LEARNING FROM TEXAS CITY REFINERY ( BP )

LEARNING FROM TEXAS CITY REFINERY ( BP )

Raffinate Splitter

Blow down Drum and Stack Blowdown Drum and ISOM Unit, After the Incident

Aerial Photograph of Isomerization Unit

Isomerization Unit

Satellite Control Room

Trailer

Double-Wide Trailer

THE INCIDENT Incident occur on the raffinate splitter used for processing gasoline blending components and involved an associated blow down drum and stack. The night shift established levels in the splitter using cold feed. They shut off the feed at the end of shift with the splitter level indication 100 %. The high level alarm activated and acknowledge at 72% but an independent high level alarm set at 78% did not activate. The day shift on 23rd March, 2005 reintroduced feed and started circulation and heating. The bottom valve was closed and the splitter became overfilled and overheated. During this period tower base temp. was increasing but the hydraulic head of cold liquid means no fractionation occurred.

When finally the operator opened the bottom valve after 3 hours of restart of feed, a rapid increase in feed temp. resulted vaporization and shortly afterwards liquid was released from overhead relief system. The relief system was not designed for such high liquid hydrocarbon flow and liquid hydrocarbon was emitted from the blow down drum and stack. A vapor cloud developed and ignited resulting explosion killing 15 persons and injured many others and damaged nearby properties.

LESSON LEARNED Critical Factors: The following critical factors are identified: Start Up and Management Oversight- -- Failure to follow start up procedure contributed to loss of process control. Key individuals did not apply their level of skills and knowledge and there was a lack of supervisory presence and oversight during this start up. Loss of Containment- -- Action taken or not taken led to overfilling of splitter resulting over pressurization and pressure relief. Hydrocarbon flow to Blow down Drum and stack resulted liquid overflowing through stack causing a vapor cloud which was ignited by an unknown source.

Design and Engineering of Blow down drum and stack --- The use blow down drum and stack as part of relief system of splitter close to uncontrolled areas. Control of Work Area and Trailer Placement --- Numerous personnel working elsewhere in the refinery were too close to the hazard at the blow down drum and stack during the start up operation. They ware congregated in and around of temporary trailer and were neither alerted nor evacuated. Business Context --- There was a lack of clearly defined and broadly understood context and business priorities for the Texas City site. A clear view of the key process safety priorities for the site or a sense of vision could not be identified.

Safety as a Priority --- Process safety, operation performance and systematic risk reduction priorities had not been set and consistently reinforced by management. Organizational Complexity and Capability --- Lack of clear accountabilities and poor communication was noticed resulting confusion in the workforce over roles and responsibilities. Inability to See Risk --- A poor level of hazard awareness and understanding of process safety on the site resulted in people accepting level of risk that were considerably higher than comparable installations.

Lack of Early Warning System --- Given the poor vertical communication and performance management process, there was neither an adequate early warning system of problems nor any independent means of understanding certain deteriorating condition of plant.

Key Issues Operator Inattention Following Procedures Supervisor Absence Communication shift handover Trailers Too Close to Hazards Some Instrumentation Did Not Work Abnormal Start-ups Investigation of Previous Incidents Blowdown Drum Vented Hydrocarbons to Atmosphere Opportunities to Replace Blowdown Drum

Underlying Cultural Issues Business Context Motivation Morale (Process) Safety as a Priority Emphasis on Environment and Occupational Safety Organizational Complexity & Capability Investment in People Layers and Span of Control Communication

Inability to See Risk Hazard Identification Skills Understanding of Process Safety Facility Siting Vehicles Lack of Early Warning Depth of Audit KPI s for Process Safety Sharing of Learning / Ideas

Raffinate Splitter Tower Temperatures as Level Rises

Decline in Feed Flow Rate as Splitter Pressure Rises

Raffinate Splitter Tower Elevation

Feed Preheat to Raffinate Splitter Tower

LAH-5102 is an independent alarm for high level in the Raffinate Splitter bottom LT-5100 is shown at 50% level. At this time it is not in the alarm condition. The controller is shown in Manual. DCS Screen Showing Raffinate Splitter Level Not in Alarm at 50% Level

LT-5100 is shown in the alarm condition with the level indication at 75.1%. The color has changed to yellow and there is an audible alarm that sounds DCS Screen Showing Raffinate Splitter Level in Alarm at 75% Level

Indicated Tower Base Level as Temperature Increases

Conclusions of the Technical Analysis The main conclusions from the technical analyses of the incident are as follows: The high peak pressures observed (63 psig) were caused by liquid filling up the 24-inch overhead line off the Splitter column. This is supported by the dynamic modeling results and supported by the flow response from the feed pump during the pressure release. As the RVs were located close to the bottom of the overhead line, the high hydrostatic pressure from a filled overhead line was sufficient to exceed the RV set pressure. Virtually all of the release was sub cooled liquid. The liquid reached the overhead line by a combination of grossly overfilling the main column with the liquid charge, and vaporization and expansion of the tower base and feed charge.

Aerial view of BP Texas City site of fatal 2005 explosion.

INDEPENDENT PANEL BP commissioned an independent panel chaired by former US Secretary of State James Baker III, to assess the effectiveness of corporate oversight of safety management systems and safety culture at its five US refineries. The panel s report was published in early 2007 and its recommendations can be grouped in 4 main headings. 1. Leadership 2. Integrated Process Safety Management System 3. Process Safety Knowledge and Expertise 4. Process Safety Culture

Leadership --- A new refinery management team led by a manager with great industry experience from outside BP has been appointed. A new simplified functional organization has been introduced built around an operation centric model, so that everyone involved in maintenance and operations knows what they are accountable for and to whom. HSSE Team and Practices --- The number of HSE staff at the refinery has trebled with a significant increase in the process safety team. A rigorous investigation process that includes all incidents whether they are near miss incidents or actual events has been implemented. A new site-wide transit system removing more than 500 vehicles from site has been introduced.

Workforce Engagement --- The new leadership is changing expectations. Changes in work practices including Stop campaign and employee led PULSE program have been introduced. Several jobs have been stopped by employees on the spot because of process safety and related issues. New communication practice through weekly safety meeting has been introduced. Trailer- -- More than 200 trailers have been removed from the site and 400+ personnel relocated to offsite offices. A new hurricane proof employees services building have been constructed outside the perimeter of the refinery.

Blow Down System- -- 11 blow down stacks have been removed and new flares installed in line with a new policy of no atmospheric venting of light hydrocarbons. A revalidation study of relief valves for all process units and a relief and flare system have been taken. Inspection and maintenance - -- A top to bottom continuous inspection and evaluation of the refinery started. The expanded site inspection program doubled the number of inspectors resulted change of 60000 feet of pipe and 2500 nos. of valves.

Control of Work- -- In light of significant construction and maintenance program a formal risk assessment has been implemented prior to any permitting job. The control of work verification process has been strengthen ensuring work is stopped when deviations occur. Operating Procedure - -- Roles, responsibilities, start up, operating and emergency procedure have been clarified. Leadership audits have been instituted to verify proper use of start up, shut down and safe procedures. Pre start up safety reviews with more detailed check requiring formal sign off have been introduced.

Training - -- Additional training programs for all employees have been introduced. Performance Indicators - -- A new on line system for process safety management information has been developed and is used to focus specifically on process safety in monthly management review meetings. Group Operations Risk Committee ( GORC ) - -- This committee is chaired by the CEO and membership includes the business segment chief executives and senior functional expertise to establish - --

CONTINUAL IMPROVEMENT 1. Incident Analysis, learning and response. 2. Monitoring performance indicators 3. Review of plan 4. Implementation of Operation Management System (OMS) 5. Operations capabilities development

CONCLUSION The Texas City incident was preventable. The lessons learned from the incident could help prevent others from repeating mistakes.