Cost cutting BP bosses blamed for Texas City disaster

Texas City, Texas – The US Chemical Safety Board (CSB) has blamed “organisational and safety deficiencies at all levels of the BP Corporation” for the 23 March 2005 explosion at the BP Texas City refinery.

In particular, the CSB final report found that BP executives had instigated major spending cuts without assessing the impact on safety of the Texas site – in the six years leading up to the incident, which killed 15 and injured many more.

All 15 fatalities occurred in or near trailers that were sited close to a blowdown drum that vented flammable liquid and vapor directly to the atmosphere. The accident occurred during the startup of the refinery’s octane-boosting isomerization (ISOM) unit, when a distillation tower and attached blowdown drum were overfilled with highly flammable liquid hydrocarbons.

As the blowdown drum vented directly to the atmosphere, there was a geyser-like release of highly flammable liquid and vapor onto the grounds of the refinery. A diesel pickup truck that was idling nearby ignited the vapor, initiating a series of explosions and fires that swept through the unit and the surrounding area.

BP acquired the Texas City refinery when it merged with Amoco in 1999. The CSB report found that “cost-cutting in the 1990s by Amoco and then BP left the Texas City refinery vulnerable to a catastrophe.”

Shortly after acquiring Amoco, BP’s group chief executive ordered a 25% cut in fixed spending at its refineries. These cuts discouraged refinery officials from replacing the blowdown drum with a flare system, which could have prevented the accident, said the report.

In 2002, BP commissioned a series of audits that revealed serious safety problems at the Texas City refinery, including a lack of necessary preventative maintenance and training. These audits and studies were shared with BP executives in London, but the group’s response, stated CSB, “was too little and too late.”

Moreover, in 2004, BP executives challenged their refineries to cut yet another 25% from their budgets for the following year. The investigative team also pointed to a significant downsizing in operations and training at the refinery as the Texas City Refinery halved the number of control board operators in the ISOM area, from two to one.

Then in 2003, the sole remaining operator was given a third process unit to control. Each refinery unit is a complex network of equipment, piping, valves, and instruments. The ISOM unit itself, one of the smaller units of the refinery, was the size of a city block and contained four major subunits. A 2003 BP hazard review recommended that a second operator be present during startups, but this recommendation was never implemented.

The 1999 cutbacks also resulted in significant training reductions for operators, and cost pressures prevented the refinery from using simulators to train operators for handling abnormal situations and process upsets.

Investigator Mark Kaszniak stated that if the appropriate process safety management standard had been thoroughly implemented at the refinery, the accident would probably not have occurred. This shortcoming, he said, led to ineffective incident investigations, lack of effective preventative maintenance, lack of change reviews and pre-startup reviews, and incomplete hazard analyses.

The CSB found that the refinery only investigated three of the eight known previous ISOM blowdown release incidents, where flammable and potentially explosive vapor was released from the same blowdown drum involved in the 23 March accident.

The report also determined that both the blowdown drum and the relief valve disposal piping were undersized, which led to the blowdown drum overflowing with liquid. “By 2005, the required relief valve study was 13 years overdue,” said Kaszniak.

For the first time in its nine-year history, the CSB conducted an examination of corporate safety culture. Supervisory investigator Don Holmstrom pointed to the unusual history of fatal incidents at the Texas City Refinery. Over a 30-year period spanning Amoco and BP’s ownership, 23 workers died at the facility - not counting the 15 workers killed in March 2005.

“Many of the safety issues that led to the March 2005 accident were recurring safety problems that had been previously identified in internal audits, reports, and investigations. Our findings show that both BP Group executives and Texas City managers became aware of serious process safety problems at the refinery beginning in 2002 and continuing through March 2005,” Holmstrom said.

Holmstrom also cited three serious incidents at the BP refinery in Grangemouth, Scotland, in 2000, which were investigated by the UK Health & Safety Executive. BP officials had written that meeting “cost targets” played a role in the Grangemouth incidents and stated that “there was too much emphasis on short term cost reduction - HSE [health, safety, and environment] was unofficially sacrificed to cost reductions, and cost pressures inhibited the staff from asking the right questions.”

The lessons from the Grangemouth investigation were not effectively implemented at the Texas City Refinery. Holmstrom stated that in each year from 2002 to 2005, BP made its own significant findings about the culture and safety of the Texas City site.

Indeed, in 2002 a new refinery manager found the infrastructure and equipment to be “in complete decline.” A follow-up study by BP found “serious concerns about the potential for a major site accident” due to mechanical integrity problems.

Later in 2002, another internal report explicitly connected the safety problems to earlier cost-cutting, stating, “the current integrity and reliability issues at TCR [Texas City Refinery] are clearly linked to the reduction in maintenance spending over the last decade.”

Similar findings were made in 2003, when a study of maintenance found that “cost cutting measures have intervened with the group’s work to get things right - usually reliability improvements are cut.” An external BP safety audit found inadequate training, a large number of overdue action items, and a concern about “insufficient resources to achieve all commitments.” The report stated that “the condition of the infrastructure and assets is poor.”

In 2004 there were three major accidents at the refinery, including a $30-million process fire and two other accidents that caused three deaths. Meanwhile, an analysis conducted by BP’s internal audit group in London found common safety deficiencies among 35 BP business units around the world, including widespread tolerance of non-compliance with basic HSE rules and poor implementation of safety management systems.

Holmstrom said. “BP managers and executives attempted to make improvements from 2002 to 2005 but they were largely focused on personal safety - such as slips, trips, falls, and vehicle accidents - rather than on improving process safety performance, which continued to deteriorate.”

Human factors were another contributory factor to the Texas City accident, the report continued. The tower overfilled, it said, because a valve allowing liquid to drain from the bottom of the tower into storage tanks was left closed for over three hours during the startup on the morning of 23 March – contrary to unit startup procedures.

“BP relied on operators taking correct and timely actions and following procedures to prevent excessive liquid levels in the tower … Modern control systems utilize automatic safety controls to shut down liquid flow to a tower and prevent dangerous overfilling,” said the CSB.

Indeed, the investigators found that abnormally high liquid levels and pressures, and dramatic swings in tower liquid level were the norm in almost all previous startups of the unit since 2000. These procedural deviations - together with the faulty condition of valves, gauges, and instruments on the tower - made the tower susceptible to overfilling, they said.

According to the report, none of the previous abnormal startups was investigated by BP, nor were operating procedures updated to reduce the likelihood or consequences of flooding the tower.

“BP had no policy for effective shift communication or requirements for shift turnover,” CSB Investigator Cheryl MacKenzie said. “This important instruction to the operator was given over the phone and was not contained in the log book or the startup procedure.”

A high-level alarm malfunctioned and a faulty tower level transmitter later indicated that the liquid level was below nine feet and falling. Unknown to operators, the level was actually rising rapidly, reaching 158 feet by 1 pm on 23 March, 20 minutes before the explosion.

The CSB determined that the level transmitter was miscalibrated, using a setting from outdated data sheets that likely had not been updated since 1975. The tower lacked basic process indicators that could have provided operators with an accurate picture of the high level inside the tower. The control panel also did not display the flows in and out of the tower on the same screen, and did not automatically calculate how much total liquid was in the tower, even though it could have been configured to do so.

The CSB team also concluded that ISOM unit operators were fatigued when the startup occurred as they had been working 12-hour shifts for 29 or more consecutive days.

The report further concluded that BP supervisory personnel were aware of the equipment problems with the level transmitter before the 23 March startup but still had signed off on equipment checks as if they had been done.

In addition, there was no documented test method for the blowdown drum high-level alarm, which failed to sound on March 23, and the testing method in actual use was contrary to the manufacturer’s recommendations.

The refinery’s computerised maintenance management system allowed maintenance work orders to be closed even if no repair had been done. Many action items from previous hazard analyses and incident investigations - such as a 1994 action item to review the adequacy of the ISOM blowdown system following two serious incidents that year - were never completed.