[Music] [Sound of helicopter rotors] Narrator: At 1:20 p.m. on March 23rd, 2005, a massive explosion and fire erupted
at the BP Refinery in Texas City, Texas. The explosion killed 15 workers and
injured 180 others, many of them seriously. The blast occurred at the
isomerization or ISOM Unit, which produces materials to
boost the octane rating of gasoline. The explosion shattered
windows in homes and businesses up to three-quarters of a mile
away from the 1200 acre refinery. As thick, black smoke billowed from
the plant, authorities instructed some 43,000 Texas City residents
to stay indoors. The accident cost BP billions of dollars in
victims' compensation, property damage and lost production. Holmstrom: This investigation was the
largest and most comprehensive investigation in the history of the
Chemical Safety Board. Narrator: CSB Supervisory Investigator
Don Holmstrom led a two-year investigation to determine the root causes
of the accident. Holmstrom: We interviewed over 370 witnesses. We looked at thousands of documents, literally
millions of pages of documents and we examined the plant, inspected over 40 pieces of
instrumentation and equipment. Narrator: The investigation team
examined a wide range of safety systems, practices and standards and looked at human factors,
such as fatigue and communication between operators. The Board's report was released at a public
meeting in Texas City on March 20th, 2007. Then CSB Chairman Carolyn Merritt presided. Merritt: Many of you here tonight had family members
or coworkers who were victims of this explosion. To all of you, I express my
deepest condolences and sincere wishes that society never allows
another accident like this to occur. Wright: The tragedy at BP was the worst industrial
accident in the United States in nearly 15 years. The CSB concluded that it was the result of organizational
and safety deficiencies at all levels of the company. We found that BP management has for many years
overlooked warning signs of a possible catastrophic accident. Kletz: There's an old saying that if you
think safety is expensive, try an accident. Accidents cost a lot of money and they're not
only in damage to plant and in claims for injury, but also the loss of
the company's reputation. Hopkins: The reason why the Texas City accident
has such an impact is because when people look at it, they can see that they're all
in the same boat, that they, the problems which led to that accident are
likely to be present at other sites around the world. Erwin: My fear is that some of the
other refineries within the United States will feel that couldn't happen to me. And the ones that feel that
that couldn't happen at their site is the ones that are set
up to have it happen there. Narrator: The following CSB computer animation
depicts the sequence of events over an 11-hour period leading to the explosion at the
BP Texas City Refinery on March 23rd, 2005. Several units at the Texas City Refinery had
been shut down for lengthy maintenance projects, which required nearly a thousand
contractors to be onsite, along with BP employees. BP had positioned a number of
portable trailers close to process units for the use of contractors
and other maintenance workers. Over a period of months, BP had located ten
trailers for workers servicing the Ultracracker unit, including a double-wide wood framed trailer that
contained 11 offices and was regularly used for meetings. Though these trailers were
located near the isomerization unit, the occupants were not warned the ISOM unit was
about to start up, a potentially hazardous operation. At 2:15 a.m., on March 23rd, overnight operators
began introducing flammable liquid hydrocarbons, known as raffinate into a 170
foot tall raffinate splitter tower, used to distill and
separate gasoline components. Near the base of the tower there was a single
instrument that measured how much liquid was inside. It transmitted this information to a central
control room located away from the ISOM unit. But this level indicator was not designed
to measure liquid above the nine-foot mark. During normal operation, the tower was only
supposed to contain about six and a half feet of liquid, but during startups, operators
routinely deviated from written procedures and filled the tower
above the nine-foot mark, concerned that if the liquid level fluctuated too
low it would cause costly damage to the furnace. At 3:09 a.m., as the liquid
neared the eight-foot mark, a high level alarm activated
and sounded in the control room. But a second high level alarm, slightly
further up the tower, failed to go off. By 3:30 a.m., the level
indicator showed that liquid had filled the bottom nine feet of
the tower and the feed was stopped. The CSB later estimated that the
liquid was in fact at a height of 13 feet, but operators could not know the actual level,
because the indicator only measured up to nine feet. The lead operator had been overseeing the startup
from a satellite control room within the ISOM Unit. At 5:00 a.m., he briefly
updated the night board operator in the central control room
about the startup activities. The lead operator then the left the refinery early,
an hour before the end of the shift. A new board operator arrived in
the control room around 6:00 a.m., to start his 30th day in a row,
working a 12-hour shift. He spoke briefly with the departing nightshift operator
and then read the logbook to prepare for the startup. But the logbook did not clearly indicate
how much liquid was already in the tower and equipment and it left no instructions on routing of
the liquid feed and products when the startup resumed. Instead, the control board operator only
found a one-line logbook entry that said "ISOM brought in some raff
to unit to pack raff with". At 7:15 a.m., the
dayshift supervisor arrived. Because he was more
than an hour late, he received no formal briefing from personnel on
the nightshift about conditions in the ISOM Unit. At 9:51 a.m.,
operators resumed the startup. They began recirculating the liquid feed and
adding more liquid to the already overfilled tower. As new feed was added, startup procedures
called for regulating the liquid level in the tower, using the automatic level control valve. But the board operator and others had received
conflicting instructions on routing the product. As a result, this critical valve
was left closed for several hours, blocking the flow of
liquid from the tower. A few minutes later, operators lit burners
on the furnace to begin heating up the feed, part of the normal startup process. While the startup was underway, the day
supervisor left the refinery on short notice, just before 11:00 a.m.,
to attend to a family medical emergency. Contrary to BP's own procedures, no
experienced supervisor was assigned to replace him. This left a single control board operator,
now without a qualified supervisor, to run three refinery units, including
the ISOM Unit, which needed close attention. The refinery had eliminated a
second board operator position following corporate budget cuts in 1999,
after BP acquired Amoco. As the startup continued, the tower steadily filled with liquid,
reaching a height of 98 feet shortly before noon; more than 15 times the normal level. But the improperly calibrated level
indicator told operators in the control room that the liquid was at 8.4
feet and gradually falling. Furthermore, the control panel was not configured
to clearly warn operators of the growing danger. It did not display flows into and
out of the tower on the same screen, nor did it calculate the
total liquid in the tower. Meanwhile, the maintenance contractors who were
not involved in the operation of the ISOM Unit left their work trailers to attend a company
lunch, celebrating a month without a lost-time injury. At 12:41 p.m., an alarm activated as the rising liquid
compressed the gases remaining in the top of the tower. Unable to understand the
source of the high pressure, operators opened a manual chain valve to vent
gases to the unit's emergency release system, a 1950s era blow-down drum that
vented vapor directly into the atmosphere. Operators also turned off two burners in the furnace,
to lower the temperature inside the tower, believing this would
reduce the pressure. Nobody knew the tower
was dangerously full. The operators did become concerned
about the lack of flow out of the tower and began opening the valve to send liquid
from the bottom of the tower to storage tanks, but this liquid was very hot. As it flowed through
the heat exchanger, it suddenly raised the temperature of the liquid
entering high up the tower by 141 degrees Fahrenheit. It was now about 1:00 p.m. Contract workers, unaware of the startup
and the looming danger, returned from lunch and began a meeting in the double-wide trailer
in the corner room closest to the blow-down drum. Over the next few minutes, the hot feed entering the
tower caused the liquid inside to start to boil and swell. Liquid filled the tower completely and
began spilling into the overhead vapor line, exerting great pressure on the
emergency relief valves 150 feet below. At 1:14 p.m., the three
emergency valves opened, sending nearly 52,000 gallons of flammable liquid to
the blow-down drum at the other end of the ISOM Unit. Liquid rose inside the blow-down drum
and overflowed into a process sewer, setting off alarms
in the control room. But the high-level alarm on the
blow-down drum failed to go off. None of the operators knew of the
catastrophe unfolding in the ISOM Unit. As flammable hydrocarbons
overfilled the blow-down drum, operators nearby saw a geyser of liquid
and vapor erupt from the top of the stack. The equivalent of nearly a tanker truck
full of hot gasoline fell to the ground and began forming a
huge flammable vapor cloud. This scene, based on CSB computer modeling, shows
how the vapor cloud expanded in just 90 seconds, engulfing the Unit and the
nearby trailers full of workers. About 25 feet from the
base of the blow-down drum, two workers were parked in a
pickup truck with the engine idling. As flammable vapor entered the air intake,
the diesel engine began to race. The two workers fled,
unable to shut off the engine. Moments later witnesses saw the truck backfire
and ignite the vapor cloud. Narrator: Powerful explosions swept through the area. Computer modeling shows how the blast
pressure wave accelerated through the ISOM Unit, causing heavy destruction and
igniting fires throughout the area. The workers inside the trailers were
right in the path of the explosions. The fires continued to burn for hours. Twelve of the 20 occupants of the
double-wide trailer were killed, along with three workers in a trailer nearby. Dozens of others suffered serious burns,
fractures and other traumatic injuries. The wood and metal frame trailers
were blown apart by the blasts. Firefighters struggled to rescue
the injured and recover the victims. Fifty large chemical
storage tanks were damaged and the ISOM Unit remained
shut down for more than two years. Holmstrom: During the early
stages of our investigation, our team had noted there were multiple safety
system deficiencies at the Texas City plant. We also found there was a
history of fatalities at the plant. Narrator: Prior to the
March, 2005 accident, 23 people died in accidents over a
30-year period at the Texas City Refinery, beginning when it was owned by Amoco and
continuing after BP acquired the refinery in 1999. Holmstrom: The CSB wanted
to know what the connection was between this history of fatal incidents
and the organizational and cultural factors. Narrator: BP Corporation's
lack of focus on preventing major accidents allowed budget cuts to be made
without assessing the impact on process safety. Holmstrom: The CSB found that
cost cutting, production pressures and failure to invest significantly impacted the
process safety performance at the Texas City Refinery and left the refinery
vulnerable to catastrophe. Narrator: After the merger with Amoco, BP ordered
a 25 percent reduction in fixed costs at all its refineries. Holmstrom: This impacted important process safety
systems such as staffing, training and mechanical integrity. Narrator: The effects of the budget cuts became apparent in a number of internal BP
documents made public following the accident. In one, the refinery manager was
quoted as having observed in 2002 that the infrastructure at
Texas City was in complete decline. He ordered a study of the
refinery's safety and mechanical integrity, a study which was shown to
be BP executives in London. That study warned of "serious concerns
about the potential for a major site incident", following more than 80 hydrocarbon
releases in the previous two years. The study also concluded that its own
findings were "urgent and far-reaching". A follow-up BP study in 2002 found the
refinery's integrity and reliability issues were "clearly linked to the reduction in
maintenance spend over the last decade". In 2003, a maintenance assessment
stated that cost-cutting measures have intervened with the
groups work to get things right. Usually reliability improvements are cut. And later that year, a company audit found
"the current condition of the infrastructure and assets is poor at Texas City" and that maintenance
spending was limited by a "checkbook mentality". Only the money on hand would be spent,
rather than increasing the budget. In March, 2004, BP auditors in London
concluded that 35 business units around the world, including the Texas City Refinery,
suffered from a host of common safety problems, including "widespread tolerance of non-compliance
with basic HSE or Health Safety and Environmental rules", "poor implementation of safety management systems
and lack of leadership competence and understanding". Holmstrom: There are a number of reports that
were coming up to as high as the Board level, that indicated serious problems
throughout the BP system. Narrator: During 2004,
the Texas City Refinery had three major accidents. In addition to this process unit fire
that caused 30 million dollars in damage, two other accidents in 2004
resulted in three fatalities. Yet this same year the refinery had
its lowest ever recordable injury rate, a statistic that does
not include fatalities. The CSB found that maintenance
spending increased between 2003 and 2004, but most of the increases were
for responding to serious accidents and complying with environmental requirements,
not for preventive maintenance. Late in 2004, the Texas City Refinery manager made a
presentation to supervisors titled "Safety Reality", reviewing fatalities at the
plant over the past 30 years. One of the slides was entitled
"Texas City is not a Safe Place to Work." Holmstrom: BP did its
own safety culture survey. It was done just
prior to the accident. That survey indicated there was an exceptional
degree of fear among employees of a major catastrophe. Narrator: Among the findings of the
survey, "the pressure for production, time pressure and understaffing are the
major causes of accidents at Texas City. Critical events [like failures or
breakdowns] are generally not attended to. Production and budget compliance gets
recognized and rewarded above anything else." Sociology Professor Doctor Andrew Hopkins has
written extensively on the causes of industrial disasters. Hopkins: My feeling is that the
solution to this problem of cost-cutting by senior people is to hold them responsible
for the safety implications of those cost cuts, so that when they
order a cost cut, they should personally be able to certify that
these things will not have adverse safety consequences. Narrator: The safety culture survey also pointed to the
exceptionally high executive turnover at the Refinery. Six different business unit leaders or
BULs in seven years prior to the accident. The authors of the
survey report concluded "We have never seen an organization
with such a history of leadership changes over such a short
period of time." Hopkins: Many managers are in
and out within a space of two years and what they are assessed on the basis of is
the profit they make in, on an annual basis. Now am I, as a manager, am I going to
spend a large amount of money to deal with some remote risk that is very unlikely to generate a
major accident during my year or two on my watch here? Narrator: The survey
of Texas City employees also found concern about safety and
equipment checks potentially left undone. Holmstrom: There was a "check the box" mentality,
which indicated that personnel would go through the motions with various policies
and procedures, but the work would not be conducted. Narrator: For example, the tower
high level alarm had been reported as not functioning several times in
the two years prior to the accident. But maintenance work orders for this alarm were closed,
although the repairs were never actually made. Holmstrom: Work orders could be closed out as completed,
even though the work hadn't been performed. This is important, because we found that on
the day of the incident during the ISOM startup, there were a number of instruments and equipment
that were not functioning properly. Narrator: On February 20th, 2005,
a company safety manager wrote "I truly believe we are on the
verge on something bigger happening." Then, three weeks later, a BP Business Plan
recognized a number of key safety risks, including that TCS or Texas City Site kills
someone in the next twelve to eighteen months. Eight days later
those fears were realized. Hopkins: Here were these warnings, these audits were, were sounding very clear warnings,
so why weren't they attended to? I think, my feeling is that Texas City
was virtually paralyzed by the cost-cutting, which had occurred at that site. And they were simply unable
to respond to those warnings. Holmstrom: There needs to be
somebody on the Board of Directors who can interpret those reports and be
in position to drive change effectively. Wright: The CSB's final report
recommended that BP appoint an additional
non-executive member of the Board of Directors, with specific expertise in
refinery operations and process safety. Hopkins: So at the problem at Texas City was that they
were essentially blind to this issue of process safety. They were focusing
on personal safety. Narrator: The CSB concluded
that over a period of years, BP managers focused on
lowering rates for personal injuries, such as slips, trips and falls, while often
disregarding key process safety indicators. Hopkins: We, as members
of the traveling public, intuitively understand that
the numbers of baggage handling and injuries really tells us nothing about the
likelihood of a major accident in aircraft crash and no airline in its right mind is going to try
and convince the traveling public of how safe it is by telling you about its
workforce injury statistics. Narrator: Dr. Trevor Kletz is an
internationally recognized chemical process safety expert. Kletz: Process safety deals with the fires and
explosions and toxic releases and things like that. And you can have a very good accident rate for what
we call hardhat accidents, but not for process ones. Hopkins: There are a whole series of incidents
occurring at BP in the years prior to the accident: gas releases, other kinds of releases, fires, all of which were telling you the
process safety was not well-managed. Holmstrom: You need to measure process safety
performance with the appropriate indicators, both leading and
lagging indicators. Narrator: Lagging indicators
measure events that have already occurred, such as fires,
explosions and equipment failures. Leading indicators are designed to predict
the likelihood of an accident before it occurs, for example, the percentage of
equipment inspections that are overdue. Hopkins: The opening of a safety release, pressure relief valve is itself an indicator
that things are not as they should be. So we should count those and try and reduce the
number of occurrences of those sorts of events. Narrator: But the investigation
found that BP did not effectively use leading and lagging indicators to
measure and drive process safety performance. For example, BP's pay plan rewarded
managers primarily for controlling costs. The only safety metric used to
calculate bonuses was the personal injury rate. Process safety
was not considered. Wright: A CSB final report
recommended that the United Steel Workers Union and the American Petroleum Institute
create a new standard for process safety indicators
for the petrochemical industry. The Board also called on BP to use leading and lagging
indicators to strengthen refinery safety performance. Kletz: After an accident,
managers often say, I didn't know this was happening or
not happening, as the case may be. If I'd known, I'd have stopped it. Now this is bad management. It's the manager's job to know what is going
on and he can do that by going round and by, keeping his eyes open and
reading the accident reports in detail. Narrator: The CSB investigation noted that BP ignored numerous warnings of the
potential for a catastrophic accident ... a result of not having an
effective reporting and learning culture. Glenn Erwin is a safety official
with the United Steel Workers and was a member of the independent
panel that examined BP's safety culture. Erwin: I believe it's very important that
we do have an open and a trusting environment where people can raise concerns and they can
tell management if they see a condition or they ... or something that is
out of the ordinary. Narrator: BP's own internal audits, however,
indicated a trusting environment was lacking. In 2005, the Texas City maintenance
manager said in an email that the refinery "has a ways to go to becoming a learning
culture and away from a punitive culture." It was a longstanding problem. In 2000, the BP Refinery in Grangemouth, Scotland
had three serious incidents, including a large process unit fire. An investigation by the British Health and Safety
Executive highlighted problems at the Grangemouth Refinery, that would show up again
five years later in Texas City. Holmstrom: There was need for corporate and
Board oversight over process safety management. There was a need to develop leading
and lagging indicators for process safety and there needed to be an emphasis on
process safety in order to prevent major accidents. Narrator: But the CSB found
little awareness in Texas City of the lessons BP executives promised
would be learned worldwide after Grangemouth. As British regulators concluded,
BP's decentralized management structure impaired learning
from previous incidents. Hopkins: And the reason why BP failed
to learn these lessons from other events, the reason why they seemed to have this,
what I would call learning disability, lies in the way in which
the organization was designed. It lies in the bonus systems of payment. It lies in the decentralized
structure of the organization. It lies in the, the organizational
location of process safety experts. Narrator: The CSB found that
following the 1999 merger with Amoco, BP dismantled Amoco's existing
centralized safety structure. The reorganization left a
diminished process safety function that no longer reported to
senior refinery leadership. Hopkins: So I think the lesson,
one of the lessons coming out that is that if an organization
judges something important, it will locate people towards the top of apex in
that organization, people with responsibility for that. And the fact that the process
safety manager was further down the line is yet another indication of the
lack of focus on process safety. Holmstrom: A positive safety culture would
ensure that incidents are being reported, that they're being followed up on, that
there's enough resources to ensure adequate safety. Narrator: Over the years at Texas City,
many critical incidents were not reported, nor were the lessons acted upon to
prevent future catastrophic events. Kletz: And it's also in human nature, this
tendency to say, oh, gosh, that was a near one; I'm glad that lead
didn't catch fire. Let's forget about it
and get on with the job. Narrator: For example, BP wasn't
investigating abnormal conditions that were occurring repeatedly
during startups of the ISOM Unit. Holmstrom: The CSB examined 19
previous startups in the five years prior to the ISOM incident and found
in the vast majority of these startups, the operators ran a high level,
above the range of the level transmitter. The problem with running the level above the reading
is that you don't know how high the level really is. This can lead to
grossly overfilling the tower. Narrator: But even though high levels and
pressures could have led to a catastrophic accident, the previous startups were never investigated as near-misses
and procedural deviations became accepted as normal. The CSB investigation also found eight serious releases
of flammable vapor from the ISOM blowdown drum, two of which caught fire
between 1994 and 2004. Only three of the incidents
were ever investigated. Kletz: Well, it's widely recognized now that you
should, that you should investigate near-misses or really near accidents, though they're called
near-misses, as thoroughly as you investigate accidents. For it's only a matter of luck whether a leak
in flammable liquid or gas catches fire or not. Wright: In our final report, the CSB
recommended that BP's Board of Directors establish a system to encourage reporting
of incidents without fear of retaliation, to investigate and implement prompt corrective actions
and to communicate lessons throughout the company. Kletz: The first choice after an accident is to say
how can we improve the design, so this can't happen? How can we remove the
opportunity for errors? Narrator: Even as releases occurred
over many years in the ISOM Unit, BP continued using equipment
based on outdated designs. The raffinate splitter tower lacked modern design
safeguards, such as redundant level indicators and alarms, a differential pressure indicator and
automatic interlocks to prevent overfilling. Kletz: In a well-designed plant, a simple error, like
closing their own valve shouldn't result in an accident. Narrator: The design of the emergency
pressure relief system was also outdated. Relief valves vented hydrocarbons directly to
the atmosphere through an antiquated blowdown drum, which was first
installed in the 1950s. The CSB report said the hydrocarbon should have
been routed to an inherently safer disposal system, such as a flare, to contain the
hydrocarbon liquid and burn off flammable vapor. In fact, the investigation found that
Amoco's own safety standards later adopted by BP stated that new blowdown stacks, which
discharge directly to the atmosphere are not permitted. As facilities were upgraded, existing blowdown
systems, which are still necessary, should be replaced. Holmstrom: Several
occasions prior to the incident, BP had seriously considered
connecting a flare to the ISOM Unit. Narrator: In the early 1990s,
when Amoco owned the refinery, three proposals were made to
replace blowdown stacks at Texas City. Two more proposals were made in 2002,
after the merger with BP. Holmstrom: However, these decisions
were impacted by production pressures and budget cuts and the
flare was never constructed. In 1992, OSHA conducted an
inspection at the Texas City Refinery, because there had been release from a very
similar blowdown drum in a different process unit. Narrator: OSHA cited the then Amoco Refinery
for the unsafe blowdown system. Holmstrom: OSHA determined that the
design of the blowdown drum was unsafe, because it did relieve to atmosphere;
it didn't relieve to a safe place. Narrator: But OSHA
later withdrew the citation, after Amoco asserted the equipment conformed
to American Petroleum Institute standards. Wright: In October, 2006, the Board issued a
recommendation to the American Petroleum Institute calling for new guidelines that weren't against the use
of blowdown drums similar to those found in Texas City. We also recommended that OSHA implement a
national emphasis program for all oil refineries focused on the hazards of blowdown drums
that release to the atmosphere. Whenever possible, companies should use inherently
safer systems, such as flares instead of blowdown drums. [Music] Narrator: The presence of occupied trailers
near the blowdown stack added to the hazards of venting
flammable material to the atmosphere. Holmstrom: Prior to the incident and
prior to the startup of the ISOM Unit, a number of trailers, occupied trailers,
had been placed close to the ISOM Unit. These trailers were occupied by workers who were not
involved in the turnaround activities in the ISOM Unit. Narrator: The investigation found this was a
key factor leading to the deaths of the workers. Kaszniak: They were right on top of the process, in
trailers close, as close as 120 feet from the blowdown, blowdown drum, which is right at
the edge of the isomerization process. Narrator: CSB investigator, Mark Kaszniak. Kaszniak: While it is not safe to have
trailers at that close to a blowdown drum or at the edge of an active
process in a petroleum refinery. During an explosion in a refinery, you're actually safer in the open atmosphere
than if you were working inside of a trailer. This is because the explosion overpressure
will destroy the weak trailer construction, resulting in the formation of missiles and walls collapsing,
which is potentially fatal to the occupants. Narrator: The CSB determined
that industry siting guidelines did not adequately protect trailer
occupants from the fire and blast damage that can occur hundreds of feet
from an explosion like the one at BP. Kaszniak: We found that these
guidelines were not safe enough prior to this accident and
resulted in placing people in harm's way. Narrator: In addition, BP did not follow
its own Management of Change procedures before placing most of the
trailers in a dangerous location. Kaszniak: They did not assess the blast
hazards close to the trailers and action items that were created during the review
were never followed up and corrected. Narrator: Ultimately the decision on where to place the
trailers was largely based on convenience, not safety. And contrary to BP startup procedures,
on the morning of March 23rd, managers did not remove
personnel from the nearby trailers or even alert them that the
potentially hazardous startup was taking place. The explosion totally destroyed 13 trailers and
damaged 27 others, some as far away as a thousand feet. People inside trailers as far
away as 479 feet were injured. Wright: In October, 2005, the CSB issued an urgent
recommendation to the American Petroleum Institute to revise industry standards and
establish minimum safe distances for occupied trailers away
from hazardous process areas. Narrator: On June 21st, 2007, the American
Petroleum Institute issued new industry guidelines to minimize the presence of people and
occupied trailers in hazardous process areas. [Music] Kletz: For a long time people were saying
that most accidents were due to human error. And this is true in a sense,
but it's not very helpful. It's a bit like saying
that falls are due to gravity. Narrator: There were a number of
human errors that contributed to the overfilling of the tower and the
disaster that followed at Texas City. Holmstrom: No one shows up to
work planning to make mistakes, so we looked at the conditions in the
workplace that would make error more likely. MacKenzie: You really need to look at
why the operators did what they did. Narrator: CSB Human Factor Specialist,
Cheryl MacKenzie. MacKenzie: There were a number of human
factors issues involved with this incident, including fatigue of
the workers, training, why it was insufficient and procedural
deviations that occurred during the startup. Narrator: The CSB investigation found
that underlying conditions in the ISOM Unit encouraged operators to consciously
deviate from written operating procedures. Hopkins: Why do they make that judgment? I think they did because these procedures were, some of
them were out-of-date, some of them were inapplicable. They were routinely not following as
procedures and nobody had said otherwise, nobody had said, hang on;
you must be following these procedures. Narrator: The investigation found
that operators were concerned that if they let the liquid level in the tower get too
low during startups, it would damage the furnace. So they had adopted an informal procedure of
adding extra liquid to the tower during startup. To do this, they placed the level control valve in manual,
not the automatic mode required by procedures and left the valve closed to raise the liquid
above the recommended six and a half foot level. So routine had this practice become, the CSB found that the tower's high-level alarm had
activated 65 times during the previous 19 startups. The outdated operating
procedures for the Unit did not establish any safe upper limit for
the liquid level in the tower. Unknown to operators, regularly
overfilling the tower had serious risks. The tower's liquid level transmitter
had a limited range and should the liquid rise above
the maximum reading of nine feet, operators could not know if the
tower was dangerously overfilling. Holmstrom: This informal practice of
running the level in the raffinate splitter tower above the range of the transmitter
led to running blind. Hopkins: They weren't aware of the
dangers of overfilling the column and so they tended to err on the side of what
they saw as caution, by overfilling the column. So their, their systematic deviation from what they
should have been doing was actually well-intentioned. It was with the interest of the company at heart that
they were, they were violating the startup procedures. Narrator: But on the day of the accident,
the routine deviation, overfilling the tower above the range of the
indicator coincided with a number of instrument failures, which impaired the board
operator's decision making. This had tragic results, as the board operator
lost awareness of just how high the level was. The tower level indicator
had been calibrated for years based on 1975 data for a different
liquid used in a different process. As a result of the miscalibration, the
indicator showed the level in the tower was declining, just prior to the explosion,
when it was actually increasing. And a backup high-level alarm
on the tower failed to activate, seeming to confirm that the
liquid level was dropping. A sight glass on the tower was dirty and unreadable
and could not be used to visually check the liquid level. The investigation
concluded that the board operator truly had no functional and accurate
measure of the tower level on March 23rd, 2005. And when the liquid finally did spill over into the
blowdown drum, the high-level alarm there failed to go off. Holmstrom: BP procedures
required that alarms and instruments and other equipment be checked for
their functionality prior to startup. The CSB determined that these
checks were largely not performed. Narrator: A poorly designed
computer display in the control room added to the difficulty of determining
if the splitter tower was overfilling. Liquid flows into and out of the
tower were not shown on the same screen, even though the computer could
have been configured to do so. The investigation also found
that communication problems among BP personnel during the morning of the
startup increased the likelihood of errors. Operators received contradictory instructions
on where to send the products from the tower. And the dayshift operators never got
clear information from the nightshift about how much liquid the
tower already contained. MacKenzie: Well, then the board operator and the
other operators that came in during the dayshift really didn't understand what
had occurred the night before, so they're starting up this unit without
full knowledge of the state of the unit and they're making judgments and
decisions based on incomplete information. Narrator: The investigation found
that BP lacked adequate policies and a management emphasis
on effective communications. Key instructions on sending the feed into the tower
were given over the phone and radio instead of in writing. Operators later told investigators these
verbal communications were rushed and vague. Written communications in the
logbook were brief and unclear. Nightshift operators
did not conduct a crucial face-to-face meeting to brief dayshift
operators on the conditions in the unit. MacKenzie: Therefore they didn't realize how
much liquid was in the tower and the equipment, so they added more, which led to the subsequent
overfilling of the tower, which later led to the release. Narrator: The opportunities
for human error were multiplied by the lack of adequate supervision,
staffing and training at the Refinery. Holmstrom: Training had been downsized and that
training was largely delivered through computerized means, rather than face-to-face training. Narrator: BP did not train operators
on the hazards of overfilling towers. And training for abnormal
situations was insufficient. Despite recommendations
dating back five years, simulators were not used to train board
operators on making critical decisions. As noted in an internal BP email about
simulators three weeks after the accident, big push back has
always been initial cost. Budget pressures also
impacted control room staffing. Holmstrom: BP implemented a
25 percent cost reduction in '99. During the same time period BP downsized the
board operators in the ISOM Unit from two to one. Later BP added an additional process unit to the
responsibilities of the board operator in the ISOM Unit. The result was that you had three complex refinery
units under the supervision of one board operator. Narrator: According to BP's own assessment,
even under normal conditions, monitoring and
controlling these three units would require ten and a half hours of
the board operator's twelve hour shift. But the startup of the ISOM Unit would demand
significantly more time and attention from the operator, whose workload was
already nearly full. And when the startup began to
encounter problems late that morning, supervisory oversight of
the board operator was absent. Holmstrom: BP's own policies required that a supervisor
or technically trained person be present during startup, because it's an especially hazardous period. The supervisor who showed up on March 23rd left due
to a family emergency and there was no replacement. Narrator: Finally, investigators
looked at the role operator fatigue played as a human factor
contributing to the accident. MacKenzie: Fatigue can
affect performance in many ways. It can cloud decision making, it can
delay responses to actions on a control board and it can lead an operator to miss
out on what's going on overall in a unit. Holmstrom: Fatigue can impair judgment, it can lead
an operator to fixate on one operational parameter, such as the declining level
and lose track of other factors, such as liquid being added to the tower
for three hours and no liquid being removed. Narrator: ISOM Unit operators had been working
twelve-hour shifts for at least 29 days prior to the accident. In particular the board operator
was likely suffering from fatigue, including acute sleep loss and
accumulative sleep debt of more than 43 hours. Holmstrom: We determined that BP
had no fatigue prevention policy. And in fact, there was no fatigue
prevention policy in the industry as a whole. Wright: Companies and employees may
believe they benefit from overtime schedules, particularly during maintenance turnarounds,
but operator fatigue can have deadly consequences. Our final report recommended that the United
Steelworkers and the American Petroleum Institute develop new guidance on preventing
fatigue in the petrochemical industry, including limits on
hours and days at work. [Music] Narrator: OSHA's 1992 standard on process
safety management or PSM requires thousands of oil and chemical facilities to implement fourteen
management elements to prevent catastrophic releases. The Environmental Protection Agency has similar
requirements under its Risk Management Program. The CSB investigation revealed many
longstanding deficiencies in the BP Refinery's compliance with federal process
safety regulations. Preventive maintenance and testing procedures were
inadequate for key alarms, instruments and equipment. Required safety studies of pressure
relief systems were years overdue. Operating procedures were
out-of-date and there were other flaws. Management of change reviews were not conducted for
critical design, equipment and procedural changes. Hazard analyses were poor,
overlooking serious fire and explosion risks. Audits revealed many process safety problems,
but they were never resolved. OSHA's enforcement program for the
PSM regulations requires planned, comprehensive inspections of facilitates with accident
histories or other indications of catastrophic risks. A 1992 OSHA directive stated
the primary enforcement tool would be the program quality verification
inspection or PQV, a large, complex audit involving high trained OSHA inspectors
and taking weeks or months to complete. Holmstrom: Despite the fact that the BP Texas City
Refinery had a long history of fatality incidents, there was no program quality verification or
intensive PSM inspection conducted at that refinery. Narrator: OSHA did conduct smaller, unplanned inspections of the Texas City Refinery
in response to accidents and complaints. But these inspections did not uncover major
flaws in process safety management compliance. In fact, the CSB found that OSHA conducted
only a handful of program quality verification, PQV inspections at the thousands of
regulated facilities across the country. Holmstrom: There's no set interval when OSHA
comes in and inspects a plant in the United States. We found that inspections in the U.S. are
largely driven by personal injury statistics. Narrator: The CSB also
found that prior to March, 2005 the EPA never audited the Texas City Refinery
for compliance with risk management requirements. Other jurisdictions inspect
process plants more frequently. In California's Contra Costa County a local
process safety ordinance requires thorough inspections of 48 major oil and chemical plants every
three years by a team of specialized engineers. In the United Kingdom,
105 specialists from the Health and Safety Executive inspect
high-hazard facilities every five years. In addition, all nine refineries
in the UK are inspected annually. Wright: If accepted process safety principles
had been thoroughly implemented at the refinery, this accident likely
would not have occurred. The CSB recommended that OSHA take steps
to conduct more process safety inspections and strengthen
enforcement of the PSM standard. OSHA should identify those
facilities at greatest risk, see that comprehensive
inspections are conducted at such facilities and to establish the
capacity to conduct those inspections, OSHA should create a group of
highly trained PSM inspectors. Narrator: On June 12th, 2007, OSHA
announced a new national emphasis program to inspect most U.S. oil refineries
for process safety compliance. [Music] Kaszniak: I participated in the Panel, because I lost a near and dear friend in this incident,
a personal friend of mine was killed in this incident. And I thought it was very important that, that the
management systems be looked at with a fresh set of eyes. Wright: Early in the investigation
of the Texas City accident, the CSB observed what appeared to
be a pattern of safety deficiencies. We therefore issued an urgent recommendation,
the first ever by this Agency that BP convene an independent panel of experts to study the
safety culture of its five North American refineries. Narrator: In October, 2005,
BP established an eleven-member panel that included leading industry,
labor and academic safety experts. It was headed by former Secretary of State,
James A. Baker III. Baker: The Panel found that BP did not ensure
as matter of best practices that its management implemented a comprehensive and
effective process safety management system. Narrator: The report, issued in 2007, concluded
there were instances of a lack of operating discipline, toleration of serious deviations
from safe operating practices and apparent complacency toward serious process
safety risks at each of BP's North American refineries. The Baker Panel also voiced concern that
other companies share similar problems. Baker: Ladies and gentlemen, we are under no
illusion that such deficiencies are in fact limited to BP. Kaszniak: One of the things that I'd like to see personally,
after having served on the Baker Panel, is that we will never have
another incident of this magnitude, the number of people that were killed,
the number of lives that were changed. So many good, hardworking people go to work
every day and too often some never return. I think the work that we did in the Baker Panel,
I believe that if this, if our work is applied within our industry,
we will not see another BP explosion. Narrator: The Baker Panel Report concluded that
the restructuring following BP's merger with Amoco had resulted in a significant loss of people,
expertise and experience in the refining sector. Only much later did BP recognize
the negative impact of these changes. The CSB's final report said
all hazardous chemical operations should be required to review the safety
impact of major organizational changes. Wright: The Board recommended that OSHA
amend its process safety management standard to require management of change reviews for
mergers, acquisitions, personnel reductions, budget cuts or other organizational changes
that can impact process safety. We also recommended that the
Center for Chemical Process Safety develop guidelines on how to perform
organizational management of change reviews. [Music] Kletz: The major problem with the chemical
industry and indeed, with other agencies, is the way accidents are investigated, reports are
written, circulated, read, filed away and then forgotten. And then ten years later, even in the
same company, the accident happens again. There's a saying that organizations
have no memory; only people have memory. Once they leave the plant, the accident
that occurred there is forgotten about. Hopkins: And what companies must
do in the petrochemical industry is realize that the fact that you've had 20
years without a catastrophic, catastrophic event is no guarantee that
there won't be one tomorrow. You have to keep your
eye on the ball constantly. Wright: All oil and chemical businesses
should seek to learn from the tragedy at BP. The CSB believes there are key
lessons to be drawn from our investigation. Narrator: The CSB said managers, executives
and Boards of Directors should do the following. Monitor process safety
performance using appropriate indicators. Invest sufficient
resources to correct problems. Maintain an open and trusting safety culture
where near-misses are reported and investigated. Ensure that non-essential personnel and work trailers
are located a safe distance from hazardous process areas. Ensure equipment and procedures
are maintained and up-to-date. Carefully manage organizational changes and
budget decisions to ensure safety is not compromised. Analyze and correct the underlying causes of
human errors, including fatigue and miscommunication. Finally, Boards of Directors must exercise their duty
to ensure that the highest standards of safety are met. Wright: The BP tragedy was years in the making,
but it was by no means inevitable. We hope our investigation will provide
all of industry with valuable lessons to assure such a tragedy
will not be repeated. Narrator: For the CSB's final report,
key investigation documents, the Baker Panel Report and other information, please
visit the Chemical Safety Board website at CSB.gov. BP cooperated with the CSB investigation and
provided documents and witnesses voluntarily. After the Texas City accident,
BP acted to relocate trailers, eliminate blowdown drums and invest billions of
dollars to upgrade the condition of its U.S. refineries. In 2007, BP accepted the
recommendations of the Baker Panel, including a call to become "a recognized
industry leader in process safety management." [Music]
I’m glad they finally corrected the animation - the original indicated that the high level alarm was redundant, when it was really just an indicator that the level was beyond what the float level measurement could measure. This is critical later when the liquid starts to boil, and the float level indicates a falling level when it is actually rising.
"If you think safety is expensive, try an accident"
...but the way corporate officers are incentivized, less profit this quarter/year (because you spent money addressing problems that might happen years from now) just shows up as "poor performance" as far as shareholders are concerned.
The way the system is set up, it selects for someone who plays as close to the edge as possible without going over. When luck doesn't favor them, and there's a major accident involving lots of deaths, investigations inevitably find that they'd been inviting disaster for years, and that it was only a matter of time.
I’ve worked in the this refinery and to this day I get a strange feeling going through that area. Other guys have said the same thing. Now it’s owned by Marathon but they went way overboard with safety after this accident. Basically it took months to get a work permit at times and they wouldn’t allow us to work on equipment live. Part of troubleshooting electrical issues requires power to be on. On another note, I was at the DuPont LaPorte plant in November 2014 when they had a massive release that killed 4 operators. It was really sad because we knew all of the operators that were killed. They closed that unit permanently and the entire site has actually been completely decommissioned and torn down. It was originally built during WWII. It’s crazy how old most of these refineries and chemical plants are and the fact that they have some of their original process equipment.