Lessons Learned From Texas City Refinery Explosion

Bill Rigot EFCOG Human Performance Task Group May, 2007

BP: company says employee failures led to deaths of 15 people at Texas City, BP:Employees Employeescaused causeddeadly deadlyblast blast- -Oil Oil company says employee failures led to deaths of 15 people at Texas City,
Texas, refinery in March. Texas, refinery in March.
May 18, 2005: 5:41 AM EDT May 18, 2005: 5:41 AM EDT

TEXAS CITY, Texas (Dow Jones)-- BP PLC (BP) said Tuesday that failures by its employees were responsible for an explosion at its TEXAS CITY, Texas (Dow Jones)-- BP PLC (BP) said Tuesday that failures by its employees were responsible for an explosion at its Texas City refinery on March 23, the deadliest industrial accident in 15 years. Texas City refinery on March 23, the deadliest industrial accident in 15 years. BP Products will take disciplinary action against supervisors and hourly employees who were directly responsible for operating the BP Products will take disciplinary action against supervisors and hourly employees who were directly responsible for operating the isomerization unit on March 22 and 23. These actions will range from warnings to termination of employment. As the investigation isomerization unit on March 22 and 23. These actions will range from warnings to termination of employment. As the investigation continues and new information is discovered, others may also be disciplined, the company said. continues and new information is discovered, others may also be disciplined, the company said. "If ISOM unit management had properly supervised the startup, or if ISOM unit operators had followed procedures or taken corrective "If ISOM unit management had properly supervised the startup, or if ISOM unit operators had followed procedures or taken corrective action earlier, the explosion would not have occurred", said Ross Pillari, president of BP Products North America. action earlier, the explosion would not have occurred", said Ross Pillari, president of BP Products North America.

Accident Summary
On March 23, 2005, at 1:20 p.m., the BP Texas City Refinery suffered one of the worst industrial disasters in recent U.S. history. Explosions and fires killed 15 people and injured another 180, alarmed the community, and resulted in financial losses exceeding $1.5B. The incident occurred during startup of an isomerization1 (ISOM) unit when a raffinate splitter tower was overfilled; pressure relief devices opened, resulting in a flammable liquid geyser from a blowdown stack that was not equipped with a flare. The release of flammables led to an explosion and fire.
3

The Chemical Safety Board

The U.S. Chemical Safety and Hazard Investigation Board (CSB) final report of the Texas City Explosion was released 3/26/2007
- The CSB is an independent federal agency charged with investigating industrial chemical accidents - CSB Board members are appointed by the president and confirmed by the Senate - CSB investigations look at all aspects of chemical accidents, including physical causes such as equipment failure as well as inadequacies in regulations, industry standards, and safety management systems - The CSB does not issues citations or fines, but does make safety recommendations to plants, industry organizations, labor groups, and regulatory agencies such as OSHA and EPA - The CSB Accident Reports and video reconstruction are available on their website, www.csb.gov
4

The Baker Report

Pursuant to an urgent recommendation from the CSB interim report, BP commissioned former Secretary of State James Baker to conduct a third party review of BP corporate practices leading up to the Texas City explosion Secretary Baker completed his review January 2007 The Baker Panel focused principally on Process Safety rather than personal safety

Baker Panel Findings

Corporate Safety Culture
- BP Board did not exercise good Process Safety leadership - At Texas City particularly, BP managers did not empower employees in the Corporate Safety Culture - BP corporate did not provide appropriate resources to assure adequate process safety - BP managers did not incorporate process safety into management decision making - BP corporate did not assure a common, unifying Process Safety culture among its US refineries
6

Baker Panel Findings (Cont.)

Process Safety Management Systems
- BP Process Risk Assessment and Analysis was flawed - BPs US refineries did not comply with its own internal process safety standards - BP refineries did not implement good engineering practices - Process safety knowledge and competence was not maintained at BP US refineries - BPs corporate process safety management system was ineffective and not measurable

Baker Panel Findings (Cont.)

Performance Evaluation, Corrective Action, Corporate Oversight
- BP measured safety performance through personal injury rate, rather than measuring process safety equipment performance - BPs causal analysis methods were inadequate and flawed - The process safety audit system was inadequate - BP managers did not provide timely correction of process safety deficiencies - BP corporate oversight of refinery specific process safety information was flawed
8

CSB Identified Root Causes

BP Group Board did not provide effective oversight of the companys safety culture and major accident prevention programs. BP Senior Executives:
- Inadequately addressed controlling major hazard risk, particularly process safety performance; - Did not provide effective safety culture leadership and oversight to prevent catastrophic accidents; - Ineffectively evaluated safety implications of major organizational changes; and - Did not provide adequate resources to its refineries
9

CSB Identified Root Causes (Cont.)

BP Texas City Managers did not:
- Create an effective reporting and learning culture; i.e. bad news was not welcomed (by inference a Just Culture was not achieved either); - Effectively investigate accidents; - Hold supervisors and managers accountable for process safety performance; - Incorporate good practice design in the operation of hazardous chemical systems; - Ensure that operators were supervised and supported during unit startup; and - Effectively incorporate human factor considerations in its training, staffing and work schedule for operations personnel
10

CSB Identified Contributing Causes

BP Texas City Managers:
- Lacked an effective mechanical integrity program to maintain instruments and process safety equipment; - Did not have an effective vehicle traffic policy to control traffic into hazardous process areas or to establish safe distances from process unit boundaries; - Ineffectively implemented Pre-Startup Safety Review policy; nonessential personnel were not removed from areas in and around process units during the hazardous unit startup; and - Located trailers in close proximity to hazardous operations.

11

Latent Organizational Weaknesses

Work environment encouraged procedural noncompliance Ineffective communications for shift change and hazardous operations (such as unit startup) Malfunctioning instrumentation and alarms Poorly designed computerized control system Insufficient staffing Lack of human fatigue-prevention strategy Inadequate operator training for abnormal and startup conditions Failure to establish effective safe operating limits 12

Latent Organizational Weaknesses (Cont.)

Ineffective incident investigation management system Ineffective Lessons Learned program No coordinates line management self-assessment process No flare on blowdown drum No automatic safety shutdown system Occupied trailers too close to hazardous operations Key operational indicators and alarms inoperative Ineffective response to serious safety problems and events Focus on injury and illness statistics, not process safety
- This was an observed Latent Organizational Weakness for their OSHA regulator as well
13

Latent Organizational Weaknesses (Cont.)

Poor implementation of Process Hazards Analyses (PHA) and Management of Change (MOC) processes (equivalent to USQ) Ineffective follow-up to audit reports Problem reporting not encouraged Inadequate implementation of OSHA Process Safety Management regulations Inadequate OSHA inspections and enforcement Gaps in applicable industry standards
14

Anatomy of an Event The INPO View

Flawed Defenses
Vision, Beliefs, & Values Vision, Beliefs, & Values

n Missio Goals es P o l i c i es ss Proce s am Progr

Event
Initiating Action

Latent Organizational Weaknesses Error Precursors

15

Equipment Ergonomics & Human Factors Environmental Housekeeping Work-arounds & Conditions Inconveniences RWPs Worker Knowledge, Skill, & Proficiency Personal Motives Morale Values & Beliefs Procedure / Work Package Quality Lockout / Tagout Fitnessfor-Duty Equipment Labeling & Condition Intolerance for Error Traps

Flagging Turnover Clearance Walkdown Pre-job Briefing Just-in-time Operating Experience Challenge Critical Parameters Procedure Use & Adherence Self-Checking Questioning Attitude 3-Part Communication Management Monitoring Problem-solving Methodology Supervision Rigor of Execution Team Skills

Tool Quality & Availability

Conservative Decision-Making Place-Keeping

Task Preview

Foreign Material Exclusion

Uneasy Attitude Roles & Responsibilities

Double (dual) Verification Peer-Checking

JOB-SITE CONDITIONS
High Standards

Questioning Attitude Coaching Respect for Others

WORKER BEHAVIOR
Reinforcement

Recognizing Error Traps Stop When Uncertain

Walkdowns HP Surveys Task Qualification Task Assignment Performance Feedback

QC Hold Points

Motivation

Leadership
Compelling Vision Example

Courage & Integrity

Independent Verification Personal Protective Equipment

Forcing Functions Interlocks FME

Healthy Relationships

Proper Reactions

Alarms

Handoffs

ORGANIZATION PROCESSES Compatible Reviews & Goals & Priorities Approvals & VALUES Safety Role Strategic Models Philosophy
HU Plans Design & Configuration Control Staffing Task Allocation OE Work Planning Simple / Effective ProblemProcesses Solving Accountability Self-Assessment Socialization Benchmarking Labor Corrective Action Relations Program Management Practices Clear Expectations

Training Procedure Revisions Rewards & Meetings Reinforcement

Open & Honest Communication

FACILITY RESULTS
Post-job Critiques Problem Root Cause Reporting Analysis Independent Oversight Performance Indicators

Reactor Protection Systems Equipment Reliability

Safeguards Equipment Containment

Scheduling / Sequencing

Change Mgmt.

Communication Practices & Plan

Performance 16 Model
w/ example defenses

Trend Analysis

Equipment Ergonomics & Human Factors Environmental Housekeeping Work-arounds & Conditions Inconveniences RWPs Worker Knowledge, Skill, & Proficiency Personal Motives Morale Values & Beliefs Procedure / Work Package Quality Lockout / Tagout Fitnessfor-Duty Equipment Labeling & Condition Intolerance for Error Traps

Flagging Turnover Clearance Walkdown Pre-job Briefing Just-in-time Operating Experience Challenge Critical Parameters Procedure Use & Adherence Self-Checking Questioning Attitude 3-Part Communication Management Monitoring Problem-solving Methodology Supervision Rigor of Execution Team Skills

Tool Quality & Availability

Conservative Decision-Making Place-Keeping

Task Preview

Foreign Material Exclusion

Uneasy Attitude Roles & Responsibilities

Double (dual) Verification Peer-Checking

JOB-SITE CONDITIONS
High Standards

Questioning Attitude Coaching Respect for Others

WORKER BEHAVIOR
Reinforcement

Recognizing Error Traps Stop When Uncertain

Walkdowns HP Surveys Task Qualification Task Assignment Performance Feedback Cost cutting, Failure to invest, Production pressures

QC Hold Points

Motivation

Leadership
Compelling Vision Example

Courage & Integrity

Independent Verification

Forcing Functions

Healthy Relationships

Interlocks Personal Protective FME Equipment Alarms

Proper Reactions

Handoffs

ORGANIZATION PROCESSES Compatible Reviews & Goals & Priorities Approvals & VALUES Safety Role Strategic Models Philosophy
HU Plans Design & Configuration Control Staffing Task Allocation OE Work Planning Simple / Effective ProblemProcesses Solving Accountability Self-Assessment Socialization Benchmarking Labor Corrective Action Relations Program Management Practices Clear Expectations

Training Procedure Revisions Rewards & Meetings Reinforcement

Open & Honest Communication

FACILITY RESULTS
Post-job Critiques Problem Root Cause Reporting Analysis Independent Oversight (by BOD) Performance Indicators (injury rates

Reactor Protection Systems Equipment Reliability

Safeguards Equipment Containment

Scheduling / Sequencing

Change Mgmt.

Communication Practices & Plan

Performance 17 Model
B/P Texas City

Trend Analysis

Lessons Learned to DOE Contractors

Could this really apply to us? Do we have higher or lower consequence events? What is our relationship with our regulator(s)?

18

Areas of Similarity
Aging facilities Safety Culture not well understood with revolving DOE contractors Budget limitations Causal Analysis weaknesses Equipment Reliability strategies Uneven quality of written operating and maintenance procedures Weak management self-assessment processes Focus on injury and illness statistics 19

Areas of Difference
Regulator (DOE) embedded with the contractor organization Competent third party oversight (DNFSB) Standardized (and enforced) Process Safety Authorization Basis development Parent Organization Oversight Program now required in DOE contracts

20