Summary
Highlights
On March 23, 2005, the BP Texas City Refinery underwent extensive maintenance. Numerous contractors and employees were on-site, with portable trailers positioned close to process units. Ten trailers were located near the ultra-cracker unit, including a double-wide trailer with 11 offices, near the isomerization (ISOM) unit, without warning occupants of its impending hazardous startup.
At 2:15 a.m., operators began introducing flammable liquid hydrocarbons (raffinate) into a 170-foot raffinate splitter tower. A single level indicator, designed for a maximum of 9 feet, was used, despite operators routinely exceeding this level during startups. A high-level alarm activated at 3:09 a.m. as the liquid neared 8 feet, but another failed to trigger. By 3:30 a.m., the indicator showed 9 feet, but the actual level was an estimated 13 feet, unknown to operators.
The lead operator left early, an hour before his shift ended, updating the central control room briefly. A new board operator, on his 30th consecutive 12-hour shift, arrived at 6:00 a.m. The logbook provided unclear information regarding liquid levels and no instructions for resuming the startup. The day shift supervisor arrived late at 7:15 a.m., missing a formal briefing from the night shift personnel.
At 9:51 a.m., operators resumed the startup, recirculating and adding more liquid to the already overfilled tower. The critical automatic level control valve was left closed for several hours due to conflicting instructions. A few minutes later, furnace burners were lit. The day supervisor left at 11:00 a.m. for a family emergency, and no experienced supervisor was assigned, leaving a single, unqualified board operator to manage three refinery units.
Corporate budget cuts from 1999 eliminated the second board operator position. The tower steadily filled, reaching 98 feet by noon—15 times the normal level. However, the improperly calibrated level indicator showed 8.4 feet and falling. The control panel lacked clear warnings, not displaying inflow/outflow on the same screen or calculating total liquid in the tower.
At 12:41 p.m., an alarm activated due to compressed gases. Operators, unaware of the overfill, opened a manual valve to the 1950s-era blow down drum, venting vapor directly into the atmosphere, and turned off two furnace burners. They then opened a valve to send hot liquid from the tower's bottom, which unexpectedly raised the temperature of liquid entering the tower by 141 degrees Fahrenheit.
Contract workers returned to their trailers, including the double-wide, at 1:00 p.m. The hot feed caused the liquid in the tower to boil and swell, completely filling it and spilling into the overhead vapor line. At 1:14 p.m., three emergency valves opened, releasing nearly 52,000 gallons of flammable liquid to the blow down drum, which then overflowed into a process sewer, setting off alarms. A geyser of liquid and vapor erupted, forming a huge vapor cloud that engulfed the unit and trailers. A idling pickup truck ignited the cloud, leading to powerful explosions that caused significant destruction and fires, killing 15 workers and injuring 180. The ISOM unit remained shut down for over two years. This was the most serious refinery accident investigated by the CSB.
The US Chemical Safety Board (CSB) is developing an interactive training application on OSHA's Process Safety Management (PSM) regulation, using the 2005 BP Texas City Refinery explosion as a case study. This training will cover the 14 elements of PSM.