BP TEXAS CITY REFINERY DISASTER

Transcription

1 BP TEXAS CITY REFINERY DISASTER ACCIDENT & PREVENTION REPORT Chinedu Charles Isiadinso April 23, 2015 Contents 1 INTRODUCTION 2 2 KLETZ-TYPE PREVENTION TABLE 3 3 ANALYSIS 6 4 CONCLUSION 9 1

2 1 INTRODUCTION On Wednesday, March , numerous explosions, and a fire, occurred at BP Texas City refinery, Texas, USA. The explosions and fire occurred during start-up of an isomerization unit at the refinery. The disaster resulted in 15 fatalities, over 150 injuries, and financial losses exceeding $1.5 billion (USD)[1]. Details of the Accident BP had begun a lengthy maintenance project at their Texas city refinery, which required over 1000 contractors on site along with employees. A number of trailers had been set up, close to the blow-down stack (see figure 1), to serve as offices and meeting rooms for the contractors. In the early hours of Wednesday, March , workers began the start-up process of an isomerization unit by pumping highly flammable liquid into to a raffinate splitter tower (see figure 1), which would, normally, have 2m (6.5ft) of liquid at its base. Liquid height sensor and two alarm systems, for heights of 2m, (6.5ft) and 3m, (10ft), were installed to measure and report the height of liquid in the tower to operators, and raise alarms if the liquid reached 2m and 3m respectively. However, the sensor was designed to measure heights up to 3m, and thus there was no way to tell the amount of liquid in the tower beyond that point. As workers pumped liquid into the splitter tower, the liquid reached, and exceeded, the 3m mark, setting off the 2m alarm but not the 3m. As the liquid feed exceeded 3m, when the feed was stopped, and the height sensor reported 3m, while in actual fact, the tower is believed to have reached 4m, (13ft)[2]. Figure 1: Raffinate section of Isomerization unit[1] Following a shift change, and very poor communication, operators recommenced the start-up process, adding more liquid to the overfull splitter tower. While liquid was being pumped in, no liquid was being pumped out, as specified in the start up procedure[5], due to a level control valve being left closed. About 10 minutes later, as part of the normal process, operator lit burners in the furnace to heat up the liquid being fed to the splitter tower. With the level control valve still closed, the tower liquid level rose, and the heigh meter reported a height of under 3m; however, calculations show that the liquid reached 42m[1]. At 1 pm, the level control valve was opened, following a high pressure alarm that caused a manual relief valve to be opened; this stabilized liquid level. However, liquid leaving the tower 2

3 was at a very high temperature, and on exiting the heat exchanger (which was not designed to cool down very hot liquid), induced a temperature rise (over 150 o [1]) in liquid being fed to the tower. This caused liquid in the tower to boil and expand causing the liquid level in the tower to rise. Minutes later, the 52m, (170f t)[5], 586, 100l[7] capacity splitter tower was completely full, and liquid flowed through a overhead pipe, down 45m, (148ft), and forced open all 3 safety relief valves near the base of the tower; these valves redirected over 200, 000l of flammable liquid to the blow-down drum of significantly lower capacity. Similar to the tower, the blow-down drum was fitted with a liquid height sensor and an alarm, but when the drum overfilled, the alarm failed to alert operators, who continued redirecting flow to the drum. Minutes later, there was an eruption of very hot highly flammable liquid, from the top of the blow-down stack[3], which fell to the ground creating a highly flammable vapour cloud that covered the entire refinery, especially the trailers housing the contractors. Ignition of the cloud, by backfire from an idling diesel truck at about 1:20 pm, caused a number explosions and fires, and sent shock-waves for miles in all directions. Figure 2: BP Texas City Refinery Layout[1] 2 KLETZ-TYPE PREVENTION TABLE Table 1: Kletz-Type prevention table Events Immediate Steps Avoiding Hazard Management System Explosions and Fire Truck driver should have turned engine off after eruption Idling diesel truck Do not idle truck a backfires, ignites few meters from hazardous vapour cloud equipment Vapour Cloud forms and expands across refinery Create dedicated parking space Sound alarm Install disaster alert system Always know where vehicles on plot are Train staff for disasters, the CSB report[1] showed that staff where not properly trained for abnormal situations 3

4 Table 2: Kletz-Type prevention table Events Immediate Steps Avoiding Hazard Management System Blow-down stack over fills and liquid erupts Liquid in blow-down drum reaches max. capacity; high level alarm does not sound High pressure liquid force open all 3 safety relief valves; liquid is redirected to the blow-down drum Tower overfills; liquid flows through overhead pipe towards relief valves 45m below Liquid fed to tower causes boiling; liquid level rises to 43m, sensor shows decline Hot liquid, from tower base, heats up tower feed Operators worry about lack of outflow, level control valve is open Tower high pressure alarm sound; operators open manual relief valve (automatic emergency valves failed) Improperly calibrated level indicator shows liquid as 2.6m and falling; liquid is at 30m Carry out disaster protocol Tower is overfull, expect the drum alarm to sound, and act if there s no sound Turn off feed, and purge systems The process had been running for over 3 hours, check what happened to liquid fed Check information about flow into and out of tower and see if there discrepancies. Install blow-down drum of equal capacity as tower. Install modern blow-down stack, to eliminate possibility of overflow Emergency purge system when drum over fills Install another set of high pressure alarms for the over head pipes Install overflow detector to shut down process if tower overfills Design location based temperature detector Design system to measure temperature of liquid in key areas (e.g. tower outlet) and alert operator of problems Design system to show valve status Show flow into and out of tower on same screen and work out in tower volume based on these Train staff for disasters[9] Regular equipment inspection, due to cost cutting techniques, less money was available to inspect and repair faulty equipment[1] Regular equipment inspection and repairs A supervisor must always be present Regular equipment inspection Equipment inspection and repairs 4

5 Table 3: Kletz-Type prevention table Events Immediate Steps Avoiding Hazard Management System Supervisor leaves due to family emergency, there is no replacement Conflicting information about level control valve is received by operator, valve is left closed Start-up recommences, more liquid is added to already overfull tower, liquid level increases Night shift operator leaves, day shift operator takes over; state of start-up process is badly communicated Sensor reads 3m (actual height is 4m), feed is stopped First tower high level alarm sounds, second fails Operators ignore 2m recommended height and fill to 3m max. height Contract workers in trailers are not informed about start-up process Isomerization start-up begins, liquid is fed into splitter tower Lengthy maintenance process; trailers are set-up close to isomerization unit Request replacement supervisor Request clarification Design system to show valve status Carry out pre-startup procedure Make better use of logbooks Stop after first alarm Follow safety recommendation Inform all personnel about hazardous processes Evacuate all nonessential staff Setup trailers at safe distance Improve system to allow operators see flows in and out of tower Improve sensor design Ensure everyone is out of harms way before starting hazardous processes Ensure pre-startup is completed Enforce requirement of at least one technical staff at all times Ensure pre-startup is completed ans successful Enforce BP sign over protocol, especially during hazardous processes Regular equipment inspection Enforce safety requirements Safety culture Should have followed CSB trailer citing recommendations 5

6 3 ANALYSIS The accident could be blamed on a wide range of failures, from mechanical to human to process, however, the entire accident could be put down to human error. Starting at the very beginning with the location of the trailers. From figure 3, it can be seen that the trailers where set up in, potentially, the most dangerous part of the site. Trailers where setup between the catalyst warehouse and the isomerization unit (close to the blow-down drum and staff), separated from the unit by a rack of pipes carrying highly flammable liquid. Not only was this citing warned against by safety experts[1], but from figure 2, it can be seen that permanent office structures where erected reasonably far away from hazardous material and equipment, at the other end of the refinery; no deaths occurred at these permanent structures. A reasonable location, for the trailers, would have been next to the control room in the blue section of figure 2. Figure 3: Trailer area and adjacent Isomerization unit[1] Second, employees, and maintenance workers knew how hazardous the isomerization start-up process was, but no alerted the contracts (who where in the trailers) about the start-up, as such contracts where unaware of of what was happening until the eruption and explosion. Deaths could have easily been prevented if trailer staff where informed, or better still, removed from harmsway until the start-up process was complete; there was a safety meeting that day, over 300 people (employees and contractors) where in attendance and nothing was said about the startup about to begin[3]. While immediately it would not have been possible for the night shift operator to have know the second alarm had failed, a better logbook entry could have been left for the day shift operator to work on. The logbook entry gave no indication of previous pumping level and alarm sound, instead it read ISOM brought in so raff to unit, to pack raff with [1]. Operators usually neglected key safety requirements, like the pre-startup checks, which would have confirmed the position of the level control valve, removed non-essential personnel from the 6

7 site, and potentially noticed, and dealt with, the idling truck. It could have also alerted staff to the faulty alarms and indicator, as it required manual liquid level confirmation, via a sight glass at the base of the tower; it is worth noting, that the sight glass had not been cleaned for longer than recommended and as such dark liquid had covered the glass making it unuseable. Poor communication saw the situation on the ground being badly transmitted from ground operators to board staff, which lead to a one of the most obvious causes of the disaster, the level valve was left closed for over 3 hours while liquid as fed. The valve was later opened, but staff should have instigated the location of hours of pumped liquid; if there was no liquid outflow, then there must have been a build up of liquid in the tower, this would have brought the faulty indicator (which read 2.6m and falling instead of 30m), to their attention and they could have stopped the feed and drained the tower. Following the departure of the only technically trained staff on site that day, due to a family emergency, and contrary to BP standard procedure, there was no replacement supervisor assigned to over see the startup process; this left one low experience operator (not qualified to run an entire refinery without supervision) alone to manage all 3 units at the refinery, including the iszomerizaion unit. On one end of Kletz s spectrum, we have ways of preventing the hazard. In this case, the hazard could have been prevented had the level indicator had been designed to accommodate the full 52m height of the tower. Looking at it from the point of view of what is necessary, the level was never meant to exceed 3m, however, if operators did not stop the feed exactly when the 3m alarm was heard, they would overshoot and not know how much by. The system could have been fool-proofed by designing an automatic system that shut off liquid feed when the level reached 3m instead of just an alarm. A similar system in the blow-down drum could automatically open the sewer block valve (see figure 4) to drain the drum if it overfills; these would help prevent any instances where there s human failure. Figure 4: Blow-down drum and gooseneck[1] 7

8 A similar system was already operational in the emergency relief valve, which failed to open on operator s command, but opened when pressure exceeded maximum allowed, and this prevented a different accident of a burst pipe. In figure 3, cars can be seen parked around very dangerous equipment, there where more suitable locations for a car park than between a catalyst warehouse and a rack of pipes. Also, the CSB s report noted poor operator display designs. The control unit did have display for amount of liquid flowing into and out of the tower, but these when on different screens, and thus meant that unless the operator suspected discrepancies in the flow, they would not check to see if the number matched. A better design would have been to have both flows on the same screen, but also to workout the different the alert the operator, or trigger an automatics protection system, if the difference exceeds an acceptable tolerance range. On the other end of Kletz s spectrum, failures of the management, such as lack of regular equipment inspection and repairs, lead to key safety devices and instruments, level indicators, alarms and even the emergency pressure relief systems, failing to alert operators of danger; these piece of equipment where know by management to be faulty but nothing was done to repair or replace them[3]. Staff where not adequately trained and protections where not put in place to prevent catastrophic failures, the likes of which, had bee predicted as early as 1992[9]. There where no real automatic systems that would act immediately in and emergency, all systems required the intervention of an operator, and while BP required operators to work in pairs and always have one person in the control room at all times, cases of desertion where very common; on the day of the accident, an operator deserted his post hours before his replacement arrived. Management had also consistently failed to address re-occurring unsafe practices, e.g. startup without fully completed pre-startup checks, that had previously (on February 12, 1994) lead to a similar situation where the tower was overfilled. Also, reports show management failed to invest in hazard prevention and safeguard. Furthermore, huge cost cutting tactics saw the isomerization unit grossly under staffed during startup. Management had a responsibility to ensure a safe working environment for everyone on site, but years of limited funding and a growing unsafe culture saw mandated processes being ignored, and near misses being left uninvestigated. The main cause of the disaster was a lack of properly implemented pre-emptive measures, which would have completely prevented not only this incidence, but future ones as well. Lessons Learned The following lessons could be drawn and generalized from is disaster; 1. Follow recommend procedure: Operators should not deviate from their training, but also, managers, and supervisors should ensure protocol is strictly adhered to. 2. Alert people of potential danger: Contractors and uninvolved staff, e.g. the two in the idling truck, where not aware of the hazardous process that was going on very close to them. This could also be extended to members of the public, for example, construction site must tell, not only their employees about dangers, but passers-by that could be hurt as well. 3. Check design by Hazop: Safety equipment, in the refinery, where not designed to eliminate hazard, rather they where designed to alert of potentially dangerous situations, and thus 8

9 where highly susceptible to human error. Safety devices should be designed to make it almost impossible to hurt yourself and others, e.g. automatic speed limiters on high speed trains (Santiago de Compostela rail disaster)[11]. 4 CONCLUSION In conclusion, the disaster at Texas City was completely preventable. Key immediate steps by operators on the day could have prevented the accident, however, the key cause of the disaster was a continuous failure to learn from near misses, an absence of safety culture, and persistent absence of hazard prevention by management staff, even after numerous near misses on numerous machines. Also misplaced priorities could be blamed for the disaster, as investments in safety and hazard prevention where not made following BP s acquisition of Amoco s outdated (even at the time of acquisition) refinery, instead job cuts and poor maintenance culture, which saved BP hundreds of thousands of dollars, where priority. References [1] U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD. INVESTIGA- TION REPORT REFINERY EXPLOSION AND FIRE. Rep. no I-TX. Texas City: U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD, Print. [2] U.S. CHEMICAL SAFETY BOARD. Anatomy of a Disaster. csb.gov. U.S. Chemical Safety Board, 11 Jan Web. 11 Mar [3] Schorn, Daniel. The Explosion At Texas City. CBSNews. CBS Interactive, 26 Oct Web. 11 Mar [4] Broadribb, Mike. Lessons from Texas City. Lessons from Texas City (2008): hse.gov.uk. Bp, 8 May Web. 12 Mar [5] Michael, Jo-Anne. Texas City Incident Human Factor Aspects. Hse.gov.uk. Health and Safety Executive, n.d. Web. 12 Mar [6] Wikipedia contributors. Texas City Refinery explosion. Wikipedia, The Free Encyclopedia. Wikipedia, The Free Encyclopedia, 1 Mar Web. 12 Mar [7] Kalantarnia, Maryam, Faisal Khan, and Kelly Hawboldt. Modelling of BP Texas City Refinery Accident Using Dynamic Risk Assessment Approach. Process Safety and Environmental Protection 88.3 (2010): ScienceDirect. ELSEVIER, 1 Feb Web. 12 Mar [8] Dean, L. E., H. R. Harris, D. H. Belden, and Vladimir Haensel. The Penex Process for Pentane Isimerisation. Platinum Metals Review 3.1 (1959): Print. [9] Cappiello, Dina, and Anne Belli. OSHA Warned Refinery about Danger in Houston Chronicle. Houston Chronicle, 8 Apr Web. 12 Mar [10] Hopkins, Andrew. Failure to Learn: The BP Texas City Refinery Disaster. Sydney, N.S.W.: CCH Australia, Print. [11] Wikipedia contributors. Santiago de Compostela rail disaster. Wikipedia, The Free Encyclopedia. Wikipedia, The Free Encyclopedia, 5 Mar Web. 13 Mar