In a 335-page
final report released on March 20, federal investigators from the U.S. Chemical
Safety Board (CSB) conclude that "organizational and safety deficiencies at all
levels of the BP Corporation" caused the March 23, 2005, explosion at the BP
Texas City refinery, the worst industrial accident in the United States since
1990. The report calls on the U.S. Occupational Safety and Health Administration
(OSHA) to increase inspection and enforcement at
CSB chairman
Carolyn W. Merritt said, "It is my sincere hope and belief that our report and
the recent Baker report will establish a new standard of care for corporate
boards of directors and CEOs throughout the world. Process safety programs to
protect the lives of workers and the public deserve the same level of attention,
investment, and scrutiny as companies now dedicate to maintaining their
financial controls. The boards of directors of oil and chemical companies should
examine every detail of their process safety programs to ensure that no other
terrible tragedy like the one at BP occurs."
The CSB
report calls on BP to appoint an additional member of the board of directors
with expertise in process safety, and calls for BP senior executives to
establish an improved incident reporting program and use new indicators to
measure safety performance.
The
independent Baker panel, formed and funded by BP in response to an urgent CSB
safety recommendation, issued its final report in January 2007. It found
"material deficiencies" in the safety of BP's five
CSB Investigation
Background
Merritt said, "Our
investigation of BP was the largest and most complex undertaking in the agency's
nine-year history. Under the leadership of supervisory investigator Don
Holmstrom, the team interviewed 370 witnesses, reviewed more than 30,000
documents, and conducted a far-reaching program of equipment, instrumentation,
and chemical testing." The final report is scheduled to be presented at a CSB
public meeting beginning at 6 p.m. tonight at the
BP cooperated
with the investigation, furnished documents and interviews on a voluntary basis,
and committed to widespread safety improvements and investments following the
accident. BP published its own report on the explosion in December 2005, pledged
the total elimination of the kind of unsafe disposal equipment that led to the
explosion, and developed a new siting policy to remove trailers from hazardous
process areas. All 15 fatalities occurred in or near trailers that were sited as
close as 121 feet from a blowdown drum that vented flammable liquid and vapor
directly to the atmosphere.
Safety Harmed by
Cost-Cutting, Production Pressures and Failure to Invest
BP acquired the
Merritt said,
"The combination of cost-cutting, production pressures, and failure to invest
caused a progressive deterioration of safety at the refinery. Beginning in 2002,
BP commissioned a series of audits and studies that revealed serious safety
problems at the
Blast Modeling Shows
Vulnerability of Temporary Trailers
The March 23
accident occurred during the startup of the refinery's octane-boosting
isomerization (ISOM) unit, when a distillation tower and attached blowdown drum
were overfilled with highly flammable liquid hydrocarbons. Because the blowdown
drum vented directly to the atmosphere, there was a geyser-like release of
highly flammable liquid and vapor onto the grounds of the refinery. A diesel
pickup truck that was idling nearby ignited the vapor, initiating a series of
explosions and fires that swept through the unit and the surrounding area.
Fatalities and injuries occurred in and around occupied work trailers, which
were placed too close to the ISOM unit and which were not evacuated prior to the
startup.
CSB
investigator Mark Kaszniak, who led the CSB's vapor and blast modeling effort,
stated, "The CSB was able to calculate that approximately 7,600 gallons of
flammable liquid hydrocarbons – nearly the equivalent of a full tanker truck of
gasoline – were release from the top of the blowdown drum stack in just under
two minutes." The ejected liquid rapidly vaporized due to evaporation, wind
dispersion, and contact with the surface of nearby equipment. High overpressures
from the resulting vapor cloud explosion totally destroyed 13 trailers and
damaged 27 others. People inside trailers were injured as far as 479 feet away
from the blowdown drum, and trailers nearly 1,000 feet away sustained damage.
"Industry
trailer siting guidelines did not predict the level of trailer damage that we
actually saw," Kaszniak stated.
In October
2005, the CSB issued an urgent recommendation to the American Petroleum
Institute to develop new guidance to prevent trailers from being sited near
hazardous areas of refineries and chemical plants, where occupants could be
injured or killed.
"A human
being is more likely to be injured or killed inside a trailer – which can
shatter during an explosion – than if he is standing in the open air. For that
reason, occupied trailers have no place near hazardous process areas of
refineries and chemical plants," Kaszniak said.
Human Factors
Analysis: Fatigue, Other Conditions Made Errors More Likely
The tower
overfilled because a valve allowing liquid to drain from the bottom of the tower
into storage tanks was left closed for over three hours during the startup on
the morning of March 23, which was contrary to unit startup procedures. The CSB
investigative team examined various conditions and human factors that led to
this error.
"BP relied on
operators taking correct and timely actions and following procedures to prevent
excessive liquid levels in the tower. While procedures are essential to any
process safety program, they are the least reliable safeguard to prevent process
accidents," Kaszniak said. "Modern control systems utilize automatic safety
controls to shut down liquid flow to a tower and prevent dangerous overfilling."
According to
a definition by
In
particular, the investigation found that procedural deviations, abnormally high
liquid levels and pressures, and dramatic swings in tower liquid level were the
norm in almost all previous startups of the unit since 2000. Operators typically
started up the unit with a high liquid level inside and left the drain valve in
manual – not automatic – mode to prevent possible loss of liquid flow and
resulting damage to a furnace that was connected to the tower. These procedural
deviations – together with the faulty condition of valves, gauges and
instruments on the tower – made the tower susceptible to overfilling,
investigators said.
None of the
previous abnormal startups was investigated by BP, nor were operating procedures
updated to reduce the likelihood or consequences of flooding the tower. As
American Petroleum Institute safety guidance notes, when operating procedures
are not updated or correct, "workers will create their own unofficial procedures
that may not adequately address safety issues." At the
On March 23,
the control board operator's decision to keep the drain valve closed was
influenced by ineffective communication and by false instrument readings from
the tower. Alarms and gauges that should have warned of the overfilling
equipment failed to operate properly. In addition, the operator believed he had
been instructed not to send any liquid from the bottom of the tower to storage
tanks, and the CSB determined that these storage tanks were in fact noted as
nearly full.
"BP had no
policy for effective shift communication or requirements for shift turnover,"
MacKenzie said. "This important instruction to the operator was given over the
phone and was not contained in the log book or the startup procedure."
Although a
high tower liquid level alarm did activate in the control room in the early
morning hours, a second high-level alarm malfunctioned and the faulty tower
level transmitter later indicated that the liquid level was below nine feet and
falling. The normal liquid level in the tower was six-and-a-half feet. Unknown
to operators, the level was actually rising rapidly, reaching 158 feet by 1 p.m.
on March 23, 20 minutes before the explosion. The CSB determined that the level
transmitter was miscalibrated, using a setting from outdated data sheets that
likely had not been updated since 1975.
The tower
lacked basic process indicators, such as a bottom pressure indicator, that could
have provided operators with an accurate picture of the high level inside the
tower. The control panel also did not display the flows in and out of the tower
on the same screen, and did not automatically calculate how much total liquid
was in the tower, even though it could have been configured to do so.
The CSB team
used an NTSB methodology to conclude that ISOM unit operators were likely
fatigued when the startup occurred. By March 23, operators had been working
12-hour shifts for 29 or more consecutive days.
"Fatigue
causes cognitive fixation and impaired judgment and could lead operators to
fixate on one operational parameter – such as the apparently declining liquid
level – to the exclusion of other indicators," MacKenzie said.
Fatigue has
been recognized as a cause of major accidents in the transportation sector.
Fatigue prevention regulations have been developed for aviation and other
transportation sectors, but there are no fatigue prevention guidelines that are
widely used and accepted in the oil and chemical sector.
The report
recommends that the American Petroleum Institute, a leading trade organization,
and the United Steelworkers International Union (USW), the largest union
representing refinery workers, work together to develop a new consensus standard
for fatigue prevention in the oil and chemical industry.
The
investigative team also pointed to a significant downsizing that occurred in
operations and training at the refinery. Following BP's global 25 percent cut to
fixed costs in 1999, the Texas City Refinery halved the number of control board
operators in the ISOM area, from two to one. Then in 2003, the sole remaining
operator was given a third process unit to control. Each refinery unit is a
complex network of equipment, piping, valves, and instruments. The ISOM unit
itself, one of the smaller units of the refinery, was the size of a city block
and contained four major subunits. A 2003 BP hazard review recommended that a
second operator be present during startups, but this recommendation was never
implemented. The 25 percent budget cut from 1999 also resulted in significant
training reductions for operators, and cost pressures prevented the refinery
from using simulators to train operators for handling abnormal situations and
process upsets.
Refinery Had
Longstanding Process Safety Deficiencies
Like other
refineries and chemical plants that handle highly flammable, toxic, or hazardous
substances, the Texas City Refinery is regulated under the Process Safety
Management (PSM) standard of the U.S. Occupational Safety and Health
Administration (OSHA). The standard was promulgated in 1992 as a result of
provisions in the 1990 Clean Air Act, which responded to major chemical
accidents in the
Investigator
Mark Kaszniak stated, "If the Process Safety Management standard had been
thoroughly implemented at the refinery, as required by federal regulations, this
accident likely would not have occurred."
Kaszniak said
that numerous requirements of the standard were not being followed in
OSHA rules
require internal investigations and corrective actions for any serious process
incidents or near-misses. But the CSB found that the refinery only investigated
three of the eight known previous ISOM blowdown release incidents, where
flammable and potentially explosive vapor was released from the same blowdown
drum involved in the March 23 accident. In 2004, an internal BP audit graded the
refinery's analysis of incident information as "poor."
The CSB also
determined that both the blowdown drum and the relief valve disposal piping were
undersized, which led to the blowdown drum overflowing with liquid. Under the
PSM standard, BP was required to conduct a study of the tower's pressure relief
system to ensure its safety. Despite the federal requirement, BP was not able to
produce any documents indicating the study had even been done.
"By 2005, the
required relief valve study was 13 years overdue," Kaszniak said. "Without the
study, there was no assurance that the equipment could handle all the credible
relief scenarios, including the one that actually occurred on March 23." The
report noted that an internal BP audit from 2004 found that design calculations
did not exist for many relief valves at the refinery and that the problem had
existed for nearly 10 years.
In October
2006, the CSB issued recommendations to OSHA and API aimed at eliminating
similar atmospheric blowdown systems from
The
investigative team also noted a number of problems with the facility's
preventative maintenance program that were causally related to the March 23
accident. The report concluded that BP supervisory personnel were aware of the
equipment problems with the level transmitter before the March 23 startup but
still had signed off on equipment checks as if they had been done, which the
report said reflected the prevalence of production pressures at the refinery.
In addition,
there was no documented test method for the blowdown drum high-level alarm,
which failed to sound on March 23, and the testing method in actual use was
contrary to the manufacturer's recommendations. The refinery's computerized
maintenance management system allowed maintenance work orders to be closed even
if no repair had been done. Many action items from previous hazard analyses and
incident investigations – such as a 1994 action item to review the adequacy of
the ISOM blowdown system following two serious incidents that year – were never
completed.
Dysfunctional Safety
Culture Existed at All Levels of BP
For the first time
in its nine-year history, the CSB conducted an examination of corporate safety
culture.
"As the
science of major accident investigations has matured, analysis has gone beyond
technical and system deficiencies to include an examination of organizational
culture," supervisory investigator Don Holmstrom said. "Effective organizational
practices such as encouraging the reporting of incidents and allocating adequate
resources for safe operation, are required to make safety systems work
successfully."
Holmstrom
pointed to the unusual history of fatal incidents at the Texas City Refinery.
Over a 30-year period spanning Amoco and BP's ownership, 23 workers died at the
facility – not counting the 15 workers killed in March 2005.
"Many of the
safety issues that led to the March 2005 accident were recurring safety problems
that had been previously identified in internal audits, reports, and
investigations. Our findings show that both BP Group executives and
Holmstrom
also cited a series of three serious incidents at the BP refinery in
Holmstrom
stated that in each year from 2002 to 2005, BP made its own significant findings
about the culture and safety of the
Similar
findings were made in 2003, when a study of maintenance found that "cost-cutting
measures have intervened with the group's work to get things right - usually
reliability improvements are cut." An external BP safety audit found inadequate
training, a large number of overdue action items, and a concern about
"insufficient resources to achieve all commitments." The report stated that "the
condition of the infrastructure and assets is poor."
The year 2004
was marked by three major accidents at the refinery, including a $30 million
process fire and two other accidents that caused three deaths. Meanwhile, an
analysis conducted by BP's internal audit group in
"In 2004, BP
documents do show that maintenance spending increased, but we found that the
increases were largely due to complying with environmental requirements and
responding to major accidents and outages. There was still not an adequate focus
on preventative maintenance before accidents occurred," Holmstrom said. The
investigation found that BP's executives relied unduly on injury statistics in
assessing the safety of their facilities.
He added, "BP
managers and executives attempted to make improvements from 2002 to 2005 but
they were largely focused on personal safety – such as slips, trips, falls, and
vehicle accidents – rather than on improving process safety performance, which
continued to deteriorate."
The report
calls on API and the USW to develop a new consensus standard defining
performance indicators for process safety. The consensus process should draw on
representatives from industry, labor, government, public interest, and
environmental organizations.
Later in
2004, a safety culture survey of the refinery was conducted and endorsed by the
site leadership. The study, known as the Telos report, pointed to "an
exceptional degree of fear of catastrophic incidents" among other conclusions,
and it stated respondents' belief that "production and budget compliance gets
... rewarded before anything else." Finally, a safety business plan for 2005
cited as a "key risk" the possibility that "
"The
investigation found that BP executives made spending cuts without assessing the
safety impact of those decisions," Holmstrom said.
The report
recommends that OSHA amend its Process Safety Management standard to require
companies to perform a management-of-change safety review on organizational
changes – including mergers, acquisitions, reorganizations, personnel changes,
policy changes and budget reductions. The CSB report cited previous
good-practice guidance from the American Chemistry Council, then known as the
Chemical Manufacturers Association, calling for such safety reviews. The report
also included a new recommendation to the Center for Chemical Process Safety to
develop guidelines for how to conduct the organizational management-of-change
reviews envisioned in the recommendation to OSHA.
OSHA Should Increase
Petrochemical Inspections, Enforcement
As part of its
investigation, the CSB looked at the role of OSHA in inspecting and enforcing
safety regulations at refineries and chemical plants. Although the refinery had
experienced numerous fatal incidents from 1985 to 2005, the investigation found
that OSHA conducted only one planned PSM inspection at the Texas City Refinery,
in 1998. Other, unplanned OSHA inspections of the Texas City Refinery occurred
in response to accidents, complaints, or referrals; the report said that
unplanned inspections are typically narrower in scope and shorter than planned
inspections. Proposed OSHA fines during the 20 years preceding the March 2005
disaster – a period when ten fatalities occurred at the refinery – totaled
$270,255; net fines collected after negotiations totaled $77,860. Following the
March 2005 explosion, OSHA issued the largest penalty in its history to BP, over
$21 million for more than 300 egregious and willful violations.
"OSHA's
national focus on inspecting facilities with high injury rates, while important,
has resulted in reduced attention to preventing less frequent, but catastrophic,
process safety incidents such as the one at Texas City," the report reads. The
report found that when the PSM standard was created, OSHA had envisioned a
highly technical, complex, and lengthy inspection process for regulated
facilities, called a Program Quality Verification or PQV inspection. The
inspections would take weeks or months at each facility and would be conducted
by a select, well-trained, and experienced team.
The CSB
investigation found that few PQV inspections were done between 1995 and 2005.
Federal OSHA conducted only nine such inspections in the targeted industries
over that ten-year period, and none in the refining sector. State agencies in
the 26 states that operate their own workplace safety programs conducted a total
of 48 PQV inspections, including six at refineries. However, a number of states
– including
"On average
from 1995 to 2005, only 0.2 percent of the approximately 2,816 facilities in
targeted, high-hazard industries received a planned OSHA process safety
inspection each year. That's about one planned inspection per 500 facilities,"
Holmstrom said.
The total
number of
The report
noted that
The report
calls on OSHA to "identify those facilities at the greatest risk of a
catastrophic accident" and then to "conduct comprehensive inspections" at those
facilities. The report also recommends that OSHA hire or develop new,
specialized inspectors and expand the PSM training curriculum at its National
Training Institute.
"Rules
already on the books would likely have prevented the tragedy in
The CSB is an
independent federal agency charged with investigating industrial chemical
accidents. The agency's board members are appointed by the president and
confirmed by the Senate. CSB investigations look into all aspects of chemical
accidents, including physical causes such as equipment failure as well as
inadequacies in regulations, industry standards, and safety management systems.
The board
does not issue citations or fines but does make safety recommendations to
plants, industry organizations, labor groups, and regulatory agencies such as
OSHA and EPA. Please visit our website, www.csb.gov.
For more
information, please contact a member of the CSB public affairs office: 1) Daniel
Horowitz, 202-441-6074 cell; 2) Sandy Gilmour 202-251-5496 cell; 3) Jennifer
Jones 202-577-8448 cell; 4) Hillary Cohen 202-446-8094 cell; or 5) Kate Baumann
202-725-2204 cell.
A Chronology of the
CSB Investigation
March 24,
2005 - CSB investigators arrive at the BP Texas City refinery
March 26,
2005 - The CSB team points out the hazard of placing trailers so close to
operating refinery units
April 1, 2005
- CSB investigators make initial entry into the damaged ISOM unit and identify
the atmospheric blowdown drum as the likely source of the release
April 28,
2005 - CSB investigators say diminished outflow from an ISOM unit distillation
tower resulted in overpressurization and flooding and led to the flammable
release during startup
June 28, 2005
- CSB Lead Investigator Don Holmstrom announces that a review of computer
records shows that two alarms and a level transmitter, which could have warned
operators of the flooded condition of ISOM unit equipment, failed to operate
properly in the hours leading to the explosion
July 28, 2005
- The Texas City refinery experiences a serious hydrogen fire in the Resid
Hydrotreater Unit that causes $30 million in property damage and forces
residents to take shelter
August 10,
2005 - Another incident related to mechanical integrity in the refinery's Gas
Oil Hydrotreater forces another community shelter-in-place alert
August 17,
2005 - The Chemical Safety Board issues its first-ever urgent safety
recommendation, calling on BP to convene an independent panel to assess safety
culture and oversight at all five of its North American refineries
October 24,
2005 - BP announces formation of the 11-member panel of experts, chaired by
former U.S. Secretary of State James A. Baker III
October 25,
2005 - The Chemical Safety Board issues new urgent safety recommendations
calling on the American Petroleum Institute to develop new safety guidance for
the placement of trailers away from hazardous process areas
October 27,
2005 - In preliminary findings released at a public meeting in
November 10,
2005 - CSB Chairman Merritt testifies before the newly established Baker panel,
notes the role of worker fatigue and operator downsizing in the accident
December 22,
2005 -The CSB releases a narrated computer animation of the events leading to
the accident; the video is viewed in refineries and chemical plants worldwide
June 30, 2006
- The CSB releases blast damage information for 44 trailers located near the
ISOM unit; notes serious damage to a distance of almost 600 feet from the center
of the explosions
October 15,
2006 - The CSB issues a safety bulletin based on the July 28, 2005, hydrogen
fire, calling for expanded use of positive material verification to prevent
accidental releases
October 30,
2006 - CSB Chairman Merritt releases new preliminary findings from the
investigation, pointing to the role of organizational factors and cost-cutting
in setting the stage for the accident
October 31,
2006 - The CSB issues new safety recommendations, calling on the
January 16,
2007 - The independent refinery safety panel chaired by Secretary Baker issues
its final report at a news conference in
March 20,
2007 - At a public meeting in