You are on page 1of 51

10th Annual Symposium:

The Prevention of Serious Accidents

Lessons Learned from the
BP Refinery Explosion and
Other Incidents
CSB Investigator, Cheryl MacKenzie
22 November 2007
CSB Mission
To promote prevention of industrial
chemical accidents by
Investigating chemical incidents
Determining causes
Making recommendations
Promoting awareness
Conducting research and studies on
accidental releases (e.g. reactives, dust)

CSB Overview
Five-member board
Presidential appointment
Senate confirmation
Five year terms
Staff positions

Investigation Criteria
Deaths or injuries onsite or offsite
Property losses
Offsite impact
Incidents with broad national
Resources available

Two Key Lessons from BP Texas City

1. Human Error is a symptom of

underlying problems

2. Process safety metrics need to be

developed; injury rate data provides
an incomplete picture of safety

Incident Summary
March 23, 2005
15 deaths and 180
During startup, tower
and blowdown drum
Liquid hydrocarbon
released, vapor
cloud formed and
Explosion and fire
Financial Times
Financial Times
Three Initiating Conditions
The overfilling of the distillation
The use of a blowdown drum and
stack that open to the
The placement of the contractor
work trailers adjacent to high
hazard process units
Why was the splitter tower

Careless operators?

Lesson 1
Human Error is a Symptom of
Underlying Problems
Human factors
Human errors contributed to the
overfilling of the tower for 3 hours

But individuals do not plan to make

mistakes; they do what makes sense to
them at the time

Human Factors
Must ask:
Why did the individuals take the
actions that they did?

Numerous underlying conditions

influenced operators decision-making
and actions

Human Error was a Symptom of
Underlying Problems at Texas City
Historical deviations of startup
A lack of a shift communication policy or
emphasis on communication
Malfunctioning equipment/instruments
Fatigued operators and lack of a policy for
maximum allowable hours
Budget cuts to staffing and training
Historical Deviations of Startup
The startup procedure required the tower
level control valve be open and the tower be
filled within the range of the level transmitter
However, the board operator closed the tower
level control valve and filled the tower above
the amount specified in the procedures
To understand why he made these decisions,
the CSB reviewed what other board operators
did in previous startups
Procedural deviations common in 19
startups of the unit from 2000 to 2005
In a majority of the startups the tower was filled
above the range of the level transmitter
Swings in level experienced in 18 of these
Tower ran with high level to protect equipment
None of these startups was considered
abnormal or investigated to correct problems
Management did not revise out-dated
procedures 17
Communication was ineffective
between operations personnel
Multiple critical miscommunications occurred
Instructions for routing feed led to the level
control valve being closed
The condition of equipment was not
communicated from one shift to the

BP had no policy for effective

communication between operations
personnel during shift changes

Tower instruments malfunctioned
Six pieces of instrumentation
malfunctioned on the day of the incident,
A redundant high level alarm
A sight glass on the tower
A miscalibrated level transmitter

The level transmitters setting was

incorrect, likely not altered since it was set
30 years ago
Operators were likely Fatigued
Operators worked 12-hr shifts, March 2005

7 days-a-week, 29+ days 27 28 1 2 3 4 5

Acute sleep loss and
6 7 8 9 10 11 12
cumulative sleep debt
resulted 13 14 15 16 17 18 19

BP has no corporate or site- 20 21 22 23 24 25 26

specific fatigue prevention

27 28 29 30 1 2 3
policy or maximum shift work
No fatigue prevention guidelines
widely used in refining industry
Supervisor and Operator Staffing was
Unit Startups are especially hazardous
No supervisor assisted with startup
25% budget cut target in 1999 led to ISOM
staffing cuts - control room consolidation
and increased workloads followed
Hazard review recommended two board
operators during all startups, but only one on
March 23
Operator Training was not effective
Move to computer-based training without
effective verification methods of
Switch to computer-based training was a
business decision driven by cost
From 1998 to 2004 central training staff
reduced from 28 to 8 and
budget cut in half
Concurrent with BP London
instruction to cut costs 25%
Operator Training was not effective
Audits and reviews from 2002 - 2005
identified on-going deficiencies in
operator competency
Yet managers adopted a compliance
strategy that relied more on operating
personnel and less on engineering
controls to prevent accidents due to cost
No effective training for abnormal
situation management or simulation
technology made available
Safety Culture

Safety Culture
The way we do things around here
Can be positive or negative
Is influenced by management changes,
historical events, and economic
Can be used as an analysis tool
Companies with a Positive Safety
Learn from previous incidents and safety
Encourage reporting of safety concerns,
issues, and problems by all levels of staff
and take visible and concrete actions to
remedy the issues
Companies with a Positive Safety

Focus on controlling the risks of major

Provide adequate resources for safe

BP Texas City Did Not Have a
Positive Safety Culture
Organizational causes were embedded in the
refinerys history and culture
Causes extended beyond the ISOM unit to
actions of people at all levels of the corporation
Multiple safety system deficiencies were found

BP did not effectively measure and

manage safety
Lesson 2
Process safety metrics need to
be developed; injury rate data
provides an incomplete picture of
safety performance
BPs Days Away from Work Rate
Hazard Event

Major hazard
accidents are
here Frequency / probability

..but most of the management systems,

(e.g. performance measures, audits, behavior-
based safety programs, etc.) are aimed here 31
Examination of BP Texas Citys
In the previous 30 years, the Texas City
site experienced multiple major
accidents and 23 fatalities, not counting
the 15 deaths on March 23
Recurring safety problems identified in
audits, reports, and investigations

CSB Investigation Findings
Texas City infrastructure and equipment
found to be in complete decline
A 2002 Texas City study warned of serious
concerns about the potential for a major
site incident due to mechanical integrity
A follow-up report found that from 1992 to
2000, capital spending was reduced 84% &
maintenance spending was reduced 41%
CSB Investigation Findings
A 2003 refinery maintenance study
concluded that maintenance and
mechanical integrity problems persisted at
Texas City
A 2003 external safety audit found
inadequate training, a large number of
overdue action items and a concern about
insufficient resources to achieve all
CSB Investigation
In 2004, Texas City
experienced three
major incidents and
three fatalities
Safety system action
item closure rate was
down to 79% in 2004,
from 95% in 2002.

CSB Investigation Findings
Safety Culture Assessment found:
Serious mechanical integrity hazards led
to an exceptional degree of fear of
catastrophic incidents
Production and budget compliance gets
rewarded before anything else and
pressure for production, time pressure,
and understaffing are the major causes of
Leadership commitment is undermined
by the lack of resources to address severe
CSB Investigation Findings
Managements Response Insufficient
Continued focused on improving worker
behavior without sufficient assessment of
safety systems and hazardous conditions

Mistakenly thought safety culture at the

site was improving because personal
safety statistics were improving

CSB Investigation Findings
BP Corporate Refining executives ordered
a 25% reduction challenge for 2005
The 2005 refinery safety business plan
developed for site leadership listed the
following key risks:
Mechanical integrity
Operator competency
The possibility that Texas City kills
someone in the next 12-18 months

Safety culture and process safety
systems of high hazard industries
need the same emphasis and focus
as personal safety
And NOT Only At BP
Formosa Plastics Explosion
Illiopolis, IL April 23, 2004
Flammable vinyl
chloride release ignited
5 fatalities, 2 injured

Operator at
control panel

Operator at
drain valve

Formosa Plastics Explosion
Immediate Events Human Error
Operator in the process of cleaning a
reactor accidentally drained a full reactor
Operator bypassed an interlock to open the
reactor bottom valve, releasing its highly
flammable contents
Operations staff attempted to stop release
Vinyl chloride ignited
Careless operations staff?
Formosa Plastics Explosion
Safety System Deficiencies
Controlled risk through procedures and
training instead of making an engineering
design change to safeguard unintentional
opening of a reactor
Ambiguous facility emergency
procedures for evacuation; no drills in
10+ years
Lessons from previous incidents not
shared and learned
Giant Industries Refinery Explosion
Gallup, NM April 8, 2004
Workers removing a
Valve connecting the
pump to a distillation
column left open
Release and ignition
of flammable
4 seriously injured
Giant Industries Refinery Explosion
Immediate Events Human Error
Operator relied on the position of the valve
wrench to determine if the valve was open
The operator tagged and locked the valve in
what he thought was a closed position
The valve was actually open
When maintenance began unbolting the
pump, the flammable material was released,
and ignited
Careless workers?
Giant Industries Refinery Explosion
Safety System Deficiencies
Equipment was allowed to be used in a
manner for which it was not designed
with no assessment of the safety
implications of the change
Additionally, the valve wrench was not
permanently affixed to the valve
Due to its size, it was often removed and
replaced only when needed
Giant Industries Refinery Explosion
Safety System Deficiencies
The pump had a history of failures 23
work orders submitted to repair the pump
in the one year previous to the incident
Yet the pump was never assessed to
determine the cause of the failure

For more information
- BP Texas City Explosion and Fire
- Formosa Plastics Vinyl Chloride Explosion
- Giant Industries Refinery Explosion and Fire
- Other reports, videos, animations
- The Baker Report

10th Annual Symposium:
The Prevention of Serious Accidents
Lessons Learned from the
BP Refinery Explosion and
Other Incidents
Cheryl MacKenzie (
This presentation is given for general informational purposes
only. The presentation represents the individual views
of Cheryl MacKenzie and all references, conclusions or other
statements regarding current on going CSB investigations
are preliminary in nature and limited to information that is
already in the public domain. Furthermore, my statements
today and this presentation do not represent a formal
adopted product of the entire Board. Users of this
presentation should also note that the contents were
compiled solely for this presentation. For specific and
accurate information on completed investigations, please
refer to the final printed version by going to the CSB website
at and clicking on the specific report desired
under completed investigations. To the extent this
presentation discusses completed investigations, such
statements come under the general prohibition in 42 U.S.C.