On March 23, 2005, a catastrophic explosion occurred at BP’s Texas City refinery in Texas, USA. The incident transpired during the startup of a hydrocarbon isomerisation (ISOM) unit. Operators inadvertently overfilled a raffinate splitter tower, causing it to flood with hydrocarbons. This led to the over-pressurisation of the tower and the release of a highly flammable hydrocarbon vapor cloud. The vapor ignited, resulting in a massive explosion that caused extensive damage across the refinery.
Date
Location
Industry
Substance
Cause
The immediate cause was the overfilling of the raffinate splitter tower during startup, which led to the discharge of flammable liquid from the blowdown stack and its subsequent ignition.
Underlying causes were numerous and included:
- Failure to establish effective safe operating limits.
- Deficiencies in equipment design, including inadequate level indication, lack of automatic safety controls, and a blowdown system that discharged directly to the atmosphere without a flare. Previous tower overfilling incidents were not adequately addressed.
- Inadequate startup procedures, including not removing liquid from the tower.
- Inadequate shift turnover, leading to a loss of situational awareness.
- Mechanical integrity deficiencies, including failures of critical instrumentation like the level transmitter (LT-5100) and a corroded high-level alarm float (LSH-5020).
- Company safety culture, which lacked a focus on process safety management (PSM), encouraged cost-cutting over safety investments, and did not effectively respond to reports of serious safety problems.
- Ineffective incident investigation system that failed to learn from previous blowdown incidents.
- Poor placement of occupied trailers too close to the hazardous ISOM unit.
- Insufficient operator training and the lack of supplementary assistance during the hazardous startup.
Consequence
The incident resulted in a major explosion and fire at the refinery. This led to:
- 15 fatalities.
- 180 injuries.
- Significant financial losses exceeding $1.5 billion.
- Alarm to the community.
- Severe damage to the ISOM unit, surrounding parking areas, the satellite control room, and the catalyst warehouse.
- Damage to over 40 trailers, with 13 destroyed.
- Damage to approximately 70 vehicles.
- Blast damage to buildings in surrounding units and off-site buildings.
- Post-explosion fires.
- Community shelter-in-place orders were issued in subsequent incidents at the refinery.
Injuries
180
Fatalities
15
All fatalities occurred in or near trailers located close to the ISOM unit.
Lessons Learned
- Process unit startup is a significantly more hazardous period than normal operations and requires supplementary assistance and rigorous procedures. Incidents are significantly more likely during startups.
- Blowdown systems discharging flammable materials directly to the atmosphere without a flare are inherently unsafe. Previous releases from the ISOM blowdown stack were early warnings that were not heeded.
- Siting occupied trailers close to process units handling highly hazardous materials is extremely dangerous. Temporary structures are more susceptible to damage from explosions.
- Reliance on low personal injury rates as a primary safety indicator can be misleading and fail to capture the risk of catastrophic process safety incidents. A focus on process safety metrics is crucial.
- Deficiencies in mechanical integrity programs, including inadequate maintenance, testing, and calibration of critical instrumentation, can lead to failures with catastrophic consequences. Equipment data sheets must be kept up-to-date.
- Effective incident investigation systems are essential for capturing lessons learned and implementing needed changes to prevent future incidents. Near-misses and previous incidents should be thoroughly investigated.
- A strong safety culture with a focus on process safety management is paramount for preventing major accidents. This includes encouraging reporting of incidents without fear of retaliation and ensuring that management models and enforces safety procedures.
- Organizational changes (MOC) must be systematically reviewed to ensure safety is maintained.
- Board-level oversight and accountability for process safety are crucial.
Image Source: US Chemical Safety Board
Analysis
The incident at the BP Texas City Refinery on March 23, 2005, was a culmination of numerous safety system deficiencies and organizational failures. The startup of the ISOM unit’s raffinate splitter section involved filling the tower with liquid. However, the level control valve on the tower was not functioning correctly, and feed was added for approximately three hours without liquid being removed. Contributing to this was a malfunctioning level transmitter (LT-5100) that provided an inaccurate level reading to the control system. Additionally, a high-level alarm (LSH-5020) failed to activate due to a corroded float.
As the tower overfilled, pressure increased, causing three pressure relief valves to open. These valves discharged a large quantity of flammable raffinate liquid into a blowdown drum, which was designed to handle vapors and small amounts of liquid but quickly overfilled. The blowdown drum was connected to a stack open to the atmosphere and was not equipped with a flare to safely combust flammable releases. The overfilled drum resulted in a geyser-like release of flammable liquid out of the blowdown stack.
The cascading liquid from the stack atomized into small droplets, enhancing evaporation and the formation of a large flammable vapor cloud at ground level. The source of ignition is believed to have been a nearby idling pickup truck. The resulting vapor cloud explosion generated significant blast pressure that caused widespread damage and fatalities. Tragically, many contract workers were located in temporary trailers situated very close to the ISOM unit and the blowdown drum, and these trailers offered little protection against the blast.
The CSB investigation revealed that prior to this catastrophic event, there were numerous warning signs, including at least eight serious hydrocarbon releases from the ISOM blowdown stack between 1994 and 2004, some of which resulted in fires. Most ISOM startups also experienced high liquid levels in the splitter tower. However, these incidents were not effectively investigated, and lessons were not learned or implemented to prevent a recurrence.
Furthermore, the investigation highlighted a systemic lack of focus on process safety at the Texas City refinery, driven in part by cost-cutting measures and a prioritization of personal safety metrics over process safety management. Audits and studies had identified serious safety problems at the refinery for years, but the companies response was ineffective. The placement of the trailers near the hazardous unit, despite existing (though inadequate) siting policies and previous hydrocarbon releases, underscored a broader organizational failure to adequately assess and mitigate major accident risks.