In this episode, Trish and Traci discuss two major BP incidents: the 2005 Texas City Refinery explosion that killed 15 workers when an overfilled tower created a geyser of hot raffinate that ignited, and the 2010 Deepwater Horizon explosion that killed 11 workers and caused the largest U.S. marine oil spill when cement failed to properly seal a well. Key factors included faulty equipment, misleading indicators, inappropriate safety messaging and failure to learn from near-misses. These tragedies led to industry-wide improvements, including standardized process safety metrics, occupied building risk assessments, and better hazard management.
Transcript
Welcome to Process Safety with Trish & Traci, the podcast that aims to share insights from past incidents to help avoid future events. Please subscribe to this free podcast on your favorite platform so you can continue learning with Trish and me in this series. I'm Traci Purdum, Editor-In-Chief of Chemical Processing. And joining me, as always, is Trish Kerin, former director of the IChemE Safety Centre and the current director of Lead Like Kerin. Hey, Trish, I know you're currently in the U.S., wrapping up a series of safety conferences. What's the update on that?
Trish: Hey, Traci. Yeah, great to be here. I'm currently sitting in Dallas, Texas, which has been a great week here at the American Institute of Chemical Engineers Global Congress on Process Safety, and spring meeting. Fantastic event, couple of thousand people, great talks on process safety, great interactions. And also, fantastically, a lot of people are coming up to me and saying, "I listen to your podcast." So, shout out to everybody that said they listened to the podcast. Thank you for being listeners, and we're just so happy that this podcast really works for you.
I also had a few days in San Francisco a couple of weeks ago at a new conference called Safety on the Edge. If you ever get a chance to consider Safety on the Edge in the coming years, it's a brand-new series, really great. It's actually a mix of occupational, and we're starting to bring the process safety flavor into it. So again, great presenters, really high-level content talking about the future of safety. So both of those events have just been absolutely fantastic and I'm so privileged to have been able to have come to them.
Traci: How exciting, a lot of good stuff and wonderful that we have fans.
Trish: We certainly do. A lot of fans... A lot of people came to me and just either they came to me and went, "Now your voice sounds familiar. Do I know you?"
Traci: That's awesome.
Trish: But a lot were, "Oh, we listen. I listen all the time. I listen when I drive my kids places. I listen when I've got to do long drives to the plant. I listen here; I listen there." Yeah, so we've got a lot of fantastic listeners out there, so that's very exciting.
Traci: Good. Great. That's wonderful to hear. Thanks for sharing that. And in today's episode, as we always do, we look back at past incidents. We're going to be talking about two incident anniversaries involving BP. The first is the 20th anniversary of the BP Texas City Refinery explosion that occurred March 23rd, 2005. 15 workers were killed, and 180 others were injured. The other incident that we're going to be talking about is the 15th anniversary of the Deepwater Horizon oil rig explosion and subsequent oil spill in the Gulf of Mexico on April 20th, 2010, which resulted in 11 deaths, a massive oil leak and the largest marine oil spill in U.S. history impacting the Gulf's ecosystem and coastal communities. Can you give us a little more detail on what happened in each of these incidents?
BP Texas City Refinery Explosion
Trish: Yeah, so we'll start with Texas City Refinery. So that refinery was just coming out of a shutdown. They'd been doing some maintenance work where you shut down the equipment, you open it all up, you do maintenance work that you need to do, and then you put it all back together and go to restart it. And they were starting up the raffinate splitter tower, and so that required them to pump raffinate into this tower, and that raffinate got heated up as it went into the tower. What they inadvertently did was overfill that tower. Now, there's a lot of complexity around the overfilling of that tower. It was a very tall tower, but the level gauge only worked on the bottom nine feet of the tower. So, there was 10, 20 feet above that that had no level gauge in it because there was only meant to be vapor up there, not liquid. The level gauge was to measure the liquid in the tower.
What they didn't realize at the time was that they continued to fill that tower, and its exit was blocked, so the liquid couldn't get out, so it continued to fill up. What really complicated matters was the level gauge because it only measured the bottom nine feet, so if you imagine once it hit 100%, it wasn't going to hit any more than 100% regardless of how much was in the tower. But even worse than that, that level gauge was actually faulty, and it actually started to show that the level was dropping, not increasing or remaining stable. And so, unbeknownst to the operators, they continued to fully pack this tower with liquid. Now, at the top of that tower, there's an overhead take-off at the pipe that just comes off the top, and that then flows down into a relief system.
And that relief system then relieved into what we call a blowdown drum, which is where you basically collect vapor and liquid, and there's a knockout part of it that the liquid drops out, and the vapor will go up a stack and out into the atmosphere. Now, an alternative to a blowdown drum would’ve been to have that piped to a flare system, and therefore you knew that you'd destroyed the hydrocarbon because you actually burnt it in a safe and controlled manner. But what unfortunately happened is it went out that open vent stack on the blowdown drum, and there was a geyser-like flow of hot raffinates. So, imagine boiling gasoline spouting out as a geyser out of this tower at the top, this stack.
And that then rained down in the area around, and there were a couple of workers that were in a pick-up and that pick-up, its engine was running. And it was a diesel engine. And the diesel engine, they turned it off, but it started to race. So, I don't know if you've ever had any experience with a diesel engine, but if fuel gets into the air intakes on a diesel, it can actually run by itself even when you turn the thing off. So, basically, that diesel engine started to run and backfire. They ran away. An ignition occurred, and that caused a massive explosion.
Now tragically, why there were 15 people killed is that most of them were located in a temporary dismountable trailer near the base of the raffinate splitter tower. They had nothing to do with the raffinate operation. It was largely a group of contractors that were there because when you do have a turnaround, you've got a lot of extra people on site, and you've got to have extra meeting rooms. And they had meeting rooms in this trailer, and they were having a meeting and there were a number of people gathered around having this meeting, nothing to do with the raffinate splitter tower, at a high hazard operation moment at that refinery.
And so, when that explosion occurred, it completely destroyed that tower and a total of 15 people were killed as a result of that explosion and the damage to the trailer, amongst other things. 180 people were also injured in this incident. So, it was a really, really significant event that occurred. So that's sort of a quick high-level overview of what happened at Texas City.
Deepwater Horizon Oil Rig Explosion
We flip over to the Deepwater Horizon or the Macondo field, basically we had a situation where they were finishing off. They'd just drilled down to the Deepwater ... The Deepwater Horizon vessel had drilled down to the Macondo field, and that field was being capped and sealed to come back to later. So, they'd found they got to the reservoir and they were capping it safely to then come back later when they would then connect the platform and extract the oil from that particular field.
And so, part of doing that is actually plugging the well, is to do, they cement it basically. So, they pour a special sort of cement. It's not your average road-based cement, but a special sort of cement gets poured down into the shaft that runs all the way down into the reservoir, and they basically plug the hole, and then they do a pressure test to check that they've plugged the hole sufficiently. Now, what actually happened here was they were very confident when they did the cement job that it all went perfectly well. Everything happened as it was meant to. Everybody started to think, well, this is a great job. We've sealed it really well. So, when they did the pressure testing, and it started to show that there was actually a problem, they started to justify why it wasn't the cement job because that was perfect.
It had to be an illusion or a strange phenomena taking place. Something else was going on. And sadly, what we now know is that that well had not sealed, and it did then blow out the pressure in the reservoir, blew out. It then, basically again, a rising geyser of oil sprung up from deep water in the Gulf, sprung onto the deck of the platform and ignited and caused a massive fire. Now, they tried to do the quick disconnect activity that they had. So, they've got, down on the seabed, there's this massive, massive device that actually has these big, big hydraulic rams in it that basically have the ability to clamp the pipe to stop the flow of oil coming back up. So basically, they crush the pipe and clamp it shut. That's called a blowout preventer. That device did not work. It failed to activate as it was expected, and it failed to isolate that pipe, and it did not prevent the blowout.
In the ensuing fire and explosion on that particular vessel, as you said, tragically 11 workers lost their lives and it did burn for quite some time. And the oil spill, they had trouble stopping the flow out of that particular rig, out of that particular well, for a number of months, and it was basically an uncontrolled spill for quite some period of time until they were finally able to seal off the well. So keep in mind that they were operating in very deep water. The blowout preventer had failed, and so they had to bring in new and different and invent devices to try and stop the flow of oil, which it has now been safely capped.
So that's some of the sort of things that happened in that one. So some interesting ... We've got indicators not working, sending us the wrong messages. We've got safety critical equipment failing to activate as we expect it to. We've got people making decisions on not the full information and, in fact, misleading information at times. You can start to see how these things do start to happen, sadly.
Traci: Absolutely, absolutely. And I know for Texas City, the CSB, the Chemical Safety Board investigated the deadly explosions as well as two more major incidents at the plant and issued an urgent recommendation that BP would commission an independent panel to investigate the safety culture and management systems at BP North America. From what I read, BP did so to publicly show that the company was eager to learn the lesson and make strides to change. Let's talk a little bit about the previous near-miss incidents and warning signs that were not adequately addressed before the Texas City explosion.
Near-Miss Incidents and Warning Signs
Trish: So, there were a number of different things that took place. So for example, when they went to restart that splitter tower and they overfilled it, the customer practice had been actually to deliberately overfill above the 100% line in that tower. And you think, why were they deliberately doing that? That's crazy. Actually, they had a really good reason to do it. So what we need to remember is when a worker does something that deviates from a procedure, they're not doing it because they're bad or stupid, they're doing it for a very valid reason for them at the time. In hindsight, it might not be the right reason, but at the time, it was a very valid reason. And what the reason was here was that their experience was if they didn't take it to just above the 100% mark, they actually had a lot of situations of rapid level dropping and cycling and tripping out and cavitating their pumps and disrupting the startup process.
So, the operators had developed a process that allowed them to start up the tower seamlessly, and that did require, that process that they had developed themselves it was not documented as a procedure, to overfill so that they maintained the flow of their pumps and kept the unit processing through its startup. So there was valid reasons in their mind as to why they were doing this. Now, interestingly, because they did have this habit of overflowing it, of overfilling it above 100%, it was not the first time that they had overfilled the tower. It was not the first time that product had come out of the blowdown vent stack. It was the first time it had ignited. So they had had precursor incidents in their history where they had almost the exact series of sequence of events occurring that then led to, ultimately, this incident when an ignition source was in the area and they had that particular issue.
It's also important to point out that, as I said earlier, it should have gone to a flare system. And so that's part of making sure we've actually got the right equipment that we need to do the job that we need to do. A flare system when we need to actually take hydrocarbon vapor away and dispose of it in a safe matter, the flare system is how to do it, not a blowdown drum with an open atmospheric vent stack.
Importance of Safety Culture
Traci: Now, what about BP's corporate safety culture? Is this potentially where some of the things started to fail? Could a different culture have prevented these incidents?
Trish: Culture is always one of those difficult and interesting questions to ask. So, 20 years ago it was a different time. BP at that time had a very significant focus on their environmental performance and on how they were doing a lot of their activities to make sure that they were reducing the risk to the environment as much as possible. So, they had very big environment focus out of the whole EHS, environmental health and safety. The E was getting a lot of attention. The safety part of it, we've got to remember that we do have this difference between occupational safety and process safety. They're actually two different fields serviced usually by two different sets of professionals because they require different skill sets. They were focused on occupational safety quite substantially.
And in fact, I believe BP had done some research and said, our biggest issues around the world are people dying in car crashes. That's our biggest fatal risk. So, their focus on all of their safety messaging was all about safe driving, wearing your seatbelt, not talking on your phone, those sorts of things, which is really important messaging for people that are driving on the road. It's less important messaging for people that are in the refinery.
And so, from a culture perspective, you've got to make sure that the safety messages you're sending an organization and different parts of an organization, are fit for purpose. So if I'm working in a refinery and I see potential explosion hazards and other sorts of issues like that, and you're talking to me about things like seat belts in cars, lids on coffee cups, holding handrails on stairs, I'm not going to get that connection. I'm going to sit back and think they've got no idea what I face every day.
And so, we've got to make sure that we craft our messages effectively to address the risks that people actually face, not the risks that we perceive they face because every facility has a different set of risks. If you've got three refineries, chances are your three refineries have the same three risks, or they're all having the same sort of risks. But the difference between the territory manager that's driving to the gas station versus the refinery operator that's filling a tower is a very different set of risks, very different sort of safety messages needed, and you've got to make sure your culture is adaptable to that.
That's not to say we don't talk about seat belts in a refinery. We do. We drive vehicles in a refinery and you have to wear your seat belt. It is a fundamental safety device. But our messages need to be more about overfilling, loss of containment of hydrocarbon, control of ignition sources. That's what we need to be focusing on in refineries fundamentally.
Traci: So does that come down to who helps to disseminate those safety messages? It sounds like initially it was, and I'm just tossing this out there and I'm not pointing fingers, but maybe an HR person talking about safety where it actually needs to be operators talking about safety.
Trish: So no, I think it's actually the difference. So, I've worked in a number of different corporates and corporates. We love to create packages and programs that are going to be rolled out throughout the whole company, and we do that on a risk basis of what we need to be focusing on. The safety people will do this. The safety people will create these packages with the use of the assistance of communications as well because that's really important that sometimes, particularly in process safety, engineers don't always communicate the best. So, we actually need our communications colleagues to help us with some of this stuff.
And so, it's actually about making sure that it's fit for purpose for where it's going. So, making sure that if you're going to roll out a large corporate program on something, and that's fine, you need to allow the sites to have some flexibility of how they implement the program at their site relative to their risks and then also make sure that they're adequately supported to be addressing their key risks, particularly if your key program is actually not addressing their key risks. And so, it's about corporate folk actually understanding and recognizing that at a corporate level, we may do a whole lot of different interesting and important things, but what people face day-to-day on the front line in a workplace can be quite different.
Lessons Learned, Recommended Best Practices
Traci: Now both of these incidents led to recommended best practices, thinking about the lag and lead indicators and different things like that. Can you talk about a few of the good things that came from these tragedies and how maybe they're being applied today or what can be learned from them so that folks can apply them?
Trish: Yeah, absolutely. And it's important when tragedies like this happen that we do actually learn and disseminate that learning. And you're right, there've been several standards that have been developed as a result of these incidents. And that's the industry coming together saying, "Okay, what did we learn, and how do we actually make this a standard practice for everybody?" And so importantly, if you talk to people that are working today, and particularly younger people that have only been in the workforce a couple of years, they actually don't comprehend that 20 years ago, we did not have a defined suite of process safety KPIs or metrics that everybody understood and worked to. People don't get that. But 20 years ago, we didn't have it. The reason we have it today is because of Texas City Refinery. And that was a recommendation that did come out of the Baker Panel report, which was that cultural review that you said that BP agreed to undertake as well as the Chemical Safety Board's investigation into that incident.
And so, that led to, first of all, the Center for Chemical Process Safety, the CCPS, developing a guidance document on process safety KPIs. And that was the first time we actually saw companies come together and define things. And we now talk about a tier one incident, a tier two incident, tier three incident, tier four incident. The terminology came out of there, and then API actually adapted that into the API. And API is now down to its third or fourth edition. A new one's about to come out shortly because it continually gets revised and updated, and improved. And so we've now got these great standards on how to monitor process safety, both the lag, the incidents that happen, and the lead. And that's where we see our barriers or controls starting to degrade before the incident happens. So how do we notice that those things are happening before an incident so we can track them, fix them, and prevent that incident from happening? That's one of the things that came out of it.
Another one that came out of it is a standard focused on undertaking occupied building risk assessment, both for fixed permanent buildings and temporary buildings. And that's really important because that gave us an agreed methodology around the world to say, "Okay, we need to review and look at the risk to our people inside their buildings." Because as I said, there were a lot of people in that trailer in the Texas City refinery that were killed when that trailer was completely destroyed by the explosion. They should not have been there. They had no reason to be there other than it was a vacant room to sit down and have a meeting in.
And so, we now have quite structured processes on assessing the risk, the fatality risk, for people in our buildings on our sites. And that has resulted in a range of changes in facilities all over the world where either buildings have actually been, people have been demobilized out of them, and nobody uses those buildings for offices anymore. You're not allowed to because it's too hazardous a location to be in. So people have had to relocate offices around different facilities and move people out of different areas, move control rooms to safer locations, and build blast-proof control rooms so that in the event of an incident, the people inside are protected.
Now, there are also some really interesting ways that have been achieved there. So, there are now methods to effectively armor the outside of control rooms or buildings such that if an explosion happened, you're going to have to demolish the building, but the people inside are going to survive that explosion. The building will take the brunt of it, and the people will survive. And then you walk out of it, and you bulldoze it. A blast-proof control building, you could, chances are you could walk out, and it'll still be fine, but these other armored buildings, so we've seen a lot of developments in that space as well.
So, we're getting the tools and techniques to help people understand the risks of their facilities and take action on them so that we can actually ensure that we do provide a safe place of work for our workers. And then obviously the flow on impact to our communities.
Traci: Trish, is there anything you want to add to this?
Why Do We Practice Process Safety?
Trish: I'd like to just ask everybody to take a moment and reflect. So the two incidents we talked about, that was 26 humans that never went home that day. So it's 26 families that never got their loved ones back. That's why we do process safety. That is why this is so important. Be willing to reflect and yeah, take a moment to think about those people and their families and their colleagues as well. It's not only the families, it's the colleagues that saw their friends perish. But apply that impact to your facility and think about what you can practically do to prevent anything like that tragedy from happening in your facility.
Because sadly, we still see these incidents occur. They occur every year. We're still seeing, if we're dealing with a flammable hydrocarbonate and we release it to the atmosphere and there's an ignition source, guess what? It will explode or catch fire. We know this. It is fundamental physics and chemistry and we can't change that. So, we need to get better at making sure we don't let it out into the atmosphere. And then if something does happen, at making sure there's no ignition sources near it. And it applies to if we are dealing with dust to, if we're dealing with flammable gases as well, a lot of work on hydrogen and methane, we need to make sure that we're applying the things we learned the hard way in the traditional oil and gas sectors into our new sectors, our new industries that are working with hydrogen, ammonia, methane.
I was talking to someone the other day, and you get that classic comment of, "But it's biomethane." Yes, it is bio methane, but do you think that little molecule knows how it got created? And even more, do you think it actually cares how it got created? It just knows it wants to go bang. That's its purpose. I don't care whether it was created through bio-digesters in a sewage treatment plant or through an oil and gas system. It's methane. It wants to explode. You need to treat it like methane. I don't care how it was formed. And so getting those messages out to people that are now moving into areas that traditionally have not had these sort of hazards and risks associated with their operations because they're now doing different things or more methane, more hydrogen, those sorts of things.
So, if you are in any of those fields, take this back and be willing to learn from the tragedies that we've had to endure in other industries, in the chemical sector, in the oil and gas sector. Learn from our tragedies before we have our own in the renewables and new industries.
Traci: Well, Trish, thank you for always helping us to reflect and to understand and to learn from these tragedies. Unfortunate events happen all over the world, and we will be here to discuss and learn from them. Subscribe to this free podcast so you can stay on top of best practices. You can also visit us at chemicalprocessing.com for more tools and resources aimed at helping you run efficient and safe facilities. On behalf of Trish, I'm Traci. And this is Process Safety with Trish and Traci. Thanks again Trish.
Trish: Stay safe.
