10th Annual Symposium: The Prevention of Serious Accidents

Lessons Learned from the BP Refinery Explosion and Other IncidentsCSB Investigator, Cheryl MacKenzie22 November 2007

2

www.csb.gov

CSB Mission

• Investigating chemical incidents• Determining causes• Making recommendations• Promoting awareness • Conducting research and studies on

accidental releases (e.g. reactives, dust)

To promote prevention of industrial chemical accidents by…

3

www.csb.gov

CSB Overview• Five-member board

– Presidential appointment– Senate confirmation– Five year terms

• Staff positions– Investigators– Recommendations– Outreach

4

www.csb.gov

• Deaths or injuries onsite or offsite• Property losses• Offsite impact

Public/Environmental• Incidents with broad national

significance• Resources available

Investigation Criteria

5

www.csb.gov

Two Key Lessons from BP Texas City

1. Human Error is a symptom of underlying problems

2. Process safety metrics need to be developed; injury rate data provides an incomplete picture of safety performance

6

www.csb.gov

Incident Summary• March 23, 2005• 15 deaths and 180

injuries• During startup, tower

and blowdown drum overfilled

• Liquid hydrocarbon released, vapor cloud formed and ignited

• Explosion and fire

7

www.csb.gov© Financial Times

8

www.csb.gov© Financial Times

9

www.csb.gov

10

www.csb.gov

Three Initiating Conditions• The overfilling of the distillation tower

• The use of a blowdown drum and stack that open to the atmosphere

• The placement of the contractor work trailers adjacent to high hazard process units

11

www.csb.gov

Why was the splitter tower overfilled?

Careless operators?

Lesson 1

Human Error is a Symptom of Underlying Problems

13

www.csb.gov

Human factors• Human errors contributed to the

overfilling of the tower for 3 hours

• But individuals do not plan to make mistakes; they do what makes sense to them at the time

14

www.csb.gov

Human Factors• Must ask:

Why did the individuals take the actions that they did?

• Numerous underlying conditions influenced operators’ decision-making and actions

15

www.csb.gov

Human Error was a Symptom of Underlying Problems at Texas City• Historical deviations of startup• A lack of a shift communication policy or

emphasis on communication• Malfunctioning equipment/instruments• Fatigued operators and lack of a policy for

maximum allowable hours• Budget cuts to staffing and training

16

www.csb.gov

Historical Deviations of Startup• The startup procedure required the tower

level control valve be open and the tower be filled within the range of the level transmitter

• However, the board operator closed the tower level control valve and filled the tower above the amount specified in the procedures

• To understand why he made these decisions, the CSB reviewed what other board operators did in previous startups

17

www.csb.gov

Procedural deviations common in 19 startups of the unit from 2000 to 2005• In a majority of the startups the tower was filled

above the range of the level transmitter• Swings in level experienced in 18 of these

startups• Tower ran with high level to protect equipment• None of these startups was considered

abnormal or investigated to correct problems• Management did not revise out-dated

procedures

18

www.csb.gov

Communication was ineffective between operations personnel

• Multiple critical miscommunications occurred– Instructions for routing feed led to the level

control valve being closed– The condition of equipment was not

communicated from one shift to the next

• BP had no policy for effective communication between operations personnel during shift changes

19

www.csb.gov

Tower instruments malfunctioned• Six pieces of instrumentation

malfunctioned on the day of the incident, including:– A redundant high level alarm– A sight glass on the tower– A miscalibrated level transmitter

• The level transmitter’s setting was incorrect, likely not altered since it was set 30 years ago

20

www.csb.gov

Operators were likely Fatigued• Operators worked 12-hr shifts,

7 days-a-week, 29+ days• Acute sleep loss and

cumulative sleep debt resulted

32130292827

26252423222120

19181716151413

1211109876

543212827

March 2005

• BP has no corporate or site-specific fatigue prevention policy or maximum shift work regulations

• No fatigue prevention guidelines widely used in refining industry

21

www.csb.gov

Supervisor and Operator Staffing was Insufficient• Unit Startups are especially hazardous

• No supervisor assisted with startup

• 25% budget cut target in 1999 led to ISOM staffing cuts - control room consolidation and increased workloads followed

• Hazard review recommended two board operators during all startups, but only one on March 23

22

www.csb.gov

Operator Training was not effective• Move to computer-based training without

effective verification methods of competency

• Switch to computer-based training “was a business decision driven by cost”

• From 1998 to 2004 central training staff reduced from 28 to 8 and budget cut in half

• Concurrent with BP London instruction to cut costs 25%

23

www.csb.gov

Operator Training was not effective• Audits and reviews from 2002 - 2005

identified on-going deficiencies in operator competency

• Yet managers adopted a compliance strategy that relied more on operating personnel and less on engineering controls to prevent accidents due to cost

• No effective training for abnormal situation management or simulation technology made available

24

www.csb.gov

Safety Culture

25

www.csb.gov

Safety Culture

• “The way we do things around here”

• Can be positive or negative

• Is influenced by management changes, historical events, and economic pressures

• Can be used as an analysis tool

26

www.csb.gov

Companies with a Positive Safety Culture:

• Learn from previous incidents and safety deficiencies

• Encourage reporting of safety concerns, issues, and problems by all levels of staff and take visible and concrete actions to remedy the issues

27

www.csb.gov

Companies with a Positive Safety Culture:

• Focus on controlling the risks of major hazards

• Provide adequate resources for safe operation

28

www.csb.gov

BP Texas City Did Not Have a Positive Safety Culture• Organizational causes were embedded in the

refinery’s history and culture• Causes extended beyond the ISOM unit to

actions of people at all levels of the corporation • Multiple safety system deficiencies were found

BP did not effectively measure and manage safety

Lesson 2

Process safety metrics need to be developed; injury rate data provides an incomplete picture of safety performance

30

www.csb.gov

BP’s “Days Away from Work” Rate

http://www.bp.com/sectiongenericarticle.do?categoryId=9010712&contentId=7021106

31

www.csb.gov

Major Hazard

RiskEvent

Severity

Frequency / probability

Major hazard accidents are

here

..but most of the management systems, (e.g. performance measures, audits, behavior-based safety programs, etc.) are aimed here

Event Severity

Frequency/Probability

© HSE

32

www.csb.gov

Examination of BP Texas City’s History

• In the previous 30 years, the Texas City site experienced multiple major accidents and 23 fatalities, not counting the 15 deaths on March 23

• Recurring safety problems identified in audits, reports, and investigations

33

www.csb.gov

CSB Investigation Findings• Texas City infrastructure and equipment

found to be in “complete decline”• A 2002 Texas City study warned of “serious

concerns about the potential for a major site incident” due to mechanical integrity problems

• A follow-up report found that from 1992 to 2000, capital spending was reduced 84% & maintenance spending was reduced 41%

34

www.csb.gov

CSB Investigation Findings• A 2003 refinery maintenance study

concluded that maintenance and mechanical integrity problems persisted at Texas City

• A 2003 external safety audit found inadequate training, a large number of overdue action items and a concern about “insufficient resources to achieve all commitments”

35

www.csb.gov

CSB Investigation Findings

• In 2004, Texas City experienced three major incidents and three fatalities

• Safety system action item closure rate was down to 79% in 2004, from 95% in 2002.

36

www.csb.gov

Safety Culture Assessment found:• Serious mechanical integrity hazards led

to “an exceptional degree of fear of catastrophic incidents”

• “Production and budget compliance gets … rewarded before anything else” and “pressure for production, time pressure, and understaffing are the major causes of accidents”

• Leadership commitment “is undermined by the lack of resources to address severe hazards”

CSB Investigation Findings

37

www.csb.gov

CSB Investigation Findings

Management’s Response Insufficient• Continued focused on improving worker

behavior without sufficient assessment of safety systems and hazardous conditions

• Mistakenly thought safety culture at the site was improving because personal safety statistics were improving

38

www.csb.gov

CSB Investigation Findings• BP Corporate Refining executives ordered

a 25% reduction “challenge” for 2005• The 2005 refinery safety business plan

developed for site leadership listed the following key risks:– Mechanical integrity– Operator competency– The possibility that “Texas City kills

someone in the next 12-18 months”

And NOT Only At BP

Safety culture and process safety systems of high hazard industries need the same emphasis and focus as personal safety

40

www.csb.gov

Formosa Plastics ExplosionIlliopolis, IL • April 23, 2004

• Flammable vinyl chloride release ignited

• 5 fatalities, 2 injured

41

www.csb.gov

Operator at control panel

Operator at drain valve

42

www.csb.gov

Formosa Plastics ExplosionImmediate Events – Human Error• Operator in the process of cleaning a

reactor accidentally drained a full reactor • Operator bypassed an interlock to open the

reactor bottom valve, releasing its highly flammable contents

• Operations staff attempted to stop release• Vinyl chloride ignited

Careless operations staff?

43

www.csb.gov

Formosa Plastics ExplosionSafety System Deficiencies• Controlled risk through procedures and

training instead of making an engineering design change to safeguard unintentional opening of a reactor

• Ambiguous facility emergency procedures for evacuation; no drills in 10+ years

• Lessons from previous incidents not shared and learned

44

www.csb.gov

Giant Industries Refinery ExplosionGallup, NM • April 8, 2004

• Workers removing a pump

• Valve connecting the pump to a distillation column left open

• Release and ignition of flammable material

• 4 seriously injured

45

www.csb.gov

46

www.csb.gov

Giant Industries Refinery ExplosionImmediate Events – Human Error• Operator relied on the position of the valve

wrench to determine if the valve was open• The operator tagged and locked the valve in

what he thought was a closed position• The valve was actually open• When maintenance began unbolting the

pump, the flammable material was released, and ignited

Careless workers?

47

www.csb.gov

• Equipment was allowed to be used in a manner for which it was not designed with no assessment of the safety implications of the change

• Additionally, the valve wrench was not permanently affixed to the valve equipment

• Due to its size, it was often removed and replaced only when needed

Giant Industries Refinery ExplosionSafety System Deficiencies

48

www.csb.gov

• The pump had a history of failures – 23 work orders submitted to repair the pump in the one year previous to the incident

• Yet the pump was never assessed to determine the cause of the failure

Giant Industries Refinery ExplosionSafety System Deficiencies

49

www.csb.gov

For more information…www.csb.gov- BP Texas City Explosion and Fire- Formosa Plastics Vinyl Chloride Explosion- Giant Industries Refinery Explosion and Fire - Other reports, videos, animations

http://www.safetyreviewpanel.com/- The Baker Report

10th Annual Symposium: The Prevention of Serious Accidents

Lessons Learned from the BP Refinery Explosion and Other IncidentsCheryl MacKenzie (CherylM@csb.gov)

Questions?www.csb.gov

51

www.csb.gov

DisclaimerThis presentation is given for general informational purposes only. The presentation represents the individual views of Cheryl MacKenzie and all references, conclusions or other statements regarding current on going CSB investigations are preliminary in nature and limited to information that is already in the public domain. Furthermore, my statements today and this presentation do not represent a formal adopted product of the entire Board. Users of this presentation should also note that the contents were compiled solely for this presentation. For specific and accurate information on completed investigations, please refer to the final printed version by going to the CSB website at www.csb.gov. and clicking on the specific report desired under completed investigations. To the extent this presentation discusses completed investigations, such statements come under the general prohibition in 42 U.S.C. §7412(r)(6)(G).