On March 23, 2005, at 1:20 p.m., the BP Texas City Refinery suffered explosions and fires that killed 15 people, 180 injured and resulted in financial losses exceeding $1.5 billion. The incident occurred during the startup of an isomerization (ISOM) unit when a raffinate splitter tower was overfilled; pressure relief devices opened, resulting in a flammable liquid discharge from a blowdown stack that was not equipped with a flare. The release of flammables led to an explosion and fire.
The BP refinery in Texas City, 30 miles southeast of Houston, can produce about 10 million gallons of gasoline per day (about 2.5 percent of the gasoline sold in the United States) for markets primarily in the Southeast, Midwest, and along the East Coast. It also produces jet fuels, diesel fuels, and chemical feed stocks; 29 oil refining units and four chemical units cover its 1,200-acre site. The refinery employs approximately 1,800 BP workers, and at the time of the incident, approximately 800 contractor workers were onsite supporting turnaround13 work.
BP Texas Refinery Accident Description
- At 02:05 am on 23 March 2005, a light naphtha isomerisation (ISOM) unit was restarted after being down for maintenance. During the start-up, the raffinate level was only determined using the Raffinate splitter tower’s torque tube displacer type level transmitter, which was not calibrated for the specific gravity of the fluid. The tower height was 52 m.
- The operator stopped the filling process after the transmitter indicated a level of 2.7m, when the true level was 4m. The high-level alarm of the tower (2.3m) was ignored. Additionally, the secondary high-level alarm (2.4m) was faulty, which was not known to the operators. The restart was stopped as the heavy raffinate product tanks were full.
- The day supervisor, who arrived late and missed the briefing, gave the instruction to resume the start-up. The feed was resumed into the tower and the recirculation pumps were restarted. However, due to miscommunication between operators heavy raffinate outlet was left closed. As a non-continuous restart was abnormal, the day board operator had to rely heavily on the experienced supervisor.
- Furnaces used to heat the fresh and recirculated feed into the tower were lit as per procedure. Shortly after this, the supervisor left the plant due to a family emergency without assigning a replacement, which was a deviation from protocol. This left the board operator alone to oversee the restart of the ISOM unit and monitor other units.
- By this point, the raffinate level reached 20 m in the tower. At 11:56 am, fuel to the burners was increased further and the raffinate level reached 30m. This was fifteen times the normal level, though the level transmitter indicated a safe level of 2.64m and decreasing.
- It was not until 1:16 pm that the level control valve at receiver was fully open, however the level kept tower was filled for over three hours without any liquid being removed.
- At that point, the level in the tower reached 48 m triggering liquid flow into the vapour line. As the pipe filled with liquid, the pressure at the bottom rose rapidly from about 21 pounds per square inch (psi) to about 64 psi. The three pressure relief valves opened for six minutes, discharging a large quantity of flammable liquid to a blowdown drum with a vent stack (34 m tall) open to the atmosphere.
- 195,600 litres of flammable fluid entered the blowdown drum, quickly overfilling and discharging to the atmosphere. The discharged fluid quickly formed a flammable vapour cloud, which was ignited by the backfiring of a nearby diesel truck. The resulting explosion killed 15 and injured 180 people, 12 of whom were in a trailer 37m from the blowdown drum.
Key Findings from BP Texas Refinery Explosion
- The ISOM startup procedure required that the level control valve on the raffinate splitter tower be used to send liquid from the tower to storage. However, this valve was closed by an operator and the tower was filled for over three hours without any liquid being removed. This led to flooding of the tower and high pressure, which activated relief valves that discharged flammable liquid to the blowdown system.
- The tower level indicator showed that the tower level was declining when it was actually overfilling. The redundant high level alarm did not activate, and the tower was not equipped with any other level indications or automatic safety devices.
- The control board display did not provide adequate information on the imbalance of flows in and out of the tower to alert the operators to the dangerously high level.
- A lack of supervisory oversight and technically trained personnel during the startup,an especially hazardous period, was an omission contrary to BP safety guidelines. An extra board operator was not assigned to assist, despite a staffing assessment that recommended an additional board operator for all ISOM startups.
- Supervisors and operators poorly communicated critical information regarding the startup during the shift turnover; BP did not have a shift turnover communication requirement for its operations staff.
- ISOM operators were likely fatigued from working 12-hour shifts for 29 or more consecutive days.
- The operator training program was inadequate. The central training department staff had been reduced from 28 to eight, and simulators were unavailable for operators to practice handling abnormal situations, including infrequent and high-hazard operations such as startups and unit upsets.
- Outdated and ineffective procedures did not address recurring operational problems during startup, leading operators to believe that procedures could be altered or did not have to be followed during the startup process.
- The unit was started despite previously reported malfunctions of the tower level indicator, level sight glass, and pressure control valve.
- The size of the blowdown drum was insufficient to contain the liquid sent to it by the pressure relief valves. The blowdown drum overfilled and the stack vented flammable liquid into the atmosphere, which fell to the ground and formed a vapour cloud that ignited.
- Neither Amoco nor BP replaced blowdown drums and atmospheric stacks, even though a series of incidents warned that this equipment was unsafe.
- Occupied trailers were sited too close to a process unit handling highly hazardous materials. All fatalities occurred in or around the trailers. The trailer was not considered before the startup of the unit.
- In the years prior to the incident, eight serious releases of flammable material from the ISOM blowdown stack had occurred, and most ISOM startups experienced high liquid levels in the splitter tower. Neither Amoco nor BP investigated these events.
- BP Texas City managers did not effectively implement their pre-startup safety review policy to ensure that nonessential personnel were removed from areas in and around process units during startup, an especially hazardous time in operations.
