Safety board says major deficiencies caused BP disaster

In a 335-page final report released on March 20, federal investigators from the U.S. Chemical Safety Board (CSB) conclude that "organizational and safety deficiencies at all levels of the BP Corporation" caused the March 23, 2005, explosion at the BP Texas City refinery, the worst industrial accident in the United States since 1990. The report calls on the U.S. Occupational Safety and Health Administration (OSHA) to increase inspection and enforcement at U.S. oil refineries and chemical plants, and to require these corporations to evaluate the safety impact of mergers, reorganizations, downsizing and budget cuts.

CSB chairman Carolyn W. Merritt said, "It is my sincere hope and belief that our report and the recent Baker report will establish a new standard of care for corporate boards of directors and CEOs throughout the world. Process safety programs to protect the lives of workers and the public deserve the same level of attention, investment, and scrutiny as companies now dedicate to maintaining their financial controls. The boards of directors of oil and chemical companies should examine every detail of their process safety programs to ensure that no other terrible tragedy like the one at BP occurs."

The CSB report calls on BP to appoint an additional member of the board of directors with expertise in process safety, and calls for BP senior executives to establish an improved incident reporting program and use new indicators to measure safety performance.

The independent Baker panel, formed and funded by BP in response to an urgent CSB safety recommendation, issued its final report in January 2007. It found "material deficiencies" in the safety of BP's five U.S. refineries in Texas, California, Indiana, Ohio and Washington. The 11-member panel also issued 10 safety recommendations, including calling on BP's corporate board to closely monitor safety performance at its facilities. The Baker panel was not charged with determining the root causes of the March 2005 explosion.

CSB Investigation Background
Merritt said, "Our investigation of BP was the largest and most complex undertaking in the agency's nine-year history. Under the leadership of supervisory investigator Don Holmstrom, the team interviewed 370 witnesses, reviewed more than 30,000 documents, and conducted a far-reaching program of equipment, instrumentation, and chemical testing." The final report is scheduled to be presented at a CSB public meeting beginning at 6 p.m. tonight at the Nessler Center, Wings of Heritage Room, located at 2010 5th Avenue North in Texas City. The report and recommendations are subject to approval by the full board at the public meeting.

BP cooperated with the investigation, furnished documents and interviews on a voluntary basis, and committed to widespread safety improvements and investments following the accident. BP published its own report on the explosion in December 2005, pledged the total elimination of the kind of unsafe disposal equipment that led to the explosion, and developed a new siting policy to remove trailers from hazardous process areas. All 15 fatalities occurred in or near trailers that were sited as close as 121 feet from a blowdown drum that vented flammable liquid and vapor directly to the atmosphere.

Safety Harmed by Cost-Cutting, Production Pressures and Failure to Invest
BP acquired the Texas City refinery when it merged with Amoco in 1999. The CSB report found that "cost-cutting in the 1990s by Amoco and then BP left the Texas City refinery vulnerable to a catastrophe." Shortly after acquiring Amoco, the BP Group Chief Executive ordered an across-the-budget 25 percent cut in fixed spending at the corporation's refineries. The impact of the cost cuts is detailed in many of the more than 20 key investigative documents the CSB made public today, including internal BP safety audits, reviews, and emails. Among other things, cost considerations discouraged refinery officials from replacing the blowdown drum with a flare system, which the CSB previously determined would have prevented or greatly minimized the severity of the accident.

Merritt said, "The combination of cost-cutting, production pressures, and failure to invest caused a progressive deterioration of safety at the refinery. Beginning in 2002, BP commissioned a series of audits and studies that revealed serious safety problems at the Texas City refinery, including a lack of necessary preventative maintenance and training. These audits and studies were shared with BP executives in London, and were provided to at least one member of the executive board. BP's response was too little and too late. Some additional investments were made, but they did not address the core problems in Texas City. In 2004, BP executives challenged their refineries to cut yet another 25 percent from their budgets for the following year."

Blast Modeling Shows Vulnerability of Temporary Trailers
The March 23 accident occurred during the startup of the refinery's octane-boosting isomerization (ISOM) unit, when a distillation tower and attached blowdown drum were overfilled with highly flammable liquid hydrocarbons. Because the blowdown drum vented directly to the atmosphere, there was a geyser-like release of highly flammable liquid and vapor onto the grounds of the refinery. A diesel pickup truck that was idling nearby ignited the vapor, initiating a series of explosions and fires that swept through the unit and the surrounding area. Fatalities and injuries occurred in and around occupied work trailers, which were placed too close to the ISOM unit and which were not evacuated prior to the startup.

CSB investigator Mark Kaszniak, who led the CSB's vapor and blast modeling effort, stated, "The CSB was able to calculate that approximately 7,600 gallons of flammable liquid hydrocarbons – nearly the equivalent of a full tanker truck of gasoline – were release from the top of the blowdown drum stack in just under two minutes." The ejected liquid rapidly vaporized due to evaporation, wind dispersion, and contact with the surface of nearby equipment. High overpressures from the resulting vapor cloud explosion totally destroyed 13 trailers and damaged 27 others. People inside trailers were injured as far as 479 feet away from the blowdown drum, and trailers nearly 1,000 feet away sustained damage.

"Industry trailer siting guidelines did not predict the level of trailer damage that we actually saw," Kaszniak stated.

In October 2005, the CSB issued an urgent recommendation to the American Petroleum Institute to develop new guidance to prevent trailers from being sited near hazardous areas of refineries and chemical plants, where occupants could be injured or killed.

"A human being is more likely to be injured or killed inside a trailer – which can shatter during an explosion – than if he is standing in the open air. For that reason, occupied trailers have no place near hazardous process areas of refineries and chemical plants," Kaszniak said.

Human Factors Analysis: Fatigue, Other Conditions Made Errors More Likely
The tower overfilled because a valve allowing liquid to drain from the bottom of the tower into storage tanks was left closed for over three hours during the startup on the morning of March 23, which was contrary to unit startup procedures. The CSB investigative team examined various conditions and human factors that led to this error.

"BP relied on operators taking correct and timely actions and following procedures to prevent excessive liquid levels in the tower. While procedures are essential to any process safety program, they are the least reliable safeguard to prevent process accidents," Kaszniak said. "Modern control systems utilize automatic safety controls to shut down liquid flow to a tower and prevent dangerous overfilling."

According to a definition by U.K. safety authorities, human factors are those environmental, organizational, and job-related factors that influence behavior at work and can impact safety performance. CSB investigator Cheryl MacKenzie, who led the human factors analysis, said, "Although errors and procedural deviations occurred during the startup, it is important to recognize that individuals do not plan to make mistakes. They are doing what makes sense to them at the time, given the work environment, the organization's goals, and other job-related factors. Understanding and correcting these factors will help prevent future accidents at BP and throughout the industry."

In particular, the investigation found that procedural deviations, abnormally high liquid levels and pressures, and dramatic swings in tower liquid level were the norm in almost all previous startups of the unit since 2000. Operators typically started up the unit with a high liquid level inside and left the drain valve in manual – not automatic – mode to prevent possible loss of liquid flow and resulting damage to a furnace that was connected to the tower. These procedural deviations – together with the faulty condition of valves, gauges and instruments on the tower – made the tower susceptible to overfilling, investigators said.

None of the previous abnormal startups was investigated by BP, nor were operating procedures updated to reduce the likelihood or consequences of flooding the tower. As American Petroleum Institute safety guidance notes, when operating procedures are not updated or correct, "workers will create their own unofficial procedures that may not adequately address safety issues." At the Texas City refinery, "Procedural workarounds were accepted as normal," MacKenzie said.

On March 23, the control board operator's decision to keep the drain valve closed was influenced by ineffective communication and by false instrument readings from the tower. Alarms and gauges that should have warned of the overfilling equipment failed to operate properly. In addition, the operator believed he had been instructed not to send any liquid from the bottom of the tower to storage tanks, and the CSB determined that these storage tanks were in fact noted as nearly full.

"BP had no policy for effective shift communication or requirements for shift turnover," MacKenzie said. "This important instruction to the operator was given over the phone and was not contained in the log book or the startup procedure."

Although a high tower liquid level alarm did activate in the control room in the early morning hours, a second high-level alarm malfunctioned and the faulty tower level transmitter later indicated that the liquid level was below nine feet and falling. The normal liquid level in the tower was six-and-a-half feet. Unknown to operators, the level was actually rising rapidly, reaching 158 feet by 1 p.m. on March 23, 20 minutes before the explosion. The CSB determined that the level transmitter was miscalibrated, using a setting from outdated data sheets that likely had not been updated since 1975.

The tower lacked basic process indicators, such as a bottom pressure indicator, that could have provided operators with an accurate picture of the high level inside the tower. The control panel also did not display the flows in and out of the tower on the same screen, and did not automatically calculate how much total liquid was in the tower, even though it could have been configured to do so.

The CSB team used an NTSB methodology to conclude that ISOM unit operators were likely fatigued when the startup occurred. By March 23, operators had been working 12-hour shifts for 29 or more consecutive days.

"Fatigue causes cognitive fixation and impaired judgment and could lead operators to fixate on one operational parameter – such as the apparently declining liquid level – to the exclusion of other indicators," MacKenzie said.

Fatigue has been recognized as a cause of major accidents in the transportation sector. Fatigue prevention regulations have been developed for aviation and other transportation sectors, but there are no fatigue prevention guidelines that are widely used and accepted in the oil and chemical sector.

The report recommends that the American Petroleum Institute, a leading trade organization, and the United Steelworkers International Union (USW), the largest union representing refinery workers, work together to develop a new consensus standard for fatigue prevention in the oil and chemical industry.

The investigative team also pointed to a significant downsizing that occurred in operations and training at the refinery. Following BP's global 25 percent cut to fixed costs in 1999, the Texas City Refinery halved the number of control board operators in the ISOM area, from two to one. Then in 2003, the sole remaining operator was given a third process unit to control. Each refinery unit is a complex network of equipment, piping, valves, and instruments. The ISOM unit itself, one of the smaller units of the refinery, was the size of a city block and contained four major subunits. A 2003 BP hazard review recommended that a second operator be present during startups, but this recommendation was never implemented. The 25 percent budget cut from 1999 also resulted in significant training reductions for operators, and cost pressures prevented the refinery from using simulators to train operators for handling abnormal situations and process upsets.

Refinery Had Longstanding Process Safety Deficiencies
Like other refineries and chemical plants that handle highly flammable, toxic, or hazardous substances, the Texas City Refinery is regulated under the Process Safety Management (PSM) standard of the U.S. Occupational Safety and Health Administration (OSHA). The standard was promulgated in 1992 as a result of provisions in the 1990 Clean Air Act, which responded to major chemical accidents in the U.S. and overseas. The PSM standard requires covered facilities to implement 14 specific management elements to prevent catastrophic releases of hazardous substances. These include hazard analysis, operator training, preventative maintenance programs (mechanical integrity), and management of change reviews.

Investigator Mark Kaszniak stated, "If the Process Safety Management standard had been thoroughly implemented at the refinery, as required by federal regulations, this accident likely would not have occurred."

Kaszniak said that numerous requirements of the standard were not being followed in Texas City and cited ineffective incident investigations, lack of effective preventative maintenance, lack of change reviews and pre-startup reviews, and incomplete hazard analyses.

OSHA rules require internal investigations and corrective actions for any serious process incidents or near-misses. But the CSB found that the refinery only investigated three of the eight known previous ISOM blowdown release incidents, where flammable and potentially explosive vapor was released from the same blowdown drum involved in the March 23 accident. In 2004, an internal BP audit graded the refinery's analysis of incident information as "poor."

The CSB also determined that both the blowdown drum and the relief valve disposal piping were undersized, which led to the blowdown drum overflowing with liquid. Under the PSM standard, BP was required to conduct a study of the tower's pressure relief system to ensure its safety. Despite the federal requirement, BP was not able to produce any documents indicating the study had even been done.

"By 2005, the required relief valve study was 13 years overdue," Kaszniak said. "Without the study, there was no assurance that the equipment could handle all the credible relief scenarios, including the one that actually occurred on March 23." The report noted that an internal BP audit from 2004 found that design calculations did not exist for many relief valves at the refinery and that the problem had existed for nearly 10 years.

In October 2006, the CSB issued recommendations to OSHA and API aimed at eliminating similar atmospheric blowdown systems from U.S. refineries and chemical plants in favor of safer alternatives, such as flare systems.

The investigative team also noted a number of problems with the facility's preventative maintenance program that were causally related to the March 23 accident. The report concluded that BP supervisory personnel were aware of the equipment problems with the level transmitter before the March 23 startup but still had signed off on equipment checks as if they had been done, which the report said reflected the prevalence of production pressures at the refinery.

In addition, there was no documented test method for the blowdown drum high-level alarm, which failed to sound on March 23, and the testing method in actual use was contrary to the manufacturer's recommendations. The refinery's computerized maintenance management system allowed maintenance work orders to be closed even if no repair had been done. Many action items from previous hazard analyses and incident investigations – such as a 1994 action item to review the adequacy of the ISOM blowdown system following two serious incidents that year – were never completed.

Dysfunctional Safety Culture Existed at All Levels of BP
For the first time in its nine-year history, the CSB conducted an examination of corporate safety culture.

"As the science of major accident investigations has matured, analysis has gone beyond technical and system deficiencies to include an examination of organizational culture," supervisory investigator Don Holmstrom said. "Effective organizational practices such as encouraging the reporting of incidents and allocating adequate resources for safe operation, are required to make safety systems work successfully."

Holmstrom pointed to the unusual history of fatal incidents at the Texas City Refinery. Over a 30-year period spanning Amoco and BP's ownership, 23 workers died at the facility – not counting the 15 workers killed in March 2005.

"Many of the safety issues that led to the March 2005 accident were recurring safety problems that had been previously identified in internal audits, reports, and investigations. Our findings show that both BP Group executives and Texas City managers became aware of serious process safety problems at the refinery beginning in 2002 and continuing through March 2005," Holmstrom said.

Holmstrom also cited a series of three serious incidents at the BP refinery in Grangemouth, Scotland, in 2000, which were investigated by the U.K. Health and Safety Executive. BP officials wrote that meeting "cost targets" played a role in the Grangemouth incidents and stated that "there was too much emphasis on short term cost reduction – HSE [health, safety, and environment] was unofficially sacrificed to cost reductions, and cost pressures inhibited the staff from asking the right questions." The lessons from the Grangemouth investigation were not effectively implemented at the Texas City Refinery, however.

Holmstrom stated that in each year from 2002 to 2005, BP made its own significant findings about the culture and safety of the Texas City site. In 2002, the new refinery manager found the infrastructure and equipment to be "in complete decline." A follow-up study by BP found "serious concerns about the potential for a major site accident" due to mechanical integrity problems. Later in 2002, another internal report explicitly connected the safety problems to earlier cost-cutting, stating, "the current integrity and reliability issues at TCR [Texas City Refinery] are clearly linked to the reduction in maintenance spending over the last decade." The prevailing culture at the Texas City refinery was to accept cost reductions without challenge and not to raise concerns when operational integrity was compromised."

Similar findings were made in 2003, when a study of maintenance found that "cost-cutting measures have intervened with the group's work to get things right - usually reliability improvements are cut." An external BP safety audit found inadequate training, a large number of overdue action items, and a concern about "insufficient resources to achieve all commitments." The report stated that "the condition of the infrastructure and assets is poor."

The year 2004 was marked by three major accidents at the refinery, including a $30 million process fire and two other accidents that caused three deaths. Meanwhile, an analysis conducted by BP's internal audit group in London found common safety deficiencies among 35 BP business units around the world, including widespread tolerance of non-compliance with basic health, safety, and environment rules and poor implementation of safety management systems.

"In 2004, BP documents do show that maintenance spending increased, but we found that the increases were largely due to complying with environmental requirements and responding to major accidents and outages. There was still not an adequate focus on preventative maintenance before accidents occurred," Holmstrom said. The investigation found that BP's executives relied unduly on injury statistics in assessing the safety of their facilities.

He added, "BP managers and executives attempted to make improvements from 2002 to 2005 but they were largely focused on personal safety – such as slips, trips, falls, and vehicle accidents – rather than on improving process safety performance, which continued to deteriorate."

The report calls on API and the USW to develop a new consensus standard defining performance indicators for process safety. The consensus process should draw on representatives from industry, labor, government, public interest, and environmental organizations.

Later in 2004, a safety culture survey of the refinery was conducted and endorsed by the site leadership. The study, known as the Telos report, pointed to "an exceptional degree of fear of catastrophic incidents" among other conclusions, and it stated respondents' belief that "production and budget compliance gets ... rewarded before anything else." Finally, a safety business plan for 2005 cited as a "key risk" the possibility that "Texas City kills someone in the next 12 to 18 months."

"The investigation found that BP executives made spending cuts without assessing the safety impact of those decisions," Holmstrom said.

The report recommends that OSHA amend its Process Safety Management standard to require companies to perform a management-of-change safety review on organizational changes – including mergers, acquisitions, reorganizations, personnel changes, policy changes and budget reductions. The CSB report cited previous good-practice guidance from the American Chemistry Council, then known as the Chemical Manufacturers Association, calling for such safety reviews. The report also included a new recommendation to the Center for Chemical Process Safety to develop guidelines for how to conduct the organizational management-of-change reviews envisioned in the recommendation to OSHA.

OSHA Should Increase Petrochemical Inspections, Enforcement
As part of its investigation, the CSB looked at the role of OSHA in inspecting and enforcing safety regulations at refineries and chemical plants. Although the refinery had experienced numerous fatal incidents from 1985 to 2005, the investigation found that OSHA conducted only one planned PSM inspection at the Texas City Refinery, in 1998. Other, unplanned OSHA inspections of the Texas City Refinery occurred in response to accidents, complaints, or referrals; the report said that unplanned inspections are typically narrower in scope and shorter than planned inspections. Proposed OSHA fines during the 20 years preceding the March 2005 disaster – a period when ten fatalities occurred at the refinery – totaled $270,255; net fines collected after negotiations totaled $77,860. Following the March 2005 explosion, OSHA issued the largest penalty in its history to BP, over $21 million for more than 300 egregious and willful violations.

"OSHA's national focus on inspecting facilities with high injury rates, while important, has resulted in reduced attention to preventing less frequent, but catastrophic, process safety incidents such as the one at Texas City," the report reads. The report found that when the PSM standard was created, OSHA had envisioned a highly technical, complex, and lengthy inspection process for regulated facilities, called a Program Quality Verification or PQV inspection. The inspections would take weeks or months at each facility and would be conducted by a select, well-trained, and experienced team.

The CSB investigation found that few PQV inspections were done between 1995 and 2005. Federal OSHA conducted only nine such inspections in the targeted industries over that ten-year period, and none in the refining sector. State agencies in the 26 states that operate their own workplace safety programs conducted a total of 48 PQV inspections, including six at refineries. However, a number of states – including Texas, Louisiana and New Jersey, where much of the U.S. oil and chemical industry is concentrated – rely upon federal OSHA to enforce workplace safety rules.

"On average from 1995 to 2005, only 0.2 percent of the approximately 2,816 facilities in targeted, high-hazard industries received a planned OSHA process safety inspection each year. That's about one planned inspection per 500 facilities," Holmstrom said.

The total number of U.S. facilities covered under the PSM standard is not known, since covered facilities are not required to identify themselves to the government; however, a similar regulatory program administered by the Environmental Protection Agency covers an estimated 15,000 sites.

The report noted that California's Contra Costa County, which has its own industrial safety ordinance, inspects each covered facility every three years. A county staff of five engineers performs an average of 16 inspections per year. The U.K. Health and Safety Executive, which oversees a much smaller oil and chemical industry than do U.S. authorities, has 105 inspectors for high-hazard facilities; each covered facility in the U.K. is inspected every five years. Although OSHA did not provide requested information to the CSB investigation, available evidence indicates that OSHA has an insufficient number of qualified inspectors to enforce the PSM standard at oil and chemical facilities.

The report calls on OSHA to "identify those facilities at the greatest risk of a catastrophic accident" and then to "conduct comprehensive inspections" at those facilities. The report also recommends that OSHA hire or develop new, specialized inspectors and expand the PSM training curriculum at its National Training Institute.

"Rules already on the books would likely have prevented the tragedy in Texas City," chairman Merritt said. "But if a company is not following those rules, year-in and year-out, it is ultimately the responsibility of the federal government to enforce good safety practices before more lives are lost. OSHA should obtain and dedicate whatever resources are necessary for inspecting and enforcing safety rules at oil and chemical plants. These facilities simply have too many potentially catastrophic hazards to be overlooked."

The CSB is an independent federal agency charged with investigating industrial chemical accidents. The agency's board members are appointed by the president and confirmed by the Senate. CSB investigations look into all aspects of chemical accidents, including physical causes such as equipment failure as well as inadequacies in regulations, industry standards, and safety management systems.

The board does not issue citations or fines but does make safety recommendations to plants, industry organizations, labor groups, and regulatory agencies such as OSHA and EPA. Please visit our website, www.csb.gov.

For more information, please contact a member of the CSB public affairs office: 1) Daniel Horowitz, 202-441-6074 cell; 2) Sandy Gilmour 202-251-5496 cell; 3) Jennifer Jones 202-577-8448 cell; 4) Hillary Cohen 202-446-8094 cell; or 5) Kate Baumann 202-725-2204 cell.

A Chronology of the CSB Investigation

March 24, 2005 - CSB investigators arrive at the BP Texas City refinery

March 26, 2005 - The CSB team points out the hazard of placing trailers so close to operating refinery units

April 1, 2005 - CSB investigators make initial entry into the damaged ISOM unit and identify the atmospheric blowdown drum as the likely source of the release

April 28, 2005 - CSB investigators say diminished outflow from an ISOM unit distillation tower resulted in overpressurization and flooding and led to the flammable release during startup

June 28, 2005 - CSB Lead Investigator Don Holmstrom announces that a review of computer records shows that two alarms and a level transmitter, which could have warned operators of the flooded condition of ISOM unit equipment, failed to operate properly in the hours leading to the explosion

July 28, 2005 - The Texas City refinery experiences a serious hydrogen fire in the Resid Hydrotreater Unit that causes $30 million in property damage and forces residents to take shelter

August 10, 2005 - Another incident related to mechanical integrity in the refinery's Gas Oil Hydrotreater forces another community shelter-in-place alert

August 17, 2005 - The Chemical Safety Board issues its first-ever urgent safety recommendation, calling on BP to convene an independent panel to assess safety culture and oversight at all five of its North American refineries

October 24, 2005 - BP announces formation of the 11-member panel of experts, chaired by former U.S. Secretary of State James A. Baker III

October 25, 2005 - The Chemical Safety Board issues new urgent safety recommendations calling on the American Petroleum Institute to develop new safety guidance for the placement of trailers away from hazardous process areas

October 27, 2005 - In preliminary findings released at a public meeting in Texas City, CSB investigators describe a history of abnormal startups in the ISOM unit, previous vapor releases, and mechanical failures; they refer to the unit's blowdown system as "outdated and unsafe"

November 10, 2005 - CSB Chairman Merritt testifies before the newly established Baker panel, notes the role of worker fatigue and operator downsizing in the accident

December 22, 2005 -The CSB releases a narrated computer animation of the events leading to the accident; the video is viewed in refineries and chemical plants worldwide

June 30, 2006 - The CSB releases blast damage information for 44 trailers located near the ISOM unit; notes serious damage to a distance of almost 600 feet from the center of the explosions

October 15, 2006 - The CSB issues a safety bulletin based on the July 28, 2005, hydrogen fire, calling for expanded use of positive material verification to prevent accidental releases

October 30, 2006 - CSB Chairman Merritt releases new preliminary findings from the investigation, pointing to the role of organizational factors and cost-cutting in setting the stage for the accident

October 31, 2006 - The CSB issues new safety recommendations, calling on the U.S. oil industry to eliminate the use of unsafe blowdown drums similar to the one involved in the Texas City accident and calling on OSHA to establish a refinery special emphasis program to promote the replacement of the drums with safer alternatives

January 16, 2007 - The independent refinery safety panel chaired by Secretary Baker issues its final report at a news conference in Houston, revealing systemic safety problems in BP's North American refineries

March 20, 2007 - At a public meeting in Texas City, the CSB releases its final investigation report and recommendations, three days prior to the second anniversary of the explosion