Anatomy of a Tragedy

Time after time, those of us in the safety community read about workplace injuries and fatalities that were completely preventable. “Had Company X just followed basic workplace safety requirements,” the investigating agency often concludes, “this accident never would have happened.”

Tragically, the March 23, 2005, explosion and fire at BP’s Texas City, Texas, refinery – which took the lives of 15 workers, sparked the largest investigation in Chemical Safety and Hazard Investigation Board (CSB) history and created a public relations nightmare for London-based BP PLC – was just such an accident.

With the release of CSB’s final investigation report on the root causes of the BP refinery tragedy, as well as with the previous releases of the independent Baker panel report and BP’s own investigation report, the safety community now has unprecedented insight into the decisions and actions that precipitated the worst U.S. industrial accident since 1990.

The body of evidence and information available to the safety community – and to the public – is the anatomy of a workplace tragedy that never should have happened. It is the anatomy of a tragedy that, in the words of CSB Chairwoman Carolyn Merritt, was “the inevitable result of a series of actions” by BP.

Technical Cause Not in Dispute

By now, there’s little dispute over what happened in the hours leading up to the accident. During a startup of the refinery’s isomerization unit, operators pumped flammable liquid hydrocarbon into the raffinate splitter tower without allowing any liquid to drain from the bottom of the tower into storage tanks – which was contrary to startup procedures.

The liquid overflowed into piping off the top of the tower, triggering emergency relief valves to open. The emergency valves channeled liquid hydrocarbon into the blowdown drum at the other end of the isomerization unit.

In the 6 minutes that the emergency relief valves were open, CSB estimates that 51,900 gallons of flammable liquid flowed from the raffinate splitter to the blowdown drum.

The drum filled completely, and, consequently, liquid hydrocarbon spewed from the 113-foot tall blowdown stack like a geyser. Although the eruption only lasted about 1 minute, CSB estimates that the blowdown stack released 7,600 gallons into the atmosphere.

The volatile liquid hydrocarbon evaporated as it fell to the ground and created a large flammable vapor cloud, which spread quickly throughout the area. At 1:20 p.m. on March 23, 2005, the cloud ignited, likely after coming into contact with an idling diesel pickup truck parked about 25 feet from the blowdown drum.

According to BP’s modeling and other calculations, the ignition of the vapor cloud created a fireball with a diameter as large as 236 feet. BP estimates that the fireball lasted 6 seconds.

Extensive Destruction

CSB and BP agree that the 15 contract employees killed in the explosion were working in or near mobile trailers located too close to the blowdown drum. Many of the injured also were in or near these trailers, which were used for supporting turnaround work on the nearby ultracracker unit.

The explosion caused heavy damage within the isomerization unit, severely damaging the satellite control room and destroying the catalyst warehouse. The blast damaged or destroyed a number of vehicles and mobile trailers near the isomerization unit.

The explosion also damaged more than 50 large chemical storage tanks – many located more than 250 feet away – and broke windows, cracked masonry walls and damaged doors in surrounding units of the refinery.

Off site, the blast shattered windows in homes and businesses up to three-fourths of a mile away from the isomerization unit.

One Key Mistake?

While BP’s final investigation report admits that there was a complex set of “underlying reasons for the behaviors and actions during the incident,” the report clearly emphasizes that workers and supervisors caused the accident by deviating from procedures. The BP investigation team asserts that one key mistake “was instrumental in leading to the incident.”

That mistake was the failure of BP personnel – both the night shift on March 22 and the day shift on March 23 – “to establish heavy raffinate rundown to tankage, while continuing to feed and heat the tower.”

During the day shift, BP operators pumped 20,000 bpd (barrels per day) of liquid hydrocarbon into the already-full raffinate splitter tower for approximately 3 hours without any egress. When they finally did begin to send liquid out of the tower to storage tanks – just minutes before the accident – it was too little, too late.

“If a heavy raffinate rundown flow had been started as soon as the feed was re-established, the incident would not have occurred,” the BP investigation team wrote. “The absence of supervisory presence on the unit probably contributed to the failure to establish rundown.”

Underscoring BP’s emphasis that workers shoulder much of the responsibility for the accident, the Houston Chronicle reported that BP, in the wake of the 2005 accident, fired six Texas City workers. BP spokesman Neil Chapman would not comment specifically on the firings but acknowledged that the company “took disciplinary action against both supervisory and hourly personnel.”

“The actions did range from dismissals to warnings, and really that’s all we can say about personnel matters,” Chapman told OCCUPATIONAL HAZARDS.

Problems “At All Levels”

The BP report acknowledges that Texas City had a broken safety culture. However, the report traces the roots of Texas City’s safety dysfunctions – which ranged from poor hazard awareness to high risk tolerance (regarding the latter, BP’s investigation team observed that Texas City workers believed that “fires were a fact of life in the refinery”) – only as far up as Texas City management.

In contrast, CSB emphasizes that the accident “was caused by organizational and safety deficiencies at all levels of the BP corporation,” and that many of those deficiencies can be traced back to decisions made by BP executives in London.

“The BP chief executive [Lord John Browne] and the BP Board of Directors did not exercise effective safety oversight,” the CSB report states. “Decisions to cut budgets were made at the highest levels of the BP Group despite serious safety deficiencies at Texas City.”

Noting that the Columbia Accident Investigation Board concluded that NASA’s organizational culture and structure had as much to do with the 2003 space shuttle Columbia disaster as the immediate cause did, CSB points out that its investigation of the Texas City accident was conducted from a similar perspective.

“Simply targeting the mistakes of BP’s operators and supervisors misses the underlying and significant cultural, human factors, and organizational causes of the disaster that have a greater preventative impact,” CSB’s report says.

It Started at the Top

After BP and Amoco merged in 1999, CEO Lord John Browne mandated a 25 percent across-the-budget cut in fixed spending at the corporation’s refineries, “even though,” CSB points out, “much of the [Texas City] refinery’s infrastructure and process equipment were in disrepair.” In late 2004, BP refinery executives issued a 25 percent budget reduction “challenge” for 2005.

Budget cuts thinned Texas City’s operator ranks, reduced the refinery’s training budget, downsized the training staff and impaired mechanical integrity. According to CSB, cost considerations scuttled attempts to replace the blowdown drum – which was installed in the 1950s and, the BP report admits, was not intended “for emergency use during, for example, a relief event.”

Ultimately, CSB concludes that “cost cutting and failure to invest in the 1990s by Amoco and then BP left the Texas City refinery vulnerable to a catastrophe.”

Meanwhile, BP executives’ fixation on injury rates – which were improving – gave them a false sense of security regarding the conditions at the refinery.

“BP Group executives used personal safety metrics to drive safety performance,” the CSB report says. This over-emphasis on personal safety “helped mask severe shortcomings in process safety.”
Even so, CSB asserts that top executives “received numerous warning signals about a possible major catastrophe at Texas City.”

“Numerous surveys, studies and audits identified deep-seated safety problems at Texas City,” CSB says in its report. During the March 20 unveiling of CSB’s final report, CSB lead investigator Don Holmstrom told reporters: “These audits and studies were shared with BP executives in London and were provided to at least one member of the executive board.”

Holmstrom acknowledged that BP officials tried to improve the conditions at Texas City from 2002 to 2005, but their efforts were focused on personal safety goals such as preventing slips, trips and falls “rather than than on the big picture: improving process safety performance, which continued to deteriorate.”

If BP executives had wanted to put their finger on the pulse of the safety risks at Texas City, they needed to look no further than history: In the 30 years prior to the 2005 disaster, there were 23 worker deaths at the refinery – three of them in 2004.

Damning Documents

BP disputes CSB’s assertion that “[b]udget cuts and production pressures seriously impacted safe operations at Texas City.”

Chapman pointed to page 143 of BP’s report, which states that the Texas City budget for capital expenditures averaged less than $50 million per year from 1996 to 2000 but increased to an average of $125 million per year from 2001 to 2004, “primarily for investment in clean fuels and other environmental projects.” According to the BP report, fixed cash costs increased in 2004 and spending on maintenance turnarounds increased from 2001 through 2004.

“So when looking at this incident, budget did not appear to play a role,” Chapman told Occupational Hazards.
CSB, however, determined just the opposite. While Holmstrom acknowledged that BP had increased its maintenance spending at Texas City in recent years before the accident, he said that “we found the increases were largely spent complying with environmental requirements and responding to repair major accidents and outages.”

And when CSB unveiled its final report, it also released about 20 damning internal BP documents that corroborate the agency’s assertion that budget cuts played a role in the Texas City disaster. These documents offer a rare inside glimpse of a workplace where, in hindsight, a serious accident was just waiting to happen.

A 1999 e-mail from Texas City management explained that Browne’s top goals for the company included reducing the days-away-from-work rate, reducing CO2 emissions and “reduc[ing] business unit cash costs for the year 2001 by at least 25 percent from 1998 levels.” The e-mail did not mention process safety management.

The e-mail added that Texas City’s strategy to meet Browne’s cost reduction goal was to “continuously and aggressively drive costs out of the system at an accelerated pace relative to other refiners.”

“Items cut included turnarounds; safety committee meetings; the central training organization; fire drills; maintenance, engineering, supervision and inspection staff; plant maintenance; and training courses,” the CSB report explains. “Safety and maintenance expenditures were a significant portion of the cuts.”

In 2004, researchers from the consulting firm Telos Group surveyed 1,080 employees and interviewed 112 as part of a safety culture assessment of the refinery. In a confidential executive summary dated Jan. 21, 2005, the consulting firm points to the connection between budget and production pressures and safety problems at Texas City.

“Most interviewees at the production level say that the pressure for production, time pressure and understaffing are the major causes of accidents at Texas City,” the executive summary states. “They say all of these have gotten steadily worse in recent years and that cuts have gone beyond what is safe in many cases.

“ ... Most interviewees say that production and budget compliance gets recognized and rewarded before anything else at Texas City.”

The Telos Group concludes: “There is an exceptional degree of fear of catastrophic incidents at Texas City.”
Another red flag appeared in the 2005 EHS business plan for the refinery. The document prophetically stated that the key risks for 2005 included the possibility that the Texas City refinery “kills someone in the next 12 to 18 months.”

“Ripe for Human Error”

While BP asserts that a failure to follow procedures caused the Texas City tragedy, CSB contends that “safety system deficiencies created a workplace ripe for human error to occur.”

Due much in part to production pressures, a crumbling infrastructure and budget cuts, “numerous latent conditions and safety system deficiencies at the refinery influenced [operators’] actions and contributed to the accident.”

According to the CSB report, the work environment at Texas City encouraged BP employees to deviate from procedures. Consequently, the agency believes that the deviations on March 23, 2005, “were not unique actions committed by an incompetent crew” but instead were actions that “operators, as a result of established work practices, frequently took to protect unit equipment and complete the startup in a timely and efficient manner.”

“Indeed, several procedural deviations made by the operations crew on March 23, 2005, were common practices in 18 previous raffinate splitter tower startups,” the CSB report says.

The unit’s malfunctioning instrumentation kept personnel in the dark regarding the volatile situation brewing in the raffinate splitter tower. CSB points to a level transmitter that indicated that the liquid level in the tower was gradually declining when it actually was rising; a redundant high-level alarm that failed to activate; and the tower-level sight glass, which “could have provided a visual verification of the actual tower level” had it not been “dirty and unreadable.” The report adds that the sight glass “had been nonfunctional for years.”

“When instrumentation provides false or misleading information,” CSB says, “accidents are likely.”

BP’s lack of a fatigue prevention policy was another underlying latent condition. BP admits that some employees in the isomerization unit, prior to the accident, had worked up to 30 days of consecutive 12-hour shifts. The company, however, says it cannot “directly attribute actions or inactions of the operators and supervisors to fatigue.”
CSB disagrees. The agency asserts that BP personnel involved in the accident demonstrated telltale signs of fatigue.

“The board operator, as well as the outside operators, did not recognize that feed was entering the tower but not being removed from the unit for 3 hours, that the tower was overfilling or that the consequences of the tower flooding might be catastrophic,” the CSB report states.

“ ... It is common for a person experiencing fatigue to be more rigid in thinking, have greater difficulty responding to changing or abnormal circumstances and take longer to reason correctly.”

Other underlying latent conditions, according to CSB, included:

• A poorly designed computerized control system that hampered the ability of operations personnel to determine if the tower was overfilling.
  
• Insufficient staffing to handle board operator workload during the high-risk time of startup.
  
• Inadequate operator training for abnormal and startup conditions. From 1998 to 2004, BP Texas City’s training budget had been cut from $2.8 million to $1.4 million and the training staff had been reduced from 28 people to eight people.
  
• Lack of a BP policy on effective communication for shift change and hazardous operations such as unit startups.
  
• Concludes the CSB report: “The broader aspects of this investigation revealed serious management safety system deficiencies that allowed the operators and supervisors to fail.”
  

“A Very Different Company”

Despite voicing “strong disagreement” with some of CSB’s conclusions, BP clearly has been chastened by the Texas City accident.

The company said it expects to invest more than $1 billion over the next several years to improve safety processes and equipment at Texas City. According to BP, the changes it has made or is making encompass “600 recommendations and 1,000 specific actions based on findings from BP’s internal accident investigation team, OSHA and other external organizations.”

According to BP, those changes include:

• Leadership development and other training programs that will involve a projected 300,000 training hours each year.
  
• Isolating or removing all blowdown stacks and installing a new flare system.
  
• Removing more than 200 temporary structures from the site.
  
• Introducing a sitewide transit system to reduce the number of vehicles allowed within the refinery.
  
• Initiating a stop-work program for startups.
  
• Requiring supervisors to be present for all startups, shutdowns and other critical operations and requiring written shift handovers with supervisors present.
  
• Appointing former U.S. District Judge Stanley Sporkin as an “ombudsman” to investigate employee safety concerns.
  

Demonstrating BP’s desire to repair the refinery’s safety culture, Chapman noted that Texas City Refinery Manager Keith Casey visits with employees before every unit startup, looks them in the eye and asks them, ‘Is it safe to start this unit up?’”

“People have raised issues at that point and seen action being taken,” Chapman said. “And that speaks powerfully.”
As for CSB’s most recent batch of recommendations (see sidebar for a list) Chapman said that BP is reviewing the CSB final report “and seeing how we can integrate their recommendations into the actions that are already being taken.”

CSB’s Merritt expressed confidence that BP will “address all of the issues that have been identified in our report as well as in their own internal investigation.” Merritt added: “BP is going to be a very different company as a result of this investigation and as a result of this incident.”

Chapman agreed.

“It’s echoed from our senior management all the way down to almost everybody you meet throughout the company: This is an event that has changed the company, and the commitment to safety has been reinvigorated,” Chapman said. “People were absolutely shocked by what happened. They were shaken by what happened. Fifteen people lost their lives, and our company has changed forever. Inside the company you can see it, because the reinvigoration and the focus on safety is so strong.”