The BP Texas City Incident - ACMThe March 23, 2005 incident at the BP Texas City, Texas refinery...
2
38 | Winter 2005 | PROCESSWest I t is human nature to let our guard down when during the course of a job or task it becomes repetitive or when we lose sight of the consequences of certain actions. For example, driving a car for hours down a long straight piece of blacktop, like the roads in southern Saskatchewan, can reduce our alertness to the point where we become so drowsy we begin to catnap. If we don't recognize what is happening or remind our- selves of the severe consequences (death), we unknowingly increase our risk exposure and the risk exposure to others. A near-miss event occurred in my family this summer when both the driver and passenger on a six- hour drive to Saskatchewan fell asleep. Fortunately, they woke up in the ditch while driving at highway speed and immediately responded with the correct recov- ery procedure. They committed to each other to always take reg- ular breaks on long trips to avoid this from happening again. The point is, taking breaks is not new. But in today's fast paced world, marathon-driving sessions, with- out breaks, brought on by jam packed schedules seem to have become the norm. My family's driving anecdote showcases the impact of human nature in our personal lives. We continuously need to be remind- ed and to remind ourselves that sometimes the consequences of our actions can be extremely bad, both for others and us. If we don't have a system of re-highlighting the consequences of our mistakes or omis- sions, we often do not think of the potential unpleasant consequences. When such an incident occurs, we can be lucky or unlucky. If we are lucky, we normally take it as a warning sign. Hopefully, we learn from it too. We pay more attention. We pull off the road and find a safe place for a nap. If we are very unlucky, we may not get a second chance. Should the worst happen, hopefully others learn from our mistake. The March 23, 2005 incident at the BP Texas City, Texas refinery illustrates the severity of consequences in our industrial world. According to a number of sources, includ- ing the Houston Chronicle and BP manage- ment, apparently trouble began early in the morning when isomerization unit workers who had begun the start-up of the raffinate splitter during the night shift failed to fully brief day-shift workers and the supervisor. (The splitter is used to produce chemicals used to boost the octane of gasoline.) As the start-up continued early that morning, high- ly flammable hydrocarbons flowed into the splitter much more quickly and were heated much faster than normal. As the level of the fluids rose from seven feet to a staggering 140 feet, three pressure-relief valves activat- ed, allowing the materials to begin flowing into a blow down drum nearby. After the blow down drum filled, the materials then made their way up a vent stack and overflowed. Liquids and vapors then flowed onto the plant grounds, where unsuspecting workers were driving vehicles, operating generators and doing other refin- ery work. A yet-to-be-identified ignition source then caused the massive blast. Apparently six minutes passed between the times the pressure relief valves opened and the explosion occurred, but none of the oper- ators sounded the evacuation alarm. The consequences were extremely severe. Fifteen people were killed and more than 170 were injured in the explosion. BP set aside US $700 million to compensate victims of the explosion and resolve claims arising from the incident. How can this happen at a modern North American facility? As we can see in the graphic accompanying this article, taken from the interna- tional standard IEC 61511 Functional safety - Safety instru- mented systems for the process industry sector, there are many risk reduction methods used by process plants like Texas City. The results of a prelimi- nary investigation by the U.S. Chemical Safety and Hazard Investigation Board released on August 17, 2005 found that some of the safeguards in place, which may have prevented this event from occurring, failed. In particular: •Key alarms and a level transmitter failed to operate properly and to warn operators of unsafe and abnormal con- ditions within the tower and blow down drum; •The startup of the raffinate splitter was authorized on March 23 despite known problems with the tower level transmitter and the high level alarms on both the tower and the blow down drum; •The majority of 17 startups of the raffi- nate splitter tower from April 2000 to March 2005 exhibited abnormally high internal pressures and liquid levels - includ- ing several occasions where pressure relief PROCESS SAFETY Ken Bingham ...a human nature issue? The BP Texas City Incident Typical risk reduction methods found in process plants.
Transcript of The BP Texas City Incident - ACMThe March 23, 2005 incident at the BP Texas City, Texas refinery...
38 | Winter 2005 | PPRROOCCEESSSSWest
IIt is human nature to let our guard downwhen during the course of a job or task itbecomes repetitive or when we lose sight
of the consequences of certain actions.For example, driving a car for hours down
a long straight piece of blacktop, like theroads in southern Saskatchewan, can reduceour alertness to the point where we becomeso drowsy we begin to catnap. If we don'trecognize what is happening or remind our-selves of the severe consequences (death), weunknowingly increase our risk exposure andthe risk exposure to others. Anear-miss event occurred in myfamily this summer when boththe driver and passenger on a six-hour drive to Saskatchewan fellasleep. Fortunately, they wokeup in the ditch while driving athighway speed and immediatelyresponded with the correct recov-ery procedure. They committedto each other to always take reg-ular breaks on long trips to avoidthis from happening again. Thepoint is, taking breaks is not new.But in today's fast paced world,marathon-driving sessions, with-out breaks, brought on by jampacked schedules seem to havebecome the norm.
My family's driving anecdoteshowcases the impact of humannature in our personal lives. Wecontinuously need to be remind-ed and to remind ourselves thatsometimes the consequences of our actionscan be extremely bad, both for others and us.If we don't have a system of re-highlightingthe consequences of our mistakes or omis-sions, we often do not think of the potentialunpleasant consequences. When such anincident occurs, we can be lucky or unlucky.If we are lucky, we normally take it as awarning sign. Hopefully, we learn from ittoo. We pay more attention. We pull off theroad and find a safe place for a nap. If we arevery unlucky, we may not get a secondchance. Should the worst happen, hopefullyothers learn from our mistake.
The March 23, 2005 incident at the BPTexas City, Texas refinery illustrates theseverity of consequences in our industrialworld.
According to a number of sources, includ-ing the Houston Chronicle and BP manage-ment, apparently trouble began early in themorning when isomerization unit workerswho had begun the start-up of the raffinatesplitter during the night shift failed to fullybrief day-shift workers and the supervisor.(The splitter is used to produce chemicals
used to boost the octane of gasoline.) As thestart-up continued early that morning, high-ly flammable hydrocarbons flowed into thesplitter much more quickly and were heatedmuch faster than normal. As the level of thefluids rose from seven feet to a staggering140 feet, three pressure-relief valves activat-ed, allowing the materials to begin flowinginto a blow down drum nearby.
After the blow down drum filled, thematerials then made their way up a ventstack and overflowed. Liquids and vaporsthen flowed onto the plant grounds, whereunsuspecting workers were driving vehicles,
operating generators and doing other refin-ery work. A yet-to-be-identified ignitionsource then caused the massive blast.Apparently six minutes passed between thetimes the pressure relief valves opened andthe explosion occurred, but none of the oper-ators sounded the evacuation alarm. T h econsequences were extremely severe. Fifteenpeople were killed and more than 170 wereinjured in the explosion. BP set aside US$700 million to compensate victims of theexplosion and resolve claims arising from the
incident.
HHooww ccaann tthhiiss hhaappppeenn aatt aammooddeerrnn NNoorrtthh AAmmeerriiccaannffaacciilliittyy??
As we can see in thegraphic accompanying thisarticle, taken from the interna-tional standard IEC 61511Functional safety - Safety instru-mented systems for the processindustry sector, there are manyrisk reduction methods used byprocess plants like Texas City.
The results of a prelimi-nary investigation by the U.S.Chemical Safety and HazardInvestigation Board releasedon August 17, 2005 found thatsome of the safeguards in place,which may have prevented thisevent from occurring, failed.In particular:
•Key alarms and a leveltransmitter failed to operate properly and towarn operators of unsafe and abnormal con-ditions within the tower and blow downdrum;
•The startup of the raffinate splitter wasauthorized on March 23 despite knownproblems with the tower level transmitterand the high level alarms on both the towerand the blow down drum;
•The majority of 17 startups of the raffi-nate splitter tower from April 2000 toMarch 2005 exhibited abnormally highinternal pressures and liquid levels - includ-ing several occasions where pressure relief
PPRROOCCEESSSSSAFETYKen Bingham
...a human nature issue?TThhee BBPP TTeexxaass CCiittyy IInncciiddeenntt
Typical risk reduction methods found in process plants.
PPRROOCCEESSSSWest | Winter 2005 | 39
valves likely opened, but theabnormal startups were notinvestigated as near-misses andthe adequacy of the towersdesign, instrumentation andprocess controls were not re-eval-uated;
•Written startup proceduresfor the raffinate splitter wereincomplete and directed opera-tors to use the so-called 3-lb ventsystem to control tower pressure,even though the pressure-controlvalve did not function in pre-startup equipment checks andalso failed to operate effectivelyin post-accident testing.
It appears that the driver hadfallen asleep and the brakes werenot going to be able to help ifcalled upon. That the driver hadexperienced some minor inci-dents that should have served aswarning signs makes it muchmore regrettable.
BP, government and regulato-ry bodies are now exhaustivelyconsidering what went wrongand how to minimize a reoccur-rence. The process industry willbenefit from the lessons learnedand know what to do better nexttime. Ironically, one of thepotential safeguards now beingconsidered more seriously is theuse of relief valves being tied into
a closed flare system. This safe-guard had been evaluated before,but considered unnecessary.Now related systems in this facil-ity and others may be revampedto a closed flare system.
Unfortunately, the Texas Cityincident signifies one of theongoing challenges decisionmakers in industry face. Unlessthe severest consequences areconsidered and steps taken tomitigate their probability, it ishuman nature to focus on theimmediate - financial perform-ance, the bottom line.Consequently, unacceptable riskscan be taken. They becomeacceptable in certain circum-stances. The trouble is that ifthese special circumstancesbecome normal circumstances,organizations expose themselvesto extraordinary and unaccept-able risk.
By being aware of the realisticprobabilities of all types of conse-quences, both individuals andorganizations can help reducehazardous events and reducetheir risk. For the process indus-try, one suggestion is to involveplant personnel in risk assess-ments. This helps identify theprobability of hazardous events,severity of consequences androbustness of safeguards in high-risk areas of a plant. It personal-izes the seriousness of operatingprocedures and maintaining safe-guards and safety systems.
The participation of plant andcorporate personnel in regularHAZID, HAZOP and SILAssessments is a good start toguard against the human natureproblem of making unacceptablerisks acceptable on any givenday.
Let's drive safely, practice gooddriving habits, and appreciatewhat staying out of the ditchmeans. PPWW
Readers can contact the author, KenBingham of ACM Facility Safety adivision of ACM Automation Inc.for more information by email:[email protected] and byphone 403-264-9637
If we don’t have a systemof re-highlight-ing the conse-quences of our
mistakes oromissions, weoften do notthink of the
potentialunpleasant
consequences.
