Team 18 Caroline Koenig

Ryan Tagher
Herman Tay Hong Cheng
Morgan Walli

Safety Case Study Report

2005 BP America Texas City Refinery:
Fire and Explosion

CME 470 | Fall 2019

November 22, 2019

Individual Contributions to Report

Caroline Koenig was responsible for researching and writing the sections of the report that
focused on the accident itself and the consequences of the incident. Completed the HAZOP
analysis for the blowdown drum.

Ryan Tagher was responsible for researching and writing the section of the report that focused
on the lessons learned from the incident, what measures should be taken to prevent further
accidents, and conclusions. Located and added Figures 1, 2, 3, and 4.

Herman Tay Hong Cheng was responsible for researching and writing the sections of the report
that focused on analyzing the incident in the context of process safety management. Formatted
sources.

Morgan Walli was responsible for researching and writing the section of the report that focused
on the incident overview, plant background, events leading up to the accident, and the design of
the process itself. Completed HAZOP analysis for raffinate splitter.
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

Overview
On March 23, 2005 in Texas City, TX, an idling pickup truck resulted in an explosion
that killed fifteen people and injured one-hundred eighty others.1,2,3 The truck, itself, was not the
cause of this catastrophic event. Instead, the ineffective startup of the isomerization unit (ISOM)
at BP’s Texas City Refinery was to blame. Due to a loss of process controls and insufficient
safety precautions, the tower overflowed which resulted in a massive release of flammable
vapors. Once ignited by the idling truck, these vapors exploded rapidly and fires erupted within
the plant. Alongside substantial loss of life and significant injuries, the explosion also resulted in
a $1.5 billion financial loss.1,2,3 In addition, BP was fined a total of $71.9 million by the
Occupational Safety and Health Administration (OSHA) due to this incident; ultimately, this
Texas City plant was sold to Marathon in 2013 and currently remains as their Galveston Bay
Refinery.1,2,3,4 While the plant may now operate under a different name and corporation, the
lessons learned are not so fleeting. The incident resulted in major revisions to safety protocols on
both technical and organizational levels to create general guidelines for safe and effective
operation, which are widely applicable to any operation utilizing similar equipment/processes.
Background
In 2005, BP’s Texas City Refinery was the third largest oil refinery plant in the United
States.1 Acquired in 1999 through the BP-Amoco Merger, it was the largest of BP America’s
refineries, spanning across 1,200 acres of land.1 The plant employed 1,800 employees and 800
on-site contractors.1 With twenty-nine refining units and four chemical units, the plant produced
10 million gallons of gasoline fuel annually.1 Since a high number of contractors were employed
at the plant, numerous contractor trailers were on-site at the time of the incident and many were
even located near the ISOM unit (where the incident occurred). In addition, some of the units
were shut down for maintenance at that time. The ISOM unit had just been restarted after
undergoing maintenance work leading up to the incident.1
While the mechanical attributes of the plant played a significant role in the events leading up
to the incident and in the incident itself, the Texas City Refinery’s work culture also played a
major role in allowing for a situation with such circumstances to occur. The plant had a history
of frequent management changes leading to poor handover, insufficient training and
inexperienced employees. Documentation of process changes and procedures were frequently
neglected and left out-of-date. The poor safety culture extended beyond management of change
with a low reporting rate of safety issues across the plant. In addition, no executive board
member was assigned to oversee safety and incident prevention in the plant.1
BP’s poor safety culture was reflected in a variety of incidents occurring prior to the 2005
explosion in the ISOM unit. In 2002, a study completed by the director of BP’s South Houston
Integrated Site found that equipment was “in complete decline” and warned of an impending
major incident based on these observations.1 In 2004, two fires occurred in ultraformers at the
plant. The first, which occurred in Ultraformer #4, resulted in no action being taken to correct the
problem despite inspector recommendation to replace the unit one year prior to the incident in
2003.1 The second fire occurred in Ultraformer #3 due to ineffective lockout procedures. Two
workers were killed and one was injured.1
The isomerization unit also had a history of unresolved safety incidents. Installed during the
1980s, the unit was used to increase octane levels in unleaded gasoline, enabling higher
compression to be used in engines before ignition and reducing knock. 1,5 This ISOM unit

1
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

consisted of a desulfurizer, a reactor, a recovery and recycle unit, and a raffinate splitter tower.
The raffinate splitter tower where the incident ultimately occurred received raffinate from the
aromatics recovery unit and was used to separate the feed into light and heavy hydrocarbons. In
this splitter, the side stream flow rate was controlled by a level control valve that was adjusted
manually to maintain a constant fluid level in the tower. As safety measures, the splitter had one
alarm for high liquid level and one alarm for low liquid levels, which relayed their readings to
the control board using a level transmitter. The distillate stream piping routed off the top of the
splitter was also equipped with pressure relief valves that lead to a blowdown drum in case of
overflow.1 The blowdown drum itself was also equipped with a high-level alarm.
Figure 1 shows the process diagram for the ISOM unit, including the blowdown drum and
pressure relief valves. Importantly, the blowdown drum was not connected to a flare. Despite the
use of flares being the accepted safety standard at the time, BP opted to use cheaper equipment
instead.1 Safety follow-up was treated with similar nonchalance as preventative safety measures.
Eight releases of flammable material from the raffinate splitter had been recorded, along with
abnormally high raffinate splitter tower liquid levels during most startups. No investigation or
follow up on either of these minor incidents were ever pursued.1

Figure 1 Process Diagram of Raffinate Splitter (Reprinted with permission of United States Chemical
Safety Hazard Investigation Board (2007). United States Chemical Safety Hazard Investigation Board)

Figure 2 shows the general layout of the isomerization unit. Note the proximity of the
contractor trailers, outlined in yellow, to the blowdown drum. Of additional importance are the
ISOM unit as a whole, which is outlined in orange, and the locations of the satellite control room
and raffinate splitter within this area. The NDU and catalyst warehouse adjacent to the trailer
area and ISOM unit are also relevant structures, suffering much of the damage that resulted from
the explosion.

2
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

Figure 2 Isomerization Unit Layout (Reprinted with permission of United States Chemical Safety Hazard
Investigation Board (2007). United States Chemical Safety Hazard Investigation Board)

The Accident

Prior to the incident, the raffinate section of the isomerization unit had been shut down
for maintenance and was scheduled to start back up on the morning of March 23, 2005.1 At the
time of scheduled startup, most but not all of the scheduled maintenance was complete, with
three contractor crews still working on the unit. In addition, instrumentation known to be faulty
had not yet been fixed.1 Despite these obvious concerns, the unit was restarted anyway. Here,
additional mistakes were made. Crucial pre-startup steps were not performed and no extra
supervision and assistance was provided for the startup process – both violations of BP’s
standing company policy.1
Upon startup, the splitter tower was slowly filled with flammable hydrocarbon feed over
a period of over three hours.1 During this stage in the startup process, the high fluid level alarms
failed to alert employees of the fluid level in the tower. As a result, the tower overflowed into the
overhead distillate pipe. During normal function, this pipe collected vapor distillate from the top
of the column and routed it to an air-cooled condenser, the reflux drum, and a pump, where a
portion was recycled back into the column. However, when the column overflowed, pressure
built up in the overhead pipe. The pressure relief valves operated as intended, opening and
allowing fluid to escape to the blowdown drum as it was designed to do in case of pressure
buildup or overthrow.1
Due to the malfunctioning high-level fluid alarms, employees were unaware of the
overflowing splitter and the blowdown drum, itself, began to fill and eventually overflowed.

3
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

Without a flare in place to burn the flammable hydrocarbons emerging from the blowdown
drum, the overflowing fluid spilled out of the drum, vaporizing as it did so and forming a
flammable vapor cloud.1 These vapors settled and collected in the area. Then, ignited by a pickup
truck parked roughly twenty-five feet from the blowdown drum, the vapors exploded.1
A large blast overpressure of up to 10 psi and numerous secondary fires resulted.1 Much
of the surrounding infrastructure was destroyed or damaged, including the satellite control room
and catalyst warehouse. Seventy vehicles and fifty-three trailers, including those located near the
isomerization unit, were damaged or destroyed.1 Windows within a three-quarter mile radius
were broken.1 The human impact of the incident was even more substantial. In total, one-
hundred eighty workers were injured, sixty-six of whom required medical accommodations
ranging from actual medical treatment to time off.1 Even worse were the fifteen fatalities:
contract workers who had been working near the trailers who died of blunt force trauma.1 Figure
3 shows the extent of the explosion and Figure 4 shows the destruction it caused. Note that the
red arrow indicates the location of the blowdown drum.

Figure 3 The Explosion (Reprinted with permission of NBC News (2007). NBC News)

Figure 4 The Aftermath of the Explosion (Reprinted with permission of United States Chemical Safety
Hazard Investigation Board (2007). United States Chemical Safety Hazard Investigation Board)

4
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

The emergency response to the incident must also be considered. This response began
within the plant when employees were alerted that the blowdown drum had begun to overflow.
At the time, they were investigating the spike in pressure in the overhead piping attached to the
distillate section of the splitter tower but were not aware of the cause or consequences of the
overpressure.1 The notification was received over the radio and relayed to the Board and Lead
Operators, who stopped the flow of feed to the base of the splitter tower.1 Isomerization unit
operators evacuated per BP’s emergency response procedure and redirected traffic away from the
area. After the explosion had actually occurred, the Texas City Industrial Mutual Aid System
(IMAS) responded, activating both fire and search-and-rescue units.1 In addressing the incident,
debris from damaged vehicles, contractor trailers, and other structures were disturbed to recover
victims. Importantly, the positions of certain valves were changed to enable effective and safe
emergency response. While the resulting lack of records of valve positions hinders incident
reconstruction, a safe and effective emergency response in which no first responders were
injured was affected.1
In the aftermath of the event, OSHA fined BP $21.3 million for negligence in the 2005
incident and the Chemical Safety Board (CSB), citing 301 willful safety violations. OSHA
mandated that these violations be corrected.1,2,3 By 2009, BP had failed to implement the
mandated safety changes quickly enough. Another additional $50.6 million fine resulted. 1,2,3
BP’s continued struggle with process safety continued and even amplified in 2010 with the BP
Deepwater Horizon Oil Spill. 2,6 The explosion of the Deepwater Horizon oil rig resulted in the
loss of 130 million gallons of oil dumped into the Gulf of Mexico – the largest accidental marine
oil spill to date.6 A $7.8 billion settlement ensued, resulting in financial difficulties for the
company in addition to the damage the Deepwater Horizon and Texas City refinery explosions
had done to their public image.6 In 2013, BP sold the Texas City Refinery to Marathon in an
effort to recover funds lost in the 2010 oil spill. The plant was sold for $2.4 billion over the
course of a six-year period.2 Today, the plant is Marathon’s Galveston Bay Refinery and remains
the third largest refinery in the United States.2
Analysis
Despite the tragedy of the 2005 incident at BP’s Texas City Refinery, it provided
valuable insight into how such incident occurred and how future incidents can be prevented. Of
the fourteen Process Safety Management (PSM) elements, six stand out as particularly prominent
to this case: mechanical integrity, process hazard analysis, process safety information, operating
procedures, management of change, and pre-startup safety review. The first of these elements is
perhaps the easiest to elucidate of the six. The instrumentation failure of the high-level fluid
alarms was at the core of the incident; if this equipment been operating correctly, employees
would have been warned of the high fluid levels in the tower and intervened, so the
resulting overflow and explosion could have been avoided. Instead, the level transmitter
displayed an inaccurate reading, indicating that the level of fluid in the column was a fraction of
the actual level. In addition, the lack of a flare on the blowdown drum – despite flares being
standard practice and, the lack thereof, a known safety hazard – greatly hindered the mechanical
integrity and the safety of the process and plant as a whole.1
Failure to complete proper process hazard analysis (PHA) was also a significant
contributor to the incident. Improper process hazard analysis included failure to take minor
incidents seriously, failure to follow up on known safety concerns, and failure to conduct routine
maintenance and inspections. These failures ultimately resulted in the consequent failure to

5
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

identify possible hazard scenarios, such as the overflow of the tower to the blowdown drum,
failure to identify instruments needed to maintain process flow, like the high-level fluid sensors,
and failure to correct known issues. Equipment on the splitter, for instance, was known to be
dysfunctional at the time of startup and, yet, the tower was restarted anyway. In particular, the
level sight glass that allowed operators to visually see the fluid level in the column was clouded
by residue buildup and was unreadable.1 A pressure control valve was also deemed inoperable
and was not fixed.1 In addition, the decision to restart the equipment while three contractor crews
were still operating shows a disregard for process hazard analysis and for the importance of
evacuating unnecessary personnel during times of greater risk, such as during start-up and shut
down. In fact, no experienced supervisor was assigned to the process at the time of start-up.1 The
placement of high-occupancy trailers, where many of the fatalities occurred, so close to a major
process is more evidence of BP’s disregard to safety. Had the trailers been moved and
contractors evacuated, casualties could have been greatly reduced.
BP’s process safety violations continue when it comes to process safety information. The
plant consistently failed to properly document process information and changes to process
procedures and operation. In particular, at the time of the incident, the plant did not have a
current data sheet for the raffinate splitter high level alarm transmitter.1 Such a record would
have allowed maintenance staff to monitor the reliability of the high-level alarm instrument and
transmitter, potentially allowing the problem to be identified prior to column restart and
preventing the incident.
Additionally, no written procedures for testing and maintaining the process instruments
was available, effectively leaving the proper operation of instruments to chance. It is here that
the plant’s operating procedures, as a whole, come into question. Not only were no written
procedures available for the startup operations of the column, with employees relying solely on
verbally communicated procedures, but communication procedures themselves were ineffective.
At the time of startup, a series of miscommunications occurred. Initially, the raffinate section of
the isomerization unit was started up in the evening of March 22nd, but the startup process was
halted and no records of the completed steps of startup was left for next-day operators.1
When the splitter was restarted again in the morning on March 23rd, the daytime board
operator was provided with minimal information regarding the current status of the splitter and
was unaware that the heat exchangers, piping, and other equipment were already filled.1 The
daytime supervisor arrived late and did not speak with any of the nighttime operators. As a result
of these ineffective operating procedures for communication and turnover, early morning
discussions between the shift director and supervisor concluded that the splitter should not be
started, but this decision was not relayed to operations staff.1 Upon startup of the unit, none of
the crew had been briefed on operating procedures and numerous misunderstandings regarding
the positions of valves and the flow of material occurred, contributing to the overflow of the
column, pressure buildup, and eventual explosion.
The Texas City Refinery saw regular changes in management and processes, many of
which was ineffectively managed by the management of change (MOC) processes in place. The
plant failed to effectively use System Applications and Products (SAP) for automatic generation
and tracking of maintenance, resulting in problems not being reported and repairs not being
scheduled. In addition, every change to equipment that requires MOC also requires a PHA. The
Texas City Refinery neglected to consistently conduct PHAs for MOC events and to sufficiently

6
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

analyze the impact of change on safety and health.1 Such mismanagement of change procedures
contributed to the miscommunications and lack of knowledge surrounding operating procedures
and process hazards for the isomerization unit.
The ineffective use and documentation of process information continued when it came to
startup processes. Per BP’s policy, a pre-startup safety review (PSSR) should have been
conducted prior to startup of the splitter. However, no such review was conducted as the
coordinator for the process was not familiar with the startup process and the applicability of
PSSR reports.1 Such a PSSR would have identified which process equipment was prone to
higher risk of malfunction. In turn, engineers could have identified the fact that process
equipment, including the high-level sensors, was not operating as originally intended and
suspended start-up until equipment known to be faulty could be fixed or replaced.
As a whole, one of the most important contributors to the 2005 incident is a nonchalant
safety culture at BP’s plant. Each of the failures surrounding the PSM elements above could have
been prevented or at least greatly alleviated had safety been a priority of BP management and
had staff been encouraged to take the safety involved in maintenance, startup, and operation
seriously. Instead of promoting a culture where safety across the board came first, the plant
emphasized personal safety, such as the use of proper PPE, as the leading safety metric and
process safety was not a priority.1 This method of assessing safety resulted in complacency on all
levels of operation when it came to maintaining equipment and ensuring proper and safe process
procedures. Since PPE should be the last line of defense for workers, creating inherently safer
processes should have been a forefront practice to avoid process safety incidents. Had care been
taken in this regard, substantial money and, more importantly, lives could have been saved.
Applying PSM Tools
The use of a hazards and operability (HAZOP) analysis may also have been a useful
preventative tool. This structured system provides a straightforward and valuable approach to
identifying possible hazards based on keywords and implementing effective solutions to prevent
safety incidents. An example of a HAZOP analysis is included in Appendix 1. Here, the raffinate
splitter and the blowdown drum elements of the ISOM unit are analyzed for potential safety
hazards and preventative measures are proposed. The high fluid level in the raffinate splitter was
central to the failure of the splitter tower and the blowdown drum was integral to the ineffective
management of the incident, making these elements relevant to an example HAZOP analysis for
this case.

Lessons Learned
The lessons learned from the 2005 BP Texas City incident are only as beneficial as they
are useful in moving forward and preventing further such incidents. These lessons can be broken
down into two categories: technical and organizational. Among the key technical lessons learned
is the importance of maintaining effective indicators and alarm systems. These systems are often
the first warning when a potentially dangerous event may occur and should not be neglected.
Company policies and standardized trainings should also be adhered to in order to ensure that
safety procedures in place are followed. Additional personnel should be assigned during startup
and changes in procedures to help oversee safety and the following of protocol. Along the same
lines, there should be a standardized, enforced method of relaying information between shifts
and workers so that important information is not neglected. Operating procedures and process
documentation should also be up to date and reflect actual process conditions. All equipment

7
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

should be maintained as well, with all known malfunctions being addressed fully prior to
restarting and running equipment. Beyond being in good repair, all equipment must be adequate
to support maximum process volumes and conditions and new equipment should be selected to
emphasize safety.
The equipment, itself, and operation thereof are only part of the picture. The placement of
equipment and supporting structures must be considered in terms of safety. For instance, high
occupancy buildings, like the contractor trailers in Texas City, must be placed a safe distance
from operating units. Similarly, protocols should be developed to ensure that non-essential
personnel are evacuated from the premises during high risk operations, such as start-up, shut
down, and abnormal operation. Finally, just as the potential of future safety incidents must be
taken seriously, so too must past incidents, no matter how minor, be treated with respect,
investigated, and addressed.
In many ways, giving safety its due concern is the essence of the organizational lessons
learned from this 2005 incident. Time and financial costs must not be cut when it comes to
ensuring process safety. As such, it is crucial to establish and maintain effective safety
management and designate an upper-level management member to oversee safety in order to
ensure sufficient oversight. Organizational safety goes beyond management, however. The
“check the box” mentality common among BP employees must be eliminated and replaced.
Employees should be encouraged to engage in safety practices and report accidents, near misses,
and safety concerns. To best ensure effective pursuit of process safety on all levels of the
organization, employees should be provided with sufficient safety education and training to
effectively fulfill their jobs. More than one metric should be used to assess the effectiveness of
safety protocols. When safety issues do become apparent, whether from in-house events or from
out-of-house studies and finding, they should be followed up on fully.
Conclusion
The 2005 explosion and fire at BP’s Texas City Refinery was the tragic consequence of a
series of ineffective equipment, process, and communication procedures. From ignoring a
history of mechanical failures and not following established safety protocols for management of
change and process hazard analysis to ineffective process monitors and a process designed for
affordability rather than safety, the plant consistently neglected to make safety a priority. The
release of flammable hydrocarbons and creation of a vapor cloud that was then ignited by an
idling vehicle resulted in the destruction of much of the facility. With more thorough process
hazard analysis, consistent process information, effective pre-startup review, better maintained
mechanics, improved management of change, and clear and enforced operating procedures, the
incident could have easily been prevented. Sadly, the fifteen lives that were lost that day cannot
be restored, highlighting the importance of proactive safety measures and emphasizing the
significance of past safety incidents in the planning, design, and operation of new and existing
chemical processing facilities.

8
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

References
1. United States. Chemical Safety Hazard Investigation Board. (2007). Refinery explosion and
fire (15 killed, 180 injured) BP, Texas City, Texas, March 23, 2005 (Investigation report
(United States. Chemical Safety and Hazard Investigation Board) ; report no. 2005-04-I-
TX). Washington, D.C.]: U.S. Chemical Safety and Hazard Investigation Board.
2. Texas City Refinery (Now Marathon Galveston Bay Refinery). (n.d.). Retrieved from The
Center for Land Use Interpretation: https://clui.org/ludb/site/texas-city-refinery-now-
marathon-galveston-bay-refinery
3. Duran, L. (2015, May 16). 10 years later: BP Texas City and the inevitable cost of an incident.
Retrieved from Control Engineering: https://www.controleng.com/articles/10-years-later-
bp-texas-city-and-the-inevitable-cost-of-an-incident/
4. Alexis Flynn, A. S. (2012). BP Sells Texas City Refinery to Marathon. The Wall Street
Journal.
5. Octane ratings. (n.d.). Retrieved from Exxon Mobil: https://www.exxon.com/en/octane-rating
6. Pallardy, Richard. (2016). Deepwater Horizon Oil Spill. Retrieved from Encyclopedia
Britannica: https://www.britannica.com/event/Deepwater-Horizon-oil-spill

9
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

Appendix 1 – Example Hazard and Operability Study on Blowdown Drum and Raffinate Splitter

10
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

11
Team # 18 2005 BP America Texas City Refinery: Fire and Explosion

12