‘OrganiSational and safety deficiencies at all levels of the BP Corporation’ caused the March 23, 2005, explosion at the BP Texas City refinery, the worst industrial accident in the United States since 1990.
This is the conclusion of the 335-page final report released on Wednesday by federal investigators from the US Chemical Safety Board (CSB).
The CSB noted that the independent Baker panel, formed and funded by BP in response to an urgent CSB safety recommendation, issued its final report in January 2007.
This found ‘material deficiencies’ in the safety of BP’s five US refineries in Texas, California, Indiana, Ohio, and Washington.
All 15 fatalities at Texas City occurred in or near trailers that were sited as close as 121 feet from a blowdown drum that vented flammable liquid and vapour directly to the atmosphere.
The CSB report said that safety was harmed by cost-cutting, production pressures, and failure to invest.
BP acquired the Texas City refinery when it merged with Amoco in 1999. The CSB report found that ‘cost-cutting in the 1990s by Amoco and then BP left the Texas City refinery vulnerable to a catastrophe’.
Shortly after acquiring Amoco, the BP Group Chief Executive ordered an across-the-budget 25 per cent cut in fixed spending at the corporation’s refineries.
The impact of the cost cuts is detailed in many of the more than 20 key investigative documents the CSB made public on Wednesday evening, including internal BP safety audits, reviews, and emails.
Among other things, cost considerations discouraged refinery officials from replacing the blowdown drum with a flare system, which the CSB previously determined would have prevented or greatly minimised the severity of the accident.
CAB Chairman Merritt said: ‘The combination of cost-cutting, production pressures and failure to invest, caused a progressive deterioration of safety at the refinery.
‘Beginning in 2002, BP commissioned a series of audits and studies that revealed serious safety problems at the Texas City refinery, including a lack of necessary preventative maintenance and training.
‘These audits and studies were shared with BP executives in London, and were provided to at least one member of the executive board.
‘BP’s response was too little and too late.
‘Some additional investments were made, but they did not address the core problems in Texas City.
‘In 2004, BP executives challenged their refineries to cut yet another 25 per cent from their budgets for the following year.’
The March 23 accident occurred during the startup of the refinery’s octane-boosting isomerization (ISOM) unit, when a distillation tower and attached blowdown drum were overfilled with highly flammable liquid hydrocarbons.
Because the blowdown drum vented directly to the atmosphere, there was a geyser-like release of highly flammable liquid and vapour onto the grounds of the refinery.
A diesel pickup truck that was idling nearby ignited the vapour, initiating a series of explosions and fires that swept through the unit and the surrounding area.
High overpressures from the vapour cloud explosion totally destroyed 13 trailers and damaged 27 others. People inside trailers were injured as far as 479 feet away from the blowdown drum, and trailers nearly 1,000 feet away sustained damage.
The CSB found that worker fatigue, bad communication and faulty equipment which gave false instrument readings contributed to the accident.
The tower overfilled because a valve allowing liquid to drain from the bottom of the tower into storage tanks was left closed for over three hours during the startup on the morning of March 23, which was contrary to unit startup procedures.
The investigation found that procedural deviations, abnormally high liquid levels and pressures, and dramatic swings in tower liquid level were the norm in almost all previous startups of the unit since 2000.
None of the previous abnormal startups was investigated by BP, nor were operating procedures updated to reduce the likelihood or consequences of flooding the tower.
‘Procedural workarounds were accepted as normal,’ CSB Investigator Cheryl MacKenzie said.
On March 23, the control board operator’s decision to keep the drain valve closed was influenced by ineffective communication and by false instrument readings from the tower.
Alarms and gauges that should have warned of the overfilling equipment failed to operate properly.
Also, ISOM unit operators were likely fatigued when the startup occurred. By March 23, operators had been working 12-hour shifts for 29 or more consecutive days.
There are no fatigue prevention guidelines that are widely used and accepted in the oil and chemical sector.
The investigative team also pointed to a significant downsizing that occurred in operations and training at the refinery.
Following BP’s global 25 per cent cut to fixed costs in 1999, the Texas City Refinery halved the number of control board operators in the ISOM area, from two to one.
Then in 2003, the sole remaining operator was given a third process unit to control. Each refinery unit is a complex network of equipment, piping, valves, and instruments.
The ISOM unit itself, one of the smaller units of the refinery, was the size of a city block and contained four major subunits.
A 2003 BP hazard review recommended that a second operator be present during startups, but this recommendation was never implemented.
The 25 per cent budget cut from 1999 also resulted in significant training reductions for operators, and cost pressures prevented the refinery from using simulators to train operators for handling abnormal situations and process upsets.
The investigation found that the Texas City refinery had ‘longstanding Process Safety deficiencies’.
Like other refineries and chemical plants that handle highly flammable, toxic, or hazardous substances, the Texas City Refinery is regulated under the Process Safety Management (PSM) standard of the US Occupational Safety and Health Administration (OSHA).
The PSM standard requires covered facilities to implement 14 specific management elements to prevent catastrophic releases of hazardous substances.
These include hazard analysis, operator training, preventative maintenance programmes (mechanical integrity), and management of change reviews.
Investigator Mark Kaszniak stated: ‘If the Process Safety Management standard had been thoroughly implemented at the refinery, as required by federal regulations, this accident likely would not have occurred.’
Kaszniak said that numerous requirements of the standard were not being followed in Texas City and cited ineffective incident investigations, lack of effective preventative maintenance, lack of change reviews and pre-startup reviews, and incomplete hazard analyses.
In 2004, an internal BP audit graded the refinery’s analysis of incident information as ‘poor’.
The CSB also determined that both the blowdown drum and the relief valve disposal piping were undersized, which led to the blowdown drum overflowing with liquid.
Under the PSM standard, BP was required to conduct a study of the tower’s pressure relief system to ensure its safety. Despite the federal requirement, BP was not able to produce any documents indicating the study had even been done.
The report noted that an internal BP audit from 2004 found that design calculations did not exist for many relief valves at the refinery and that the problem had existed for nearly 10 years.
The report also concluded that BP supervisory personnel were aware of the equipment problems with the level transmitter before the March 23 startup but still had signed off on equipment checks as if they had been done, which the report said reflected the prevalence of production pressures at the refinery.
The CSB found that a ‘dysfunctional safety culture existed at all levels of BP’.
For the first time in its nine-year history, the CSB conducted an examination of corporate safety culture.
Inspector Holmstrom pointed to the unusual history of fatal incidents at the Texas City Refinery. Over a 30-year period spanning Amoco and BP’s ownership, 23 workers died at the facility, not counting the 15 workers killed in March 2005.
He said: ‘Many of the safety issues that led to the March 2005 accident were recurring safety problems that had been previously identified in internal audits, reports, and investigations.
‘Our findings show that both BP Group executives and Texas City managers became aware of serious process safety problems at the refinery beginning in 2002 and continuing through March 2005.’
Holmstrom also cited a series of three serious incidents at the BP refinery in Grangemouth, Scotland, in 2000, which were investigated by the UK Health and Safety Executive.
BP officials wrote that meeting ‘cost targets’ played a role in the Grangemouth incidents and stated that ‘there was too much emphasis on short term cost reduction – HSE (health, safety, and environment) was unofficially sacrificed to cost reductions, and cost pressures inhibited the staff from asking the right questions.’
The lessons from the Grangemouth investigation were not effectively implemented at the Texas City Refinery, however.
Holmstrom stated that in each year from 2002 to 2005, BP made its own significant findings about the culture and safety of the Texas City site. In 2002, the new refinery manager found the infrastructure and equipment to be ‘in complete decline’.
A follow-up study by BP found ‘serious concerns about the potential for a major site accident’ due to mechanical integrity problems.
Later in 2002, another internal report explicitly connected the safety problems to earlier cost-cutting, stating, ‘the current integrity and reliability issues at TCR (Texas City Refinery) are clearly linked to the reduction in maintenance spending over the last decade’.
Holmstrom said: ‘The prevailing culture at the Texas City refinery was to accept cost reductions without challenge and not to raise concerns when operational integrity was compromised.’
Similar findings were made in 2003, when a study of maintenance found that ‘cost cutting measures have intervened with the group’s work to get things right – usually reliability improvements are cut.’
An external BP safety audit found inadequate training, a large number of overdue action items, and a concern about ‘insufficient resources to achieve all commitments’. The report stated that ‘the condition of the infrastructure and assets is poor’.
The year 2004 was marked by three major accidents at the refinery, including a $30m process fire and two other accidents that caused three deaths.
Meanwhile, an analysis conducted by BP’s internal audit group in London found common safety deficiencies among 35 BP business units around the world, including widespread tolerance of non-compliance with basic health, safety, and environment rules and poor implementation of safety management systems.
Referring to BP documents from 2004, Holmstrom stressed: ‘There was still not an adequate focus on preventative maintenance before accidents occurred.’
The investigation found that BP’s executives relied unduly on injury statistics in assessing the safety of their facilities.
Later in 2004, a safety culture survey of the refinery was conducted and endorsed by the site leadership.
The study, known as the Telos report, pointed to ‘an exceptional degree of fear of catastrophic incidents’ among other conclusions, and it stated respondents’ belief that ‘production and budget compliance gets . . . rewarded before anything else.’
Finally, a safety business plan for 2005 cited as a ‘key risk’ the possibility that ‘Texas City kills someone in the next 12-18 months’.
Holmstrom said: ‘The investigation found that BP executives made spending cuts without assessing the safety impact of those decisions.’
