10th Annual Symposium, Mary Kay O’Connor Process Safety Center “Beyond Regulatory Compliance: Making Safety Second Nature” The Brazos Center • Texas A&M University, College Station, Texas October 23-24, 2007 Examining Organizational and Safety Culture Causes of the BP Texas City Refinery Explosion Don Holmstrom, Mark Kaszniak and Cheryl MacKenzie U.S. Chemical Safety and Hazard Investigation Board 2175 K. Street, NW, Suite 400, Washington, DC 20037-1809 Phone: (202) 261-7600 [email protected] Abstract On March 23, 2005, a series of explosions and fires occurred at the BP Texas City refinery during the startup of an isomerization (ISOM) process unit. Fifteen workers were killed and about 180 others were injured. However, the catastrophic incident on March 23rd was not the only major incident at the Texas City refinery. As part of its investigation, CSB learned that over the past 32 years, the BP Texas City refinery has had 39 fatalities. This discovery prompted CSB to investigate the organizational and safety culture precursors that produced the multiple safety system deficiencies that lead to the ISOM incident and the history of major accidents and fatalities at this refinery. This paper will examine the organizational and safety culture precursors rooted in the refinery’s history. The paper will also show how these organizational issues extended beyond the ISOM unit and the Texas City refinery to the corporate oversight system of BP Global and to the 1999 merger between BP and Amoco Corporation, where the safety impacts of major organizational change were not effectively reviewed. Disclaimer This paper has been prepared for general informational purposes only. This paper represents the individual views of the authors and all references, conclusions or other statements regarding current on-going CSB investigations are preliminary in nature and limited to information that is already in the public domain. Furthermore, this paper is not a product of the Board and its contents have not been reviewed, endorsed, or approved as an official CSB document. For specific and accurate information on completed investigations, please refer to the final published investigation report [CSB, 2007] by going to the CSB website at www.csb.gov and clicking on the specific report desired under “Completed Investigations.” To the extent this paper includes statements about the conclusions, findings, or recommendations of the Board, such statements come under the general prohibition in 42 U.S.C. §7412(r)(6)(G). Introduction On the morning of March 23, 2005, the raffinate splitter1 tower in the ISOM unit2 at the BP refinery3 in Texas City, Texas was restarted after a maintenance outage. During the startup, operations personnel pumped flammable liquid hydrocarbons into the tower for over three hours without any liquid being removed, which was contrary to startup procedure instructions. Critical alarms and control instrumentation provided false indications that failed to alert the operators of the high level in the tower. Consequently, unknown to the operations crew, the 170-foot (52 meter) tall tower was overfilled and liquid overflowed into the overhead pipe at the top of the tower. The overhead pipe ran down the side of the tower to pressure relief valves located 148 feet (45 meters) below. As the pipe filled with liquid, the pressure at the bottom rose rapidly from about 21 pounds per square inch (psi) [144 kPa] to about 64 psi (440 kPa). The three pressure relief valves opened for six minutes, discharging a large quantity of flammable liquid to a blowdown drum with a vent stack open to the atmosphere. The blowdown drum and stack overfilled with flammable liquid, which led to a geyser-like release of approximately 7,600 gallons (28,700 liters) out the 113 foot (34 meter) tall stack. This blowdown system was an antiquated and unsafe design; it was originally installed in the 1950s, and had never been connected to a flare system to safely contain liquids and combust flammable vapors released from the process. The released hydrocarbon liquid vaporized as it fell to the ground and formed a flammable vapor cloud. The most likely source of ignition for the vapor cloud was backfire from an idling diesel pickup truck located about 25 feet (7.6 meters) from the blowdown drum. The 15 employees killed in the explosion were contractors working in and around temporary trailers that had been previously sited by BP as close as 121 feet (37 meters) to the blowdown drum. CSB Investigation Approach Shortly after the ISOM incident, two additional incidents occurred at the Texas City refinery in other process units due to mechanical integrity failures. Then on July 21, 2006, the Texas City refinery had a fatality in an accident involving a motorized man-lift. This series of safety failures prompted the CSB to examine the safety culture of BP, including the role played by BP Group management based in London, England4, and its influence on the events that led to the ISOM incident. While conducting its investigation, the CSB found that in the 30 years before the ISOM incident, the Texas City site suffered 23 fatalities. In 2004 alone, three major incidents 1 The raffinate splitter is a distillation tower that takes raffinate, a non-aromatic, primarily straight-chain hydrocarbon mixture and separates it into light and heavy components. 2 The refining isomerization process alters the fundamental arrangement of atoms in a molecule without adding or removing anything from the original material. The ISOM unit at the BP Texas City refinery converted straight chain normal pentane and normal hexane streams to the higher octane branched hydrocarbons isopentane and isohexane that are used for gasoline blending and chemical feedstocks. 3 The BP Texas City refinery is the third largest oil refinery in the U.S. It can produce about 10 million gallons of gasoline per day (about 2.5% of the gasoline sold in the U.S.). Prior to 1999, the refinery was owned and operated by Amoco Corporation. 4 BP Group management is the global corporate management responsible for business operations, including refining and marking (R&M). caused three fatalities. The CSB determined that many of the safety problems that led to the March 23, 2005 disaster were recurring problems that had been previously identified by BP in earlier audits and investigations. The CSB BP Texas City investigation was conducted in a manner similar to that used by the Columbia Accident Investigation Board (CAIB) in its probe of the loss of the space shuttle. Using the CAIB model, the CSB examined both the technical and organizational causes of the incident at Texas City. The CAIB report stated that NASA’s organizational culture and structure had as much to do with this accident as did the immediate cause5. The CAIB also observed that: Many accident investigations make the same mistake in defining causes. They identify the widget that broke or malfunctioned, then locate the person most closely connected with the technical failure: the engineer who miscalculated an analysis, the operator who missed signals or pulled the wrong switches, the supervisor who failed to listen, or the manager who made bad decisions. When causal chains are limited to technical flaws and individual failures, the ensuing responses aimed at preventing a similar event in the future are equally limited: they aim to fix the technical problem and replace or retrain the individual responsible. Such corrections lead to a misguided and potentially disastrous belief that the underlying problem has been solved (CAIB, 2003). A Center for Chemical Process Safety (CCPS) publication explains that as the science of major accident investigation has matured, analysis has gone beyond technical and system deficiencies to include an examination of organizational culture (CCPS, 2005). For example, the CAIB report identified the impact of budget constraints and scheduling pressures in its analysis of the accident’s organizational causes (CAIB, 2003). While technical causes may vary significantly from one catastrophic accident to another, the organizational failures can be very similar; therefore, an organizational analysis provides the best opportunity to transfer lessons broadly (Hopkins, 2000). So although actions taken or errors made by BP operations personnel during the raffinate splitter startup were the immediate causes of the March 23 accident, simply targeting them would miss the underlying and significant cultural, human factors,6 and organizational causes of the disaster that have a greater preventative impact.7 Defining “Safety Culture” The U.K. Health and Safety Executive describes safety culture as “the product of individual and group values, attitudes, competencies and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organization’s health and safety programs” (HSE, 2002). 5 Immediate causes are the events or conditions that lead directly or indirectly to an incident, such as mechanical failure or human error (CCPS, 1999). The immediate cause of the Columbia space shuttle disaster was striking of the left shuttle wing by a piece of insulating foam that separated from the external tank about a minute after launch. During re-entry, superheated air melted the area damaged by the foam strike, weakening the structure, leading to the subsequent failure of the structure and break up of the shuttle (CAIB report, 2003, vol. 1, p.9). 6 “Human factors refer to environmental, organizational, and job factors, and human and individual characteristics, influence behaviour at work in a way which can affect health and safety” (HSE, 1999). 7 The Center for Chemical Process Safety (CCPS) states that identifying the underlying or root causes of an incident has a greater preventative impact by addressing safety system deficiencies and averting the occurrence of numerous other similar incidents, while addressing the immediate cause only prevents the identical accident from reoccurring (CCPS, 1999). The CCPS cites a similar definition of process safety culture as the “combination of group values and behaviors that determines the manner in which process safety is managed” (CCPS, 2007, citing Jones, 2001).