U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT 

REPORT NO. 2005-04-I-TX 

REFINERY EXPLOSION AND FIRE

(15 Killed, 180 Injured) 

KEY ISSUES: BP

SAFETY CULTURE TEXAS CITY, TEXAS

REGULATORY OVERSIGHT MARCH 23, 2005 

PROCESS SAFETY METRICS

HUMAN FACTORS

MARCH 2007
BP Texas City Final Investigation Report 3/20/2007 
BP Texas City Final Investigation Report 3/20/2007 

3

Contents 

FIGURES AND TABLES ..........................................................................................................................10

ACRONYMS AND ABBREVIATIONS ...................................................................................................13

1.0 EXECUTIVE SUMMARY ...........................................................................................................17

1.1 Incident synopsis ........................................................................................................................17

1.2 Scope of Investigation ................................................................................................................17

1.2.1 BP Group and Texas City .................................................................................................18

1.2.2 OSHA ...............................................................................................................................20

1.3 Incident Description ...................................................................................................................21

1.4 Conduct of the Investigation.......................................................................................................22

1.5 Key Technical Findings..............................................................................................................22

1.6 Key Organizational Findings......................................................................................................25

1.7 Recommendations ......................................................................................................................26

1.7.1 New Recommendations....................................................................................................26

1.7.2 Previously Issued Recommendations ...............................................................................27

1.8 Organization of the Report .........................................................................................................29

2.0 INCIDENT OVERVIEW ..............................................................................................................31

2.1 BP Corporate and Texas City Refinery Background..................................................................31

2.2 ISOM Unit Process.....................................................................................................................31

2.2.1 Raffinate Splitter Section..................................................................................................32

2.2.2 Raffinate Splitter Tower ...................................................................................................33

2.2.3 Safety Relief Valves .........................................................................................................36

2.2.4 Disposal Header Collection Systems................................................................................37

2.2.5 Blowdown Drum and Stack..............................................................................................37

2.2.6 ISOM Unit Sewer System.................................................................................................40

2.3 Turnaround Activities.................................................................................................................40

2.3.1 Ultracracker Unit and Aromatics Recovery Unit Turnaround..........................................40

2.3.2 Partial ISOM Unit Shutdown............................................................................................41

2.4 The Hazards of Unit Startup.......................................................................................................44

2.5 Incident Description ...................................................................................................................44

2.5.1 Unit Staffing .....................................................................................................................45

2.5.2 Preparations for the ISOM Startup ...................................................................................47

2.5.3 Initial Tower Filling and Shutdown..................................................................................49

2.5.4 Inadequate Shift Turnover ................................................................................................51

2.5.5 Raffinate Tower Startup....................................................................................................52

2.5.6 Tower Overfills.................................................................................................................54

2.5.7 Tower Overflows..............................................................................................................58

2.5.8 Safety Relief Valves Open................................................................................................59

2.5.9 Hydrocarbon Liquid Flows Into Collection Header .........................................................61

2.5.10 Flammable Liquid Flow Into ISOM Sewer System..........................................................61

2.5.11 Flammable Liquid Flow Out of the Blowdown Stack ......................................................62

2.5.12 Flammable Vapor Cloud Formation and Fire...................................................................64

2.5.13 Ignition Source..................................................................................................................66

2.5.14 Blast Pressure....................................................................................................................66

2.5.15 Post-Explosion Fires.........................................................................................................67
BP Texas City Final Investigation Report 3/20/2007 

4 

2.5.16 Fatalities and Injuries........................................................................................................68

2.5.17 Equipment and Facility Damage.......................................................................................68

2.5.18 Offsite Damage .................................................................................................................70

2.5.19 Post-Incident Emergency Response..................................................................................70

3.0 SAFETY SYSTEM DEFICIENCIES IN UNIT STARTUP .........................................................71

3.1 Work Environment Encouraged Procedural Deviations.............................................................72

3.1.1 Procedures Did Not Reflect Actual Practice.....................................................................73

3.1.2 Procedural Changes Without Management of Change (MOC) ........................................76

3.1.3 Startup Procedure Lacked Sufficient Instructions ............................................................77

3.1.4 Summary...........................................................................................................................78

3.2 Ineffective and Insufficient Communication Among Operations Personnel..............................79

3.3 Malfunctioning Instrumentation .................................................................................................81

3.4 Poor Computerized Control Board Display................................................................................83

3.5 Ineffective Supervisory Oversight and Technical Assistance During Unit Startup....................85

3.6 Insufficient Staffing During Start Up .........................................................................................86

3.6.1 Refining and Corporate Management Decisions Affected Staffing .................................88

3.7 Operator Fatigue .........................................................................................................................89

3.7.1 Fatigue Factors..................................................................................................................90

3.7.2 Operator Performance Impaired by Fatigue......................................................................91

3.7.3 Lack of a BP Fatigue Prevention Policy ...........................................................................93

3.8 Inadequate Operator Training.....................................................................................................94

3.8.1 Training for Abnormal Situation Management.................................................................94

3.8.2 Verifying Operator Knowledge and Qualifications..........................................................96

3.8.3 Simulators Not Used to Train for Hazardous Scenarios...................................................96

3.8.4 Refinery and Corporate Management Decisions Affected Training.................................98

3.9 Failure to Establish Effective Safe Operating Limits...............................................................100

3.10 Distraction Not a Factor ...........................................................................................................101

3.11 Summary...................................................................................................................................102

4.0 INCIDENT INVESTIGATION SYSTEM DEFICIENCIES ......................................................103

5.0 EQUIPMENT DESIGN...............................................................................................................105

5.1 Hazards of High Tower Level ..................................................................................................105

5.2 Previous Tower Overfilling Incidents ......................................................................................105

5.3 Level Indication Design............................................................................................................106

5.4 Automatic Safety Controls .......................................................................................................107

5.5 Pressure Relief and Disposal System Design ...........................................................................109

5.5.1 Safety and Engineering Standards..................................................................................110

5.5.2 Pressure Relief System Design Basis .............................................................................110

5.5.3 Blowdown System Design Basis....................................................................................111

5.5.4 Process Safety Standard No. 6........................................................................................111

5.5.5 Amoco Engineering Specification 49D-2.......................................................................112

5.5.6 Amoco Engineering Specification A CV-PLT-DISP-E..................................................113

5.6 Previous Attempts to Remove Blowdown Drums....................................................................114

5.6.1 1991 Flare/Blowdown Strategy ......................................................................................114

5.6.2 1992 OSHA Citation.......................................................................................................114

5.6.3 1993 Amoco Regulatory Cluster Project ........................................................................115

5.6.4 2002 NDU Flare line.......................................................................................................115

5.6.5 2002 Clean Streams Project............................................................................................116

5.7 API 521 Guidelines ..................................................................................................................117
BP Texas City Final Investigation Report 3/20/2007 

5

5.7.1 Tower overfilling scenario..............................................................................................118

5.7.2 Selection of disposal systems..........................................................................................118

5.7.3 Sizing the knockout drum ...............................................................................................119

5.7.4 Inherently safer approaches ............................................................................................119

5.8 Conclusion................................................................................................................................120

6.0 TRAILERS ..................................................................................................................................122

6.1 Placement of Temporary Structures .........................................................................................122

6.2 History of Trailers in the Area..................................................................................................122

6.2.1 2005 Turnaround.............................................................................................................123

6.3 BP Texas City Facility Siting Practices....................................................................................123

6.3.1 Amoco Facility Siting Screening Workbook...................................................................124

6.3.2 MOC Procedures for Facility Siting ...............................................................................125

6.3.3 What If/Checklist Methodology .....................................................................................125

6.3.4 MOC Implementation Problems with Trailer Siting.......................................................126

6.4 API 752 Guidelines ..................................................................................................................127

6.5 BP Actions After the Explosion ...............................................................................................129

7.0 MECHANICAL INTEGRITY.....................................................................................................130

7.1 Instrumentation Failures...........................................................................................................130

7.2 Mechanical Integrity Management System Deficiencies .........................................................132

7.2.1 Process Safety Information.............................................................................................132

7.2.2 Maintenance Procedures and Training............................................................................133

7.2.3 Process Hazard Analysis (PHA).....................................................................................133

7.2.4 Deficiency Management: The SAP Maintenance Program ............................................134

7.3 Summary...................................................................................................................................134

8.0 OTHER SAFETY SYSTEM PROBLEMS .................................................................................136

8.1 Process Hazard Analysis (PHA)...............................................................................................136

8.2 Management of Change (MOC) ...............................................................................................137

8.3 Auditing....................................................................................................................................138

8.3.1 Compliance Audits .........................................................................................................138

8.3.2 PSM Audits.....................................................................................................................138

8.3.3 2001 PSM Audit .............................................................................................................139

8.3.4 2004 PSM Audit .............................................................................................................139

8.4 Controlling Vehicle Traffic and People During Startup...........................................................140

8.4.1 Traffic Safety Policy.......................................................................................................140

8.4.2 Failure to Remove Non-Essential Personnel ..................................................................141

9.0 BP’S SAFETY CULTURE..........................................................................................................142

9.1 BP Texas City Explosion: An Organizational Accident...........................................................142

9.2 Grangemouth Lessons—Focus on PSM...................................................................................144

9.3 BP’s Approach to Safety—Lack of PSM Focus.......................................................................146

9.3.1 Changes in the Safety Organization................................................................................146

9.3.2 BP Group’s HSE Management System ..........................................................................147

9.3.3 Group Major Hazard Safety Standard.............................................................................150

9.3.4 BP Management Framework ..........................................................................................150

9.3.5 Texas City Process Safety Group ...................................................................................152

9.3.6 Other Factors Impacting BP’s Safety Management........................................................153

9.3.7 Summary.........................................................................................................................155

9.4 Ineffective BP Response to Reports of Serious Safety Problems 2002-2005 ..........................155
BP Texas City Final Investigation Report 3/20/2007 

6 

9.4.1 2002 Study Provides Warnings of Impending Major Site Incident ................................155

9.4.2 Study Follow-up: Lack of Investment Compromised Safety..........................................157

9.4.3 1999 – 2000 Significant Budget Cuts.............................................................................158

9.4.4 2002 Financial Crisis Mode............................................................................................159

9.4.5 2003 Maintenance Gap Assessment ...............................................................................160

9.4.6 The SHIFT Program .......................................................................................................160

9.4.7 2003 GHSER Audit—“The condition of infrastructure and assets is poor”...................161

9.4.8 1,000 Day Goals .............................................................................................................163

9.4.9 The Texas City Repositioning Project ............................................................................163

9.4.10 The Ultraformer #4 (UU4) Incident................................................................................164

9.4.11 Ultraformer #3 (UU3) Incident.......................................................................................165

9.4.12 2004 BP Group GHSER Audit Review—“Systemic Underlying Issues” ......................166

9.4.13 BP’s Golden Rules of Safety ..........................................................................................167

9.4.14 Process Safety Performance Declines Further in 2004...................................................171

9.4.15 “Texas City is not a Safe Place to Work” .......................................................................172

9.4.16 Telos Survey ...................................................................................................................173

9.4.17 2005 Budget Cuts............................................................................................................176

9.4.18 2005 Key Risk—“Texas City kills someone”.................................................................177

9.4.19 Summary.........................................................................................................................177

10.0 ANALYSIS OF BP’S SAFETY CULTURE...............................................................................179

10.1 Lack of Reporting, Learning Culture........................................................................................179

10.1.1 Reporting Culture ...........................................................................................................180

10.1.2 Learning Culture .............................................................................................................182

10.2 Lack of Focus on Controlling Major Hazard Risk ...................................................................184

10.2.1 Focus on personal safety rather than process safety .......................................................184

10.2.2 “Check the box”..............................................................................................................186

10.2.3 Oversimplification ..........................................................................................................186

10.2.4 Ineffective corporate leadership and oversight...............................................................187

10.3 Safety Implications of Organizational Change.........................................................................191

10.3.1 BP mergers......................................................................................................................191

10.3.2 Organizational Changes at Texas City............................................................................192

10.3.3 Budget Cuts.....................................................................................................................194

10.3.4 Good Practice Guidelines ...............................................................................................194

11.0 REGULATORY ANALYSIS......................................................................................................196

11.1 OSHA’s Process Safety Management Regulation....................................................................196

11.1.1 Background Information.................................................................................................196

11.1.2 PSM Standard Elements .................................................................................................196

11.1.3 Other Models for Process Safety Inspections.................................................................204

11.1.4 Summary and Discussion................................................................................................206

11.2 EPA’s Risk Management Plan (RMP) Rule.............................................................................207

11.2.1 Comparison to PSM........................................................................................................208

11.2.2 RMP Rule Enforcement..................................................................................................209

12.0 ROOT AND CONTRIBUTING CAUSES..................................................................................210

12.1 Root Causes..............................................................................................................................210

12.2 Contributing Causes .................................................................................................................211

13.0 RECOMMENDATIONS.............................................................................................................212

American Petroleum Institute (API) and United Steelworkers International Union (USW)....................212
BP Texas City Final Investigation Report 3/20/2007 

7

Occupational Safety and Health Administration (OSHA)........................................................................213

Center for Chemical Process Safety (CCPS)............................................................................................214

BP Board of Directors ..............................................................................................................................214

BP Texas City Refinery............................................................................................................................215

United Steelworkers International Union and Local 13-1........................................................................216

APPENDIX A: TEXAS CITY TIMELINE 1950S – MARCH 23, 2005 .................................................218

APPENDIX B: LOGIC TREE..................................................................................................................222

APPENDIX C: PREVIOUSLY ISSUED RECOMMENDATIONS........................................................236

C.1 Safety Culture Recommendation..............................................................................................236

C.2 Trailer Siting Recommendation................................................................................................241

American Petroleum Institute ......................................................................................................243

American Petroleum Institute & the National Petrochemical and Refiners Association.............244

C.3 Blowdown Drum & Stack Recommendation ...........................................................................244

American Petroleum Institute ......................................................................................................247

Occupational Safety and Health Administration (OSHA)...........................................................248

APPENDIX D: BP CORPORATE AND TEXAS CITY REFINERY BACKGROUND........................249

D.1 BP- Amoco Merger ..................................................................................................................249

D.2 BP South Houston Integrated Site ............................................................................................249

D.3 BP Texas City Refinery............................................................................................................250

APPENDIX E: ISOM UNIT - HISTORY, EQUIPMENT, AND OPERATION.....................................251

E.1 Raffinate Splitter Section..........................................................................................................251

E.2 Blowdown Drum and Stack......................................................................................................252

APPENDIX F: TRAILERS FOR TURNAROUND ACTIVITIES..........................................................255

F.1 BP Internal Guidelines Compared To Good Practice Guidelines.............................................256

F.1.1 Occupancy Criteria .........................................................................................................257

APPENDIX G: PROCESS MODELING .................................................................................................258

G.1 Modeling Approach..................................................................................................................258

G.2 Raffinate Splitter Column Overfill ...........................................................................................260

G.3 Blowdown Stack Hydrocarbon Liquid Overflow.....................................................................261

G.3.1 Methodology...................................................................................................................261

G.3.2 Computer Inputs and Assumptions.................................................................................262

G.3.3 Computer Simulation Results.........................................................................................263

APPENDIX H: BLAST DAMAGE ANALYSIS, VAPOR CLOUD AND EXPLOSION MODELING 265

H.1 Surveys of Blast Damage..........................................................................................................265

H.2 Blast Damage Analysis.............................................................................................................266

H.3 Intense Blast Regions ...............................................................................................................266

H.4 Trailer Damage .........................................................................................................................269

H.5 ISOM Satellite Control Room Building ...................................................................................270

H.6 Catalyst Warehouse ..................................................................................................................271

H.7 Storage Tanks...........................................................................................................................271

H.8 Off-Site Buildings.....................................................................................................................272

H.9 Vapor Cloud Dispersion Modeling...........................................................................................272

H.10 Methodology.............................................................................................................................273

H.10.1 Wind Effects...................................................................................................................273

H.10.2 Source Term....................................................................................................................274

H.11 PHAST Modeling.....................................................................................................................275
BP Texas City Final Investigation Report 3/20/2007 

8 

H.12 Pool Evaporation ......................................................................................................................276

H.13 FLACS Vapor Dispersion Modeling........................................................................................277

H.13.1 Results.............................................................................................................................278

H.14 Explosion Modeling Methodology...........................................................................................279

H.15 Vapor Cloud Formation............................................................................................................279

H.16 Ignition Locations....................................................................................................................281

H.17 Additional Explosion Modeling ...............................................................................................283

H.17.1 Results.............................................................................................................................283

APPENDIX I: HISTORICAL DATA ON 19 RAFFINATE UNIT STARTUPS ....................................285

APPENDIX J: INEFFECTIVE AND INSUFFICIENT COMMUNICATION........................................286

J.1 What is Effective Communication?..........................................................................................286

J.2 BP Grangemouth Refinery Study on Effective Communication..............................................287

J.3 Summary...................................................................................................................................288

APPENDIX K: DESIGN OF THE AU2/ISOM/NDU CONTROL BOARD...........................................289

APPENDIX L: STAFFING CONCERNS................................................................................................291

APPENDIX M: FATIGUE AND PERFORMANCE...............................................................................293

M.1 Research on the Performance Effects of the 12-Hour Shift......................................................293

M.2 BP’s Fatigue Policy ..................................................................................................................295

APPENDIX N: COMPARISON OF HOURS-FOR-SERVICE REGULATIONS ..................................296

APPENDIX O: OPERATOR TRAINING ...............................................................................................300

O.1 BP Board Operator Training.....................................................................................................300

O.1.1 Five-Week Basic Operator Training...............................................................................300

O.1.2 Two-Day Troubleshooting Course .................................................................................300

O.1.3 On-The-Job Training ......................................................................................................301

O.1.4 Computerized Training Program ....................................................................................301

O.2 Training Certifications..............................................................................................................302

APPENDIX P: DISTRACTION NOT A CONTRIBUTING FACTOR ..................................................304

P.1 Possible Distraction Due to Understaffing ...............................................................................305

APPENDIX Q: PRIOR INCIDENTS.......................................................................................................306

Q.1 Texas City Blowdown System Incidents..................................................................................307

Q.2 Raffinate Splitter Tower Upsets During Startup.......................................................................311

APPENDIX R: EMERGENCY RELIEF SYSTEM DESIGN ANALYSIS.............................................313

APPENDIX S: RAFFINATE SPLITTER AND BLOWDOWN DRUM INSTRUMENT HISTORY, 

TESTING, INSPECTION, AND ANALYSIS .........................................................................................319

S.1 Instruments Involved ................................................................................................................319

S.2 Physical Failure Causes............................................................................................................319

S.2.1 Description of Instrument Testing ..................................................................................320

S.2.2 Raffinate Splitter Level Transmitter LT-5100................................................................320

S.2.3 Raffinate Splitter Sight Glass LG-1002A/B ...................................................................323

S.2.4 Raffinate Splitter High Level Alarm LSH-5102.............................................................323

S.2.5 Blowdown Drum High Level Alarm LSH-5020.............................................................324

S.2.6 Raffinate splitter 3-pound vent valve PCV-5002............................................................325

S.3 Instrument Inspection and Testing............................................................................................326

S.4 Test Results and Instrument Failure Analysis..........................................................................327
BP Texas City Final Investigation Report 3/20/2007 

9

S.5 Photographic Evidence .............................................................................................................329

APPENDIX T: BP MANAGEMENT-OF-CHANGE (MOC) POLICY ..................................................332

APPENDIX U: BP TURNAROUNDS TRAFFIC CONTROL MAP*....................................................334

REFERENCES .........................................................................................................................................335
BP Texas City Final Investigation Report 3/20/2007 

10 

Figures and Tables 

Figures 

Figure 1. Raffinate section of the ISOM.....................................................................................................34

Figure 2. Disposal collection header system...............................................................................................37

Figure 3. Blowdown drum and gooseneck..................................................................................................39

Figure 4. Left: Gooseneck piping and manual block valve (chained-locked open) Right:: Close-up of 

manual block valve .............................................................................................................................40

Figure 5. Refinery layout of the area surrounding the ISOM unit ..............................................................42

Figure 6. At 1:04 p.m. the liquid level in the tower was 158 feet (48 m), but the computerized control 

system indicated to operators that the level was at 78 percent of the level transmitter (7.9 feet, or 2.4 

m, of liquid in the tower). ...................................................................................................................57

Figure 7. Heating of feed in the splitter tower............................................................................................58

Figure 8. Hydrostatic head of liquid in overhead piping leads to the three relief valves opening..............60

Figure 9. Tower overfills and blowdown drum releases hydrocarbons......................................................63

Figure 10. The darkened areas in and around the ISOM unit had the heaviest fire damage; the red arrow 

points to the top of the blowdown stack .............................................................................................65

Figure 11. Idling diesel pickup truck at north end of ISOM unit................................................................66

Figure 12. Blast overpressure map depicting the areas of highest blast pressure (10+, 5+, and 2.5+ psi) .67

Figure 13. Destroyed trailers west of the blowdown drum (red arrow in upper left of the figure).............69

Figure 14. The Board Operator viewed this screen, which provides information on raffinate product 

leaving the unit but not the liquid being added to the unit..................................................................84

Figure 15. Trailer area and adjacent ISOM unit .......................................................................................124

Figure 16. Comparison of explosion damage based on API and BP Texas City criteria..........................129

Figure 17. Simplified organizational chart of BP at the time of the March 23, 2005 incident. Some 

positions are not included .................................................................................................................148

Figure 18. Organizational changes affecting the Texas City refinery.......................................................192

Figure G- 1. Experimental boiling (bubble) point data (Fauske & Associates, 2005)..............................260
BP Texas City Final Investigation Report 3/20/2007 

11

Figure H- 1. Intense blast regions in the ISOM unit.................................................................................268

Figure H- 2. Blast overpressure map ........................................................................................................269

Figure H- 3. Cloud extent comparing field observations (red line) to dispersion modeling.....................278

Figure K- 1 The computerized control system for the AU2/ISOM/NDU complex..................................289

Figure S- 1. Calculated LT-5100 flooded reading versus specific gravity ...............................................321

Figure S- 2. Calculated raffinate splitter feed specific gravity as a function of temperature....................322

Figure S- 3. LT-5100 cabinet showing calibration set for 0.8 specific gravity.........................................329

Figure S- 4. LSH-5102 internal components............................................................................................329

Figure S- 5. Internal components of LSH-5020 blowdown drum high level alarm..................................330

Figure S- 6. Close-up of LSH-5020 float, showing corrosion and hole....................................................330

Figure S- 7. PCV-5002 shop testing .........................................................................................................331

Tables

Table 1. Timeline of events from ISOM unit shutdown to March 23 incident...........................................43

Table 2. Individuals involved in the March 23, 2005, startup ....................................................................46

Table 3. Safeguard reliability (CCPS, 1996b) ..........................................................................................108

Table 4. Instrumentation that failed to operate properly on March 23, 2005 ...........................................131

Table 5. Upper management job position descriptions.............................................................................147

Table G- 1. Raffinate splitter column simplified composition model (Fisher, 2006)...............................259

Table G-2: Safety relief valve characteristics...........................................................................................262

Table G-3: Overall mass balance of hydrocarbon flow from the raffinate splitter...................................264

Table H- 1. Trailer damage.......................................................................................................................270

Table H- 2. Source term release and material property data.....................................................................275

Table H- 3. PHAST input parameters.......................................................................................................275
BP Texas City Final Investigation Report 3/20/2007 

12 

Table H- 4. PHAST model results............................................................................................................276

Table R- 1. Specifications of safety relief valves installed on the raffinate splitter tower .......................316

Table R- 2. Flow from the safety relief valves on the raffinate splitter....................................................316

Table S- 1. Field and Shop Testing and Inspection Summary..................................................................326

Table S- 2. Test results and analysis summary .........................................................................................327
BP Texas City Final Investigation Report 3/20/2007 

13

Acronyms and Abbreviations 

ACC American Chemistry Council 

AIChE American Institute of Chemical Engineers 

API American Petroleum Institute 

ARPD Amoco Refining Planning Department 

ARU Aromatics Recovery Unit 

AU2 Aromatics Unit #2 

BOT Basic Operator Training 

BPSH BP South Houston 

bpd barrels per day 

BUL Business Unit Leader 

CAIB Columbia Accident Investigation Board 

CDP Compliance Delivery Process 

CFHU Cat Feed Hydrotreating Unit 

CCPS Center for Chemical Process Safety 

CMMS Computerized Maintenance Management Software 

CSB U.S. Chemical Safety and Hazard Investigation Board 

CVP Capital Value Process 

DIERS Design Institute for Emergency Relief Systems 

DIH Deisohexanizer 

EHS Environment, Health and Safety 

EPA Environmental Protection Agency 

GHSER Getting Health, Safety, and Environment Right 

gph gallons per hour 
BP Texas City Final Investigation Report 3/20/2007 

14 

HAZOP Hazard and Operability Study 

HC1 Hydrogen Chloride 

HRO High Reliability Organization 

HSE Health, Safety & Environment 

HSSE Health, Safety, Security, & Environment 

HUF Heavy Ultraformate Fractionator 

IH Industrial Hygiene 

IMAS Industrial Mutual Aid System 

ISBL Inside Battery Limits 

ISOM Isomerization unit 

kPa kilopascal 

KPI Key Performance Indicators 

L&D Learning and Development 

MAR Major Accident Risk 

MAWP Maximum Allowable Working Pressure 

MDL Manufacturing Delivery Leader 

MOA Memorandum of Agreement 

MOC Management of Change 

mscf million standard cubic feet 

NDU Naptha Desulfurization Unit 

NESHAP National Emissions Standard for Hazardous Air Pollutants 

NPRA National Petrochemical and Refiners Association 

NPS Nominal Pipe Size 

NTSB National Transportation Safety Board 

OSBL Outside Battery Limits 
BP Texas City Final Investigation Report 3/20/2007 

15

OCAM Operator Competency Assurance Model 

OSHA Occupational Safety and Health Administration 

P&ID Piping and Instrumentation Diagram 

PHA Process Hazard Analysis 

PIP Piping Integrity Program 

pph pounds per hour 

PPS Amoco Petroleum Products Sector 

psi pounds per square inch 

PSM Process Safety Management 

PSS Process Safety Standard 

PSSR Pre-Startup Safety Review 

PT Process Technician 

QA/QC Quality Assurance/Quality Control 

R&M Refining and Marketing 

RCFA Root Cause Failure Analysis 

RHU Resid Hydrotreating Unit 

RIF Recordable Injury Frequency 

RMP Risk Management Program 

SAP Systems Applications and Products 

SEP Special Emphasis Program 

SHIFT South Houston Infrastructure for Tomorrow 

SIS Safety Instrumented System 

SOI Standard Operating Instructions 

SOPs Standard Operating Procedures 

SPU Strategic Performance Unit 
BP Texas City Final Investigation Report 3/20/2007 

16 

TCEQ Texas Commission on Environmental Quality 

TCR Texas City Refinery 

TCS Texas City Site 

TSP Traffic Safety Policy 

UK United Kingdom 

ULC Ultracracker unit 

UOP Universal Oil Products 

USW United Steelworkers 

UU3 Ultraformer Unit # 3 

UU4 Ultraformer Unit #4 

VOC Volatile Organic Compounds 

VPP Variable Pay Plan 
BP Texas City Final Investigation Report 3/20/2007 

17

 

1.0 EXECUTIVE SUMMARY 

1.1 Incident synopsis 

On March 23, 2005, at 1:20 p.m., the BP Texas City Refinery suffered one of the worst industrial 

disasters in recent U.S. history. Explosions and fires killed 15 people and injured another 180, alarmed the 

community, and resulted in financial losses exceeding $1.5 billion. The incident occurred during the 

startup of an isomerization1

 (ISOM) unit when a raffinate splitter tower2 was overfilled; pressure relief 

devices opened, resulting in a flammable liquid geyser from a blowdown stack that was not equipped with 

a flare. The release of flammables led to an explosion and fire. All of the fatalities occurred in or near 

office trailers located close to the blowdown drum. A shelter-in-place order was issued that required 

43,000 people to remain indoors. Houses were damaged as far away as three-quarters of a mile from the 

refinery. 

The BP Texas City facility is the third-largest oil refinery in the United States. Prior to 1999, Amoco 

owned the refinery. BP merged with Amoco in 1999 and BP subsequently took over operation of the 

plant. 

1.2 Scope of Investigation 

Due to the significance of the disaster, the U.S. Chemical Safety and Hazard Investigation Board (CSB) 

investigated not only BP’S safety performance at Texas City, but also the role played by BP Group 

1

 The refining isomerization process converts straight chain normal pentane and normal hexane streams to the higher 

octane branched hydrocarbons isopentane and isohexane that are used for gasoline blending. 

2

 The raffinate splitter is a distillation tower that takes raffinate, a non-aromatic, primarily straight-chain 

hydrocarbon mixture and separates it into light and heavy components. 
BP Texas City Final Investigation Report 3/20/2007 

18 

management, based in London, England.3

 The CSB further examined the effectiveness of the 

Occupational Safety and Health Administration (OSHA), which has primary U.S. federal government 

oversight responsibility for worker safety. 

1.2.1 BP Group and Texas City 

The Texas City disaster was caused by organizational and safety deficiencies at all levels of the BP 

Corporation. Warning signs of a possible disaster were present for several years, but company officials 

did not intervene effectively to prevent it. The extent of the serious safety culture deficiencies was further 

revealed when the refinery experienced two additional serious incidents just a few months after the March 

2005 disaster. In one, a pipe failure caused a reported $30 million in damage; the other resulted in a $2 

million property loss. In each incident, community shelter-in-place orders were issued. 

This investigation was conducted in a manner similar to that used by the Columbia Accident Investigation 

Board (CAIB) in its probe of the loss of the space shuttle. Using the CAIB model, the CSB examined 

both the technical and organizational causes of the incident at Texas City. 

The CAIB report stated that NASA’s organizational culture and structure had as much to do with this 

accident as did the immediate cause.4

 

 

3

 BP Group management is the global corporate management responsible for business operations, including refining 

and marking (R&M). 

4

 Immediate causes are the events or conditions that lead directly or indirectly to an incident, such as mechanical 

failure or human error (CCPS, 1992a). The immediate cause of the Columbia space shuttle disaster was striking of 

the left shuttle wing by a piece of insulating foam that separated from the external tank about a minute after 

launch. During re-entry, superheated air melted the area damaged by the foam strike, weakening the structure, 

leading to the subsequent failure of the structure and break up of the shuttle (CAIB report, 2003, vol. 1, p.9). 
BP Texas City Final Investigation Report 3/20/2007 

19

 of 

 

The CAIB also observed that: 

Many accident investigations make the same mistake in defining causes. They identify the 

widget that broke or malfunctioned, then locate the person most closely connected with the 

technical failure: the engineer who miscalculated an analysis, the operator who missed signals 

or pulled the wrong switches, the supervisor who failed to listen, or the manager who made 

bad decisions. When causal chains are limited to technical flaws and individual failures, the 

ensuing responses aimed at preventing a similar event in the future are equally limited: they 

aim to fix the technical problem and replace or retrain the individual responsible. Such 

corrections lead to a misguided and potentially disastrous belief that the underlying problem 

has been solved (CAIB, 2003). 

Simply targeting the mistakes of BP’s operators and supervisors misses the underlying and significant 

cultural, human factors,5

 and organizational causes of the disaster that have a greater preventative 

impact.6

 One underlying cause was that BP used inadequate methods to measure safety conditions at 

Texas City. For instance, a very low personal injury rate at Texas City gave BP a misleading indicator

process safety performance. In addition, while most attention was focused on the injury rate, the overall

safety culture and process safety management (PSM)7

 program had serious deficiencies. Despite 

numerous previous fatalities at the Texas City refinery (23 deaths in the 30 years prior to the 2005 

5

 “Human factors refer to environmental, organizational, and job factors, and human and individual characteristics, 

influence behaviour at work in a way which can affect health and safety” (HSE, 1999). 

6

 The Center for Chemical Process Safety (CCPS) states that identifying the underlying or root causes of an incident 

has a greater preventative impact by addressing safety system deficiencies and averting the occurrence of 

numerous other similar incidents, while addressing the immediate cause only prevents the identical accident from 

reoccurring (CCPS,1992a). 

7

 CCPS defines process safety as a “discipline that focuses on the prevention of fires, explosions and accidental 

chemical releases at chemical process facilities.” Process Safety Management (PSM) applies management 

principles and analytical tools to prevent major accidents rather than focusing on worker occupational health and 

safety issues, such as fall protection and personal protective equipment (CCPS, 1992a). 
BP Texas City Final Investigation Report 3/20/2007 

20 

ing risk of 

. 

 

disaster) and many hazardous material releases, BP did not take effective steps to stem the grow

a catastrophic event

Cost-cutting and failure to invest in the 1990s by Amoco and then BP left the Texas City refinery 

vulnerable to a catastrophe. BP targeted budget cuts of 25 percent in 1999 and another 25 percent in 2005, 

even though much of the refinery’s infrastructure and process equipment were in disrepair. Also, operator 

training and staffing were downsized. 

1.2.2 OSHA 

OSHA enforcement at the BP Texas City refinery was also examined. In the years prior to the incident 

OSHA conducted several inspections, primarily in respose to fatalities at the refinery, but did not identify 

the likelihood for a catastrophic incident, nor did OSHA prioritize planned inspections of the refinery to 

enforce process safety regulations, despite warning signs. After this incident OSHA uncovered 301 

egregious willful8

 violations for which BP paid a $21 million fine, the largest ever issued by OSHA in its 

35-year history. Prior to OSHA issuing citations, the refinery had two additional serious incidents. 

Despite the large number of major violations on the ISOM unit, and these two additional serious incidents 

in 2005, OSHA did not conduct a comprehensive inspection of any of the other 29 process units at the 

Texas City refinery.9

 

8

 A “willful” violation is defined as an "act done voluntarily with either an intentional disregard of, or plain 

indifference to, the Act's requirements." Conie Construction, Inc. v. Reich, 73 F.3d 382, 384 (D.C. Cir. 1995). An 

“egregious” violation, also know as a “violation-by-violation” penalty procedure, is one where penalties are 

applied to each instance of a violation without grouping or combining them. 

9

 The settlement agreement between OSHA and BP from the ISOM incident and other investigations did require BP 

to retain a PSM expert to conduct comprehensive audits at the Texas City refinery to assess the “robustness of the 

PSM systems.” United States of America Occupational Safety and Health Administration, BP Products North 

America Inc. Settlement Agreement, September 21, 2005. 
BP Texas City Final Investigation Report 3/20/2007 

21

OSHA’s national focus on inspecting facilities with high personnel injury rates, while important, has 

resulted in reduced attention to preventing less frequent, but catastrophic, process safety incidents such as 

the one at Texas City. OSHA’s capability to inspect highly hazardous facilities and to enforce process 

safety regulations is insufficient; very few comprehensive process safety inspections were conducted prior 

the ISOM incident and only a limited number of OSHA inspectors have the specialized training and 

experience needed to perform these complex examinations. 

1.3 Incident Description 

On the morning of March 23, 2005, the raffinate splitter tower in the refinery’s ISOM unit was restarted 

after a maintenance outage. During the startup, operations personnel pumped flammable liquid 

hydrocarbons into the tower for over three hours without any liquid being removed, which was contrary 

to startup procedure instructions. Critical alarms and control instrumentation provided false indications 

that failed to alert the operators of the high level in the tower. Consequently, unknown to the operations 

crew, the 170-foot (52-m) tall tower was overfilled and liquid overflowed into the overhead pipe at the 

top of the tower. 

The overhead pipe ran down the side of the tower to pressure relief valves located 148 feet (45 m) below. 

As the pipe filled with liquid, the pressure at the bottom rose rapidly from about 21 pounds per square 

inch (psi) to about 64 psi. The three pressure relief valves opened for six minutes, discharging a large 

quantity of flammable liquid to a blowdown drum with a vent stack open to the atmosphere. The 

blowdown drum and stack overfilled with flammable liquid, which led to a geyser-like release out the 

113-foot (34 m) tall stack. This blowdown system was an antiquated and unsafe design; it was originally 

installed in the 1950s, and had never been connected to a flare system to safely contain liquids and 

combust flammable vapors released from the process. 
BP Texas City Final Investigation Report 3/20/2007 

22 

The released volatile liquid evaporated as it fell to the ground and formed a flammable vapor cloud. The 

most likely source of ignition for the vapor cloud was backfire from an idling diesel pickup truck located 

about 25 feet (7.6 m) from the blowdown drum. The 15 employees killed in the explosion were 

contractors working in and around temporary trailers that had been previously sited by BP as close as 121 

feet (37 m) from the blowdown drum. 

1.4 Conduct of the Investigation 

Investigators from the CSB arrived at the facility on the morning of March 24, 2005. During the 

investigation, the CSB reviewed over 30,000 documents; conducted 370 interviews; tested instruments; 

and assessed damage to equipment and structures in the refinery and surrounding community. Electronic 

data from the computerized control system and process information from five years of previous startups 

were also examined. The CSB investigation team was supplemented by experts in blast damage 

assessment, vapor cloud modeling, pressure relief system design, distillation process dynamics, 

instrument control and reliability, and human factors. 

Several analytical tools were used by CSB in its investigation of the BP incident, including timeline 

construction and logic tree causal analysis. See Section 2.3 for an incident timeline, Appendix A for an 

organizational timeline leading up to the incident, and Appendix B for the logic tree. 

This investigation was coordinated with OSHA; the U.S. Environmental Protection Agency (EPA); the 

Texas Commission of Environmental Quality (TCEQ); and BP’s investigation team. 

1.5 Key Technical Findings 

1. The ISOM startup procedure required that the level control valve on the raffinate splitter tower be 

used to send liquid from the tower to storage. However, this valve was closed by an operator and 
BP Texas City Final Investigation Report 3/20/2007 

23

the tower was filled for over three hours without any liquid being removed. This led to flooding 

of the tower and high pressure, which activated relief valves that discharged flammable liquid to 

the blowdown system. Underlying factors involved in overfilling the tower included: 

• The tower level indicator showed that the tower level was declining when it was 

actually overfilling. The redundant high level alarm did not activate, and the tower 

was not equipped with any other level indications or automatic safety devices. 

• The control board display did not provide adequate information on the imbalance of 

flows in and out of the tower to alert the operators to the dangerously high level. 

• A lack of supervisory oversight and technically trained personnel during the startup, 

an especially hazardous period, was an omission contrary to BP safety guidelines. An 

extra board operator was not assigned to assist, despite a staffing assessment that 

recommended an additional board operator for all ISOM startups. 

• Supervisors and operators poorly communicated critical information regarding the 

startup during the shift turnover; BP did not have a shift turnover communication 

requirement for its operations staff. 

• ISOM operators were likely fatigued from working 12-hour shifts for 29 or more 

consecutive days. 

• The operator training program was inadequate. The central training department staff 

had been reduced from 28 to eight, and simulators were unavailable for operators to 

practice handling abnormal situations, including infrequent and high hazard 

operations such as startups and unit upsets. 

• Outdated and ineffective procedures did not address recurring operational problems 
BP Texas City Final Investigation Report 3/20/2007 

24 

 

during startup, leading operators to believe that procedures could be altered or did not 

have to be followed during the startup process. 

2. The process unit was started despite previously reported malfunctions of the tower level indicator, 

level sight glass, and a pressure control valve. 

3. The size of the blowdown drum was insufficient to contain the liquid sent to it by the pressure 

relief valves. The blowdown drum overfilled and the stack vented flammable liquid to the 

atmosphere, which fell to the ground and formed a vapor cloud that ignited. A relief valve system 

safety study had not been completed. 

4. Neither Amoco nor BP replaced blowdown drums and atmospheric stacks, even though a series 

of incidents warned that this equipment was unsafe. In 1992, OSHA cited a similar blowdown 

drum and stack as unsafe, but the citation was withdrawn as part of a settlement agreement and 

therefore the drum was not connected to a flare as recommended.10 Amoco, and later BP, had 

safety standards requiring that blowdown stacks be replaced with equipment such as a flare when 

major modifications were made. In 1997, a major modification replaced the ISOM blowdown 

drum and stack with similar equipment, but Amoco did not connect it to a flare. In 2002, BP 

engineers proposed connecting the ISOM blowdown system to a flare, but a less expensive option 

was chosen. 

10 A flare system is process plant disposal equipment designed to receive and combust waste gases from emergency 

relief valve discharge or process vent. In an oil refinery, flares convert flammable vapors to less hazardous 

materials. Flare system equipment includes a vessel, or “knockout drum,” that is sized appropriately to safely 

contain any liquid discharge. After the liquid is removed, the remaining gases are safely combusted by a flare 

burner. OSHA withdrew the citation after Amoco argued that the design of the atmospheric blowdown stack was 

consistent with industry standards. 
BP Texas City Final Investigation Report 3/20/2007 

25

 

5. Occupied trailers were sited too close to a process unit handling highly hazardous materials. All 

fatalities occurred in or around the trailers. 

6. In the years prior to the incident, eight serious releases of flammable material from the ISOM 

blowdown stack had occurred, and most ISOM startups experienced high liquid levels in the 

splitter tower. Neither Amoco nor BP investigated these events. 

7. BP Texas City managers did not effectively implement their pre-startup safety review policy to 

ensure that nonessential personnel were removed from areas in and around process units during 

startups, an especially hazardous time in operations. 

1.6 Key Organizational Findings 

1. Cost-cutting, failure to invest and production pressures from BP Group executive managers 

impaired process safety performance at Texas City. 

2. The BP Board of Directors did not provide effective oversight of BP’s safety culture and major 

accident prevention programs. The Board did not have a member responsible for assessing and 

verifying the performance of BP’s major accident hazard prevention programs. 

3. Reliance on the low personal injury rate11 at Texas City as a safety indicator failed to provide a 

true picture of process safety performance and the health of the safety culture. 

4. Deficiencies in BP’s mechanical integrity program resulted in the “run to failure” of process 

equipment at Texas City. 

11 OSHA’s Recordable Occupational Injury and Illness Incidence Rate, which does not include fatalities, is 

normalized to allow for comparisons across workplaces and industries. The rate is calculated as the number of 

recordable incidents for each 100 full-time employees per year, based on 2,000 hours worked per employee per 

year. BP’s calculation of injury rate was the same as OSHA’s, but included fatalities, and counted fatalities the 

same as injuries. 
BP Texas City Final Investigation Report 3/20/2007 

26 

5. A “check the box” mentality was prevalent at Texas City, where personnel completed paperwork 

and checked off on safety policy and procedural requirements even when those requirements had 

not been met. 

6. BP Texas City lacked a reporting and learning culture. Personnel were not encouraged to report 

safety problems and some feared retaliation for doing so. The lessons from incidents and nearmisses, therefore, were generally not captured or acted upon. Important relevant safety lessons 

from a British government investigation of incidents at BP’s Grangemouth, Scotland, refinery 

were also not incorporated at Texas City. 

7. Safety campaigns, goals, and rewards focused on improving personal safety metrics and worker 

behaviors rather than on process safety and management safety systems. While compliance with 

many safety policies and procedures was deficient at all levels of the refinery, Texas City 

managers did not lead by example regarding safety. 

8. Numerous surveys, studies, and audits identified deep-seated safety problems at Texas City, but 

the response of BP managers at all levels was typically “too little, too late.” 

9. BP Texas City did not effectively assess changes involving people, policies, or the organization 

that could impact process safety. 

1.7 Recommendations 

1.7.1 New Recommendations 

As a result of this investigation, the CSB makes recommendations to the following recipients: 

• BP Group Executive Board of Directors 

• BP Texas City Refinery 

• U. S. Occupational Safety and Health Administration (OSHA) 
BP Texas City Final Investigation Report 3/20/2007 

27

1.7.2.1 

• American Petroleum Institute (API) 

• United Steelworkers International Union and Steelworkers Local 13-1 

• Center for Chemical Process Safety (CCPS) 

Section 13 of this report provides the detailed recommendations. 

1.7.2 Previously Issued Recommendations 

The CSB issued recommendations during the course of the investigation. This section provides a brief 

description; Appendix C provides the full text of each. 

Safety Culture Recommendation 

On August 17, 2005, the CSB issued an urgent safety recommendation to the BP Group Executive Board 

of Directors that it convene an independent panel of experts to examine BP’s corporate safety 

management systems, safety culture, and oversight of the North American refineries. BP accepted the 

recommendation and commissioned the BP U.S. Refineries Independent Safety Review Panel, chaired by 

former Secretary of State James Baker, III (“Baker Panel”). The scope of the Baker Panel’s work did not 

include determining the root causes of the Texas City ISOM incident. 

“The Report of the BP U.S. Refineries Independent Safety Review Panel” was issued January 16, 2007. 

The Baker Panel Report found that “significant process safety issues exist at all five U.S. refineries, not 

just Texas City,” and that BP had not instilled “a common unifying process safety culture among its U.S. 

refineries.” The report found “instances of a lack of operating discipline, toleration of serious deviations 

from safe operating practices, and [that an] apparent complacency toward serious process safety risk 

existed at each refinery.” The Panel concluded that “material deficiencies in process safety performance 

exist at BP’s five U.S. refineries.” 
BP Texas City Final Investigation Report 3/20/2007 

28 

1.7.2.2 

1.7.2.3 

The Baker Panel Report stated that BP’s corporate safety management system “does not effectively 

measure and monitor process safety performance” for its U.S. refineries. The report also found that BP’s 

over-reliance on personal injury rates impaired its perception of process safety risks, and that BP’s Board 

of Directors “has not ensured, as a best practice, that BP’s management has implemented an integrated, 

comprehensive, and effective process safety management system for BP’s five US refineries.” The 

report’s 10 recommendations to BP addressed providing effective process safety leadership, developing 

process safety knowledge and expertise, strengthening management accountability, developing leading 

and lagging process safety performance indicators, and monitoring by the Board of Directors the 

implementation of the Baker Panel’s recommendations. 

Trailer Siting Recommendations 

On October 25, 2005, the CSB issued two urgent safety recommendations. The first called on the 

American Petroleum Institute (API) to develop new guidelines to ensure that occupied trailers and similar 

temporary structures are placed safely away from hazardous areas of process plants; API agreed to 

develop new guidelines. A second recommendation to API and the National Petrochemical and Refiners 

Association (NPRA) called for both to issue a safety alert urging their members to take prompt action to 

ensure that trailers are safely located. API and NPRA published information on the two recommendations, 

referring to the CSB’s call for industry to take prompt action to ensure the safe placement of occupied 

trailers away from hazardous areas of process plants. 

Blowdown Drum and Stack Recommendations 

On October 31, 2006, the CSB issued two recommendations regarding the use of blowdown drums and 

stacks that handle flammables. The CSB recommended that API revise “Recommended Practice 521, 

Guide for Pressure Relieving and Depressuring Systems,” to identify the hazards of this equipment, to 

address the need to adequately size disposal drums, and to urge the use of inherently safer alternatives 
BP Texas City Final Investigation Report 3/20/2007 

29

1.7.2.4 

 

such as flare systems. 

The CSB issued a recommendation to OSHA to conduct a national emphasis program for oil refineries 

focused on the hazards of blowdown drums and stacks that release flammables to the atmosphere and on 

inadequately sized disposal drums. The CSB further recommended that states that administer their own 

OSHA plan implement comparable emphasis programs within their jurisdictions. 

Additional Recommendations from July 28, 2005, Incident 

The CSB also made two recommendations as a result of its investigation of the July 28, 2005, incident in 

the Resid Hydrotreating Unit (RHU) of the BP Texas City refinery, one of two incidents after the March 

23, 2005, incident.12 The RHU had a major fire that resulted in a shelter-in-place for 43,000 people and a 

reported $30 million in plant property damage. In October 2006, the CSB released a Safety Bulletin on 

the findings of its investigation of the incident, available at www.csb.gov. 

1.8 Organization of the Report 

Section 2 describes the events in the ISOM startup that led to the explosion and fires. Section 3 analyzes 

the safety system deficiencies and human factors issues that impacted unit startup. Sections 4 through 8 

assess BP’s systems for incident investigation, equipment design, pressure relief and disposal, trailer 

siting, and mechanical integrity. Because the organizational and cultural causes of the disaster are central 

to understanding why the incident occurred, BP’s safety culture is examined in these sections. Section 9 

details BP’s approach to safety, organizational changes, corporate oversight, and responses to mounting 

safety problems at Texas City. Section 10 analyzes BP’s safety culture and the connection to the 

management system deficiencies. Regulatory analysis in Section 11 examines the effectiveness of 

12 On August 10, 2005, the BP Texas City refinery experienced the third major mechanical integrity-related incident 

of that year, this one in the Cat Feed Hydrotreating Unit (CFHU); it resulted in a shelter-in-place order and $2 

million in property damage. 
BP Texas City Final Investigation Report 3/20/2007 

30 

OSHA’s enforcement of process safety regulations in Texas City and other high hazard facilities. The 

investigation’s root causes and recommendations are found in Sections 12 and 13. The Appendices 

provide technical information in greater depth. 
BP Texas City Final Investigation Report 3/20/2007 

31

 

2.0 INCIDENT OVERVIEW 

2.1 BP Corporate and Texas City Refinery Background 

On March 23, 2005, an explosion and fires occurred at the BP refinery in Texas City, Texas, 30 miles 

southeast of Houston. The refinery, the company’s largest worldwide, can produce about 10 million 

gallons of gasoline per day (about 2.5 percent of the gasoline sold in the United States) for markets 

primarily in the Southeast, Midwest, and along the East Coast. It also produces jet fuels, diesel fuels, and 

chemical feed stocks; 29 oil refining units and four chemical units cover its 1,200 acre site. The refinery 

employs approximately 1,800 BP workers, and at the time of the incident, approximately 800 contractor 

workers were onsite supporting turnaround13 work. The site has also had numerous changes in 

management at both the refinery and corporate levels. (Appendix D provides details on how the site 

changed from its commissioning to the date of the explosion.) 

The Texas City facility is one of five U.S. refineries owned by BP; its others are in Whiting, Indiana; 

Carson, California; Cherry Point, Washington; and Toledo, Ohio. 

2.2 ISOM Unit Process 

The incident occurred while a section of the refinery’s ISOM unit was being restarted after a maintenance 

turnaround that lasted one month. The ISOM unit, installed at the refinery in the mid-1980s to provide 

higher octane components for unleaded gasoline, consists of four sections: an Ultrafiner14 desulfurizer, a 

13 In petroleum refining, a turnaround is the shutdown of a process unit after a normal run for maintenance and 

repair, then putting the unit back into operation (Parker, 1994). 

14 Ultrafining is a licensed process developed by Standard Oil of Indiana to desulfurize and hydrogenate refinery 

feedstocks from naphtha to lubrication oils using a regenerative fixed-bed catalyst. 
BP Texas City Final Investigation Report 3/20/2007 

32 

 

Penex15 reactor, a vapor recovery/liquid recycle unit, and a raffinate splitter. Isomerization is a refining 

process that alters the fundamental arrangement of atoms in the molecule without adding or removing 

anything from the original material. At the BP Texas City refinery, the ISOM unit converted straightchain normal pentane and hexane into higher octane branched-chain isopentane and isohexane for 

gasoline blending and chemical feedstocks. (Appendix E provides historical information on the ISOM 

unit and the refinery.) 

2.2.1 Raffinate Splitter Section 

On the day of the incident, the startup of the ISOM raffinate splitter section was initiated. It was during 

this startup that the tower was overfilled with liquid. This section describes the relevant equipment 

involved in the startup on March 23, 2005. 

The raffinate splitter section took raffinate -- a non-aromatic, primarily straight-chain hydrocarbon 

mixture -- from the Aromatics Recovery Unit (ARU) and separated it into light and heavy components. 

About 40 percent of the raffinate feed was recovered as light raffinate (primarily pentane/hexane). The 

remaining raffinate feed was recovered as heavy raffinate, which was used as a chemicals feedstock, JP-4 

jet fuel, or blended into unleaded gasoline. The raffinate splitter section ccould process up to 45,000 

barrels per day (bpd)16 of raffinate feed. 

15 Penex is a licensed fixed–bed process developed by Universal Oil Products (UOP) that uses high-activity 

chloride-promoted catalysts to isomerize C5/C6 paraffins to higher octane branched components. 

16 One barrel equals 42 US gallons, or 159 liters. 
BP Texas City Final Investigation Report 3/20/2007 

33

 

The process equipment in the raffinate splitter section (Figure 1) consisted of a feed surge drum; a 

distillation tower; a furnace with two heating sections, one used as a reboiler for heating the bottoms of 

the tower and the other preheating the feed; air-cooled fin fan condensers and an overhead reflux drum; 

various pumps; and heat exchangers. (Appendix E provides details on the history of the raffinate splitter 

section.) 

2.2.2 Raffinate Splitter Tower 

The tower was a vertical distillation column with an inside diameter of 12.5 feet (3.8 m) and height of 170 

feet (52 m) with an approximate liquid-full volume of 154,800 gallons (586,100 liters). The tower was 

fitted with 70 distillation trays17 that separated the light from the heavy raffinate (Figure 1). 

17 A distillation tray has an opening at one end called a downcomer that allows liquid to flow down from the tray, 

and a series of bubble caps that allow vapors to pass through from below. Hydrocarbon liquid enters the tray from 

the downcomer of the tray above. The liquid entering the tray is aerated with the vapor rising from the tray below 

that is flowing through the bubble caps to form froth on the tray. The froth flows across the tray until it reaches an 

outlet weir. The froth flows over the weir into the downcomer, where the vapor is disengaged from the liquid 

(Kister, 1990, pg. 267). 
y Final Investigation Report 

34 

Figure 1. Raffinate section of the ISOM

BP Texas Cit
BP Texas City Final Investigation Report 3/20/2007 

35

 

Liquid raffinate feed was pumped into the raffinate splitter tower near the tower’s midpoint. An automatic 

flow control valve adjusted the feed rate. The feed was pre-heated by a heat exchanger using heavy 

raffinate product and again in the preheat section of the reboiler furnace, which used refinery fuel gas. 

Heavy raffinate was pumped from the bottom of the raffinate splitter tower and circulated through the 

reboiler furnace, where it was heated and then returned below the bottom tray. Heavy raffinate product 

was also taken off as a side stream at the discharge of the circulation pump and sent to storage. The flow 

of this side stream was controlled by a level control valve that, when placed in “automatic,” adjusted to 

maintain a constant level in the tower. The splitter tower was equipped with a level transmitter, which 

provided a reading of liquid level in the tower to the control room board operator.18 The transmitter 

measured the tower’s liquid level in a 5-foot (1.5-m) span within the bottom 9 feet (2.7 m) of the 170-foot 

(52-m) tall tower.The splitter tower also had two separate alarms that indicated high liquid level; one was 

programmed to sound when the transmitter reading reached 72 percent (a height of 7.6 feet or 2.3 meters 

in the tower). The second, a redundant hardwired high level switch,19 was designed to sound when the 

liquid level reached 7.9 feet (2.4 m) in the tower (which corresponded to a reading of approximately 78 

percent on the transmitter).The raffinate splitter was also fitted with a redundant low level alarm. 

The heavy raffinate product side stream flowed through two heat exchangers, one that exchanged heat 

from the heavy raffinate with the colder incoming feed to the raffinate splitter, and a second that cooled 

the heavy raffinate feed using water, before the heavy raffinate was sent to storage or blending tanks. 

18 This reading was also used by the computerized control board system to adjust the position of the level control 

valve. 

19 The redundant hardwired high level switch was an independent instrument not connected to the level transmitter. 
BP Texas City Final Investigation Report 3/20/2007 

36 

ief 

 

Light raffinate vapors flowed overhead and down a 148-foot (45-m) long section of pipe before they were 

condensed by the air-cooled fin fan condensers and then deposited into a reflux drum. Liquid from the 

reflux drum, called “reflux,” was then pumped back up into the raffinate splitter tower above tray 1 (the 

top tray). The reflux drum was operated as a “flooded” drum, which means that during normal steadystate operation, it was kept completely full. The reflux drum also had high and low level alarms and a 

safety relief valve set at 70 psig (483 kPa). A bypass line, which discharged into the raffinate splitter 

disposal header collection system, allowed release of non-condensable gas (e.g. nitrogen) and purge the 

system. During startup, uncondensed vapors that built up in the drum were normally vented through a 

control valve to the refinery’s 3-pound purge and vent gas system (Figure 1). This control valve 

malfunctioned and was not used during the March 23, 2005, startup. 

2.2.3 Safety Relief Valves 

To protect the raffinate splitter tower from overpressure, three parallel safety relief valves (Figure 2) were 

located in the overhead vapor line 148 feet (45 m) below the top of the tower. The outlet of the relief 

valves was piped to a disposal header collection system that discharged into a blowdown drum fitted with 

a vent stack. 

The set pressures on these relief valves were 40, 41, and 42 psig (276, 283, and 290 kPa), respectively. 

An 8-inch NPS20 (8.625-inch, 21.9 cm outer diameter) line, fitted with a manual chain valve, bypassed 

the safety relief valves and was used to release non-condensable gases and for system purging. The rel

valves were designed to open and discharge primarily vapor into the raffinate splitter disposal header 

collection system when their set pressures were exceeded. 

20 NPS, or nominal pipe size, is a set of standard pipe sizes used for pressure piping in North America. 
BP Texas City Final Investigation Report 3/20/2007 

37

2.2.4 Disposal Header Collection Systems 

The disposal header collection system received liquid and/or vapor hydrocarbons from venting relief and 

blowdown valves from equipment in the ISOM unit and discharged them to the blowdown drum. The 

header collection system included a 14-inch NPS (35.6 cm outer diameter) elevated pipe about 885 feet 

(270 m) long from the raffinate splitter tower (Figure 2). Other sections of the ISOM unit also discharged 

from two additional collection headers into the blowdown drum. 

Figure 2. Disposal collection header system 

2.2.5 Blowdown Drum and Stack 

The blowdown drum and stack were designed to accept mixed liquid and/or vapor hydrocarbons from 

venting relief and blowdown valves during unit upsets or following a unit shutdown. In normal operation, 
BP Texas City Final Investigation Report 3/20/2007 

38 

 

light hydrocarbon vapors disengage from liquids, rise through a series of baffles, and disperse out the top 

of the stack into the atmosphere. Any liquids or heavy hydrocarbon vapors released into the drum either 

fall, or condense and then fall, to the bottom of the drum where they collect. Liquid would then be 

discharged from the base of the blowdown drum into the ISOM unit sewer system because a 6-inch NPS 

(6.625 inches; 15.24 cm outer diameter) manual block valve was chained open (Figures 3 and 4). This 

practice of discharging to the sewer was unsafe; industry safety guidelines recommend against 

discharging flammable liquids that evaporate readily into a sewer.21

The blowdown system, installed in the refinery in the 1950s, was a vertical drum with an inside diameter 

of 10 feet (3 m) and is 27 feet (8 m) tall. (Appendix E provides additional information on the blowdown 

system’s history.) The drum wais fitted with a 34-inch (86 cm) diameter stack that discharged to the 

atmosphere at a height of 119 feet (36 m) off the ground. The approximate liquid full volume of the 

blowdown drum and stack was 22,800 gallons (86,200 L). The drum had seven internal baffles; the 

disposal collection header systems from the ISOM unit discharged into the drum below the lowest baffle. 

A liquid level, normally water, was maintained in the bottom of the blowdown drum. The height of this 

level was controlled by a “gooseneck” seal leg piped to a closed drain (Figure 3 and 4). 

A level sight glass was available to monitor the water level and a high level alarm was set to activate 

when the liquid level in the drum was close to flowing over the top of the gooseneck seal leg. A second 

manual block valve was located in a branch line of the blowdown drum discharge pipe (Figure 3). 

Following this valve, which was normally closed, was a manual steam-driven pump and a light slop 

tank.22

21 American Petroleum Institute (API) 1997. Guide for Pressure-Relieving and Depressuring Systems, API 

Recommended Practices 521, p. 52. 

22 A slop tank is a tank designated for collecting equipment drainings, tank washings, and other oily mixtures. 
BP Texas City Final Investigation Report 3/20/2007 

39

Figure 3. Blowdown drum and gooseneck 
BP Texas City Final Investigation Report 3/20/2007 

40 

Figure 4. Left: Gooseneck piping and manual block valve (chained-locked open) Right:: Close-up of 

manual block valve 

2.2.6 ISOM Unit Sewer System 

While liquid raffinate discharged out the top of the blowdown stack, it also flowed into the process sewer 

system and into the west diversion box and oil/water separator, both fitted with high- and high-high level 

alarms. 

2.3 Turnaround Activities 

In early 2005, two major turnarounds were underway on units adjoining the ISOM unit. 

2.3.1 Ultracracker Unit and Aromatics Recovery Unit Turnaround 

Ultracracker unit (ULC) contractors were supporting a turnaround and BP sited a number of trailers for 

the contractors in the area next to the ISOM unit (Figure 5). (Appendix F provides further information on 

the location, construction, and use of these trailers.) The Aromatics Recovery Unit (ARU), which 
BP Texas City Final Investigation Report 3/20/2007 

41

.

 

provides feedstock to the ISOM unit, was also undergoing a turnaround supported by contractors. These 

two turnarounds greatly increased the number of contractor and BP personnel in the area. 

2.3.2 Partial ISOM Unit Shutdown 

The raffinate splitter section of the ISOM unit was shut down on February 21, 2005, and the raffinate 

splitter tower was drained, purged, and steamed-out to remove hydrocarbons (Table 1). At the time of the 

incident most of the scheduled maintenance tasks had been completed on the raffinate splitter section, but 

the Penex reactor, in a separate section of the unit, was awaiting delivery of a gasket. When BP decided to 

start up the raffinate splitter section, three contractor crews were still working inside the battery limits23

of the ISOM unit: one crew was waiting to install the gasket on the Penex reactor, the second was 

removing some asbestos, and the third was painting equipment inside the unit. Employees from all three 

crews were injured as a result of the explosion and fire

23 The battery limit is an area in a refinery or chemical plant encompassing a process unit or battery of units with 

their related utilities and services (Parker, 1994). 
y Final Investigation Report 

42 

Figure 5. Refinery layout of the area surrounding the ISOM unit 

BP Texas Cit
BP Texas City Final Investigation Report 3/20/2007 

43

Table 1. Timeline of events from ISOM unit shutdown to March 23 incident 

Date Time Events 

21-Feb-05 Raffinate splitter section of the ISOM unit is shut down; the 12-hour consecutive day shift schedule begins 

26-Feb-05 Operators try to open/close the pressure control (3-pound) valve from the control board; valve is unresponsive 

10-Mar-05 

A revised work order to replace leaking isolation valves is added to the list of turnaround work so that the level 

transmitter can be fixed 

22-Mar-05 Operators again try to open/close the 3-pound valve from the control board, but valve is unresponsive 

22-Mar-05 

Supervisor A tells instrument technicians to stop checking the critical alarms because the unit is starting up and 

there is not enough time to complete the checks 

23-Mar-05 2:15 a.m. The Night Lead Operator begins filling the tower with raffinate feed from the satellite control room 

23-Mar-05 3:09 a.m. The tower high level alarm sounds when the level in the tower reaches 7.6 ft in the tower (72% on the transmitter) 

23-Mar-05 The redundant high level alarm switch does not sound when the tower level reaches 7.9 ft (78% on transmitter) 

23-Mar-05 

The Night Lead Operator fills the tower, stopping when the transmitter reads 99%, which should have been 8.95 ft 

(2.7 m) in the tower, but is actually 13.3 ft (4 m) 

23-Mar-05 5:00 a.m. The Night Lead Operator leaves the refinery a little over an hour before his scheduled shift leave time 

23-Mar-05 6:06 a.m. The Day Board Operator arrives at the refinery 

23-Mar-05 6:23 a.m. The Night Board Operator leaves the refinery 

23-Mar-05 7:15 a.m. Supervisor A arrives for his shift 

23-Mar-05 9:27 a.m. Operators open 8-inch NPS chain valve to remove nitrogen; the pressure in the tower drops to near 0 psig (0 kPa) 

23-Mar-05 A verbal miscommunication occurs between operations personnel regarding feed-routing instructions 

23-Mar-05 9:40 a.m. The Day Board Operator opens the tower level control valve to 70% output for 3 minutes, then closes the valve 

23-Mar-05 9:51 a.m. Startup of the raffinate unit recommences and the tower begins receiving more feed from the ARU 

23-Mar-05 

The Day Board Operator observes a 97% transmitter reading (which should have been an 8.85 ft, or 2.7 m, tower 

level) when he starts circulation 

23-Mar-05 9:55 a.m. Two burners are lit in the raffinate furnace 

23-Mar-05 10:47 a.m. 

Supervisor A leaves the refinery due to a family emergency; no supervisor or technically trained personnel 

replaces him 

23-Mar-05 11:16 a.m. 

Two additional burners in the furnace are lit; the level transmitter reads 93%, which should have been a tower 

level of 8.65 ft (2.6 m); but is actually 67 ft. (20 m) 

23-Mar-05 11:50 a.m. Fuel to the furnace is increased; the actual tower level is 98 ft, but the transmitter reads 88% (8.4 ft.; 2.6 m) 

23-Mar-05 12:41 p.m. 

The tower's pressure rises to 33 psig (228 kPa); operators reduce pressure by opening the 8-inch NPS chain 

valve 

23-Mar-05 12:42 p.m. Fuel gas to the furnace is reduced; the actual tower level is 140 ft (43 m), but transmitter reads 80% (8 ft; 2.4 m) 

23-Mar-05 12:42 p.m. 

The Day Board Operator opens the tower level control valve to 15% output, then tries several times to increase 

output over the next 15 min. 

23-Mar-05 12:45 p.m. Approximately 25 people attend a safety meeting in the main control room until ~1:10 p.m. 

23-Mar-05 12:59 p.m. Heavy raffinate flow out of the unit finally begins 

23-Mar-05 1:02 p.m. Heavy raffinate flow out of the tower matches the flow of raffinate into the unit 

23-Mar-05 1:04 p.m. The actual level in the tower is 158 ft (48 m) but transmitter reading has declined to 78% (a level of 7.9 ft; 2.4 m) 

23-Mar-05 1:11 p.m. Supervisor A and Lead Operator talk; Supervisor suggests opening a bypass valve to relieve tower pressure 

23-Mar-05 1:14 p.m. 

Hydrocarbon flows out of the tower into overhead piping; tower pressure spikes to 63 psig (434 kPa); all three 

relief valves open 

23-Mar-05 

The Board Operator begins troubleshooting the pressure spike; he notices the drum alarm had not sounded, so 

he resumes moves to reduce pressure believing there is a residual buildup of noncombustibles in the tower 

23-Mar-05 1:15 p.m. Fuel gas to the furnace is reduced 

23-Mar-05 1:16 p.m. The Board Operator fully opens the heavy raffinate level control valve 

23-Mar-05 1:17 p.m. The overhead reflux pump is started by outside operators 

23-Mar-05 1:19:59 p.m. The Day Lead Operator shuts off fuel gas to the furnace from the satellite control room 

23-Mar-05 1:20:04 p.m. Vapor cloud ignites and explodes 
BP Texas City Final Investigation Report 3/20/2007 

2.4 The Hazards of Unit Startup 

Process unit startup is a significantly more hazardous period compared to normal oil refinery operations. 

BP’s Texas City policies and procedures acknowledged that process unit startup is especially hazardous, 

and as such, BP’s process safety guidelines recommended that “supplementary assistance” be provided, 

such as experienced supervisors, operating specialists, or technically trained personnel during unit 

startups and shutdowns. 24 A basis for this policy was a previous explosion at Texas City during startup. 

The guidelines state that startup and shutdown are two of the most critical periods of plant operations,25

and that these critical periods experience unexpected and unusual situations.26 In 1996, Amoco analyzed 

data from 15 years of operations and concluded that incidents during startups were 10 times more likely 

than during normal operation. 27 Despite these guidelines and increased risks, BP did not have 

supplementary assistance personnel actively involved in the ISOM startup. 

2.5 Incident Description 

The incident occurred during the startup of the raffinate splitter section of the ISOM unit when the 

raffinate splitter tower was overfilled. Flammable liquid was released, vaporized, and ignited, resulting in 

 

24 “Supervisory Personnel—Startups and Shutdowns,” Process Safety Guideline No. 4, 1997. This guideline was 

labeled as an Amoco Petroleum Products document; however, BP had adopted Amoco’s Texas City refinery 

heritage policies and procedures after the 1999 merger. 

25 See Safe Ups and Downs for Process Units, BP Process Safety Series (IChemE, 2005):“History shows that most 

of the serious refinery fires and explosions have occurred on units during startups and shutdowns,” p. 3. 

26 Not only BP, but industry safety guidelines, recognize that startups are hazardous. The Center for Chemical 

Process Safety (CCPS), an industry-sponsored affiliate of the American Institute of Chemical Engineers that 

publishes widely recognized process safety guidelines, has determined that plant startup is when the majority of 

process safety incidents occur. CCPS states that even though startup represents only a small portion of the 

operating life of a plant, process safety incidents occur five times more often during startup than during normal 

operations. The 1998 Equilon Refinery accident in Anacortes, WA, with six fatalities; the United Kingdom 1994 

Texaco Milford Haven explosion and fire; and the 2000 BP Grangemouth FCC unit fire are examples of major 

accidents that occurred during plant startup. Guidelines for Safe Process Operations and Maintenance (CCPS, 

1995); p.113 citing Large Property Damage Losses in the Hydrocarbon-Chemical Industries. Marsh McLennan, 

14th edition, New York, NY, 1992. 

27 Memo from the Director of Refining Process Safety, “Incident Rates for Amoco Process Units—Startups and 

Shutdowns Versus Normal Operations;” May 1, 1996. 

44 
BP Texas City Final Investigation Report 3/20/2007 

45

 

an explosion and fire. The following section describes the events leading up to the incident, the resulting 

damage, and the emergency response activities. 

2.5.1 Unit Staffing 

When the ISOM unit was in normal operation, it and two other units were run by a board operator and 

three outside operators.28 The outside operators were assigned to either the ISOM unit; the naphtha 

desulfurization unit (NDU); or the aromatics unit no. 2 (AU2). One board operator monitored all three 

from a central control room located in the AU2 (Figure 5). Each crew also had a frontline supervisor and 

a process technician (PT). Table 2 lists significant persons involved in unit startup. 

While the ISOM unit was shut down, the operators were on a turnaround schedule and split into two 

crews working 12-hour shifts, which would continue for the duration of the shutdown and until the unit 

was back to normal operation after the shutdown. The ISOM day shift crew consisted of one board 

operator and five outside operators. The Day Shift Board Operator had six years experience operating the 

control board, including four startups in the last five years. Two of the five outside operators had over 15 

years ISOM experience. One of these two operators was the Day Lead Operator, and had more than nine 

years of mostly board operator experience but was assigned to an outside operator role for the startup. 

This operator had been elevated to a lead position for the turnaround, but was not clearly assigned 

responsibility for leading the startup. The Day Lead Operator coordinated his tasks from the ISOM unit’s 

satellite control room (Figure 5), which had a computer system that allowed him to monitor the ISOM 

control board. 

28 As the NDU, AU2, and ISOM normally operate continuously, a total of four crews working rotating 12-hour 

shifts is needed to staff the units. The four frontline supervisors, an operations coordinator, a turnaround 

coordinator, and a training coordinator report to the unit superintendent. The coordinators and superintendent 

work the day shift. 
BP Texas City Final Investigation Report 3/20/2007 

46 

Table 2. Individuals involved in the March 23, 2005, startup 

Job Position Description 

Texas City Managers Managers above the frontline supervisor level 

Shift Director Site operations coordinator responsible for executing the daily operation plan 

Process Technician 

(PT) 

Experienced operators who held floating positions, performing tasks as needed, 

including assisting on the control board or outside operators in the process units. 

Night Supervisor Frontline supervisor involved in the turnaround activities of the ARU during the 

night shift prior to the incident 

Day Supervisor A ISOM-experienced frontline supervisor; left the refinery for a family emergency 

Day Supervisor B Inexperienced frontline supervisor for AU2/ISOM/NDU complex and the ARU; 

involved primarily in turnaround activities of the adjacent unit 

Night Lead Operator Began the startup process in the satellite control room during the early morning 

hours of March 23 

Day Lead Operator ISOM-experienced board operator working as an outside operator during 

turnaround; responsible for managing contractors, finding replacement equipment 

for ISOM, and training two new operators 

Night Board Operator Controlled the NDU and AU2 units in the centralized control room during the shift 

prior to the incident 

Day Board Operator Responsible for monitoring and controlling the AU2,NDU, and ISOM units, 

including the raffinate section startup, on March 23 from a centralized control 

room in the AU2 unit 

Outside Operators Operators performing manual tasks on unit equipment 

Operations Personnel Operators and frontline supervisors 

The other experienced outside operator had little board operator experience. The three remaining outside 

operators were inexperienced; one had worked in the ISOM for seven months, and two were unit trainees. 

The shift started with two supervisors: one with 20 years ISOM experience, the second with none. 

The two PTs typically assigned to the ISOM/NDU/AU2 unit were delegated to work in the ARU; these 

experienced and knowledgeable operators did not help with the ISOM unit startup. The startup of the 

raffinate section of the ISOM unit took place over two shifts: the night shift on March 22, 2005, and the 

day shift that began at 6 a.m. on March 23. 
BP Texas City Final Investigation Report 3/20/2007 

47

2.5.2.1 

 

2.5.2 Preparations for the ISOM Startup 

A number of safety-critical steps were required prior to introducing hydrocarbons into the splitter tower. 

These steps, as listed in the startup procedures, included completing maintenance work, performing 

required safety reviews, checking equipment, and ensuring that utilities, control valves, and other 

equipment were functioning and correctly aligned. 

Pre-Startup Safety Review (PSSR) 

BP had used a rigorous pre-startup procedure prior to the incident that required all startups after 

turnarounds to go through a PSSR.29 While the PSSR had been applied to unit startups after turnarounds 

for two years prior to this incident, the process safety coordinator responsible for an area of the refinery 

that includes the ISOM was unfamiliar with its applicability, and therefore, no PSSR procedure was 

conducted. If the PSSR, which called for a formal safety review by a technical team led by the operations 

superintendent, had been implemented, a technical team would have verified the adequacy of all ISOM 

safety systems and equipment, including procedures and training, process safety information, alarms and 

equipment functionality, and instrument testing and calibration. The PSSR required sign-off that all nonessential personnel had been removed from the unit and neighboring units and that the operations crew 

had reviewed the startup procedure. Higher level management, such as the Texas City Operations 

Manager and Process Safety Manager, were required to sign off on the PSSR checklists and authorize the 

startup. However, none of the PSSR procedural steps were undertaken for the ISOM startup. 

29 The BP Texas City “Formal Pre-Startup Safety Review” policy (marked “For Comment”), PSM-7.0, required a 

formal PSSR prior to startup following a turnaround. The policy defined a turnaround “as any shutdown that 

requires feed to be pulled from the unit or a section of the unit and equipment to be prepared or opened for 

maintenance.” The ISOM raffinate section maintenance work prior to the March 23, 2005, incident would qualify 

as a turnaround under this policy. Equipment, such as the E-1101 splitter tower and the F-1101 feed surge drum, 

was deinventoried, steamed-out, and opened for maintenance. While PSM-7.0 was not formally adopted until 

after the incident, it had been applied to the startups after turnarounds for the two years prior to the ISOM 

incident. 
BP Texas City Final Investigation Report 3/20/2007 

48 

2.5.2.2 

 

Needed Pre-Startup Instrumentation and Equipment Repairs 

During pre-startup equipment checks, key splitter tower instrumentation and equipment were identified as 

malfunctioning but were not repaired. During the ISOM turnaround, operations personnel reported to 

turnaround supervisors that the splitter level transmitter and level sight glass needed repair.30 This 

equipment could not be repaired when the unit was operating, as the block valves needed to isolate the 

level transmitter and the sight glass from the process were leaking. As a result, on March 10, 2005, a 

revised work order was issued that added replacement of the isolation block valves to the turnaround job 

list. The level transmitter was not repaired because BP supervisors determined that there was too little 

time to complete the job in the existing turnaround schedule. The isolation valves were replaced during 

the turnaround; BP supervisors planned to repair the level transmitter after the startup. 

Both during unit shutdown and the equipment checks in the days preceding raffinate splitter startup, 

operations personnel found that a pressure control valve31 was inoperable. On February 26 and March 22, 

2005, operators tried to open and close the control valve from the control board, but the outside operators 

saw that it did not move. The malfunctioning control valve was reported to a frontline supervisor; 

however, no work order was written and no repairs were made prior to startup. This same frontline 

supervisor signed off on the startup procedure that all control valves had been tested and were operational 

prior to startup. 

A functionality check of all alarms and instruments was also required prior to startup, but these checks 

were not completed. On March 22, 2005, instrument technicians had begun checking the critical alarms 

when a supervisor told them that the unit was starting up and there was no time for additional checks. 

30 The raffinate splitter tower level transmitter was reported by operations personnel as providing inaccurate 

readings and needing calibration. The tower sight glass was reported as dirty on the inside of the glass so that the 

tower level could not be visually determined. 

31 The raffinate splitter tower pressure control valve, PV-5002, vents pressure and non-condensable gases to the 3-

pound plant gas system from the reflux drum and splitter tower during startup but does not control pressure during 

normal operation. 
BP Texas City Final Investigation Report 3/20/2007 

49

ng 

 

While some alarms were tested, most were not prior to startup. The supervisor, however, initialed on the 

startup procedure that those checks had been completed. 

Other key safety preparations listed in the startup procedures were omitted or ineffectively carried out. 

BP guidelines state that unit startup requires a thorough review of startup procedures by operators and 

supervisors;32 however, this review was not performed. The procedure also called for adequate staffing 

for the startup and that any unsafe conditions be corrected. Both of these steps were initialed as bei

completed by a unit trainee at the direction of his supervisor. 

2.5.3 Initial Tower Filling and Shutdown 

BP supervision decided to initiate the startup of the ISOM unit raffinate section during the night shift on 

March 22, 2005. This decision was consistent with prior email communications by area supervision 

directing the turnaround work, stating that the raffinate section would be started when the ARU had 

returned to operation.33 However, after the startup was begun, it was stopped and the raffinate section was 

shut down to be re-started during the next shift. Starting, but then stopping, the unit was unusual and not 

covered in the startup procedures, which only addressed one continuous startup. 

The Night Lead Operator controlled filling the raffinate section from the satellite control room because it 

was close to the process equipment. The Night Board Operator controlled the other two process units 

from the central control room. The Night Lead Operator did not use the startup procedure or record 

completed steps for the process of filling the raffinate section equipment, which left no record of the 

startup steps completed for the operators on the next shift. 

32 Safe Ups and Downs for Process Units, BP Process Safety Series (IChemE, 2005); p. 28. 

33 The ARU had just been started up from a major turnaround and some ARU operational problems were still being 

addressed. 
BP Texas City Final Investigation Report 3/20/2007 

50 

 

As stated earlier, the splitter tower was equipped with a level transmitter that measured the tower’s liquid 

level in a 5-foot (1.5 m) span within the bottom 9 feet (2.7 m) of the 170-foot (52-m) tall tower. The 

splitter tower also had two separate alarms; one was programmed to sound when the transmitter reading 

reached 72 percent (a height of 7.6 feet or 2.3 meters in the tower), and the other was a redundant high 

level alarm that was designed to sound when tower level reached 7.9 feet or 2.4 meters (an approximate 

transmitter reading of 78 percent). However, when the raffinate splitter tower was filled beyond the set 

points of both alarms to a level reading of 99 percent on the transmitter in the early morning on March 23, 

2005,34 only one alarm was activated. The high level alarm was triggered at 3:09 a.m.. The redundant 

hardwired high level alarm never sounded. Material balance calculations conducted post-incident 

determined that the tower had actually filled to 13 feet (4 m), four feet over the top tap of the level 

transmitter. Because the failure of the high level switch was unnoticed, it was not reported by the Night 

Lead Operator or other operations personnel; consequently, no work order was written and the 

malfunction was not noted in the logbook. The high level alarm associated with the level transmitter 

remained in the alarmed state throughout the incident. 

Filling the bottom of the tower until the level transmitter read 99 percent was not unusual, even though 

the startup procedure called for the level in the tower to be established at a 50 percent transmitter reading. 

Operations personnel explained that additional liquid level was needed in the tower because in past 

startups the level would typically drop significantly. To avoid losing the liquid contents of the tower and 

potentially damaging equipment, board operators typically operated the tower level well above 50 

percent. 

34 At 1:57 a.m., liquid hydrocarbons from the ARU were introduced into the raffinate section equipment; at 2:15 

a.m., hydrocarbon feed was flowing to the raffinate splitter tower and the liquid level began to rise at 2:27 a.m. 
BP Texas City Final Investigation Report 3/20/2007 

51

 

Once the raffinate section equipment was filled, the startup was stopped and the splitter tower feed and 

bottoms pumps shut off. The circulation was shut down and the tower level control valve remained in the 

“closed” position for the next shift to resume the startup.35 

2.5.4 Inadequate Shift Turnover 

Shortly before 5:00 a.m. on March 23, 2005, the Night Lead Operator left the Texas City refinery 

approximately an hour before his scheduled shift end time. He told his supervisor and the Night Board 

Operator that he was leaving, and briefly described the actions he had taken in the satellite control room. 

The following entry was added to the centralized control room logbook: “ISOM: Brought in some raff to 

unit, to pack raff with.”36 

When the Day Board Operator changed shifts in the central control room with the Night Board Operator 

shortly after 6:00 a.m., he received very little information on the state of the unit. The Day Board and 

Night Board Operators spoke to each other, but because the Night Board Operator was not the one who 

filled the tower, he provided few details about the night shift’s raffinate section startup activities other 

than what was written in the logbook. 

The Day Board Operator read the logbook and interpreted the entry to mean that liquid was added only to 

the tower; the Day Board Operator, in post-incident testimony, said that he was unaware that the heat 

exchangers, the piping, and associated equipment had also been filled during the previous shift. The 

ISOM-experienced Day Supervisor, Supervisor A, arrived for his shift at approximately 7:15 a.m., more 

than an hour late, and did not conduct shift turnover37 with any night shift personnel. 

35 These actions were not part of the startup procedure, which instructed that, after a level was established in the 

splitter tower, the tower level control valve was to be placed in “automatic” and set at 50 percent to establish 

heavy raffinate flow from the bottom of the tower to storage. 

36 The term “pack” is jargon used in the refinery; to “pack” a piece of equipment is to fill it with product; in this 

case, with liquid raffinate feedstock. 

37 Shift turnover is when the operator of the outgoing shift shares information with the operator of the incoming shift 

regarding the current status of the unit and any problems or concerns noted during that shift. 
BP Texas City Final Investigation Report 3/20/2007 

52 

 

2.5.5 Raffinate Tower Startup 

On the morning of March 23, the raffinate tower startup began with a series of miscommunications. The 

early morning shift directors’ meeting discussed the raffinate startup, and Day Supervisor B, who lacked 

ISOM experience, was told that startup could not proceed because the storage tanks that received raffinate 

from the splitter tower were believed to be full. The Shift Director stated in post-incident interviews that 

the meeting ended with the understanding that the raffinate section would not be started. This decision 

was consistent with a March 22 storage tank area logbook entry that stated the heavy raffinate tank was 

filling up.38 The instruction to not start the raffinate section was not communicated to the ISOM 

operations personnel.39 

Day Supervisor A told the operations crew that the raffinate section would be started. Because the startup 

procedure that should have provided information on the progress of the startup by the night shift was not 

filled out and did not provide instructions for a non-continual startup, the Day Board Operator had no 

precise information of what steps the night crew had completed and what the day shift was to do. 

Day Supervisor A did not distribute or review the applicable startup procedure with the crew, despite 

being required to do so in the procedure. 

Before sending additional liquid hydrocarbons to the raffinate section, outside operators opened the 8-

inch NPS chain-operated valve to remove nitrogen from the splitter tower system. At 9:27 a.m., the 

pressure in the tower dropped to near 0 psig (0 kPa). The startup procedure called for lowering system 

pressure to a minimum to help prevent over-pressuring the tower during startup by removing the nitrogen 

that remained in the system following the purging of air from the raffinate equipment. 

38 The storage tank area log book dated March 22, 2005 stated “*Filling up on RAFF 538, 36 [heavy raffinate 

storage tanks].” 

39 No BP managers other than frontline supervisors have acknowledged authorizing the startup. 
BP Texas City Final Investigation Report 3/20/2007 

53

 

Prior to re-commencing the startup, a miscommunication occurred regarding how feed and product would 

be routed into and out of the unit (Section 3.2). The Day Board Operator believed he was instructed not to 

send heavy raffinate product to storage and therefore closed the tower level control valve. However, the 

outside operators believed they were instructed not to send the light raffinate product to storage and 

manually changed the valve positions so that light raffinate would flow into the heavy raffinate product 

line. Moreover, no feed or product-routing instructions were entered into the startup procedure or the unit 

logbook. The CSB determined that the miscommunication likely concerned whether the light or heavy 

raffinate tanks were full and unavailable to receive additional liquid. 

Prior to the restart at 9:40 a.m., the Day Board Operator opened the splitter tower level control valve to 70 

percent output, and for three minutes 12,000 bpd of heavy raffinate flowed out of the tower. Then he 

closed the level control valve, which went to 0 percent output, but the heavy raffinate flow indication 

dropped only to 4,300 bpd rather than 0 bpd. The flow indication was erroneous, and little or no heavy 

raffinate flowed from the tower. Startup resumed at 9:51 a.m. Even though the Day Board Operator did 

not have the benefit of a written procedure with the completed steps initialed to indicate the exact stage of 

the startup, raffinate circulation was restarted and feed introduced into the splitter tower, which already 

had a high liquid level. 

The Day Board Operator, acting on what he believed were the unit’s verbal startup instructions and his 

understanding of the need to maintain a higher level in the tower to protect downstream equipment,40 

closed the level control valve. However, the startup procedure required the level control valve to be 

placed in “automatic” and set at 50 percent to establish heavy raffinate flow to storage. The Day Board 

Operator said that, from his experience, when the splitter tower bottoms pumps were started and 

associated equipment filled, the tower level dropped. Operations personnel stated that if the level was 

40 A loss of heavy raffinate flow out the bottom of tower had the potential to damage the furnace tubes in the fired 

heater. The raffinate furnace was equipped with a low flow alarm and furnace trip to protect the tubes against 

overheating. The trip shut down the furnace by closing the fuel gas control valve. 
BP Texas City Final Investigation Report 3/20/2007 

54 

maintained at only 50 percent, a drop in liquid level could result in losing heavy raffinate flow from the 

bottom of the tower, and that loss of flow from the tower bottom’s pump to the furnace would shut down 

the furnace and the startup process. The Day Board Operator observed a 97 percent level when he started 

circulation and thought that this level was normal; he said he did not recall observing a startup where the 

level was as low as 50 percent. At 10:10 a.m., 20,000 bpd of raffinate feed was being pumped into the 

tower and 4,100 bpd was erroneously indicated as leaving the tower through the level control valve. The 

Day Board Operator said he was aware that the level control valve was shut. After examining control 

board data, CSB concludes that there was likely no flow out of the tower at this time. 

2.5.6 Tower Overfills 

The tower instrumentation continued to show a liquid level less than 100 percent of the range of the 

transmitter. The level sight glass, used to visually verify the tower level, had been reported by operators 

as unreadable because of a buildup of dark residue; the sight glass had been nonfunctional for several 

years. Knowing the condition of the sight glass, the Day Board Operator did not ask the outside crew to 

visually confirm the level. Even though the tower level control valve was not at 50 percent in 

“automatic” mode, as required by the startup procedure, the Day Board Operator said he believed the 

condition was safe as long as he kept the level within the reading range (span) of the transmitter. 

As the unit was being heated, the Day Supervisor, an experienced ISOM operator, left the plant at 10:47 

a.m. due to a family emergency. The second Day Supervisor was devoting most of his attention to the 

final stages of the ARU startup; he had very little ISOM experience and, therefore, did not get involved in 

the ISOM startup. No experienced supervisor or ISOM technical expert was assigned to the raffinate 

section startup after the Day Supervisor left, although BP’s safety procedures required such oversight. 
BP Texas City Final Investigation Report 3/20/2007 

55

 

The Day Board Operator continued the liquid flow to the splitter tower, but was unaware that the actual 

tower level continued to rise. At 9:55 a.m., two burners were lit in the raffinate furnace,41 which preheated the feed flowing into the splitter tower and served as a reboiler, heating the liquid in the tower 

bottom (Figure 1). At 11:16 a.m., operators lit two additional burners in the furnace. While the 

transmitter indicated that the tower level was at 93 percent (8.65 feet; 2.64 m) in the bottom 9 feet of the 

tower, the CSB determined from post-incident analysis that the actual level in the tower was 67 feet (20 

m). The fuel to the furnace was increased at 11:50 a.m., at which time the actual tower level was 98 feet 

(30 m), although the transmitter indicated that the level was 88 percent (8.4 feet; 2. 6 m) and decreasing. 

At 12:41 p.m., the tower’s pressure rose to 33 pounds (psig) (228 kPa), due to the significant increase in 

the liquid level compressing the remaining nitrogen in the raffinate system. The operations crew, 

however, believed the high pressure to be a result of the tower bottoms overheating, which was not 

unusual in previous startups. In response to the high pressure, the outside operations crew opened the 8-

inch NPS chain-operated valve that vented directly to the blowdown drum, which reduced the pressure in 

the tower. 

The startup procedure called for heating the raffinate splitter tower reboiler return flow to 275°F (135°C) 

at no more than 50°F (10°C) per hour to avoid excessive pressure in the tower. However, during this 

startup the temperature of the reboiler return to the tower rose as high as 307°F (153°C), and from 10 a.m. 

to 1 p.m. the temperature increased at a rate of 73°F (23°C) per hour. In the previous five years, most of 

the 19 startups had deviated from written procedures. In the majority, the reboiler return was heated above 

275°F (135°C) and had temperature increase rates of over 100°F (38°C) per hour; in five, the reboiler 

return was heated to over 290°F (143°C); and in six of these startups, temperatures increased at rates in 

excess of 150°F (66°C) per hour. 

41 The direct fired reboiler did not allow fine control of the heating rate. Burners had to be brought on- and off-line 

manually to adjust the heating rate. 
BP Texas City Final Investigation Report 3/20/2007 

56 

ned 

 

The Day Board Operator and the Day Lead Operator agreed that the heat to the furnace should be 

reduced, and at 12:42 p.m. fuel gas flow was reduced to the furnace. At this time the raffinate splitter 

level transmitter displayed 80 percent (8 feet; 2.4 m) but the actual tower level was 140 feet (43 m). 

From 10 a.m. to 1 p.m. the transmitter showed the tower level declining from 97 to 79 percent.42 The 

Day Board Operator thought the level indication was accurate, and believed it was normal to see the level 

drop as the tower heated up. At the time of the pressure upset, the Day Board Operator became concer

about the lack of heavy raffinate flow out of the tower, and discussed with the Day Lead Operator the 

need to remove heavy raffinate from the raffinate splitter tower. None of the ISOM operators knew the 

tower was overfilling. At 12:42 p.m., the Day Board Operator opened the splitter level control to 15 

percent output, and over the next 15 minutes opened the valve five times until, at 1:02 p.m., it was 70 

percent open. However, heavy raffinate flow had not actually begun until 12:59 p.m. 

The heavy raffinate flow out of the tower matched the feed into the tower (20,500 bpd) at 1:02 p.m. and 

by 1:04 p.m. had increased to 27,500 bpd. Unknown to the operators, the level of liquid in the 170-foot 

(52 m) tower at this time was 158 feet (48 m), but the level transmitter reading had continued to decrease 

and now read 78 percent (7.9 feet; 2.4 m) (Figure 6). Although the total quantity of material in the tower 

had begun to decrease, heating the column contents caused the liquid level at the top of the column to 

continue increasing until it completely filled the column and spilled over into the overhead vapor line 

leading to the column relief valves and condenser. 

42 The level transmitter output was expressed as a percentage of the transmitter’s measurement span of 

approximately 5 feet in the bottom section of the column. 
BP Texas City Final Investigation Report 3/20/2007 

57

Figure 6. At 1:04 p.m. the liquid level in the tower was 158 feet (48 m), but the computerized control 

system indicated to operators that the level was at 78 percent of the level transmitter (7.9 feet, or 2.4 m, 

of liquid in the tower). 
BP Texas City Final Investigation Report 3/20/2007 

58 

2.5.7 Tower Overflows 

At 1:14 p.m., sub-cooled43 hydrocarbon liquid flowed out of the top of the raffinate splitter tower and into 

the vertical overhead vapor line, due to overfilling and rapid heating of the column (Figure 7). 

Figure 7. Heating of feed in the splitter tower 

Heating from the furnace had created a temperature profile in the raffinate splitter column, such that cold 

liquid was on top and hot liquid was in the lower section (Figure 7B). Bubbles of hot vapor rising through 

the column contacted the overlying cold liquid, rapidly condensing the vapor and heating the liquid. At 

the time of the incident, the resulting hot liquid reached nearly to the level of the feed inlet. Hot liquid 

 

43 A sub-cooled liquid is below its saturation temperature. The saturation temperature is the temperature that a 

substance will change from a liquid to a gas, or vice versa. 
BP Texas City Final Investigation Report 3/20/2007 

59

 

raffinate leaving from the bottom of the column after 12:59 p.m. transferred additional heat to the column 

feed through the heat exchanger, leading to rapid heating of the section of the raffinate splitter column 

above the feed inlet. By the time of the incident, most of the column was rapidly heating, although a cold 

layer of liquid remained at the top (Figure 7C). 

The increase in average column temperature reduced the density of the hydrocarbon liquid, significantly 

increasing the liquid level. As the entire column approached the boiling point of the liquid, the vapor 

bubbles accumulated instead of being rapidly condensed. The resulting increase in volume from 

vaporization caused the liquid at the column top to overflow into the vapor line (Appendix G). 

2.5.8 Safety Relief Valves Open 

As the liquid filled the overhead line, the resulting hydrostatic head44 in the line increased. The tower 

pressure (which remained relatively constant) combined with the increased hydrostatic head and exceeded 

the set pressures of the safety relief valves. The valves opened and discharged liquid raffinate into the 

raffinate splitter disposal header collection system (Figure 8). Based on valve set pressure, post-incident 

valve testing, and computerized control system data, the first safety relief valve is estimated to have 

opened at 1:13:56 p.m., followed by the second at 1:14:10 p.m., and the third at 1:14:14 p.m. Both the 

Day Board Operator in the central control room and the outside operators in the satellite control room saw 

the splitter tower pressure rising rapidly to 63 psig (434 kPa); however, interviews revealed that the 

outside operators did not hear the three splitter tower relief valves open.45 

The Day Board Operator began troubleshooting this pressure spike and announced on the unit radio that 

the blowdown drum’s high level alarm had not sounded. The operations crew again believed the 

44 Hydrostatic head is the pressure per unit area (e.g. psi) that is exerted by a column of liquid. 

45 The operators likely did not hear the relief valves open because the sound normally comes from the vapor 

escaping through the relief valves; if liquid was being released through the relief valves, the sound would be 

significantly quieter. 
BP Texas City Final Investigation Report 3/20/2007 

60 

overpressure was a result of buildup of noncondensible gases or lack of reflux. 46Computerized control 

system data shows that the Day Board Operator reduced the fuel gas to the feed preheat furnace at 1:15:30 

p.m., and fully opened the level control valve to heavy raffinate storage at 1:16:00 p.m. The Day Lead 

Operator told two outside operators to go out and start the reflux pump on the raffinate splitter; he then 

shut off the fuel gas to the furnace from the satellite control room. Computerized control system data 

showed that the overhead reflux pump was started at 1:17:14 p.m., and that the fuel gas to the furnace was 

stopped at 1:19:59 p.m.; however, the data showed that the incoming feed to the raffinate splitter was not 

stopped. 

Figure 8. Hydrostatic head of liquid in overhead piping leads to the three relief valves opening 

The minimum closing (blowdown) pressure for the three safety relief valves to stop flowing was 37.2 psig 

(256.5 kPa). Computerized control system data indicate that all three safety relief valves were fully open 

and flowing at capacity for slightly longer than six minutes. An average pressure of 61 psig (421 kPa) at 

 

46 Reflux is a part of the product stream that is returned to the process to assist in giving increased conversion or 

recovery (Parker, 1994). 
BP Texas City Final Investigation Report 3/20/2007 

61

 

the inlet to the three safety relief valves maintained the flow. Eventually, the amount of material and 

pressure in the tower overhead line decreased due to the flow through the valves, the raffinate splitter 

reflux flow, and the heavy raffinate rundown. This caused the pressure to drop and the safety relief valves 

to close after an estimated 51,900 gallons (196,500 liters) of flammable liquid flowed from the valves into 

the collection header (Appendix G.3). 

2.5.9 Hydrocarbon Liquid Flows Into Collection Header 

The flammable liquid flowed from the overhead vapor line through the safety relief valves into the 

collection header for 46 seconds then discharged into the blowdown drum47 (Appendix G.3). 

2.5.10 Flammable Liquid Flow Into ISOM Sewer System 

As the blowdown drum and stack filled, some of the flammable liquid flowed into the ISOM unit process 

sewer system through the chained-open 6-inch NPS manual block valve (Figures 3 and 4) and the other 

safety relief valve discharge pipe headers. As explained in section 2.2.5, this practice of discharging to the 

sewer was unsafe. 

The liquid flow rate from the raffinate splitter to the blowdown drum was calculated to be 509,500 

gallons per hour (gph) (1,929,000 lph), resulting in 51,900 gallons (196,500 liters) being released in the 

six minutes that the safety relief valves were open. The flow rate of liquid hydrocarbons to the sewer 

through the 6-inch NPS gooseneck pipe varied with the hydrostatic head pressure in the blowdown drum 

and stack as it filled, but when the blowdown system completely filled with liquid the peak rate was 

calculated to be 223,400 gph (Appendix G.3). 

47 The safety relief valves on the raffinate splitter were mounted approximately 50 feet (15 m) above ground level; 

therefore, once the liquid level in the blowdown stack reached an equivalent height and above, the increasing 

hydrostatic head increased the backpressure in the header, in turn decreasing the flow through the safety relief 

valves. 
BP Texas City Final Investigation Report 3/20/2007 

62 

From the gooseneck pipe, the flammable liquid flowed into a sewer line and then into West Diversion 

Box No 2. The high and high-high level alarms for this box were recorded by the computerized control 

system at 1:16 p.m. and 1:18 p.m., respectively. High and high-high level alarms were also recorded by 

the computerized control system at the dry weather sewer, which is downstream from West Diversion 

Box No. 2, at 1:17 p.m. and 1:18 p.m., respectively. 

Because the series of pipes from the diversion box to the storm sewer have flow capacities three times the 

estimated liquid flow from the base of the drum, it is unlikely the sewers backed up in the ISOM unit. 

2.5.11 Flammable Liquid Flow Out of the Blowdown Stack 

Once the blowdown system filled, flammable liquid discharged to the atmosphere from its stack as a 

geyser and fell to the ground (Figure 9). Shortly after the ISOM operators began troubleshooting the 

pressure spike, they received, via radio, the first notification that the blowdown drum was overflowing. In 

response to the radio message, the Board Operator and Lead Operator used the computerized control 

system to shut the flow of fuel to the heater, while the other operators left the satellite control room and 

ran toward an adjacent road, Avenue F, to re-direct traffic away from the blowdown drum, as required by 

BP’s “Emergency Response Procedure A-7.” 
BP Texas City Final Investigation Report 3/20/2007 

63

Figure 9. Tower overfills and blowdown drum releases hydrocarbons 

The ISOM operators stated they had insufficient time to sound the emergency alarm before the explosion. 

Approximately 15 seconds after hearing the radio message, both the Board Operator and the Lead 

Operator said they started the process of shutting off the fuel to the furnace using the computerized 

control system. Their testimony is substantiated by the computerized control system data, which showed 

that the fuel gas flow control valve was shut five seconds before the explosion. Hundreds of alarms 

registered in the computerized control system at 1:20:04 p.m., including the high level alarm on the 

blowdown drum; the flood of alarms indicates when the explosion occurred. Consequently, ISOM 

operations personnel did not have sufficient time to assess the situation and sound the emergency warbler 

alarm prior to the explosion. 
BP Texas City Final Investigation Report 3/20/2007 

64 

 

Numerous eyewitnesses48 reported seeing the geyser at the top of the blowdown stack, which they 

estimated to be approximately 20 feet (6.1 m) high and of a diameter equal to that of the blowdown stack 

(34 inches or 86 cm). 

Post-incident calculations showed that filling the blowdown drum and stack and additional safety relief 

valve headers took three minutes and 36 seconds; thus, the hydrocarbon liquid reached the top of the 

blowdown stack four minutes and 22 seconds after the safety relief valves started to flow. The 

hydrocarbon liquid flow rate out of the blowdown stack to the atmosphere was calculated to be 257,300 

gph, meaning that 7,600 gallons (28,700 liters) were released in the 107 seconds of flow before the relief 

valves closed (Appendix G.3). 

2.5.12 Flammable Vapor Cloud Formation and Fire 

The liquid hydrocarbon release time was calculated using computerized control system datapoints and the 

flow times from DIERS modeling (Appendix H). The flammable vapor cloud reached a wide area, as is 

clearly evident by the burned area shown in a post-explosion photo (Figure 10). 

The burned area is estimated to be approximately 200,000 square feet (18, 581 m2). Two mechanisms 

explain how the vapor cloud covered an area this size in such a short interval: the first was direct 

dispersion from evaporation prior to ignition that was responsible for the bulk of the dispersal, and the 

second was “pushing” of flammable vapors as subsonic flames burned through the flammable cloud. The 

hydrocarbon liquid cascading down the stack and blowdown drum coupled with the impact of the falling 

liquid onto process equipment, structural components, and piping, promoted fragmentation into relatively 

small droplets, thereby enhancing evaporation and the formation of the flammable vapor cloud (Appendix 

H.15). 

48 The CSB interviewed more than 25 people, a combination of BP and contractor employees, who were injured by 

or observed the vapor cloud explosion. 
BP Texas City Final Investigation Report 3/20/2007 

65

Atmospheric wind also helped push the vapors and small droplets downwind, causing them to mix with 

air. The wind direction at the time of the incident was reported to be out of the northwest traveling 

southeast at 5 miles (8 km) per hour and as Figure 10 shows, the burned area is elongated in that 

direction. However, portions of the vapor cloud also went upwind and cross wind (Appendix H.10.1), 

which placed the trailer area within the flammable cloud covered area. 

Figure 10. The darkened areas in and around the ISOM unit had the heaviest fire damage; the red arrow 

points to the top of the blowdown stack 

N
BP Texas City Final Investigation Report 3/20/2007 

66 

2.5.13 Ignition Source 

Although several potential ignition sources (Appendix H.16) were identified, the most likely ignition 

point was an idling diesel pickup truck (Figure 11). This truck was parked about 25 feet (7.6 m) from the 

blowdown drum, and several eyewitnesses reported seeing or hearing the truck’s engine over-revving 

when the vapor cloud reached it. 

Figure 11. Idling diesel pickup truck at north end of ISOM unit 

Two eyewitnesses saw the truck catch fire, followed shortly by the vapor cloud explosion. One 

eyewitness saw sparks leaving the truck after a backfire and igniting the vapor cloud. While the diesel 

pickup has been positively identified by witnesses as an ignition point, this does not preclude the potential 

that the cloud was additionally ignited by other sources. 

2.5.14 Blast Pressure 

Once ignited, the flame rapidly spread through the flammable vapor cloud, compressing the gas ahead of 

it to create a blast pressure wave. Furthermore, the flame accelerated each time a combination of 
BP Texas City Final Investigation Report 3/20/2007 

67

congestion/confinement and flammable mix allowed, greatly intensifying the blast pressure in certain 

areas. These intense pressure regions, or sub-explosions, produced heavy structural damage locally and 

left a pattern of structural deformation away from the blast center in all directions. A computer 

simulation49 and a blast overpressure map (Figure 12) were developed based on site observations, 

structural analysis, and blast modeling (Appendix H). 

1.0 2.0

0.5

10+

1 0

F20 Blowdown 

Unit (ISOM)

Unit (NDU)

Distillation

 Naptha

Isomerization

SPLITTER

RAFFINATE B-200

SUMP

SUMP

SUMP

2.0+

2.5+ 5+

Trailer

Double-Wide

QA/QC

Trailer

Tank and Stack

Control

Satellite

Room

0.5

Figure 12. Blast overpressure map depicting the areas of highest blast pressure (10+, 5+, and 2.5+ psi) 

2.5.15 Post-Explosion Fires 

The flame-front that burned through the vapor cloud also ignited the flammable liquid that had 

accumulated on the ground near the base of the blowdown drum, resulting in a pool fire. The fire lasted 

long enough and produced sufficiently high temperatures, in combination with firefighting water spray, to 

 

49 The computer simulation is available for viewing or downloading from the CSB website, www.csb.gov. 
BP Texas City Final Investigation Report 3/20/2007 

68 

 

cause the concrete of the pipe rack columns to spall.50 The CSB learned of several additional fires in and 

around the ISOM unit based on eyewitness interviews and review of news footage shot from local 

television station helicopters. (Appendix H-12 provides further details on the pool fire.) 

2.5.16 Fatalities and Injuries 

In the explosion, 15 contract employees working in or near the trailers sited between the ISOM and the 

NDU unit were killed. Autopsy reports revealed that the cause of death for all 15 was blunt force trauma, 

probably resulting from being struck by structural components of the trailers. Three occupants in the 

Quality Assurance/Quality Control (QA/QC) trailer perished, and 12 of 20 workers inside the doublewide trailer were killed; the others were seriously injured. 

A total of 180 workers at the refinery were injured, 66 seriously enough that they had days away from 

work, restricted work activity, or medical treatment. The majority of these suffered multiple injuries, 

typically combinations of: fractures, lacerations, punctures, strains, sprains, and/or second- and thirddegree burns. Of the seriously injured, 14 were BP employees; the rest were contractor employees from 

13 different firms. Of the 114 workers given first aid, 35 were BP employees; 79 were contract employees 

from 14 different contracting firms. None of the contract workers in the area surrounding the ISOM were 

personnel essential to the startup of the unit. 

2.5.17 Equipment and Facility Damage 

The most severe blast damage occurred within the ISOM unit, from the trailer area to the catalyst 

warehouse (Figure 13), and the surrounding parking areas. The satellite control room was severely 

damaged and the catalyst warehouse was destroyed. 

50 Spalling is a breakdown in surface tensile strength of concrete when the concrete is exposed to extreme heat, such 

as during a fire, and then rapidly cooled, such as by the water used to extinguish the fire. (NFPA, 2004, Guide for 

Fire and Explosion Investigations, NFPA 921, pg. 36). 
BP Texas City Final Investigation Report 3/20/2007 

69

Many of the approximately 70 vehicles in the vicinity of the ISOM unit were damaged and a number were 

destroyed. More than 40 trailers were damaged; 13 were destroyed. On June 30, 2006, the CSB released a 

detailed analysis of the trailer damage, which can be viewed or downloaded from the CSB website, 

www.csb.gov. 

Figure 13. Destroyed trailers west of the blowdown drum (red arrow in upper left of the figure) 

Buildings in surrounding units also had blast damage, but of a much lower magnitude. This damage was 

characterized by broken windows, cracked masonry walls, damaged doors, bent metal panels, and 

dispersal of interior contents; 50 storage tanks sustained varying degrees of structural damage, even 

though much of the tank farm was situated more than 250 feet (76 m) from the explosion. Most of the 

damage sustained by the tanks consisted of buckled tank shells, both the shell sides and the roofs (for 
BP Texas City Final Investigation Report 3/20/2007 

70 

 

those tanks with domed roofs). The explosion also damaged several tanks designed to hold hazardous 

substances, such as benzene, which allowed benzene vapors to escape.51

2.5.18 Offsite Damage 

Windows were shattered in homes and businesses located north of the refinery, up to a distance of threequarters of a mile away from the ISOM unit. 

2.5.19 Post-Incident Emergency Response 

The emergency response teams made a rapid and effective effort to help the injured and recover the 

victims. Texas City Industrial Mutual Aid System (IMAS) member companies responded and assisted 

with fire hose lines and search-and-rescue. None of the emergency response personnel were injured 

during rescue efforts. 

The blast produced a large debris field of damaged trailers and vehicles located between the NDU and 

ISOM units. To recover victims from this area, the site was necessarily disturbed by the emergency 

responders. Debris, vehicles, and equipment were moved to initiate search-and-rescue and recover the 

fatally injured. As operators and emergency responders entered the ISOM unit to isolate the plant, some 

valve positions were changed, but no records were kept to document these changes. Therefore, there was 

no record of the actual state of some of the valves at the time of the incident, information that is important 

when trying to reconstruct the incident and determine its causes.52 

51 After the incident, the liquid hydrocarbons containing benzene were pumped from the damaged tanks. On April 1, 

2005, the elevated benzene readings in the ISOM area dropped, allowing the CSB investigators to enter the site 

and inspect the incident area while wearing appropriate personal protective equipment. 

52 The CSB was able to reconstruct some of the valve position changes based on interview accounts. 
BP Texas City Final Investigation Report 3/20/2007 

71

 

3.0 SAFETY SYSTEM DEFICIENCIES IN UNIT STARTUP 

Although actions or errors by operations personnel at the BP Texas City site, as described in the 

preceding section, were immediate causes of the March 23 accident, numerous latent conditions and 

safety system deficiencies at the refinery influenced their actions and contributed to the accident. 

Addressed here are the human factors53 that explain why feed was added to the tower for three hours 

without liquid being removed. While recognizing that human errors were made in the raffinate startup, 

this investigation goes beyond individual failures to gain a deeper understanding of why the incident 

occurred, which is more useful in major accident prevention.54 Renowned process safety expert Trevor 

Kletz puts it plainly: “To say accidents are due to human failing is like saying falls are due to gravity. It is 

true but it does not help us prevent them.” The broader aspects of this investigation revealed serious 

management safety system deficiencies that allowed the operators and supervisors to fail. The following 

underlying latent conditions contributed to the unsafe start up: 

• A work environment that encouraged operations personnel to deviate from procedure. 

• Lack of a BP policy or emphasis on effective communication for shift change and hazardous 

operations (such as unit startup). 

• Malfunctioning instrumentation that did not alert operators to the actual conditions of the unit. 

53 “Human Factors refer to environmental, organizational and job factors, and human and individual characteristics, 

which influence behaviour at work in a way which can affect health and safety” (HSE, 1999). 

54 The CSB followed accepted investigative practices, such as the CCPS’s Guidelines for Investigating Chemical 

Process Accidents (1992a). Chapter 6 of the CCPS book discusses the analysis of human performance in accident 

causation: “The failure to follow established procedure behavior on the part of the employee is not a root cause, 

but instead is a symptom of an underlying root cause”. The CCPS guidance lists many possible “underlying 

system defects that can result in an employee failing to follow procedure.” The CCPS provides nine examples, 

which include defects in training, defects in fitness-for-duty management systems, task overload due to ineffective 

downsizing, and a culture of rewarding speed over quality. 
BP Texas City Final Investigation Report 3/20/2007 

72 

 

• A poorly designed computerized control system that hindered the ability of operations personnel 

to determine if the tower was overfilling. 

• Ineffective supervisory oversight and technical assistance during unit startup. 

• Insufficient staffing to handle board operator workload during the high-risk time of unit startup. 

• Lack of a human fatigue-prevention policy. 

• Inadequate operator training for abnormal and startup conditions. 

• Failure to establish effective safe operating limits. 

3.1 Work Environment Encouraged Procedural Deviations 

Operators deviated from the raffinate unit startup procedure on March 23, 2005. These deviations were 

not unique actions committed by an incompetent crew, but were actions operators, as a result of 

established work practices, frequently took to protect unit equipment and complete the startup in a timely 

and efficient manner. 

Several aspects of the work environment encouraged such deviations. Management did not ensure that the 

startup procedure was regularly updated, even though the startup process had evolved and changed over 

time with modifications to the unit’s equipment, design, and purpose.55 The procedure did not address 

critical events the unit experienced during previous startups, such as dramatic swings in tower liquid 

level, which could severely damage equipment and delay startup. In addition, specific instructions for 

unique startup circumstances were not included in the procedure, such as the unusual stopping and 

resumption of the ISOM startup or the routing of products to different storage tanks. Management had 

also allowed operators to make procedural changes without performing proper Management of Change 

55 The unit underwent several operational changes, including the de-rating of the splitter tower’s three relief valves 

from 70 psig to 40, 41, and 42 psig, and the switch to flooded drum operation (as discussed in Section 2.2.2) , 

which were not reflected in the procedures. 
BP Texas City Final Investigation Report 3/20/2007 

73

 

(MOC) hazard analysis, thereby encouraging operators to make unplanned (and potentially unsafe) 

deviations during startup. All of these managerial actions (or inactions) sent a strong message to 

operations personnel: the procedures were not strict instructions but were outdated documents to be used 

as guidance. 

Operators relied on knowledge of past startup experiences (passed down by the more skilled veteran 

operators) and developed informal work practices to prevent future startup delays. Indeed, several 

procedural deviations made by the operations crew on March 23, 2005, were common practices in 18 

previous raffinate splitter tower startups (Appendix I). 

3.1.1 Procedures Did Not Reflect Actual Practice 

Management did not ensure that unit operational problems were corrected over time, leading operators to 

deviate from established procedures. Historical computer data from five years of ISOM startups highlight 

past critical events: 1) in a majority of the 19 ISOM startups between April 2000 and March 2005,56 the 

tower was filled above the range of the level transmitter despite procedural instruction to fill the tower to 

a 50 percent reading on the transmitter; 2) operators frequently ran the valve sending liquid raffinate out 

of the unit to storage in “manual” instead of “automatic” control mode, as the procedure required; 3) the 

tower experienced dramatic swings in liquid level during 18 of the 19 previous startups, making control 

of the startup difficult for operators, yet the instrumentation and equipment were not reviewed nor were 

methods for handling swings in liquid level addressed in the procedure; and 4) tower pressure alarm setpoints were frequently exceeded, yet the procedure did not address all the reasons this might happen and 

the steps operators should take in response. 

56 The 19 startups include the March 23, 2005, startup. 
BP Texas City Final Investigation Report 3/20/2007 

74 

 

In fact, only one of the 19 ISOM unit startups maintained both the tower level within the range of the 

level transmitter and the pressure within the alarm limits set for safe tower operation. However, none of 

the 18 previous startups before March 23, 2005, were considered abnormal or investigated to correct these 

operational deficiencies or possible equipment problems. 

Control board computer records of the last 19 raffinate unit startups show that it was common for the 

liquid level in the tower to significantly rise and fall during the initial stages of startup. Indeed, in 14 of 

the 19 startups, the tower experienced significant swings in level; the swings were so severe that in the 14 

startups the level alarm went off a total of 74 times.57 Of the past 19 ISOM startups, each startup 

experienced three significant swings, on average, in tower level and heavy raffinate flow out of the tower. 

The level control valve for the splitter tower was often placed in “manual” mode until the tower flow and 

level fluctuations subsided. (Appendix I provides data on these 19 startups.) 

Introducing feed into the unit such that the range of the level transmitter was exceeded and placing the 

level controls in “manual” mode deviated from the written startup procedure. However, operators knew 

that these swings in tower liquid level had the potential to significantly damage unit equipment, 

particularly the furnace, if the level in the tower was lost. Board operators stated that they often filled the 

tower above the range of the transmitter and put the controls in “manual” to improve their control of the 

system and reduce the severity of the swings that could result in a loss of level. 

Computer records from the control board confirm that overfilling the tower and putting the controls in 

“manual” mode during startup were common practice. The tower’s high level alarm set-point58 was 

exceeded 65 times during the last 19 startups, with more than 50 hours of operating time with the high 

57 The level transmitter provided a reading to the Control Room Board Operator regarding how much feed was in the 

tower. The transmitter could provide a feed level reading of the 170-ft tower only when the level in the tower was 

inside a 5 foot (1.5 m) span within the bottom 9 feet of the tower. 

58 The high level alarm was set at 72 percent of transmitter output. 
BP Texas City Final Investigation Report 3/20/2007 

75

 

level alarm activated. In contrast, the low level alarm59 was triggered nine times, and the column operated 

in low alarm for slightly more than five hours during the 19 startups. This evidence supports the 

conclusion that operators biased the tower level on the high side, likely to avoid the possibility of losing 

the level and damaging the furnace. This bias of running the tower on the high side occurred in nearly all 

of the last 19 startups. The operators’ actions show that they were aware of the tower’s low level risks, 

but not the high level risks. 

Without awareness of the risks of high level, the operators often conducted startup without knowing the 

actual amount of material in the tower. In 15 of the 19 startups, the liquid level rose beyond the range of 

the transmitter, and in eight, the tower was operated out of range for more than one hour. Filling the tower 

beyond the range of the level transmitter (that is, beyond an approximate height of 9 feet from the bottom 

of the tower) was a departure from the startup procedure, which instructs operators to fill the tower to 50 

percent (6.5 feet) in the tower.60 Once the feed rises above the span of the transmitter, operators have no 

ready means to determine how much liquid is in the tower and makes overfilling the tower much more 

likely. 

Pressure excursions outside the procedure’s stated 32 psig (221 kPa) alarm set-point also occurred in 14 

of the 19 startups.61 Since the beginning of 2003, two startups prior to the March 23 incident had 

pressures above the relief valve set-points, which likely lifted the relief valves and discharged 

hydrocarbon vapor to the blowdown drum and stack. Neither of these two startup incidents was 

investigated. 

59 The low level alarm was set at 35 percent of transmitter output. 

60 At the midpoint (a 50 percent output on the transmitter), the tower is filled to a height of approximately 6.5 feet. 

According to the procedure, this level is established in the bottom of the tower by putting the level control valve 

in “automatic” mode to control the flow of bottom tower liquid to storage. After the level is established, the 

raffinate feed is to be slowly heated, which gradually increases tower pressure. 

61 In nine of the 19, the splitter pressure increased rapidly to over 40 psig. 
BP Texas City Final Investigation Report 3/20/2007 

76 

 

The computer data for critical events from previous startups was available to the managers, yet engineers 

and supervisors stated they were unaware of the deviations. Management did not effectively review the 

available computer records of these deviations and intervene to prevent future deviations. The operational 

problems should have been corrected and the procedures updated to emphasize the importance of 

following the written instructions to the operating staff. 

When procedures are not updated or do not reflect actual practice, operators and supervisors learn not to 

rely on procedures for accurate instructions. Other major accident investigations reveal that workers 

frequently develop work practices to adjust to real conditions not addressed in the formal procedures. 

Human factors expert James Reason refers to these adjustments as “necessary violations,” where 

departing from the procedures is necessary to get the job done (Hopkins, 2000). Management’s failure to 

regularly update the procedures and correct operational problems encouraged this practice: “If there have 

been so many process changes since the written procedures were last updated that they are no longer 

correct, workers will create their own unofficial procedures that may not adequately address safety 

issues” (API 770, 2001). 

3.1.2 Procedural Changes Without Management of Change (MOC) 

Deviations from the procedure were made without performing MOC hazard analyses. Written operating 

procedures are used to provide clear instructions for safely operating a process. BP guidelines state that 

procedures should be reviewed as often as necessary to assure that they reflect current operating practices, 

are handled according to MOC policy, and are certified annually as being current and accurate.62 

62 Amoco Petroleum Performance Sector, “Refining Implementation Guidelines for OSHA 1910.119 and EPA 

RMP,” Section D-4: Operating Procedures 
BP Texas City Final Investigation Report 3/20/2007 

77

 

BP Texas City’s MOC policy also asserts that the MOC be used when modifying or revising an existing 

startup procedure,63 or when a system is intentionally operated outside the existing safe operating limits.64

Yet BP management allowed operators and supervisors to alter, edit, add, and remove procedural steps 

without conducting MOCs to assess risk impact due to these changes. They were allowed to write “not 

applicable” (N/A) for any step and continue the startup using alternative methods. 

Allowing operations personnel to make changes without properly assessing the risks creates a dangerous 

work environment where procedures are not perceived as strict instructions and procedural “workarounds” are accepted as being normal. API 770 (2001) states: “Once discrepancies [in procedures] are 

tolerated, individual workers have to use their own judgment to decide what tasks are necessary and/or 

acceptable. Eventually, someone’s action or omission will violate the system tolerances and result in a 

serious accident.” Indeed, this is what happened on March 23, 2005, when the tower was filled above the 

range of the level transmitter, pressure excursions were considered normal startup events, and the control 

valves were placed in “manual” mode instead of the “automatic” control position. 

3.1.3 Startup Procedure Lacked Sufficient Instructions 

The ISOM raffinate section startup procedure lacked sufficient instructions for the Board Operator to 

safely and successfully start up the unit. The procedure instructed the Board Operator to open the valve 

that would send heavy raffinate liquid out of the unit to storage, but did not explain the safety implication 

of this deviation. The procedure did not instruct the Board Operator to pay close attention to the 

incoming/outgoing liquid raffinate flow readings or to calculate a material balance65 of the unit during 

startup, nor did it explain how to make such a calculation. Calculating material balance for a unit is a 

63 “Texas City Process Safety Guideline No. 10: Management of Change,” from the BP Amoco Texas City Process 

Safety Guidelines Manual, last revised 8/4/99 

64 Ibid. 

65 A material balance calculation relies on knowledge of the flow rates into and out of a piece of equipment, such as 

a tower, and the board operator’s understanding of how the net rate affects accumulation of liquid within the 

equipment over time. 
BP Texas City Final Investigation Report 3/20/2007 

78 

 

method used by operations personnel during times of potential flow imbalances or level uncertainty; that 

is, when the amount of material coming into the unit does not necessarily equate to the material being 

removed from the unit. Start up of a unit is a time when material balances should be calculated. 

Good practice guidance from Center for Chemical Process Safety (CCPS) on writing effective procedures 

states: “When procedures require calculations, the calculations must be clear and understandable.... 

Having the calculation in the procedure or readily available ensures accuracy and consistency” (CCPS, 

1996a). 

The procedure also did not include instructions on halting unit operations in the middle of the startup 

process, as was done during the early morning hours on March 23, 2005, nor did it provide instruction for 

recommencing startup several hours later by a different operating crew. The hazards and safety 

implications of a partial startup/shutdown/re-startup were not addressed and specific steps to initiate such 

activities were not provided. 

BP’s raffinate startup procedure included a step to determine and ensure adequate staffing for the startup; 

however, “adequate” was not defined in the procedure. An ISOM trainee checked off this step, but no 

analysis or discussion of staffing was performed.66 Despite these deficiencies, Texas City managers 

certified the procedures annually as up-to-date and complete. 

3.1.4 Summary 

Post-incident, BP emphasized that following the procedures would have prevented the explosions and fire 

on March 23 (“Fatal Accident Investigation Report,” 2005). However, Texas City management did not 

emphasize the importance of following procedures as evidenced by its lack of enforcement of the MOC 

66 The Trainee acknowledged that he followed orders of his trainer and signed off on numerous startup tasks without 

knowing whether the tasks were completed. The CSB has not located evidence to suggest that such a discussion or 

analysis was conducted for the March 23, 2005, startup. 
BP Texas City Final Investigation Report 3/20/2007 

79

ws.70 

 

policy, its acceptance of procedural deviations during past startups, and its failure to ensure that the 

procedures remained up-to-date and accurate. 67 

3.2 Ineffective and Insufficient Communication Among Operations 

Personnel 

Two critical miscommunications occurred among operations personnel on March 23, 2005, that led to the 

delay in sending liquid raffinate to storage: 1) the instructions for routing raffinate products to storage 

tanks were not communicated from Texas City management and supervisors to operators; and 2) the 

condition of the unit – specifically, the degree to which the unit was filled with liquid raffinate – was not 

clearly communicated from night shift to day shift.68 These lapses in communication were the result of 

BP management’s lack of emphasis on the importance of communication. BP had no policy for effective 

shift communication,69 nor did it enforce formal shift turnover or require logbook/procedural records to 

ensure communication was clearly and appropriately disseminated among operating cre

67 Indeed, one of the opening statements of the raffinate startup procedures asserts “This procedure is prepared as a 

guide for the safe and efficient startup of the Raffinate unit.” This statement is at fundamental odds with the 

OSHA PSM Standard, 29 CFR 1910.119, which states that procedures are required instructions, not optional 

guidance. 

68 Miscommunication occurred regarding startup of the unit altogether. During a shift directors’ meeting on the 

morning of the incident, the state of the ISOM unit was discussed. Day Supervisor B was told that he would not 

be able to startup because the storage tanks that received raffinate from the splitter tower were believed to be full. 

The Shift Director said that the meeting ended with the understanding that the raffinate section would not be 

started up. 

69 BP Texas City’s Learning & Development Services department produced a training document, “Safe Ups and 

Downs for Refinery and Chemical Units” which states: “The importance of communications between shifts and 

between individuals must be emphasized [during startup]. Each shift must clearly understand what has been done 

on prior shifts and what is expected of it. Some overlap of supervisor between shifts can improve communications 

and continuity of work” (p.24). This good advice was not enforced through plant procedures or practice, nor was 

additional (experienced) supervision made available during startup. 

70 BP’s Grangemouth refinery in the U.K. conducted a study to assess shift turnover communication at its facility 

and, as a result, created a policy to improve operation staff communication (Appendix J). BP Texas City 

management did not appear to learn from the lessons of the Grangemouth study. 
BP Texas City Final Investigation Report 3/20/2007 

80 

maining. 

 

Inadequate verbal instructions among Texas City supervision and operating personnel regarding critical 

aspects of ISOM unit startup led to the initial closing of the valve that routes heavy raffinate to storage. A 

crucial face-to-face discussion between the operator who began the process of starting up the raffinate 

unit, and the operator who finished the job did not occur at shift change.71 Further, the night shift’s 

written communication in the unit logbook was minimal and unclear,72 hindering the Board Operator’s 

ability to accurately understand the specific procedural steps performed during the previous shift and the 

procedural steps re

On the morning of the incident, feed routing instructions were not written down in either the logbook or 

the startup procedures. Instead, they were given to the Board Operator over the phone and radio by a Lead 

Operator who, while having the experience and knowledge to start up the unit, was responsible for other 

outside operator tasks that took his attention away from helping the Board Operator start up the raffinate 

section of the ISOM. Based on interview testimony, the verbal communication between the operators was 

rushed and vague. The Board Operator believed he was told not to send heavy liquid raffinate to tankage 

because the tanks were full; the Lead Operator believed he communicated that the light raffinate feed was 

not to be sent to normal tankage, but combined with heavy raffinate flow to storage because the light 

raffinate tanks were full. Based on logbooks from the tank farm area, the heavy raffinate tank was filling 

up73 prior to raffinate unit startup, supporting the fact that a miscommunication occurred. 

Communication is most effective when it includes multiple methods (both oral and written); allows for 

feedback; and is emphasized by the company as integral to the safe running of the units (Lardner, 1996). 

(Appendix J provides research on effective communication.) During times of abnormal operating 

71 A night outside operator performed initial board operator startup activities in the satellite control room, away from 

the central AU2/ISOM/NUD control room; this operator filled the tower to 99.9 percent of the range of the level 

transmitter. 

72 The logbook entry from the night shift stated: “ISOM: Packed raff with raff.” The term “pack” is jargon used in 

the refinery; to “pack” a piece of equipment is to fill it with product; in this case, with liquid raffinate feedstock. 
BP Texas City Final Investigation Report 3/20/2007 

81

 

conditions, such as unit startup, the risk of operators having dissimilar understandings of the state of the 

process unit is even greater (Lardner, 1996). 

Effective communication is accomplished by clearly defining roles and responsibilities regarding 

communication for every employee, and establishing a communication protocol among key operating 

positions, particularly during shift changes. 

3.3 Malfunctioning Instrumentation 

The Board Operator’s decision-making was influenced by incorrectly calibrated instrumentation on the 

raffinate splitter tower (Section 7.0). Accurate instrument readings of process conditions, such as product 

level, are critical during unit startup, as they provide the operator with a way to monitor the process and 

help the operator detect system irregularities. When instrumentation provides false or misleading 

information, accidents are likely.74

During the March 23, 2005, startup, the level transmitter indicated that the liquid level in the splitter 

tower was gradually declining, although it was actually rising.75 At 1:04 p.m. (approximately 16 minutes 

before the explosions), the level indicator read 78 percent (a height of about 7.9 feet or 2.41 m) in the 

tower); however, the tower level was actually at 158 feet (48.16 m). Operations personnel involved in the 

raffinate section startup were unaware that the transmitter’s reading was inaccurate. 

73 The tank farm area logbook from the March 22, 2005, night shift states “*Filling up on RAFF” referring 

specifically to one of the heavy raffinate storage tanks. 

74 The history of accidents and hazards associated with distillation tower faulty level indication, especially during 

startup, has been well documented in technical literature. See Kister, 1990. Henry Kister is one of the most 

notable authorities on distillation tower operation, design, and troubleshooting. 

75 The liquid level read 97 percent when startup was resumed at 9:51 a.m., but dropped to 78 percent by 1:04 p.m. 
BP Texas City Final Investigation Report 3/20/2007 

82 

 

The Day Board Operator stated that he saw the declining level in the tower over three hours prior to the 

incident and believed the level was accurate, as he expected that the level would decline as the tower 

heated up and the system returned to normal operating limits. 

The Board Operator’s belief that the tower level was accurate was reinforced by the redundant high level 

alarm’s failure to activate.76 This alarm provided a redundant high level indication should the level 

transmitter malfunction.77 However, this alarm’s set-point was not known to operations personnel or 

provided in the procedure, control data, or training materials.78 The lack of a set-point at which the alarm 

would sound made recognizing the failure of the alarm less apparent. And because the separate alarm did 

not sound, the Board Operator believed this confirmed the fact that the level had actually dropped in the 

tower as liquid raffinate left the tower and circulated to the other unit equipment. He did not verify his 

conclusion about the decline in tower liquid level with any other operations personnel. 

In addition, had the tower level sight glass been clean and functional, it could have provided a visual 

verification of the actual tower level. However, because it was dirty and unreadable79 (Section 7.1) the 

tower liquid level could not be visually verified and compared against the level transmitter reading. The 

Board Operator truly had no functional and accurate measure of tower level on March 23, 2005. 

76 Control system alarms alert operators of abnormal process conditions via illuminated displays and audible devices 

on the computerized control system workstation monitors. 

77 The splitter tower had two alarms associated with the level transmitter. A high level alarm set at 72 percent was 

activated for the entire period of the startup. This alarm was expected to sound, as operators purposely filled the 

tower above the range of the level transmitter during startup (see section 4.1). The Board Operator said that he 

remembered seeing this alarm acknowledged when he came on shift; it was acknowledged during the night shift 

prior to his arrival. 

78 Post-incident calculations determined that the redundant high level alarm was set at 78 percent or approximately 8 

feet high in the tower; had it worked during the startup, it would have sounded during the night shift when the 

operator filled the tower to 99.9 percent of the transmitter’s span. 

79 Post-incident testing confirmed that the sight glass was dirty and unreadable at the time of the incident. This 

instrument had a history of being dirty and non-functional. 
BP Texas City Final Investigation Report 3/20/2007 

83

 

3.4 Poor Computerized Control Board Display 

The AU2/ISOM/NDU complex is monitored and controlled via a computerized control system80 in a 

central control room in the AU2 unit. (Appendix K provides a full description of the complex’s system.) 

The Board Operator – far removed from the physical location of the process unit undergoing startup81 – 

depended on the system to provide him with crucial process information, which requires a well-designed 

control board. On the day of the incident, however, the computerized control system display provided 

neither flow data in and out of the raffinate unit on the same display screen, nor a material balance 

calculation, hindering the Board Operator’s ability to recognize the need to send liquid raffinate to 

storage. 

To prevent flooding the tower, liquid raffinate entering the process would have to be balanced with the 

products leaving the unit.82 The computerized control system screen that provided the reading of how 

much liquid raffinate was entering the unit was on a different screen from the one showing how much 

raffinate product was leaving the unit (Figure 14). Having the two feed readings on separate screen pages 

diminishes the visibility and importance of monitoring liquid raffinate in versus out, and fails to make the 

imbalance between the two flow readings obvious. 

80 A computerized control system, often referred to as a DCS or distributed control system, is a data tracking-andcontrol system that provides operations staff a visual and auditory account of the state of the process unit(s) and 

allows operators to alter the unit’s state by manipulating the system’s controls (keyboard, mouse, and touch 

screens). 

81 Based on a process and instrumentation diagram of the West plant, the centralized control room was 

approximately 500 feet (152.4 m) from the east side of the ISOM unit. 

82 A material balance calculation is used to determine how much total liquid is in a given unit; it is determined by 

comparing the amount of incoming feed to the amount of outgoing product, and requires knowledge of how much 

liquid the total system needs to maintain and run the process smoothly. 
BP Texas City Final Investigation Report 3/20/2007 

84 

Product leaving the Unit

Figure 14. The Board Operator viewed this screen, which provides information on raffinate product 

leaving the unit but not the liquid being added to the unit. 

A poorly designed computerized control system display was found to be a cause in another major 

incident, the 1994 explosions and fire at a Texaco plant in Milford Haven, in the United Kingdom. The 

control system did not calculate the material balance of the system and the operators did not know how to 

make such calculations. The computerized control system was also configured to display only portions of 

the unit in discrete detailed sections, and did not allow for a complete overview of the process, just like 

the control system screens for the Texas City ISOM unit. The U.K. Health and Safety Executive83

recommended that computerized control systems include a process overview and, as appropriate, material 

balance summaries to ensure full process oversight by operators (HSE, 1997). 

 

83 The Health and Safety Executive is Great Britain’s enforcement authority (in conjunction with local governments) 

for the Health and Safety Commission, a governing body that is responsible for the regulation of health and safety 

in the workplace. 
BP Texas City Final Investigation Report 3/20/2007 

85

 

3.5 Ineffective Supervisory Oversight and Technical Assistance 

During Unit Startup 

The ISOM/AU2/NDU complex lacked effective supervisory oversight during the startup of the raffinate 

unit. When Day Supervisor A left the refinery for a family medical emergency, 84 no technically trained 

personnel with ISOM unit experience were assigned to assist and supervise the Board Operator. Two 

significant staffing issues arose: it was unclear who was responsible for ISOM unit supervision once Day 

Supervisor A left, and the one individual available to provide such supervision lacked technical 

knowledge of the unit. Had the second Day Supervisor on shift (Supervisor B) left his work at the ARU to 

assist in the raffinate startup, his presence in the control room would likely not have been helpful, as he 

had little technical expertise on the unit.85 The two Process Technicians (PTs) who had ISOM knowledge 

and experience were not assigned to assist with the startup.86 

Amoco’s process safety guideline, “Supervisory Personnel – Startups and Shutdowns,” adopted by BP, 

states that times of unit startup and shutdown are often unpredictable and much more likely than normal 

operations to go awry. For this reason, the BP guideline states: “Experienced operating personnel should 

be assigned to each process unit as it is being started up and as it is being shut down.”87 Examples of such 

personnel who could provide supplementary assistance include supervisors and operating specialists. BP 

unit management also concluded that supervisory assistance would be needed during unit startups in a 

84 The Day Supervisor had to attend to a family medical emergency. 

85 The second Day Supervisor joined the AU2/ISOM/NDU complex after 25 years at the BP Texas City chemical 

plant. According to BP South Houston Process Safety Management standard “Training for Process Safety” (SHPSM_5),” unit supervisors were required only to have an awareness of startup procedures and safe operating 

limits. This type of training is documented but does not require verification. 

86 The two PTs knowledgeable in both the board and outside operator job duties were assigned temporary positions 

at the ARU where they were paid more to participate in those turnaround activities. 

87 The Amoco Petroleum Products Process Safety Guideline No. 4, “Supervisory Personnel – Startups and 

Shutdowns,” last revision 12/18/97, continues: “For all critical phases of start-ups and shutdowns, technically 

trained personnel knowledgeable in the process should be readily available.” 
BP Texas City Final Investigation Report 3/20/2007 

86 

 

MOC analysis conducted in 2001.88 However, on March 23, 2005, Texas City management did not ensure 

that such personnel were assigned to the startup. 

3.6 Insufficient Staffing During Start Up 

On March 23, 2005, the ISOM unit was understaffed for the task of unit startup. One board operator was 

in charge of monitoring and controlling the NDU, AU2, and ISOM units, which under normal conditions, 

would take about 10.5 hours of a 12-hour shift to run,89 if all units would be running at a steady state 

(normal), according to a BP assessment. On the morning of the incident, however, the Board Operator 

was also responsible for managing the startup of the ISOM raffinate section.90 A startup is an abnormal 

unit condition that requires significantly more manual control of a process, as well as critical thinking and 

decision-making that goes beyond normal unit operation. 

Human factors experts have compared operator activities during routine and non-routine conditions and 

concluded that in an automated plant, workload increases with abnormal conditions such as startups and 

upsets. For example, one study found that workload more than doubled during upset conditions (Reason, 

1997 quoting Connelly, 1997). Startup and upset conditions significantly increased the ISOM Board 

Operator’s workload on March 23, 2005, which was already nearly full with routine duties, according to 

BP’s own assessment. 

The Day Board Operator had little assistance for the startup and upset conditions at the control board on 

March 23, 2005. During the mid-morning hours, the Day Supervisor for the unit left the refinery and no 

88 The MOC’s action item stated: “Consider revising the planned startup and planned shutdown procedures to 

require an asset supervisor be assigned to shift.” This action item had a target resolution date of 12/21/01; it 

remains open. 

89 Hours/shift of steady-state operations was calculated by the BP assessment team via direct observation: the 

number of observable tasks was listed and the following equation was used: ∑(time/task)/Observation time = 

percent activity, plus 0.5 (or up to 1.0) minute for the time between each task. 

90 During the day shift on March 23, 2006, the NDU and the AU2 units were running fully and part of the ISOM unit 

was in circulation. 
BP Texas City Final Investigation Report 3/20/2007 

87

substitute personnel with ISOM experience replaced him. The Lead Operator – who had board operator 

experience but was assigned as an outside operator – was involved in organizing contractor work and 

training two new operators. The other ISOM operators with experience in control board operation during 

unit startup (the PTs) were at the ARU unit finishing startup activities. 

In the years preceding the incident, the concern about insufficient staffing had been raised numerous 

times (Appendix L). In 2001, a MOC analysis was conducted when the NDU was built and its board 

responsibilities were added to those of the AU2/ISOM board operator. An action item stated: “Extend the 

requirement to have two board operators for any planned startup or planned shutdown activities to include 

NDU.” Even though the MOC analysis required two Board Operators for any startup, Texas City 

management did not implement this recommendation for startups of the raffinate section of the ISOM 

unit. Instead, a second board operator was brought in only during specific times during ISOM startup.91

This was not the first time that operations personnel recognized the need for two board operators during 

startup and shutdown. A 1996 Amoco staffing assessment of all units in the refinery stated: “Personnel 

are concerned that under a minimum staffing scenario they would be unable to manage historic upsets.” 

Then in 1999, a MOC for the consolidation of AU2 and ISOM resulted in a recommendation to revise the 

ISOM planned startup and shutdown procedures to require that an additional independent/dedicated board 

operator be present to help with critical transitions during times of unit startup and shutdown.92 Five 

months prior to the incident, an experienced ISOM supervisor expressed concern to Operations 

Management that two board operators were needed to safety operate all three units, particularly during 

 

91 ISOM startup procedure SOP 101.0 specifies that a second board operator shall be brought in only during certain 

activities, such as when another unit in the complex is being startup up concurrently with the ISOM and when 

introducing feed into the Penex reactors. 

92 The startup of a highly hazardous process unit has a higher level of risk than normal operations because it requires 

more manual operation and higher-level critical thinking by the operators, and thus the entire startup process 

would be considered a critical transition. “Critical transitions” were not defined in the MOC. 
BP Texas City Final Investigation Report 3/20/2007 

88 

 

times of unit upsets.93 In January 2005, the Telos safety culture assessment informed BP management that 

at the production level, plant personnel felt that one major cause of accidents at the Texas City facility 

was understaffing, and that staffing cuts went beyond what plant personnel considered safe levels for 

plant operation. 

3.6.1 Refining and Corporate Management Decisions Affected Staffing 

Despite a history of recommendations and requests for additional staffing during times of unit startup and 

shutdown, Amoco and BP management cut staffing budgets in the years prior to the March 23, 2005, 

incident. 

In 1994, Amoco reviewed staffing to determine if operations staffing could be adjusted to Solomon 

performance indices. This review concluded that reducing headcount at Texas City and at the Whiting site 

in Indiana by the 18 percent necessary to match the Solomon first quartile average would save Amoco 

between $22 and $33 million in operating expenses. If staffing could be reduced 31 percent, reaching the 

“Best class Solomon manpower index,” the company would save $42 to $61 million. Such changes would 

result in staffing for normal operations only, where each operations crew is “staffed at a ‘lean’ level, i.e., 

no additional personnel on hand to guard against ‘peaks’ such as safe-offs,94 absences, and so on.”95 In 

1999, BP cut fixed costs nearly 25 percent (see Section 9.4.3), resulting in plant-wide staffing 

reductions,96 and combined and consolidated from two to one the board operator positions for the AU2 

and ISOM units. 

93 Email from an AU2/ISOM/NDU Supervisor to Operations personnel and Texas City management, including the 

Superintendent of the AU2/ISOM/NDU, dated November 11, 2004. 

94 A safe-off is a procedure for emergency shutdown of a process unit in the event of a process, utility, and/or 

equipment failure. 

95 McKinsey study, November 2, 1994, commissioned for the Amoco Oil Company 

96 The Texas City Business Unit Strategy document, dated October 1999, stated that the budget targets could be 

accomplished, in part, by reducing staffing by “roughly 15% fewer employees.” 
BP Texas City Final Investigation Report 3/20/2007 

89

 

Despite these cuts, in a 2004 compliance strategy document, Texas City management stated: “In the face 

of increasing expectations and costly regulations, we are choosing to rely wherever possible on more 

people dependant and operational controls rather than preferentially opting for new hardware. This 

strategy [will place] greater demands on work processes and staff to operate within the shrinking margin 

for error.”97 Texas City management’s cost-cutting resulted in a greater reliance on its operations 

personnel, specifically the frontline operators, and less on hardware improvements. Yet the company had 

been significantly reducing the number of these frontline operators since the 1996 Amoco staffing study 

examined all units for potential staffing cutbacks. And, as section 3.8 discusses, training of the reduced 

operations personnel was less than adequate. 

3.7 Operator Fatigue 

On the day of the incident, the Day Board Operator was likely fatigued, experiencing both acute sleep 

loss98 and cumulative sleep debt.99 He had worked 12-hour shifts for 29 consecutive days and generally 

slept five to six hours per 24-hour period, although he reported feeling most rested with seven hours of 

sleep per night. The Night Lead Operator, who filled the tower from the satellite control room, worked 33 

consecutive days, from February 18–March 23, 2005. The Day Lead Operator – who was training two 

new operators, dealing with contractors, and working to get a replacement part to finish the ISOM 

turnaround work – had been on duty for 37 consecutive days, from February 14 until March 23, 2005. 

Finally, another experienced outside operator, who was helping the Day Lead Operator, worked 31 

consecutive days, February 21–March 23, 2005. All of these individuals were working 12-hour shifts. 

97 The Compliance Strategy document was part of a collection of Texas City documents presented to the Global 

Chief Executive for Refining and Marketing in July 2004 as the strategy adopted at the Texas City refinery. 

98 Acute sleep loss is the amount of sleep lost from an individual’s normal sleep requirements in a 24-hour period. 

99 Cumulative sleep debt is the total amount of lost sleep over several 24-hour periods. If a person who normally 

needs 8 hours of sleep a night to feel refreshed gets only 6 hours of sleep for five straight days, this person has a 

sleep debt of 10 hours. 
BP Texas City Final Investigation Report 3/20/2007 

90 

 

Based on an analysis of this information (see below), operator fatigue likely contributed to the incident by 

impairing operator performance. 

Fatigue can increase errors, delay responses, and cloud decision-making (Rogers et al., 1999; HSE, 2005). 

Research also shows that complex task decision-making that requires innovative, flexible thinking and 

planning are sensitive to fatigue (Rogers et al., 1999; Rosekind, et al., 1996) (Appendix M). 

Based on their work schedules, many of the ISOM operators were likely fatigued; however, this analysis 

focused on the Day Board Operator because he had a primary role on the day of the incident. 

The investigation focused on two questions: 1) Were identifiable fatigue factors100 present at the time of 

the incident?; and 2) If yes, did fatigue-related performance loss contribute to or cause the accident? The 

CSB used a methodology employed by the NASA Fatigue Countermeasures Program and the National 

Transportation Safety Board (NTSB) to assess operator fatigue in accidents.101 Using this methodology 

and evidence from the incident, the CSB concluded that fatigue was a likely contributing factor. 

3.7.1 Fatigue Factors 

Identifiable fatigue factors were present at the time of the incident. On March 23, 2005, the Day Board 

Operator had been working 12-hour shifts, seven days a week, for 29 consecutive days.102 The operator’s 

commute to and from work took between 30 and 45 minutes each way, providing him 10.5-11 hours off 

from work each day. The operator spent this time with his wife and children, and used it to take care of 

family duties, household chores, and errands. Some of this time was also needed for meals and to prepare 

100 Fatigue factors are physiological aspects of an individual’s sleep/wake cycle that underlie fatigue. Two core 

fatigue factors are 1) acute sleep loss and cumulative sleep debt; and 2) continuous hours of wakefulness. 

(Rosekind et al., 1993). 

101 This methodology has been used in NTSB investigations of pipeline board operators and in transportation 

incidents. As the tasks of board operators, pilots, and drivers parallel each other in that they all deal with issues of 

critical decision-making, attending to/monitoring partially automated systems, reacting quickly to abnormal 

conditions, and rectifying deviations from normal conditions, the CSB used this methodology in its investigation. 

102 According to company records, his last day off from work was February 21, 2005, 30 days prior to the incident. 
BP Texas City Final Investigation Report 3/20/2007 

91

3.7.2.1 

 

for bed at night and work the next day. He reported that, due to these factors, he routinely got five to six 

hours of sleep per night, about 1.5 hours less than he slept during his normal work schedule. Losing 1.5 

hours of sleep in a 24-hour period for 29 straight days, the Board Operator had accumulated a sleep debt 

of 43.5 hours.103 Without any days off from work during that period, the Board Operator had little 

opportunity to reduce that sleep debt and minimize the effects of chronic sleep loss. Research suggests 

that even short breaks from work tasks can often lessen the severity of accumulated fatigue (Rosekind et 

al., 1996). However, the Board Operator also reported that he rarely took official/scheduled rest breaks 

during his shift and ate meals in front of the board. 

The work-sleep schedule of the Day Board Operator highly suggests fatigue, and the other operators of 

the unit were also likely experiencing the effects of fatigue. According to the Baker Panel findings, the 

average rate of overtime for operators and maintenance personnel at the Texas City refinery in the past 

four years was 27 percent, with several employees exceeding 68 percent (Baker et al., 2007). The Baker 

Panel Report concluded that such overtime rates were excessive, would likely compromise safety, and 

were symptomatic of understaffing (Baker et al., 2007). 

3.7.2 Operator Performance Impaired by Fatigue 

Evidence suggests that the operators’ fatigue degraded their judgment and problem-solving skills, 

hindering their ability to determine that the tower was overfilling. 

Fatigue Impaired Judgment and Decision-Making 

The Board Operator, as well as the outside operators, did not recognize that feed was entering the tower 

but not being removed from the unit for three hours, that the tower was overfilling, or that the 

consequences of the tower flooding might be catastrophic. Throughout the startup on March 23, 2005, the 

103 If he was getting 5.5 hours of sleep per night, he was suffering from an acute sleep loss of 1.5 hours/night. 1.5(29 

days) = sleep debt of 43.5 hours (about a month and a half of lost sleep). 
BP Texas City Final Investigation Report 3/20/2007 

92 

3.7.2.2 

operations personnel did not make the connection between adding feed to the unit and the risk of 

explosions and fire. 

It is common for a person experiencing fatigue to be more rigid in thinking, have greater difficulty 

responding to changing or abnormal circumstances, and take longer to reason correctly (Rogers et al., 

1999).

Fatigue Contributed to Cognitive Fixation 

In the hours preceding the incident, the tower experienced multiple pressure spikes. In each instance, 

operators focused on reducing pressure: they tried to relieve pressure, but did not effectively question why

the pressure spikes were occurring. They were fixated on the symptom of the problem, not the underlying 

cause and, therefore, did not diagnose the real problem (tower overfill). The absent ISOM-experienced 

Supervisor A called into the unit slightly after 1 p.m. to check on the progress of the startup, but focused 

on the symptom of the problem and suggested opening a bypass valve to the blowdown drum to relieve 

pressure. Tower overfill or feed-routing concerns were not discussed during this troubleshooting 

communication. Focused attention on an item or action to the exclusion of other critical information – 

often referred to as cognitive fixation or cognitive tunnel vision – is a typical performance effect of 

fatigue (Rosekind et al., 1993). 
BP Texas City Final Investigation Report 3/20/2007 

93

 

3.7.3 Lack of a BP Fatigue Prevention Policy 

BP has no corporate or site-specific fatigue prevention policy or regulations. The contract between the 

United Steelworkers Union and BP provides a minimum number of hours per work week requirement, 

but not a maximum.104 According to BP, “operators were expected to work” the 12-hour, 7-days-a-week 

turnaround schedule, although they were allowed time off if they had scheduled vacation , used 

personal/vacation time, or had extenuating circumstances that would be considered on a “case-by-case” 

basis.105

OSHA, the API, the NPRA, or others have no regulations or industry safety guidelines on fatigue 

prevention that applies to the chemical process industry or oil refinery workers. However, regulations do 

exist for a variety of other industries, such as the nuclear sector, aviation, and motor carriers. Some 

European countries have also begun to regulate employee fatigue (Appendix N). 

The NTSB has also recognized the effect of fatigue on job performance and has included, in its “Most 

Wanted Safety Improvements,” a recommendation to the U.S. Department of Transportation for 

employee working hour limits in all modes of transportation to prevent accidents and incidents caused by 

human fatigue.106

Companies involved in high-hazard processes must establish a shift work policy to minimize the effects 

of fatigue, especially because individuals are poor self-assessors and are less likely to admit they are too 

fatigued to work safely. The shift work policy should aim to manage both normal shift patterns/rotations 

104 In March 1999, ISOM operators, including the Day Board Operator, attended a training course, “Are You Alert 

Through Your Shift?”; however, BP was unable to provide the course materials to the CSB because the 

document’s retention period expired. According to BP, documents are no longer considered “active” if they are 

not “referenced on a regular basis, generally more than once each month or during the current fiscal year.” The 

March 1999 date was the only recorded time the ISOM operators on duty on March 23, 2005, took a course on 

workplace fatigue. 

105 BP response to CSB interrogatory request for information, December 15, 2006. 

106 http://www.ntsb.gov/recs/mostwanted/intermodal_issues.htm. 
BP Texas City Final Investigation Report 3/20/2007 

94 

and temporary situations, such as turnarounds, by limiting the number of working hours per 24-hour 

period and the number of consecutive days at work. 

The Day Board Operator, and the entire operations crew working the turnaround schedule, was likely 

experiencing significant effects of fatigue on March 23, 2005. By degrading judgment and causing 

cognitive fixation, fatigue likely contributed to the overfilling of the raffinate splitter tower. 

3.8 Inadequate Operator Training 

Inadequate training for operations personnel, particularly for the board operator position, contributed to 

causing the incident. The hazards of unit startup, including tower overfill scenarios, were not adequately 

covered in operator training. 

BP Board Operator Training consisted of new-hire basic operator training; a two-day generic 

troubleshooting course; computer-based tutorials; and on-the-job training. (Appendix O provides a more 

detailed description of the Board Operator’s training.) 

The ISOM unit operator training program did not include 

• training for abnormal situation management, the importance of material balance calculations, and 

how to avoid high liquid level in towers; 

• effective verification methods of operator knowledge and qualifications; and 

• a formal program for operations crews to discuss potentially hazardous conditions, such as startup 

or shutdown, to enhance operator knowledge and define roles. 

3.8.1 Training for Abnormal Situation Management 

Operator training for abnormal situations was insufficient. Much of the training consisted of on-the-job 
BP Texas City Final Investigation Report 3/20/2007 

95

 

instruction, which covered primarily daily, routine duties. With this type of training, startup or shutdown 

procedures would be reviewed only if the trainee happened to be scheduled for training at the time the 

unit was undergoing such an operation. BP’s computerized tutorials provided factual and often narrowly 

focused information, such as which alarm corresponded to which piece of equipment or instrumentation. 

This type of information did not provide operators with knowledge of the process or safe operating limits. 

While useful for record keeping and employee tracking, BP’s computer-based training often suffered 

“from an apparent lack of rigor and an inability to adequately assess a worker’s overall knowledge and 

skill level” (Baker et al., 2007). Neither on-the-job training nor the computerized tutorials effectively 

provided operators with the knowledge of process safety and abnormal situation management necessary 

for those responsible for controlling highly hazardous processes. Training that goes beyond fact 

memorization and answers the question “Why?” for the critical parameters of a process will help develop 

operator understanding of the unit. This deeper understanding of the process better enables operators to 

safely handle abnormal situations (Kletz, 2001). The BP Texas City operators did not receive this more 

in-depth operating education for the raffinate section of the ISOM unit. 

According to BP’s training requirements, operators were expected to spend five hours per year reviewing 

startup and shutdown procedures as part of their normal operating duties. The infrequency of unit 

startups, in conjunction with the inherently higher risk for accidents during such a time, requires focused 

and frequent training. Indeed, due to the high-risk associated with such abnormal conditions, the need for 

training on these infrequent events may be greater than the training needs for normal operation. 

BP did not train board operators on the hazards of overfilling towers. The two-day troubleshooting course 

for board operators did not discuss the consequences of overfilling, and neither the training guides nor the 

ISOM safe-off107 procedures provided sufficient guidance on operator response to tower overfilling. 

107 A safe-off is a procedure for emergency shutdown of a process unit in the event of a process, utility, and/or 

equipment failure. 
BP Texas City Final Investigation Report 3/20/2007 

96 

The BP training program did not include specific instruction on the importance of calculating material 

balances, and the startup procedures did not discuss how to make such calculations. As a result, the Day 

Board Operator did not have a full understanding of the material balance for the ISOM unit. 

3.8.2 Verifying Operator Knowledge and Qualifications 

For several years leading up to the March 23 incident, Texas City managers did not effectively conduct 

performance appraisals to determine the knowledge level and training development plans of most 

AU2/ISOM/NDU operators. The refinery-wide 2004 Operator Competency Assurance Model (OCAM)

audit108 results stated that only 25 percent of ISOM unit operators were given performance appraisals 

annually.109 The results of the OCAM audits also revealed that zero individual operator development 

plans were created for ISOM unit operators in 2003 and 2004. 

In addition, no Standard Operating Instructions (SOI) existed for the Board Operator position at the time 

of the March 23, 2005, incident, even though a SOI had been created for the Outside Operator position. 

The training materials specific to the board operator position were also very limited in scope and detail 

(Appendix O.1.4). 

3.8.3 Simulators Not Used to Train for Hazardous Scenarios 

Simulation technology was unavailable to the AU2/ISOM/NDU board operators, despite their reported 

success in improving employee knowledge at BP’s Cherry Point facility (Baker et al., 2007) and the BP 

chemicals plant adjacent to the Texas City refinery. Gun drills, or verbal discussions of potential 

 

108 The OCAM audit was a unit assessment of its training program, materials, and appraisal methods, as well as a 

review of unit records to determine if and how operator performance was being measured and tracked. General 

audits of the Texas City site were done in 2001 and 2002. Full audits of all refinery units were conducted in 2003 

and 2004. 

109Contrary to the OCAM audit findings, the 2003 and 2004 performance records for the person responsible for 

conducting/facilitating the operator evaluations reported that 100 percent of the appraisals were completed. 
BP Texas City Final Investigation Report 3/20/2007 

97

hazardous situations that operators could face while working the unit, were not formally and consistently 

held for shift crews to develop operator understanding of the ISOM unit’s risks. 

The need for continual training on hazardous operations was raised multiple times in the years leading up 

to the incident. The 2001 MOC for adding NDU responsibilities to the AU2/ISOM board operator 

position resulted in an action item to develop a simulator for the board operator position or an effective 

gun drill110 program that would test operator understanding of the units. However, the OCAM audit in 

both 2003 and 2004 found no evidence that a gun drill program was in effect, even though the MOC 

documentation incorrectly stated that a gun drill program had been developed.111 Only one gun drill is 

listed in the Board Operator’s training records and it was conducted on May 9, 2004; no records besides a 

list of those who attended have been maintained by the company. 

Texas City management did not incorporate simulators in its training program, despite ISOM incident 

investigation recommendations112 that urged their use to ensure that operators develop the critical 

decision-making skills necessary for running hazardous chemical processing units. Beginning in 2000, 

BP’s Learning & Development (L&D) department had also pressed site management to equip units with 

simulators, but was unsuccessful. After the March 2005 incident, the head of L&D department stated that 

lack of funding was why simulators were not being incorporated into the operator training program: “Big 

push back has always been initial cost and people/resources/cost to keep current. We could have equipped 

 

110 A gun drill is a verbal discussion by operations and supervisory staff on how to respond to abnormal or hazardous 

activities and the responsibilities of each individual during such times. A gun drill program – regularly scheduled 

and recorded gun drills – had been established at other units at the Texas City refinery but not for the 

AU2/ISOM/NDU complex. 

111 The actual date of action item resolution on the MOC documentation is April 25, 2003, 24 days after the 2003 

audit was conducted. 

112 An incident at the FCCU3 unit in the Texas City refinery led to the following Investigation Report 

recommendation: “consider providing simulator training for all board operating personnel” (FCCU3 Incident 

Investigation report, dated February 28, 2003). 
BP Texas City Final Investigation Report 3/20/2007 

98 

M unit). 

every process unit across TCR [Texas City Refinery] with several simulators for what the ISOM incident 

will cost us.” 113

3.8.4 Refinery and Corporate Management Decisions Affected Training 

Corporate-level decisions, such as budget and staff reductions, impaired the delivery of training at the 

Texas City site. Between 1998 and 2004, the budget for the Texas City refinery L&D department was cut 

in half, from $2.8 to $1.4 million, and its staff was reduced from 28 to eight.114 At the time of the 

incident, four PSM positions, which could have assisted with training and gun drills, were also vacant in 

the West Plant of the refinery (which included the ISO

To make up for fewer L&D trainers, BP Texas City went to computer-based training for policies, 

procedures, and process unit lessons. This type of training saved the company money, according to the 

individual who, at the time of the incident, was head of the L&D: “[computer-based training] was 

definitely a cost decision...made across the site; we will push computer based training to you as opposed 

to bringing you the classroom training...it was a business decision to minimize costs.”115 However, 

operators who require training for abnormal conditions would not benefit from computer-based training 

that often focuses on memorizing facts, not troubleshooting unusual events. 

In 1999, responding to London executives’ call to cut fixed costs 25 percent, Texas City refinery 

management agreed to implement a number of cost-reduction actions that affected training, including: 

• reducing/limiting off-shift board operator training; 

• renegotiating with the Union to eliminate one hourly training coordinator; 

 

113 Email from the head of Learning & Development (L&D) department to L&D staff, dated 4/17/2006. 

114 These figures are for all of BP South Houston; Texas City received approximately 60 percent of the allocated 

budget and personnel during these years. 

115 Interview with the head of BP’s Learning & Development department at the time of the March 23, 2005, 

incident. 
BP Texas City Final Investigation Report 3/20/2007 

99

• eliminating all non-OSHA required training for the “short term”;116

• reducing the training plan for outside operators and maintenance crafts; and 

• eliminating the central training organization of the refinery.117 

While the Texas City site’s training department’s budget and process safety staff were being cut 

beginning in 1999, corporate BP identified a gap in training at the refinery. A 2003 external audit found 

that “[t]raining in most areas is not up to the challenge of performance expectations and anticipated 

turnover.”118

The OCAM audits also revealed similar inadequacies; in fact, these audits determined that the unit 

training coordinator for the ISOM/AU2/NDU spent only about 5 percent of his time actually training 

personnel. Instead of training, his time was spent filling in for the superintendent, working or supporting a 

turnaround or project, doing extended work on resolving hazard and operability study (HAZOP) action 

items, scheduling unit personnel, and filling in on shift for another frontline supervisor. The OCAM 

audits also found that the budget for both 2003 and 2004 allowed only for initial job and OSHA-required 

refresher training; there was no budget allowance for increasing the competency of current operators. 

 

116 The duration of “short term” was not disclosed in the document. 

117 The Texas City Business Unit 1999 Cost Reduction Plan Action Items. 

118 The 2003 external GHSER audit, BP South Houston, September 22, 2003. 
BP Texas City Final Investigation Report 3/20/2007 

100

 

3.9 Failure to Establish Effective Safe Operating Limits 

BP had established safe operating limits for some ISOM process parameters; however, the ISOM 

operating limits did not include limits for high level in the raffinate splitter tower. The documentation for 

the operating limits established limits for process indications like pressure, level, and flow; described the 

effects of deviating from those limits; and listed recovery methods to avoid operating beyond those 

limits. Upper and lower limits for process parameters and consequences of deviation are necessary for 

safe plant operation and are required by the OSHA PSM Standard [29 CFR 1910.119 (d)(2)(i)(D) and 

(E)]. The only operating limit addressed in BP documentation for safe operation of the raffinate splitter 

tower was high tower pressure, which was incorrectly listed at 70 psig (482.6 kPa).119 The document did 

not address a safe operating limit or consequences of deviation for high splitter tower level. Further, none 

of the three distillation towers in the ISOM unit specified an operating limit for high tower level. 

BP had implemented an operating envelope program designed to increase oversight over process 

operations and critical parameters, which addressed both safety, environmental, and economic operating 

limits. Refinery management cited the program in safety assurance reports to BP Group managers as an 

important way to control operational risks. The operating envelope program data, including information 

indicating when unit operation occurred outside the limits, were stored electronically and were accessible 

to the board operator, supervisors, and other personnel on the refinery computer network. The program 

was intended to capture the frequency and duration of operating limit deviations so that management 

could oversee how the plant was operating and implement needed corrective action. 

Operating beyond the “not to exceed” limits set in the envelope was intended to trigger an incident report 

or a MOC process if the activity was repeated or prolonged. However, the operating envelope’s 

119 The ISOM Safe Operating Limit document had not been updated to correct the tower pressure limit since the 

maximum allowable operating pressure was lowered to 40 psig in 2003. 
BP Texas City Final Investigation Report 3/20/2007 

101

computerized reporting mechanisms to operations managers were not operational because the program’s 

reporting feature was never activated. 

In addition, the operating envelope for the ISOM unit did not address the upper operating limit for the 

raffinate splitter tower level or other distillation towers in the ISOM; consequently, the frequency or 

duration of instances of high splitter tower level were not recorded. The history of abnormal raffinate 

section startups with high tower level rising beyond the range of the transmitter was not captured as a “not 

to exceed” deviation or reported to operations management by the operating envelope system. 

BP’s ISOM process documentation did not address the consequences of high tower level or actions to 

take to recover from operating outside the safe operating limit. Safe operating limit documentation, 

procedures, and training must address the consequences of deviating from key process parameters such as 

tower level, and provide information on actions to take to return the process to normal conditions. This 

information is critical for operators to safely respond to abnormal conditions (CCPS, 1995a). 

3.10 Distraction Not a Factor 

Phone calls and a safety meeting in the control room on March 23, 2005, were investigated as potential 

distractions for the Board Operator; however, a review of available evidence suggests that neither issue 

was a likely distraction. The phone calls into and out of the centralized control room were limited in 

number and duration during the startup. And the historical control board data does not indicate that the 

Board Operator’s decision-making was affected by the safety meeting. (Appendix P provides a more 

detailed discussion of both concerns.) 
BP Texas City Final Investigation Report 3/20/2007 

102

3.11 Summary 

Numerous underlying latent conditions collectively influenced the decisions and actions of the operations 

personnel at the AU2/ISOM/NDU complex. These safety system deficiencies created a workplace ripe for 

human error to occur. 
BP Texas City Final Investigation Report 3/20/2007 

103

4.0 INCIDENT INVESTIGATION SYSTEM DEFICIENCIES 

The CSB found evidence to document eight serious ISOM blowdown drum incidents from 1994 to 2004; 

in two, fires occurred. In six, the blowdown system released flammable hydrocarbon vapors that resulted 

in a vapor cloud at or near ground level that could have resulted in explosions and fires if the vapor cloud 

had found a source of ignition. In an incident on February 12, 1994, overfilling the 115-foot (35-meter) 

tall Deisohexanizer (DIH) distillation tower resulted in hydrocarbon vapor being released to the 

atmosphere from emergency relief valves that opened to the ISOM blowdown system. The incident report 

noted a large amount of vapor coming out of the blowdown stack, and high flammable atmosphere 

readings were recorded. Operations personnel shut down the unit and fogged the area with fire monitors 

until the release was stopped. 

In August 2004, pressure relief valves opened in the Ultracracker (ULC) unit, discharging liquid 

hydrocarbons to the ULC blowdown drum. This discharge filled the blowdown drum and released 

combustible liquid out the stack. While the high liquid level alarm on the blowdown drum failed to 

operate, the hydrocarbon detector alarm sounded and fire monitors were sprayed to cool the released 

liquid and disperse the vapor, and the process unit was shut down. 

These incidents were early warnings of the serious hazards of the ISOM and other blowdown systems’ 

design and operational problems. The incidents were not effectively reported or investigated by BP or 

earlier by Amoco (Appendix Q provides a full listing of relevant incidents at the BP Texas City site.) 

Only three of the incidents involving the ISOM blowdown drum were investigated. 

BP had not implemented an effective incident investigation management system to capture appropriate 

lessons learned and implement needed changes. Such a system ensures that incidents are recorded in a 

centralized record keeping system and are available for other safety management system activities such as 
BP Texas City Final Investigation Report 3/20/2007 

104

incident trending and process hazard analysis (PHA). The lack of historical trend data on the ISOM 

blowdown system incidents prevented BP from applying the lessons learned to conclude that the design 

of the blowdown system that released flammables to the atmosphere was unsafe, or to understand the 

serious nature of the problem from the repeated release events. 

BP’s problems with its incident investigation system were not isolated to the ISOM unit. In the two years 

before the incident, refinery audits and other reviews indicated larger problems with the Texas City 

incident investigation system. A 2003 external audit120 found that “a coordinated, self-monitoring and 

self-assessment process is not evident throughout the line organization.” A 2004 audit121 graded as “poor” 

how incident investigation information was analyzed to monitor trends and develop prevention programs. 

 

120 2003 GHSER Audit Report, BP South Houston, September 22, 2003. 

121 2004 GHSER Assessment, Texas City Site, August 2004. 
BP Texas City Final Investigation Report 3/20/2007 

105

5.0 EQUIPMENT DESIGN 

5.1 Hazards of High Tower Level 

The hazards of overfilling distillation towers were not well understood by Texas City management and 

operations personnel; however, overfilling incidents in the process industry have been well-documented. 

Distillation tower expert Henry Kister (2003) analyzed recent trends in distillation tower malfunctions 

from 900 case histories, and found that more problems initiate at the tower base than in any other section, 

with half of the tower base malfunctions involving high liquid level. 

Kister (2006a) reports several incidents where the high level led to liquid discharges into the tower 

overhead equipment. For vessels generally, the U.K. Health and Safety Executive similarly found, in its 

analysis of 718 loss of containment incidents, that overflow was the second leading cause (Collins & 

Keely, 2003). In his case history review, Kister concludes that faulty level measurement and control are 

the primary causes of tower high level events, as seen in this ISOM incident (Kister, 2006a & 1990). 

5.2 Previous Tower Overfilling Incidents 

The hazards of high tower level were also known from a previous ISOM incident investigation. As 

section 4.0 discussed, on February 12, 1994, another ISOM distillation tower was overfilled with liquid. 

The investigation report states that the level indication reached 91 percent and remained there while 

operators struggled to lower the tower level over a 24- hour period. The tower remained in operation 

while an undiagnosed blockage in the bottom pumps caused the tower to fill with liquid. Overfilling led 

three pressure relief valves to open, and large amounts of hydrocarbon vapor were released from the 

blowdown stack. Like the 1994 tower overfill, the 2005 incident involved filling the raffinate splitter 

tower for several hours with no flow out of the bottom. In both incidents a malfunctioning level 
BP Texas City Final Investigation Report 3/20/2007 

106

 

transmitter misled operations personnel about the actual liquid level in the tower. 

A high distillation tower level led to a fire and explosion incident reported by the U.K. Health and Safety 

Executive (1997). In July 1994, at the Texaco Milford Haven refinery, a plant upset resulted in liquid 

hydrocarbons being pumped into a distillation tower for several hours while liquid flow out of the bottom 

was shut off. This problem was undiagnosed by operations personnel, as the instruments indicating the 

outlet valve position, level, and flow out of the tower bottom provided inaccurate information. As a result, 

the tower over-pressured and caused a release of flammable hydrocarbons when outlet piping from the 

flare knock-out drum failed. The lessons from this incident were addressed to the U.K. refinery and 

petrochemical industry, including BP (HSE, 1997). The Health and Safety Executive found that the 

operators were not provided adequate information on process conditions and that Texaco was not 

adequately monitoring instrument maintenance and equipment inspection. 

5.3 Level Indication Design 

None of the instruments that indicated raffinate splitter tower level were working properly on March 23, 

2005. The tower level instrumentation consisted of a displacer type level transmitter, a level sight glass, 

and two redundant level switches (high and low level), both of which failed to trigger alarms on the day 

of the incident.122 The tower level transmitter provided faulty readings and the level sight glass was dirty 

and non-operational. The tower was not equipped with an additional level indication or with pressure 

indicators that could have warned the board operator about high liquid level. 

122 The low level switch failed to alarm but did not play a role in causing the incident. 
BP Texas City Final Investigation Report 3/20/2007 

107

Kister concluded from his review of distillation tower malfunctions that reliable level monitoring is 

important in preventing high level incidents, so much so that facilities should “refrain from proceeding 

with a startup when a reliable level indication is absent” (Kister, 1990). Redundant level instrumentation 

extending above the range of the primary column level instruments is valuable for detecting excessive 

liquid levels (Kister, 2006a). Such instrumentation could include an upper displacement meter, a column 

bottom pressure transmitter, or a lower column differential pressure transmitter. However, to be effective, 

safety critical instrumentation, such as column bottom level instruments, must be maintained in a 

functional and correctly calibrated condition. 

After the 2005 raffinate splitter tower incident, BP experienced another distillation tower high level 

incident at its Whiting, Indiana refinery. On December 13, 2005, during unit startup, a distillation tower 

overfilled, leading to the filling of a flare knockout drum and liquid flow into the fuel gas system, causing 

flames to shoot out of two furnace fire boxes. A newly installed level transmitter was found to have 

failed, leading to overfilling the tower while the tower outlet valve was closed. Other pressure indicators 

on the tower that could have provided additional information on the high level condition were not 

working. The BP investigation team recommendations included installing an additional level indicator 

and repairing the two malfunctioning pressure indicators. 

5.4 Automatic Safety Controls 

Even if the level instrumentation in the raffinate splitter column had operated properly, BP relied on the 

correct and timely action by operators and following procedures to prevent excessive column liquid 

levels. The tower was not equipped with automatic shutdowns or safety interlocks triggered by a high 

level, either of which could have provided additional protection against tower overfill. 
BP Texas City Final Investigation Report 3/20/2007 

108

While procedures are essential in any process safety program, they are regarded as the least reliable 

safeguard to prevent process incidents. The CCPS has ranked safeguards in order of reliability (Table 3). 

Passive safeguards, such as reduced inventory of hazardous substances, cannot readily fail, but as in this 

case, are not always feasible. Procedural safeguards, such as operating procedures, because they rely on 

personnel consistently making correct and timely decisions while performing other duties and potentially 

while stressed or fatigued, are considered to be the least reliable. 

Table 3. Safeguard reliability (CCPS, 1996b) 

Reliability Type Examples 

Most Reliable Passive Safeguards 

Reduced inventory of hazardous substances 

Use of chemistry with reduced toxicity 

Less Reliable Active Safeguards 

Emergency shutdown systems 

Flare stacks 

Least Reliable Procedural Safeguards Operating procedures 

Failures with potentially severe consequences, such as overfilling a column in flammable service, may 

require multiple, redundant, active safeguards. Examples of active safeguards that could reduce the 

likelihood or consequences of column overfilling include, but are not limited to 

• reducing and shutting off column feed on increasing high column level to prevent further material 

accumulation, 

• shutting down the reboiler on high column level to prevent damage to trays or massive carryover 

of liquid from the column, or 

• directing relief valve discharges to a high-capacity liquid knock-out system and flare stack. 
BP Texas City Final Investigation Report 3/20/2007 

109

In its report on the Milford Haven explosion, the U.K. Health and Safety Executive recommended an 

automatic safety device such as the shutdown of tower feed to prevent overfilling (HSE, 1997). The 

Instrument Society of America has suggested high level overrides on column feeds to reduce, and 

eventually halt, the flow of material into a column if the liquid level is high (Buckley et al., 1985). For 

columns where the consequences of overfilling could be severe, redundant instrumentation and a high 

reliability safety instrumented system (SIS) are recommended. Such systems, which operate 

independently of the normal operating controls, improve the reliability of safeguards and help reduce the 

likelihood of catastrophic failures such as the March 23, 2005, incident. 

5.5 Pressure Relief and Disposal System Design 

The investigation analyzed the design of the pressure relief system on the raffinate splitter tower and the 

disposal of the relief streams via the disposal collection header connected to the blowdown drum and 

stack. The analysis focused on the design basis of the relief and disposal system, calculations of relieving 

rates, and placement of equipment. The design basis was compared against the definition provided by the 

EPA in guidance materials for its Risk Management Program (40 CFR, Part 68): 

Design basis means documenting how the loads and sizes of the relief system, as well 

as inlet and outlet sizes were determined. This includes a description of overpressure 

scenarios considered, the scenario that creates the largest load to be relieved, the 

assumptions used and if the device meets a certain code.... (EPA, 2003). 

The importance of properly documenting the design basis of relief systems is discussed in the third 

edition of Lees’ Loss Prevention in the Process Industries: 

The core purpose of the relief system design basis documentation is two-fold: (1) to 

ensure that the entirety of the process unit is adequately protected against all credible 

sources of overpressure, and (2) to ensure that this design basis information is 
BP Texas City Final Investigation Report 3/20/2007 

110

available to all interested parties throughout the operating life of the unit. These goals 

may be satisfied if the documentation captures the analysis process of the original 

designers of the unit’s pressure relief system (Mannan, 2005). 

 

The analysis must also address credible overpressure scenarios to ensure that the relief devices are 

equipped to safely dispose of the effluent while not compromising overpressure protection. 

5.5.1 Safety and Engineering Standards 

The Texas City refinery was owned and operated by Amoco Corporation prior to the merger with BP 

(Appendix D). Hence, the refinery and its equipment were designed and operated in accordance with 

Amoco and U.S. industry engineering codes and process safety standards. After the merger, former 

Amoco sites continued using the existing safety and engineering standards. Amoco and BP had developed 

a number of safety standards and engineering specifications that applied to safety relief valves, collection 

headers, and effluent systems; the most pertinent in use at Texas City were 

• Process Safety Standard No. 6, “Flare, Blowdown, Pressure Relief, Vent and Drain Systems for 

Process Units,” originally issued September 20, 1977 and updated in 1986, 1990, and 1994; 

• Engineering Specification 49D-2, “ISBL Equipment Location and Spacing,” October 21, 1992; 

• A CV-PLT-DISP-E, “Civil Plant Disposal Systems Engineering Specification,” October 1998; 

and 

• “BP Chemicals Relief Systems Design Guide”, Draft 1B, June 2001. 

5.5.2 Pressure Relief System Design Basis 

Texas City management did not identify all credible overpressure scenarios, fully document potential 

overpressure events, or calculate relief flow rates for all the potential overpressure scenarios on the 
BP Texas City Final Investigation Report 3/20/2007 

111

raffinate splitter (Appendix R). Without this information, Texas City management could not ensure that 

the blowdown disposal system was safely designed. The lack of design basis documentation also points 

to a failure of PSM systems, such as process safety information and PHA requirements. 

5.5.3 Blowdown System Design Basis 

No evidence suggests that an analysis had been conducted to determine if the ISOM blowdown drum was 

safely designed. BP was unable to provide the CSB with any documents from the historical files 

concerning the original design basis of the blowdown drum and stack. No documents could be found 

indicating or showing that the blowdown drum could safely handle the effluent when the Heavy 

Ultraformate Fractionator (HUF) was installed in 1976, or after it was converted to a raffinate splitter in 

1985 (Appendix E.1). While a contractor evaluated the other headers discharging into the blowdown 

drum when the ISOM unit was converted to a Penex reactor, the header from the raffinate splitter tower 

was not included in the evaluation. A BP engineer reviewed the results of the contractor’s study in March 

1994 and erroneously concluded that all the relief headers had been examined and were properly sized. 

His conclusion was then used as justification for closing an action item from the 1993 PHA to review the 

unit’s relief valves to ensure that they were properly sized for current operation. And a 2003 process 

safety analysis action item for a review of the unit’s relief valves was never completed; the target date 

was March 31, 2005, eight days after the explosion. 

5.5.4 Process Safety Standard No. 6 

The Texas City refinery did not follow the requirements of Amoco’s Process Safety Standard (PSS) No. 6 

(adopted by BP), which did not allow new atmospheric blowdown systems and required existing 

blowdown systems to be phased out. The policy required stacks to be converted to flare or closed system 

configurations “when the size of the existing facility is outgrown or when major modifications are made 

to the existing facility.” The policy also did not allow quenched blowdown systems (such as the ISOM) 
BP Texas City Final Investigation Report 3/20/2007 

112

 

to relieve to the atmosphere. Based on this policy, the following requirements or events should have 

triggered the replacement of the ISOM blowdown system: 

• When the HUF fractionator was converted to a raffinate splitter tower in 1985, the existing 

quenched blowdown drum should have been converted. 

• The replacement of the blowdown drum and stack in 1997 was a major modification to the ISOM 

unit.123 

• A major modification also occurred in 2003 when the original design intent of the blowdown 

drum was significantly altered after the quench capabilities of the drum were impaired due to 

corrosion. The blowdown drum remained in disrepair until the time of the incident. 

The purpose of PSS No. 6 was to ensure, “safe design of those systems in hydrocarbon processing units 

which are in place to control releases of hydrocarbons or potentially toxic materials to the environment. In 

general, release of these materials into closed systems is preferable. Containment, handling and proper 

disposal of such materials is critical to unit and personnel safety.” The CSB concluded that PSS No. 6 

required that the ISOM blowdown system should have been replaced for safety reasons. 

5.5.5 Amoco Engineering Specification 49D-2 

The blowdown drum and stack did not meet the Amoco engineering specification for spacing and location 

of refinery process unit equipment. Section 7.4 of this specification states that blowdown stacks be 

“located remote from other equipment, preferably OSBL (outside battery limits) and on the downwind 

side of the unit. The clear space between blowdown facilities and other equipment should be a minimum 

of 40 feet (12.2 m).” The blowdown drum and stack were located in the northwest corner of the ISOM 

123 BP managers stated in interviews after the incident that the 1997 project was a “replacement in kind” and did not 

trigger the conversion to a flare system. The policy did not contain an “in kind” exemption, nor did any historical 

record exist that showed that such an exemption was ever relied upon. 
BP Texas City Final Investigation Report 3/20/2007 

113

 

unit, inside the battery limits124 (ISBL). The Amoco engineering specification states that major deviations 

from this guideline will need approval from the Refinery Process Safety Committee, but no evidence was 

found to indicate that the Texas City refinery ever sought approval to deviate from this standard. This 

standard should have been reviewed during PHA revalidations and facility siting studies; if it had, then 

the removal of the blowdown drum would have been evaluated. 

5.5.6 Amoco Engineering Specification A CV-PLT-DISP-E 

The blowdown drum and stack did not meet Amoco engineering specifications for plant disposal systems, 

which required that blowdown systems discharge to a vapor recovery system or a flare, rather than to the 

atmosphere. In 1998, Amoco Corporation Engineering Specification, A CV-PLT-DISP-E, “Civil Plant 

Disposal Systems Engineering Specification,” was issued. This specification defines “technical 

requirements for design of drain, vent, pump-out, blowdown, and sanitary sewer systems in plant 

processing facilities,” and defines a blowdown system as one that provides a means of safely and quickly 

removing process streams from a processing facility in an emergency. The general requirements of this 

standard state: “If deviation from this specification is necessary to conform to equipment design, unusual 

operating conditions, or existing facilities, approval to do so shall be obtained from Company,” yet the 

CSB found no evidence to indicate that the Texas City refinery ever sought approval to deviate. This 

specification states that whether hot hydrocarbons are released to a blowdown system and quenched, or 

cold hydrocarbons are drained into a blowdown drum, the drum will be vented to a flare or vapor 

recovery system, not directly to the atmosphere. 

124 The battery limit is an area in a refinery or chemical plant encompassing a process unit or battery of units with 

the unit(s)’s related utilities and services (Parker, 1994). 
BP Texas City Final Investigation Report 3/20/2007 

114

 

5.6 Previous Attempts to Remove Blowdown Drums 

During the 15 years prior to the March 2005 incident, a number of proposals were made to remove 

blowdown stacks that vent directly to the atmosphere at the Texas City refinery, but none were 

implemented, primarily due to cost considerations. 

5.6.1 1991 Flare/Blowdown Strategy 

In mid-1991, in response to recent changes to the EPA Clean Air Act and various state requirements to 

disclose non-routine process vent sources, the Amoco Refining Planning Department (ARPD) proposed a 

strategy to eliminate blowdown stacks that vented to the atmosphere. In 1992, ARPD decided not to 

include separate funding for flare and blowdown work in the 10-year capital plan because neither federal 

nor state regulations were likely to require that relief valves be routed to closed systems in the foreseeable 

future. Instead, Amoco refineries were directed to identify and correct all deficiencies in equipment 

protection, including installation of common flare systems and projects, to correct Amoco PSS No. 6 

deficiencies. 

5.6.2 1992 OSHA Citation 

In 1992, OSHA issued a serious citation to the Texas City refinery alleging that nine relief valves from 

vessels in the Ultraformer No. 3 (UU3) did not discharge to a safe place and exposed employees to 

flammable and toxic vapors. One feasible and acceptable method of abatement OSHA listed was to 

reconfigure blowdown to a closed system with a flare.125 Amoco contested the OSHA citation. 

125 OSHA Citation No. 107617789, item 2, 3/30/1992. 
BP Texas City Final Investigation Report 3/20/2007 

115

 

In March 1994, OSHA and Amoco agreed to a settlement126 regarding the 1992 citation. As part of that 

settlement, OSHA agreed to withdraw the citation, and Amoco stipulated that the conditions described in 

the violation had been analyzed in accordance with API Recommended Practice 521, “Guide for 

Pressure-Relieving and Depressuring Systems,” and that the hazardous conditions cited did not exist or 

had been corrected. The agreement also allowed OSHA or its consultants access to the workplace to 

review Amoco’s analysis of the conditions to verify compliance; however, OSHA did not conduct a 

follow-up inspection. 

5.6.3 1993 Amoco Regulatory Cluster Project 

The 1993 Amoco Regulatory Cluster Project was initiated to resolve compliance issues with all liquid 

waste regulations by installing state-of-the-art, double-lined, 100 percent segregated sewer systems at 

each process unit. All blowdown stacks would be eliminated and replaced with flares and knockout drums 

for maintenance and all liquid waste. High-risk areas would also have double-contained sumps installed 

to catch drips and drain rain water. However, due to project costs of $400 million, Amoco decided not to 

fund the project. 

5.6.4 2002 NDU Flare line 

During project development for the construction of the NDU and its flare system in early 2002, the 

contracted engineers sizing the flare line asked if the line should be sized to accommodate process 

streams from the ISOM unit as well. They noted that if the ISOM used the same flare line as the NDU, it 

would save about 1,000 feet (305 m) of pipe. If not, the proposed line size to the NDU flare could be 

reduced, saving $150,000. Due to uncertain future regulatory requirements and financial pressures, the 

126 Occupational Safety and Health Review Commission (OSHRC) Docket No. 92-1394, 92-1395. 
BP Texas City Final Investigation Report 3/20/2007 

116

refinery manager stated that only the original project as approved was to proceed and to “bank the savings 

in 99.999 percent of the cases.”127 Consequently, the ISOM unit tie-in was not made. 

5.6.5 2002 Clean Streams Project 

As a result of compliance issues with the EPA’s environmental regulations, including the “National 

Emissions Standard for Hazardous Air Pollutants” (NESHAP) standard128 for benzene waste and volatile 

organic compounds (VOC),129 the Texas City refinery health, safety, and environment (HSE) department 

initiated a capital project, called “Clean Streams,” in summer 2002. The project was assigned to a BP 

process engineering group with support from outside engineering firms, and involved either removing all 

liquid streams routed to blowdown stacks or installing emission controls. The short-term goals centered 

on identifying and measuring non-relief valve streams going to blowdown drums and identifying 

solutions to eliminate the sources discharging to blowdown drums. Long-term goals included eliminating 

blowdown stacks and initiating projects to install closed systems or flares for relief valve disposal. A 

presentation to the EPA in November 2002 included a slide on the Clean Streams project indicating that 

BP intended to remove all streams, other than relief valves from blowdown systems, to achieve rapid 

compliance with benzene waste issues. 

As the ISOM unit was going to be shut down for a turnaround in early 2003, it was one of the first 

refinery units evaluated for benzene elimination. One option considered by the Clean Streams project 

team was to reconfigure the blowdown drum as a flare knockout drum and route its discharge to a flare to 

reduce benzene emissions. However, because the relief valve and header study was not up-to-date, this 

option was not selected. The ISOM unit relief valve and header study should have been completed before 

the first unit PHA was completed in 1993 (see Section 5.5.3). The Clean Streams project team discovered 

 

127 Email “Re: Line size for NDU flare,” from Refinery Operations Manager, January 9, 2002. 

128 40 CFR 61.340. 

129 40 CFR 63.640. 
BP Texas City Final Investigation Report 3/20/2007 

117

in September 2002 that no study existed for the ISOM unit, and that budget cuts had delayed completion 

of the planned ISOM unit relief valve and header study for at least a year until the end of 2004. 

Instead, the team decided to divert benzene-containing streams to segregated wet/dry closed systems with 

relief valves still venting to the blowdown drum. This took advantage of an exemption in the 

environmental regulations for emergency releases. Tie-ins for the wet/dry closed systems were done 

during the 2003 turnaround so these systems could be installed later. 

As the Clean Streams project costs rose from $6 to $89 million, its proposed scope was discussed and 

redefined by BP managers, project engineers, and environmental personnel during an April 2003 “Setting 

Business Priority” workshop. After the meeting, the project scope changed from converting blowdown 

drums to emergency use to only attaining compliance with the refinery’s two mega-gram-per-year limit 

for benzene waste. Consequently, the wet/dry system project in the ISOM unit was deemed unnecessary 

to meet the limit, the project was cancelled, and the wet/dry system was never installed. 

The primary driver for the Clean Streams project evolved over time to focus on achieving compliance 

with EPA benzene waste regulations as soon as practical; safety and engineering specifications were not 

considered or addressed. Due to scheduling pressures from the upcoming turnarounds, the Cleans Streams 

project did not follow safeguards that were part of BP’s Capital Value Process (CVP), including 

consideration of safety and engineering policies, such as those discussed in sections 5.5.4 through 5.5.6. 

5.7 API 521 Guidelines 

At the time of the March 23, 2005, incident, the American Petroleum Institute (API) Recommended 

Practice No. 521, “Guide for Pressure-Relieving and Depressuring Systems,” (1997) was the generally 

accepted industry standard for pressure relieving and disposal systems. As Amoco asserted to OSHA in 

the 1994 citation settlement agreement, Amoco used an earlier addition of this guideline to evaluate its 
BP Texas City Final Investigation Report 3/20/2007 

118

blowdown drums. The CSB also evaluated this guideline to determine its effectiveness in addressing 

hazards posed by blowdown drums with integral stacks open to the atmosphere. 

The API 521 guidelines are divided in four main sections: causes of overpressure, determination of 

individual relieving rates, selection of disposal systems, and disposal systems. Gaps and ambiguities were 

noted in the guidelines and are discussed below. 

5.7.1 Tower overfilling scenario 

Although the API guidance covers 16 potential causes of overpressure, it does not address the potential 

overpressure hazard of vessel liquid overfill, or the hazard of a large liquid release to a disposal drum that 

vents directly to the atmosphere. 

5.7.2 Selection of disposal systems 

In “Selection of a Disposal System,” Section 4 of the guideline, there is no reference to the type of 

disposal system operating in the ISOM unit at BP Texas City; namely, multiple relief valves venting to a 

disposal collection header discharging to a blowdown drum fitted with an atmospheric vent stack. In 

section 4.6, “Disposal of Liquids and Condensable Vapors,” the short subsection 4.6.1.3 states that relief 

valves that discharge hot hydrocarbon liquids or vapors may be piped to a header that terminates in a 

quench drum. Subsection 4.6.1.3.1 indicates that a type of quench drum may be connected to a vent stack 

or flare. The ISOM blowdown drum had water sprays for quenching, but they were inoperable. Quench 

fluid is designed to be sprayed on hot vapors and will not prevent the release of volatile hydrocarbon 

liquids to the atmosphere if overfilled. This two-paragraph subsection does not discuss the sizing of the 

drum for liquid or vapor release scenarios, nor does it advise on the safe siting of the vent stack. 
BP Texas City Final Investigation Report 3/20/2007 

119

5.7.3 Sizing the knockout drum 

Section 5.4.2.1, “Sizing a Knockout Drum,” of the guideline, asserts that sizing is “generally a “trial-anderror process.” A liquid overfill scenario is not considered. In fact, the guidance states: 

However, it would usually not be necessary to consider the following volumes relative to 

vapor disengaging in the following situation: that in which the knockout drum is used to 

contain large liquid dumps from pressure relief valves from other sources where there is no 

significant flashing, and the liquid can be removed promptly. 

The BP incident involved liquid overfill, not liquid/vapor disengagement. Even then, the guidance says 

that sizing the drum for large liquid dumps does not have to be considered if the liquid can be removed 

“promptly.” The guidance does not define “promptly” or how to size a drum when the liquid cannot be 

removed “promptly.” 

5.7.4 Inherently safer approaches 

The API 521 discussion of designing or selecting disposal systems does not address the concept that a 

flare system is an inherently safer design than an atmospheric vent stack because it safely combusts 

flammable hydrocarbons before they are vented to atmosphere, where they could become a serious fire or 

explosion hazard. 

A flare system with a knockout drum is both a destruct and containment system. A properly sized 

knockout drum would contain a credible “worst case” scenario release. Containment is one of the main 

lines of defense against releases of hazardous materials (Kletz, 1998). The flare burner is a destruct 

system, which is an inherently safer option compared to dispersing flammables to the atmosphere from 

the blowdown drum vent stack. 
BP Texas City Final Investigation Report 3/20/2007 

120

 

API 521, Section 5.4.4, “Vent Stacks,” discusses stack sizing and minimum velocity directed at vents 

directly off pressure relief valves. There is no discussion of backpressure effects on relief valves and the 

potential impacts on stack discharge velocity from having varying numbers of relief valves discharge to a 

header system connected to an atmospheric vent stack. In the ISOM unit, 58 emergency relief valves 

vented into disposal collection headers that discharged into the blowdown drum, many of which might 

operate simultaneously. The section does discuss the issue of possible liquid accumulation from vapor 

condensation, but not from a large liquid release. One alternative mentioned to avoid liquid accumulation 

is the installation of “a small disengaging drum” at the base of the vent stack, but the need for a 

blowdown or quench drum to be sized for a potential large liquid release is not discussed. Little guidance 

is given for safely siting vent stacks in the process plant. In fact, the section on design details states that 

vent stacks are frequently located in a process area that contains equipment connected to the stack, and 

suggests that the stack can often be more economically supported from a fractionating tower, chimney, 

etc. This suggestion ignores the safety implications of a potential large liquid or low discharge velocity 

vapor release in the middle of a process unit. 

5.8 Conclusion 

Based on the analysis of the relief system, the blowdown drum was undersized and the emergency relief 

system design did not address the potential of a large liquid release in the event the raffinate splitter tower 

overfilled. After the March 23, 2005, incident, BP evaluated the 22 blowdown systems at its five U.S. 

refineries and found that 17 handled flammables. BP has publicly pledged to eliminate all atmospheric 

blowdown systems in flammable service at all five of its U.S. refineries. 

In light of the ambiguities and gaps discovered in reviewing API 521, CSB issued a recommendation to 

API on October 31, 2005, (Appendix C) to revise its recommended practice. OSHA’s PSM standard130

130 29 CFR 1910.119(d)(3)(i)(D), “Process Safety Management of Highly Hazardous Chemicals.” 
BP Texas City Final Investigation Report 3/20/2007 

121

requires that relief system designs comply with “recognized and generally accepted good engineering 

practices.” Published PSM compliance guidelines call for inspections to ensure that “destruct systems, 

such as flares, are in place and operating” and that “pressure relief valves and rupture discs are properly 

designed and discharge to a safe area” (CPL 2-2.45A, 1994). Therefore, the CSB recommended that 

OSHA implement a special emphasis program for oil refineries to focus on blowdown drums that 

discharge directly to the atmosphere and their design (Appendix C). 
BP Texas City Final Investigation Report 3/20/2007 

122

6.0 TRAILERS 

6.1 Placement of Temporary Structures 

BP’s placement of occupied trailers close to the ISOM unit was a key factor leading to the fatalities from 

this disaster. All 15 who died during the March 23, 2005, incident were in or around trailers. The trailers 

were sited in this area primarily for convenience: the unoccupied area between the ISOM and NDU units 

was selected because it was across the road from the Ultracracker, (ULC) and would be a convenient 

staging area for the contractors in their turnaround work (Figure 15). The CCPS noted that this practice is 

an increasing trend: 

Temporary, nonpermanent structures may be used at processing facilities. The most common 

are mobile office trailers used during construction or periodic major unit overhaul or 

turnaround. A common practice is that these temporary offices are located near processing 

areas for convenience and are not removed on completion of the job; thus, they transition 

from temporary to semi-permanent (CCPS, 2003). 

6.2 History of Trailers in the Area 

BP had been using trailers as temporary office spaces for several years at the Texas City refinery. A 

survey by the Texas City Facilities and Services department showed that in 2004, 122 trailers were in the 

refinery with an estimated occupancy of 800. These trailers were generally used to house employees and 

contract workers during turnaround periods. BP policy allowed trailers to be sited near process units 

based on the results of a screening process, which included a building analysis. 

The area between the NDU and the ISOM had been viewed as an appropriate location to site trailers to be 

used during turnarounds for years largely for reasons of convenience. In fact, support utilities had been 

installed in that area in 2002 specifically for use by trailers in the turnarounds when the NDU was 
BP Texas City Final Investigation Report 3/20/2007 

123

 

constructed and never removed. In summer 2003, a series of emails circulated in the BP Oils Turnaround 

Network131 questioned whether changes were needed in turnaround trailer siting practices, or whether 

explosion-proof turnaround trailers should be used, in light of the findings of recently completed Major 

Accident Risk (MAR) studies132 showing that turnaround trailers could be subject to potential explosion 

overpressures in certain areas of refineries. Although the BP Texas City refinery also identified this 

turnaround trailer siting concern as an issue, no evidence was found to indicate that this issue was 

resolved prior to the March 23, 2005, explosion. 

6.2.1 2005 Turnaround 

While planning for the 2005 ULC unit turnaround, in September 2004 BP sited a double-wide trailer 

between the NDU and ISOM to house employees for the Motorization Project. Nine others were located 

in the same area to support the ULC turnaround, but a MOC was not conducted for any of them despite 

being required by BP policy (Figure 15). (Appendix F provides further information on the location, 

construction, and use of all the trailers sited in this area.) 

6.3 BP Texas City Facility Siting Practices 

The policies, procedures, and practices being used at the Texas City refinery for facility siting were 

examined to determine why the trailers were placed so close to hazardous process areas. As most refinery 

units handle large quantities of flammable liquids, they are subject to the requirements of the OSHA PSM 

standard (Section 11.1). The PSM standard requires that facility siting be addressed as one element of a 

PHA using an appropriate methodology [29 CFR 1910.119(e)(2) and (3)(v)]. In its compliance directive 

131 This peer network, which included representatives from all BP refineries, met periodically and exchanged emails 

to discuss best practices for improving turnarounds. 

132 These voluntary studies conducted by BP assessed societal risk by determining the risk of multiple facilities (over 

three) from all potential scenarios at a particular site. The MAR study, conducted in March/April 2003 at the 

Texas City site, identified the top 80 risks, but none included the ISOM unit or blowdown drums. 
BP Texas City Final Investigation Report 3/20/2007 

124

[CPL 02-02-045], OSHA interpreted facility siting to mean “the location of various components within 

the establishment” in relation to PSM-covered process(es). 

Figure 15. Trailer area and adjacent ISOM unit 

6.3.1 Amoco Facility Siting Screening Workbook

Because the Texas City refinery was owned and operated by Amoco Corporation at the time the initial 

refinery-wide siting analysis was conducted in 1995, the refinery used the Amoco Petroleum Products 

Sector (PPS) Refining Facility Siting Screening Workbook as its methodology to analyze siting (Amoco, 

1995). After the BP-Amoco merger in 1999, the Texas City refinery continued to use the Amoco 

workbook, even though BP Oil had been using a different risk-benefit approach in its refineries since the 
BP Texas City Final Investigation Report 3/20/2007 

125

mid-1990s (Fryman, 1996). In fact, the facility siting analysis was revalidated in 2002 using the Amoco 

workbook, even though the BP Group had adopted and published a new group risk criteria (Mogford 

2005, pg. 98). The workbook generally follows API 752 (1995), but contains some differences (Appendix 

F.1.1) that made it less protective (see additional discussion in Section 6.4 and Figure 16). The workbook 

sets forth a methodology for assessing risks involved in locating buildings with respect to process. 

Although the limitations of this workbook (e.g.. potential for trailer damage from a vapor cloud explosion 

and annualized occupancy of highly populated, short-duration turnaround trailers) were pointed out in a 

September 2004 email forwarded from the Whiting refinery to the Texas City PSM manager, these 

limitations were dismissed because the MOC PHA checklist for temporary trailer siting called for a 

distance of 350 feet (107 m) from the process, and at that distance the risk of a fatality was extremely low. 

However, the 350-foot (107 m) distance trigged a need for an analysis, but did not prevent a trailer from 

being placed closer than 350 feet (107 m). 

6.3.2 MOC Procedures for Facility Siting 

To address potential safety and health hazards of buildings introduced into the refinery between the 

refinery-wide siting studies, such as temporary mobile office trailers used in unit turnarounds, the refinery 

also required all newly sited structures to be evaluated under its MOC procedure, which also required that 

a PHA be conducted. As the trailers involved in the 2005 explosion near the ISOM blowdown drum and 

stack were placed there after the 2002 facility-wide siting study was completed and the next revalidation 

was not scheduled until 2007, facility siting for trailers sited during the 2005 turnaround were addressed 

using the refinery’s MOC procedure. 

6.3.3 What If/Checklist Methodology 

The refinery used a What If/Checklist methodology for PHAs involving trailer siting. After a “What If” 

hazard analysis, a trailer siting checklist needed to be completed. The checklist was the first step in the 
BP Texas City Final Investigation Report 3/20/2007 

126

screening process to determine if the building could be screened out based solely on its distance from the 

process unit. One checklist question asked if the trailer was to be located within 350 feet (107 m) of a 

process unit. If the answer to this question was “Yes,” then further screening was required, which 

involved analyzing the building siting using the Amoco workbook. 

6.3.4 MOC Implementation Problems with Trailer Siting 

On September 27, 2004, BP Texas City staff completed a MOC form, which indicated that a double-wide 

mobile office trailer would be temporarily sited in the open area between the ISOM and NDU units for 

use by the Motorization Project during the upcoming ULC turnaround; the intention was to remove it 

when the project was completed at the end of April 2005. The MOC team conducting the PHA for this 

trailer did a “What If” analysis, using questions brainstormed by the MOC team, and then completed the 

checklist. As the trailer was closer than 350 feet (107 m) from both the ISOM and NDU units, they 

correctly answered the question on the checklist and were directed to perform a building siting analysis. 

However, none of MOC team members had been trained to use the Amoco workbook and thus did not 

understand how to do the building siting analysis. In lieu of an analysis that would have considered siting 

hazards, the MOC team attached a drawing showing the proposed interior configuration of the trailer and 

measured its location from the catalyst warehouse. 

In January and February 2005, nine other trailers were sited between the ISOM and NDU without 

conducting a MOC. For siting purposes, the siting workbook specifically instructs users to consider 

clusters of buildings, such as turnaround trailers, as one building, which the team did not do. By 

conducting only one MOC, the occupancy load of the other trailers was never considered to increase risk. 

In addition, the MOC procedures clearly state that the proposed change – in this case the siting of the first 

trailer – cannot be initiated until all action items identified in the PHA have been resolved. Although two 

action items were still pending from the MOC at the time of the March 2005 explosion, this trailer had 
BP Texas City Final Investigation Report 3/20/2007 

127

been occupied by contractor personnel since November 2004, and the ISOM unit superintendent had 

never approved the MOC. After the March 2005 incident, BP determined that a majority of the mobile 

office trailers were sited without applying the MOC process and thus no PHAs or siting assessments were 

completed. 

6.4 API 752 Guidelines 

One industry standard used by the chemical, petrochemical, and hydrocarbon processing industries to 

evaluate facility siting in a PHA is API 752, “Management of Hazards Associated with Locations of 

Process Plant Buildings.” Because this guideline was also the basis for the BP Texas City facility siting 

studies, the CSB evaluated this guideline, which uses a three-stage analysis process to identify hazards 

and manage risks to building occupants from explosion hazards. Buildings screened out during one of the 

stages require no further evaluation. The guideline also allows companies to develop specific criteria 

pertaining to occupancy levels, evaluation-case events, consequence modeling/analysis programs, and 

risk acceptance criteria (Section 2.4.1, API 1995). Consequently, the values chosen by each company for 

these criteria will affect how buildings are screened. 

API 752 does not address whether the convenience of placing of temporary mobile structures, like 

trailers, close to process units handling high hazardous chemicals outweighs the risk to occupants. Nor 

does it establish a minimum safe distance among various types of buildings and hazardous process units. 

The guidelines note that occupancy is normally based on an annual average and recommends that weekly 

occupancy rates vary from 200 to 400 person hours each week (the difference between five and 10 fulltime employees being exposed to risk). Additionally, peak occupancy varies from five to 40 personnel. 

Yet by allowing this amount of latitude, companies applying API 752 using a high-occupancy criterion 

could place employees at significant risk and still fall within the allowances of the guidelines. Also, using 

an annual average as a basis for occupancy is inappropriate for trailers that will be occupied only several 
BP Texas City Final Investigation Report 3/20/2007 

128

 

months during a unit turnaround. 

The data API uses to assess vulnerability of building occupants during building collapse is based mostly 

on earthquake, bomb, and windstorm damage to buildings. However, as vapor cloud explosions tend to 

generate lower overpressures with long durations (and thus relatively high impulses) (Gugan 1979), the 

mechanism by which vapor cloud explosions induce building collapse does not necessarily match the data 

being used in API 752 to assess vulnerability. The CSB found that this data is heavily weighted on the 

response of conventional buildings, not trailers, which are not typically constructed to the same standards. 

Thus, when the correlations of vulnerability to overpressure from the March 23, 2005, explosion (Figure 

16) are compared against the API and BP criteria (Section 6.3.1), they were both found to be less 

protective in that both under-predict vulnerability for a given overpressure. Also, the data used by both 

API and BP to estimate vulnerability133 does not include serious injuries to trailer occupants as a result of 

flying projectiles, which are typically combinations of shattered window glass and failed building 

components, heat, fire, jet flames, or toxic hazards. 

In light of these findings and because API 752 is commonly used as a basis for facility siting, the CSB 

made an urgent recommendation to API regarding trailer siting and recommended either revising API 752 

or issuing a new standard to address the issues (Appendix C). 

133 The Amoco workbook data used by BP Texas City was based primarily on fatalities, while the API data was 

based on fatalities and life-threatening injuries. However, OSHA standards are based on Section 5 of the 

Occupational Safety and Health Act of 1970, which requires employers to prevent death as well as serious 

physical harm (such as broken bones and severe lacerations). 
BP Texas City Final Investigation Report 3/20/2007 

129

Figure 16. Comparison of explosion damage based on API and BP Texas City criteria 

6.5 BP Actions After the Explosion 

In its internal investigation of the March 23, 2005 explosion, BP adopted new policies for trailer siting at 

its facilities. Appendix 37 in the “Fatal Accident Investigation Report” (Mogford, 2005) outlines the 

specifics of BP’s new siting policy; trailer siting is now based on exclusion zones for areas where 

explosions are possible, and all occupied trailers should be located outside of vulnerable areas even if this 

means a location outside the refinery. A large number of Texas City personnel were relocated to a 

permanent building away from the refinery after the incident. 
BP Texas City Final Investigation Report 3/20/2007 

130

7.0 MECHANICAL INTEGRITY 

The goal of a mechanical integrity program is to ensure that all refinery instrumentation, equipment, and 

systems function as intended to prevent the release of dangerous materials and ensure equipment 

reliability. An effective mechanical integrity program incorporates planned inspections, tests, and 

preventive and predictive maintenance, as opposed to breakdown maintenance (fix it when it breaks). 

This section examines the aspects of mechanical integrity causally related to the incident. 

7.1 Instrumentation Failures 

The instruments associated with the raffinate splitter tower and the blowdown drum were causal factors in 

the BP Texas City incident. BP instrument technicians described the unit instrumentation as being rundown and in disrepair. 

Table 4 summarizes those ISOM instruments whose failure contributed to the BP Texas City incident. 

The table includes instrument descriptions and functions, as well as the instruments’ modes, causes and 

effects of failure. Details of post-incident instrument testing, inspection, and failure analysis are found in 

Appendix S. 
BP Texas City Final Investigation Report 3/20/2007 

131

Table 4. Instrumentation that failed to operate properly on March 23, 2005 

Tag No. Instrument Function Failure 

Mode 

Likely Failure 

Cause Effect 

LT-5100 Raffinate 

Splitter Level 

Transmitter 

Transmits a signal to 

the control system to 

indicate the level in the 

tower. 

Incorrect 

reading prior 

to the 

incident 

Instrument not 

calibrated for 

actual specific 

gravity of the ISOM 

process fluid, at 

operating 

temperatures. 

Transmitter falsely showed 

the level in the tower 

bottoms below 100 percent 

and falling, when in fact the 

tower was overfilling. 

LSH-5102 Raffinate 

Splitter 

Redundant 

(Hard-wired) 

High Level 

Alarm 

Alarms when the level 

in the tower exceeds a 

maximum set value. 

Failed to 

signal when 

the tower 

bottom level 

reached the 

assigned setpoint. 

Worn, misaligned 

components bound 

the mechanism. 

Operators received no 

independent warning that 

the maximum bottom level 

had been exceeded. 

LG-1002 

A/B 

Raffinate 

Splitter Sight 

Glass 

Visually indicates 

tower level (level 

indication split across 

two sight glasses). 

Sight glasses 

were dirty on 

the inside; 

tower level 

could not be 

visually 

determined. 

Sight glass not 

cleaned. 

Level transmitter calibration 

could not be effectively 

performed without sight 

glass verification. Operators 

had no backup to determine 

tower level. 

LSH-5020 ISOM 

Blowdown 

Drum High 

Level Alarm 

Alarms when the level 

in the blowdown drum 

exceeds a set value. 

This was the only high 

level alarm for the 

blowdown drum. 

Failed to 

signal when 

the tower 

bottom level 

reached the 

assigned setpoint. 

Damaged level 

displacer (“float”) 

No warning that the 

blowdown drum level was 

above maximum.134

PCV-5002 3-lb Pressure 

Vent Valve for 

the Raffinate 

Splitter Reflux 

Drum 

Available for operators 

to manually vent 

gases from the splitter 

overhead system. 

Valve failed 

to open 

during startup 

testing. 

Possible actuator 

stem binding, or 

intermittent 

pneumatic failure. 

Unit was started up with a 

known malfunction of this 

pressure control valve.135

 

134Although this alarm failure did not contribute to the release, the CSB believes that if the alarm had functioned 

properly, the operators may have been alerted to the rising level in the drum and able to sound the emergency 

alarm, which may have led some personnel in the area to evacuate, reducing the consequences of the blast. 

135 The failure of PCV-5002 did not directly contribute to the raffinate splitter overfilling; however, startup of the 

unit should not have been allowed with this valve known to be malfunctioning, according to BP’s own 

procedures. 
BP Texas City Final Investigation Report 3/20/2007 

132

7.2 Mechanical Integrity Management System Deficiencies 

Mechanical integrity is one of 12 functional elements of OSHA’s PSM rule [29 CFR 1910.119 (j)], which 

requires employers to establish written procedures to maintain the mechanical integrity of process 

equipment through 

• testing and inspection, 

• maintenance procedures and training, 

• equipment design and selection, 

• quality assurance of purchased equipment and spare parts, and 

• equipment deficiency correction. 

The goal of mechanical integrity is to ensure that process equipment (including instrumentation) functions 

as intended. Mechanical integrity programs are intended to be proactive, as opposed to relying on 

“breakdown” maintenance (CCPS, 2006). An effective mechanical integrity program also requires that 

other elements of the PSM program function well. For instance, if instruments are identified in a PHA as 

safeguards to prevent a catastrophic incident, the PHA program should include action items to ensure that 

those instruments are labeled as critical, and that they are appropriately tested and maintained at 

prescribed intervals. 

The BP Texas City mechanical integrity program did not ensure that deficiencies, such as those found 

with the ISOM instruments and equipment, were identified and repaired prior to failure. 

7.2.1 Process Safety Information 

Accurate and current instrument data sheets and testing and calibration procedures are necessary for 

instrument technicians to ensure instrument reliability. The instrument data sheets for raffinate splitter 
BP Texas City Final Investigation Report 3/20/2007 

133

 

tower level transmitter and a number of other ISOM instruments were not kept up-to-date or made 

available to maintenance personnel, likely resulting in miscalibration of the level transmitter. As a result, 

the transmitter provided false information to operators during the raffinate tower startup. The plant work 

order system also did not supply necessary calibration information or instrument testing procedures. 

7.2.2 Maintenance Procedures and Training 

The instrument technicians stated that no written procedures for testing and maintaining the instruments 

in the ISOM unit existed. Although BP had brief descriptions for testing a few instruments in the ISOM 

unit, it had no specific instructions or other written procedures relating to calibration, inspection, testing, 

maintenance, or repair of the five instruments cited as causally related to the March 23, 2005, incident. 

For example, the instrument data sheet for blowdown high level alarm did not provide a test method to 

ensure proper operation of the alarm. Technicians often used a potentially damaging method of physically 

moving the float with a rod (called “rodding”) to test the alarm. This testing method obscured the 

displacer (float) defect, which likely prevented proper alarm operation during the incident.136

7.2.3 Process Hazard Analysis (PHA) 

The original 1993 PHA for the ISOM unit identified the level instrumentation on the raffinate splitter as a 

safeguard against tower overfilling. However, the raffinate splitter instruments were not included on the 

list of critical instruments. 

In addition, a safety review of the ISOM unit relief system and blowdown drum identified the raffinate 

splitter level transmitter and alarm as justifications for concluding that tower overfill was not a credible 

scenario. However, neither the PHA nor the relief system review resulted in the raffinate splitter level 

136 While the blowdown drum high level alarm (which was mislabeled in the critical alarm database as “Cooling 

Tower Sump Low Level”) had no listed testing procedure, other listed ISOM testing procedures for high level 

alarms called for instrument technicians to manually “rod float to activate,” which was the procedure typically 

used for the blowdown drum high level. 
BP Texas City Final Investigation Report 3/20/2007 

134

instruments being designated as “safety-critical.” The result was a history of ineffective maintenance for 

the level instruments. Further, no work history was found for the tower level transmitter for the five years 

prior to the incident. 

7.2.4 Deficiency Management: The SAP Maintenance Program 

In October 2002, BP Texas City refinery implemented the SAP (Systems Applications and Products) 

proprietary computerized maintenance management software (CMMS) system. SAP enabled automatic 

generation and tracking of maintenance jobs and scheduled preventive maintenance. 

While the SAP software program can provide high levels of maintenance management, the Texas City 

refinery had not implemented its advanced features. Specifically, the SAP system, as configured at the 

site, did not provide an effective feedback mechanism for maintenance technicians to report problems or 

the need for future repairs. SAP also was not configured to enable technicians to effectively report and 

track details on repairs performed, future work required, or observations of equipment conditions. SAP 

did not include trending reports that would alert maintenance planners to troublesome instruments or 

equipment that required frequent repair, such as the high level alarms on the raffinate splitter and 

blowdown drum. 

Finally, the Texas City SAP work order process did not include verification that work had been 

completed. According to interviews, BP maintenance personnel were authorized to close a job order even 

if the work had not been completed. 

7.3 Summary 

Several instruments in the ISOM raffinate splitter section failed, likely due to inadequate maintenance and 

testing, contributing to the incident. The mechanical integrity program did not incorporate the necessary 

training, tools, and oversight. The equipment data sheets were not kept up-to-date so that incorrect data, 
BP Texas City Final Investigation Report 3/20/2007 

135

such as a wrong specific gravity value for the process hydrocarbons, resulted in miscalibration of critical 

instruments. Instruments with a history of problems, such as the tower high level alarm, were not tracked 

to ensure proper corrective action and avoid breakdown maintenance. Site practices did not ensure that 

instruments were tested and/or repaired before unit startup. Appropriate methods and procedures were not 

used for testing instrument functionality as with the blowdown drum high level alarm. 

Mechanical integrity deficiencies resulted in the raffinate splitter tower being started up without a 

properly calibrated tower level transmitter, functioning tower high level alarm, level sight glass, manual 

vent valve, and high level alarm on the blowdown drum. 
BP Texas City Final Investigation Report 3/20/2007 

136

 

8.0 OTHER SAFETY SYSTEM PROBLEMS 

8.1 Process Hazard Analysis (PHA) 

PHAs in the ISOM unit were poor, particularly pertaining to the risks of fire and explosion. The initial 

unit PHA on the ISOM unit was completed in 1993, and revalidated in 1998 and 2003. The methodology 

used for all three PHAs was the hazard and operability study, or HAZOP.137 The following illustrates the 

poor identification and evaluation of process safety risk: 

• Consequences of high level and pressure in the raffinate splitter tower and high level in the 

blowdown drum and stack were not adequately identified. Overfilling the tower resulting in overpressurization of the safety relief valves and liquid overflow to the blowdown drum and stack was 

not identified. 

• High heat-up rates or blocked outlets were not identified as potential causes of high pressure. 

• The sizing of the blowdown drum for containment of a potential liquid release from the ISOM 

was not evaluated. The safeguards listed for the blowdown drum and stack to protect against the 

hazard of overflow, such as the steam-driven pump-out pump and high level alarm, were 

insufficient to protect against the hazards. No recommendations were made by the PHA team to 

provide additional safeguards. 

137 A systematic method conducted by an interdisciplinary team in which process hazards and potential operating 

problems are identified using a series of guide words to investigate process deviations. If the causes and 

consequences of the deviations are significant and the existing safeguards are determined by the team to be 

inadequate, then a follow-up action is recommended. 
BP Texas City Final Investigation Report 3/20/2007 

137

• Previous incidents with catastrophic potential were not addressed. The 1998 HAZOP revalidation 

did not address the two documented incidents involving the blowdown drum that occurred in 

February 1994, nor was the January 16, 1999, incident addressed in the 2003 HAZOP 

revalidation (see Section 5.1). 

8.2 Management of Change (MOC) 

Changes made to processes, equipment, procedures, buildings, and personnel at the refinery were not 

systematically reviewed to ensure that an adequate margin of safety was maintained. 

The refinery required that a MOC be initiated for any change that involved process chemicals, 

process/equipment technology, equipment piping, process control and instrumentation, operating 

procedures, safe operating limits, relief/safety systems, personnel/staffing/organization/outsourcing, and 

occupied buildings. The program revolved around the refinery Asset Superintendents, who were 

responsible for most aspects of the program. Support for the MOC program was provided by the 

refinery’s PSM group, which managed the electronic MOC database, trained PHA leaders, and tracked 

resolution of MOC action items. 

Every change that required a MOC also required a PHA so that the impact of the change on safety and 

health could be evaluated. Impacts of minor changes were typically assessed using the What If/Checklist 

methodology; for major changes, the HAZOP methodology was typically used. The MOC program 

intended that changes be authorized by the Asset Superintendent once the PHA was complete and all 

safety action items were addressed. However, this was not always done; for example, the siting of the 

double-wide trailer next to the ISOM unit was not authorized. 

There were a number of misapplications of the refinery MOC policy for changes pertaining to the 

blowdown drum, the splitter tower, and occupied trailers (Appendix T). 
BP Texas City Final Investigation Report 3/20/2007 

138

Organizational changes that could adversely impact process safety, such as changes in the management 

structure, budget cuts, etc., generally were not evaluated. The American Chemical Council (ACC) 

recommends in its good practice guideline, “Managing Process Changes,” that organizational, personnel 

and policy changes be evaluated in MOC systems (CMA, 1993). 

8.3 Auditing 

8.3.1 Compliance Audits 

A review of compliance audits at the Texas City refinery revealed that many of the process safety system 

deficiencies causal to the ISOM incident had been previously identified by BP auditors. The OSHA PSM 

standard, 29 CFR 1910.119(o)(1), requires compliance audits every three years to verify that procedures 

and practices developed under the standard are adequate and being followed. Noteworthy findings from 

the two previous PSM compliance audits are discussed below. A number of other audits were also 

conducted at the Texas City refinery to verify compliance with corporate and business unit policies and 

programs (see Section 9.4). 

8.3.2 PSM Audits 

Auditors with process safety experience from other BP facilities audited Texas City’s PSM program in 

2001 and 2004, using an audit protocol developed by the BP Refining Group. These audits focused 

primarily on management systems, not verification of actual practices in the refinery. Although all PSM 

elements were evaluated during these audits, due to the time limitations of the audits (one week) and the 

sampling methods used, all PSM elements were not evaluated in every process unit at the refinery. The 

results of the PSM audit were given to the refinery business unit leader, process safety committee, PSM 

and health, safety, security, and environment (HSSE) departments, which were then responsible for 

developing a corrective action plan to address the audit’s findings. 
BP Texas City Final Investigation Report 3/20/2007 

139

 

8.3.3 2001 PSM Audit 

The 2001 PSM audit addressed PHAs and incident investigations on the ISOM unit. Although no findings 

mentioned the ISOM unit specifically, the audit findings noted that 9 percent of PHA recommendations 

made since OSHA mandated PHAs remained open, and that some of these items dated back to the initial 

unit PHAs conducted in 1993. Also, 15 percent of these open items were found to be past their due dates. 

The audit also noted action items on incident investigations were not being closed out in a timely manner. 

In other PSM areas, the audit team noted that a number of changes had occurred in operating units 

without initiating MOCs, and recommended refresher training on types of changes that needed to be 

managed under the MOC process. The audit team also discovered that a number of operating procedures 

were not current and did not accurately reflect practices on particular units. The team recommended a 

comprehensive audit of operating procedures at each unit. 

8.3.4 2004 PSM Audit 

The 2004 PSM audit for the ISOM unit addressed PHAs, operating procedures, contractors, PSSRs, 

mechanical integrity, safe work permits, and incident investigations. Again, no findings specifically 

mentioned the ISOM unit, but the audit noted that “engineering documentation, including governing 

scenarios and sizing calculations, does not exist for many relief valves. This issue has been identified for 

a considerable time at TCR [Texas City Refinery] (circa 10 yrs) and efforts have been underway for some 

time to rectify this situation but work has not been completed.”138 

The audit also found that the refinery PHA documentation lacked a detailed definition of safeguards, but 

noted that this would be addressed by applying layer of protection analysis (LOPA) for upcoming PHAs. 

However, the ISOM unit’s last PHA revalidation was in 2003, and LOPA was not scheduled to be applied 

138 Executive Summary, “Process Safety Management Audit,” BP South Houston, March 8-12, 2004. 
BP Texas City Final Investigation Report 3/20/2007 

140

until the unit’s next PHA revalidation in 2008. The audit also noted that the refinery had no formal 

process for communicating lessons learned from incidents. 

The audit team found a lack of specific training for newly assigned managers, superintendents, 

supervisors, and engineers, plus lack of a formal gun drill policy. They also found that process safety 

action item resolution was still a problem for the refinery (20 percent of open action items were overdue), 

and that changes were still being made before MOC sign-offs and action items had been resolved. 

8.4 Controlling Vehicle Traffic and People During Startup 

The likely ignition source for the vapor cloud was an idling vehicle parked close to the blowdown drum. 

Most of those injured or killed from the resulting explosion did not need to be in the area surrounding the 

ISOM during the hazardous period of unit startup. Policies applicable to control of vehicle traffic and 

non-essential personnel during abnormal conditions such as unit startup were examined as follows. 

8.4.1 Traffic Safety Policy 

The BP Texas City Traffic Safety Policy (TSP) outlines safety requirements for all vehicles operating 

inside the refinery. The TSP addresses basic vehicle operating rules and procedures, but does not mention 

• plant or unit turnarounds, 

• capital work projects, and 

• traffic safety during abnormal conditions such as unit startup. 
BP Texas City Final Investigation Report 3/20/2007 

141

Interviews with employees revealed that special event coordinators wrote supplemental or modified 

traffic control plans for unit-specific turnarounds. Turnaround traffic control plans point out specific 

changes such as areas of the plant that are restricted to parking or traffic. The West Plant 2005 turnaround 

traffic control plan did not address vehicle access limitations during startup, shutdown, or other abnormal 

conditions. 

The turnaround traffic control plan also did not address the use or parking of vehicles adjacent to the 

battery limits of process units. Drivers were not restricted from parking or leaving vehicles idling close to 

a process unit outer battery limit, where the vehicle engine could introduce a potential ignition 

source. However, the map (Appendix U) issued with the turnaround traffic control plan does indicate that 

no vehicles were to be parked along either side of Avenue F beside the NDU and ISOM units (the idling 

vehicle that was the likely ignition source, as well as a number of other vehicles, were in this area). 

Interviews with turnaround personnel indicated that this map was posted in turnaround trailers. Based on 

the number of contractor vehicles found parked along Avenue F after the incident, the prohibition against 

parking outlined on the map was not enforced. 

8.4.2 Failure to Remove Non-Essential Personnel 

As Section 3.5.2.1 discusses, the site had implemented a PSSR policy applicable to the ISOM startup that 

required sign-off that all non-essential personnel had been removed from the unit and neighboring units. 

Higher level management was required to sign off on the checklists, which included the requirement to 

remove non-essential personnel prior to the startup. None of the PSSR procedural steps were undertaken 

for the ISOM startup. 
BP Texas City Final Investigation Report 3/20/2007 

142

9.0 BP’S SAFETY CULTURE 

The U.K. Health and Safety Executive describes safety culture as “the product of individual and group 

values, attitudes, competencies and patterns of behaviour that determine the commitment to, and the style 

and proficiency of, an organization’s health and safety programs” (HSE, 2002). The CCPS cites a similar 

definition of process safety culture as the “combination of group values and behaviors that determines the 

manner in which process safety is managed” (CCPS, 2007, citing Jones, 2001). Well-known safety 

culture authors James Reason and Andrew Hopkins suggest that safety culture is defined by collective 

practices, arguing that this is a more useful definition because it suggests a practical way to create cultural 

change. More succinctly, safely culture can be defined as “the way we do things around here” (CCPS, 

2007; Hopkins, 2005). An organization’s safety culture can be influenced by management changes, 

historical events, and economic pressures. This section of the report analyzes BP’s approach to safety, the 

mounting problems at Texas City, and the safety culture and organizational deficiencies that led to the 

catastrophic ISOM incident. 

9.1 BP Texas City Explosion: An Organizational Accident 

In the 30 years before the ISOM incident, the Texas City site suffered 23 fatalities. In 2004 alone three 

major incidents caused three fatalities. Many of the safety problems that led to the March 23, 2005, 

disaster were recurring problems that had been previously identified in audits and investigations. Shortly 

after the ISOM incident, two additional incidents occurred at the Texas City refinery in other process 

units due to mechanical integrity failures. And on July 21, 2006, the Texas City refinery had a fatality in 

an accident involving a motorized man-lift. This series of safety failures prompted the CSB to examine 

the safety culture of BP and its influence on the events that led to the ISOM incident. 
BP Texas City Final Investigation Report 3/20/2007 

143

 

Organizational accidents have been defined as low-frequency, high-consequence events with multiple 

causes that result from the actions of people at various levels in organizations with complex and often 

high-risk technologies (Reason, 1997). Safety culture authors have concluded that safety culture, risk 

awareness, and effective organizational safety practices found in high reliability organizations (HROs)139

are closely related, in that “[a]ll refer to the aspects of organizational culture that are conducive to safety” 

(Hopkins, 2005). These authors indicate that safety management systems are necessary for prevention, 

but that much more is needed to prevent major accidents. Effective organizational practices, such as 

encouraging that incidents be reported and allocating adequate resources for safe operation, are required 

to make safety systems work successfully (Hopkins, 2005 citing Reason, 2000).

A CCPS publication explains that as the science of major accident investigation has matured, analysis has 

gone beyond technical and system deficiencies to include an examination of organizational culture 

(CCPS, 2005). One example is the U.S. government’s investigation into the loss of the space shuttle 

Columbia, which analyzed the accident’s organizational causes, including the impact of budget 

constraints and scheduling pressures (CAIB, 2003). While technical causes may vary significantly from 

one catastrophic accident to another, the organizational failures can be very similar; therefore, an 

organizational analysis provides the best opportunity to transfer lessons broadly (Hopkins, 2000). 

The disaster at Texas City had organizational causes, which extended beyond the ISOM unit, embedded 

in the BP refinery’s history and culture. BP Group executive management became aware of serious 

process safety problems at the Texas City refinery starting in 2002 and through 2004 when three major 

incidents occurred. BP Group and Texas City managers were working to make safety changes in the year 

139 HROs are described as organizations from higher risk sectors such as nuclear power plants, air traffic control, or 

nuclear aircraft carriers that have developed characteristics such as preoccupation with failure, reluctance to 

simplify, and mindfulness to operations, which enables them to more successfully manage unexpected events and 

suffer fewer incidents (Weick & Sutcliffe, 2001). 
BP Texas City Final Investigation Report 3/20/2007 

144

prior to the ISOM incident, but the focus was largely on personal rather than process safety.140 As 

personal injury safety statistics improved, BP Group executives stated that they thought safety 

performance was headed in the right direction. 

At the same time, process safety performance continued to deteriorate at Texas City. This decline, 

combined with a legacy of safety and maintenance budget cuts from prior years, led to major problems 

with mechanical integrity, training, and safety leadership. 

9.2 Grangemouth Lessons—Focus on PSM 

In 2000, three incidents at BP’s Grangemouth refinery in Scotland included a large process unit fire and 

two serious upsets. The U.K. Health and Safety Executive investigated the causes of the incidents and 

released a major report in 2003 (HSE, 2003a). Three senior BP process safety engineers, including the BP 

Texas City PSM manager, published an article in 2004 summarizing the major lessons from the incidents 

(Broadribb et al., 2004), which were similar to those in the ISOM incident. The BP authors stated that one 

key lesson for industry was that preventing major incidents “requires a specific focus on process safety 

management over and above conventional safety management.” They recommended that companies 

“develop key performance indicators (KPIs) for major hazards” to ensure that performance is monitored 

and to provide an early warning of process safety deficiencies, and concluded that “traditional indicators 

such as ‘days away from work’ do not provide a good indication of process safety performance.” 

 

140 CCPS defines process safety as “a discipline that focuses on the prevention of fires, explosions and accidental 

chemical releases at chemical process facilities.” Process safety management applies management principles and 

analytical tools to prevent major accidents rather than focusing on personal safety issues such as slips, trips and 

falls (CCPS, 1992a). Process safety expert Trevor Kletz notes that personal injury rates are “not a measure of 

process safety” (Kletz, 2003). The focus on personal safety statistics can lead companies to lose sight of 

deteriorating process safety performance (Hopkins, 2000). 
BP Texas City Final Investigation Report 3/20/2007 

145

BP also determined that “cost targets” played a role in the Grangemouth incident: 

There was too much focus on short term cost reduction reinforced by KPI’s in performance 

contracts, and not enough focus on longer-term investment for the future. HSE (safety) was 

unofficially sacrificed to cost reductions, and cost pressures inhibited staff from asking the 

right questions; eventually staff stopped asking. Some regulatory inspections and industrial 

hygiene (IH) testing were not performed. The safety culture tolerated this state of affairs, and 

did not ‘walk the talk’ (Broadribb et al., 2004). 

The U.K. Health and Safety Executive investigation similarly found that the overemphasis on short-term 

costs and production led to unsafe compromises with longer term issues like plant reliability. 

The Health and Safety Executive also found that organizational factors played a role in the Grangemouth 

incidents. It reported that BP’s decentralized management led to “strong differences in systems style and 

culture.” This decentralized management approach impaired the development of “a strong, consistent 

overall strategy for major accident prevention,” which was also a barrier to learning from previous 

incidents. The report also recommended in “wider messages for industry” that major accident risks be 

managed and monitored by directors of corporate boards. 

BP Group did not systematically review its refinery operations and corporate governance worldwide to 

implement needed changes identified in the Health and Safety Executive report and in its own Task Force 

report, even though the Group Chief Executive told staff in October 2000 edition of BP’s in-house 

magazine that BP would learn lessons from Grangemouth and other incidents.141 The CSB found that a 

number of managers, including executive leadership, had little awareness or understanding of the lessons 

from Grangemouth. Moreover, BP Group leadership did not ensure that necessary changes were made to 

BP’s approach to safety. They did not effectively address the need for greater focus on PSM, including 

 

141 Browne, J., 2000, “Browne, Take Action to put Safety First,” Horizon, October 2000, p.39. 
BP Texas City Final Investigation Report 3/20/2007 

146

measuring PSM performance, nor did they resolve problems associated with BP’s decentralized approach 

to safety. 

The Baker Panel also noted “striking” similarities between the lessons of Grangemouth and the events of 

the Texas City explosion, most notably the lack of management leadership, accountability, and resources; 

poor understanding of and a lack of focus on process safety, coupled with inadequate performance 

measurement indicators; and untimely completion of corrective actions from audits, peer reviews, and 

past incident investigations. The Panel concluded that “in its response to Grangemouth, BP missed an 

opportunity to make and sustain company-wide changes that would have resulted in safer workplaces for 

its employees and contractors” (Baker et al., 2007). 

9.3 BP’s Approach to Safety—Lack of PSM Focus 

9.3.1 Changes in the Safety Organization 

Sweeping changes occurred in the HSE organization of the Texas City refinery after the 1999 BP and 

Amoco merger. Prior to the merger, Amoco managed safety under the direction of a senior vice president. 

Amoco had a large corporate HSE organization that included a process safety group that reported to a 

senior vice president managing the oil sector. The PSM group issued a number of comprehensive 

standards and guidelines, such as “Refining Implementation Guidelines for OSHA 1910.119 and EPA 

RMP.” 

In the wake of the merger, the Amoco centralized safety structure was dismantled. Many HSE functions 

were decentralized and responsibility for them delegated to the business segments. Amoco engineering 

specifications were no longer issued or updated, but former Amoco refineries continued to use these 

“heritage” specifications. Voluntary groups, such as the Process Safety Committees of Practice, replaced 

the formal corporate organization. Process safety functions were largely decentralized and split into 

different parts of the corporation. These changes to the safety organization resulted in cost savings, but 
BP Texas City Final Investigation Report 3/20/2007 

147

led to a diminished process safety management function that no longer reported to senior refinery 

executive leadership. The Baker Panel concluded that BP’s organizational framework produced “a 

number of weak process safety voices” that were unable to influence strategic decision making in BP’s 

US refineries, including Texas City (Baker et al., 2007). 

9.3.2 BP Group’s HSE Management System 

BP Group’s “Getting Health, Safety, and the Environment Right” (GHSER) policy, established in 1997, 

was intended to provide a business-wide HSE management system. The BP document, “Getting HSE 

Right, A Guide for BP Managers,” listed 91 mandatory HSE expectations to be implemented by BP 

Business Unit Leaders.142 GHSER was BP’s primary safety program and was monitored by BP Group. 

The implementation of GHSER was controlled by business units such as the Texas City refinery. 

Responsibility was placed on the Business Unit Leader to assure GHSER performance with the HSE 

expectations to the Group Chief Executive. (See Table 5 for brief descriptions of various upper 

management positions and Figure 17 for the line of accountability.) 

Table 5. Upper management job position descriptions 

Job Position/Group Description 

BP Group Global business operations, including Refining and Marketing, 

headquartered in London 

Group Executives Corporate managers above the Business Unit Leaders 

R&M Refining and Marketing 

BUL; Business Unit Leader The top manager of a BP business unit 

South Houston Site Director The South Houston Site Director had full accountability for all refining and 

petrochemical products within the five business units of South Houston. He 

was responsible for the commercial performance of the Texas City refinery. 

The Site Director became the Texas City refining Business Unit Leader in 

spring 2004 when the South Houston site was dissolved. 

Texas City Managers Managers above the front line supervisor level 

 

142 A Business Unit Leader is the top manager of a business unit, which is a defined, free-standing commercial 

organization. In the BP system, business units receive centralized direction, but implementation is decentralized. 

In the BP organizational structure, a refinery such as Texas City is typically a separate business unit. 
BP Texas City Final Investigation Report 3/20/2007 

148

Figure 17. Simplified organizational chart of BP at the time of the March 23, 2005 incident. Some 

positions are not included 
BP Texas City Final Investigation Report 3/20/2007 

149

 

Although the GHSER policy required Business Unit Leaders to send annual performance assurance 

reports to the Group Chief Executive, the practice evolved to send the report only to the staff of the Group 

Vice President (VP) for refining. The staff aggregated each submission with the other refinery reports and 

submitted that document to the Refining and Marketing (R&M) managers, who, in turn, compiled a report 

for the Group Chief Executive. Additionally, the staff of the Group VP of Refining would aggregate the 

various segment reports into one group-wide report for the Environment and Ethics Assurance Committee 

of the Board of Directors. 

Serious safety failures were not communicated in the compiled reports. For example, the “2004 R&M 

Segment Risks and Opportunities” report to the Group Chief Executive states that there were “real 

advancements in improving Segment wide HSSE [Health, Safety, Security & Environment] performance 

in 2004,” but failed to mention the three major incidents and three fatalities in Texas City that year. 

The GHSER expectations encompassed both personal safety and some process safety elements, however, 

GHSER reporting requirements focused on personal safety. Under GHSER, the BP R&M segment, 

including oil refining, required the reporting of fatalities, days away from work cases, recordable 

injuries,143 and illnesses. Other data such as oil spills and chemical releases were also reported. 144 The 

GHSER policy did not require R&M reporting of explicit process safety performance indicators.145 

143 OSHA’s Recordable Occupational Injury and Illness Incidence Rate is normalized to allow for comparisons 

across workplaces and industries. The rate is calculated as the number of recordable incidents for each 100 fulltime employees per year, based on 2,000 hours worked per employee per year. OSHA’s Recordable Injury Rate 

does not include fatalities. 

144 The reporting requirements for spills and chemical releases, while having process safety implications, were 

defined with thresholds relevant to environmental releases. For example, an oil spill was defined as greater than 

one barrel and a chemical release was limited to those reportable to local agencies, which, under US regulations, 

would typically be an environmental agency. Additionally, the oil spills metric was placed in the 

“environmentally sound operations” category of the group metrics. 

145 The UK Health and Safety Executive defines process safety performance indicators as typically both leading and 

lagging metrics that can provide up-to-date assurance that process plant major hazards are under control. 

Examples of PSM indicators include the resolution rate of PSM action items, the number of process safety nearmiss incidents, or the percentage of instruments and equipment tested by the target date (HSE, 2006a). 
BP Texas City Final Investigation Report 3/20/2007 

150

9.3.4.1 

9.3.3 Group Major Hazard Safety Standard 

BP Group issued a “Process Safety/Integrity Management” standard in May 2001. This standard outlined 

BP’s minimum requirements to “prevent the occurrence of, or minimize the consequences of, catastrophic 

releases of hazardous materials and to assure facilities are designed, constructed, operated and maintained 

in a safe fashion using appropriate codes and standards.” The standard highlighted eight GHSER 

elements: hazard evaluation, MOC, mechanical integrity, protective systems, competent personnel, 

incident investigation, emergency response, and performance management and assurance, and provided 

guidance to meet the requirements of these elements. The BP Texas City refinery reviewed the Group 

standard and determined that the site’s existing PSM program covered the standard’s elements and that no 

changes were needed. 

9.3.4 BP Management Framework 

In 2003, BP issued “Management Framework,” a document that addresses company governance issues 

brought about by rapid growth and consolidation of different management cultures due to mergers and 

acquisitions in the late 1990s. The framework describes BP’s corporate governance system, which is 

based on three primary foundations: 1) BP operations are divided into business units that operate in a 

decentralized manner and rely on individual business unit leaders to run them and deliver performance; 2) 

BP Group (e.g., corporate) provides support for the business units through a variety of functions, 

networks, and peer groups; and 3) individual performance contracts are used to motivate people. The 

“Management Framework” was revised in 2004 to give more scope and authority to the Group functions, 

and to clarify BP management framework, goals, and processes. 

Delegation of Authorities and Responsibilities 

BP, a public company, is owned by its shareholders. Annually, these shareholders elect a Board of 

Directors and delegate authority to them for direction and oversight of the company’s businesses. The 
BP Texas City Final Investigation Report 3/20/2007 

151

9.3.4.2 

Board of Directors, comprised of both BP executives and outside directors, establishes goals, makes 

broad policy decisions, and monitors the Group Chief Executive’s performance, but does not manage the 

day-to-day operations of the company. 

The Group Chief Executive (Figure 17) is given the authority and responsibility by the Board to manage 

BP’s businesses, subject to certain limitations. The limitations pertaining to safety are quite general: they 

require the Group Chief Executive to consider the effect on long-term shareholder value of the health, 

safety, and environmental consequences of any actions taken, and prohibit any employee from 

substituting his own risk preferences for those of the shareholders. The Group Chief Executive, under the 

“Management Framework,” delegates these responsibilities to the executive officers who manage the 

Group functions, and to the chief executives of BP’s three operating business segments, Exploration and 

Production; Refining and Marketing; and Gas, Power and Renewables. 

Assurance that delegated activities are being effectively performed is determined primarily through 

monitoring, which is by direct inspection, routine and non-routine reports, or audits. Performance 

contracts are also used to measure key results and milestones, and play an integral part in determining 

annual bonuses. The Baker Panel noted that “BP regards performance contracts as an essential component 

in delegating commitments for BP’s annual plans to individual leaders” (Baker, et al., 2007, pg. 28). 

Role of HSSE in the Management Framework

The “Management Framework” specifies that only a limited number of HSSE activities are centralized 

under the HSSE Group function. These centralized activities include creating the GHSER policy, auditing 

HSSE matters, managing group crises, managing relationships with HSE regulators and government 

agencies, supporting mergers and acquisitions, and analyzing and using HSSE data. All other HSSE 

activities are delegated to the business segments: Exploration and Production; Refining and Marketing; 

and Gas, Power and Renewables. 
BP Texas City Final Investigation Report 3/20/2007 

152

9.3.4.3 HSE Impacts on Business Segment Management Strategies 

The BP “Management Framework” also outlines the overall strategy and sub-strategies used to manage 

BP’s business segments. One sub-strategy had major impacts on the Texas City refinery: 

While acknowledging that refining segment had grown considerably in the past few years due to 

acquisitions and that it could generate high returns, a sub-strategy was to limit the amount of 

capital allocated in the Refining SPU due to its ‘volatility’. 

This sub-strategy would make it more difficult for the Texas City refinery to get the capital it needed to 

repair its aging infrastructure (Section 9.4.17). 

9.3.5 Texas City Process Safety Group 

The PSM group at the Texas City refinery, part of the HSSE department at the time of the incident, was 

responsible for overseeing the implementation of process safety. The group had a manager and four 

process safety coordinators. The PSM group led all unit process hazard analyses and facility siting 

studies, and oversaw the MOC system for the 1,500 to 2,000 changes made annually. It also conducted 

PSSRs of major capital projects following turnarounds, coordinated PSM audits, and determined which 

incidents were investigated under PSM. 

The process safety group developed and tracked process safety performance, but unlike the OSHA injury 

rate, the PSM metrics did not drive site performance. The PSM key performance indicators (KPIs), which 

included PSM action item closure, equipment inspections, and relief valve testing, were not incorporated 

into the GHSER metrics, the plant performance contract, personal performance contracts, or bonus 

programs. The PSM group planned to track safe operating limit exceedances, but this was not yet being 

done at the time of the 2005 incident. 
BP Texas City Final Investigation Report 3/20/2007 

153

9.3.6.1 

9.3.6.2 

9.3.6.3 

 

9.3.6 Other Factors Impacting BP’s Safety Management 

 Other factors, such as BP’s performance contracts, incentive programs, behavioral safety initiatives, and 

responses to industry benchmarking, reflected a lack of focus on PSM and major accident prevention. 

Performance Contracts 

BP incorporated the Refining and Marketing GHSER performance targets in performance contracts with 

business units and personal contracts with Group and business unit leadership. The performance contracts 

were used to evaluate personnel and impacted managers’ compensation. The contracts consisted of 

weighted metrics for categories such as financial performance, plant reliability, and safety. The largest 

percentage of the weighting was in financial outcome and cost reduction. The safety metrics included 

fatalities, days away from work case rate, recordable injuries, and vehicle accidents; process safety 

metrics were not included. HSE metrics typically accounted for less than 20 percent of the total weighting 

in the performance contracts. 

Incentive Programs 

BP Group implemented an incentive program based on performance metrics, the Variable Pay Plan 

(VPP), which was in place at the Texas City refinery for several years prior to the ISOM incident. Payouts 

under the VPP were approved by the refining executive managers in London. “Cost leadership” 

categories accounted for 50 percent and safety metrics for 10 percent of the total bonus. For the 2003-

2004 period, the single safety metric for the VPP bonus was the OSHA Recordable Injury Rate146. 

Behavioral Safety 

A central component of the BP Texas City approach to safety was its behavioral programs, which had 

been in effect in some form since 1997. The program, based on observations of BP workers and 

146 The OSHA recordable injury rate is the annual number of injuries and illnesses per 100 full-time workers. The 

OSHA injury rate, which excludes fatalities, is a normalized rate that is used for comparison across industries. 
BP Texas City Final Investigation Report 3/20/2007 

154

9.3.6.4 

contractors engaged in work tasks, was designed to provide immediate feedback about observed hazards 

and activities that did not conform to refinery safety policies. 

In a 2001 presentation, “Texas City Refinery Safety Challenge,” BP Texas City managers stated that the 

site required significant improvement in performance or a worker would be killed in the next three to four 

years. The presentation asserted that unsafe acts were the cause of 90 percent of the injuries at the refinery 

and called for increased worker participation in the behavioral safety program. 

A new behavior initiative in 2004 significantly expanded the program budget and resulted in new 

behavior safety training for nearly all BP Texas City employees. In 2004, 48,000 safety observations were 

reported under this new program. This behavior-based program did not typically examine safety systems, 

management activities, or any process safety-related activities. 

Industry Benchmarking 

BP Group and Texas City managers’ priorities were greatly influenced by industry benchmarking of 

Solomon Associates, a firm that provides performance analysis and benchmarking services. Solomon 

benchmarking is widely used in the US oil refining industry to compare refinery performance in a wide 

variety of categories. Solomon data are presented as efficiency targets, allowing comparisons to peer 

refineries of a similar type, complexity, or locality. 

Solomon performance measures include operating cost, refinery utilization, mechanical availability, 

energy efficiency, personnel staffing, and specific process unit categories. The BP Texas City refinery 

used the Solomon benchmarking data to analyze its competitive position and make resource allocation 

decisions. BP Texas City also used the Solomon data to establish its own performance metrics, and 

incorporated Solomon benchmarking data into its analytical reports, performance contracts, and plant 

goals. Solomon does not benchmark any specific process safety-related metrics. 
BP Texas City Final Investigation Report 3/20/2007 

155

 

9.3.7 Summary 

BP’s approach to safety largely focused on personal safety rather than on addressing major hazards. BP 

Group and the Texas City officials almost exclusively focused on, measured, and rewarded reductions in 

injury rates and days away from work rather than the improved performance of its process safety systems. 

BP had process safety systems in place in its Group management system and at Texas City, yet in the 

wake of the merger with Amoco, the resulting organizational changes to safety management led to a deemphasis of major accident prevention. 

BP and the U.K. Health and Safety Executive concluded from their Grangemouth investigations that 

preventing major accidents requires a specific focus on process safety. BP Group leaders communicated 

the lessons to the business units, but did not ensure that needed changes were made. 

9.4 Ineffective BP Response to Reports of Serious Safety Problems 

2002-2005 

9.4.1 2002 Study Provides Warnings of Impending Major Site Incident 

The new director of BP’s South Houston Integrated Site (consisting of five area BP businesses, including 

the Texas City site) observed in 2002 that the Texas City refinery infrastructure and equipment were “in 

complete decline.”147 In consultation with London managers, the director ordered a study that looked at 

147 Interview of the former Texas City Site Director, October 12, 2006. The Site Director led five BP Houston area 

businesses that included the Texas City site, referred to as the South Houston Integrated Site (SHIS). The Texas 

City site comprised the oil refinery and the chemical plant. The South Houston site was reorganized in spring 

2004 with the sale of some chemical assets and the Site Director became the Business Unit Leader for the Texas 

City site. During the period of the SHIS, the Texas City refinery had a separate Business Unit Leader who 

reported to both the Site Director and BP Global Executive management. 
BP Texas City Final Investigation Report 3/20/2007 

156

 

mechanical integrity, training, safety, and economic opportunities.148 The study, which was shared with 

London executives, concluded that mechanical integrity was one of the biggest problems.149 

The study stated that its findings were “urgent and far-reaching with important implications for the site, 

including the integrity of the on-going site operations,” and warned about vulnerability in both the process 

units and infrastructure.150 It indicated that “there were serious concerns about the potential for a major 

site incident due to the large number of hydrocarbon releases (over 80 in the 2000-2001 period).”151 The 

study also found that many inspections were overdue,152 and that “known reliability issues,” including 

instrumentation, needed to be addressed. 153 

The study concluded that these problems were site-wide and that the Texas City refinery needed to focus 

on improving operational basics such as reliability, integrity, and maintenance management. The study 

found the refinery was in the lowest quartile of the 2000 Solomon index for reliability and ranked near the 

bottom among BP refineries. The leadership culture at Texas City was described in the study as “can do” 

accompanied by a “can’t finish” approach to making needed changes. 

The study recommended “a major overhaul of the ‘basics’” including addressing issues such as 

vulnerability and cultural change.154 While the study recognized mechanical integrity problems with both 

the infrastructure and process units, it specifically recommended increases in maintenance spending of 

$235 million, mostly to address the infrastructure problems at the Texas City refinery. The study did not 

148 “Good Practice Sharing Assessment,” BP South Houston, August 2002. The 2002 study was referred as the 

“Veba” study because it was similar to the comprehensive analysis conducted for the German Veba Corporation 

that BP had recently acquired. 

149 “Good Practice Sharing Assessment,” BP South Houston, Final Report, August 2002. 

150 In the “Veba” study, process units were referred to as “inside the battery limits,” or ISBL. The infrastructure, 

including storage tanks, utilities, and docks, were referred to as “outside the battery limits.” or OSBL. 

151 “Good Practice Sharing Assessment,” BP South Houston, Final Report, August 2002. 

152 Ibid. 

153 Ibid. 

154 Ibid. 
BP Texas City Final Investigation Report 3/20/2007 

157

propose specific funds for identified problems with process units. A study recommendation proposed 

conducting a site-wide study to determine process unit requirements, but this was not done. 

The study recommended improving the competency of operators and supervisors and defining process 

unit operating envelopes155 and near-miss reporting around those envelopes to establish an operating 

“reliability culture.”156 The study found high levels of overtime and absenteeism resulting from BP’s 

reduced staffing levels and called for applying MOC safety reviews to people and organizational changes. 

The study concluded that personal safety performance at Texas City refinery was excellent, but there were 

deficiencies with process safety elements such as mechanical integrity, training, leadership, and MOC. 

The serious safety problems found in the 2002 study were not adequately corrected, and many played a 

role in the 2005 disaster. 

9.4.2 Study Follow-up: Lack of Investment Compromised Safety 

The BP Group Refining VP suggested a follow-up inquiry asking, “How has [South Houston] gotten into 

such a poor state?”157 This follow-up report, the “Texas City Refinery Retrospective Analysis,” issued 

later in 2002, had the objective of determining why Texas City refinery performance had deteriorated. 

The analysis concluded that “the current integrity and reliability issues at TCR [Texas City Refinery] are 

clearly linked to the reduction in maintenance spending over the last decade.”158 Capital spending was 

reduced 84 percent from 1992 to 2000. The analysis found “a consistent and significant reduction” in 

fixed costs159 at the refinery between 1992 and 1999, when fixed costs were reduced 52 percent, and the 

 

155 Operating envelopes were similar to safe operating limits, but also addressed environmental and economic 

factors. BP had implemented a computerized operating envelope program designed to increase oversight over 

process operations and critical parameters. The BP operating envelope program is discussed in Section 3.9. 

156 “Good Practice Sharing Assessment,” BP South Houston, Final Report, August 2002. 

157 Email “S. Houston,” August 16, 2002 

158 “Texas City Refinery Retrospective Analysis,” October 28, 2002. 

159 BP defined fixed cash costs as costs that did not vary with production rates such as compensation, training costs, 

and routine maintenance. 
BP Texas City Final Investigation Report 3/20/2007 

158

ery: 

ot 

5

 

 

report highlighted a 25 percent budget cut targeted in 1999-2000 in the wake of the BP and Amoco 

merger160 (Appendix D). During the same period in the 1990s, total maintenance spending161 was reduced 

41 percent. 

Identified spending increases from 2000 to 2002 were “primarily budget overruns resulting from firefighting unplanned events,”162 and new energy and environmental projects.163 For capital expenditures 

that addressed HSE and safe operation of the plant, funds were cut 78 percent from 1992-2002. The 

analysis stated that from 1992 to 2002 “the [Texas City] Refinery has consistently remained in the lowest 

percentile grouping for Operational Availability against Solomon benchmarks.”164 The analysis 

concluded that the budget cuts did not consider the specific maintenance needs of the Texas City refin

“The prevailing culture at the Texas City refinery was to accept cost reductions without challenge and n

to raise concerns when operational integrity was compromised.”16

9.4.3 1999 – 2000 Significant Budget Cuts 

The 2002 study identified a 25 percent cut in fixed cash costs targeted in 1999-2000. In 1999, the BP 

Group Chief Executive outlined his strategies and goals for newly merged company, with the target of 

“reduc[ing] business unit cash costs for the year 2001 by at least 25 percent from year 1998 levels.”166 He 

also set out three year targets to cut $1.4 billion from R&M worldwide. 

160 “Texas City Refinery Retrospective Analysis,” October 28, 2002. 

161 In the 2002 Texas City Refinery Retrospective Analysis, total maintenance included routine maintenance fixed 

cash costs, turnaround spending, HSE Capex (capital expenditure needed to meet internal and external safety 

standards) and Sustaining Capex (capital expenditure needed to safely maintain and operate the plant). 

162 An example of “fire fighting unplanned events” was piping or equipment failure that required unit shutdown and 

repair. 

163 “Texas City Refinery Retrospective Analysis,” October 28, 2002. 

164 Ibid. 

165 Ibid. 

166 Email “Message from Site Leadership,” July 15, 1999. 
BP Texas City Final Investigation Report 3/20/2007 

159

In 1999, the BP Group Chief Executive of R&M told the refining executive committee about the 25 

percent cut, and said that the target was a directive more than a loose target. One refinery Business Unit 

Leader considered the 25 percent reduction to be unsafe because it came on top of years of budget cuts in 

the 1990s; he refused to fully implement the target. 

While some BP refinery leaders resisted the call for a 25 percent reduction in fixed costs, Texas City 

made serious cuts and came close to the 25 percent reduction target.167 Its cost reduction strategy was to 

“aggressively drive costs out of the system at an accelerated pace relative to other refiners.”168 The 

strategy indicated that the cuts would be accomplished through destaffing, outsourcing, and eliminating 

unnecessary turnaround costs. Items cut included turnarounds; safety committee meetings; the central 

training organization; fire drills; maintenance, engineering, supervision, and inspection staff; plant 

maintenance; and training courses. Safety and maintenance expenditures were a significant portion of the 

cuts. The refinery’s capital expenditures to maintain safe plant operation and to comply with HSE legal 

requirements were cut $33 million, or 45 percent, from 1998 to 1999.169 

9.4.4 2002 Financial Crisis Mode 

The 2002 study concluded a critical need for increased expenditures to address asset mechanical integrity 

problems at Texas City. Shortly after the study’s release, however, BP refining leadership in London 

warned Business Unit Leaders to curb expenditures. In October 2002, the BP Group Refining VP sent a 

communication saying that the financial condition of refining was much worse than expected, and that 

from a financial perspective, refining was in a “crisis mode.”170 The Texas City West Plant171 manager, 

 

167 “MPH TCBU Face to Face Presentation,” July 16, 2002. The historical TCBU fixed cash costs (inflation 

adjusted) fell 23.2 percent from 1998 to 1999. 

168 Texas City Business Unit Strategy, July 12, 1999. 

169 Capital Plan Texas City Refinery – Technical Managers Network Kwinana, February 29, 2000. 

170 Email “GFO” from the Global VP for Refining, October 17, 2002. 

171 The ISOM unit where the March 23, 2005, incident occurred was in the Texas City West Plant. 
BP Texas City Final Investigation Report 3/20/2007 

160

 

while stating that safety should not be compromised, instructed supervisors to implement a number of 

expenditure cuts including no new training courses. During this same period, Texas City managers 

decided not to eliminate atmospheric blowdown systems. 

9.4.5 2003 Maintenance Gap Assessment 

In 2003, BP Texas City managers conducted a “Getting Maintenance and Reliability Right Gap 

Assessment,” which concluded that maintenance and mechanical integrity problems persisted at Texas 

City. While plant infrastructure reliability scores were among the lowest, the assessment concluded that 

scores were “fairly low for all areas.”172 The assessment found that most areas had insufficient resources 

to conduct the needed root cause failure analysis (RCFA) for equipment problems, and that most action 

items were “not implemented because of budget constraints.”173 Many manufacturing areas scored low on 

most elements of the assessment. The Texas City West Plant scored below the minimum acceptable 

performance in 22 of 24 elements. For turnarounds, the West Plant representatives concluded that “cost 

cutting measures [have] intervened with the group’s work to get things right. Team feels that no one 

provides/communicates rationale to cut costs. Usually reliability improvements are cut.”174 Two major 

accidents in 2004-2005 (both in the West Plant of the refinery—the UU4 in 2004 and ISOM in 2005) 

occurred in part because needed maintenance was identified, but not performed during turnarounds. 

9.4.6 The SHIFT Program 

The BP Texas City refinery responded to the integrity problems with programs that largely addressed 

infrastructure rather than process unit vulnerability. In 2003, the site leadership implemented the South 

Houston Infrastructure for Tomorrow (SHIFT) program in response to the 2002 study recommendations. 

172 BP South Houston “Getting Maintenance and Reliability Right” (GMRR) 2003 Gap Assessment Results,” 

September, 2003. 

173 Ibid. 

174 Ibid. 
BP Texas City Final Investigation Report 3/20/2007 

161

A presentation by Texas City managers summed up the budget-cutting history that led to the SHIFT 

program:175 

“Pre-2002: How did we get into our intolerable risk situation with the Infrastructure assets? 

• Culture 

• Money.” 

The presentation noted that the infrastructure problem took years to develop and would take significant 

time to fix. The presentation’s five-year, $150 million proposal included details on the Piping Integrity 

Project (PIP), which mostly addressed infrastructure needs, and would cost $50 million. The presentation 

included no specific requests for addressing the process unit integrity issues identified in the 2002 study, 

but did identify the critical nature of the situation, stating that the SHIFT program must be “the last 

disaster recovery project at Texas City.”176 

9.4.7 2003 GHSER Audit—“The condition of infrastructure and assets is 

poor” 

The September 2003 GHSER audit found that “the units and staff are actively managing infrastructure 

risks but the current condition of the infrastructure and assets is poor at [the] Texas City refinery.” One of 

the most problematic gaps identified was that a “checkbook mentality” still existed throughout most of 

the Texas City site, which “limits HSE and general performance.” The “checkbook mentality” meant that 

the budgets were not large enough to address identified risks, and that only the money on hand would be 

spent, rather than increasing the budget. The audit team was concerned about “insufficient resources to 

 

175 Shift Program Review, August 19, 2003. 

176 Ibid. 
BP Texas City Final Investigation Report 3/20/2007 

162

 

achieve all commitments and goals.” The South Houston site leader was disappointed about the audit 

findings because “many things have shown up before.”177 

An overall conclusion of the audit was that a coordinated self-monitoring process was not evident; 

therefore, management was leaving some risks unaddressed. The audit found that “HSE actions items are 

allowed to become past due and remain in that status without intervention.” While the audit found that 

personal and behavioral safety were strong, the audit’s first recommendation was that BP South Houston 

“break the cycle in the culture that tolerates HSE exceptions”:178 

• BPSH (BP South Houston) must establish the standard that makes overdue HSE actions and/or 

critical maintenance inspections or unaddressed major risks unacceptable to the Leadership Team. 

• Accept zero for exceptions to BP (Group and local) HSE standards. 

• Embed PSM Systems at all sites. 

The audit identified some additional significant risks. In particular, the risk of the refinery “operating 

envelope” that needed to be addressed,179 a site-wide risk assessment process that was not robust enough, 

and deficient training in most areas.180

177 The follow-up action items from the 2003 GHSER audit ineffectively addressed the identified Texas City safety 

deficiencies. For example, the response to the finding on the poor condition of the assets stated that measures had 

been taken in the 2005 budget—over one year after the audit. Only a small portion of the capital allocated to the 

listed infrastructure projects had been spent prior to 2005. Although the Veba analysis and other reviews identified 

integrity problems with both process units and infrastructure, Texas City increased spending in 2005 mostly on 

infrastructure projects (docks, utilities, tank farm, etc.). 

178 In response to the recommendation that the culture tolerated HSE exceptions, BP implemented the 2004 

Compliance Delivery Process (CDP). CDP focused largely on worker behavior and personnel safety, even though 

the audit recommendation focused primarily on the need for management to address major risks and fully implement 

PSM systems. 

179 As Section 4.10 discusses, the operating envelope program was not fully functional at the time of the ISOM 

incident and managers were not alerted about envelope exceedances. 

180 The 2003 GHSER recommendation concerning training improvements and the implementation of a risk 

identification process was not addressed at the time of the 2005 ISOM incident. 
BP Texas City Final Investigation Report 3/20/2007 

163

 

The poor condition of the refinery, inadequate training, inadequate PSM implementation, and the need for 

leadership to set an example and eliminate exceptions to HSE standards were all findings of the audit and 

causally related to the ISOM incident. 

9.4.8 1,000 Day Goals 

In response to the financial and safety challenges facing South Houston, the site leader developed 1,000 

day goals in fall 2003 that measured site-specific performance. The 1,000 day goals addressed safety, 

economic performance, reliability, and employee satisfaction; the consequence of failing to change in 

these areas was described as losing the “license to operate.”181 The 1,000 day goals for safety included 

recordable injury frequency (RIF) and HSE action item closure (a PSM action item closure goal was not 

added until early 2005 and had not been reported prior to the ISOM incident). The goals also measured 

indicators such as Solomon mechanical availability, cash delivery, and environmental reports; the goal to 

reduce maintenance spending 25 percent was added in 2004. The 1,000 day goals reflected the continued 

focus by site leadership on personal safety and cost-cutting rather than on process safety. 

9.4.9 The Texas City Repositioning Project 

During 2003 the plant was continually pressured to reduce expenditures. Plant officials initiated the Texas 

City Refinery Repositioning Project in August 2003 at the request of BP Group Refining management, 

who told the refinery that it had not made a contribution of profit proportionate to its capital 

consumption.182 The goal of the project was to improve the refinery’s competitive position over a 10 year 

period by focusing on efficiency changes to the refinery’s asset configuration and technology. The team 

looked for significant changes that included over $30 million in capital expenditure cuts and $140 million 

181 “1,000 Day Goals -- What is this about?” document, 2003. 

182 The project team, led by BP personnel outside the refinery, found that the refinery contributed only 10 percent of 

the Global refining profits while consuming 18 percent of capital expenditure needed to meet environmental and 

safety compliance. The Texas City refinery faced additional challenges due to its unique complexity and 

interconnectedness. Management stated that the refinery was the most complex in the world by a factor of two. 
BP Texas City Final Investigation Report 3/20/2007 

164

 

increase in annual operating profit. The Reposition Project and the SHIFT program reflected the 

persistent competing pressures on the Texas City refinery to cut capital expenditures, increase efficiency, 

and spend needed funds to address asset vulnerability. Those pressures would intensify with the major 

accidents that occurred in 2004. 

9.4.10 The Ultraformer #4 (UU4) Incident 

Mechanical integrity problems previously identified in the 2002 study and the 2003 GHSER audit were 

warnings of the likelihood of a major accident. In March 2004, a furnace outlet pipe ruptured and resulted 

in fire that caused $30 million in damage. Texas City managers investigated and prepared an HRO 

analysis of the accident to identify the underlying cultural issues.183 They found that in 2003 an inspector 

recommended examining the furnace outlet piping, but this was not done. Prior to the 2004 incident, 

thinning pipe discovered in the outlet piping toward the end of a turnaround was not repaired, and, after 

the unit was started up, a hydrocarbon release from the thinning pipe caused a major fire. One key finding 

of the investigation was that “[w]e have created an environment where people ‘justify putting off repairs 

to the future.’”184 The BP investigation team, which included the refinery maintenance manager and the 

West Plant Manufacturing Delivery Leader (MDL), also found an “intimidation to meet schedule and 

budget” when the discovery of the unsafe pipe conflicted with the schedule to start up UU4. The team 

summarized its conclusions: 

• “The incentives used in this workplace may encourage hiding mistakes.” 

• “We work under pressures that lead us to miss or ignore early indicators of potential problems.” 

• “Bad news is not encouraged.” 185

183 HRO Learning’s from UU4 Incident Investigation – “Deep Dive.” 

184 Ibid. 

185 Ibid. 
BP Texas City Final Investigation Report 3/20/2007 

165

 

These findings are similar to the BP Group refining group-wide HRO study and the West Plant team’s 

2003 Maintenance Gap Assessment that identified budget and scheduling pressures that impacted 

reliability. In both the UU4 and ISOM incidents, required maintenance was not conducted prior to startup. 

In the ISOM incident, three pieces of equipment necessary for safe operation – the raffinate splitter 

tower’s level transmitter, sight glass, and pressure valve – were identified by managers as malfunctioning 

prior to the startup, but were not repaired. 

9.4.11 Ultraformer #3 (UU3) Incident 

In September 2004, three workers in the UU3 unit were burned, two fatally, with hot water and steam 

during the opening of a pipe flange. The workers believed the pump system was isolated and were 

unaware that a check valve was concealing hazardous energy from a leaking discharge block valve. The 

absence of a bleed valve between the check and block valve did not allow the workers to verify whether 

the piping was isolated, depressured, and safe to open. 

The investigation recommendations included revising plant lockout/tagout procedures and engineering 

specifications to ensure a means to verify the safe energy state between a check and block valve, such as 

installing bleeder valves. In a review of the incident, the Texas City site leader stated that the pump was 

locked out based on established procedures and that work rules had not been violated. In 2004, two of the 

three major accidents were process safety-related.186 Taken as a whole, the incidents revealed a serious 

decline in process safety and management system performance at the BP Texas City refinery. 

186 The September 2004 UU3 incident is process safety-related. While the application of OSHA’s PSM standard is 

limited to listed highly hazardous chemicals, industry safety guidelines have a broader application of PSM that 

encompasses all process hazards and hazardous materials. The CCPS defines PSM as “the application of 

management principles and systems to the identification, understanding and control of process hazards to prevent 

process- related injuries and incidents” (CCPS, 1995b). CCPS also states that line and equipment opening and 

lockout/tagout are a type of hazardous maintenance work that can lead to hazardous releases and are addressed by 

process safety guidelines (CCPS, 1995a.). 
BP Texas City Final Investigation Report 3/20/2007 

166

9.4.12 2004 BP Group GHSER Audit Review—“Systemic Underlying 

Issues” 

In 2004 the BP Internal Audit Group in London reviewed GHSER audits for 2003 and found a number of 

serious safety deficiencies common throughout the corporation. The BP auditors reviewed the 35 audits, 

including South Houston.187 The audit report, released in March 2004, found significant common 

deficiencies:188

• widespread tolerance of non-compliance with basic HSE rules; 

• poor implementation of HSE management systems, reducing the effectiveness and efficiency of 

activities to manage HSE risks and deliver sustainable performance; 

• lack of leadership competence and understanding to effectively manage all aspects of HSE; 

• insufficient monitoring of key HSE processes to provide management visibility and confidence in 

management’s ability to deliver as required and [implement] necessary interventions. 

Leadership and accountability were the most common problem, which was found in 28 business units. 

The report stated that there was a lack of leadership focus on closing action items from audits and other 

safety reviews, as well as a backlog of maintenance items. The report also found that leadership was not 

“reinforcing expectations through their own behaviors.” 

The report found that risk assessment was “often incomplete,” that business units did not understand or 

address major hazards, and that competency in risk and hazard assessment was poor. 

 

187 The audits were conducted over a mix of BP Global businesses including R&M and Exploration & Production. 

188 Internal audit, “2003 GHSER Audits—Summary of Findings,” March 2004. 
BP Texas City Final Investigation Report 3/20/2007 

167

 

The report found that MOC was poorly defined; in particular, a lack of clarity on what constitutes a 

change in areas such as temporary modifications and organizational change. In addition, the report 

concluded that MOC systems lacked staff competency, rigorous application, and monitoring. 

The report stated there were “poor processes” to disseminate lessons learned. While the BP Group HSE 

organization distributed information on incidents, business units lacked effective processes for assessing 

the implications or taking action to prevent a similar occurrence. This finding is significant because the 

HSE Grangemouth report concluded that BP’s organizational structure impaired the corporation’s ability 

to learn from incidents and prevent major accidents. The internal audit findings are evidence that the 

conclusions from the 2003 Grangemouth report had not been effectively addressed. 

9.4.13 BP’s Golden Rules of Safety 

In response to the 2004 report on GHSER audits, the BP Group Chief Executive of R&M directed 

Business Unit Leaders to focus on reviews of control of work189 and vehicle safety to ensure compliance 

with the Golden Rules of Safety.190 The Golden Rules addressed primarily personal safety issues related 

to work activities such as working at heights, lifting operations, and entering confined spaces. Although 

MOC is one element of the Golden Rules, process safety was not specifically addressed. 

In May 2004, the Texas City site performed a “Control of Work Review,” which revealed deficiencies in 

compliance with the Golden Rules. The three primary areas of concern were risk assessment, use of 

nitrogen, and lifting operations. The review found that plant personnel generally complied with policies 

and procedures, but there was variability among operating units and tasks performed. The report 

concluded that site leadership needed to communicate to the workforce “that productivity and progress in 

other areas is not acceptable if it comes at the cost of noncompliance with HSE policies and procedures.” 

189 “Control of work” addresses workplace hazards and how to manage them safely. 

190 Email from BP Global Chief Executive of R&M to the Group R&M Leadership, dated March 30, 2004. 
BP Texas City Final Investigation Report 3/20/2007 

168

 

The Texas City site’s response to the “Control of Work Review,” which occurred after the two major 

accidents in spring 2004,191 focused on ensuring compliance with safety rules. The response stated that 

the review findings support “our objective to change our culture to have zero tolerance for willful noncompliance to our safety policies and procedures.” The report indicated that “accepting personal risk” and 

noncompliance based on lack of education on the rules would end. To correct the problem of noncompliance, Texas City managers implemented the “Compliance Delivery Process” and “Just Culture” 

policies. “Compliance Delivery” focused on adherence to site rules and holding the workforce 

accountable. The purpose of the “Just Culture” policy was to ensure that management administered 

appropriate disciplinary action for rule violations. The “Just Culture” policy indicated that willful 

breaches of rules, but not genuine mistakes, would be punished. The Texas City Business Unit Leader 

announced that he was implementing an educational initiative and accelerated the use of punishment to 

create a “culture of discipline.”192

These initiatives failed to address process safety requirements or management system deficiencies 

identified in the GHSER audits, mechanical integrity reviews, and the 2004 incident investigation reports. 

BP Group executive leadership met with the Texas City Business Unit Leader several times in 2004 and 

approved the focus on personal safety. The BP Group Chief Executive for R&M visited the Texas City 

refinery in July 2004 to review progress toward the 1,000-day goals and improved safety performance. In 

a presentation to the Chief Executive during the visit, the site reported a “best ever” recordable injury 

rate. The action plan for improvement was to “aggressively pursue Control of Work Audit learnings,” but 

there was no action plan for the deteriorating Texas City process safety performance. 

191 The two major incidents in spring 2004 included the March UU4 incident and in May 2004, a contractor died 

from a fall inside a tower during a turnaround in the AU2 unit. 

192 June 27, 2004, email from the Texas City Business Unit Leader to the BP Global North American VP for 

Refining and the Global Chief Executive for R&M; Subject: Control of Work Response. 
BP Texas City Final Investigation Report 3/20/2007 

169

 

In the July 2004 presentation, Texas City managers also spoke to the ongoing need to address the site’s 

reliability and mechanical integrity issues and financial pressures. The presentation suggested that a 

number of unplanned events in the process units led to the refinery being behind target for reliability, 

citing the UU4 fire and other outages and shutdowns. The presentation stated that “poorly directed 

historic investment and costly configuration yield middle of the pack returns.” The conclusion was that 

Texas City was not returning a profit commensurate with its needs for capital, despite record profits at the 

refinery. The presentation indicated that a new 1,000-day goal had been added to reduce maintenance 

expenditures to “close the 25 percent gap in maintenance spending” identified from Solomon 

benchmarking.193

The BP Texas City refinery increased total maintenance spending in 2003-2004 by 33 percent194; 

however, a significant portion of the increase was a result of unplanned shutdowns and mechanical 

failures. In the July 2004 presentation to the R&M Chief Executive, Texas City leadership said that 

“integrity issues had been costly,” specifically identifying an increase in turnaround costs.195 In 2004, BP 

Texas City experienced a number of unplanned shutdowns and repairs due to mechanical integrity 

failures196: the UU4 piping failure incident resulted in $30 million in damage, and while the Texas City 

refinery West Plant leader proposed improving reliability performance to avoid “fix it when it fails” 

maintenance, integrity problems persisted. In addition, the ISOM area superintendent was reporting 

“numerous equipment failures” that resulted in budget overruns.197

193 According to Solomon benchmarking, the BP Texas City refinery was spending more on maintenance than other 

refineries of similar size and complexity. The 1,000 Day Goal was established to close that gap. 

194 Email “Texas City Spend,” May 12, 2005. 

195 Texas City Refinery Business Review, (Global Chief Executive for R&M) Site Visit Pre-read, July 12, 2004. 

196 TC Site Availability, June 2004. 

197 Email “Budget Outlook for 2004,” from ISOM area superintendent. 
BP Texas City Final Investigation Report 3/20/2007 

170

 

At the July 2004 presentation, the Texas City leadership also presented a compliance strategy to the R&M 

Chief Executive that stated:198

In the face of increasing expectations and costly regulations, we are choosing to rely 

wherever possible on more people-dependent and operational controls rather than 

preferentially opting for new hardware. This strategy, while reducing capital consumption, 

can increase risk to compliance and operating expenses through placing greater demands on 

work processes and staff to operate within the shrinking margin for human error. Therefore to 

succeed, this strategy will require us to invest in our ‘human infrastructure’ and in 

compliance management processes, systems and tolls to support capital investment that is 

unavoidable. 

The document identified that “Compliance Delivery” was the process that Texas City managers 

designated to deliver the referenced workforce education and compliance activities. The chosen strategy 

states that this approach is less costly than relying on new hardware or engineering controls but has 

greater risks from lack of compliance or incidents. 

The aftermath of the UU3 incident resulted in additional scrutiny from Group executives and urgency for 

the Texas City refinery to improve safety performance. As a result, the Texas City Business Unit Leader 

met with the R&M Chief Executive and the Senior Executive Team in October 2004 to view the 

presentation, “Texas City Site Safety Transformation,” which recounted the fatal incidents with pictures 

of the deceased. Although two of the three major accidents in 2004 were process safety-related, the safety 

problems were described primarily in terms of casual compliance and personal risk tolerance. Again, 

“Compliance Delivery” and “Just Culture” were the programs cited as addressing the problems; the 

proposed action plans did not focus on management system issues or process safety concerns. 

198 Texas City HSE Compliance, July 7, 2004. 
BP Texas City Final Investigation Report 3/20/2007 

171

9.4.14 Process Safety Performance Declines Further in 2004 

In August 2004, the Texas City Process Safety Manager gave a presentation to plant managers that 

identified serious problems with process safety performance. The presentation showed that Texas City 

2004 year-to-date accounted for $136 million, or over 90 percent, of the total BP Group refining process 

safety losses; and over five years, accounted for 45 percent of total process safety refining losses.199 The 

presentation noted that PSM was easy to ignore because although the incidents were high-consequence, 

they were infrequent. The presentation addressed the HRO concept of the importance of mindfulness and 

preoccupation with failure; the conclusion was that the infrequency of PSM incidents can lead to a loss of 

urgency or lack of attention to prevention. 

In September 2004, the site PSM manager told the Business Unit Leader that Texas City had received 

poor scores in second quarter concerning PSM metrics such as action item completion (63 percent).200

This information had been communicated in a PSM presentation at the September 2004 BP Group 

refining leadership meeting where the Texas City refinery was categorized as high risk.201 A key message 

in the presentation was that process safety was just as important as personal safety. The presentation 

summarized BP’s refinery PSM incident history, indicating that the “depth and rigor of investigations” 

was not always sufficient to identify root causes. In March 2005, before the ISOM incident, the Texas 

City operations manager communicated to a Group refining executive that the PSM action item closure 

status for fourth quarter 2004 was a concern; as a result, PSM closure was added to the site’s 1,000 Day 

Goals. 

 

199 TC-PSC Chair Selection, August 1, 2004. 

200 Email “Process Safety discussion at GRL meeting on 14th September.” 

201 GRL Process Safety Session Presentation, September 2004. 
BP Texas City Final Investigation Report 3/20/2007 

172

Texas City had serious problems with unresolved PSM action items. Target closure rate was 90 percent, 

but in 2004 was only 79 percent, down from 95 percent in 2002. The PSM manager indicated that the 

closure rate had fallen since the metric was removed from the formula in 2003 for calculating bonuses. At 

the end of 2004, the Texas City site had closed only 33 percent of its PSM incident investigation action 

items; the ISOM unit closed 31 percent. Only 40 percent of the PSM business plan milestones were 

completed in 2004. 

Additionally, the findings from the 2004 PSM audit (Section 8.3.4) revealed poor PSM performance in a 

number of areas categorized as high priority, especially in mechanical integrity, training, process safety 

information, and MOC. Texas City refinery’s mechanical availability202 worsened from 2002 to 2004.203

During this same period, loss of containment incidents, a process safety metric tracked but not managed 

by BP, increased 52 percent from 399 to 607 per year (Baker, et al., 2007). 

9.4.15 “Texas City is not a Safe Place to Work” 

Fatalities, major accidents, and PSM data showed that Texas City process safety performance was 

deteriorating in 2004. Plant leadership held a safety meeting in November 2004 for all site supervisors 

detailing the plant’s deadly 30-year history. The presentation, “Safety Reality,” was intended as a wakeup 

call to site supervisors that the plant needed a safety transformation, and included a slide entitled “Texas 

City is not a safe place to work.” Also included were videos and slides of the history of major accidents 

and fatalities at Texas City, including photos of the 23 workers killed at the site since 1974. 

The “Safety Reality” presentation concluded that safety success begins with compliance, and that the site 

needed to get much better at controlling process safety risks and eliminating risk tolerance. Even though 

 

202 Mechanical availability measures the time available for processing minus downtime for maintenance. 

203 The 2004 Solomon metrics for mechanical availability put Texas City refinery performance at the bottom of 29 

Gulf Coast refineries and 79 of 82 refineries nationally. 
BP Texas City Final Investigation Report 3/20/2007 

173

two major accidents in 2004 and many of those in the previous 30 years were process safety-related, the 

action items in the presentation emphasized following work rules. 

9.4.16 Telos Survey 

In late 2004, the Texas City site performed a safety culture assessment. The survey was initiated by the 

Business Unit Leader to determine the “brutal facts” concerning “our management systems, our site 

leadership, our site cultures, and our behaviors for safety and integrity management.” Researchers from 

safety culture consultant the Telos Group surveyed 1,080 employees and interviewed 112. The 

interviewees included members of the leadership team and 69 supervisors. The assessment team issued a 

report with recommendations (Telos Report) in January 2005, which was “embraced”204 by the site 

leadership team. The Telos report provided insight into the organizational and cultural conditions at the 

Texas City refinery before the ISOM explosion. 

The report revealed that Texas City had a severely flawed safety culture and organizational deficiencies 

that preceded the ISOM incident. The report findings include:205

• Production pressures impact managers “where it appears as though they must compromise 

safety.” 

• “Production and budget compliance gets recognized and rewarded before anything else at Texas 

City.” 

• “The pressure for production, time pressure, and understaffing are the major causes of accidents 

at Texas City.” 

 

204 “Telos Perspective and Recommendations,” part of the Telos Report, January 21, 2005. 

205 “Executive Summary of Report Findings,” part of the Telos Report, January 21, 2005. 
BP Texas City Final Investigation Report 3/20/2007 

174

• “The quantity and quality of training at Texas City is inadequate...compromising other 

protection-critical competence.” 

• “Many [people] reported errors due to a lack of time for job analysis, lack of adequate staffing, a 

lack of supervisor staffing, or a lack of resident knowledge of the unit in the supervisory staff.” 

• Many employees also reported “feeling blamed when they had gotten hurt or they felt 

investigations were too quick to stop at operator error as the root cause.” There was a “culture of 

casual compliance.” 

• Serious hazards in the operating units from a number of mechanical integrity issues: “There is an 

exceptional degree of fear of catastrophic incidents at Texas City.” 

• Leadership turnover and organizational transition; the creation and dismantling of the South 

Houston site “made management of protection very difficult.” 

• The strong safety commitment by the Business Unit Leader “is undermined by the lack of 

resources to address severe hazards that persist,” and “for most people, there are many unsafe 

conditions that prove cost cutting and production are more important than protection. Poor 

equipment conditions are made worse in the view of many people by a lack of resources for 

inspection, auditing, training, and staffing for anything besides ‘normal operating conditions.’” 

• Texas City was at a “high risk” for the “check the box” mentality. This included going through 

the motions of checking boxes and inattention to the risk after the check-off. “Critical events, 

(breaches, failures or breakdowns of a critical control measure) are generally not attended to.” 

Texas City managers asked the safety culture consultants who authored the Telos report to comment on 

what made safety protection particularly difficult for Texas City. The consultants noted that they had 

never seen such a history of leadership changes and reorganizations over such a short period that resulted 
BP Texas City Final Investigation Report 3/20/2007 

175

in a lack of organizational stability.

206 Initiatives to implement safety changes were as short-lived as the 

leadership, and they had never seen such “intensity of worry” about the occurrence of catastrophic events 

by those “closest to the valve.” At Texas City, workers perceived the managers as “too worried about seat 

belts” and too little about the danger of catastrophic accidents. Individual safety “was more closely 

managed because it ‘counted’ for or against managers on their current watch (along with budgets) and 

that it was more acceptable to avoid costs related to integrity management because the consequences 

might occur later, on someone else’s watch.” 

The Telos consultants also noted that concern about equipment conditions was expressed not only by BP 

personnel, but “strongly expressed by senior members” of the contracting community who “pointed out 

many specific hazards in the work environment that would not be found at other area plants.” The 

consultants concluded that the tolerance of “these kind of risks must contribute to the tolerance of risks 

you see in individual behavior.” 

The refinery leadership team reviewed the Telos report and accepted the findings. The Business Unit 

Leader said that “seeing the ‘brutal facts’ so clearly defined was hard to digest, including the concern 

around the conflict between production and safety. The evidence was strong and clear and I accept my 

responsibility for the results.”207 The Business Unit Leader summarized results of the report on March 17, 

2005, for all plant supervisors. The summary stated that the site had gotten off to good start in 2005 with 

safety performance that “may be the best ever,” adding that Texas City had had “the best profitability ever 

in its history last year” with over $1 billion in profit—“more than any other refinery in the BP system.” 

Despite the stark findings of safety failures reflected in site performance and the Telos assessment, BP 

management persisted in believing that the personal injury rates reflected total safety performance. The 

Business Unit Leader stated that BP Group refinery executive leadership was “very complimentary” of 

 

206 Telos memo, “What makes protection particularly difficult for BP Texas City?” 

207 Email “Update from [Business Unit Leader],” March 17, 2005. 
BP Texas City Final Investigation Report 3/20/2007 

176

 

progress and had “high praise” for the site’s auditing process and “our Safety Culture response efforts.” 

The Business Unit Leader also applauded the safety efforts of the supervisors “that prompted [the Group 

VP for refining] to raise our VPP [bonus program] scores and improve all of our payouts!” The BP Group 

HSE VP for Refining stated that the executive leadership had considered further intervention at Texas 

City, but did not act because the personal injury rates had improved. Focus on injury rates at all levels of 

BP management helped mask severe shortcomings in process safety. In this regard, the lessons of the 

Grangemouth report were not learned or acted upon. 

9.4.17 2005 Budget Cuts 

In late 2004, BP Group refining leadership ordered a 25 percent budget reduction “challenge” for 2005. 

The Texas City Business Unit Leader asked for more funds based on the conditions of the Texas City 

plant, but the Group refining managers did not, at first, agree to his request. Initial budget documents for 

2005 reflect a proposed 25 percent cutback in capital expenditures, including on compliance, HSE, and 

capital expenditures needed to maintain safe plant operations.208 The Texas City Business Unit Leader 

told the Group refining executives that the 25 percent cut was too deep, and argued for restoration of the 

HSE and maintenance-related capital to sustain existing assets in the 2005 budget. The Business Unit 

Leader was able to negotiate a restoration of less than half the 25 percent cut; however, he indicated that 

the news of the budget cut negatively affected workforce morale and the belief that the BP Group and 

Texas City managers were sincere about culture change. 

In February 2005, the BP Group VP and the North American VP for Refining visited Houston, where 

refinery managers presented details about safety transformation efforts, the Telos cultural assessment, and 

“Safety Reality” slides. The presentation listed the major Telos findings, including concern about the 

condition of the refinery, budget cuts, pressure for production overshadowing safety, and inadequate 

208 TCR Update – 2005 HSE Capex, August 24, 2004; Email “Texas City Capex Reduction Proposal” from the 

Business Unit Leader, 11-5-04. 
BP Texas City Final Investigation Report 3/20/2007 

177

training. Also discussed were the three fatalities in 2004 and the poor PSM action item closure rate. The 

site’s mechanical availability was graded a “D,” with little or no progress due to unplanned events such as 

the UU4 fire. Also identified were the initial 25 percent capital expenditure cuts in the 2005 budget and 

the amount restored. Texas City managers proposed, in the presentation, that the executive leaders restore 

an additional $41 million of the 2005 cuts in the 2006 budget.209

9.4.18 2005 Key Risk—“Texas City kills someone” 

 The 2005 Texas City HSSE Business Plan210 warned that the refinery likely would “kill someone in the 

next 12-18 months.” This fear of a fatality was also expressed in early 2005 by the HSE manager: “I truly 

believe that we are on the verge of something bigger happening,”211 referring to a catastrophic incident. 

Another key safety risk in the 2005 HSSE Business Plan was that the site was “not reporting all incidents 

in fear of consequences.” PSM gaps identified by the plan included “funding and compliance,” and 

deficiency in the quality and consistency of the PSM action items. The plan’s 2005 PSM key risks 

included mechanical integrity, inspection of equipment including safety critical instruments, and 

competency levels for operators and supervisors. Deficiencies in all these areas contributed to the ISOM 

incident. 

9.4.19 Summary 

Beginning in 2002, BP Group and Texas City managers received numerous warning signals about a 

possible major catastrophe at Texas City. In particular, managers received warnings about serious 

deficiencies regarding the mechanical integrity of aging equipment, process safety, and the negative 

safety impacts of budget cuts and production pressures. 

 

209 “Texas City Site Update, A Brief Update for Mike Hoffman – February 15, 2005.” 

210 HSSE ’05 Business Plan, March 15, 2005. HSSE is Health, Safety, Security, and the Environment. 

211 Email from the HSSE manager, February 20, 2005. 
BP Texas City Final Investigation Report 3/20/2007 

178

However, BP Group oversight and Texas City management focused on personal safety rather than on 

process safety and preventing catastrophic incidents. Financial and personal safety metrics largely drove 

BP Group and Texas City performance, to the point that BP managers increased performance site bonuses 

even in the face of the three fatalities in 2004. Except for the 1,000 day goals, site business contracts, 

manager performance contracts, and VPP bonus metrics were unchanged as a result of the 2004 fatalities. 
BP Texas City Final Investigation Report 3/20/2007 

179

10.0 ANALYSIS OF BP’S SAFETY CULTURE 

The BP Texas City tragedy is an accident with organizational causes embedded in the refinery’s culture. 

The CSB investigation found that organizational causes linked the numerous safety system failures that 

extended beyond the ISOM unit. The organizational causes of the March 23, 2005, ISOM explosion are 

• BP Texas City lacked a reporting and learning culture. Reporting bad news was not encouraged, 

and often Texas City managers did not effectively investigate incidents or take appropriate 

corrective action. 

• BP Group lacked focus on controlling major hazard risk. BP management paid attention to, 

measured, and rewarded personal safety rather than process safety. 

• BP Group and Texas City managers provided ineffective leadership and oversight. BP 

management did not implement adequate safety oversight, provide needed human and economic 

resources, or consistently model adherence to safety rules and procedures. 

• BP Group and Texas City did not effectively evaluate the safety implications of major 

organizational, personnel, and policy changes. 

10.1 Lack of Reporting, Learning Culture 

Studies of major hazard accidents conclude that knowledge of safety failures leading to an incident 

typically resides in the organization, but that decision-makers either were unaware of or did not act on the 

warnings (Hopkins, 2000). CCPS’ “Guidelines for Investigating Chemical Process Incidents” (1992a) 

notes that almost all serious accidents are typically foreshadowed by earlier warning signs such as nearmisses and similar events. James Reason, an authority on the organizational causes of accidents, explains 

that an effective safety culture avoids incidents by being informed (Reason, 1997). Collecting appropriate 

information, assessing vital signs, and communicating lessons and knowledge of hazards are 
BP Texas City Final Investigation Report 3/20/2007 

180

10.1.1.1 

characteristics of an effective safety culture. An informed culture includes two essential elements: 

reporting and learning, and in such a culture, managers have up-to-date knowledge about the “human, 

technical, organizational and environmental factors that determine the safety of the system as a whole” 

(Reason, 1997). BP Texas City did not have effective reporting and learning cultures where previous 

incidents and near-misses could serve as learning opportunities to avoid catastrophic incidents. 

10.1.1 Reporting Culture 

An informed culture must first be a reporting culture where personnel are willing to inform managers 

about errors, incidents, near-misses, and other safety concerns. The key issue is not if the organization has 

established a reporting mechanism, but rather if the safety information is actually reported (Hopkins, 

2005). Reporting errors and near-misses requires an atmosphere of trust, where personnel are encouraged 

to come forward and organizations promptly respond in a meaningful way (Reason, 1997). This 

atmosphere of trust requires a “just culture” where those who report are protected and punishment is 

reserved for reckless non-compliance or other egregious behavior (Reason, 1997). While an atmosphere 

conducive to reporting can be challenging to establish, it is easy to destroy (Weike et al., 2001). 

BP Texas City Reporting 

The BP Texas City site had a number of reporting programs, yet serious near-misses and other critical 

events were often unreported. In the eight previous ISOM blowdown system incidents, three were not 

reported in any BP database, five were reported as environmental releases, and only two were 

investigated as safety incidents. In the five years prior to the 2005 disaster, over three-quarters of the 

raffinate splitter tower startups’ level ran above the range of the level transmitter and in nearly half, the 

level was out of range for more than one hour. These operating deviations were not reported by operations 

personnel or reviewed in the computerized history by Texas City managers. During the March 2005 

ISOM startup, the operating deviations were more serious in degree but similar in kind to past startups. 
BP Texas City Final Investigation Report 3/20/2007 

181

 

Yet the operating envelope program designed to capture and report excursions from safe operating limits 

was not fully functional and did not capture high distillation tower level events in the ISOM to alert 

managers to the deviations. 

Other methods to communicate safety information also failed to provide critical data. Logbooks, incident 

databases, and fire and environmental reports typically provided little detail or analysis of the events. The 

maintenance work order system was primarily an accounting program that lacked crucial information 

about work order history, the cause of failures, and whether equipment was successfully repaired. 

Logbooks also provided little detail on equipment repairs. 

BP Texas City managers did not effectively encourage the reporting of incidents; they failed to create an 

atmosphere of trust and prompt response to reports. Among the safety key risks identified in the 2005 

HSSE Business Plan, issued prior to the disaster, was that the “site [was] not reporting all incidents in fear 

of consequences.” The maintenance manager said that Texas City “has a ways to go to becoming a 

learning culture and away from a punitive culture.”212 The Telos report found that personnel felt blamed 

when injured at work and “investigations were too quick to stop at operator error as the root cause.” 

Lack of meaningful response to reports discourages reporting. Texas City had a poor PSM incident 

investigation action item completion rate: only 33 percent were resolved at the end of 2004. The Telos 

report cited many stories of dangerous conditions persisting despite being pointed out to leadership, 

because “the unit cannot come down now.” A 2001 safety assessment found “no accountability for timely 

completion and communication of reports.” 

212 Email from the Texas City Maintenance Manager, January 19, 2005. 
BP Texas City Final Investigation Report 3/20/2007 

182

10.1.1.2 

 

BP Group Reporting 

Responsibility for a lack of a reporting culture extended to BP Group. The three major accidents at the 

Texas City refinery were not mentioned in the GHSER reports sent to Group executives and the BP Board 

of Directors. A 2004 BP Group HRO survey found that across all business units “mistakes may be held 

against people.”213 A 2002 BP Group analysis, “Learning from Tragedy,” concluded that the “quality of 

investigation and reporting varies considerably and quality of evidence gathering [is] sometimes 

questionable.” 

10.1.2 Learning Culture 

BP Group and Texas City lacked a learning culture. A learning culture ensures that reports of incidents 

and safety information are analyzed and lessons learned effectively communicated, and that prompt 

corrective action is taken (Hopkins, 2005). BP Group and Texas City had serious deficiencies in these 

areas: 

• Management failed to adequately investigate previous incidents that revealed the serious hazards 

of atmospheric blowdown systems in the ISOM, and other process units and failed to take 

corrective action. 

• Managers did not act on findings from previous reports, such as more training for operators and 

supervisors, use of control board simulators, and use of fully functional operating envelopes. 

• Reports of malfunctioning instrumentation were not acted on and instrument checks were not 

completed prior to the ISOM startup. 

213 Aggregate HRO Survey Results, June 2004. 
BP Texas City Final Investigation Report 3/20/2007 

183

• BP did not monitor recurring instrument malfunctions, such as the high level switch on the 

raffinate splitter tower and the blowdown drum, for trends or failure analysis. 

• A BP Group 2002 report on the Group Fatal Accident Investigation Process found that “critical 

factors and hence root causes [were] not identified” and that “corrective actions [were]sometimes 

vague and impractical.” 

• The 2003 South Houston GHSER audit found that “a coordinated, self monitoring and self 

assessment process is not evident throughout the organization.” 

• The 2004 GHSER assessment graded Texas City as “poor” because investigation information was 

not analyzed to monitor trends and develop prevention programs. The assessment found little use 

of the GHSER audit/assessment results to drive plant goals. 

• The 2004 Group Internal Audit report found poor plant monitoring and lessons learned processes 

at 35 BP Group business units: “[i]nformation on incidents is circulated from Group HSE. Some 

entities do not have robust processes for assessing the implications of these and initiating actions 

to manage their risks of a similar occurrence.” 

The lack of a learning and a reporting culture was also revealed in BP’s ineffective response to the 

important lessons from the Grangemouth report. Many of the organizational failures in the ISOM incident 

involved issues that were also key lessons from Grangemouth. The U.K. Health and Safety Executive 

concluded that BP lacked “a strong, consistent overall strategy for major accident prevention,” which was 

a barrier to learning from previous incidents. Failure to effectively act on those lessons set the stage for 

the ISOM incident. BP Group lacked an effective program to ensure that lessons from internal and 

external incidents were acted upon corporate-wide. 
BP Texas City Final Investigation Report 3/20/2007 

184

10.2 Lack of Focus on Controlling Major Hazard Risk 

BP did not effectively assess and control the risks of major hazards at Texas City. In the events leading up 

to the ISOM incident, managers and operators lacked an understanding of major hazard risk: 1) the 

blowdown system had not been replaced, despite previous serious incident reports and policies that 

required converting it to a flare; 2) occupied trailers were placed dangerously close to running process 

units because the siting analysis failed to identify the risks; 3) non-essential personnel were not evacuated 

despite the hazards posed by ISOM unit startup; 4) the startup was authorized despite having inadequate 

staffing, malfunctioning instruments and equipment, and without a pre-startup safety review (PSSR); and 

5) during the startup, no qualified supervision was present and procedures were not followed as had been 

the practice for some time. 

Audits and assessments concluded that Texas City had serious deficiencies in identifying and controlling 

major risks. The 2003 GHSER audit found that “the practice of risk identification and the development of 

mitigation plans are not evident across the site.” The 2004 GHSER assessment concluded that “no formal 

system exists for identifying high level risks.” The 2005 Telos assessment found that “critical events, 

(breaches, failures, or breakdowns of a critical control measure) are generally not attended to.” Safety 

risks revealed by the 2004 fatalities and property damage, the falling PSM action item closure rate, and 

poor equipment integrity were not perceived as requiring more serious intervention. 

Similar risk awareness deficiencies were found at business units across the corporation. BP Group’s 2004 

Internal Audit report found that business unit managers’ risk management processes did not understand or 

control major hazards, nor were these processes used to drive priorities or allocate resources. Moreover, 

BP business unit managers had poor competency in risk and hazard management. 

10.2.1 Focus on personal safety rather than process safety 

BP Group executives used personal safety metrics to drive safety performance. A key lesson from the 
BP Texas City Final Investigation Report 3/20/2007 

185

 

U.K. Health and Safety Executive Grangemouth report is that BP needed a specific focus on KPIs for 

process safety because personal safety metrics are not a reliable measure of the risk for a major accident. 

BP did not adequately implement these lessons in its Group safety management or at Texas City, and, in 

fact, paid most attention to, measured, and rewarded personal safety performance rather than process 

safety. Personal safety metrics were the exclusive measures in the GHSER policy, HSE assurance reports, 

business and personal contracts, incentive programs, and plant goals. Personal safety metrics are 

important to track low-consequence, high-probability incidents, but are not a good indicator of process 

safety performance. As process safety expert Trevor Kletz notes, “The lost time rate is not a measure of 

process safety”214 (Kletz, 2003). An emphasis on personal safety statistics can lead companies to lose 

sight of deteriorating process safety performance (Hopkins, 2000). 

Process safety KPIs provide important information on the effectiveness of safety systems, and an early 

warning of impending catastrophic failure (HSE, 2006a). The sole use of lagging safety indicators, such 

as injury rates or numbers of incidents, has been described as trying to drive down the road looking only 

in the rear view mirror---it tells you where you have been but not where you are headed. Process safety 

good practice guidelines recommend using both leading and lagging indicators for process safety. 

Leading indicators provide a check of system functioning—whether needed actions have been taken, such 

as equipment inspections completed by the target date or PSM action item closure. Lagging indicators, 

such as near-misses, provide evidence that a key outcome has failed or not met its objective. “Active 

monitoring” of both leading and lagging indicators is important to the health of process safety systems 

(HSE 2006a). 

214 Kletz (2001) also writes that “a low lost-time accident rate is no indication that the process safety is under 

control, as most accidents are simple mechanical ones, such as falls. In many of the accidents described in this book 

the companies concerned had very low lost-time accident rates. This introduced a feeling of complacency, a feeling 

that safety was well managed”. 
BP Texas City Final Investigation Report 3/20/2007 

186

 

10.2.2 “Check the box” 

Rather than ensuring actual control of major hazards, BP Texas City managers relied on an ineffective 

compliance-based system that emphasized completing paperwork. The Telos assessment found that Texas 

City had a “check the box” tendency of going through the motions with safety procedures; once an item 

had been checked off it was forgotten. The CSB found numerous instances of the “check the box” 

tendency in the events prior to the ISOM incident. For example, the siting analysis of trailer placement 

near the ISOM blowdown drum was checked off, but no significant hazard analysis had been performed, 

hazard of overfilling the raffinate splitter tower was checked off as not being a credible scenario, critical 

steps in the startup procedure were checked off but not completed, and an outdated version of the ISOM 

startup procedure was checked as being up-to-date. 

10.2.3 Oversimplification 

In response to the safety problems at Texas City, BP Group and local managers oversimplified the risks 

and failed to address serious hazards. Oversimplification means evidence of some risks is disregarded or 

deemphasized while attention is given to a handful of others215 (hazard and operability study, or HAZOP 

Weak et al., 2001). The reluctance to simplify is a characteristic of HROs in high-risk operations such as 

nuclear plants, aircraft carriers, and air traffic control, as HROs want to see the whole picture and address 

all serious hazards (Weick et al., 2001). An example of oversimplification in the space shuttle Columbia 

report was the focus on ascent risk rather than the threat of foam strikes to the shuttle (CAIB, 2003). An 

example of oversimplification in the ISOM incident was that Texas City managers focused primarily on 

infrastructure216 integrity rather than on the poor condition of the process units. Four major incidents 

where mechanical integrity played a role in 2004-2005 occurred in the process units—UU4, ISOM, RHU, 

215 Weick and Sutcliffe further state that HROs manage the unexpected by a reluctance to simplify: “HROs take 

deliberate steps to create more complete and nuanced pictures. They simplify less and see more.” 

216 The infrastructure includes refinery storage tanks, utilities, and docks. 
BP Texas City Final Investigation Report 3/20/2007 

187

 

CFHU.217 As the 2003 GHSER audit notes, BP Texas City was managing the infrastructure problems; 

however, process unit hazards were not adequately addressed. 

BP Group executives oversimplified their response to the serious safety deficiencies identified in the 

internal audit review of common findings in the GHSER audits of 35 business units. The R&M Chief 

Executive determined that the corporate response would focus on compliance, one of four key common 

flaws found across BP’s businesses. The response directing the R&M segment to focus on compliance 

emphasized worker behavior. Other deficiencies identified in the internal audit included lack of HSE 

leadership and poor implementation of HSE management systems; however, these problems were not 

addressed. This narrow compliance focus at Texas City allowed PSM performance to further deteriorate, 

setting the stage for the ISOM incident. The BP focus on personal safety and worker behavior was 

another example of oversimplification. 

10.2.4 Ineffective corporate leadership and oversight 

BP Group managers failed to provide effective leadership and oversight to control major accident risk. 

According to Hopkins, top management’s actions and what they paid attention to, measure, and allocate 

resources for is what drives organizational culture (Hopkins, 2005). Examples of deficient leadership at 

Texas City included managers not following or ensuring enforcement of policies and procedures, 

responding ineffectively to a series of reports detailing critical process safety problems, and focusing on 

budget cutting goals that compromised safety. 

Texas City managers did not model safe practices, and in the incidents and critical events prior to the 

ISOM incident, deviated from numerous safety policies and procedures. Managers did not complete the 

study of the ISOM pressure relief system that had been required by the OSHA process safety regulations 

for many years. Contrary to BP policy (Section 5.5.4), the ISOM blowdown drum was not replaced with a 

217 CFHU is the Cat Feed Hydrotreating Unit. 
BP Texas City Final Investigation Report 3/20/2007 

188

 

flare system, nor was the siting of the trailers effectively managed. A PSSR that would have required nonessential personnel to be removed from the ISOM unit and surrounding areas prior to startup was not 

conducted. Numerous procedures and forms were checked off, but the safety critical tasks were not 

performed or reviewed. Finally, the startup lacked the presence of qualified supervisory oversight or 

technically trained personnel despite being required by BP policy. 

The 2003 GHSER audit emphasized that the Texas City senior managers must “break the culture that 

tolerated HSE exceptions,” citing overdue action items and maintenance inspections and unaddressed 

major risks. The 2004 BP audit of 35 business units found a lack of leadership competence and 

understanding of HSE, and that “leadership was not reinforcing the [GHSER] expectations through their 

own behaviors.” The Telos authors concluded that management accepting risks, such as serious 

unaddressed hazards or deviations from safety procedures, can contribute to “the tolerance of risks you 

see in individual behavior.” 

Budget cuts and production pressures seriously impacted safe operations at Texas City. Studies and 

assessments presented to BP Group managers linked the history of budget cuts to critical safety issues: 

“The current integrity and reliability issues at [Texas City] are clearly linked to the reduction in 

maintenance spending over the last decade.”218 Budget cuts also impaired training, operations staffing 

levels, and mechanical integrity. Budget pressures affected the decision not to replace the ISOM 

blowdown system on several occasions. BP’s assessment of the 2004 UU4 accident, as well as events 

leading to the ISOM incident, show that safety critical repairs were not conducted because there “was no 

time” left in the turnaround schedule. 

The 2005 Telos assessment indicated that while senior managers showed a strong safety commitment, it 

was “contradicted by the lack of resources, action or clear plans to address severe hazards that persist. For 

218 Texas City Refinery Retrospective Analysis, October 28, 2002. 
BP Texas City Final Investigation Report 3/20/2007 

189

most people there are many unsafe conditions that prove cost cutting and production are more important 

than protection.” 

The BP Chief Executive and the BP Board of Directors did not exercise effective safety oversight. 

Decisions to cut budgets were made at the highest levels of the BP Group despite serious safety 

deficiencies at Texas City. BP executives directed Texas City to cut capital expenditures in the 2005 

budget by an additional 25 percent despite three major accidents and fatalities at the refinery in 2004. 

The CCPS, of which BP is a member, developed 12 essential process safety management elements in 

1992. The first element is accountability. CCPS highlights the “management dilemma” of “production 

versus process safety” (CCPS, 1992b). The guidelines emphasize that to resolve this dilemma, process 

safety systems “must be adequately resourced and properly financed. This can only occur through top 

management commitment to the process safety program.” (CCPS, 1992b). Due to BP’s decentralized 

structure of safety management, organizational safety and process safety management were largely 

delegated to the business unit level, with no effective oversight at the executive or board level to address 

major accident risk. 

The Financial Reporting Council (FRC), the U.K.'s independent regulator for corporate reporting and 

governance, has adopted “Internal Control: Guidance for Directors on the Combined Code,” commonly 

referred to as the “Turnbull guidance.” The Turnbull guidance recommends that U.K. boards maintain a 

system of internal risk control that includes HSE, and that that boards review the system’s effectiveness 

annually: “The review should cover all material controls, including financial, operational and compliance 

controls and risk management systems” (FRC, 2005). 

The UK Health and Safety Executive’s report on the accidents at the BP Grangemouth refinery also 

addresses the importance of board safety oversight. One of the report’s “wider messages for industry” 

states that “[o]perators should give increased focus to major accident prevention in order to ensure serious 
BP Texas City Final Investigation Report 3/20/2007 

190

 

business risk is controlled and to ensure effective Corporate Governance.” The Health and Safety 

Executive specifically uses the BP Grangemouth incident to address the responsibilities of board 

members for major accident prevention: 

The Turnbull report states that directors should, at least annually, review systems of control 

including risk management, financial, operational and compliance controls that are the key to the 

fulfillment of the company’s business objectives. 

The HSE has prepared guidance for directors in order to help them ensure that the health and 

safety risks arising from their organizations activities are properly managed. Directors should be 

fully aware of their corporate responsibilities in relation to the control of major accident hazards. 

Failure by a corporate body and the directors of a company to adequately manage health and 

safety can result in prosecution of the company and the individual directors responsible. 

As previously stated the underlying causes of major accidents (technical, managerial and human 

factors) are well established from analysis of hundreds of major accidents worldwide. Directors 

have a duty to manage these known factors to prevent major accidents (HSE, 2003). 

The above quotation from the guidance ”Directors Responsibilities for Health and Safety”, as referenced 

in the Grangemouth Report, states that “[t]he board needs to ensure that it is kept informed of, and alert 

to, relevant health and safety risk management issues. The UK Health and Safety Commission (HSC) 

recommends that boards appoint one of their number to be the ‘heath and safety director’”219 (HSC, 

2002). Additionally, the guidance recommends that boards of directors review their heath and safety 

performance annually, ensure that management systems provide effective monitoring and reporting, and 

ensure that the health and safety implications of all their decisions are addressed. 

219 This guidance is published by the Health and Safety Executive (HSE); the Health and Safety Commission is the 

politically appointed governing body of the HSE. 
BP Texas City Final Investigation Report 3/20/2007 

191

The Baker Panel Report concluded that BP’s Board of Directors had not ensured, as a best practice, 

effective implementation of PSM. Safety culture expert James Reason emphasizes the importance of 

designating corporate boards of directors’ responsibility for organizational safety and major hazard risk 

control. BP has a board Ethics and Environment Assurance committee that monitors safety issues; 

however, no board member has designated health and safety leadership responsibilities or a background 

in refinery operations or process safety. 

10.3 Safety Implications of Organizational Change 

Although the BP HSE management policy, GHSER, required that organizational changes be managed to 

ensure continued safe operations, these policies and procedures were generally not followed. Poorly 

managed corporate mergers, leadership and organizational changes, and budget cuts greatly increased the 

risk of catastrophic incidents. 

10.3.1 BP mergers 

In 1998, BP had one refinery in North America. In early 1999, BP merged with Amoco and then acquired 

ARCO in 2000. BP emerged with five refineries in North America, four of which had been just acquired 

through mergers. BP replaced the centralized HSE management systems of Amoco and Arco with a 

decentralized HSE management system. 

The effect of decentralizing HSE in the new organization resulted in a loss of focus on process safety. In 

an article on the potential impacts of mergers on PSM, process safety expert Jack Philley explains, “The 

balance point between minimum compliance and PSM optimization is dictated by corporate culture and 

upper management standards. Downsizing and reorganization can result in a shift more toward the 

minimum compliance approach. This shift can result in a decrease in internal PSM monitoring, auditing, 

and continuous improvement activity” (Philley, 2002). 
BP Texas City Final Investigation Report 3/20/2007 

192

10.3.2 Organizational Changes at Texas City 

After the Amoco merger, Texas City underwent a complex series of leadership and organizational 

changes that were only informally assessed for their impact on safety and health. In 1999, Texas City was 

a separate business unit run by a business unit leader. In 2001, the refinery became part of the BP South 

Houston complex along with four BP chemical plants (Figure 18; Appendix D). From then until 2004, the 

safety, environmental, and process safety departments were combined and operated as a shared services 

group servicing multiple facilities. This resulted in the process safety group not reporting directly to each 

site’s business unit leader; instead they reported to the Star Site’s Shared Services Group (Appendix D.2). 

Figure 18. Organizational changes affecting the Texas City refinery 

After the BP South Houston complex was formed, a series of leadership changes occurred. First, the 

refinery business unit leader became the BP South Houston director and the Texas City refinery was run 

by an operations manager. In 2002, the director was replaced and later that year the operations manager 

left. He was replaced by a refinery performance unit leader, who functioned basically as the business unit 

leader. The Baker Panel Report concluded that Texas City refinery senior leadership turnover had been 
BP Texas City Final Investigation Report 3/20/2007 

193

 

high with nine plant managers since 1997; five from 2001 to 2003 (Baker, et al., 2007). 

Additional organizational change occurred in 2003 and 2004 when BP issued its “Management 

Framework.” The BP South Houston complex was dissolved, the director became the refinery Business 

Unit Leader, and the process safety department became part of the new HSSE department with a new 

manager. 

The impact of these ineffectively managed organizational changes on process safety was summed up by 

the Telos study consultants. Weeks before the ISOM incident, when asked by the refinery leadership to 

explain what made safety protection particularly difficult for BP Texas City, the consultants responded: 

We have never seen an organization with such a history of leadership changes over such 

short period of time. Even if the rapid turnover of senior leadership were the norm 

elsewhere in the BP system, it seems to have a particularly strong effect at Texas City. 

Between the BP/Amoco mergers, then the BP turnover coupled with the difficulties of 

governance of an integrated site... there has been little organizational stability. This 

makes the management of protection very difficult.220

Additionally, BP’s decentralized approach to safety led to a loss of focus on process safety. BP’s new 

HSE policy, GSHER, while containing some management system elements, was not an effective PSM 

system. The centralized Process Safety group that was part of Amoco was disbanded and PSM functions 

were largely delegated to the business unit level. Some PSM activities were placed with the loosely 

organized Committee of Practice that represented all BP refineries, whose activity was largely limited to 

informally sharing best practices. 

220 Telos Group memo, “What makes protection particularly difficult for BP Texas City?” 
BP Texas City Final Investigation Report 3/20/2007 

194

The impact of these changes on the safety and health program at the Texas City refinery was only 

informally assessed. Discussions were held when leadership and organizational changes were made, but 

the MOC process was generally not used. Applying Jack Philley’s general observations to Texas City, the 

impact of these changes reduced the capability to effectively manage the PSM program, lessened the 

motivation of employees, and tended to reduce the accountability of management (Philley, 2002). 

10.3.3 Budget Cuts 

BP audits, reviews, and correspondence show that budget-cutting and inadequate spending had impacted 

process safety at the Texas City refinery. Sections 3, 6, and 9 detail the spending and resource decisions 

that impaired process safety performance in operator training, board operator staffing, mechanical 

integrity and the decisions not to replace the blowdown drum in the ISOM unit. Philley warns that shifts 

in risk can occur during mergers: “If company A acquires an older plant from company B that has higher 

risk levels, it will take some time to upgrade the old plant up to the standards of the new owner. The risk 

reduction investment does not always receive the funding, priority, and resources needed. The result is 

that the risk exposure levels for Company A actually increase temporarily (or in some cases, 

permanently)” (Philley 2002). Reviewing the impacts of cost-cutting measures is especially important 

where, as at Texas City, there had been a history of budget cuts at an aging facility that had led to critical 

mechanical integrity problems. BP Texas City did not formally review the safety implications of policy 

changes such as cost-cutting strategy prior to making changes. 

10.3.4 Good Practice Guidelines 

The need to manage organizational change is recognized in good practice guidelines issued by CCPS 

(1992b); American Chemistry Council (CMA, 1998); the Health and Safety Executive (2003b); the 

Canadian Society for Chemical Engineering (2004); and Contra Costa County in California (1999). A 

recent U.S. survey by Keen, West, and Mannan (2002) showed, however, that organizational change was 
BP Texas City Final Investigation Report 3/20/2007 

195

addressed in the MOC programs of only 44 percent of chemical processing companies. Kletz notes that 

companies may not be addressing the full range of organizational changes, and recommends that MOC 

programs assess the impact on safety and health of organizational changes resulting from outsourcing, 

major re-organizations following mergers or downsizing, and other high level changes (Kletz, 2003). 
BP Texas City Final Investigation Report 3/20/2007 

196

 

11.0 REGULATORY ANALYSIS 

11.1 OSHA’s Process Safety Management Regulation 

11.1.1 Background Information 

In 1990, the U. S. Congress responded to catastrophic accidents221 in chemical facilities and refineries by 

including in amendments to the Clean Air Act a requirement that OSHA and EPA publish new 

regulations to prevent such accidents. The new regulations addressed prevention of low-frequency, highconsequence accidents. OSHA’s regulation, “Process Safety Management of Highly Hazardous 

Chemicals,” (29 CFR 1910.119) (PSM standard) became effective in May 1992. This standard contains 

broad requirements to implement management systems, identify and control hazards, and prevent 

“catastrophic releases of highly hazardous chemicals.” 

11.1.2 PSM Standard Elements 

Several PSM elements are applicable to the disaster at BP Texas City. The BP Texas City ISOM unit was 

a covered process under the PSM rule, because the process contained over 10,000 pounds of flammable 

221 The catastrophic accidents included the 1984 toxic release in Bhopal, India, that resulted in several thousand 

known fatalities, and the 1989 explosion at the Phillips 66 petrochemical plant in Pasadena, Texas, that killed 23 

and injured 130. 
BP Texas City Final Investigation Report 3/20/2007 

197

tegrity.225 

 

substances.222,

223 These PSM elements include PHA, process safety information,224 MOC, and 

mechanical in

The initial PHA and subsequent revalidations for the BP Texas City ISOM unit failed to identify the 

possible scenario of raffinate splitter tower overfill, leading to a liquid release from the blowdown drum 

(section 8.1). Therefore, the raffinate splitter instruments, such as the level transmitter, were not identified 

as critically important to prevent a catastrophic release, and were not placed on a priority schedule for 

maintenance and inspection. 

An effective PHA depends on accurate information as the basis for analysis. Accurate information is also 

vital for inspecting, testing, and maintaining instruments. The PSM standard identifies specific 

information that must be maintained, including relief system design and basis, instrument data sheets, and 

documentation that equipment complies with recognized and accepted good industry practice. 

Instrument technicians at BP Texas City did not have a current data sheet for the raffinate splitter level 

transmitter or testing procedures for the blowdown drum high level alarm. The ISOM unit pressure relief 

system design review was not completed and the blowdown drum did not comply with recognized good 

industry practice, as it was undersized. 

222 Applicability of the PSM rule is determined by whether the process contains in excess of the threshold quantity 

of listed highly hazardous chemicals. 

223 A flammable liquid is any liquid having a flashpoint below 100o

F (37.8oC). A flammable gas is a gas at ambient 

temperature and pressure that forms a flammable mixture with air at a concentration of 13% by volume or less 

[29CFR 1910.1200 (A)]. 

224 Process safety information is documentation needed to identify process hazards such as information related to 

process chemistry, safe upper and lower operating limits, technology, equipment, and design codes. The PSM 

standard requires covered employers to compile process safety information in conjunction with conducting a 

PHA. 

225 The other elements of the PSM Rule are contractor safety, PSSR, hot work permits, incident investigation, 

emergency planning and response, and compliance audits. The 13th “element” is mainly a requirement that 

maintaining trade secrecy not interfere with an employer’s compliance with the other 12 elements. 
BP Texas City Final Investigation Report 3/20/2007 

198

11.1.2.1 

 

Management of Change (MOC) 

Mergers, reorganizations, staffing cuts and reassignments, budget cuts, and other policy changes impacted 

the effectiveness of BP Texas City safety systems. Audits and other assessments found that the MOC 

program ineffectively reviewed policy, organizational, and personnel changes. 

The OSHA PSM standard requires that, at a minimum, a company’s MOC policy apply to “process 

chemicals, technology, equipment, and procedures; and, changes to facilities...” Industry good practice 

guidelines recommend that MOC also apply to organizational, personnel, and policy changes that could 

affect process safety. OSHA does not require employers to evaluate these types of changes. 

BP Texas City required that an MOC be initiated for changes to personnel, staffing and organization 

(Section 8.2). BP conducted an MOC analysis before placing additional duties on board operators but did 

not implement their findings effectively. However, BP did not formally review the safety impact of 

broader organizational and policy changes that potentially impacted process safety at the refinery, nor 

were they required to do so by the PSM standard. BP Texas City did not perform MOCs on budget cuts, 

staff reductions, and organizational changes that impaired process safety. 

CCPS and the American Chemistry Council (ACC, formerly CMA)226 publish guidelines for MOC 

programs. CCPS (1995b) recommends that MOC programs address organizational changes such as 

employee reassignment. The ACC guidelines for MOC warn that changes to the following can 

significantly impact process safety performance: 

• staffing levels, 

• major reorganizations, 

• corporate acquisitions, 

226 The American Chemistry Council is a chemical industry trade association. 
BP Texas City Final Investigation Report 3/20/2007 

199

11.1.2.2 

 

• changes in personnel, and 

• policy changes (CMA, 1993). 

Kletz reported on an incident that was similar to the March 23 explosion in which a distillation tower 

overfilled to a flare that failed and released liquid, causing a fire. According to Kletz, the immediate 

causes included failure to complete instrument repairs (the high level alarms did not activate); operator 

fatigue; and inadequate process knowledge. Kletz attributed the incident to changes in staffing levels and 

schedules, cutbacks, retirements, and internal reorganizations. He recommends “with changes to plants 

and processes, changes to organi[s]ation should be subjected to control by a system...which 

covers...approval by competent people”227 (Kletz 2003). 

The U.K. Health and Safety Executive published an information sheet in 2003 that provides guidance on 

managing the impact of organizational change on major hazards (HSE, 2003b). Among the types of 

changes recommended that managers address are mergers and acquisitions, downsizing, changes to key 

personnel, centralization and decentralization of functions, and changes at site and corporate levels. The 

document also includes a framework and methodology for managing and assessing the risk of such 

changes. 

If BP had reviewed the safety implications of changes to personnel, policy, and organization, the March 

23 disaster would have been less likely to occur. In addition, adoption of broader MOC requirements by 

OSHA would help companies like BP avoid catastrophic events. 

Mechanical Integrity 

The PSM standard requires procedures to maintain the integrity of process equipment. Poor testing, 

inspection, and maintenance of ISOM instrumentation (Section 7.0) were causal factors in the disaster. 

227 For the sake of brevity, several other elements of an organizational change management system in Kletz’s article 

are omitted here. 
BP Texas City Final Investigation Report 3/20/2007 

200

11.1.2.3 OSHA Enforcement at BP Texas City 

After the March 23, 2005 incident OSHA conducted an inspection of the Texas City facility and 

identified over 300 egregious willful violations of OSHA standards, many of which were related to PSM 

non-compliance. BP was fined over 21 million dollars. Under the settlement agreement, BP agreed to 

abate all violations, pay the penalty and retain an outside PSM expert to conduct a refinery-wide 

comprehensive audit. 

In the 20 years prior, OSHA records show at least 10 incidents at the site, resulting in 10 fatalities.228

While three workers died in 2004, there were no planned inspections conducted that year. Prior to the 

March 23, 2005, incident, OSHA conducted one planned229 PSM inspection of the Texas City facility in 

1998. That planned inspection was related to a local emphasis program; all other inspections were 

unplanned--the result of an accident, complaint, referral from another agency, or an inspection of another 

company (such as a BP contractor). During the 20 year period, OSHA issued citations for three willful 

and 82 serious violations, resulting in proposed penalties of $270,255, of which $77,860 was collected.230 

11.1.2.4 

 

OSHA Enforcement History 

A deadly explosion at the Phillips 66 plant in Pasadena, Texas, killed 23 in 1989. It occurred before the 

OSHA PSM standard was issued. OSHA investigated this accident and published a report to the President 

of the United States in 1990. In that report, OSHA identified several actions to prevent future incidents 

that, in OSHA’s words “occur relatively infrequently, when they do occur, the injuries and fatalities that 

result can be catastrophic” (OSHA, 1990). The report recognized the importance of a different type of 

inspection priority system other than one based upon industry injury rates and proposed that “OSHA will 

228 BP internal documents received by the CSB indicate 11 fatalities during the same 20-year period. 

229 Planned or programmed OSHA inspections of worksites have been scheduled based on national, regional or area 

plans, targeting programs, or special emphasis programs.

230 These inspections and penalties do not include the inspection following the September 2004 incident that killed 

two. OSHA did not settle this inspection with BP until the conference following the March 23, 2005, incident. 
BP Texas City Final Investigation Report 3/20/2007 

201

11.1.2.5 

 

revise its current system for setting agency priorities to identify and include the risk of catastrophic events 

in the petrochemical industry.” 

Prior to the Phillips disaster, OSHA conducted a Special Emphasis Program (SEP)231 using a system 

safety approach to prevent accidents in the chemical manufacturing industry. OSHA conducted 40 

ChemSEP inspections in 1985 and 1986. According to the final report reviewing the program, the 

valuable lesson learned by OSHA from these ChemSEP inspections is that an inspection process different 

from the agency’s traditional approach of determining compliance with the safety and health standards is 

needed to address the identification and correction of potentially catastrophic situations. A comprehensive 

approach, which includes both physical conditions and management systems, is indicated (OSHA, 

1987a). 

Program Quality Verification (PQV) Inspections 

The PSM standard is designed to prevent catastrophic accidents. OSHA’s enforcement program for 

preventing these accidents requires planned, comprehensive compliance inspections in facilities with 

accident histories or other indications of risk for a catastrophe. In 1992, OSHA published the compliance 

directive232 for the PSM standard, which states that “the primary enforcement model for the PSM 

standard shall be the PQV (Program Quality Verification) inspection” (OSHA Instruction CPL 02-02-

045). Those inspections have three parts: determining if the elements of a PSM program are in place; 

evaluating if the programs comply with the requirements of the standard; and verifying compliance with 

the standard through interviews, data sampling, and field observations. 

231 SEPs are focused inspections aimed at specific hazards or industries and usually include a detailed inspection 

protocol. 

232 Compliance directives are the main method OSHA uses to communicate the targeting plans, inspection methods 

and compliance expectations to their Compliance Safety and Health Officers for enforcing a new regulation. The 

PSM Compliance Directive was updated in 1994. 
BP Texas City Final Investigation Report 3/20/2007 

202

11.1.2.6 

 

PQV Inspection Targeting 

In its report on the Phillips 66 explosion, OSHA concluded that the petrochemical industry had a lower 

accident frequency than the rest of manufacturing, when measured in traditional ways using the Total 

Reportable Incident Rate (TRIR)233 and the Lost Time Injury Rate (LTIR). However, the Phillips 66 and 

BP Texas City explosions are examples of low-frequency, high-consequence catastrophic accidents. 

TRIR and LTIR do not effectively predict a facility’s risk for a catastrophic event; therefore, inspection 

targeting should not rely on traditional injury data. OSHA also stated in its report that it will include the 

risk of catastrophic events in the petrochemical industry on setting agency priorities. The importance of 

targeting facilities with the potential for a disaster is underscored by the BP Texas City refinery’s 

potential off-site consequences from a worst case chemical release. In its Risk Management Plan (RMP) 

submission to the EPA, BP defined the worst case as a release of hydrogen fluoride with a toxic endpoint 

of 25 miles; 550,000 people live within range of that toxic endpoint and could suffer “irreversible or other 

serious health effects” under the potential worst case release.234 

The targeting process began with OSHA selecting industries (SIC codes) that had experienced the greatest 

number of accidents. Petroleum refining and seven chemical industry segments were on the original list, 

which OSHA had not updated prior to the incident.235 

Although the PSM compliance directive requires each of the 10 OSHA regions to submit five candidate 

facilities for inspections each year, OSHA has conducted few planned PQV inspections. OSHA 

233 Prior to the March 23, 2005, explosion, the TRIR at BPTC was one-third the industry average, even though 

multiple fatalities had occurred in the year before the incident. 

234 BP Texas City Risk Management Plan, March 1, 2005. 

235 Within these industries, each regional office was to submit a list of five possible inspection targets within their 

region (from the over 2,800 U. S. facilities in these industries). Candidate facilities were to be selected based on 

several factors, including incident history, toxicity of chemicals onsite, and previous inspections. OSHA’s 

Directorate of Compliance would determine the inspection goals and select the facilities to receive PQV 

inspections each year. 
BP Texas City Final Investigation Report 3/20/2007 

203

 

inspection data236 reveals that federal OSHA conducted nine planned PQV inspections in targeted 

industries from 1995 to March 2005, while OSHA state plan jurisdictions conducted 48. Federal OSHA 

conducted no planned PQV inspections in oil refineries from 1995 to March 2005. All six planned PQV 

inspections in oil refineries were by state plan offices (Alaska, California, Nevada, Utah, and Wyoming.) 

 During the same period, federal OSHA conducted 77 unplanned PQV inspections237 and state plans 

conducted 29. Unplanned inspections are typically narrower in scope, shorter, and limited to possible 

regulatory violations raised from accidents, complaints, or referrals from another regulatory agency. 

OSHA’s compliance directive states that “it is anticipated that PQV inspections will be highly resourceintensive.” The directive describes a PQV inspection as “a large and complex undertaking” and states that 

a PQV inspection “is long-term, possibly several weeks or months.” However five of the nine planned 

federal OSHA PQV inspections conducted lasted less than one month. 

The National Transportation Safety Board (NTSB) found deficiencies in OSHA oversight of PSMcovered facilities. A 2001 railroad tank car unloading incident at the ATOFINA chemical plant in 

Riverview, Michigan, killed three workers and forced the evacuation of 2,000 residents. The 2002 NTSB 

investigation found that the number of inspectors that OSHA and the EPA have to oversee chemical 

facilities with catastrophic potential was limited compared to the large number of facilities (15,000). 

Michigan’s OSHA state plan, MIOSHA, had only two PSM inspectors for the entire state, but had 2,800 

facilities with catastrophic chemical risks. The NTSB reported that these inspections are necessarily 

complicated, resource-intensive, and rarely conducted by OSHA. NTSB concluded that OSHA did not 

provide effective oversight of such hazardous facilities. 

236 www.osha.gov/pls/imis. 

237 These inspections included the code “PQV” in the inspection report. 
BP Texas City Final Investigation Report 3/20/2007 

204

11.1.2.7 OSHA PQV Inspection Resources 

The OSHA PSM compliance directive includes training and experience requirements for inspectors who 

conduct PQV inspections. The directive states that “[A]ppropriate levels of staff training and preparation 

are essential for compliance activities relating to the PSM standard,” and that “[O]nly trained compliance 

safety and health officers (CSHOs) with experience in the chemical industry shall be assigned to lead a 

PQV inspection.” Specific training courses at the OSHA training institute are listed as minimum 

requirements for PQV inspectors. 

An official from OSHA’s Houston South office stated that the only fully trained and experienced OSHA 

PSM inspection team in the United States is in that office and includes three to four inspectors. He added 

that a limited number of other inspectors nationwide have the necessary qualifications to conduct PQV 

inspections. The CSB submitted a number of requests for documents and interviews from OSHA 

regarding the PQV program, including numbers, training, education, and experience of PSM inspectors, 

but the requested information or interviews have not been provided. 

11.1.3 Other Models for Process Safety Inspections 

A review of the process safety programs in state plan OSHA states found that only six conducted PQV 

inspections (see next section). In addition, Contra Costa County (2007) in California has its own 

Industrial Safety Ordinance requiring inspections of covered facilities with catastrophic chemical hazards. 

The process safety inspection programs of the U.K. Health and Safety Executive were also examined in 

this investigation. 

According to the CSB’s survey of state OSHA programs, Nevada and California each have process safety 

inspection programs. California inspects every refinery annually; Nevada inspects each PSM-covered 

facility annually, and conducts more comprehensive PQV-style inspections every five years. 
BP Texas City Final Investigation Report 3/20/2007 

205

11.1.3.1 

 

Contra Costa County requires of the accident prevention programs at 48 covered facilities238 an inspection 

every three years. Each year a staff of five engineers performs an average of 16 inspections. 

The U. K’s Control of Major Accident Hazards regulation (COMAH) requires facility operators to submit 

a safety report detailing their plan to prevent major accidents. Annually, 105 inspectors (typically 

engineers and scientists) visit high hazard facilities, and all COMAH-covered facilities are inspected 

every five years. For the nine refineries in the United Kingdom, detailed planned inspections (ranging 

from 80 to 150 days) are conducted annually for each refinery by a multidisciplinary team (regulatory 

inspectors, process safety, mechanical engineering, electrical and instrumentation, and human factors 

specialists). 

Contra Costa County and the U.K. Health and Safety Executive conduct frequent scheduled inspections of 

PSM and major hazard facilities with highly qualified staff. Federal OSHA infrequently conducts 

planned PQV inspections. The CSB concludes that OSHA lacks sufficiently trained and experienced 

inspectors to effectively inspect PSM facilities. 

PQV Inspections by Industry Segment and Region 

The PSM Compliance Directive states that OSHA plans to focus more PQV inspections in OSHA 

Regions with higher concentrations of high hazard industries affected by the standard. While Region 6 

(which includes Texas) contains more refineries (US Census Bureau, 2005) than any other region (51), 

OSHA conducted two planned PQV inspections in Region 6 (none in refining.) OSHA’s inspection data 

was also analyzed to determine any correlation between the number of facilities within an industry sector 

and the number of inspections. Table 6 shows that the number of facilities in a sector (the eight industry 

sectors identified as targets in the PSM compliance directive) was not reflected in the number of PQV 

inspections. 

238 Covered facilities are those classified as Tier 3 under EPA’s Risk Management Plan Rule. 
BP Texas City Final Investigation Report 3/20/2007 

206

Table 6. PQV inspection239 and facility numbers from 1995 to March 2005 

State PQV Inspections Federal PQV Inspections Federal PSM Local Emphasis 

Program Inspections 

Industry Sector Number of 

Facilities 

[U.S. Census 

Bureau, 2005] 

Planned Unplanned Planned Unplanned Planned Unplanned 

Alkalies and Chlorine (2812) 41 12 3 0 2 0 0 

Industrial Inorganic 

Chemicals, Not Elsewhere 

Classified (2819) 

631 18 7 1 14 0 0 

Plastics Materials, Synthetic 

Resins, and Nonvulcanizable 

Elastomers (2821) 

846 4 2 0 7 0 2 

Cyclic Organic Crudes and 

Intermediates, and Organic 

Dyes and Pigments (2865) 

179 0 0 0 4 1 4 

Industrial organic chemicals, 

not elsewhere classified 

(2869) 

685 3 1 4 19 2 1 

Nitrogenous fertilizers (2873) 144 4 4 3 2 0 0 

Explosives (2892) 87 1 1 1 8 0 1 

Petroleum Refining (2911) 203240 6 11 0 21 1 0 

Totals 2816 48 29 9 77 4 8 

11.1.4 Summary and Discussion 

OSHA’s compliance directive for the PSM standard states that the main vehicle for enforcement is 

planned PQV inspections. However, PQV inspections are infrequent and an insufficient number of 

inspectors are qualified to conduct them. 

 

239 OSHA Integrated Management Information System (IMIS), inspections within industry, 

http://www.osha.gov/pls/imis/industry.html. 

240 The U.S. Energy Information Administration under its definition of an oil refinery states there are 144 refineries 

in the US. 
BP Texas City Final Investigation Report 3/20/2007 

207

Over time OSHA has adjusted enforcement priorities to reflect new workplace data and enforcement 

initiatives. For example, during the 1990s OSHA began collecting site specific injury data, which allowed 

improved targeting of planned inspections, and likely had the effect of putting greater emphasis on injury 

rates in overall inspection priorities. The incident at Texas City and its connection to serious process 

safety deficiencies at the refinery emphasize the need for OSHA to refocus resources on preventing 

catastrophic accidents through greater PSM enforcement. 

The EPA estimates that 15,000 facilities are covered by RMP regulations similar in coverage to the PSM 

standard (Stephenson, 2004). OSHA’s targeting of facilities for general safety and health inspections 

based on traditional safety measurements is ineffective in preventing catastrophic accidents. OSHA did 

not effectively inspect BP Texas City, despite its history of fatal accidents and releases. Additional factors 

for identifying facilities at risk for a catastrophic accident should include process safety performance 

indicators such as the resolution rate of PSM action items. 

Strengthened enforcement of the PSM standard by OSHA through comprehensive, planned PQV 

inspections is needed to help prevent catastrophic accidents. Additional resources and inspector training 

are also needed. Finally, PQV inspection targeting must be based on effective metrics that help OSHA 

identify which facilities are at highest risk for a catastrophic incident. BP Texas City was a facility with 

very high risk for a catastrophe, but OSHA did not target the refinery for comprehensive planned 

inspections. 

11.2 EPA’s Risk Management Plan (RMP) Rule 

The Clean Air Act of 1990 required that the EPA issue an accident prevention regulation to protect the 

public and the environment from catastrophic chemical releases from stationary sources, in addition to the 
BP Texas City Final Investigation Report 3/20/2007 

208

 

OSHA PSM Rule. The EPA’s RMP241 rule became effective in August 1996. In a separate regulation 

issued in 1997, the EPA published the list of chemicals covered by the RMP rule along with the threshold 

quantities (TQ) that determine if a process is covered. 

The BP Texas City facility included many Program 3242 processes covered by the RMP rule. The ISOM 

unit contained 1.5 million pounds of a mixture of flammables listed by the RMP rule (including pentane, 

propane, and butane), well above the 10,000-pound TQ for flammables. 

11.2.1 Comparison to PSM 

The RMP rule requires covered facilities to submit a risk management plan to the EPA. The rule provides 

less stringent requirements for smaller facilities or those with less likelihood of offsite injury or 

environmental damage from a release (“Program 1” and “Program 2” facilities). Refineries like BP Texas 

City (“Program 3” facilities) must fully comply with the rule’s most stringent provisions. The accident 

prevention requirements for Program 3 facilities are similar to those of the OSHA PSM rule. 

The RMP rule requires covered facilities to submit emergency contact information, descriptions of 

processes and hazardous chemicals onsite, accident history, and worst-case release scenarios. Facilities 

must update their risk management plan every five years or whenever a major accident occurs or the 

emergency contact information changes. BP submitted the first risk management plan when required in 

1999, and has updated it at least three times. 

24140 CFR Chapter 1, Sub-chapter C, Part 68. 

http://www.access.gpo.gov/nara/cfr/cfrhtml_00/Title_40/40cfr68_00.html 

242 The EPA’s RMP rule defines Program levels based upon process units’ potential for impact to the public and the 

requirements to prevent accidents. Level 3 processes would affect the public in a worst case release and are 

subject to additional requirements to prevent accidents. 
BP Texas City Final Investigation Report 3/20/2007 

209

11.2.2 RMP Rule Enforcement 

To date, the EPA enforcement of the RMP rule has focused primarily a review of the submitted RMPs 

and required updates by the covered facilities. In 1999, EPA established an audit program to help ensure 

compliance with the RMP. The audits were intended to provide an independent verification of the 

information in the RMP and include on-site inspections. EPA records show that the BP Texas City facility 

had not received a planned RMP rule audit prior to the ISOM incident. The CSB requested documents 

from the EPA about the RMP enforcement program and received a partial response: the EPA’s response 

did not provide requested items such as the total number of RMP audits conducted, the audit selection 

process description, audit reports, and the number of RMP inspectors. 
BP Texas City Final Investigation Report 3/20/2007 

210

12.0 ROOT AND CONTRIBUTING CAUSES 

12.1 Root Causes 

BP Group Board did not provide effective oversight of the company’s safety culture and major accident 

prevention programs. 

Senior executives: 

• inadequately addressed controlling major hazard risk. Personal safety was measured, rewarded, 

and the primary focus, but the same emphasis was not put on improving process safety 

performance; 

• did not provide effective safety culture leadership and oversight to prevent catastrophic 

accidents; 

• ineffectively ensured that the safety implications of major organizational, personnel, and policy 

changes were evaluated; 

• did not provide adequate resources to prevent major accidents; budget cuts impaired process 

safety performance at the Texas City refinery. 

BP Texas City Managers did not: 

• create an effective reporting and learning culture; reporting bad news was not encouraged. 

Incidents were often ineffectively investigated and appropriate corrective actions not taken. 

• ensure that supervisors and management modeled and enforced use of up-to-date plant policies 

and procedures. 
BP Texas City Final Investigation Report 3/20/2007 

211

• incorporate good practice design in the operation of the ISOM unit. Examples of these failures 

include: 

– no flare to safely combust flammables entering the blowdown system; 

– lack of automated controls in the splitter tower triggered by high-level, which would 

have prevented the unsafe level; and 

– inadequate instrumentation to warn of overfilling in the splitter tower. 

• ensure that operators were supervised and supported by experienced, technically trained 

personnel during unit startup, an especially hazardous phase of operation; or that 

• effectively incorporated human factor considerations in its training, staffing, and work schedule 

for operations personnel. 

12.2 Contributing Causes 

BP Texas City managers: 

• lacked an effective mechanical integrity program to maintain instruments and process equipment. 

For example, malfunctioning instruments and equipment were not repaired prior to startup. 

• did not have an effective vehicle traffic policy to control vehicle traffic into hazardous process 

areas or to establish safe distances from process unit boundaries. 

• ineffectively implemented their PSSR policy; nonessential personnel were not removed from 

areas in and around process units during the hazardous unit startup. 

• lacked a policy for siting trailers that was sufficiently protective of trailer occupants. 
BP Texas City Final Investigation Report 3/20/2007 

212

 

13.0 RECOMMENDATIONS243 

American Petroleum Institute (API) and United Steelworkers 

International Union (USW) 

Work together to develop two new consensus American National Standards Institute (ANSI) standards. 

2005-4-I-TX-R6 In the first standard, create performance indicators for process safety in the refinery 

and petrochemical industries. Ensure that the standard identifies leading and lagging 

indicators for nationwide public reporting as well as indicators for use at individual 

facilities. Include methods for the development and use of the performance 

indicators. 

2005-4-I-TX-R7 In the second standard, develop fatigue prevention guidelines for the refining and 

petrochemical industries that, at a minimum, limit hours and days of work and 

address shift work. 

In the development of each standard, ensure that the committees 

a. are accredited and conform to ANSI principles of openness, balance, due process, and 

consensus; 

b. include representation of diverse sectors such as industry, labor, government, public interest 

and environmental organizations and experts from relevant scientific organizations and 

disciplines. 

243 See Appendix C for previously issued recommendations. 
BP Texas City Final Investigation Report 3/20/2007 

213

Occupational Safety and Health Administration (OSHA) 

2005-4-I-TX-R8 Strengthen the planned comprehensive enforcement of the OSHA Process Safety 

Management (PSM) standard. At a minimum: 

a. Identify those facilities at greatest risk of a catastrophic accident by using available indicators 

of process safety performance and information gathered by the EPA under its Risk 

Management Program (RMP). 

b. Conduct, or cause to be conducted, comprehensive inspections, such as those under your 

Program Quality Verification (PQV) program at facilities identified as presenting the greatest 

risk. 

c. Establish the capacity to conduct more comprehensive PSM inspections by hiring or 

developing a sufficient cadre of highly trained and experienced inspectors. 

d. Expand the PSM training offered to inspectors at the OSHA National Training Institute. 

2005-4-I-TX-R9 Amend the OSHA PSM standard to require that a management of change (MOC) 

review be conducted for organizational changes that may impact process safety 

including 

a. major organizational changes such as mergers, acquisitions, or reorganizations; 

b. personnel changes, including changes in staffing levels or staff experience; and 

c. policy changes such as budget cutting. 
BP Texas City Final Investigation Report 3/20/2007 

214

Center for Chemical Process Safety (CCPS) 

2005-4-I-TX-R10 Issue management of change guidelines that address the safe control of the following: 

a. major organizational changes including mergers, acquisitions, and reorganizations 

b. changes in policies and budgets 

c. personnel changes 

d. staffing during process startups, shutdowns and other abnormal conditions. 

BP Board of Directors 

2005-4-I-TX-R11 Appoint an additional non-executive member of the Board of Directors with specific 

professional expertise and experience in refinery operations and process safety. 

Appoint this person to be a member of the Board Ethics and Environmental 

Assurance Committee. 

2005-4-I-TX-R12 Ensure and monitor that senior executives implement an incident reporting program 

throughout your refinery organization that 

a. encourages the reporting of incidents without fear of retaliation; 

b. requires prompt corrective actions based on incident reports and recommendations, and tracks 

closure of action items at the refinery where the incident occurred and other affected 

facilities; and 

c. requires communication of key lessons learned to management and hourly employees as well 

as to the industry. 
BP Texas City Final Investigation Report 3/20/2007 

215

2005-4-I-TX-R13 Ensure and monitor that senior executives use leading and lagging process safety 

indicators to measure and strengthen safety performance in your refineries. 

BP Texas City Refinery 

2005-4-I-TX-R14 Evaluate your refinery process units to ensure that critical process equipment is 

safely designed. At a minimum, 

a. Ensure that distillation towers have effective instrumentation and control systems to prevent 

overfilling such as multiple level indicators and appropriate automatic controls. 

b. Configure control board displays to clearly indicate material balance for distillation towers. 

2005-4-I-TX-R15 Ensure that instrumentation and process equipment necessary for safe operation is 

properly maintained and tested. At a minimum, 

a. Establish an equipment database that captures the history of testing, inspections, repair, and 

successful work order completion. 

b. Analyze repair trends and adjust maintenance and testing intervals to prevent breakdowns. 

c. Require repair of malfunctioning process equipment prior to unit startups. 

2005-4-I-TX-R16 Work with the United Steelworkers Union and Local 13-1 to establish a joint 

program that promotes the reporting, investigation, and analysis of incidents, nearmisses, process upsets, and major plant hazards without fear of retaliation. Ensure 

that the program tracks recommendations to completion and shares lessons learned 

with the workforce. 

2005-4-I-TX-R17 Improve the operator training program. At a minimum, require 
BP Texas City Final Investigation Report 3/20/2007 

216

a. face-to-face training conducted by personnel with process-specific knowledge and experience 

who can assess trainee competency, and 

b. training on recognizing and handling abnormal situations including the use of simulators or 

similar training tools. 

2005-4-I-TX-R18 Require additional board operator staffing during the startup of process units. Ensure 

that hazard reviews address staffing levels during abnormal conditions such as 

startups, shutdowns, and unit upsets. 

2005-4-I-TX-R19 Require knowledgeable supervisors or technically trained personnel to be present 

during especially hazardous operation phases such as unit startup. 

2005-4-I-TX-R20 Ensure that process startup procedures are updated to reflect actual process 

conditions. 

United Steelworkers International Union and Local 13-1 

2005-4-I-TX-R21 Work with BP to establish a joint program that promotes reporting, investigating, and 

analyzing incidents, near-misses, process upsets, and major plant hazards without 

fear of retaliation. Ensure that the program tracks recommendations to completion 

and shares lessons learned with the workforce. 
BP Texas City Final Investigation Report 3/20/2007 

217

By the 

U.S. Chemical Safety and Hazard Investigation Board 

Carolyn W. Merritt 

 Chair 

 John S. Bresland 

 Member 

 Gary L. Visscher 

 Member 

 William B. Wark 

 Member 

 William E. Wright 

 Member 

Date of Board Approval 
BP Texas City Final Investigation Report 3/20/2007 

218

Appendix A: Texas City Timeline 1950s – March 23, 2005 

Date Event 

 

1950s The ISOM blowdown system is installed in the southwest corner of the ISOM unit 

1957 The blowdown system is moved approximately 200 ft to the northwest corner of the ISOM unit battery limits 

1976 The HUF fractionator is installed into what is now the ISOM unit 

1985 The HUF fractionator is converted into the raffinate splitter tower 

1986 The raffinate splitter tower's capacity is increased 

1987 The capacity of the splitter tower is increased again 

1991 

The Amoco Refining Planning Department (ARPD) proposes a strategy to eliminate blowdown stacks that vent to the 

atmosphere 

1992 

ARPD does not include separate funding for flare/blowdown work in the 10-year capital plan because state and federal 

regulations are unlikely to require that relief valves be routed to closed systems in the foreseeable future 

1992 

OSHA cites a similar blowdown drum and stack as unsafe at the Texas City refinery and recommends it be 

reconfigured to a closed system with a flare 

1993 

The Amoco Regulatory Cluster Project plans to eliminate all blowdown stacks and replace them with knockout drums; 

however, due to the project cost of $400 million, the project is not implemented 

1993 

A PHA HAZOP is conducted on the ISOM unit; consequences of high level and high pressure in the splitter tower are 

not addressed, and the sizing of the blowdown drum for containment of liquid release is not considered 

1994 

An Amoco staffing review concludes that the company will reap substantial cost savings if staffing is reduced at the 

Texas City and Whiting sites to match Solomon performance indices 

12-Feb-94 

The 115-ft DIH distillation tower in the ISOM unit is overfilled and results in a hydrocarbon vapor cloud release out of 

the relief valves that open to the blowdown drum and stack 

17-Feb-94 Leaking DIH relief valves result in a vapor release out of the ISOM blowdown stack; part of the unit is shut down 

27-Feb-94 

The ISOM stabilizer tower emergency relief valves open five or six times over four hours, releasing a large vapor cloud 

near ground level; it is misreported in the event log as a much smaller incident and no safety investigation is conducted 

Mar-94 

A BP engineer reviews a contractor study of the headers that discharge into the blowdown drum and concludes that all 

relief headers are properly sized; unfortunately, the raffinate splitter tower header is not included in the contractor study 

Mar-94 

OSHA and Amoco agree to a settlement regarding the 1992 citation; the blowdown drum, like the ISOM blowdown 

drum, remains open to atmosphere 

24-Jul-94 

The Texaco Milford Haven refinery in the U.K. experiences a plant upset when a distillation tower is overfilled and 

releases hydrocarbons into the atmosphere 

1995 

At an IChemE conference, BP presents its findings from a study conducted at its Grangemouth refinery that examined 

shift turnover communication and resulted in several improvements in how its operations personnel communicated at 

the refinery 

8-May-95 

The 8-inch chain vent valve of the raffinate splitter tower overhead piping is inadvertently left open for over 20 hours 

during a raffinate section startup, resulting in a significant vapor cloud release out of the blowdown stack 

1996 

A staffing assessment of the Texas City refinery process units reveals that personnel are concerned that staffing is too 

minimal to handle unit upsets 

1997 

The approximately 40-year-old ISOM blowdown drum and stack are completely replaced with similar but not identicallysized equipment, yet a flare is not connected to it 

1997 BP Group’s Getting Health, Safety and the Environment Right (GHSER) policy is established 

1997 Behavioral safety programs begin to go into effect at the Texas City site 

1998 BP’s Learning & Development department has a budget of $2.8 million and a central staff of 28 trainers 

1998 

The ISOM unit’s HAZOP revalidation does not address previous incidents with catastrophic potential, as required by 

the PSM standard 
BP Texas City Final Investigation Report 3/20/2007 

219

Date Event 

 

4-Oct-98 

The ISOM blowdown stack catches fire during stormy weather, resulting in a unit upset; management does not 

investigate 

31-Dec-98 BP merges with Amoco 

1999 Texas City refinery is a separate business unit run by a director 

1999 BP Group Management directs Texas City to cut costs 25% 

16-Jan-99 

During an ISOM unit shutdown, hydrocarbon liquid flows from the blowdown into the sewer system and hydrocarbons 

vapors release out of the sewer boxes, producing a significant vapor cloud 

16-Feb-00 The Day Board Operator receives refresher training on the ISOM unit via a computerized training course 

2000 A series of incidents occur at BP’s Grangemouth refinery in Scotland 

23-Jul-00 

The ISOM blowdown stack catches fire, fueled by leaking pressure relief valves on the hydrogen driers; the fire 

continues over five 12-hour shifts before it is extinguished; no investigation is conducted 

Oct-00 

BP’s in-house magazine publishes a document written by the Group Chief Executive who asserts that BP will learn the 

lessons from Grangemouth and other incidents 

2000 

BP’s Learning & Development department presses Texas City management for simulators to aid in training unit 

operators, but are unsuccessful in obtaining such technologies 

2001 

The Texas City refinery joins four other facilities to become part of the BP South Houston complex, run by one site 

director who oversees each facility’s Business Unit Leader 

2001 

The presentation, “Texas City Refinery Safety Challenge,” is given to BP management; it predicts an employee death in 

the next 3-4 years 

2001 

The PSM audit finds a substantial number of PHA action items still open well past their stated due dates, and a number 

of unit operating procedures that are not current 

May-01 

BP Group issues a “Process Safety/Integrity Management” standard, which outlines the minimum requirements to 

prevent catastrophic incidents 

2002 BP engineers propose connecting the ISOM blowdown system to a flare, but a less expensive option is chosen 

2002 

The Texas City Refinery Retrospective Analysis determines that capital spending has been reduced 84% from 1992 to 

2000, and that many budget cuts do not consider the specific maintenance needs of the refinery 

2002 

A BP Group report on the Group Fatal Accident Investigation process finds that root causes are not being identified and 

corrective actions are not always practical or clear 

summer 

2002 

The refinery HSE department initiates the Clean Streams project with the goal of identifying and eliminating liquid 

streams routed to blowdown stacks; the ISOM unit is scheduled to be one of the first to undergo such changes 

Aug-02 

The “Veba” study concludes that Texas City has serious deficiencies with mechanical integrity, inspections, and 

instrumentation, as well as a high likelihood for a major incident 

Apr-03 

As the Clean Streams project budget increases from $6 to $89 million, its scope is altered and work plans for the ISOM 

unit are cancelled 

2003 

The “Getting Maintenance and Reliability Right Gap Assessment” reveals that maintenance and mechanical integrity 

problems persist at the Texas City refinery 

2003 

An internal inspection of the blowdown drum reveals that most vessel shed trays have collapsed in the bottom of the 

drum. The remaining trays that are still attached are considered dangerous to personnel, so the internal inspection is 

terminated and the drum is closed without recommending that the drum be taken out of service or repaired 

2003 The second ISOM unit HAZOP revalidation again does not address previous incidents with catastrophic potential 

2003 

A process safety analysis action item requires a review of the ISOM unit’s relief valves; the target completion date is 

March 31, 2005, seven days after the explosion; the study is never completed 

2003 

A major modification of the blowdown drum occurred in 2003 when the quench capabilities of the drum fail due to 

corrosion and remained in disrepair until the time of the incident 
BP Texas City Final Investigation Report 3/20/2007 

220

Date Event 

 

Aug-03 

The Texas City Refinery Repositioning Project is initiated at the request of BP Group Refining management because 

the refinery has not made a profit contribution proportionate to its capital consumption 

Sep-03 

The 2003 GHSER audit determines that the Texas City refinery infrastructure and assets are in poor condition, and that 

both training and incident investigation activities are insufficient 

2003 The South Houston Infrastructure for Tomorrow (SHIFT) program is implemented 

2003 

The 1,000 Day Goals program is developed to measure site-specific performance; it focuses on personal safety and 

cost-cutting, rather than on process safety 

2003 

The refinery-wide Operator Competency Assurance Model audit finds that no individual operator development plans 

are being developed for AU2/ISOM/NDU unit operators 

2004 BP's Learning & Development department has a budget of $1.4 million and a central staff of 8 trainers 

2004 

The Texas City business unit leader/plant manager gives a presentation entitled "Safety Reality" to 100 supervisory 

personnel regarding the 23 deaths in the plant in the previous 30 years 

2004 A new behavior initiative is put in place, resulting in behavior safety training for nearly all BP Texas City employees 

2004 

The PSM audit notes that many relief valves are missing engineering documentation, safeguards are not clearly 

defined, no official process for communicating lessons learned from previous incidents is in place, and unit managers 

and operators lack training 

Mar-04 

After an inspection of the raffinate unit reveals significant corrosion under the insulation on the exterior of the splitter, its 

relief pressure is lowered to 40 psig (276 kPa) and the safety relief valves are lowered to 40, 41, and 42 psig; (276, 

283, and 290 kPa) however, the startup procedures do not incorporate this pressure change 

Mar-04 A furnace outlet pipe ruptures in the UU4 unit, resulting in a fire that causes $30 million in damages 

Mar-04 

The BP Internal Audit Group in London releases its report on GHSER audit findings of all its business units; noncompliance of HSE rules, poor implementation of HSE management systems, lack of learning from previous incidents, 

and lack of leadership and monitoring are common deficiencies among the different sites 

Mar-04 

The DIH tower pressure relief valves again lift after a short loss of electric power to the ISOM unit, resulting in a 

significant vapor cloud at or near ground level 

Apr-04 

BP South Houston is dissolved and the Texas City refinery is once again a separate business unit run by a business 

unit leader who reports directly to the Regional Group VP of Refining 

Apr-04 

The Day Board Operator is certified that he has the necessary knowledge to conduct unit startup when a process 

technician (PT) tests him verbally on the process 

Jun-04 

The GHSER assessment grades Texas City as "poor" because accident investigations are not thoroughly analyzed for 

trends and preventative programs are not being developed 

May-04 

The Texas City site “Control of Work Review” reveals deficiencies in compliance with the Golden Rules of Safety 

(personal safety issues) 

Spring 2004 

In response to the findings of the “Control of Work Review,” Texas City implements the “Compliance Delivery Process” 

and “Just Culture” programs that enforce adherence of site rules, promote individual accountability, and punish rule 

violations 

Jul-04 

The BP Group Chief Executive for Refining and Marketing visits Texas City to review progress toward the 1,000 Day 

Goals; the site reports a "best ever" recordable injury frequency rate, but that the refinery needs to reduce its 

maintenance spending to improve profitability 

Aug-04 

The Texas City Process Safety Manager gives a presentation to plant managers that identifies serious problems with 

process safety performance 

Aug-04 

Pressure relief valves open in the Ultracracker unit, discharging liquid hydrocarbons to the ULC blowdown drum and 

out of the stack 

Sep-04 

Two employees are killed and another seriously injured when burned with hot water and steam during the opening of a 

pipe flange in the UU3 unit 

Sep-04 

The Texas City Process Safety Manager tells the site director that Texas City received poor scores on PSM-related 

metrics, such as action item completion, and that incident investigations are not identifying the underlying root causes 
BP Texas City Final Investigation Report 3/20/2007 

221

Date Event 

 

Sep-04 

BP sites the double-wide trailer between the NDU and ISOM units to house contractor employees for turnaround work 

in the nearby Ultracracker unit 

Oct-04 

The Texas City site leader meets with the R&M Chief Executive and Senior Executive Team to discuss the 2004 

incidents; management discusses how these incidents are the result of casual compliance and personal risk tolerance 

despite two of the three incidents being directly process-safety related 

2004 

The 2004 PSM audit reveals poor PSM performance of the Texas City refinery, especially in mechanical integrity, 

training, process safety information, and management of change (MOC) 

Nov-04 

Plant leadership meets with all site supervisors for a "Safety Reality" presentation that declares that Texas City is not a 

safe place to work 

late 2004 

BP Group refining leadership gives the Texas City refinery business unit leader a 25% budget cut "challenge" for 2005; 

the business unit leader asks for more funds due to the conditions of the refinery, but less than half of the 25% cuts are 

restored 

late 2004 The Telos survey is conducted to assess safety culture at the refinery and finds serious safety issues 

2004 

The refinery-wide OCAM audit finds that only 25% of ISOM unit operators are given performance appraisals annually, 

and that no individual operator development plans are being developed for unit operators; the audit also finds that the 

budget allows for no training beyond initial new employee and OSHA-required refresher information 

Jan-Feb-05 Nine additional trailers are placed in the area between the NDU and ISOM units 

Jan-05 

The Telos Report is issued with recommendations to improve the significantly deficient organizational and cultural 

conditions of the Texas City refinery 

Feb-05 

The BP Group VP and the North American VP for Refining meet with refinery managers in Houston, where they are 

presented with information on the Telos report findings, the deteriorating conditions of the refinery, budget cuts, 

inadequate training, pressures of production overshadowing safety, and the 2004 fatality incidents 

2005 

The 2005 Texas City HSSE Business Plan warns management that that refinery will likely "kill someone in the next 12-

18 months." 

Mar-05 

The Texas City Process Safety Manager tells management that PSM action item closure is still a significant concern 

and this metric is finally added to the site's 1,000 Day Goals 

23-Mar-05 Explosion and fire at the Texas City refinery results in 15 fatalities and 180+ injuries 

Apr-05 

Due to 23 deaths at the Texas City refinery in 30 years, OSHA puts BP onto its list of "Enhanced Enforcement Program 

for Employers Who are Indifferent to Their Obligations" 

Jul-05 An incident in the RHU results in a shelter-in-place of the community and $30 million in damage at the refinery 

Aug-05 A release in the CFHU results in a shelter-in-place and $2 million in damage at the refinery 

Sep-05 OSHA fines BP $21 million for 301 egregious willful violations 

13-Dec-05 During unit startup, a distillation tower at the BP Whiting refinery in Indiana is overfilled, resulting in fire and damage. 
BP Texas City Final Investigation Report 

Appendix B: Logic Tree 

222
BP Texas City Final Investigation Report 
BP Texas City Final Investigation Report 

224
BP Texas City Final Investigation Report 
BP Texas City Final Investigation Report 

226
BP Texas City Final Investigation Report 
BP Texas City Final Investigation Report 

228
BP Texas City Final Investigation Report 
BP Texas City Final Investigation Report 

230
BP Texas City Final Investigation Report 
BP Texas City Final Investigation Report 

232
BP Texas City Final Investigation Report 
BP Texas City Final Investigation Report 

234
y Final Investigation Report 

BP Texas Cit
BP Texas City Final Investigation Report 3/20/2007 

236

APPENDIX C: Previously Issued Recommendations

C.1 Safety Culture Recommendation 

Whereas: 

1. On March 23, 2005, the BP Texas City refinery experienced a severe chemical accident involving 

a raffinate splitter tower and associated blowdown system that resulted in 15 deaths, about 180 

injuries, and significant economic losses, and was one of the most serious U.S. workplace 

disasters of the past two decades; 

2. Key alarms and a level transmitter failed to operate properly and to warn operators of unsafe and 

abnormal conditions within the tower and the blowdown drum; 

3. The startup of the raffinate splitter was authorized on March 23 despite known problems with the 

tower level transmitter and the high-level alarms on both the tower and the blowdown drum; for 

example, a work order dated March 10 and signed by management officials, acknowledged that 

the level transmitter needed repairs but indicated that these repairs would be deferred until after 

startup; 

4. The majority of 17 startups of the raffinate splitter tower from April 2000 to March 2005 

exhibited abnormally high internal pressures and liquid levels – including several occasions 

where pressure-relief valves likely opened – but the abnormal startups were not investigated as 

near-misses and the adequacy of the tower’s design, instrumentation, and process controls were 

not re-evaluated; 

5. Written startup procedures for the raffinate splitter were incomplete and directed operators to use 

the so-called “3-lb.” vent system to control tower pressure, even though the pressure-control 
BP Texas City Final Investigation Report 3/20/2007 

237

 

valve did not function in pre-startup equipment checks and also failed to operate effectively 

during post-accident testing; 

6. The Texas City refinery missed opportunities before and after its acquisition by BP North 

America to connect the tower pressure-relief valves to a safety flare system, as noted in BP’s own 

May 2005 interim investigation report;244

7. Most of the fatalities and many of the serious injuries occurred in or around trailers that were 

susceptible to blast damage and were located within 150 feet (46 m) of the blowdown drum and 

vent stack; 

8. The Texas City refinery had a facility siting policy and performed a management-of-change 

analysis prior to positioning the trailers, but trailers were nonetheless placed in close proximity to 

the isomerization unit, which had experienced various hydrocarbon releases, fires, and other 

process safety incidents over the previous two decades; 

9. The Texas City refinery experienced two fatal safety incidents in 2004 as well as a serious 

furnace fire that resulted in a community order to shelter; 

10. Subsequent to the March 23 incident, the Texas City refinery experienced a major process-related 

hydrogen fire on July 28, 2005, that had the potential to cause additional deaths and injuries and 

resulted in a Level 3 community alert;245

244 The BP interim report states: “Blowdown stacks have been recognized as potentially hazardous for this type of 

service, and the industry has moved more towards closed relief systems to flare .... Opportunities to tie the 

Splitter relief lines into a flare system were not taken when it could have been efficiently done in 1995 or 2002 

....” 

245 Level 3 is the second highest emergency classification under Texas City procedures. It applies when “an incident 

has occurred, the situation is not under control, and protective action may be necessary for the surrounding or 

offsite area.” 
BP Texas City Final Investigation Report 3/20/2007 

238

11. On August 10, 2005, the Texas City refinery experienced another Level 3 incident involving the 

Gas Oil Hydrotreater that resulted in a community order to shelter; 

12. All three incidents in 2005 raise the issue of the adequacy of mechanical integrity programs at the 

Texas City refinery; 

13. In April 2005 the U.S. Occupational Safety and Health Administration listed the BP Texas City 

refinery as a subject facility under its Enhanced Enforcement Program for Employers Who Are 

Indifferent to Their Obligations Under the OSH Act; 

14. The U.K. Health and Safety Executive (HSE) investigated and reported on three incidents at the 

BP Grangemouth refinery in Scotland in 2000, concluding that “BP Group Policies set high 

expectations but these were not consistently achieved because of organisational and cultural 

reasons; BP Group and Complex Management did not detect and intervene early enough on 

deteriorating performance ....” 

15. The Board believes that the foregoing circumstances and preliminary findings raise serious 

concerns about (a) the effectiveness of the safety management system at the BP Texas City 

refinery; (b) the effectiveness of BP North America’s corporate safety oversight of its refining 

facilities; (c) a corporate safety culture that may have tolerated serious and longstanding 

deviations from good safety practice; 

16. The Board believes that corporations using large quantities of highly hazardous substances must 

exercise rigorous process safety management and oversight and should instill and maintain a 

safety culture that prevents catastrophic accidents; 

17. Under 42 U.S.C. §7412(r)(6)(C)(ii), the Board is charged with “recommending measures to 

reduce the likelihood or the consequences of accidental releases and proposing corrective steps to 
BP Texas City Final Investigation Report 3/20/2007 

239

 

make chemical production, processing, handling and storage as safe and free from risk of injury 

as is possible ....” 

18. Board procedures authorize the development and issuance of an urgent safety recommendation 

before a final investigation report is completed if an issue is considered to be an imminent hazard 

and has the potential to cause serious harm unless it is rectified in a short timeframe. 

Accordingly: 

P ursuant to its authority under 42 U.S.C. § 7412(r)(6)(C)(i) and (ii), and in the interest of preventing the 

serious harm that could result if the imminent hazards underlying the series of incidents at BP facilities 

are not promptly rectified, the Board makes the following urgent safety recommendation to the BP Group 

Executive Board of Directors 

2005-4-I-TX-R1

1. Commission an independent panel to assess and report on the effectiveness of BP North 

America’s corporate oversight of safety management systems at its refineries and its corporate 

safety culture. 246 Provide the panel with necessary funding, resources, and authority – including 

full access to relevant data, corporate records, and employee interviews – in order to conduct a 

thorough, independent, and credible inquiry. 

2. Ensure that, at a minimum, the panel report examines and recommends any needed improvements 

to: 

246 Appropriate reference materials for the design of the assessment may include the Final Report of the Columbia 

Accident Investigation Board (2003), the Conference Board research report “Driving Toward ‘0’: Best Practices 

in Corporate Safety and Health, the ANSI/AIHA Z10-2005 standard Occupational Health and Safety 

Management Systems, the International Labor Organization (ILO) code of practice Prevention of Major Industrial 

Accidents (1991), and the ILO Guidelines on Occupational Safety and Health Management Systems (2001). 
BP Texas City Final Investigation Report 3/20/2007 

240

a. Corporate safety oversight, including the safe management of refineries obtained through 

mergers and acquisitions; 

b. Corporate safety culture, including the degree to which: 

i. Corporate officials exercise appropriate leadership to promote adherence to 

safety management systems; 

ii. Process safety is effectively incorporated into management decision-making at 

all levels; 

iii. Employees at all levels are empowered to promote improved process safety; 

iv. Process safety programs receive adequate resources and are appropriately 

positioned within organizational structures; 

c. Corporate and site safety management systems, specifically: 

i. Near-miss reporting and investigation programs; 

ii. Mechanical integrity programs; 

iii. Hazard analysis programs, management-of-change programs, and up-to-date 

operating procedures for processes with catastrophic potential; 

iv. Siting policies for occupied structures near hazardous operating units. 

3. Ensure that the panel has a diverse makeup, including an external chairperson; employee 

representatives; and outside safety experts, such as experts in process safety; experts in corporate 

culture, organizational behavior, and human factors; and experts from other high-risk sectors such 

as aviation, space exploration, nuclear energy, and the undersea navy. 

4. Ensure that the report and recommendations of the independent panel, which should be completed 
BP Texas City Final Investigation Report 3/20/2007 

241

within 12 months, are made available to the BP workforce and to the public. 

C.2 Trailer Siting Recommendation 

Whereas: 

1. On March 23, 2005, the BP Texas City refinery experienced a severe explosion and fire accident 

involving a raffinate splitter tower within the isomerization (ISOM) unit and associated 

blowdown system that resulted in 15 deaths, 180 injuries, and significant economic losses; the 

accident was one of the most serious U.S. workplace disasters of the past two decades. 

2. All of the fatalities and many of the serious injuries occurred in or around the nine contractor 

trailers that were sited near process areas and as close as 121 feet (37 m) from the ISOM unit. 

This unit contained large quantities of flammable hydrocarbons and had a history of releases, 

fires, and other safety incidents over the previous two decades. 

3. Workers in adjacent units were injured in trailers as far as 480 feet (146 m) from the ISOM 

blowdown drum. A number of trailers as far as 600 feet (103 m) from the blowdown drum were 

heavily damaged. 

4. At the Texas City refinery, trailers had been periodically sited in and around hazardous process 

areas for reasons of convenience such as ready access to work areas. The trailers did not need to 

be located as close as they were to the process areas in order for workers to perform their job 

duties. 

5. Trailers had been sited periodically in the same location near the isomerization unit for a number 

of years. On September 1, 2004, and prior to a safety assessment, BP placed the trailer where 12 

workers died near the isomerization unit; a month later BP applied a siting policy to approve the 

location. The eight other trailers placed nearby were not analyzed for hazards related to their 
BP Texas City Final Investigation Report 3/20/2007 

242

location, nor was the impact of the total occupancy of multiple trailers in close proximity 

considered. 

6. Under BP’s siting policy, trailers used for short periods of time such as turnaround trailers were 

considered as posing little or no danger to occupants. This approach conforms to the guidance 

provided in American Petroleum Institute (API) Recommended Practice 752, “Management of 

Hazards Associated with Location of Process Plant Buildings.” API 752 states that each company 

may define its own risk and occupancy criteria. 

7. API 752 is a widely recognized practice for complying with facility siting requirements under the 

Process Hazard Analysis element of OSHA’s Process Safety Management Standard (29 CFR 

1910.119). 

8. API 752 provides no minimum safe distances from hazardous areas for trailers used in refineries 

and other chemical facilities. Trailers are not generally designed to protect the occupants from the 

fire and explosion hazards present in refineries. In contrast, occupied buildings (e.g. control 

rooms, operator shelters) located within a process unit are typically permanent and constructed to 

be blast and fire resistant. 

9. Trailers can be easily relocated to less hazardous sites. Subsequent to the March 23rd incident, 

BP America Inc. announced that it would move trailers at least 500 feet (152) from hazardous 

process areas. A number of contractor offices were moved to an offsite location. 

10. In 1995, another serious process plant incident involved occupied trailers placed too close to 

hazardous areas, resulting in significant deaths and injuries. At the Pennzoil Refinery in 

Rouseville, Pennsylvania, a hydrocarbon fire that resulted from the bursting of two storage tanks 

led to five fatalities, including two contractors who were in trailers sited near the tanks. A 1998 

EPA investigation report determined that if the trailers had been isolated from the storage tank 
BP Texas City Final Investigation Report 3/20/2007 

243

area the casualties may have been prevented. 

11. Under 42 U.S.C. §7412(r)(6)(C) (ii), the Board is charged with “recommending measures to 

reduce the likelihood or the consequences of accidental releases and proposing corrective steps to 

make chemical production, processing, handling and storage as safe and free from risk of injury 

as is possible ....” 

12. Board procedures authorize the issuance of an urgent safety recommendation before a final 

investigation report is completed where there is likelihood that a safety issue is widespread at a 

number of sites. 

Accordingly: 

Pursuant to its authority under 42 U.S.C. §7412(r)(6)(C)(i) and (ii), and in the interest of promoting safer 

operations at U.S. petrochemical facilities and protecting workers and communities from future accidents, 

the Board makes the following urgent safety recommendations: 

American Petroleum Institute 

2005-4-I-TX-R2 In light of the above findings concerning the March 23rd incident at BP’s Texas City 

refinery, revise your Recommended Practice 752, “Management of Hazards 

Associated with Location of Process Plant Buildings” or issue a new Recommended 

Practice to ensure the safe placement of occupied trailers and similar temporary 

structures away from hazardous areas of process plants. Ensure that the new 

recommended practice: 

a. Protects occupants from accident hazards such as heat, blast overpressure, and projectiles; 

b. Establishes minimum safe distances for trailers and similar temporary structures away from 
BP Texas City Final Investigation Report 3/20/2007 

244

hazardous areas of process plants; 

c. Evaluates the siting of trailers under a separate methodology from permanent structures, since 

trailers are more susceptible to damage, are more readily relocated, and likely do not need to 

be placed near hazardous areas. 

American Petroleum Institute & the National Petrochemical and Refiners 

Association 

2005-4-I-TX-R3 Issue a safety alert to your membership to take prompt action to ensure the safe 

placement of occupied trailers away from hazardous areas of process plants. 

C.3 Blowdown Drum & Stack Recommendation 

Key Findings 

1. On March 23, 2005, the BP Texas City refinery experienced a severe explosion and fire that 

resulted in 15 deaths, 180 injuries, and significant economic losses; the accident was one of the 

most serious U.S. workplace disasters of the past two decades. 

2. During the isomerization (ISOM) unit startup, a distillation tower was overfilled with liquid, 

triggering the opening of three emergency relief valves that protect the tower from high pressure; 

the liquid discharged into a disposal blowdown drum with a stack open to the atmosphere. The 

drum rapidly overfilled with flammable liquid leading to a geyser-like release out of the stack and 

subsequent explosion and fire. 

3. The ISOM blowdown drum was connected to 58 emergency relief valves. BP had not completed 

a relief valve and disposal collection piping study for the ISOM which was necessary to 

determine if the drum was adequately sized. At the time of the incident, many BP Texas City 

refinery process units did not have up-to-date relief studies. In addition, information on the 
BP Texas City Final Investigation Report 3/20/2007 

245

original design basis and capacity of the ISOM blowdown drum was missing. CSB determined 

that liquid was released out the top of the ISOM blowdown stack during the incident because the 

drum was undersized. 

4. From 1994 to 2004, there were eight serious ISOM blowdown incidents; in two of these incidents 

the blowdown stack caught fire. The other six incidents were serious near-misses where 

flammable hydrocarbon vapors that were released from the blowdown system could have had 

catastrophic consequences if the resulting ground level vapor clouds had found sources of 

ignition. 

5. The BP Texas City refinery safety standards, in effect since 1977, stated that new blowdown 

stacks were not permitted and blowdown drums should be connected to a closed system or a flare 

when the existing facility was outgrown or major modifications were made to the unit. Since 

1986 the blowdown drum was replaced and major capacity changes were made but the blowdown 

drum was not connected to a safe disposal system such as a flare. In 2002, BP engineers proposed 

connecting the discharge from the ISOM relief valves to a flare as part of an environmental 

project, but this work was not performed. A properly designed flare system would safely contain 

discharged liquid in a disposal drum and burn flammable vapor preventing a hazardous release to 

atmosphere. Flares are the most frequently used disposal control equipment in the oil refining 

industry. 

6. As a result of mergers and acquisitions with Amoco and Arco, BP owns five North American 

refineries. Prior to the incident, the five refineries operated 22 blowdown systems with stacks 

open to atmosphere; 17 handled flammables. Since the March 23, 2005 accident, BP has stated it 

will eliminate all atmospheric blowdown systems in flammable service at all five of its U.S. 

refineries including Texas City. 
BP Texas City Final Investigation Report 3/20/2007 

246

7. OSHA’s Process Safety Management (PSM) standard establishes requirements for the prevention 

of catastrophic releases of highly hazardous chemicals such as flammables. The standard requires 

employers of covered processes to compile written process safety information including 

information pertaining to relief system design and design basis that complies with “recognized 

and generally accepted good engineering practices.” OSHA publishes PSM Compliance 

Guidelines that establish procedures for the enforcement of the standard. These guidelines call for 

inspections to ensure that “destruct systems such as flares are in place and operating” and 

“pressure relief valves and rupture disks are properly designed and discharge to a safe area.” 

8. In 1992, the Occupational Safety and Health Administration (OSHA) cited and proposed fines to 

Amoco on the hazardous design of a similar blowdown drum and stack at the Texas City refinery. 

OSHA determined that the drum and stack were not constructed in accordance with the American 

Society of Mechanical Engineers’ (ASME) Boiler and Pressure Vessel Code. The code requires 

relief valve piping to discharge to a safe location. As an abatement method OSHA suggested 

connecting the blowdown drum to a closed system such as a flare. Amoco asserted that the 

blowdown system was constructed in accordance with industry standards citing the American 

Petroleum Institute’s (API) Recommended Practice 521 Guide for Pressure-Relieving and 

Depressuring Systems. As part of a settlement agreement, OSHA withdrew the citation and the 

fine. The refinery continued to use blowdown drums without flares at the Texas City site. As a 

result of the March 23, 2005 incident, OSHA cited BP’s ISOM blowdown system for a willful 

violation of the same regulation. In the settlement agreement, BP agreed to permanently remove 

the ISOM blowdown system from service. 

9. API 521 is the generally accepted practice for the design and operation of pressure relieving and 

disposal systems. CSB found that for flammables API 521: 

a. Does not consider liquid overfill of a vessel as a potential hazard which can result in large 
BP Texas City Final Investigation Report 3/20/2007 

247

liquid releases to pressure relief and disposal systems; 

b. Lacks adequate drum sizing guidance for large releases of liquid to disposal systems; 

c. Does not address the hazard posed by relief flows less than design causing flammable 

concentrations of vapor at ground level due to low stack exit velocity and ineffective 

dispersion; 

d. Does not recommend the use of inherently safer options such as a flare system in lieu of a 

blowdown drum and stack vented to the atmosphere. 

Therefore, the Board makes the following safety recommendations: 

American Petroleum Institute 

2005-4-I-TX-R4 Revise API Recommended Practice 521, Guide for Pressure Relieving and 

Depressuring Systems to ensure that the guidance: 

a. Identifies overfilling vessels as a potential hazard for evaluation in selecting and designing 

pressure relief and disposal systems; 

b. Addresses the need to adequately size disposal drums for credible worst-case liquid relief 

scenarios, based on accurate relief valve and disposal collection piping studies; 

c. Warns against the use of atmospheric blowdown drums and stacks attached to collection 

piping systems that receive flammable discharges from multiple relief valves and urges the 

use of appropriate inherently safer alternatives such as a flare system. 
BP Texas City Final Investigation Report 3/20/2007 

248

Occupational Safety and Health Administration (OSHA) 

2005-4-I-TX-R5 

1. Implement a national emphasis program for all oil refineries that focuses on: 

a. The hazards of blowdown drums and stacks that release flammables to the atmosphere 

instead of to an inherently safer disposal system such as a flare. Particular attention should be 

paid to blowdown drums attached to collection piping systems servicing multiple relief 

valves; 

b. The need for adequately sized disposal knockout drums to safely contain discharged 

flammable liquid based on accurate relief valve and disposal collection piping studies. 

2. Urge States that administer their own OSHA plan to implement comparable emphasis programs 

within their respective jurisdictions. 
BP Texas City Final Investigation Report 3/20/2007 

249

 

APPENDIX D: BP Corporate and Texas City Refinery Background 

D.1 BP- Amoco Merger 

The management structure changed on December 31, 1998, when Amoco Corporation merged with BP. 

The new company, BP-Amoco, transferred corporate functions from Chicago to London. The process 

safety group in Chicago was disbanded and the process safety function was placed under the Technology 

area in the London corporate office staffed by a single advisor. About 120 new business units were 

created, one of which was the Texas City refinery, now headed by a Business Unit Leader who was the 

Amoco refinery manager before the merger. In 2000, after reorganization, the PSM department reported 

to the manager of engineering and inspection rather than the chair of the Refinery Process Safety 

Committee. 

D.2 BP South Houston Integrated Site 

In 2001, the Star Site concept247 was introduced at Texas City. The refinery and nearby chemical plants 

were merged into a single business unit at Texas City, managed by a site director (the former Texas City 

refinery Business Unit Leader), who now reported to both the refining and chemicals groups. A new 

refinery manager assumed responsibilities for the Texas City refinery. As the products of the ISOM unit 

were used primarily in the chemicals business, management of the ISOM unit was transferred from the 

refinery to the chemicals business. A new shared services group provided EHS (Environment, Health and 

Safety), process safety, human resources, information technology, and contract maintenance for these 

facilities. Until new corporate standards could be developed and adopted, each business in it continued to 

use the corporate standards that were in effect in their respective organizations before the merger. At the 

end of 2001, the site director left to become the Business Unit Leader of another BP refinery, and a new 

site director arrived from London. At the Texas City refinery, the refinery manager retired and was 

247 This concept had been previously used by BP at its Grangemouth facility in England. 
BP Texas City Final Investigation Report 3/20/2007 

250

replaced by a Performance Unit Leader, who reported to both the BP South Houston site director and the 

refining group VP. 

D.3 BP Texas City Refinery 

In April 2004, BP moved most of its petrochemicals businesses into a separate entity, which resulted in 

chemical operations being separated from the refinery and the shared services group being divided among 

these entities. Management of the ISOM unit was returned to the refinery. In June 2004, the Performance 

Unit Leader left to become a Business Unit Leader of another BP refinery because the position was being 

eliminated. The BP South Houston site director became the Business Unit Leader of the Texas City 

refinery, and in January 2005, began reporting solely to the Regional Group VP of Refining. The PSM 

department became part of the refinery HSSE department. 
BP Texas City Final Investigation Report 3/20/2007 

251

APPENDIX E: ISOM Unit - History, Equipment, and Operation 

The ISOM unit began production in 1985 to provide higher octane for blending stock of unleaded 

gasoline that was lost with the government phase-out of tetra ethyl lead. As the ISOM unit was converted 

from a process unit, called an Ultraformer, its process equipment (towers, drums, piping, etc.) ranged 

from newer equipment installed when the conversion was made to older equipment that had been installed 

in the 1950s. 

In 1985, Ultraforming Unit No. 1 was converted into a 27,000 bpd C5/C6 naphtha isomerization unit. The 

isomerization process used was the Hysomer process licensed by Union Carbide Corporation. The 

Hysomer process converts lower octane C5 and C6 straight chain paraffins to higher octane C5 and C6

isomers on a platinum-alumina catalyst. 

In mid-1986, the ISOM unit was converted from the Union Carbide Hysomer process to the Universal Oil 

Products (UOP) low-temperature Penex process. The new Penex unit consisted of three sections: the 

Ultrafiner section, Penex Reaction system, and Stabilization section. The design basis of this unit was 

27,000 bpd. 

E.1 Raffinate Splitter Section 

This equipment was installed in 1976 and used initially as a Heavy Ultraformate Fractionator (HUF) to 

increase recovery of xylenes from ARU and Ultraformers. In 1985, the HUF was converted to fractionate 

light raffinate feedstock for the ISOM unit and became a raffinate splitter. In 1986, the capacity of the 

raffinate splitter section was increased from 20,000 to 30,000 bpd to ensure that 27,000 bpd would be 

available as feed for the Penex section of the ISOM unit. In 1987, the capacity of the raffinate splitter 

section was again increased from 30,000 to 33,000 bpd to produce additional heavy raffinate for JP-4 jet 

fuel. 
BP Texas City Final Investigation Report 3/20/2007 

252

When the raffinate splitter tower was converted to a raffinate splitter in the mid-1980s, its operating 

pressure was changed to 75 psig (517 kPa) and the discharge pressure for the opening of one safety relief 

valve was set at 70 (483 kPa), while the other two relief valves were set at 74 psig each (510 kPa). In 

March 2004, after an inspection revealed significant corrosion under the insulation on the exterior of the 

raffinate splitter, its relief pressure was lowered to 40 psig (276 kPa), and the pressures for the opening of 

the three safety relief valves were lowered to 40, 41, and 42 psig (276, 283, and 290 kPa), respectively. 

E.2 Blowdown Drum and Stack 

The ISOM blowdown drum and stack was originally installed in the mid-1950s as part of Ultraformer No. 

1 unit. A piping and instrumentation diagram (P&ID) indicates that the blowdown drum was initially 

located in the southwest corner of the Ultraformer No. 1 unit. In May 1957, an inspection record noted 

that the blowdown drum and stack was “relocated approximately 200 feet (61 m) to the extreme 

northwest corner of the battery limits. This vessel was moved to eliminate a dangerous fire hazard which 

prevailed under certain wind conditions.” The inspection record also noted that three new nozzles were 

installed on the drum to facilitate new line tie-ins from ultraformate splitting facilities; however, despite 

this additional load, BP has indicated that no documented capacity analysis could be found. 

The operating manual for the HUF, dated June 1976, lists the blowdown connections to the Ultraformer 

No. 1 blowdown drum for “receiving, quenching and disposing if hot liquid and/or vapor hydrocarbons.” 

BP has not provided the CSB with any historical records from the Texas City refinery to indicate that the 

blowdown drum and stack was capable of safely handling the load from the listed connections. 

In October 1986, an engineering contractor working on converting the ISOM unit to Penex evaluated the 

relief system on the raffinate splitter and determined that the backpressure in the common relief valve 

disposal header was 113 percent of the relief valve set pressure in the event of a reflux/condenser failure, 

and recommended that Amoco take corrective action. An undated internal Amoco memo, with some 
BP Texas City Final Investigation Report 3/20/2007 

253

 

handwritten notes, indicates that Amoco was informed of the problem and developed some proposals to 

correct it, but none were implemented. 

In 1992, an action item from the ISOM unit’s initial PHA required by PSM recommended that relief 

valves be reviewed to ensure that they were properly sized. In March 1994, the recommendation was that 

no changes were required to the ISOM unit’s pressure relief header system of blowdown drum, based on 

an Amoco engineering analysis. However, the engineering analysis did not look at the common vent 

disposal header from the raffinate splitter, nor did it consider two-phase discharges (vapor/liquid) to the 

blowdown drum and how effectively the drum could handle them. 

In 1994, P&ID drawing248 changes show that a number of new lines were added to the relief valve 

headers; however, BP has provided no historical records to the CSB to indicate that any of the safety and 

health impacts of these changes were evaluated under the MOC process. 

In 1997, the refinery replaced the blowdown drum and stack because it was about 40 years old and 

needed extensive repair due to corrosion. Part of the decision to replace the blowdown drum without 

modifications was to “maintain profits” so the refinery could “continue to operate without triggering the 

EPA New Source Performance Standards.”249 However, while the blowdown system replacement was 

listed as a “replacement-in-kind,” the stack on the new blowdown drum was fabricated to be 34 inches 

outside diameter, while the stack on the original blowdown drum was 36 inches inside diameter. 

During the ISOM PHA revalidation in 1998, an action item recommended locking the valve on the 

blowdown drum overflow line open to prevent excessive backpressure on the common disposal headers in 

the event of a large flow of liquid to the drum. This action item was resolved by chaining the valve open; 

however, no MOC was conducted to evaluate the safety or health implications of this change. 

248 Drawings B-4450-G_1278, Rev. 27; B-4550-G-2636; B-4550-G-2746; and B-4550-G-2622, Rev. 6. 

249 Amoco Appropriation Request No. 08-05449; Reforming--ISOM--Replace F-20 Blowdown Drum and Stack; 

July 7, 1997. 
BP Texas City Final Investigation Report 3/20/2007 

254

Section IV of the Isomerization Unit No.1 Operating Manual and the ISOM #1, Training Guide #31, 

Pumpout and Blowdown Systems explain that originally, the drum and stack had quench water and steam 

connections. The quench water would cool any hot process streams. A temperature-sensing element 

connected to a flow control valve would admit water to the drum. Operators could also manually add 

quench water. Two steam connections were also provided: one to steam out the drum, and the other, to 

blanket the drum and disperse vapors that vent from the stack. This equipment had not been operational 

for several years prior to the incident, according to interviews with ISOM operators. 

In 2003, an internal inspection of the blowdown drum revealed that most of the vessel shed trays had 

collapsed in the bottom of the drum. As the remaining shed trays that were still attached were considered 

dangerous to personnel, the internal inspection was terminated and the drum was closed without 

recommending that the drum be taken out of service or repaired. 

Later in 2003, the second PHA revalidation for the ISOM unit contained an action item that 

recommended a full unit relief valve study be conducted to verify that all relief valves were adequately 

sized for service. The relief valve study was underway when the explosion occurred in the ISOM unit two 

years later. 
BP Texas City Final Investigation Report 3/20/2007 

255

APPENDIX F: Trailers for Turnaround Activities 

Contractors working on the Motorization Project were working out of a wood-framed, double-wide office 

trailer sited west of the ISOM unit and north of the catalyst warehouse, about 120 feet (37 m) from the 

blowdown drum. This location was selected because trailers had been sited in this area during an earlier 

turnaround and it was adjacent to the ULC unit where the work would be performed. The double-wide 

trailer was sited in this area in September 2004, had 11 contractor offices, and was routinely used for 

meetings. This trailer was to be occupied until the project was completed in June 2005. 

A single-wide, wood-framed office trailer, used by four QA/QC contractors, was sited south of the 

double-wide and east of the catalyst warehouse, approximately 136 feet (42 m) from the blowdown drum. 

This trailer was installed when the ULC turnaround began and was to be occupied until the turnaround 

was complete. Both trailers had electrical hook-ups, and the double-wide project trailer also had a potable 

water hook-up. 

Six additional trailers, arranged in two parallel rows of three, were sited directly north of the catalyst 

warehouse approximately 250 feet (76 m) from the blowdown drum. All had electrical hook-ups. 

The two southernmost trailers in this group of six were being used by an instrument and electrical 

contractor who had between 15 to 20 employees working on the ULC turnaround. One trailer was used 

primarily by contractor job representatives while the other was an employee break/lunchroom. Both, sited 

in early January, were single-wide of wood construction and were scheduled to remain until the 

contractors’ work was completed. 

The middle two trailers in the group of six were being used as decontamination trailers for a contractor 

changing reactor catalysts in the ULC. One contractor employee was assigned to this trailer to issue and 

wash work clothing; other contractor employees used it to change and/or shower at the beginning and end 
BP Texas City Final Investigation Report 3/20/2007 

256

of their work shifts. These were both single-wide with steel fames and siding. These trailers had been 

sited in early February and would remain until the catalyst was changed in ULC reactors. 

The two trailers at the northernmost end of the group of six, constructed of steel, were sited in midFebruary. These trailers, scheduled to remain for several weeks, were being used by other ULC 

contractors to store equipment and tools; one had an attendant. 

F.1 BP Internal Guidelines Compared To Good Practice Guidelines 

The CSB determined that the Amoco siting workbook used a less conservative correlation for death to 

occupants than did API 752. The Amoco workbook shows lower death rates at comparable pressures than 

does API. For example, API states that a 1.0 psi peak side-on pressure applied to a wooden building will 

result in a 10 percent death rate to the occupants, whereas Amoco states that a 5.0 psi. reflected pressure 

(approximately equivalent to a 2.5 psi peak side-on pressure) will produce the same rate. The 

overpressure experienced at the two trailers closest to the blowdown drum was estimated to be between 

2.5 and 2.8 psi peak side-on pressure. 

The building identification step of the Amoco workbook consists of initially identifying those buildings 

that can be screened out from further analysis. Buildings can be exempted from further analysis based on 

their location, construction, or occupancy. The workbook notes that minimum damage will result if a 

building is located “far enough” away from a vapor cloud explosion and provides minimum distances 

between buildings and processing units. The workbook states that trailers can be located 350 feet (107 m) 

from the center of the nearest concentration of congested equipment in the closest unit, which was 

generally interpreted at the refinery to mean that trailers could be located 350 feet (107 m) from the unit’s 

battery limits. Steel frame buildings with sheet metal siding could be located 450 feet (137 m) from the 

unit’s battery limits and concrete, masonry, brick, or cinder block buildings could be located 700 feet 

(213 m) away. The workbook notes that the minimum distance for trailers was less than for other types of 
BP Texas City Final Investigation Report 3/20/2007 

257

buildings because “data from actual events indicate that trailers tend to roll in response to a vapor cloud 

explosion, and walls and roof do not collapse on occupants, resulting in fewer serious injuries/fatalities.” 

The basis for the safe distance used in the Amoco workbook adopted by BP was documented in the 

Amoco Petroleum Products Sector-Refining Facility Siting Reference Manual (Amoco 1995b). A typical 

volume of congested equipment was calculated to be 200 million standard cubic feet (mscf). Using this 

typical congested equipment volume, the distances that resulted in a 10 percent occupant death rate for 

various building types were calculated, then recorded in the workbook. The CSB determined that these 

distances placed trailers at an increased risk from vapor cloud explosions. 

F.1.1 Occupancy Criteria 

The workbook also set occupancy limits, which would exclude further screening. A building was 

excluded from further analysis if one individual occupied it for 20 hours per week or less, or if all 

inhabitants occupied it less than 200 hours per week. The workbook instructed users to calculate 

occupancies on an annualized basis. For trailers occupied only a couple of months during a unit 

turnaround, this approach diluted the actual risks to the occupants by weighting them (assuming zero risk 

for the months that the trailer was not being used) over a yearly average. Consequently, nearly all trailers 

at the refinery were excluded from further screening based on their annualized occupancy levels. The 

Amoco workbook also noted some factors to consider when determining peak occupancy levels, 

including meetings and gatherings, but did not provide any guidance on what to do if the peak occupancy 

was exceeded. In the March 2005 explosion, a total of 22 BP and contractor workers were inside a 

double-wide trailer located 120 feet (37 m) from the blowdown drum because of a weekly meeting. The 

normal occupancy of the trailer was 13. When this trailer was destroyed by the blast overpressure wave 

from vapor cloud explosion, 12 were killed in or around the trailer and the other 10 seriously injured. 
BP Texas City Final Investigation Report 3/20/2007 

258

 

APPENDIX G: Process Modeling 

The CSB examined the mechanisms responsible for the overflow of the raffinate splitter column into its 

overhead vapor line and to model the column conditions leading to the overfilling of the column. 

G.1 Modeling Approach 

Convention distillation models are inappropriate for modeling the behavior of the raffinate splitter column 

during this incident because distillation was not occurring. By 1:13 p.m. on March 23, 2005, the column 

was completely liquid-full (flooded) with a layer of sub-cooled liquid at the top and downstream 

equipment filled with nitrogen. No vapor flowed out of the column, no condensation occurred in the fin 

fan condenser, and no reflux flowed to the column. Laboratory tests of liquid samples recovered from the 

column feed, bottoms, and overhead confirmed that no separation had occurred in the column (SPL 

Houston Laboratories, 2005). Furthermore, the behavior of the vapor generated in the column on the 

flooded trays can not be predicted with confidence, as the conditions are outside the range of standard 

empirical models of distillation tray behavior. Standard steady-state and dynamic distillation computer 

programs cannot accurately model the behavior of the column under these conditions. 

Three complementary approaches were used to understand the overflow of the raffinate splitter column: 

• modeling of column material balance, 

• modeling of liquid thermal expansion, and 

• qualitative evaluation of vapor accumulation. 

The material balance was modeled in a spreadsheet based on flow data from the PI system250. The density 

of the liquid in the column was modeled using the Rackett equation and temperature data from the PI 

250 The PI System, or Process Information System, is a historical database of process data collected from the control 

board. 
BP Texas City Final Investigation Report 3/20/2007 

259

system. The potential for vapor accumulation was inferred qualitatively from PI system pressure and 

temperature data, and from experimental bubble point251 test data obtained from Fauske & Associates 

(2005). 

A simplified composition (Table G-1) was used to make property calculations tractable. This composition 

gave a very good fit to Fauske & Associates’ experimental bubble point data (Figure G-1). This data is 

based on analysis of samples taken from the raffinate splitter column overheads and was developed using 

Fauske & Associates’ proprietary VSP-2 test apparatus. 

Table G- 1. Raffinate splitter column simplified composition model (Fisher, 2006) 

Compound Weight Fraction 

n-pentane 0.0383 

2-methyl butane 0.0263 

n-hexane 0.1519 

2-methyl pentane 0.2950 

n-heptane 0.3072 

n-octane 0.1300 

n-nonane 0.0409 

Heavies as n-decane 0.0104 

Total 1.0000 

 

251 Mixtures at a given pressure boil over a range of temperatures, with the most volatile materials vaporizing first 

and the least volatile last. The bubble point, or initial boiling point, of a mixture at a given pressure is the 

temperature at which vaporization first occurs. 
BP Texas City Final Investigation Report 3/20/2007 

260

1.E+00

1.E+01

1.E+02

-3.5 -3.3 -3.1 -2.9 -2.7 -2.5 -2.3

Temperature: -1,000/T (1/K)

Pressure (psia)

Nitrogen Free Basis

Experimental Data

Figure G- 1. Experimental boiling (bubble) point data (Fauske & Associates, 2005) 

G.2 Raffinate Splitter Column Overfill 

Based on material balance, at 1:13 p.m., the level of cold liquid in the raffinate splitter would have been 

143 feet (44 m) above the lower tangent line on the column. Accounting for liquid thermal expansion due 

to the heating of the column contents (but neglecting vapor holdup in the column) brings this to 161 feet 

(49 m), less than 4 feet (1.2 m) below the upper tangent line of the column. This left only about 3.5 

percent of the volume of the column empty; the liquid level was reaching the top of the column. 

Sufficient vapor had accumulated lower in the column to displace the cold liquid at the top into the 

overhead vapor line. 

Vapor generated in the reboiler initially had a minor effect on column level. The pressure in the lower 

column, created by the combination of nitrogen pressure at the top of the column and the hydrostatic 

pressure exerted by the liquid filling the column, raised the boiling point of the liquid enough to suppress 

bubble formation. Any bubbles formed quickly collapsed when they contacted relatively cold liquid a 

short distance higher in the column. 
BP Texas City Final Investigation Report 3/20/2007 

261

This situation changed in the minutes preceding the incident. At 12:41 p.m., operators opened the 8-inch 

valve around the column relief valves to vent nitrogen from the column, reducing the pressure from 33 to 

less than 22 psig (152 kPa), and coincidently reducing the boiling point temperature of the liquid 

throughout the column. Heavy raffinate flow began at 12:59 p.m., rapidly preheating the feed to the 

column to 2600

F (127°C), well above its initial boiling point temperature. 

Between 12:59 and 1:13 p.m., the average temperature of the column increased almost 270

F (-0.3°C). As 

the amount of sub-cooled liquid below the feed tray decreased, vapor bubbles that had formed in the 

reboiler no longer quickly collapsed. Consequently, the vapor volume in the column increased, although a 

“cap” of cold liquid remained in the upper column. Less than 0.1 percent of the liquid in the column had 

to vaporize to displace the column contents into the overhead vapor line. The trend in the column strongly 

favored significant liquid swell due to vapor hold-up in the column at the time of the incident. 

G.3 Blowdown Stack Hydrocarbon Liquid Overflow 

The amounts of sub-cooled hydrocarbon liquid lost from the raffinate splitter to the atmosphere and sewer 

can only be estimated. A mass balance of the raffinate splitter, ancillary equipment, blowdown drum, and 

piping using calculated flows from the safety relief valves on the raffinate splitter overhead vapor line and 

flow to the sewer from the gooseneck piping at the bottom of the blowdown drum was used to determine 

the flow from the blowdown drum stack to the atmosphere. 

G.3.1 Methodology 

A digital computer simulation program calculated the flows of sub-cooled liquid through the safety relief 

valves, relief header, sewer pipes, and blowdown drum. The computer program incorporates technology 

from the American Institute of Chemical Engineers (AIChE); Design Institute for Emergency Relief 

Systems (DIERS); and Center for Chemical Process Safety (CCPS) for both viscous and non-viscous, 

flashing, frozen, and hybrid two-phase flows through emergency relief devices and pipes. Also included 
BP Texas City Final Investigation Report 3/20/2007 

262

are routines to calculate inlet pipe pressure drop and discharge pipe back pressure for choked and subcritical vapor, two-phase and sub-cooled liquid flows from safety valves. The computer program reports 

choked or unchoked and turbulent or laminar flow through each device and associated back pressures 

through inlet or discharge pipes. Warning messages are provided if the emergency relief devices cannot 

maintain the system pressure to meet American Society of Mechanical Engineers’ (ASME) Pressure 

Vessel Code and API requirements. 

G.3.2 Computer Inputs and Assumptions 

The three Consolidated bellows safety relief valves protecting the raffinate splitter had coefficients of 

discharge and rated capacity flows as Table G-2 shows. 

Table G-2: Safety relief valve characteristics 

Safety Relief Valve Vapor Flow Liquid Flow 

Kd 0.95 0.74 

Rated Capacity 1.1 Pset 1.25 Pset 

A Kp factor is applied to a safety relief valve with vapor trim when flowing a liquid. The flow from these 

valves therefore increases from 0.6 to 1.0 of the rated capacity as the flowing pressure increases from 1.1 

to 1.25 Pset. When the flowing and constant superimposed backpressures on the safety relief valves 

exceed certain values, Kb and Kw factors are also applied to reduce the vapor or liquid flows, 

respectively, to account for the valves going out of full lift. The Kb and Kw values in API 520 are 

consensus values of various manufacturers. Each manufacturer also publishes Kb and Kw curves for its 

own valves. A single curve represents the performance of all models in a manufacturer’s line of valves. 

These values were supposedly measured, but most of the data are not now available to justify the 

published curves. The published values of the various manufactures do not agree. 
BP Texas City Final Investigation Report 3/20/2007 

263

Safety relief values with modified liquid trim are now required by the ASME Code to have their rated 

capacity flow certified at 1.1 Pset. The manufacturers, however, have never changed the Kw curves 

published for their older model liquid valves with the rated capacity certified at 1.25 Pset. Due to the high 

overpressure of the liquid flow from the safety relief valves, a Kw value of 1.0 was chosen to best 

represent the incident information. 

A certain degree of uncertainty therefore exists with respect to the flows and backpressures calculated for 

the safety relief valves protecting the raffinate splitter. The uncertainty of the flow into the blowdown 

drum affects the calculated liquid flows to the sewer through the gooseneck piping and to the atmosphere 

from the stack and available to form the flammable vapor cloud. The flows reported here are therefore 

best estimates that agree with the incident timeline and eyewitnesses accounts of the release from the 

blowdown drum stack. 

G.3.3 Computer Simulation Results 

The overall mass balance of hydrocarbon flow from the raffinate splitter from the computer simulation is 

shown in Table G-3. As much as 6,730 gallons of hydrocarbons could have been released to the 

atmosphere prior to the explosion and an additional 855 gallons after the explosion. 
BP Texas City Final Investigation Report 3/20/2007 

264

Table G-3: Overall mass balance of hydrocarbon flow from the raffinate splitter 

Equipment Volume (Gallons) Mass (pounds) Time to Fill (minutes) 

Flow from raffinate splitter tower 51,930 283,150 6.00 

Raffinate splitter safety relief valve 

discharge pipe header 

6,975 0.625 

Blowdown drum and stack (above 

gooseneck nozzle) 

18,855 2.70 

Other safety relief valve discharge 

pipe headers 

6,300 0.900 

Flow to fill equipment 32,130 175,200 4.225 

Flow to sewer 12,210 66,575 5.375 

Flow to atmosphere 7,590 41,375 1.775 

Before explosion (94.5 seconds) 

Flow to sewer 11,470 62,555 

Flow to atmosphere 6,735 36,710 

After explosion (12 seconds) 

Flow to sewer 740 4,020 

Flow to atmosphere 855 4,665 

Total 19,800 107,950 
BP Texas City Final Investigation Report 3/20/2007 

265

APPENDIX H: Blast Damage Analysis, Vapor Cloud and Explosion 

Modeling 

The CSB conducted surveys and analyzed on- and off-site blast damage resulting from the March 23, 

2005, explosion at the BP Texas City refinery. The CSB engaged a contractor to perform engineering 

analysis and modeling to investigate the release and explosion consequences of the generated vapor 

cloud. Various explosion scenarios were examined using computer simulations for comparison with 

observed consequences, and blast contours were calculated. Animations were developed that depict a best 

estimate of events, including dispersion of flammables and propagation of flame through the flammable 

cloud and creating the explosion. A final report was submitted to the CSB containing the information 

collected, completed analysis, and results; highlights of the report appear in the following sections of this 

appendix (ABS Consulting, 2006). Animations showing the dispersion of the flammables and propagation 

of flame through the flammable cloud can be viewed on the CSB website, www.csb.gov. 

H.1 Surveys of Blast Damage 

An extensive survey was made of the damage caused by the blast. The survey included qualitative 

recording of damage with photographs, field notes, and detailed measurements of permanent 

deformations. The purpose of this survey was to provide data that could be used to estimate the severity 

of the explosion in terms of observed overpressure. An important part of this survey included 

documentation of trailers and other portable buildings damaged by the blast. A total of 50 trailers and 

other portable buildings were examined and information regarding structural damage and internal hazards 

recorded. The survey also contained a detailed examination of structural damage to permanent buildings 

located near the ISOM unit, including the catalyst warehouse, ISOM satellite control room, the electrical 

switchgear building near the blowdown drum and stack, and various buildings in surrounding process 

units. 
BP Texas City Final Investigation Report 3/20/2007 

266

A separate survey was conducted on the damaged storage tanks in the refinery tank farm south of the 

ISOM unit, and off-site window breakage to residential homes and commercial buildings surrounding the 

plant. As over 50 tanks sustained varying degrees of structural damage from the explosion, the storage 

tank survey was undertaken to understand the nature and extent of blast loads on these structures. Specific 

analysis was conducted on a severely damaged tank to estimate the observed overpressure. Inspections 

were also performed on over 20 selected properties. The off-site survey was not intended to be a thorough 

investigation to identify every structure with broken window glass, but a qualitative study to identify the 

type of damage off-site and range of discernable damage. 

H.2 Blast Damage Analysis 

Both dispersion modeling and the blast modeling used computational fluid dynamics (CFD) to investigate 

flammable cloud formation and to generate blast overpressure contours. Structural analysis of the blast 

damage measured in the field survey to objects and buildings provided an estimate of the blast load 

experienced by these objects, or “indicators.” Some indicators used in this analysis were deformed and/or 

damaged steel plates and lids, electrical box covers, and elevated switchgear buildings. Other indicators 

included permanent unit structures, such as control rooms, maintenance buildings, and pump houses. The 

overpressures noted in the following discussion are applied pressures, and care must be taken in 

correlating them to published literature values, as some of the damage indicators may have been subjected 

to reflected blast pressure loads, while others may be the result of side-on blast pressure loads. Even 

undamaged structural elements provided clues regarding the blast loading exposure as the strength if an 

object was greater than the applied blast load then an upper bound could be assigned. 

H.3 Intense Blast Regions 

The site survey identified several clear and distinct intense blast regions. These regions were 

characterized by locally intense structural damage and each had a surrounding pattern of directional 
BP Texas City Final Investigation Report 3/20/2007 

267

indicators that pointed away from these areas, indicating that they were sub-explosion centers. At least 

two of these areas were identified in the ISOM unit: the Penex reactors and nearby heat exchangers, and 

the hydrogen compressor and surrounding areas (Figure H-1). Structural indicators showed that blast 

overpressures of 10+ psi and 5+ psi occurred at the hydrogen compressor and Penex reactor areas, 

respectively (Figure H-2). 

The third intense blast region was the trailer area, where structural indicators showed that a blast 

overpressure of 2.8 psi at the double-wide and QA/QC trailers. 

Additional points of interest on the blast overpressure maps (Figure H-2) are 

• Areas surrounding the intense pressure regions in the ISOM unit, including the satellite control 

building, experienced 5 psi and greater overpressures. 

• The catalyst warehouse and the six temporary trailers sited directly north of it experienced 

approximately 2 to 2.5 psi overpressure. 

• The east edge of the NDU, first layer of storage tanks south of Ave. G, and the south edge of the 

ULC unit experienced about 1 psi overpressure. 

• The west edge of the NDU, second layer of tanks south of Ave. G, the south portions of ULC and 

ARU units, and the western edge of the ARU unit experienced 0.5 psi and greater overpressures. 

• Five ULC turnaround trailers sited west of Sixth Street; the remainder of ULC and ARU units, 

and storage tanks farther south experienced 0.25 psi and greater overpressures. 
BP Texas City Final Investigation Report 3/20/2007 

268

Figure H- 1. Intense blast regions in the ISOM unit 

The blast overpressures presented on the map are free-field values and do not address blast wave 

reflections. Objects facing the blast can experience applied blast wave pressure higher than the free-field 

values. 
BP Texas City Final Investigation Report 3/20/2007 

269

Figure H- 2. Blast overpressure map 

H.4 Trailer Damage 

Trailer damage varied with distance from the ISOM unit. Distances reported in this discussion are 

measured from the blowdown drum to the centers of the trailers. This is not to imply that blowdown drum 

was the epicenter of the explosion event, but it was the point of release and serves as a convenient, fixed 

point of reference. Table H-1 summarizes damage to the various types of trailers at the BP Texas City 

refinery. 
BP Texas City Final Investigation Report 3/20/2007 

270

Table H- 1. Trailer damage 

Type of Trailer Distance from Blowdown 

Drum (feet) 

Summary of Damage 

140 to 240 Trailers and contents destroyed; debris thrown; 

occupants killed or seriously injured 

240 to 620 Significant wall damage, some structural failure; flying 

window glass; internal debris hazards 

Wood Framed 

620 and beyond Broken window glass, internal debris hazards 

220 – 250 Wall and roof failures; significant internal debris 

hazards 

250 – 270 Deformation of walls and roof, but not to failure; 

internal debris hazards 

Semi-Trailers and 

5th Wheel Trailers 

(metal 

construction) 

455 and beyond Broken window glass 

340 Large deformation of walls and roof; contents 

significantly dislodged presenting internal debris 

hazards 

Steel Container 

Units 

450 and beyond No apparent damage 

H.5 ISOM Satellite Control Room Building 

The building windows failed and one door was blown into the building. The masonry block walls 

experienced widespread heavy damage, especially the west wall that faced the ISOM. Inside, fallen 

cabinets and light fixtures, objects thrown from the walls, and flying glass hazards were observed. The 

structural analysis estimated that the ISOM satellite control room experienced a side-on blast 

overpressure in the range of 1.5 to 2.5 psi. 

The wall facing the blast experienced blowout of the external face of the masonry block at or near 

midspan. One explanation of this damage pattern is that the wall experienced compression arching and the 

building had inherent structural features that would facilitate this possibility. Masonry walls that respond 

with compression arching exhibit higher out-of-plane capacity than walls that do not develop arching 

action. Therefore, the arching action in the Satellite Control Building may have reduced the level of wall 
BP Texas City Final Investigation Report 3/20/2007 

271

damage from that which would have otherwise been observed. Conclusions regarding the strength of 

masonry walls drawn from the observed damage to the Satellite Control Building should consider the 

potential that arching occurred. 

H.6 Catalyst Warehouse 

 The catalyst warehouse was essentially destroyed by the explosion. Analysis determined that the damage 

was constant with external overpressure and there was no evidence of an internal explosion. Structural 

analysis estimated that this conventional pre-engineered steel building was subjected to a side-on blast 

overpressure of about 2.0 psi. 

H.7 Storage Tanks 

The structural damage sustained by the storage tanks can be broadly classified into three types: (a) minor 

buckling and creasing, mostly localized in the top two or three courses of the shell wall, which was 

observed primarily for tanks with floating roofs; (b) minor damage to the cone roof and buckling on the 

upper courses of the shell wall, observed in a large number of tanks having a fixed roof; (c) major damage 

to one or both the roof and the shell wall. Large buckling of a portion or portions of the shell wall was 

usually associated with this kind of damage. In general, the row of tanks immediately south of the ISOM 

unit sustained damaged of type (c); side-on blast loads on some of these tanks would have been in excess 

of 1.0 psi overpressure. 

The remaining tanks were damage classes (a) or (b), depending on the roof configuration. The tanks 

situated to the west and northeast of the unit had relatively minor damage (b). One possible reason for this 

disparity in damage could be the shielding effect of the blast provided by the process units in the west and 

northwest directions, and the lack of units to the south. The effect of the blast was evident in some tanks 

situated 2,000 feet (610 m) south of the incident; however, the damage was minor and can be classified as 

type (b). 
BP Texas City Final Investigation Report 3/20/2007 

272

H.8 Off-Site Buildings 

The pattern of off-site window breakage at Texas City was consistent with relatively low overpressures 

(on the order of 0.1 psi or less) expected at the distances observed and for the types and sizes of windows 

inspected. The farthest identified glass damage was approximately 2,000 feet (610 m) from the refinery 

perimeter, or three-quarters of a mile from the blowdown drum and stack. Residential homes received 

more damage and were affected at greater distances from the refinery than commercial properties. This is 

a result of weaker construction of residential windows compared to commercial windows. Damage 

reached farthest to the north and west sides of the plant, as the ISOM unit was located in the northwest 

portion of the refinery and the predominance of homes and off-site commercial buildings are located in 

that direction from the plant. 

H.9 Vapor Cloud Dispersion Modeling 

Analysis and computer models were used to recreate the formation of the flammable cloud. This allowed 

key parameters to be examined, such as the likely mechanism(s) for the generation of the flammable 

vapors and the effects of wind and time on the dispersion of the flammable vapors. The results of the 

dispersion modeling revealed several sources of vapor production, including evaporation of liquid 

droplets during their fall from the blowdown stack, evaporation of liquid droplets after impact with 

elevated equipment and during fall to the ground, evaporation of the ground pool, and evaporation off 

elevated equipment wetted by the liquid. A vapor production rate as high as 100 kg/sec can be justified 

when all the above sources are considered, but a rate of 60 kg/sec compared best with field observations.
BP Texas City Final Investigation Report 3/20/2007 

273

H.10 Methodology 

Dispersion modeling used the FLACS (FLame ACceleration Simulator) Computational Fluid Dynamics 

(CFD) code.252 The FLACS code used source term inputs developed using the Process Hazards Analysis 

Software Tool (PHAST.)253 A 3D geometric model of the ISOM unit and surrounding structures was first 

constructed in CAD (computer-aided drafting) based on measurements made during the site investigations 

and supplemented with plan drawings of the units. The CAD model included a majority of the buildings, 

larger pieces of equipment, piping, vehicles, buildings, tanks, berms, pipe runs, and other objects in and 

around the ISOM unit. Rather than attempt to recreate each item individually, locations with significant 

amounts of small diameter objects (tubing, cabling, piping, etc.) were represented in the model by 3D 

arrays of objects with the approximate size and spacing of the objects observed in the field. 

Large items (e.g., buildings and units) in the upwind direction were included, or approximated as solid 

blocks, as these items could influence development of wind patterns. The CAD model was then imported 

into FLACS. The numerical model was then established by meshing the CAD model into a non-uniform 

hexahedral grid of cells with a fine region in the vicinity of the ISOM unit, and stretched cells near the 

boundaries. Each cell in the model contains the values of the primary flow variables (such as pressure, 

temperature, and density) and flow equations are used to solve transfers between cells for each unit time 

step.

H.10.1 Wind Effects 

Wind effects were included in the FLACS modeling. A steady-state wind profile throughout the model 

domain was established prior to initiating dispersion of the flammable material source. The initial wind 

speed specified in the model was an average value based on BP plant measurements taken at the North 

 

252 FLACS is commercially available through GexCon, a company in the CMR group; its principal offices are in 

Norway. 

253 PHAST software is commercially available from DNV. 
BP Texas City Final Investigation Report 3/20/2007 

274

Office Building weather station at or about the time of the actual explosion. As the model ran, the initial 

wind speed changed over the domain as the wind interacted with objects; once a steady-state was 

achieved, dispersion modeling of the flammable material was initiated. 

The wind modeling allowed formation of local variation in wind patterns that resulted from the influence 

of obstacles in the FLACS domain. Wind speed was significantly influenced downwind of large objects 

or areas of congestion. A large portion of the ISOM unit was observed to be less than half of the initial 

wind speed and portions were near zero wind speed. Similar reductions were seen immediately downwind 

of the catalyst warehouse, the trailer area, and other buildings in the area. 

H.10.2 Source Term 

Table H-2 shows data used for the release rate of liquid hydrocarbons from the blowdown stack. The 

release was determined to be liquid at the release temperature, so any vapor formation would occur as that 

liquid interacted with the environment. The PHAST model was used to determine the rate of production 

of flammable vapor due to interaction with the environment, as FLACS lacks the ability to determine the 

rate of vapor production from a liquid release. FLACS was then used to determine the dispersion of a 

gaseous source into the complex 3D domain. 
BP Texas City Final Investigation Report 3/20/2007 

275

Table H- 2. Source term release and material property data 

Release Information 

Release Duration (start till ignition) 106 seconds 

Average Flow Rate 177 kg/sec 

Total Quantity Released 18,800 kg 

Release Temperature 317 to 320 K 

Release Mixture Components (Weight Fraction) 

n-pentane 0.0383 

i-pentane 0.0263 

n-hexane 0.1519 

i-hexane 0.2950 

n-heptane 0.3072 

n-octane 0.1300 

n-nonane 0.0409 

n-decane 0.0104 

Mixture Properties (317 K, 1 atm) 

Average Molecular Weight 93.7 kg/k-mol 

Physical State Liquid 

Boiling Point 347 K 

Liquid Density 642.8 kg/m3

H.11 PHAST Modeling 

PHAST Version 6.5 was used to determine the fraction of liquid release that evaporates during the fall 

and the fraction that “rains out” reaching the ground to pool. The input parameters used in the model are 

listed in Table H-3. 

Table H- 3. PHAST input parameters 

Fluid Mixture (using weight fractions from Table G.1) 

Model Line Rupture Model 

Temperature 317 K 

Pressure 200 Pa 

Pipe Length 23.3 m (stack length) 

Internal diameter 0.8255 m 

Release Elevation 35 m (top of blowdown stack) 

Atmospheric Conditions 80°F 

70 percent relative humidity 

5 mph wind 

Class A stability 
BP Texas City Final Investigation Report 3/20/2007 

276

The results from the PHAST modeling are shown in Table H-4. 

Table H- 4. PHAST model results 

Mean Droplet Size 0.919 mm 

Maximum Droplet Horizontal Trajectory Approximately 6.5 m (21 ft.) 

Liquid Rainout Fraction 0.55 

Droplet Evaporation Rate 78.3 kg/sec 

Pool Characteristics Radius 13 m at 68 seconds, evaporation rate 1.6 kg/sec 

Radius 24 m at 90 seconds, evaporation rate 5 kg/sec 

Radius 27 m at 106 second, evaporation rate 6.8 kg/sec 

The droplet evaporation rate of just over 78 kg/sec is significant, as it indicates significant vapor 

formation during free-fall of the droplets. Another mechanical breakup mechanism is the impact of the 

falling liquid on elevated equipment below the blowdown drum (pipe racks, vessels, grating, decks, and 

ladders). A survey was used to determine the ratio of horizontal area of elevated equipment to the area of 

the ground as a function of radius away from the blowdown drum. Near the stack of the blowdown drum, 

the ratio is 100 percent due to the configuration of blowdown drum itself; otherwise it varies between 30 

to 50 percent. The PHAST results indicate a horizontal drift around 20 feet (6 m); therefore, a substantial 

portion (approximately 30 percent) of the falling droplets would impact elevated equipment, resulting in 

spray. The height above the ground that liquid drops would be impacting equipment varied, but typically 

ranged from 15 to 30 feet (4.5 to 9 m). Liquid droplets impacting elevated equipment would produce 

multiple smaller drops, which in turn would increase evaporation. 

H.12 Pool Evaporation 

A portion of the liquid release from the blowdown stack “rained out” onto the ground and on elevated 

objects near the drum. As Table F-3 notes, the PHAST model included the effects of pool evaporation due 

to the rain-out fraction of the liquid. For a liquid release at 317 K, PHAST determined a pool temperature 

of approximately 285 K, which is a result of evaporative cooling and heat transfer to the droplets as they 
BP Texas City Final Investigation Report 3/20/2007 

277

fall to the ground. This cooling effect strongly influences the eventual pool vapor contribution; thus, the 

contribution of evaporation from the ground pool is much smaller than that predicted for evaporation 

during droplet fall to the ground. Of course, additional evaporation would have occurred from elevated 

equipment items wetted by rainout. As elevated equipment is made of metal, and some of it also had hot 

process fluids or steam flowing through it, it will likely have a significantly higher heat transfer rate than 

the ground. Consequently, the contribution of this equipment to liquid droplet evaporation is likely to be 

much greater than simply the ratio of the area. 

H.13 FLACS Vapor Dispersion Modeling 

A large domain was chosen that exceeded the expected extent of the flammable dispersion. The domain 

was also large enough to address sizeable objects around the perimeter of the ISOM unit that would affect 

wind patterns and ultimately dispersion of flammables. Steady-state wind conditions, as described, were 

established prior to beginning the dispersion of flammable materials. The dispersion grid was set at 1 

meter in the X, Y, and Z directions for the bulk of the model. A tighter grid was chosen at low elevations 

where the heavy flammable vapor cloud was expected to settle. The CFD modeling attempted to simulate 

the release conditions and source terms described previously. The CFD model included several vapor 

source terms that represent vapor generated from evaporation of falling liquid, vapor generated through 

evaporation when liquid interacted with elevated equipment, and vapor generated by evaporation from 

liquid pooled on the ground. The numerically discrete nature of CFD allows specifications of definite leak 

locations; therefore, vapor sources were placed in the model at various locations to represent potential 

sources. A total of 16 discrete “leak” locations were selected that would be vapor sources in the model, 

including four sets, placed at various elevations, of four leaks located about the perimeter of blowdown 

drum. A parameter study that varied the rate of vapor generation for the source terms was then conducted 

and comparisons made against field data and observations. A comparison (Figure H-3) shows reasonable 

agreement. 
BP Texas City Final Investigation Report 3/20/2007 

278

Figure H- 3. Cloud extent comparing field observations (red line) to dispersion modeling 

H.13.1 Results 

The FLACS dispersion modeling revealed several key items regarding the extent of the vapor cloud: 

• Significant amounts of flammable vapor spread around the double-wide and QA/QC trailers. This 

area was not downwind of the blowdown drum and stack and, therefore, migration into this area 

was not intuitive. This cross-wind migration was probably the result of a) wind patterns predicted 

by modeling indicated a relatively quiet region between blowdown drum and the double-wide 

trailer where all the fatalities occurred; b) the portion of the flow attempting to move upwind 

(toward the northwest) is redirected, including some toward the trailers; c) the pipe run is at a 

lower elevation in relation to the concrete slab on which the ISOM was built, and thus gravity 
BP Texas City Final Investigation Report 3/20/2007 

279

attracted the heavier than air flammables in that direction. 

• Dispersion modeling places flammable vapors over a significant portion of the pipe run and is 

consistent with field observations and eyewitness statements. 

• Dispersion modeling places flammable vapors around vehicles parked between the catalyst 

warehouse and the pipe run, which is constant with field observations and eyewitness statements. 

• Dispersion modeling places flammable vapors at the south end of the ISOM unit, which is also 

consistent with field observations and eyewitness statements. 

H.14 Explosion Modeling Methodology 

FLACS was also the tool used to model the explosion of flammable vapor cloud in the ISOM unit and 

surrounding areas. The explosion modeling examined two scenarios: the global events involving 

combustion of the entire flammable cloud, and the propagation of the flame-front through the pipe run 

and under the double-wide trailer. Attempts were made to simulate burning of the dispersed, nonhomogenous cloud taken directly from the dispersion output; however, this could not be accomplished 

with FLACS. Instead, the explosion analysis used a uniform stoichiometric vapor cloud covering similar 

areas in and around the ISOM unit using a cloud volume estimated by FLACS based on cloud size and 

amount of congestion in the area. 

H.15 Vapor Cloud Formation 

Typical dispersion models assume that a low-momentum, sub-cooled liquid release falls to the ground 

with minimum vaporization. The resultant ground-level pool, formed from the low volatility liquid, 

simultaneously spreads and vaporizes by forced or free convection evaporation and forms a flammable 

mixture with air. The evaporation rate depends on several factors: the area of the liquid exposed to air, the 

velocity of the airstream moving over the spill, the temperature and humidity of the air, and the physical 
BP Texas City Final Investigation Report 3/20/2007 

280

properties of the spilled liquid. 

Much of the ground area near the blowdown drum was covered by vertical or horizontal equipment, pipe 

racks with multiple pipes, concrete pads with curbs, etc., and there was only a limited, flat horizontal area 

in which a pool of liquid could form and spread in a concentric circle; thus, correlations used to determine 

the mass of the flammable vapor cloud for a fixed period due solely to evaporation from a large ground 

pool would not necessarily apply. Based on the wind direction at the time of the incident and eyewitness 

accounts, the CSB believes that substantial portions of the hydrocarbon liquid released from the stack 

cascaded down the stack and drum or fell onto nearby process equipment. Using a 3D CAD drawing of 

the blowdown drum and stack and surrounding equipment, the CSB estimates that only 40 percent of the 

liquid spewing from the stack would have landed directly on the ground to create a liquid pool at the base 

of the blowdown drum. 

The CSB believes that the evaporation of the hydrocarbon liquid droplets and the formation and 

dispersion of the flammable vapor cloud could approach that resulting from the mechanical breakup of a 

high momentum sub-cooled liquid release. The liquid cascading down the drum and stack and the 

smashing impact of falling liquid onto process equipment, structural components, and piping promoted 

fragmentation into relatively small droplets, thereby enhancing the evaporation and formation of a 

flammable vapor cloud. The CSB notes that this effect was similar to the evaporation mechanism cited in 

the incident investigation analysis of a recent large gasoline spill in the United Kingdom (HSE 2006a, 

2006b). Some contribution would also be made to the flammable vapor cloud due to forced convection 

evaporation from the expanding ground-level liquid pool. Evaporation of liquid from wetted process 

equipment, structural supports, and the surfaces of pipes--especially if they were above ambient 

conditions--also likely contributed to the formation of the flammable vapor cloud. The atmospheric wind 

then pushed the vapors and small droplets downwind, causing them to mix with air. The wind direction at 
BP Texas City Final Investigation Report 3/20/2007 

281

the time of the incident was reported to be out of the northwest traveling southeast and the burned area is 

elongated in that direction. 

The second dispersion mechanism results from the expansion of the flammable vapor cloud ahead of an 

approaching subsonic frame-front. Such a flame-front pushes vapors ahead of it, like a piston, and causes 

the flammable vapor cloud to expand from its pre-ignition size and the flammable vapors to mix with air. 

If congestion (process vessels, pipes, structural supports) is present in areas ahead of the flame-front, 

turbulence is generated as vapors move through this congestion, which promotes mixing of the vapor with 

air; consequently, the flame-front will burn faster once it reaches this area and generate greater pressure. 

The CSB, which estimated that the size of the vapor cloud expanded about 12-15 percent, developed a 

computer simulation of the dispersion and expansion of the vapor cloud, which can be viewed or 

downloaded from the agency’s website. www.csb.gov.

H.16 Ignition Locations 

Four ignition locations were examined: 

1. A diesel truck located at north end of the ISOM. Eyewitnesses reported that this truck, which was 

idling, began over-revving and ignited the vapor cloud. 

2. A switchgear building near the blowdown drum in the northwest corner of the ISOM unit. 

3. An operating furnace at the southwest corner of the ISOM. 

4. A diesel truck parked immediately north of a contractor trailer in the south end of the ISOM unit. This 

vehicle was found to have the ignition key in the “on” position, the hood panel blown off, and the air 

intake disrupted. 
BP Texas City Final Investigation Report 3/20/2007 

282

All ignition locations were relatively in the open. The model runs showed that the initial burn rate was 

relatively slow for all ignition locations due to lack of congestion near the ignition points, and that the 

flame-front accelerated upon encountering congestion. The two south-end ignition scenarios (3 and 4) 

were eliminated, as the blast modeling did not predict the overpressure patterns, known to have occurred 

based on the structural analysis, in the south region of the ISOM. Some of the highest overpressures 

recorded were observed at the hydrogen compressor station; model runs indicate that ignitions at points 3 

and 4 would be unable to generate adequate overpressure in this region to explain the observed damages. 

An ignition at locations 1 or 2, and at the north end of the ISOM unit, resulted in blast patterns consistent 

with observed structural damage. 

A close examination of ignition location 2, the switchgear building, showed that it did not display 

significant evidence of an interior explosion, as any internal ignition of flammable vapors that had entered 

the building would have resulted in pressure buildup inside until wall and roof panels released and were 

thrown outward in all directions. Only some of the damage to the switchgear building is consistent with 

an internal explosion; however, all the damage is consistent with a blast wave, principally from the 

southwest, reaching the building. The south wall was destroyed and pushed inward and the southernmost 

cabinets were heavily damaged on the south face of the building. The north wall was pushed outward. 

The east wall was intact and found leaning inward against the east row of electrical cabinets. The west 

wall was destroyed and the bulk of the wall panels were thrown into the pipe rack running north to south, 

between the ISOM unit and the trailer area. The roof was destroyed and the bulk of the roof panels were 

recovered in the Pipe Run to the northwest. The observed damage pattern was not uniform, but was in fact 

directional. Additional structural deformation patterns were identified that indicated that the damage to 

this building was from a blast generated to the southwest and in the ISOM unit. Thus scenario 2 is 

eliminated as an ignition point. Therefore, scenario 1 remains the likely candidate and is consistent with 

all observed structural damage; however, the modeling alone cannot confirm this as the ignition point. 
BP Texas City Final Investigation Report 3/20/2007 

283

H.17 Additional Explosion Modeling 

By performing additional explosion modeling using FLACS, the CSB was able to closely look at the 

propagation of the flame front through the pipe run and around and under the double-wide trailer. The 

additional modeling investigated the impacts of the pipe run and trailer on local flame speed and 

associated blast pressures. To do this detailed modeling, the region around the pipe run and double-wide 

trailer were specifically modeled with a smaller mesh than that used in the large domain model. Ignition 

of the flammable vapor was initiated to the east of the pipe to simulate a flame exiting the west edge of 

the ISOM unit. 

H.17.1 Results 

Modeling indicates that the explosion event (from initiation to blast-generating flame-front passing 

through the entire flammable cloud) lasted about four seconds. After the vapor cloud had ignited, a 

relatively slow flame spread in an uncongested area. Upon reaching a more congested area north of the 

ISOM unit, flame-front speed increased and varied in intensity as the flame moved in and out of 

congested and/or confined areas. After the explosion, a large rising fireball persisted, burning fuel 

uninvolved in the initial explosion. 

The explosion pressures from the blast modeling are generally consistent with values calculated by 

structural analysis of damaged indicators. The highest pressures recorded were in localized areas of the 

ISOM unit with high levels of congestion. The most predominate was the hydrogen compressor deck, 

where 10 or over psi was likely experienced. Blast modeling generally indicated that the bulk of the 

ISOM unit experienced overpressures in the range of 2.0 to 5.0 psi. Pressures as high as 2.0 psi were 

experienced at the catalyst warehouse, six-pack trailer area, and Avenues F and G. A 1.0 psi pressure 

extended into the NDU and to the first layer of storage tanks south of Avenue G to the south edge of 

ULC. The west edge of the NDU second layer of tanks south of Avenue G, south portions of the UCU-1 
BP Texas City Final Investigation Report 3/20/2007 

284

and ARU-1, and western edge of ARU-2 reached 0.5 psi (Figure H-2). 

The pipe run influenced flame movement across the region between the ISOM and trailer area, and 

prevented any significant reduction in flame speed, as would have occurred in an open field. Further, the 

congestion and confinement of the trailers, nearby vehicles, and nearby equipment likely supported 

locally high flame speed and corresponding high overpressures (approximately 2.5+ psi). Hence, the 

physical separation between the trailer area and the ISOM unit did not reduce the blast pressures, as 

would be the case in an open field. 
BP Texas City Final Investigation Report 3/20/2007 

285

APPENDIX I: Historical data on 19 raffinate unit startups 
BP Texas City Final Investigation Report 3/20/2007 

286

APPENDIX J: Ineffective and Insufficient Communication 

J.1 What is Effective Communication? 

Basic communication consists of a sender (the one with the information); the message (the information 

itself); the receiver (the one who obtains and processes the information); and the method(s) used to 

communicate the message. 

Research shows that verbal communication is most effective for creating a shared understanding of 

information because it allows for two-way transference of data. Face-to-face communication affords the 

receiver the opportunity to reiterate the information, ask questions, and have ambiguous data clarified. It 

also allows the sender to confirm that the information was transmitted correctly and to resubmit the 

message if necessary. Written communication may be less effective because it lacks this immediate 

feedback. However, because repeating information increases the likelihood of comprehension, multiple 

methods of communication are essential in ensuring that accurate, unambiguous data has been transferred. 

Feedback is associated with more accurate information sharing, but is more time-intensive than other 

methods of communication; that is, it takes more time to verbally share information and allow for 

feedback from both parties than it does to pass a message through other channels, such as written. But 

written messages are especially necessary for critical unit operations, where the information 

communicated could play a significant role in preventing or causing a catastrophic incident. 

CCPS (2004) produced a safety alert on ways to improve process safety through effective 

communication. Additionally, the U.K. Health and Safety Executive published a literature review of 

effective shift turnover (Lardner, 1996). Both documents conclude that communication is most effective 

when it includes multiple methods of communication (both verbal and written); allows for feedback; and 

is emphasized by the company as integral to the safe running of the units (Lardner, 1996; CCPS, 2004). 
BP Texas City Final Investigation Report 3/20/2007 

287

BP’s Grangemouth refinery in the United Kingdom came to the same conclusion after examining shift 

communication at its facility in the early 1990s. 

J.2 BP Grangemouth Refinery Study on Effective Communication

The Grangemouth refinery studied safe communication at shift handover, which was presented at an 

ICHEME conference in 1995 (Adamson, 1995). The data collected resulted in a site-wide initiative to 

modify and enhance shift turnover activities to encourage more effective communication, particularly 

during times of abnormal plant conditions where risk of a miscommunication leading to a incident are far 

greater than during time of normal operation. The study looked to answer the question: “What verbal and 

written information should be included [during a shift turnover,] and how should this be communicated 

effectively?” (Adamson, 1995). 

This study revealed that while operators communicated both verbally and via logbooks, the type of 

information being shared was not always complete and efficient. Logbooks were unstructured (lined 

notebooks) and operators did not receive guidance on the type of information that should be passed. 

(These conditions paralleled those of the BP Texas City refinery, particularly for the ISOM unit.) 

Operators used different styles and formats; some wrote a lot, others hardly at all. The logbooks were 

mostly historical records and little information was collected on what should be done in the future. No 

data on safety issues with the unit were written in the logbooks. While shift handover was discussed 

during new operator training, because no structured guidance was given, BP was unable to adequately 

judge trainees’ ability to effectively communicate between shifts. 

From this data, BP developed training that emphasized the importance of both the sender and receiver in 

effective communication and that increased operators’ perceived responsibility in the two-way 

transmission of information between shifts. Structured logbooks – created with the help of the actual 

operators – were implemented. These new logbooks contained required categories of information, 
BP Texas City Final Investigation Report 3/20/2007 

288

including safety, maintenance and technical problems, work outstanding, comments/remarks, and 

signatures of logbook authors. The study found that these new logbooks resulted in several improvements 

in written communication: “More information on maintenance and technical problems was being 

recorded, safety issues were being flagged up and timings of events were being recorded more 

consistently. Furthermore, the information contained in the logs was easier to access and read” (Adamson, 

1995). The structured logs also acted as a memory aid and helped operators know what information was 

important to communicate to oncoming staff. 

J.3 Summary 

In complex and critical process systems, multi-channel communication with feedback provides the best 

opportunity for operators to establish and maintain a mutual understanding of the process unit and its 

expected future state. During times of abnormal operating conditions, such as unit startup, the risk of 

operators having dissimilar or incompatible understandings of the state of the process unit is even greater, 

making effective communication vital and feedback essential (Lardner, 1996). 
BP Texas City Final Investigation Report 3/20/2007 

289

APPENDIX K: Design of the AU2/ISOM/NDU Control Board 

The control board for the ISOM/NDU/AU2 complex (Figure K-1) consisted of eight computerized 

control board monitor screens, four of which could be subdivided into four smaller display windows, for a 

total of 20 screen windows. Additionally, four additional monitors (two on either side of the eight monitor 

screens) displayed the critical unit alarms. 

Figure K- 1 The computerized control system for the AU2/ISOM/NDU complex 

 Three of the smaller screen windows were reserved strictly for alarm data (one for each unit). Each was a 

historical (chronological) record of the alarms; the alarm data displayed on these three screens could also 

be sorted by alarm priority type (low, high, emergency/critical). Additionally, the board operator was 
BP Texas City Final Investigation Report 3/20/2007 

290

responsible for monitoring four more screens that provided critical alarm data (see numbered screens in 

Figure K-1). One alarm enunciator screen was specifically for the ISOM unit, one was for the NDU, and 

the two remaining were for the AU2 unit. Each alarm screen displayed a matrix of the critical alarms for 

its designated unit. If a critical alarm sounded, the color of the alarm changed and blinked to visually 

warn the board operator. All screens were operational at the time of the March 23, 2005, incident. Besides 

the three-quarter screen windows containing alarm information, what was actually viewed on each of the 

remaining 16 computerized control board monitor screens varied based on board operator’s judgment. 

Each unit had several screen pages that depicted schematics of different portions of the unit, as well as an 

“Overall” screen page that would generally depict the whole unit system, but would lack the detail the 

other screen pages provided. The raffinate section, for example, had several screen pages that could be 

brought up to monitor different sections or equipment of the process unit. These screen pages were 

originally developed by the computerized control system provider and then modified based on 

engineering and operations personnel input. 
BP Texas City Final Investigation Report 3/20/2007 

291

 

APPENDIX L: Staffing Concerns 

Texas City refinery operations personnel raised staffing concerns. A 1996 staffing assessment performed 

for all Texas City refinery process units used specific guidelines designed to evaluate minimum staffing 

level requirements during normal (routine) and safe-off operations, and to determine the level of training 

necessary to develop and maintain a knowledgeable workforce. A general observation from the 

assessment was that operations personnel would be unable to safely handle unit upsets with the current 

staffing arrangements.254 But this concern was not addressed any further in the staffing assessment. 

The Steelworkers Union also contended that there was unsafe staffing. In a November 2000 Process 

Safety Committee meeting, the Union presented BP with written documentation expressing employee 

concern over operator staffing. 

Through the Joint Health and Safety Committee, PACE Union 4-449 is notifying the 

company, BP, of its concern on the issue of the complement of operators relative to providing 

adequate staffing levels to assure safe and environmentally sound operations at the Texas 

City Refinery site. Issues include operator staffing levels below the numbers required for 

‘safe off staffing’. This involves the day to day operation of units with less than the minimum 

numbers of operators required. The situations worsen when staffing of extra board decreases 

to the extent of operators working excessive amounts of overtime, which adds worker fatigue 

into potential job performance problems.255

The PSM group was to follow up on the staffing concern, but the grievance was not resolved. This 

concern for staffing reductions came on the heels of an October 9, 2000, BP “Texas City Safety Talk” 

newsletter (disseminated to operations personnel) that reported on a hydrocarbon release incident at BP’s 

254 Amoco 1996 Staffing Assessment 

255 This grievance was reviewed in BP Texas City Process Safety Committee meeting minutes, November 21, 2000. 
BP Texas City Final Investigation Report 3/20/2007 

292

 

Lavera Refinery. One of the lessons learned from the incident was that “[s]ufficient qualified staff with 

diagnostic skills must be available at unit start-ups.”256 

256 BP – Texas City Site Safety Talk, dated October 9, 2000. 
BP Texas City Final Investigation Report 3/20/2007 

293

performance (such as is the case when operating a control room), the U.K. Health and Safety Executive

 

APPENDIX M: Fatigue and Performance 

In section 3.7, the CSB demonstrated that fatigue likely contributed to the Board Operator’s impaired 

ability to deduce that the tower was being filled for three hours without any liquid being removed to 

storage. 

The Day Board Operator was experiencing an acute sleep loss of approximately 1.5 hours per 24-hour 

period for 29 straight days–a sleep debt of 43.5 hours. Performance can be impaired and levels of 

alertness decline with only two hours of sleep loss (Price, 2005; Rosekind et al., 1993). Studies show that 

feelings of sleepiness increased among subjects and led to a decrease in performance on vigilance 

(monitoring) tasks when they had five hours of sleep for seven consecutive nights (Price, 2005; Rosekind 

et al., 1993). This is significant when considering that the Board Operator was maintaining the 5.5-hourper-night schedule for 29 consecutive days. Additional research comparing the effects of fatigue to 

alcohol inebriation finds that two hours of sleep loss produces the same performance detriments as 

consuming two to three beers and a blood alcohol content of .045 percent (Roehrs et al., 2003). And as 

sleep debt accumulates, performance becomes increasingly worse 257: evidence that strongly suggests that 

a 1.5-hour sleep loss for about a month would impair the mental performance of the Day Board Operator.

M.1 Research on the Performance Effects of the 12-Hour Shift 

Often in industries that run on continuous schedules, the tendency is to staff a 24-hour period with two 

12-hour shifts, which much of the workforce likes (as opposed to 8 or 10 hour shifts), as they receive 

more time off from work and reduce time spent commuting. However, the 12-hour shift negatively affects 

employee performance and subjective fatigue (Rogers et al., 1999). In a study on multiple task 

257 “Analyzing for Fatigue in Road Accidents,” BP document developed by P. Gander. 
BP Texas City Final Investigation Report 3/20/2007 

294

nts 

rease the 

The cumulative sleep effects the Board Operator was experiencing may have also been compounded by 

d 

 

258 found that performance deteriorated throughout a 12-hour shift, even when operators were given 15-

minute breaks every 75 minutes (Rogers et al., 1999). Other studies show that “exceeding the 8-hr 

workday can lead to lower productivity, higher accident rates, and higher absenteeism.... Fatigued 

workers are more likely to experience ‘tunnel vision.’ They are able to focus only on a few instrume

rather than a whole display panel. A tired worker tends to perform very much like an unskilled 

worker.”259 In addition, too many consecutive workdays can lead to accumulated fatigue and inc

risk of fatigue-related problems including ill health, errors, and accidents (HSE, 2006b). And frequent 

overtime has been shown to increase likelihood of an accident at work, which has been demonstrated in

both the coal mining and nuclear power industries (Rogers, 1999). 

the starting hour of his shift. The Health and Safety Executive published its results from a questionnaire 

study on fatigue in a variety of industry settings, including nuclear processing and off-shore installations.

The Health and Safety Executive found that subjective levels of fatigue increased with consecutive early 

shifts (those starting around 6:00 a.m.). The third day of working an early morning shift resulted in a 30 

percent increase in fatigue, while the fifth consecutive day of working early morning shifts resulted in a 

60 percent increase in fatigue, and the seventh consecutive day resulted in a 75 percent increase compare

to the first day. Individuals also reported that they needed one day off to recover from three consecutive 

early-morning shifts and two days off to recover from five consecutive early shifts.260 For 29 days 

straight, the Day Board Operator’s shift began at 6 a.m. 

258 The Health and Safety Executive is Great Britain’s enforcement authority (in conjunction with local 

governments) for the Health and Safety Commission, a governing body responsible for regulating health and 

safety in the workplace. 

259 Labor Occupational Health Program, U. of CA, Berkeley, “Human Factors Curriculum for Refinery Workers.” 

260 Ibid. 
BP Texas City Final Investigation Report 3/20/2007 

295

 

M.2 BP’s Fatigue Policy 

Despite not having an operator fatigue-prevention program, BP Group does have a method to analyze 

fatigue in road accidents involving its truck drivers.261 BP Group documentation on vehicular fatigue 

incident investigations, which references NASA’s and NTSB’s methodology, states that when multiple 

fatigue factors are present, a strong argument can be made that fatigue contributed to the incident.262 The 

CSB agrees and believes that the Day Board Operator–and likely the entire operations crew working the 

turnaround schedule–was significantly fatigued on March 23, 2005. Using NASA and NTSB 

methodology, the CSB concludes that fatigue of the operations personnel contributed to overfilling the 

tower. 

Opportunities for additional overtime can be driven by economic incentives, required by work rules or 

encouraged; however, it is common for individuals not to realize how fatigued they actually are. 

Therefore, management must recognize and establish a shift work policy to minimize the effects of 

fatigue, and ensure that board operators who must constantly monitor hazardous installations or process 

units take brief, periodic breaks away from their workstation.

261 BP document, Analyzing for Fatigue in Road Accidents, BP document developed by P. Gander. 

262 Ibid. 
BP Texas City Final Investigation Report 

APPENDIX N: Comparison of Hours-for-Service regulations 

Industry/ 

Agency 

Name of 

Policy / 

Standard 

Effective 

Date Applies to: 

Max hrs in 30-

day period 

(on-duty time) 

Max 

hrs/week 

average 

Max hrs/ 

week 

Max hrs/24-

hr work 

period (day 

shift) 

Min. hrs 

rest/off 

between 

shifts 

Max # of 

consecutive 

shifts (day 

shift) 

U.S. Nuclear Regulatory Commission 

Nuclear Power Plant Staff Working Hours (IE Circular No. 80-02 and Generic Letter No. 82-12)** 6/15/1982 

plant operating personnel 72 12 (Note 1) 12 (Note 2) 14 (Note 3) 

Aviation 

14 CFR Part 121/135 

updated in 

1985 pilots 

100 

(flying time) 30/34 

9 (if flight time <8 hr) 10 (if flight time 8-9 hr) 11 (if flight time >9 hr) 

(Note 4)

Marine 

46 U.S.C. 8104 

updates 

1990 and 

1997 

a licensed individual on an oceangoing or coastwise vessel of not more than 100 

 t ~360 (Note 6) 70 

9 (in port) 

12 (at sea) 

Federal Motor Carrier Safety Administration 

49 CFR 395 Hours of Service of Drivers 1-Oct-05 

passengercarrying commercial motor vehicle driver ~260 

60/70 (Note 

7) 

10 (driving) 

15 (on duty) 

(Note 8) 8 (Note 9) Note 7 

296
BP Texas City Final Investigation Report 

Industry/ 

Agency 

Name of 

Policy / 

Standard 

Effective 

Date Applies to: 

Max hrs in 30-

day period 

(on-duty time) 

Max 

hrs/week 

average 

Max hrs/ 

week 

Max hrs/24-

hr work 

period (day 

shift) 

Min. hrs 

rest/off 

between 

shifts 

Max # of 

consecutive 

shifts (day 

shift) 

Federal Motor Carrier Safety Administration 

49 CFR 395 Hours of Service of Drivers 1-Oct-05 

propertycarrying commercial motor vehicle driver ~260 

60/70 (Note 

7) 

11 (driving) 

14 (on duty) 

(Note 10) 10 (Note 11) Note 7 

Rail 

49 U.S.C. 211 Hours of Service; 49 CFR Part 228 

last 

amended 

1988 

signal employees ~440 12 (Note 12) 8/10 (Note 13) 

EU 

Road Transport Directive drivers 

48 (Note 

14) 60 

Pipeline 

There are no Federal regulations for operators or controllers of pipeline systems;However, PHMSA published an Advisory Business unit leaderletin (ADB-05-06) in August 2005 with the following 

pipeline control room operators 12 (Note 16) 10 

UK Dept of Trade and Industry 

Working Time Regulations 

Oct 1998; 

amended 

Aug 2003 

non mobile workers in road, sea, inland 

48 (Note 

17) 11 (Note 18) 
BP Texas City Final Investigation Report 

Industry/ 

Agency 

Name of 

Policy / 

Standard 

Effective 

Date Applies to: 

Max hrs in 30-

day period 

(on-duty time) 

Max 

hrs/week 

average 

Max hrs/ 

week 

Max hrs/24-

hr work 

period (day 

shift) 

Min. hrs 

rest/off 

between 

shifts 

Max # of 

consecutive 

shifts (day 

shift) 

UK Health and Safety Executive 

Inspector's Toolkit: Human Factors in the Management of Major Accident Hazards, section 6, topic 2, Managing fatigue risks Oct-05 

operators working in industries where major accident hazards exist 

avoid more 

than 

50 12 12 

BP Group 

Group Driving Standard Jan-04 

"every BP employee who operates any vehicle on BP business and to all 

BP 

60 80 (Note 20) 16 (Note 21) 

BP Texas City during turnarounds no policy 

Operators and Supervisors 348 - 408 84 12 no limit 

BP Texas City (normal operations) 

no policy; Articles of Agreement between BP 1-Feb-02 

shift workers 

no max given 

no max given 7.5 no limit 

NOTES: 1. 16 during abnormal times or extended periods of shutdown 

298
y Final Investigation Report 

13. After being on duty for 12 consecutive hours, the employee may not go on duty until the employee has had at least 10 consecutive hours off duty; after being on duty 

10. Not to exceed 11 hours of driving after 10 consecutive hours off duty; may not drive beyond the 14th hour after coming on duty, following 10 consecutive hours off d

21. 10 hours total maximum driving time within a 24-hour period; apparently the remaining 6 hours can be used for non-driving tasks, such as loading/unloading/etc. 

12. After being on duty for 12 consecutive hours, the employee may not go on duty until the employee has had at least 10 consecutive hours off duty 

7. May not drive after 60/70 hours on duty in 7/8 consecutive days (later when motor carrier operators every day of the week). 15. This may be exceeded by collective workforce agreements (i.e. by signing an opt-out or derogation from the directive) 

3. Guidance: an individual should not work more than 14 consecutive days without having 2 consecutive days off 4. These are the minimum reset periods in the 24 hours preceding the scheduled completion of the flight segment 6. For a licensed individual on an oceangoing vessel or coastwise vessel of not more than 100 gross tons at sea 

20. 120 hrs/14 days max, subject to a 80 hrs/7 days max; avg of 60 hrs/week over extended period of time 

17. Max average a worker is required to work, though worker can choose to work more if want to 16. Shift not to exceed 12 hours in a 24-hr period except in extraordinary or emergency situations 9. May not drive after having been on duty 15 hours following 8 consecutive hours off duty may not drive after having been on duty 15 hours following 8 consecutive hours off duty" 8. “Not to exceed 10 hours of driving following 8 consecutive hours off duty 11. Not to exceed 11 hours of driving after 10 consecutive hours off duty 14. Usually averaged over 4 months; can be averaged over 6 months 5. Hours of service requirements vary depending on type of vessel 

 employee must have at least an 8-hour rest period 

2. 8 during abnormal times or extended shutdown 18. A right to 11 hours rest a day 

BP Texas Cit

19. Average 
BP Texas City Final Investigation Report 3/20/2007 

300

 

APPENDIX O: Operator Training 

The hazards of unit startup were inadequately covered in operator training and did not prepare the Board 

Operator for the tasks he was responsible for on the day of the incident. This insufficient training was 

compounded by the lack of annual performance appraisals, individual skill development plans, and 

abnormal situation management simulator training. BP provided only basic general training to its 

operators. 

O.1 BP Board Operator Training 

BP Board Operator Training consisted of a five-week Basic Operator Training course, a two-day generic 

troubleshooting course, computer-based tutorials, and on-the-job training. 

O.1.1 Five-Week Basic Operator Training 

Basic operator training (BOT)263 was provided to newly hired individuals and covered a wide range of 

general refinery operations topics and operator responsibilities. Operators went through BOT prior to 

2002; the Day Board Operator working on March 23 had received this training, which consisted of a 

review of BP standards, guidelines, safety booklet, and computer-based training. The CSB found no 

evidence to suggest that the training covered material balance calculations or the hazards of high liquid 

level in splitter towers. 

O.1.2 Two-Day Troubleshooting Course 

All operators also took a two-day troubleshooting course (which the Board Operator on March 23 had 

completed) or graduated from a college program that covered troubleshooting. However, BP did not 

263 At the time of the incident, the five-week BOT training was no longer offered at BP Texas City; the new-hire 

training had been shortened to 8 days. The company’s rationale for the cut in training time was the requirement to 

hire only experienced operators or individuals who have attended process technology school. 
BP Texas City Final Investigation Report 3/20/2007 

301

 

require operators to take a refresher troubleshooting class after this first one, even years later.264 The 

troubleshooting course was not unit-specific, nor did it discuss issues critical to unit startup, such as 

calculating material balance or the hazards of high liquid levels. 

O.1.3 On-The-Job Training 

On-the-job training consisted of a board operator-in-training working shifts with a Process Technician 

(PT); abnormal situations, like unit startup or unit upset, are less likely to be covered in this type of 

training. When training is focused on what is taught on-the-job, the operator will be prepared to deal only 

with problems or issues that come up during those shifts (API, 2001). But abnormal situations require the 

most skill, knowledge, and critical thinking. And an operator’s ability to perform optimally on infrequent 

tasks will deteriorate over time if those tasks are not performed (or at least practiced) routinely. 

O.1.4 Computerized Training Program 

BP’s computerized training program required operators to read through a policy or procedure, then take a 

multiple choice test to determine if they had learned the information. The questions were factual in nature, 

not theoretical. For example, a question that asks what an LAH-5006 alarm indicates does not provide 

knowledge/reasoning on the alarm’s importance, nor does it provide the operator with the engineer’s 

design intent. Training that answers the question “why?” for the critical actions the operator is responsible 

for will help develop operator understanding of the unit and thereby improve troubleshooting capabilities. 

An understanding of the process unit, how it runs and why, and not just the memorization of facts, make 

operators better able to deal with abnormal situations.265 

264 Interview testimony of the head of the Learning & Development department at the time of the incident. 

265 Trevor Kletz, as quoted in Labor Occupational Health Program, U. of CA, Berkeley, in Human Factors 

Curriculum for Refinery Workers. 
BP Texas City Final Investigation Report 3/20/2007 

302

 

O.2 Training Certifications 

In April 2004, the Day Board Operator was certified that he had the necessary knowledge to conduct unit 

startup, when a PT tested him verbally. Prior to that certification, the last time the Day Board Operator 

received refresher training on ISOM unit startup was when he took a computerized training course 

February 16, 2000. Most raffinate-specific training was last reviewed in 1993.266

The ISOM unit board operators and PTs were collectively behind in their training. According to company 

records, at the time of the incident not one board-certified individual had completed more than 44 percent 

of training.267

According to BP’s “Guideline for Assessing Minimum Unit Staffing Levels to Meet Process Safety 

Requirements,” operators were expected to spend five hours per year reviewing startup and shutdown 

procedures as part of their normal operating duties.268 The CSB concludes that, due to the hazards of unit 

startup and the increased likelihood of incidents at such a time, this amount of time for startup/shutdown 

procedural review is insufficient. 

No Standard Operating Instructions (SOIs) existed for the Board Operator position at the time of the 

March 23, 2005, incident,269 and the training materials specific to the board operator position were limited 

in scope and detail. When the MOC was conducted for the addition of the NDU responsibilities to the 

AU2/ISOM board operator, an action item was to develop a training plan for the board operator position 

in accordance with SH-PSM-5, “Training for Process Safety.” The resolution to this action item was to 

add the NDU training requirements to the board operator training matrix, which merely outlines the 

266 TXC Refinery Team Status Report, VTA Report, through March 23, 2005. 

267 TXC Refinery Team Status Report, VTA Report, through March 23, 2005. 

268 “Guideline for Assessing Minimum Unit Staffing Levels to Meet Process Safety Requirements,” June 3, 1996. 

269 BP response to CSB doc request 34, item 39, May 26, 2006. 
BP Texas City Final Investigation Report 3/20/2007 

303

 

process safety standards, guidelines, and training guides that the board operator is required to read and 

understand. 

The 1998 Memorandum of Agreement between the company and the Union states that operators are 

expected to “satisfactorily complete the process unit, regulatory, and refinery training requirements” and 

that “with [the] Supervisor, jointly identify plan to develop and enhance skills to optimize job 

performance.”270 Many of the operators, including the Day Board Operator, had not completed their 

training, and none of the ISOM/AU2/NDU unit operators had performance plans in place. 

Board operator training did not adequately cover abnormal situation management; as a result, the Board 

Operator was ill-prepared to lead a raffinate unit startup. Workers must develop an accurate and in-depth 

understanding of how the process system works to diagnose process upsets and understand the 

consequences of their actions, and “the only way such an understanding can be built is for operators to be 

thoroughly trained not only in what or how to do something but also in why to do it” (API, 2001). 

270 HiPRO Memorandum of Agreement between BP Texas City and Pace, no. 4-1 (1998), page 127. 
BP Texas City Final Investigation Report 3/20/2007 

304

 

APPENDIX P: Distraction Not a Contributing Factor 

Early in the investigation, evidence suggested that distraction may have also contributed to the three-hour 

delay in sending heavy raffinate from the tower out to storage. These factors were investigated, and the 

CSB determined that distraction did not likely contribute to the incident. 

At approximately 12:45 p.m., a safety meeting was held in the central control room immediately adjacent 

to the control board. Approximately 25 people attended this weekly meeting, including operators, 

engineers, supervisors, and the superintendent. The meeting lasted about 20-25 minutes, breaking around 

1:10 p.m.271 The start of this meeting was at a critical point in the unit startup: the ISOM operations crew 

realized heavy raffinate needed to be removed from the tower and sent to storage at 12:40 p.m. (section 

3.5.7). After reviewing historical alarm data and control board records, the CSB did not find that the 

meeting discussions or activities impacted the Board Operator’s response time to any alarm or instrument 

reading during the meeting. The decisions the operators made prior to (not during) the meeting led to the 

tower overfill. The CSB cannot speculate that the Board Operator would have made any decisions or 

moves on the control board differently had the meeting not taken place. 

Phone calls were an unlikely distraction for the Board Operator. The central control board had two phones 

that the Board Operator was responsible for answering. Based on phone records, 28 calls were received or 

made between 6:25 a.m. and 1:20 p.m.; only 15 were made between the critical time period of 10:00 a.m. 

and 1:20 p.m. The longest of these 15 calls was 2 minutes, 6 seconds; 11 of the 15 calls were less than 1 

minute. Phone calls labeled “potential distractions” in other published reports were not a significant 

distraction for the Board Operator on March 23, 2005. These calls were actually made by individuals 

uninvolved in the ISOM unit startup activities from a different unit control room in another building 

271 Interview testimonies of those who attended revealed that the meeting adjourned at approximately 1:10; this 

contradicts BP’s investigation report, which states that the meeting ended at 1:00 p.m. 
BP Texas City Final Investigation Report 3/20/2007 

305

outside of the AU2/ISOM/NDU complex. Based on this data, the CSB has concluded that the phone calls 

were not a distraction to the Board Operator during unit startup. 

P.1 Possible Distraction Due to Understaffing 

The CSB focused its investigation on the actions and decisions of the Board Operator, because his role on 

the day of the incident has come under the most scrutiny. However, the CSB has noted that a possible 

distraction may have occurred outside the central control room. The one person in the ISOM unit with the 

technical knowledge and experience to assist the Board Operator control the board during the abnormal 

condition of unit startup – the Lead Operator – was distracted with other duties unrelated to startup. The 

Lead Operator was monitoring three different contractor crews, completing authorization-to-work 

documentation, working with others to obtain the gasket for the ISOM reactor section, and training two 

new operators. While he had the familiarity and skill to help the Board Operator troubleshoot unit startup 

issues, his assigned position as an outside operator hindered his ability to do so. In interview testimony he 

admitted that his responsibilities kept him too busy to even attend to the satellite control room board 

throughout the morning. 
BP Texas City Final Investigation Report 3/20/2007 

306

 

APPENDIX Q: Prior Incidents 

In 2004, the Texas City plant manager gave a sobering “Safety Reality” presentation was given by the 

Texas City plant manager to 100 supervisory personnel. The plant manager spoke of the 23 deaths at the 

plant in the previous 30 years; on average, one worker had died every 16 months. In 2004 alone, three 

major accidents resulted in three fatalities. Yet, in 2004, BP Texas City had the lowest OSHA recordable 

injury rate272 in its history, nearly one-third the oil refinery sector average. 

As a result of this history of serious incidents, OSHA listed the BP Texas City refinery in April 2005 

under its “Enhanced Enforcement Program for Employers Who are Indifferent to Their Obligations” 

under the OSH Act. Out of the March 23, 2005, incident, in a settlement agreement, BP paid the largest 

OSHA fine in history of over $21 million. The settlement agreement incorporated 301 willful violations. 

After the ISOM incident, BP experienced additional major incidents at its Texas City refinery. A July 28, 

2005, incident in the Resid Hydrotreating Unit (RHU) resulted in a shelter-in-place for 43,000 people and 

BP reported $30 million in plant property damage.273 An August 10, 2005, release in the Cat Feed 

Hydrotreating Unit (CFHU) also resulted in a shelter-in-place order and $2 million in property damage. 

Then on July 21, 2006, the BP Texas City refinery had an additional fatality in an accident involving a 

motorized man-lift. In the last 32 years, the BP Texas City refinery has had 39 fatalities, one of the worst 

cumulative death tolls of any US workplace in recent history. 

272 The OSHA recordable injury rate is the annual number of injuries and illnesses per 100 full-time workers. The 

OSHA injury rate, which excludes fatalities, is a normalized rate that is used for comparison across industries. 273 The CSB has published a Safety Alert addressing important issues related to this incident, available at the CSB 

website, http://www.csb.gov/completed_investigations/docs/RHUBulletin.pdf
BP Texas City Final Investigation Report 3/20/2007 

307

Q.1 Texas City Blowdown System Incidents 

The blowdown drum and stack have experienced a number of releases resulting in fires or significant 

vapor clouds at or near ground level since its construction in 1953. In 1957, the blowdown drum was 

moved within the ISOM unit to its current location in the northwest corner, according to Amoco’s 

mechanical inspection records “to eliminate a dangerous fire hazard which prevailed under certain wind 

conditions.” The CSB documented eight serious ISOM blowdown drum incidents from 1994 to 2004. In 

two, the blowdown system caught fire; in six, the blowdown system released flammable hydrocarbon 

vapors that resulted in a vapor cloud at or near ground level. 

The CSB determined that the ISOM blowdown stack caught fire twice: once in 1998 and once in 2000. 

On October 4, 1998, the ISOM blowdown stack caught fire during stormy weather, which had caused a 

unit upset. The fire was extinguished by injecting steam into the blowdown system. Amoco management 

did not investigate. In the July 23, 2000, incident, the stack again caught fire, fueled by leaking pressure 

relief valves on the hydrogen driers. Steam, quench water, and a flow of nitrogen gas were opened to the 

blowdown system, but the fire continued over five 12-hour shifts. On the third day, the hydrogen driers 

were shut down and the fire on the blowdown stack extinguished. Texas City managers did not 

investigate. Neither of these two ISOM blowdown fire events was recorded in any incident reporting 

database. 

The CSB determined that six ISOM blowdown incidents from 1994 to 2004 resulted in a flammable 

vapor cloud at or near ground level. These blowdown releases could have been more serious if the vapor 

cloud had found a source of ignition. In February 1994, there were three major releases of flammables 

from the ISOM blowdown stack at the Amoco Texas City refinery. In one, on February 12, 1994, the 

115-foot (35 m) tall DIH tower filled with liquid, which led to the emergency relief valves opening to the 

ISOM blowdown system. A large amount of vapor was seen coming from the blowdown drum; high 
BP Texas City Final Investigation Report 3/20/2007 

308

flammable vapor readings were measured at ground level in the area. The ISOM unit was shut down and 

the plant firefighters responded by fogging the area with fire monitors until the vapor cloud dissipated. 

Leaking DIH relief valves caused a similar incident on February 17, 1994, that resulted in a vapor release 

out of the blowdown stack. The fire crew was called out and placed on stand-by. A section of the ISOM 

was shut down to stop the release. 

Amoco conducted a safety investigation and issued an incident report for the two serious February 1994 

ISOM blowdown releases that identified nine action items; however, four items were not completed. Two 

of the action items called for reviewing the adequacy and the operation of the blowdown system. These 

action items were assigned to the area superintendent but were not signed off as completed, and no 

changes were made to the blowdown drum or stack as a result of the incident. 

Another serious ISOM blowdown incident occurred later that same month. On February 27, 1994, the 

ISOM stabilizer tower emergency relief valves opened five or six times over four hours. A large vapor 

cloud was observed near ground level. The vapor release was reported as an environmental event. In the 

event log, the incident is described as a single relief valve discharge that lasted two or three minutes 

releasing 100 pounds of pollutants. No safety-related incident report was written. 

On May 8, 1995, the 8-inch chain vent valve off the raffinate splitter tower overhead piping was 

inadvertently left open for over 20 hours during a raffinate section startup, resulting in a significant 

flammable vapor release out the blowdown stack. Hydrocarbons vapors were reported as “pouring out” of 

the blowdown drum in the ISOM logbook and high flammable vapor readings were measured at ground 

level. The fire department was called and quench water was started to the blowdown drum. Eventually the 

8-inch overhead chain valve to the blowdown was closed after operations personnel discovered that it was 

open. 
BP Texas City Final Investigation Report 3/20/2007 

309

An environmental investigation indicated that operator error was the cause of the incident. The report 

about the incident stated the 8-inch chain valve should not have been used to vent the splitter tower during 

the startup. The need to vent the tower during startup is acknowledged in the report because “the tower 

pressure easily raises to 45-50 psig, at least three times its normal operating pressure.” An ISOM operator 

mistakenly opened the chain valve all the way when he believed he was closing it. That the valve was 30 

feet (9 m) above the location where it was chain-operated at ground level and just above a solid deck 

made it difficult to visually check the position of the valve. 

The report recommendations addressed procedures and warnings, but not the known hazards of the ISOM 

blowdown drum. Of the seven report recommendations, one called for a review of the startup procedure 

“to minimize/eliminate” the need to use the chain valve vent to the blowdown drum and for improving the 

visibility of the valve to the operator. Despite the report’s admonition against using the chain valve to 

vent the splitter, Amoco managers did not remove the chain that facilitated the use of the valve, tag the 

chain to warn against its use, or reference the hazards of venting to the blowdown system in the startup 

procedure. Rather, after this incident, “open” and “closed” were inscribed at the appropriate location 

where the chain exited the bottom of the decking facing the ground as an aid to operators using the chain 

valve. Witness reports and process data indicate that tower startup overpressure events and the use of the 

chain valve to vent pressure to the blowdown drum occurred in most of the startups in the five years prior 

to the incident. 

No evidence existed that any of the other of the 1995 environmental reports’ recommendations had been 

implemented or safety investigation reports written. Despite the large flammable vapor release, the report 

did not question the safety of the blowdown drum, nor did it reference the previous 1994 blowdown 

incident report written just a year earlier that called for a safety review of the adequacy of the ISOM 

blowdown system. 
BP Texas City Final Investigation Report 3/20/2007 

310

On January 16, 1999, the night crew was conducting a partial ISOM unit shutdown that required draining 

liquid from process equipment into the blowdown system. The draining of a large amount of liquid into 

the blowdown drum resulted in liquid flowing into the sewer system by way of the piping that was 

chained open off the drum to the sewer. The high level alarm on the blowdown drum, below the outlet of 

the piping to the sewer, should have been triggered by the rising high liquid level, but was not. 

Underground sewer boxes designed to hold and separate out liquid hydrocarbons filled and released 

flammable vapors from the box seals, resulting in a significant vapor cloud. The ISOM logbook notes that 

the sewer boxes and blowdown drum “are full of oil.” Operators fogged the area with fire monitors until 

the vapor cloud dissipated. BP management did not report the release as either an environmental event or 

a safety incident. 

On March 25, 2004, the DIH tower pressure relief valves again lifted after a short loss of electric power to 

the ISOM unit, resulting in a significant vapor cloud at or near ground level. Afterward, the process 

equipment was restarted and tower pressure retuned to normal. The incident was recorded as an 

environmental event. The ISOM logbook, and another reporting record, “After Action Review,” stated 

that the relief valves lifted for 12 minutes. However, the environmental reporting records that calculated 

the emissions to atmosphere state a release of 3.35 minutes. One released hydrocarbon component, 

hexane, was reported close (4,015 pounds) to the reportable quantity of 5,000 pounds. BP’s 

environmental emissions calculations note that if the ISOM unit had been connected to a flare header, 

total emissions would have been less than 150 pounds. No incident investigation report or safety review 

of the blowdown drum system was generated as a result of this vapor cloud incident. 

Only two of the eight serious ISOM blowdown drum incidents were investigated as safety incidents, 

despite the observed fires and associated large vapor clouds. Four of the six blowdown vapor cloud 

releases were reported only as environmental events; three of the eight were not reported in any database. 
BP Texas City Final Investigation Report 3/20/2007 

311

To obtain information about prior incidents, the CSB needed to gather data from a variety of sources 

including interviews, logbooks, environmental reports, and fire department records. Other than the 

environmental event log, no central database contained reports on the eight incidents. The two moredetailed reports of the incidents in 1994 and 1995 were given to the CSB months later. 

In 2004, an incident involved a liquid hydrocarbon release out the blowdown stack in the Ultracracker 

process unit adjacent to the ISOM. In the Ultracracker, pressure relief valves opened and would not 

reseat, discharging liquid hydrocarbons to the blowdown drum, and no transmitter existed to signal the 

operator that the pressure was approaching the relief valve set-point. The high level switch on the 

blowdown drum did not activate and warn operators that the drum was rapidly filling with liquid. A 

supervisor observed that “liquid began to spew out of the top of the [blowdown system],” which then fell 

to the ground level. The unit evacuation alarm was sounded. The fire crew responded and fire monitors 

were sprayed to cool the released liquid and disperse the vapor. The process unit was shut down, and 

eventually the relief valve reseated and shut off the liquid flow to the blowdown system. 

The Ultracracker incident investigation did not review or identify the blowdown drum design as a cause 

of the accident. The investigation report focused on operator error and the malfunctioning high level 

switch. The report found that 840 gallons of liquid hydrocarbons were spilled; however, the report did not 

discuss the inadequate drum size or that the stack was open to atmosphere as causes leading to the release. 

Q.2 Raffinate Splitter Tower Upsets During Startup 

BP did not follow its own policy requiring that previous raffinate splitter tower start-ups with high 

pressures be investigated. As Section 3.1.1 describes, nearly three-quarters of all ISOM raffinate section 

startup in the five years prior to the incident involved splitter tower high pressures and levels. BP’s 

environmental reporting procedures required that any event involving the lifting of relief valves to the 

blowdown drum be reported in its incident database. Since 2003, two of the startups had pressure surges 
BP Texas City Final Investigation Report 3/20/2007 

312

 

over the relief valve set-point of 40 psig (276 kPa), likely resulting in discharge to the ISOM blowdown 

system. However, these high pressure events did not trigger an incident investigation. 

The high level events in the previous splitter tower startups should have been investigated. In 15 out of 19 

previous startups, the splitter tower level rose above the range of the level transmitter; in eight, the level 

was above the transmitter range for over one hour. The CSB has determined that in none of these previous 

high level startups did the tower level rise as high as it did during the March 2005 incident. When the 

tower is operated in this condition it becomes much easier to overfill. Overfilling a process vessel can 

lead to process upsets, unit shutdown, or the discharge of flammable liquid to atmosphere. Moreover, as 

discussed in Section 3.9, BP did not designate a safe operating limit for high tower level, despite previous 

incidents such as the February 1994 incident when another ISOM distillation tower, the 115-foot (35-m) 

tall DIH tower, overfilled, leading to a unit shutdown and large release out of the blowdown and stack. 

The previous startups with high tower level were near-miss274 incidents that could have led to a vapor 

cloud explosion if the cloud had found an ignition source. Investigations of these incidents could have 

resulted in improvements to tower design, instrumentation, procedures, and controls. 

274 The CCPS defines a near-miss as “an event in which an accident (that is property damage, environmental impact 

or human loss or an operational interruption could have plausibly resulted if circumstances had been slightly 

different.” (CCPS, 2003, p.437). 
BP Texas City Final Investigation Report 3/20/2007 

313

APPENDIX R: Emergency Relief System Design Analysis 

The CSB reviewed the BP design basis calculations for the installed raffinate splitter tower relief system, 

and had a contractor perform emergency relief design calculations on the raffinate splitter tower to 

determine if it met the requirements of the American Society of Mechanical Engineers (ASME) “Boiler 

and Pressure Vessel Code, Section VIII – Unfired Pressure Vessels,” and other applicable industry 

guidelines, such as API 521 (Fauske & Associates, 2006). 

The BP sizing calculations for the safety relief valves on the raffinate splitter tower were compared 

against those obtained from a digital simulation computer program. The heat and material balance 

differential equations, which describe the transients, and the fluid dynamic equations, which describe the 

flow capacity of an emergency relief system, were solved by numerical integration. The physical 

properties and vapor-liquid equilibrium constants for the materials present were read into the computer 

program from a physical property data file. All physical properties were calculated as a function of 

temperature in accordance with recognized thermodynamic models. Program input and output describing 

the physical situation were checked for consistency and printed to provide a written record of the 

calculations. The mass of each component was also continually checked to ensure a realistic value. A 

variable time step controlled by the rates of temperature and pressure changes was used to maintain 

numerical accuracy for stiff systems. 

The computer program incorporated the American Institute of Chemical Engineers (AIChE); DIERS,

(Fisher et al., 1992; Fisher, 1991) and CCPS (1998) technology for both viscous and non-viscous, 

flashing, frozen, and hybrid two-phase flows through emergency relief devices and pipes. Also included 

were routines to calculate inlet pipe pressure drop and discharge pipe backpressure for choked and subcritical vapor, two-phase, and sub-cooled liquid flows from safety valves and breather vents. The program 

reported choked or unchoked and turbulent or laminar flow through each device and associated inlet or 
BP Texas City Final Investigation Report 3/20/2007 

314

 

discharge pipe, and the first occurrence of safety valve inlet pipe high-pressure drop or discharge pipe 

high backpressure. Warning messages were provided if the emergency relief devices cannot maintain the 

system pressure to meet ASME Pressure Vessel Code and API requirements (ASME, 2001; API, 2000, 

1997, & 1994). 

Based on a review of records from BP, the original design basis of the safety relief valves installed on the 

raffinate splitter tower was the heat input at the production capacity and flow at an accumulation of 1.16 

(process upset/multiple relief devices) of the 70 psig (483 kPa) Maximum Allowable Working Pressure 

(MAWP). When the MAWP of the raffinate splitter tower was derated to 40 psig (276 kPa), the area of 

the safety relief valves was not increased to reflect flow at the lower set pressure, nor was the production 

capacity of the unit reduced. Neither does documentation exist showing that the maximum flow rate of 

the fuel available to the raffinate splitter feed preheater/fractionator reboiler was reduced. 

The relief system design and design basis (controlling case) for the raffinate splitter tower with a MAWP 

of 40 psig (276 kPa) is reflux failure, with a worst credible scenario total loss of condenser cooling at the 

design capacity. Unfortunately, BP used a partial loss of cooling with reflux, rather than the total reboiler 

duty with no reflux, for the recent calculations, resulting in a design error.275 The original emergency 

relief system design for the raffinate splitter with a 70 psig (483 kPa) MAWP does not appear to contain 

this error. 

275 “RV Summary – RV-1001GA” (February 5, 2003). 
BP Texas City Final Investigation Report 3/20/2007 

315

 

The raffinate splitter reboiler duty is rated as 59.6 MM BTU/hr .276,277,278 The raffinate splitter overhead 

condenser duty is rated as 59.4 MM BTU / hr .279,280,281 Using a latent heat vaporization range of 113.3 

BTU/lb,282 the required capacity of the installed emergency relief at an accumulation of 1.16 for the 40 

psig (276 kPa) MAWP would be 525,215 pph. 

API Recommended Practice 521, Section 3, “Determination of Individual Relieving Rates,” and Section 

3.6.2, “Cooling or Reflux Failure – Total Condensing” provide guidance. The design value (wide-open 

capacity) should be used for the process heat input prevailing at the time of relief for condenser failure. 

API 521 suggests in “Fan Failure” (Section 3.6.4) that because of natural convection effects, credit for a 

partial condensing capacity of 20 to 30 percent of the normal duty is often used, and that the capacity of 

the relief valve is then based on the remaining 70 to 80 percent of the duty. 

The raffinate splitter overhead condenser uses a variable pitch fan; if the pitch mechanism fails, cooling 

capacity can be reduced. Failure of the reflux that results from pump shutdown or valve closure will flood 

the condenser, which equals a total loss of cooling. A valve sized for total cooling failure should be used 

for this relief scenario. The relief system design and design basis for the safety relief valves BP provided 

for the raffinate splitter tower with a MAWP of 40 psig (276 kPa) is not conservative and is inadequate. 

Three Consolidated bellows-type safety relief valves were installed (Table R-1) to provide the required 

emergency relief for the raffinate splitter system with the current MAWP of 40 psig (276 kPa), which was 

derated from 70 psig (483 kPa) in 2003 due to corrosion considerations. 

276 Ibid. 

277 “E-1101 HUF Fractionator (in Raffinate Service)” – RV-1001GA” (January 21, 2003). 

278 “Relief Valve Scenarios” – RV-1001GB” (October 20, 2002). 

279 “RV Summary – RV-1001GA” (February 5, 2003). 

280 “E-1101 HUF Fractionator (in Raffinate Service)” – RV-1001GA” (January 21, 2003). 

281 “Relief Valve Scenarios” – RV-1001GB” (October 20, 2002). 

282 “RV Summary – RV-1001GA” (February 5, 2003). 
BP Texas City Final Investigation Report 3/20/2007 

316

Table R- 1. Specifications of safety relief valves installed on the raffinate splitter tower 

Safety Relief 

Valve 

Original Pressure 

Setting (psig) 

Present Pressure 

Setting (psig) 

Inlet Pipe 

Diameter 

(inches) 

Discharge Pipe 

Diameter (inches) 

Valve ID 

4P6 70 40 6 6 RV-1001GC 

8T10 74 41 10 10 RV-1001GB 

8T10 74 42 10 10 RV-1001GA 

The capacity of and backpressure on these safety relief valves were evaluated using a 0.95 coefficient of 

discharge appropriate for a Consolidated bellows safety relief valve, an ASME code capacity reduction 

factor of 1.0, and the API 520 consensus Kb factor to account for the decreasing lift and resultant flow 

reduction of bellows safety relief valves as the discharge pipe backpressure increases. The flow capacities 

were evaluated at 1.16 MAWP values with set pressures of 40 and 70 psig (276 and 483 kPa) (Table R-2). 

Table R- 2. Flow from the safety relief valves on the raffinate splitter 

No Discharge Pipe Header 14-Inch Discharge Pipe Header 20-Inch Discharge Pipe Header 

Tower 

(Top-Mounted SRVs) 

Flow Rate 

(pph)283 Flow Rate (pph) 

% Backpressure Flow Rate (pph) % Backpressure 

Vapor Flow 

(40 psig MAWP) 

416,467 213,339 60.8 378,862 37.0 

Vapor Flow 

(70 psig MAWP) 

 637,441 316,194 61.8 542,942 38.0 

As Table R-2 shows, excessive backpressures of 60.8 percent of the safety relief valve set pressures were 

found for vapor flow from the bellows safety relief valves for a MAWP of 40 psig (276 kPa) and 61.8 

percent for a MAWP of 70 psig (483 kPa). These high backpressures show that the diameter of the 

bellows safety relief valves discharge pipe header should have been 20 inches, rather than 14, for either 

the 40 or the 70 psig (276 or the 483 kPa) MAWP design calculations. 

 

283 @ 1.16 Pset. 
BP Texas City Final Investigation Report 3/20/2007 

317

 

The ASME Code, Appendix M, Para. M-8 states: “The sizing of any common discharge header 

downstream from each of two or more pressure relieving devices that can reasonably be expected to 

discharge simultaneously shall be based on the total of their outlet areas....” This design error should 

have been caught by inspection, during the many PHA revalidations, as part of the OSHA PSM “relief 

system design and design basis” calculations, or when the pressure relief calculations were completed that 

supported lowering the MAWP of the raffinate splitter. 

The raffinate splitter safety analyses, conducted by the contractor who designed the Penex reactors for the 

ISOM unit,284,285 identified that the 14-inch diameter discharge pipe header from the raffinate splitter to 

the blowdown drum was not large enough to handle relief loads, which were calculated based on the full 

reboiler furnace firing rate when reflux is lost. During power, reflux, or condenser failure, the built-up 

backpressure on the raffinate splitter relief valves was found to approach 85 percent of the set pressure. 

The contractor recommended that the instrumentation be modified, but BP never did, nor were the 

calculations rechecked during many subsequent opportunities. 

BP has not provided relief system design and design basis backpressure calculations for the safety relief 

valve discharge pipe header from the raffinate splitter to the blowdown drum, as required by the OSHA 

PSM standard [29 CFR 1910.119(d)(3)(i)(D)]. 

The sizing information286 for the safety relief valve protecting the raffinate splitter reflux drum reflects 

only vapor flow. The reflux drum operation was changed to operate liquid-full. The safety relief valve 

should have been sized for a sub-cooled liquid, or flashing two-phase vapor-liquid flow, instead of vapor. 

284 Untitled (Raffinate Splitter Safety Analysis), Litwin Engineers & Constructors Inc., (undated). 

285 “Raffinate Splitter Relief System”, Litwin Engineers & Constructors, Inc. (October 30, 1986). 

286 “ISOM RV Walkdowns, RV-1002G, Raffinate Splitter Reflux Drum (F-1102) (January 5, 2005) w / 

Attachments. 
BP Texas City Final Investigation Report 3/20/2007 

318

 

The sizing records287 for the safety relief valve that protects the raffinate splitter feed surge drum reflect a 

requirement to install a bellows kit in the safety relief valve to address concern about pressure dropping in 

the outlet piping. The information furnished by BP does not indicate that this change was made. 

The sizing calculations288 for the safety relief valve protecting the raffinate splitter reboiler furnace tubes 

reflect a requirement for flashing two-phase vapor-liquid flow, but have not been furnished by BP. If the 

calculation used for sizing this valve did not consider two-phase vapor-liquid flow -- a possibility due to 

the age of the furnace -- then the effluent system may be incapable of handling the rate and amount of 

liquid likely to be released. 

BP has not furnished calculations justifying the projected release of the vapor flow from the safety relief 

valves on the raffinate splitter tower to the blowdown drum and then to the atmosphere. Dispersion 

modeling should have been completed for discharges from the blowdown drum stack to ensure that a 

flammable vapor cloud large enough to cause damage could not form. 

287 “ISOM RV Walkdowns, RV-1000G, Raffinate Splitter Feed Surge Drum (F-1101)” (January 4, 2005) 

w/attachments. 

288 “ISOM RV Walkdowns, RV-1004G, Raffinate Splitter Reboiler Furnace Tubes (B-1101)” (January 10, 2005) 

w/attachments. 
BP Texas City Final Investigation Report 3/20/2007 

319

APPENDIX S: Raffinate Splitter and Blowdown Drum Instrument History, 

Testing, Inspection, and Analysis 

This appendix contains additional information about the four instruments identified in the CSB’s report as 

causally related to the March 23, 2005, incident at BP Texas City. The contents of the appendix are: 

• A brief summary of the CSB testing and inspection of the instruments. 

• A discussion of the failure analysis and possible failure mechanisms for each instrument. 

• A tabulation of the work history for each instrument, compared with manufacturer 

recommendations. 

S.1 Instruments Involved 

The CSB analysis identified four instruments as causally related to the incident: 

• LT-5100 Raffinate Splitter Level Transmitter 

• LSH-5102 Raffinate Splitter High Level Alarm 

• LSH-5020 Isom Blowdown Drum High Level Alarm 

• PCV-5002 Raffinate Splitter Vent Valve to 3-lb Relief Header 

Additionally, the sight glass associated with the raffinate splitter level transmitter was dirty and unusable. 

S.2 Physical Failure Causes 

The CSB inspected and tested the instruments (above), to determine the causes of their failures. The next 

section discusses the physical conditions that caused the failures, and the systemic failures that allowed 

the physical conditions to occur. 
BP Texas City Final Investigation Report 3/20/2007 

320

 

S.2.1 Description of Instrument Testing 

The CSB tested the instruments and a valve onsite to determine their condition and functionality in their 

post-incident condition. The CSB then removed the instruments and tested, disassembled, and inspected 

them in a third-party shop, following a written protocol. 

S.2.2 Raffinate Splitter Level Transmitter LT-5100 

The raffinate splitter level transmitter is a torque-tube displacement instrument289 that must be calibrated 

for the specific gravity290 of fluid to be measured at the fluid’s normal operating temperature. When the 

raffinate splitter bottoms’ temperature increased on the day of the incident, the specific gravity of the 

fluid in the raffinate splitter dropped below the calibration setting of the transmitter, causing it to read less 

than 100 percent and decreasing even as the tower over filled. 

During field-testing the CSB found the raffinate splitter level transmitter to be functioning with its 

calibration set at a fluid specific gravity of 0.8. At ambient temperature, the transmitter indicated slightly 

less than 100 percent level when the raffinate splitter liquid level was above the displacer (when the 

transmitter was flooded). 

The meter was removed from the raffinate splitter column and taken to a third-party shop for inspection 

and testing. The transmitter was tested using three fluids with different specific gravities. Analysis of 

these tests indicated that the flooded transmitter would read 100 percent level at a specific gravity of 

0.705 (Figure S-1), close to, but slightly higher than the ambient temperature specific gravity of the 

raffinate splitter contents of 0.67. This is consistent with the field test results conducted with the tower 

liquid at ambient temperature. 

289The transmitter measures changes in the net weight of a displacer body due to buoyancy as the liquid level varies 

along the displacer. Once the tower level reaches the maximum height of the displacer body, the buoyant forces 

stabilize; therefore, this type of level sensor is incapable of transmitting levels above 100 percent of its range. 

290 Specific gravity is the relative density of a fluid, compared with water, at a specified temperature. 
BP Texas City Final Investigation Report 3/20/2007 

321

40%

50%

60%

70%

80%

90%

100%

110%

120%

130%

140%

0.30 0.40 0.50 0.60 0.70 0.80 0.90 1.00

Specific Gravity

% Reading

Figure S- 1. Calculated LT-5100 flooded reading versus specific gravity 

The specific gravity of the hydrocarbon liquid in the raffinate splitter tower is strongly temperaturedependent. At 300°F, the temperature in the base of the raffinate splitter when it overflowed, the specific 

gravity is about 0.55 (Figure S-2). As Figure S-1 shows, at a specific gravity of 0.55 the transmitter would 

indicate a level of 78 percent when flooded, which matches the value observed when the raffinate splitter 

tower over-filled. The CSB concludes that the level transmitter was not calibrated for the specific gravity 

of fluid at its normal operating temperature. 
BP Texas City Final Investigation Report 3/20/2007 

322

Raffinate Splitter Contents

Specific Gravity versus Temperature

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

50 100 150 200 250 300 350 400 450

Temperature, F

Specific Gravity

Figure S- 2. Calculated raffinate splitter feed specific gravity as a function of temperature 

The CSB investigators learned that the instrument data sheet, which should have been used for calibrating 

the transmitter, had not been updated since 1975 when the tower was part of a different process with a 

different feed fluid. The data sheet had never been changed to reflect the operating specific gravity in the 

ISOM process; furthermore, instrument technicians responsible for maintaining and calibrating the 

transmitter stated that the data sheets—even if they had been updated—were unavailable to them. The 

CSB learned that these data sheets were filed in an engineer’s office and were not typically given to 

technicians with work orders for instrument calibration. 

The CSB learned from interviews and maintenance records that the transmitter had been noted as 

“troublesome” some months prior to the 2005 turnaround. The CSB investigators found that the isolation 
BP Texas City Final Investigation Report 3/20/2007 

323

valves for the transmitter and associated sight glass had been leaking; and that the transmitter could thus 

not be removed for repair and calibration. While the valves were replaced in the recent turnaround,

291 the 

transmitter was not worked on or calibrated before the unit started up. 

S.2.3 Raffinate Splitter Sight Glass LG-1002A/B 

The CSB investigators observed that the sight glasses for the raffinate splitter were dirty (with stains or 

deposits on the inside of the glass), to the extent that the tower level could not be seen in the glass. 

Operator interviews confirm that the sight glass had been in this condition for years prior to the March 

2005 turnaround. The same leaking isolation valves that prevented the level transmitter repair also likely 

prevented technicians from being able to remove and clean the sight glasses. Again, although the isolation 

valves had been replaced in the recent turnaround, the sight glasses were not cleaned. 

The sight glasses were necessary to properly calibrate the level transmitter and alarms, as only by visually 

verifying the actual level in the tower could operators and instrument technicians verify the accuracy of 

the level instruments. Functioning sight glasses might also have allowed a field check of the column 

level, and warned operators that the level indication was erroneous and the level in the column was above 

the transmitter. 

S.2.4 Raffinate Splitter High Level Alarm LSH-5102 

Plant maintenance records indicate that the high level alarm on the raffinate splitter had been reported as 

not functioning several times in the two years prior to the incident. An instrument technician replaced part 

of the switch for the high level alarm; however, this repair was unsuccessful and the switch continued to 

function improperly. Maintenance workers indicated that the isolation valves for this instrument were 

leaking and further repairs could not be conducted. Plant maintenance records show several closed work 

 

291 Job Note 05-009R, 3/10/2005. 
BP Texas City Final Investigation Report 3/20/2007 

324

orders for this alarm, but maintenance workers stated that the repairs were never completed (one record 

shows no labor or materials was ever charged). Maintenance worker interviews confirm that the alarm 

had not been successfully repaired before the March 23 startup. 

Post-incident, the CSB could not field-test the alarm’s functionality due to the leaking isolation valves. 

Since the leaking isolation valves were also reported by the instrument technicians, the CSB concludes 

that the alarm most likely was not repaired prior to the incident. Shop-testing and -inspection revealed 

that the internal components were worn, misaligned, and binding, which likely prevented the alarm from 

working during the March 23 incident. 

S.2.5 Blowdown Drum High Level Alarm LSH-5020 

Operating data recovered after the incident and operator statements revealed that the high level alarm for 

the relief system blowdown drum did not activate when the level in the blowdown drum reached the setpoint. The CSB found the displacer float for the alarm full of fluid; shop inspection revealed that the float 

had a hole in it. In this condition, the float would likely have either sunk to the bottom of its chamber or 

failed to float at the designed height for the alarm, preventing it from reaching the alarm set-point. 

Damage to other components of this alarm caused by the fire of March 23, 2005, prevented additional 

functionality testing. 

Although the CSB could not conclusively determine when the damage to the float occurred (during 

operation or during the upset and fire on March 23, 2005), laboratory analysis of the fluid in the float 

indicates that the float was filled with water, sediment, and a hydrocarbon mixture with a different 

composition than that of the raffinate splitter feed. The CSB concludes that the hole in the high level 

switch float likely formed prior to the incident. Additionally, the history of problems with the 

functionality of the high level switch reported by operations personnel is consistent with a float defect. In 

response to the reoccurring problems, weekly maintenance was performed to ensure that the switch was 
BP Texas City Final Investigation Report 3/20/2007 

325

working. However, the typical maintenance practice of steaming out the piping connections from the 

switch housing to the blowdown drum would not reveal the float defect. 

LSH-5020 was a designated critical alarm; therefore, it was tested by instrument technicians every six 

months. However, the test method the instrument technicians typically used would not have revealed the 

float defect: they stated that they commonly used a metal rod to push the float up to test the alarm 

(“rodding”), which would not test the functionality of the float. The test method recommended by the 

alarm manufacturer and industry guidance calls for raising the chamber liquid level to check the alarm 

set-point, which would test the functionality of the float (Goettsche, 2005). 

S.2.6 Raffinate splitter 3-pound vent valve PCV-5002 

PCV-5002 was a manually-activated control valve intended to provide a vent path for non-condensable 

gases from the raffinate splitter overhead. These non-condensable materials, such as nitrogen, could 

prevent the condensation of hydrocarbon vapors in the fin fan condenser, causing excessive column 

pressure, especially during startups. The valve was intended to direct vapors to a common vent system 

(called the “3-pound vent”). Operations personnel stated that this valve failed to function during prestartup testing, and that they were aware the valve was not working when the ISOM unit was shut down. 

This forced operators to manually open other valves to vent non-condensable gases during the March 23, 

2005, startup. 

PCV-5002 was a control valve with an air-activated mechanism (actuator) to move the valve stem. The 

valve failed to open in nearly all the attempts during field-testing, but did open to varying degrees through 

successive shop trials, indicating a possible intermittent failure. The CSB was unable to identify the likely 

failure mechanism for this valve; however, several possible failure causes include 

• binding, signal, or motor failure of the valve actuator; 
BP Texas City Final Investigation Report 3/20/2007 

326

• excessive valve stem friction; and 

• leaks in the signal air to the valve actuator. 

The CSB found no evidence that PCV-5002 had been repaired, inspected, or subject to a preventive 

maintenance program in the 10 years prior to the incident. 

S.3 Instrument Inspection and Testing 

The CSB contracted ASBG Consulting, Inc., to inspect, test, and analyze the four instruments the CSB 

identified as causally connected to the March 23, 2005, incident at BP Texas City refinery. All four were 

field-tested to the extent possible, photographed, and examined in-situ, then transported to a third-party 

shop for further testing and inspection. Table S-1 provides a brief synopsis of the work performed. 

Table S- 1. Field and Shop Testing and Inspection Summary 

Tag 

Number Field Testing Shop Testing Inspection 

LT-5100 Calibration testing, measured 

transmitter outputs as the level 

varied in the isolated level bridle 

and sight glass. 

Functional testing similar to field testing 

using a shop displacer chamber and 

sight tube. Tested three fluids with 

different specific gravities (water, low 

sulfur diesel, and Viscor leak detection 

fluid 130 BT.) 

Calibration testing of the transmitter by 

simulating level values using weights. 

Disassembly and 

inspection for 

damage, corrosion, 

plugage, and 

dimensional 

measurement. 

LSH-5102 Functionality testing attempted 

but not completed; isolation 

valves leaked. 

Function tested using shop displacement 

chamber and Viscor leak detection fluid 

130 BT. 

Disassembly and 

inspection of all 

parts. 

LSH-5020 None. Damage due to fire too 

extensive. 

None. Damage due to fire too extensive. Disassembly and 

inspection of all 

parts. 

PCV-5002 Function testing by sending 

signals to valve actuator and 

observing valve movement 

(stroke test.) 

Valve stroke test and bubble test for 

valve leakage. 

Disassembly and 

inspection of all 

parts. 
BP Texas City Final Investigation Report 3/20/2007 

327

S.4 Test Results and Instrument Failure Analysis 

To help identify possible failure causes, the CSB (through its contractor, ABSG Consulting, Inc.) 

developed a fault tree for each instrument failure. From this analysis a list of possible failure causes was 

derived, which were compared to the results of field and shop testing and inspections. Any potential 

causes not supported by the evidence were eliminated. The remaining causes were deemed probable and 

are underlined in the Table S-2. 

Table S- 2. Test results and analysis summary 

Tag Number Test/Inspection Findings Possible Failure Causes 

LT-5100 Transmitter functioned; 

however, it was not calibrated 

for the correct fluid specific 

gravity at normal operating 

temperature. 

Transmitter out of calibration 

Transmitter power insufficient 

Tubing or connection leaking 

Liquid in the tubing 

Pneumatic transmitter out of calibration 

Incorrect pneumatic transmitter setting 

Instrument air piping fails to transmit air to the pneumatic 

transmitter/loss of instrument supply/displacer chamber not 

level 

LSH-5102 Unable to field test (leaking 

valves). Alarm switch failed to 

function during shop testing. 

Switch components misaligned 

and binding. 

Mercury switch wiring to the switch terminals tension 

excessive 

Mercury switch assembly pivot point binding 

Return spring degraded 

Magnetic attraction between the connecting rod and 

mercury switch assembly not broken when the displace 

moves the designated distance 

Connecting rod movement insufficient 

Process fluid fails to fill the switch housing 
BP Texas City Final Investigation Report 3/20/2007 

328

Tag Number Test/Inspection Findings Possible Failure Causes 

LSH-5020 Unable to field or shop test due 

to fire damage. Float corroded 

with small hole, filled with fluid. 

Analysis of the fluid indicates 

that it was not raffinate splitter 

feed. 

Computerized control board fails to display the high-level 

alarm when the status of the high-level switch transitions to 

the alarm state 

Computerized control board fails to detect that the signal 

from LSH-5020 has changed to the alarm state 

Connected mercury switch not attached or improperly 

attached to the mercury switch assembly 

Electrical component shorted 

Float failure 

Process fluid fails to fill the switch housing 

PCV-5002 Intermittent failure to open 

during field testing. Variable 

valve stem travel distances on 

successive tests. 

Air signal leakage 

Excessive friction forces on actuator stem 

Torque motor failure 

Output module failure 

Nozzle failure 

Wiring failure 

Loose stem clamp 

Feedback arm linkage binding at pivot points 

Unable to determine most probable cause. Theorized 

transient failure or combination of the above. 
BP Texas City Final Investigation Report 3/20/2007 

329

S.5 Photographic Evidence 

This section contains selected photographs taken during shop testing that illustrate testing and conditions. 

Figure S- 3. LT-5100 cabinet showing calibration set for 0.8 specific gravity 

Metal 

sleeve with 

washers 

and cotter 

Isolation 

tube 

removed 

Graphite 

displacer 

Connecting 

rod 

Figure S- 4. LSH-5102 internal components 
BP Texas City Final Investigation Report 3/20/2007 

330

Figure S- 5. Internal components of LSH-5020 blowdown drum high level alarm 

Figure S- 6. Close-up of LSH-5020 float, showing corrosion and hole 
BP Texas City Final Investigation Report 3/20/2007 

331

Figure S- 7. PCV-5002 shop testing 
BP Texas City Final Investigation Report 3/20/2007 

332

APPENDIX T: BP Management-of-Change (MOC) Policy 

While reviewing changes pertaining to the raffinate splitter tower, blowdown drum and stack, and mobile 

trailers, the CSB noted a number of misapplications of the refinery MOC policy. As discussed in section 

2.5.2.2, a pressure control valve was non-operable, but the raffinate splitter tower startup proceeded 

without initiating a MOC. Several changes were also made to the start-up procedures of the raffinate 

splitter tower without initiating MOCs. 

A number of design and equipment changes to the blowdown drum and stack were not evaluated under 

the MOC policy, even though this equipment was designated by the refinery as “safety critical.” In 1997, 

when the blowdown drum and stack was replaced due to corrosion, the internal diameter of the stack was 

reduced over three inches, from 36 inches inside diameter to 34 inches outside diameter. Although this 

change was characterized by the refinery as a “replacement-in-kind” involving no process changes,1, the 

dispersion of flammable vapors into the atmosphere is a function of the stack height and the internal 

diameter; therefore, the safety and health impacts should have been reviewed under the MOC policy. In 

1998, a process hazard analysis (PHA) action item recommended chaining open the discharge valve to the 

sewer on the blowdown drum to prevent a high liquid level from increasing the backpressure on the relief 

valve headers. This action item was addressed by chaining open the valve without assessing its potential 

impacts on health and safety. The CCPS notes, in “Guidelines for Design Solutions for Process 

Equipment Failures,” that locking open a valve is “not merely a common sense decision; rather at an 

operating facility it is a design change. It is a procedural design solution that requires a documented 

design basis and a subsequent safety review” (CCPS, 1998, p. 27). As Section 3.2.5 notes, industry safety 

guidelines recommend against putting volatile, flammable liquids into a sewer. In 2003, the blowdown 

drum and stack was returned to normal service after ISOM turnaround, even though an external 

inspection noted heavy corrosion due to hydrogen chloride (HCl) attack, and an internal inspection could 
BP Texas City Final Investigation Report 3/20/2007 

333

not be conducted because of safety concerns that additional baffles might fall. As Section 3.2.5 discusses, 

the original design of the blowdown drum and stack was to separate liquid and vapor discharges, which 

the internal baffles helped with. A MOC was not initiated to determine if the blowdown drum and stack 

could still function as designed, even after some baffles had collapsed in the bottom of the drum and 

sections of corroded baffles were still attached to the walls. Also, no MOC was initiated to determine if 

the blowdown drum could function as designed without service water (supplied to the blowdown drum to 

cool any hot process streams diverted to the drum during an upset or unit shutdown), which had been out 

of service for a couple of years. 

As Section 6 discussed, mobile trailers were not sited in accordance with MOC policy. Insufficient 

training for PHA leaders in the use of the MOC policy and its various checklists, a lack of identified 

responsibilities for the refinery’s turnaround organization, trailers being occupied before PHA all action 

items were resolved, and lack of review of MOCs all prevented the MOC policy from being implemented 

as was intended. 
BP Texas City Final Investigation Report 3/20/2007 

334

APPENDIX U: BP turnarounds traffic control map* 

*The red outline has been added by CSB to highlight the “No Access/Parking” area. 
BP Texas City Final Investigation Report 3/20/2007 

335

References 

ABS Consulting, Inc., 2006. BP America Refinery Explosion Texas City, TX – March 23, 2005, Explosion 

Incident Investigation, Final Report, ABSC Project No. 1428551, October 31, 2006. 

Adamson, S., Lardner, R., Miller, S. 1995. “Safe Communication At Shift Handover: Setting And 

Implementing Standards,” presented at Major Hazards Onshore and Offshore II – 2nd Symposium for 

the Institute of Chemical Engineers Symposium Series, October 24-26, 1995, Vol 139, p. 411-424.

American Petroleum Institute (API), 2001. A Manager’s Guide to Reducing Human Error, API 

Recommended Practices 770. 

API, 2000. “Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries, Part I – 

Sizing and Selection,” API Recommended Practice 520, 7th Ed. 

API, 1997. “Guide for Pressure-Relieving and Depressuring Systems,” API Recommended Practice 521, 

4th Ed. 

API, 1995. “Management of Hazards Associated with Locations of Process Plant Buildings,”

Recommended Practice 752. 

 API, 1994. “Sizing, Selection, and Installation of Pressure-Relieving Devices in Refineries, Part II – 

Installation,”, API Recommended Practice 520, 4th ed.

American Society of Mechanical Engineers (ASME), 2001. “Rules for Construction of Pressure Vessels,” 

ASME Boiler and Pressure Vessel Code, Section VIII, Division 1. 

Baker, James et al., 2007. “The Report of the BP U.S. Refineries Independent Safety Review Panel” 

http://www.safetyreviewpanel.com/, January 30, 2007. 

Broadribb, M., Ralph, W. H., and Macnaughton, N. 2004. “Lessons From Grangemouth: A Case 

History.” Loss Prevention Bulletin, Issue 180. IChemE. 

Browne, J., 2002. “Browne, Take Action to put Safety First,” Horizon, October 2002, p.39. 

Buckley, P., Luyben, W., and Shunta, J., 1985. Design of Distillation Control Systems, NY: Edward 
BP Texas City Final Investigation Report 3/20/2007 

336

Arnold. 

Canadian Society for Chemical Engineers (CSChE), 2004. Managing the Health and Safety Impacts of 

Organizational Change, Ottawa, Ontario, Canada. 

Center for Chemical Process Safety (CCPS), 2007. Guidelines for Risk Based Process Safety,. New York: 

AIChE. 

CCPS, 2006. Guidelines for Mechanical Integrity Systems, New York: AIChE. 

CCPS, 2005. Building Process Safety Culture: Tools to Enhance Process Safety Performance, American 

Institute of Chemical Engineers (AIChE). 

CCPS, 2004. Interface Management: Effective Communication to Improve Process Safety” CCPS Safety 

Alert. New York: AIChE. 

CCPS, 2003.Guidelines for Fire Protection in Chemical, Petrochemical and Hydrocarbon Processing 

Facilities, AIChE. 

CCPS, 1998. Guidelines for Pressure Relief and Effluent Handling Systems,AIChE. 

CCPS, 1996a. Guidelines for Writing Effective Operating and Maintenance Procedures, AIChE. 

CCPS, 1996b. Inherently Safer Chemical Processes, A Life Cycle Approach, AIChE. 

CCPS, 1995a. Guidelines for Safe Process Operations and Maintenance, AIChE. 

CCPS, 1995b. Plant Guidelines for Technical Management of Chemical Process Safety, Revised Edition,

AIChE. 

CCPS, 1992a. Guidelines for Investigating Chemical Process Incidents, AIChE. 

CCPS, 1992b. Plant Guidelines for Technical Management of Chemical Process Safety, AIChE. 

Chemical and Manufacturers Association (CMA), 2002. A Manager’s Guide to Reducing Human Errors: 

Improving Human Performance in the Chemical Industry, Washington, D.C. 

CMA, 1998. Management of Safety and Health During Organization Change – A Resource Kit for 

Organizations Facing Change, Washington, D.C. 
BP Texas City Final Investigation Report 3/20/2007 

337

CMA, 1993. Managing Process Changes: A Manager’s Guide to Implementing and Improving 

Management of Change Systems, Washington, D.C. 

Collins, A. and Keely, D., 2003. Analysis of Onshore Dangerous Occurrence and Injury Data Involving a 

Loss of Containment. UK: Health and Safety Laboratory. Presented at the pre-proceedings of the 24th

ESReDa Seminar on Safety Investigation of Accidents, Petten, Netherlands, May 12-13, 2003. 

Columbia Accident Investigation Board (CAIB) Report, 2003. Vol. 1, Washington, D.C.: National 

Aeronautics and Space Administration. 

Connelly, C (ed.), 1997. “Changes in Operator Activities Due to Upsets,” Newsletter, Dayton, O.H.: 

Beville Engineering. 

 Contra Costa County, 2006. “Contra Costa County Ordinance Chapter 450-8,” Part of Industrial Safety 

Ordinance (ISO), http://www.cchealth.org/groups/hazmat/industrial_safety_ordinance.php, retrieved 

January 13, 2007. 

Contra Costa County, 1999. “Management of Change for Organizational Changes,” Industrial Safety 

Ordinance Guidance Document, Section B, Ch. 7, 

http://www.cchealth.org/groups/hazmat/industrial_safety_ordinance_guidance.php. 

Environmental Protection Agency (EPA), 2003. General Guidance for Risk Management Programs.

Fauske & Associates, LLC, 2006, An Evaluation of the Explosion and Fire on March 23, 2005 at the BP 

Products North America, Inc. Refinery in Texas City, Texas (Emergency Relief System Evaluation),

FAI/06-59. 

Fauske & Associates, LLC, 2005. Vapor Pressure Data of Raffinate OVH Product, FAI / 05-66. 

Financial Reporting Council (FRC), 2005. Internal Control: Guidance for Directors on the Combined 

Code,

http://www.frc.org.uk/documents/pagemanager/frc/Revised%20Turnbull%20Guidance%20October

%202005.pdf
BP Texas City Final Investigation Report 3/20/2007 

338

Fisher, H. G., et al., 1992. Emergency Relief Systems Design Using DIERS Technology – The DIERS 

Project Manual, AIChE / DIERS, New York. 

Fisher, H. G., 1991. “An Overview of Emergency Relief System Design Practice,” Plant/Operations 

Progress, 10 (1), 1-12. 

Fryman, C., 1996. “Risk-Based Solutions to Facility Siting,” Facility Siting Update, EQE International 

Newsletter, Fall 1996, Volume 1, Issue 3. 

Goettsche, L.D., (ed.), 2005. Maintenance of Instruments and Systems. The Instrumentation, Systems, and 

Automation Society. Research Triangle Park, NC. 

Gugan, Keith, 1979. Unconfined Vapor Cloud Explosions, Gulf Publishing, Houston, TX, pp. 122-126. 

Hopkins, Andrew, 2005. Safety, Culture and Risk; The Organisational Causes of Disasters. Sydney, New 

South Wales: CCH Australia Limited. 

Hopkins, Andrew, 2000. Lessons from Longford, the Esso Gas Plant Explosion, Sydney, New South 

Wales: CCH Australia Limited. 

Health and Safety Commission (HSC), 2002. Directors’ Responsibilities for Health and Safety. U.K., 

www.hse.gov.uk/pubns/indg343.pdf

Health and Safety Executive (HSE), 2006a. Developing Process Safety Indicators: A Step-By-Step Guide 

For Chemical And Major Hazard Industries, U.K.: HSE Books. 

HSE, 2006b. Managing Shift Work, U.K.: HSE Books. 

HSE, 2004. “Managing Fatigue Risks,” Inspectors Toolkit: Human Factors in the Management of Major 

Accident Hazards, http://www.hse.gov.uk/humanfactors/comah/toolkit.htm, retrieved March 1, 2006. 

HSE, 2003a. Major Incident Investigation Report, BP Grangemouth, Scotland, U.K., 

http://www.hse.gov.uk/comah/bpgrange/contents.htm, retrieved January 13, 2007. 

HSE, 2003b, Organisational change and major accident hazards, Chemical Information Sheet No. 

CHIS7. 
BP Texas City Final Investigation Report 3/20/2007 

339

HSE, 2002. Safety Culture: A Review of the Literature, HSL/2002/25. 

HSE, 1999. Reducing Error and Influencing Behavior, 2nd ed. U.K.: HSE Books. 

HSE, 1997. The Explosion And Fires at the Texaco Refinery, Milford Haven, 24 July 1994: A Report Of 

the Investigation by the Health and Safety Executive Into the Explosion and Fires on the Pembroke 

Cracking Company Plant at the Texaco Refinery, Milford Haven on 24 July 1994, U.K.: HSE Books. 

Institute of Chemical Engineers (IChemE), 2005. BP Process Safety Series: Safe Ups and Downs for 

Process Units, Rugby, U.K. 

Jones, David, 2001. “Turning the Titanic – Three Case Histories in Cultural Change,” CCPS International 

Conference and Workshop, Toronto. 

Keen, Nir, West, Harry, and Mannan, M. Sam, 2002. “Benchmarking MOC Practices in the Process 

Industries,” Process Safety Progress, Volume 21, No.2, pp. 103-112. 

Kister, Henry Z., 2006a. “Distillation: Introducing Reboiler Return,” Chemical Engineering Progress.

Kister, Henry Z., 2006b. Distillation Troubleshooting. Hoboken, New Jersey: Wiley-Interscience. 

Kister, Henry Z., 2003. “What Caused Tower Malfunctions in the Last 50 Years,” Trans IChemE, Vol. 

81, part A, Institution of Chemical Engineers (IChemE). 

Kister, Henry Z., 1990. Distillation Operation. New York: McGraw-Hill. 

Kletz, Trevor, 2003. “The Management of Organisational Change,” Symposium Series 149, IChemE. 

Kletz, Trevor, 2001. An Engineer’s View of Human Error, 3rd ed. Warwickshire, U.K.: Institution of 

Chemical Engineers (IChemE). 

Kletz, Trevor, 1998. Process Plants: A Handbook for Inherently Safer Design. Philadelphia, P.A.: Taylor 

& Francis. 

Lardner, Ronny, 1996. Offshore Technology Report – OTO 96 003 Effective Shift Handover – A 

Literature Review, Edinburgh, U.K.: The Keil Centre and HSE. 

Mannan, M. Sam (ed.), 2005. Lees’ Loss Prevention in the Process Industries, 3rd ed., Vol.1, pp. 12/57. 
BP Texas City Final Investigation Report 3/20/2007 

340

Mogford, John et al., 2005. “Fatal Accident Investigation Report, Isomerization Unit Explosion Final 

Report, Texas City, Texas, USA,” December 9, 2005. 

National Fire and Protection Agency (NFPA), 2004. Guide for Fire and Explosion Investigations, NFPA 

921. 

National Transportation Safety Board (NTSB), 2002. Hazardous Materials Release from Railroad Tank 

Car with subsequent Fire at Riverview, Michigan, July, 14, 2001. 

Occupational Safety and Health Administration (OSHA), 2002. “OSHA 20th Century Enforcement Data,” 

U.S. Department of Labor, Office of the Assistant Secretary for Policy, 

http://www.dol.gov/asp/media/reports/osha-data/toc.htm. 

OSHA, 1990. The Phillips 66 Company Houston Chemical Complex Explosion and Fire, a Report to the 

President, U. S. Department of Labor, OSHA. 

OSHA, 1987. Chemical Special Emphasis Program Final Report. U.S. Department of Labor, 

Washington, D.C. 

OSHA Instruction CPL 02-02-045 (CPL 2-2.45A), 1992 (As revised by CPL 2-2.45A CH-1, 1994) 

Process Safety Management of Highly hazardous Chemicals: Compliance Guidelines and 

Enforcement Procedures, Appendix A. Occupational Safety and Health Administration (OSHA) 

Directives.

Parker, Sybil (ed.), 1994. McGraw-Hill Dictionary of Scientific and Technical Terms, 5th ed., New York: 

McGraw-Hill, pg. 2084. 

Philley, Jack, 2002. “Potential Impacts to Process Safety Management from Mergers, Acquisitions, 

Downsizing, and Re-engineering,” Process Safety Progress, Vol. 21, No. 2, pp. 151-160. 

Pratt, Joseph A., 2000. Prelude to Merger, History of Amoco Corporation 1973-1998, Hart Publications. 

Price, Jana, 2005. “A Review of the Evidence Investigators use in Determining Operator Fatigue,” 

published in the Proceedings of the 2005 International Conference on Fatigue Management in 
BP Texas City Final Investigation Report 3/20/2007 

341

Transportation Operations, Seattle, WA: September 11-15. 

Reason, James, 2000. Beyond the Limitations of Safety Systems, Australia Safety News, April. 

Reason, James, 1997. Managing the Risks of Organizational Accidents. Brookfield, VT: Ashgate 

Publishing. 

Rosekind, M., Gander, P., et al., 1996. “Managing Fatigue in Operational Settings I: Physiological 

Considerations and Countermeasures,” Behavioral Medicine, Vol. 21, 157-165. 

Rosekind, M., Gregory, K., et al., 1993. “Analysis of crew fatigue factors in AIA Guantanamo Bay 

aviation accident, Appendix E,” to Aircraft Accident Report: Uncontrolled Collision with Terrain, 

NTSB/AAR-94/04, Washington, D.C.: NTSB. 

Rogers, A.S., Spencer, M.B., and Stone, B.M., 1999. Report 245/Validation and Development of a 

Method for Assessing the Risks Arising From Mental fatigue, prepared by the Defence Evaluation 

and Research Agency Center for Human Services, for the HSE, U.K. 

Roehrs, T., Burduvali, E., Bonahoom, A. et al. (2003). “Ethanol and Sleep Loss: A “Dose” Comparison 

of Impairing Effects, Sleep, 26:981-5. 

SPL, 2005. Analysis Summary, Houston Laboratories, TX. 

Stephenson, J.B., 2004. “Homeland Security: Federal Action Needed to Address Security Challenges at 

Chemical Facilities,” presented as testimony by the Director of Natural Resources and Environment, 

before the Subcommittee on National Security, Emerging Threats, and International Relations, 

Committee on Government Reform, House of Representatives on February 23, 2004. Washington, 

D.C.: General Accounting Office. 

U.S. Census Bureau, 2005. General Summary, 2002 Economic Census, Manufacturing Subject Series, 

EC02-31SG-1, http://www.census.gov/prod/ec02/ec0231sg1t.pdf. 

Weick, Karl E. and Sutcliffe, Kathleen M., 2001. Managing the Unexpected, Assuring High Performance 

in an Age of Complexity, San Francisco: Jossey-Bass.