Lessons Learned From Texas City Refinery Explosion

Bill RigotEFCOG

Human Performance Task GroupMay, 2007

2BP: Employees caused deadly blast - Oil company says employee failures led to deaths of 15 people at Texas City, Texas, refinery in March.

May 18, 2005: 5:41 AM EDT

TEXAS CITY, Texas (Dow Jones)-- BP PLC (BP) said Tuesday that failures by its employees were responsible for an explosion at its Texas City refinery on March 23, the deadliest industrial accident in 15 years.

BP Products will take disciplinary action against supervisors and hourly employees who were directly responsible for operating the isomerization unit on March 22 and 23. These actions will range from warnings to termination of employment. As the investigation continues and new information is discovered, others may also be disciplined, the company said.

"If ISOM unit management had properly supervised the startup, or if ISOM unit operators had followed procedures or taken corrective action earlier, the explosion would not have occurred", said Ross Pillari, president of BP Products North America.

BP: Employees caused deadly blast - Oil company says employee failures led to deaths of 15 people at Texas City, Texas, refinery in March.

May 18, 2005: 5:41 AM EDT

TEXAS CITY, Texas (Dow Jones)-- BP PLC (BP) said Tuesday that failures by its employees were responsible for an explosion at its Texas City refinery on March 23, the deadliest industrial accident in 15 years.

BP Products will take disciplinary action against supervisors and hourly employees who were directly responsible for operating the isomerization unit on March 22 and 23. These actions will range from warnings to termination of employment. As the investigation continues and new information is discovered, others may also be disciplined, the company said.

"If ISOM unit management had properly supervised the startup, or if ISOM unit operators had followed procedures or taken corrective action earlier, the explosion would not have occurred", said Ross Pillari, president of BP Products North America.

3Accident Summary

On March 23, 2005, at 1:20 p.m., the BP Texas City Refinery suffered one of the worst industrial disasters in recent U.S. history. Explosions and fires killed 15 people and injured another 180, alarmed the community, and resulted in financial losses exceeding $1.5B. The incident occurred during startup of an isomerization1 (ISOM) unit when a raffinate splitter tower was overfilled; pressure relief devices opened, resulting in a flammable liquid geyser from a blowdownstack that was not equipped with a flare. The release of flammables led to an explosion and fire.

4The Chemical Safety Board

The U.S. Chemical Safety and Hazard Investigation Board (CSB) final report of the Texas City Explosion was released 3/26/2007- The CSB is an independent federal agency charged with investigating

industrial chemical accidents- CSB Board members are appointed by the president and confirmed by the

Senate- CSB investigations look at all aspects of chemical accidents, including physical

causes such as equipment failure as well as inadequacies in regulations, industry standards, and safety management systems

- The CSB does not issues citations or fines, but does make safetyrecommendations to plants, industry organizations, labor groups, and regulatory agencies such as OSHA and EPA

- The CSB Accident Reports and video reconstruction are available on their website, www.csb.gov

5The Baker Report

Pursuant to an urgent recommendation from the CSB interim report, BP commissioned former Secretary of State James Baker to conduct a third party review of BP corporate practices leading up to the Texas City explosion

Secretary Baker completed his review January 2007 The Baker Panel focused principally on Process Safety

rather than personal safety

6Baker Panel Findings

Corporate Safety Culture- BP Board did not exercise good Process Safety leadership- At Texas City particularly, BP managers did not empower

employees in the Corporate Safety Culture- BP corporate did not provide appropriate resources to assure

adequate process safety- BP managers did not incorporate process safety into

management decision making- BP corporate did not assure a common, unifying Process Safety

culture among its US refineries

7Baker Panel Findings (Cont.)

Process Safety Management Systems- BP Process Risk Assessment and Analysis was flawed- BPs US refineries did not comply with its own internal process

safety standards- BP refineries did not implement good engineering practices- Process safety knowledge and competence was not maintained

at BP US refineries- BPs corporate process safety management system was

ineffective and not measurable

8Baker Panel Findings (Cont.)

Performance Evaluation, Corrective Action, Corporate Oversight- BP measured safety performance through personal injury rate,

rather than measuring process safety equipment performance- BPs causal analysis methods were inadequate and flawed- The process safety audit system was inadequate- BP managers did not provide timely correction of process safety

deficiencies- BP corporate oversight of refinery specific process safety

information was flawed

9CSB Identified Root Causes

BP Group Board did not provide effective oversight of the companys safety culture and major accident prevention programs.

BP Senior Executives:- Inadequately addressed controlling major hazard risk, particularly

process safety performance;- Did not provide effective safety culture leadership and oversight

to prevent catastrophic accidents;- Ineffectively evaluated safety implications of major organizational

changes; and- Did not provide adequate resources to its refineries

10

CSB Identified Root Causes (Cont.)

BP Texas City Managers did not:- Create an effective reporting and learning culture; i.e. bad news

was not welcomed (by inference a Just Culture was not achieved either);

- Effectively investigate accidents;- Hold supervisors and managers accountable for process safety

performance;- Incorporate good practice design in the operation of hazardous

chemical systems;- Ensure that operators were supervised and supported during unit

startup; and- Effectively incorporate human factor considerations in its training,

staffing and work schedule for operations personnel

11

CSB Identified Contributing Causes

BP Texas City Managers:- Lacked an effective mechanical integrity program to maintain

instruments and process safety equipment;- Did not have an effective vehicle traffic policy to control traffic into

hazardous process areas or to establish safe distances from process unit boundaries;

- Ineffectively implemented Pre-Startup Safety Review policy; non-essential personnel were not removed from areas in and around process units during the hazardous unit startup; and

- Located trailers in close proximity to hazardous operations.

12

Latent Organizational Weaknesses

Work environment encouraged procedural noncompliance

Ineffective communications for shift change and hazardous operations (such as unit startup)

Malfunctioning instrumentation and alarms Poorly designed computerized control system Insufficient staffing Lack of human fatigue-prevention strategy Inadequate operator training for abnormal and startup

conditions Failure to establish effective safe operating limits

13

Latent Organizational Weaknesses (Cont.)

Ineffective incident investigation management system Ineffective Lessons Learned program No coordinates line management self-assessment process No flare on blowdown drum No automatic safety shutdown system Occupied trailers too close to hazardous operations Key operational indicators and alarms inoperative Ineffective response to serious safety problems and events Focus on injury and illness statistics, not process safety

- This was an observed Latent Organizational Weakness for their OSHA regulator as well

14

Latent Organizational Weaknesses (Cont.)

Poor implementation of Process Hazards Analyses (PHA) and Management of Change (MOC) processes (equivalent to USQ)

Ineffective follow-up to audit reports Problem reporting not encouraged Inadequate implementation of OSHA Process Safety

Management regulations Inadequate OSHA inspections and enforcement Gaps in applicable industry standards

15

The INPO ViewAnatomy of an Event

Event

ErrorPrecursors

Vision, Beliefs, &

Values

LatentOrganizationalWeaknesses

Mission

Goals

Policies

Processes

Programs

FlawedDefenses

InitiatingAction

Vision, Beliefs, &

Values

16

Self-Checking Place-Keeping

3-Part Communication

Double (dual)Verification

Procedure Use& Adherence

Supervision

ManagementMonitoring

Stop WhenUncertain

Critical Parameters

Problem-solvingMethodology

ConservativeDecision-Making

TeamSkills

Peer-Checking

RecognizingError Traps

Rigor ofExecution

ChallengeFlagging

CommunicationPractices & Plan

Reviews &Approvals

ChangeMgmt.

Problem-Solving

Scheduling /Sequencing

ClearExpectations

RoleModels

SafetyPhilosophy

TaskAllocation

MeetingsRewards &

Reinforcement

Trend Analysis

OE

Training

Handoffs

Accountability

Simple / EffectiveProcesses

ProcedureRevisions

WorkPlanning

Corrective ActionProgram

Self-AssessmentBenchmarking

CompatibleGoals & Priorities

StrategicHU Plans

Management Practices

SafeguardsEquipment

ReactorProtectionSystems

Containment

EquipmentReliability

Equipment Labeling& Condition

Procedure / WorkPackage Quality

Worker Knowledge,Skill, & Proficiency

Fitness-for-Duty

Uneasy Attitude

Equipment Ergonomics& Human Factors

Tool Quality& Availability

Roles &Responsibilities

HousekeepingEnvironmentalConditions

ForeignMaterial

Exclusion

Lockout /Tagout

PersonalMotives

Intolerance forError Traps

Morale

RWPs

Performance ModelPerformance Modelw/ example defenses

Leadership

Post-jobCritiques

ProblemReporting

Root CauseAnalysis

PerformanceIndicators

FACILITYRESULTS

JOB-SITECONDITIONS

ORGANIZATIONPROCESSES

& VALUES

WORKERBEHAVIOR

ProperReactions

HighStandards

Reinforcement

Coaching

Questioning Attitude

Respectfor Others

Open & HonestCommunication

CompellingVision

HealthyRelationships

Courage &Integrity

Motivation

Example

Pre-jobBriefing

Just-in-timeOperatingExperience

Task Preview

TurnoverClearance Walkdown

Walkdowns

PerformanceFeedback

Task Assignment

HP Surveys

Task Qualification

QC Hold Points

IndependentVerification

InterlocksPersonalProtectiveEquipment

Alarms

ForcingFunctions

FME

Questioning AttitudeWork-arounds &Inconveniences

Staffing

LaborRelations

Socialization

Design & Configuration Control

Values &Beliefs

Independent Oversight

17

Self-Checking Place-Keeping

3-Part Communication

Double (dual)Verification

Procedure Use& Adherence

Supervision

ManagementMonitoring

Stop WhenUncertain

Critical Parameters

Problem-solvingMethodology

ConservativeDecision-Making

TeamSkills

Peer-Checking

RecognizingError Traps

Rigor ofExecution

ChallengeFlagging

CommunicationPractices & Plan

Reviews &Approvals

ChangeMgmt.

Problem-Solving

Scheduling /Sequencing

ClearExpectations

RoleModels

SafetyPhilosophy

TaskAllocation

MeetingsRewards &

Reinforcement

Trend Analysis

OE

Training

Handoffs

Accountability

Simple / EffectiveProcesses

ProcedureRevisions

WorkPlanning

Corrective ActionProgram

Self-AssessmentBenchmarking

CompatibleGoals & Priorities

StrategicHU Plans

Management Practices

SafeguardsEquipment

ReactorProtectionSystems

Containment

EquipmentReliability

Equipment Labeling& Condition

Procedure / WorkPackage Quality

Worker Knowledge,Skill, & Proficiency

Fitness-for-Duty

Uneasy Attitude

Equipment Ergonomics& Human Factors

Tool Quality& Availability

Roles &Responsibilities

HousekeepingEnvironmentalConditions

ForeignMaterial

Exclusion

Lockout /Tagout

PersonalMotives

Intolerance forError Traps

Morale

RWPs

Performance ModelPerformance ModelB/P Texas City

Leadership

Post-jobCritiques

ProblemReporting

Root CauseAnalysis

PerformanceIndicators(injury rates

FACILITYRESULTS

JOB-SITECONDITIONS

ORGANIZATIONPROCESSES

& VALUES

WORKERBEHAVIOR

ProperReactions

HighStandards

Reinforcement

Coaching

Questioning Attitude

Respectfor Others

Open & HonestCommunication

CompellingVision

HealthyRelationships

Courage &Integrity

Motivation

Example

Pre-jobBriefing

Just-in-timeOperatingExperience

Task Preview

TurnoverClearance Walkdown

Walkdowns

PerformanceFeedback

Task Assignment

HP Surveys

Task Qualification

QC Hold Points

IndependentVerification

InterlocksPersonalProtectiveEquipment

Alarms

ForcingFunctions

FME

Questioning AttitudeWork-arounds &Inconveniences

Staffing

LaborRelations

Socialization

Design & Configuration Control

Values &Beliefs

Independent Oversight(by BOD)

Cost cutting,Failure to invest,Production pressures

18

Lessons Learned to DOE Contractors

Could this really apply to us?

Do we have higher or lower consequence events?

What is our relationship with our regulator(s)?

19

Areas of Similarity

Aging facilities Safety Culture not well understood with revolving DOE

contractors Budget limitations Causal Analysis weaknesses Equipment Reliability strategies Uneven quality of written operating and maintenance

procedures Weak management self-assessment processes Focus on injury and illness statistics

20

Areas of Difference

Regulator (DOE) embedded with the contractor organization

Competent third party oversight (DNFSB) Standardized (and enforced) Process Safety

Authorization Basis development Parent Organization Oversight Program now required

in DOE contracts