2005 deadly refinery accident
The Texas City refinery explosion occurred on March 23, 2005, when a flammable hydrocarbon vapor cloud ignited and violently exploded at the isomerization process unit of the BP oil refinery in Texas City, Texas, killing 15 workers, injuring 180 others and severely damaging the refinery. All the fatalities were contractors working out of temporary buildings located close to the unit to support turnaround activities. Property loss was $200million ($million in 2023). When including settlements ($2.1 billion), costs of repairs, deferred production, and fines, the explosion is the world's costliest refinery accident. 
The direct cause of the explosion was the ignition of a heavy hydrocarbon vapor cloud which emanated from raffinate liquids overflowing from the top of a blowdown stack. The source of ignition was probably a running vehicle engine. The release of liquid followed the automatic opening of a set of relief valves on a raffinate splitter column caused by overfilling.
Subsequent investigation reports by BP, the U.S. Chemical Safety Board (CSB), and an independent blue-ribbon panel led by James Baker identified numerous technical and organizational failings at the refinery and within corporate BP.
The disaster had widespread consequences on both the company and the industry as a whole. The explosion was the first in a series of accidents (which culminated in the Deepwater Horizon oil spill) that seriously tarnished BP's reputation, especially in the U.S. The refinery was eventually sold as a result, together with other North American assets. In the meantime, the industry took action both through the issuance of new or updated standards and more radical regulatory oversight of refinery activities.
Background.
The refinery.
The refinery was established in 1933 by Pan American Refining Corporation. Pan American merged with Standard Oil of Indiana in 1954 to form Amoco. BP acquired the refinery as part of its merger with Amoco in 1999. As of January 2005, it was the second largest oil refinery out of 23 in Texas (behind Baytown Refinery), and the fourth overall out of 142 in the United States in terms of operating capacity, which was per stream day. At the time of the accident it was one of three refineries in Texas City, the other two belonging to Marathon Petroleum and Valero Energy. The refinery was also one of five BP refineries in the U.S. and BP’s largest worldwide. It could produce around 10 million gallons (38 million L) of gasoline per day, or about 2.5% of the entire volume sold in the United States. It also produced jet fuels, diesel fuels, as well as chemical feed stocks. Its site was covered by 29 oil refining units and four chemical units. It employed around 1,800 BP workers. At the time of the accident, about 800 contractors were onsite to support turnaround works.
At the time of the 1999 merger, the plant was losing money, but BP was extremely successful in turning the tide. In fact, the complex had performed at an all-time record profitability in 2004, with over $1 billion in profit, "more than any other refinery in the BP system" in the words of business unit leader and complex manager Don Parus. By early 2005 the refinery was making profits of around $100 million on a monthly basis.
Safety and maintenance record.
Since 1974 there had been 23 fatalities in 20 separate accidents at the refinery. Three of these occurred in 2004, the year prior to the explosion. Almost half of these fatalities were due to fires or explosions ensuing process fluid releases. A very serious explosion affected the complex in July 1979, when hydrocarbons at were released from a failed elbow in the depropanizer overhead condensing system of the sulfuric acid alkylation unit. More than of liquids were discharged. A large vapor cloud formed and traveled downwind about to the fluid catalytic cracking (FCC) unit, where ignition occurred. A control building, the alkylation unit, the FCC unit, and the carbon monoxide boiler sustained heavy damage. Windows were broken up to away. Although no fatalities occurred, property loss was very significant ($24million, or $million in 2023). Another large explosion took place in March 2004. Although no one was injured, BP temporarily evacuated the refinery. The police closed the access roads and asked residents not to leave their houses.
The plant had been poorly maintained for several years. Starting in the early 1990s, Amoco and later BP made substantial budget cuts, especially affecting maintenance expenditure. Immediately after the merger, in fact, BP ordered a 25% cut in operating costs, which was achieved in part with lower spending in maintenance and training and cutting back on safety staff.
In 2002, BP contracted consulting firm A.T. Kearney to understand "the historical facts which have led to the deterioration of the Texas City refinery performance." The report connected the significant reductions in spending with the deterioration in the refinery's integrity and reliability. An internal BP audit conducted in 2003 found that a "checkbook mentality", blame, and status culture eroded HSE as well as general performance; the condition of assets and infrastructure was poor; management had not created meaningful action plans; and that there were insufficient resources. A similar audit in 2004 found fault across all elements of process safety management. Another external audit report was produced by consulting firm Telos in January 2005. It identified numerous safety issues including "broken alarms, thinned pipe, chunks of concrete falling, bolts dropping, cigarettes falling and staff being overcome with fumes." The report's co-author stated, "We have never seen a site where the notion 'I could die today' was so real." The report also stated, "Most interviewees say that production and budget compliance gets recognized and rewarded before anything else", "Most interviewees at the production level say that the pressure for production, time pressure, and understaffing are the major causes of accidents at Texas City" and thatThere is an exceptional degree of fear of catastrophic incidents at Texas City. People talked or wrote at length about serious hazards are in the operating units from CUI, abandoned asbestos, piping integrity issues, inadequate spare pumps and parts, and other equipment and operating hazards. Of these, piping integrity was repeated again and again. Even where there have been recent investments in piping integrity, people reported that they often could not shut the unit down to in fact replace the pipe they had fabricated. The tolerance of these kinds of risk "distracted" people from routine safe practices at the task level, or made them feel skeptical about the commitment to safety at the plant.Some key reports on the preoccupying conditions of the refinery made their way to company board level. In early March 2005, mere weeks before the explosion, an internal e-mail warned, "I truly believe that we are on the verge of something bigger happening and that we must make some critical decisions [...] over getting the workforce's attention around safety." Management turnover had been high in the years leading to the explosion, with the complex having had five managers in the six years since the merger, with the result that employees were under the impression that any new initiative would not last and that efforts were focused on short-term profit rather than long-term sustainability. The complex was still largely using Amoco safety management processes pre-dating the merger.
The ISOM plant.
The isomerization plant (ISOM) at the site was designed for the conversion of low-octane hydrocarbons, through various chemical processes, into hydrocarbons with higher octane ratings that could then be blended into unleaded gasoline. This is achieved by converting straight-chain hydrocarbon molecules into branched ones. The main feed to the unit was a mix of "n"-pentane and "n"-hexane, with isopentane and isohexane being the main product. The plant consisted of a desulfurization system, a Penex isomerization reactor, a vapor recovery and liquid recycle unit, and a raffinate splitter.
The 170-foot (50 m) tall tower-shaped splitter, a distillation column, was used to separate lighter hydrocarbon components from the top of the tower (mainly pentane and hexane), which condensed and were then pumped to a light raffinate storage tank, while the heavier components (mainly C7 and C8) were recovered lower down in the splitter, then pumped to a heavy raffinate storage tank. The unit had an operational capacity of per day.
Excess hydrocarbon vapors and liquids from vent and relief were sent to vessel F-20, a blowdown stack. This was designed to disperse vapors from the top and convey any liquids through a gooseneck into the plant closed sewer network. It was a diameter vertical drum with a vertical flue pipe. F-20 was put in commission in the 1950s and had gone through several modifications over the years.
Unit turnarounds and use of portable buildings.
Remedial work had been started on the raffinate splitter from February 21, 2005. Two turnaround activities were also taking place at the adjacent ultracracker unit (UCU) and at the aromatics recovery unit (ARU) at the same time. Portable buildings and trailers were often installed for use as offices during construction and maintenance. In 2004, 122 trailers were in the refinery with an estimated occupancy of 800. BP allowed trailers to be placed near process units based on the results of a screening process.
In 1995 a site-wide temporary siting analysis report had been created at the facility that established an acceptable layout of trailers and other temporary structures with respect to nearby hazardous process facilities. The report was revalidated in 2002, still based on Amoco's standards although more than three years had passed since the BP–Amoco merger. In turn, Amoco's "Facility Siting Screening Workbook" was based on the American Petroleum Institute's Recommended Practice 752. The next siting analysis was due to take place in 2007 and, therefore, any siting changes before then would have to be under the management of change (MOC) process. Plans were made late in 2004 to accommodate contractors due to work on the UCU in 2005 in nine single trailers and one double-wide trailer immediately west of the ISOM process unit. The team carrying out the MOC assessment for the placement of the double-wide trailer identified that the structure would be less than from the ISOM plant, a distance below which a dedicated risk analysis had to be carried out under Amoco's "Workbook" provisions. This team, however, lacked the expertise to complete the risk assessment. The introduction of the nine single trailers in the picture was not assessed in an MOC. Further, contrary to procedure, recommendations issued in the analysis of the change involving the placement of the double-wide trailer were still open when the trailers were occupied in November 2004.
Circumstances of the accident.
Early morning.
The start-up process commenced with the night-shift lead operator on March 23 carrying out the initial filling of the splitter tower. Because plant start-ups are especially prone to unexpected situations, operational practice requires the application of a controlled and approved pre-start-up safety review (PSSR) procedure. BP had one, but it was not adopted in this case. The process control level transmitter was designed to indicate the raffinate level within a span from the bottom of the splitter tower to a level. A high-level alarm dependent on this transmitter sounded as intended at 3:09 am, when a level of from the bottom was reached. However, during start-up it was common to ignore this alarm and fill up to a level of 99% (as indicated by the transmitter) to prevent damage to the furnace heating the splitter bottom. Unbeknown to the operators, the process control level transmitter, which was used to monitor the level in the splitter during the whole start-up operation, was not calibrated and its readings were not reliable. An independent level alarm triggered by a high-level switch should also have sounded at but failed to. At 5:00 am, the lead operator in the ISOM satellite control room briefed the central control room and went home early. At 6:00 am, the day-shift board operator (central control room operator) arrived and started his thirtieth consecutive day on a 12-hour shift duty. By this time, the level was still believed to be below the 9-foot mark, but it was already at .
At 7:15 am, more than one hour late on the commencement of his shift (6:00 am), one of the two day-shift supervisors ("A") arrived at the central control room. Because of his lateness, he could not go through the required handover with the night shift. During the morning meeting on March 23, it was discussed that the heavy raffinate storage tanks were nearly full and, therefore, a