- Buyer's Guide
In a 335-page
final report released on March 20, federal investigators from the U.S. Chemical
Safety Board (CSB) conclude that "organizational and safety deficiencies at all
levels of the BP Corporation" caused the March 23, 2005, explosion at the BP
Texas City refinery, the worst industrial accident in the United States since
1990. The report calls on the U.S. Occupational Safety and Health Administration
(OSHA) to increase inspection and enforcement at
CSB chairman Carolyn W. Merritt said, "It is my sincere hope and belief that our report and the recent Baker report will establish a new standard of care for corporate boards of directors and CEOs throughout the world. Process safety programs to protect the lives of workers and the public deserve the same level of attention, investment, and scrutiny as companies now dedicate to maintaining their financial controls. The boards of directors of oil and chemical companies should examine every detail of their process safety programs to ensure that no other terrible tragedy like the one at BP occurs."
The CSB report calls on BP to appoint an additional member of the board of directors with expertise in process safety, and calls for BP senior executives to establish an improved incident reporting program and use new indicators to measure safety performance.
independent Baker panel, formed and funded by BP in response to an urgent CSB
safety recommendation, issued its final report in January 2007. It found
"material deficiencies" in the safety of BP's five
Merritt said, "Our investigation of BP was the largest and most complex undertaking in the agency's nine-year history. Under the leadership of supervisory investigator Don Holmstrom, the team interviewed 370 witnesses, reviewed more than 30,000 documents, and conducted a far-reaching program of equipment, instrumentation, and chemical testing." The final report is scheduled to be presented at a CSB public meeting beginning at 6 p.m. tonight at the
BP cooperated with the investigation, furnished documents and interviews on a voluntary basis, and committed to widespread safety improvements and investments following the accident. BP published its own report on the explosion in December 2005, pledged the total elimination of the kind of unsafe disposal equipment that led to the explosion, and developed a new siting policy to remove trailers from hazardous process areas. All 15 fatalities occurred in or near trailers that were sited as close as 121 feet from a blowdown drum that vented flammable liquid and vapor directly to the atmosphere.
Safety Harmed by
Cost-Cutting, Production Pressures and Failure to Invest
BP acquired the
"The combination of cost-cutting, production pressures, and failure to invest
caused a progressive deterioration of safety at the refinery. Beginning in 2002,
BP commissioned a series of audits and studies that revealed serious safety
problems at the
Blast Modeling Shows
Vulnerability of Temporary Trailers
The March 23 accident occurred during the startup of the refinery's octane-boosting isomerization (ISOM) unit, when a distillation tower and attached blowdown drum were overfilled with highly flammable liquid hydrocarbons. Because the blowdown drum vented directly to the atmosphere, there was a geyser-like release of highly flammable liquid and vapor onto the grounds of the refinery. A diesel pickup truck that was idling nearby ignited the vapor, initiating a series of explosions and fires that swept through the unit and the surrounding area. Fatalities and injuries occurred in and around occupied work trailers, which were placed too close to the ISOM unit and which were not evacuated prior to the startup.
CSB investigator Mark Kaszniak, who led the CSB's vapor and blast modeling effort, stated, "The CSB was able to calculate that approximately 7,600 gallons of flammable liquid hydrocarbons – nearly the equivalent of a full tanker truck of gasoline – were release from the top of the blowdown drum stack in just under two minutes." The ejected liquid rapidly vaporized due to evaporation, wind dispersion, and contact with the surface of nearby equipment. High overpressures from the resulting vapor cloud explosion totally destroyed 13 trailers and damaged 27 others. People inside trailers were injured as far as 479 feet away from the blowdown drum, and trailers nearly 1,000 feet away sustained damage.
"Industry trailer siting guidelines did not predict the level of trailer damage that we actually saw," Kaszniak stated.
In October 2005, the CSB issued an urgent recommendation to the American Petroleum Institute to develop new guidance to prevent trailers from being sited near hazardous areas of refineries and chemical plants, where occupants could be injured or killed.
"A human being is more likely to be injured or killed inside a trailer – which can shatter during an explosion – than if he is standing in the open air. For that reason, occupied trailers have no place near hazardous process areas of refineries and chemical plants," Kaszniak said.
Analysis: Fatigue, Other Conditions Made Errors More Likely
The tower overfilled because a valve allowing liquid to drain from the bottom of the tower into storage tanks was left closed for over three hours during the startup on the morning of March 23, which was contrary to unit startup procedures. The CSB investigative team examined various conditions and human factors that led to this error.
"BP relied on operators taking correct and timely actions and following procedures to prevent excessive liquid levels in the tower. While procedures are essential to any process safety program, they are the least reliable safeguard to prevent process accidents," Kaszniak said. "Modern control systems utilize automatic safety controls to shut down liquid flow to a tower and prevent dangerous overfilling."
a definition by
In particular, the investigation found that procedural deviations, abnormally high liquid levels and pressures, and dramatic swings in tower liquid level were the norm in almost all previous startups of the unit since 2000. Operators typically started up the unit with a high liquid level inside and left the drain valve in manual – not automatic – mode to prevent possible loss of liquid flow and resulting damage to a furnace that was connected to the tower. These procedural deviations – together with the faulty condition of valves, gauges and instruments on the tower – made the tower susceptible to overfilling, investigators said.
None of the
previous abnormal startups was investigated by BP, nor were operating procedures
updated to reduce the likelihood or consequences of flooding the tower. As
American Petroleum Institute safety guidance notes, when operating procedures
are not updated or correct, "workers will create their own unofficial procedures
that may not adequately address safety issues." At the
On March 23, the control board operator's decision to keep the drain valve closed was influenced by ineffective communication and by false instrument readings from the tower. Alarms and gauges that should have warned of the overfilling equipment failed to operate properly. In addition, the operator believed he had been instructed not to send any liquid from the bottom of the tower to storage tanks, and the CSB determined that these storage tanks were in fact noted as nearly full.
"BP had no policy for effective shift communication or requirements for shift turnover," MacKenzie said. "This important instruction to the operator was given over the phone and was not contained in the log book or the startup procedure."
Although a high tower liquid level alarm did activate in the control room in the early morning hours, a second high-level alarm malfunctioned and the faulty tower level transmitter later indicated that the liquid level was below nine feet and falling. The normal liquid level in the tower was six-and-a-half feet. Unknown to operators, the level was actually rising rapidly, reaching 158 feet by 1 p.m. on March 23, 20 minutes before the explosion. The CSB determined that the level transmitter was miscalibrated, using a setting from outdated data sheets that likely had not been updated since 1975.
The tower lacked basic process indicators, such as a bottom pressure indicator, that could have provided operators with an accurate picture of the high level inside the tower. The control panel also did not display the flows in and out of the tower on the same screen, and did not automatically calculate how much total liquid was in the tower, even though it could have been configured to do so.
The CSB team used an NTSB methodology to conclude that ISOM unit operators were likely fatigued when the startup occurred. By March 23, operators had been working 12-hour shifts for 29 or more consecutive days.
"Fatigue causes cognitive fixation and impaired judgment and could lead operators to fixate on one operational parameter – such as the apparently declining liquid level – to the exclusion of other indicators," MacKenzie said.
Fatigue has been recognized as a cause of major accidents in the transportation sector. Fatigue prevention regulations have been developed for aviation and other transportation sectors, but there are no fatigue prevention guidelines that are widely used and accepted in the oil and chemical sector.
The report recommends that the American Petroleum Institute, a leading trade organization, and the United Steelworkers International Union (USW), the largest union representing refinery workers, work together to develop a new consensus standard for fatigue prevention in the oil and chemical industry.
The investigative team also pointed to a significant downsizing that occurred in operations and training at the refinery. Following BP's global 25 percent cut to fixed costs in 1999, the Texas City Refinery halved the number of control board operators in the ISOM area, from two to one. Then in 2003, the sole remaining operator was given a third process unit to control. Each refinery unit is a complex network of equipment, piping, valves, and instruments. The ISOM unit itself, one of the smaller units of the refinery, was the size of a city block and contained four major subunits. A 2003 BP hazard review recommended that a second operator be present during startups, but this recommendation was never implemented. The 25 percent budget cut from 1999 also resulted in significant training reductions for operators, and cost pressures prevented the refinery from using simulators to train operators for handling abnormal situations and process upsets.
Longstanding Process Safety Deficiencies
Like other refineries and chemical plants that handle highly flammable, toxic, or hazardous substances, the Texas City Refinery is regulated under the Process Safety Management (PSM) standard of the U.S. Occupational Safety and Health Administration (OSHA). The standard was promulgated in 1992 as a result of provisions in the 1990 Clean Air Act, which responded to major chemical accidents in the
Investigator Mark Kaszniak stated, "If the Process Safety Management standard had been thoroughly implemented at the refinery, as required by federal regulations, this accident likely would not have occurred."
that numerous requirements of the standard were not being followed in
OSHA rules require internal investigations and corrective actions for any serious process incidents or near-misses. But the CSB found that the refinery only investigated three of the eight known previous ISOM blowdown release incidents, where flammable and potentially explosive vapor was released from the same blowdown drum involved in the March 23 accident. In 2004, an internal BP audit graded the refinery's analysis of incident information as "poor."
The CSB also determined that both the blowdown drum and the relief valve disposal piping were undersized, which led to the blowdown drum overflowing with liquid. Under the PSM standard, BP was required to conduct a study of the tower's pressure relief system to ensure its safety. Despite the federal requirement, BP was not able to produce any documents indicating the study had even been done.
"By 2005, the required relief valve study was 13 years overdue," Kaszniak said. "Without the study, there was no assurance that the equipment could handle all the credible relief scenarios, including the one that actually occurred on March 23." The report noted that an internal BP audit from 2004 found that design calculations did not exist for many relief valves at the refinery and that the problem had existed for nearly 10 years.
2006, the CSB issued recommendations to OSHA and API aimed at eliminating
similar atmospheric blowdown systems from
The investigative team also noted a number of problems with the facility's preventative maintenance program that were causally related to the March 23 accident. The report concluded that BP supervisory personnel were aware of the equipment problems with the level transmitter before the March 23 startup but still had signed off on equipment checks as if they had been done, which the report said reflected the prevalence of production pressures at the refinery.
In addition, there was no documented test method for the blowdown drum high-level alarm, which failed to sound on March 23, and the testing method in actual use was contrary to the manufacturer's recommendations. The refinery's computerized maintenance management system allowed maintenance work orders to be closed even if no repair had been done. Many action items from previous hazard analyses and incident investigations – such as a 1994 action item to review the adequacy of the ISOM blowdown system following two serious incidents that year – were never completed.
Culture Existed at All Levels of BP
For the first time in its nine-year history, the CSB conducted an examination of corporate safety culture.
"As the science of major accident investigations has matured, analysis has gone beyond technical and system deficiencies to include an examination of organizational culture," supervisory investigator Don Holmstrom said. "Effective organizational practices such as encouraging the reporting of incidents and allocating adequate resources for safe operation, are required to make safety systems work successfully."
Holmstrom pointed to the unusual history of fatal incidents at the Texas City Refinery. Over a 30-year period spanning Amoco and BP's ownership, 23 workers died at the facility – not counting the 15 workers killed in March 2005.
"Many of the
safety issues that led to the March 2005 accident were recurring safety problems
that had been previously identified in internal audits, reports, and
investigations. Our findings show that both BP Group executives and
also cited a series of three serious incidents at the BP refinery in
stated that in each year from 2002 to 2005, BP made its own significant findings
about the culture and safety of the
Similar findings were made in 2003, when a study of maintenance found that "cost-cutting measures have intervened with the group's work to get things right - usually reliability improvements are cut." An external BP safety audit found inadequate training, a large number of overdue action items, and a concern about "insufficient resources to achieve all commitments." The report stated that "the condition of the infrastructure and assets is poor."
The year 2004
was marked by three major accidents at the refinery, including a $30 million
process fire and two other accidents that caused three deaths. Meanwhile, an
analysis conducted by BP's internal audit group in
"In 2004, BP documents do show that maintenance spending increased, but we found that the increases were largely due to complying with environmental requirements and responding to major accidents and outages. There was still not an adequate focus on preventative maintenance before accidents occurred," Holmstrom said. The investigation found that BP's executives relied unduly on injury statistics in assessing the safety of their facilities.
He added, "BP managers and executives attempted to make improvements from 2002 to 2005 but they were largely focused on personal safety – such as slips, trips, falls, and vehicle accidents – rather than on improving process safety performance, which continued to deteriorate."
The report calls on API and the USW to develop a new consensus standard defining performance indicators for process safety. The consensus process should draw on representatives from industry, labor, government, public interest, and environmental organizations.
2004, a safety culture survey of the refinery was conducted and endorsed by the
site leadership. The study, known as the Telos report, pointed to "an
exceptional degree of fear of catastrophic incidents" among other conclusions,
and it stated respondents' belief that "production and budget compliance gets
... rewarded before anything else." Finally, a safety business plan for 2005
cited as a "key risk" the possibility that "
"The investigation found that BP executives made spending cuts without assessing the safety impact of those decisions," Holmstrom said.
The report recommends that OSHA amend its Process Safety Management standard to require companies to perform a management-of-change safety review on organizational changes – including mergers, acquisitions, reorganizations, personnel changes, policy changes and budget reductions. The CSB report cited previous good-practice guidance from the American Chemistry Council, then known as the Chemical Manufacturers Association, calling for such safety reviews. The report also included a new recommendation to the Center for Chemical Process Safety to develop guidelines for how to conduct the organizational management-of-change reviews envisioned in the recommendation to OSHA.
OSHA Should Increase
Petrochemical Inspections, Enforcement
As part of its investigation, the CSB looked at the role of OSHA in inspecting and enforcing safety regulations at refineries and chemical plants. Although the refinery had experienced numerous fatal incidents from 1985 to 2005, the investigation found that OSHA conducted only one planned PSM inspection at the Texas City Refinery, in 1998. Other, unplanned OSHA inspections of the Texas City Refinery occurred in response to accidents, complaints, or referrals; the report said that unplanned inspections are typically narrower in scope and shorter than planned inspections. Proposed OSHA fines during the 20 years preceding the March 2005 disaster – a period when ten fatalities occurred at the refinery – totaled $270,255; net fines collected after negotiations totaled $77,860. Following the March 2005 explosion, OSHA issued the largest penalty in its history to BP, over $21 million for more than 300 egregious and willful violations.
"OSHA's national focus on inspecting facilities with high injury rates, while important, has resulted in reduced attention to preventing less frequent, but catastrophic, process safety incidents such as the one at Texas City," the report reads. The report found that when the PSM standard was created, OSHA had envisioned a highly technical, complex, and lengthy inspection process for regulated facilities, called a Program Quality Verification or PQV inspection. The inspections would take weeks or months at each facility and would be conducted by a select, well-trained, and experienced team.
investigation found that few PQV inspections were done between 1995 and 2005.
Federal OSHA conducted only nine such inspections in the targeted industries
over that ten-year period, and none in the refining sector. State agencies in
the 26 states that operate their own workplace safety programs conducted a total
of 48 PQV inspections, including six at refineries. However, a number of states
"On average from 1995 to 2005, only 0.2 percent of the approximately 2,816 facilities in targeted, high-hazard industries received a planned OSHA process safety inspection each year. That's about one planned inspection per 500 facilities," Holmstrom said.
The report calls on OSHA to "identify those facilities at the greatest risk of a catastrophic accident" and then to "conduct comprehensive inspections" at those facilities. The report also recommends that OSHA hire or develop new, specialized inspectors and expand the PSM training curriculum at its National Training Institute.
already on the books would likely have prevented the tragedy in
The CSB is an independent federal agency charged with investigating industrial chemical accidents. The agency's board members are appointed by the president and confirmed by the Senate. CSB investigations look into all aspects of chemical accidents, including physical causes such as equipment failure as well as inadequacies in regulations, industry standards, and safety management systems.
The board does not issue citations or fines but does make safety recommendations to plants, industry organizations, labor groups, and regulatory agencies such as OSHA and EPA. Please visit our website, www.csb.gov.
For more information, please contact a member of the CSB public affairs office: 1) Daniel Horowitz, 202-441-6074 cell; 2) Sandy Gilmour 202-251-5496 cell; 3) Jennifer Jones 202-577-8448 cell; 4) Hillary Cohen 202-446-8094 cell; or 5) Kate Baumann 202-725-2204 cell.
A Chronology of the CSB Investigation
March 24, 2005 - CSB investigators arrive at the BP Texas City refinery
March 26, 2005 - The CSB team points out the hazard of placing trailers so close to operating refinery units
April 1, 2005 - CSB investigators make initial entry into the damaged ISOM unit and identify the atmospheric blowdown drum as the likely source of the release
April 28, 2005 - CSB investigators say diminished outflow from an ISOM unit distillation tower resulted in overpressurization and flooding and led to the flammable release during startup
June 28, 2005 - CSB Lead Investigator Don Holmstrom announces that a review of computer records shows that two alarms and a level transmitter, which could have warned operators of the flooded condition of ISOM unit equipment, failed to operate properly in the hours leading to the explosion
July 28, 2005 - The Texas City refinery experiences a serious hydrogen fire in the Resid Hydrotreater Unit that causes $30 million in property damage and forces residents to take shelter
August 10, 2005 - Another incident related to mechanical integrity in the refinery's Gas Oil Hydrotreater forces another community shelter-in-place alert
August 17, 2005 - The Chemical Safety Board issues its first-ever urgent safety recommendation, calling on BP to convene an independent panel to assess safety culture and oversight at all five of its North American refineries
October 24, 2005 - BP announces formation of the 11-member panel of experts, chaired by former U.S. Secretary of State James A. Baker III
October 25, 2005 - The Chemical Safety Board issues new urgent safety recommendations calling on the American Petroleum Institute to develop new safety guidance for the placement of trailers away from hazardous process areas
2005 - In preliminary findings released at a public meeting in
November 10, 2005 - CSB Chairman Merritt testifies before the newly established Baker panel, notes the role of worker fatigue and operator downsizing in the accident
December 22, 2005 -The CSB releases a narrated computer animation of the events leading to the accident; the video is viewed in refineries and chemical plants worldwide
June 30, 2006 - The CSB releases blast damage information for 44 trailers located near the ISOM unit; notes serious damage to a distance of almost 600 feet from the center of the explosions
October 15, 2006 - The CSB issues a safety bulletin based on the July 28, 2005, hydrogen fire, calling for expanded use of positive material verification to prevent accidental releases
October 30, 2006 - CSB Chairman Merritt releases new preliminary findings from the investigation, pointing to the role of organizational factors and cost-cutting in setting the stage for the accident
2006 - The CSB issues new safety recommendations, calling on the
2007 - The independent refinery safety panel chaired by Secretary Baker issues
its final report at a news conference in
2007 - At a public meeting in