Atmospheric reliefs for flammable liquids and vapors are inherently dangerous. They should be routed through a safer path such as a flare. BP considered replacing the

blowdown

stack and connection to a flare, but numerous proposals were rejected due to the high cost.

D

uring start-ups, operators routinely deviated from procedures to maintain > 9 feet liquid in the tower because they were concerned with damage to the furnace if liquid level dropped too low. Operators thought they were erring on the side of caution by overfilling the unit. Slide17

Ergonomics

Control board indications were not user friendly. Inlet & Outlet flows for the tower were not on the same screen and there was no on-screen calculation for total liquid in the tower.

Chemical

S

afety BoardSlide18

Bad Apple Theory

The In-house BP Fatal Accident Investigation Report stated:“Although the Raffinate Splitter is arguably one of the simplest process units in the

refinery, the absence of an automatic emergency shutdown system places reliance upon sound operating practices and procedures to maintain operating parameters within the safe upper

and

lower limits of the operating envelope. Nevertheless, the design was typical of many

older

fractionating towers in

the industry

, and was relatively easy to operate safely if

normal standards

of operation were observed. The

Raffinate

Splitter had been started up safely on

many

previous occasions when the operating procedures were followed correctly to avoid

high

heatup rates and high furnace outlet temperatures. To overflow the tower required feed/rundown imbalance, high temperatures, and 3 to 4 hours of operator inattention”

They basically stated it was ok to have antiquated systems and no provisions for emergency shutdown capability. They also overlooked the many times previously that there were issues with the startup of this same tower.

Placing the fault squarely on the operatorsSlide19

“While the site management had introduced improvement programs, such as the 1000-day program, had completed a site-wide Major Accident Risk assessment exercise (MAR) and, following previous incidents, had begun to introduce many improvements in the areas of training, audit, and culture, the team found many areas where procedures, policies, and expected behaviors were not met.”

Bad Apple Theory

The BP In-House Fatal Accident Report also stated:

The truth is, BP management was great at performing audits and surveys.

They were horrible at following up and correcting issuesSlide20

Bad Apple Theory

While the accident was directly due to a series of human errors, these errors were made more likely due to the latent organizational weaknesses at Texas City. The conditons for operations at the Isom unit encouraged operators to deviate from procedures. Supervision and management did not step in, deliver expectations, and stop the practice. When they fail to intervene on this type of behavior, it becomes a condoned behavior.

The BP Final Report pointed directly at operators and supervisors as the main cause of the accident instead of focusing on the organizational culture, which was significantly eroded, as the main cause.

The weak organizational culture was clearly evident as two additional accidents occurred only a few months after the March accident. Ironically, these additional accidents also occurred prior to submission of the BP final report. Yet the BP final report did not take this into account.

There was a gross history of fatalities at the refinery. Prior to this accident, 23 people had died at the Texas City Refinery in the last 30 years.Slide21

Error or Violation

Error - An action that unintentionally departs from expected behavior, without malice or forethought.

Human Error – The inevitable by-product of the pursuit of success in an imperfect, unstable, resource-constrained world.Violation - Deliberate, intentional

act

to evade a known policy or procedure requirement for personal advantage usually adopted for fun, comfort, expedience or convenience

Operations personnel had gotten very sloppy. Disciplined operations did not occur. Management needs to show up and observe evolutions in the field to reinforce expectations for disciplined operations, or else “shortcuts” and “work-

arounds

” will be prevalent.

Nobody shows up for work with the thought that they are going to mess up and get a co-worker hurt (or worse). It happens, usually because of bad behaviors that have been going on for some time.Slide22

Organizational Culture

BP merged with Amoco in 1999. Although BP turned a profit of $19 billion in 2005, cost-cutting measures at Texas City soon followed and were made without regard to process safety of the refinery. This left the refinery vulnerable to a major accident, especially when combined with production pressure and a failure to invest in improvements to people and equipment.

The Chemical Safety Board Final Report on the accident revealed findings that included:

Maintenance and operating procedures were inadequate

S

afety studies were years overdue

H

azard analysis was poor

Site leadership let the standards slip and didn’t prioritize Process Safety

Production and budget compliance were found to be rewarded above everything elseSlide23

Cost-Cutting measures without regard to process safety:

A 2nd operator position was eliminated at the control board. Later, a 3rd processing unit was added to the remaining operator’s responsibilities. The 2nd operator position was not reinstated, even though an internal audit recommended doing so for process safety.

The number of training personnel were cut significantly.

Portable trailers were sited too close to process units (within 120 feet of

blowdown

drum). Contrary to BP established procedures, an analysis was not performed to determine if trailer

sitings

were safe. People in trailers were injured as far away as 479 feet.

Again, contrary to established procedures, occupants of the trailers were not notified of the

Isom

unit startup. The startup was considered a high hazard activity.

The occupants in the trailers were celebrating completion of a 9 week maintenance cycle, accident free.

Organizational CultureSlide24

Organizational Culture

BP management had performed several audits in the year prior to the accident.One audit revealed a

host of common safety problems including noncompliance with basic ES&H rules, poor implementation of safety management systems, and lack of leadership competence and understanding. A safety culture survey performed at the refinery just before the accident revealed that there was a great deal of fear among employees of a major

accident.

In addition, it found that the pressure for production, time pressure, and understaffing are the major causes of accidents at Texas City. The survey also found that production and budget compliance were recognized and rewarded above anything

else

In late 2004, the refinery Safety Manager gave a presentation to

supervisors, titled “Safety

Reality”, reviewing the fatalities over the last years, where one slide was titled “Texas City is not a safe place to work”.Slide25

Organizational Culture

Management had many warnings about the impending disaster, yet failed to take action.Management

did not have an effective reporting culture. Instead of having an effective learning culture, it was more of a punitive culture.Management did not have a trusting environment. Many critical incidents were not reported over the years, therefore there were no lessons learned to prevent making the same mistakes.

The workforce was poorly motivated

There was a lack of role models at the supervisor level

Lack of teamwork evidenced by many poor behaviors and attitudes

All the issues at the refinery lined up like holes in

swiss

cheese.

Creating a perfect recipe for a bad accident.

IAGC.orgSlide26

Corrective Action Recommendations

Safety Stand-down so that management, supervisors, operators, maintenance, etc. can meet and discuss expectations for disciplined operations. This could have been performed during the month long time the Isom unit was down for maintenance.

Verbatim procedure compliance. This still requires “thinking” compliance, not maliciously complying with a procedure even if you know it is incorrect. Stop and fix the procedure if it is incorrect.

Review procedures for accuracy with operators and safety professionals. Ensure hazard analysis and hazard mitigation is incorporated into procedures. Make corrections as needed.

Ensure adequate staffing is available to enable effective training. Invest in a simulator so supervisors and operators can undergo effective “abnormal operations” training.

Establish a fitness-for-duty policy.

Establish (and enforce) a communications policy for pre-job briefings, shift change and turnovers, and logbook requirements.

Invest in equipment upgrades that make sense.

Re-iterate to employees that it is ok to “Stop Work” if something doesn’t look right. Do not make these punitive. Reward employees for bringing up safety concerns. Ask for their input on how to resolve their concerns.

Follow through and fix the problem.

Establish an open and trusting safety culture.

Begin an initiative to monitor and trend performance. Take action on negative trends in order to be forward-looking, not reactionary. Don’t let the

swiss

cheese line up again.Slide27

References

Stack, Theresa. Block assignment information powerpoint presentations. INDT 442-40. University of Idaho. Fall 2013

Dekker, Sidney. The Field Guide to Understanding Human Error.

Burlington:

Ashgate

Publishing, 2006. Print.

United States

, Investigation Report, Refinery Explosion and Fire

, U.S. Chemical Safety and Hazard Investigation Board, March 2007, Print.

www.csb.gov

BP,

Fatal

Accident Investigation

Report,

Isomerization Unit Explosion Final Report

, Texas City, Texas,

December 9th 2005, Print.