Texas City refinery explosion

The refinery

The refinery was established in 1933 by Pan American Refining Corporation.^[1] Pan American merged with Standard Oil of Indiana in 1954 to form Amoco.^[2] BP acquired the refinery as part of its merger with Amoco in 1999.^[3] As of January 2005, it was the second largest oil refinery out of 23 in Texas (behind Baytown Refinery), and the fourth overall out of 142 in the United States in terms of operating capacity, which was 475,000 barrels (75,500 m³) per stream day.^[4][a] At the time of the accident it was one of three refineries in Texas City, the other two belonging to Marathon Petroleum and Valero Energy.^[1][4] The refinery was also one of five BP refineries in the U.S. and BP’s largest worldwide. It could produce around 10 million gallons (38 million L) of gasoline per day, or about 2.5% of the entire volume sold in the United States. It also produced jet fuels, diesel fuels, as well as chemical feed stocks. Its 1,200-acre (490 ha) site was covered by 29 oil refining units and four chemical units. It employed around 1,800 BP workers. At the time of the accident, about 800 contractors were onsite to support turnaround works.^[6]

At the time of the 1999 merger, the plant was losing money,^[7] but BP was extremely successful in turning the tide. In fact, the complex had performed at an all-time record profitability in 2004, with over $1 billion in profit, "more than any other refinery in the BP system" in the words of business unit leader and complex manager Don Parus.^[8] By early 2005 the refinery was making profits of around $100 million on a monthly basis.^[9]

Safety and maintenance record

Since 1974 there had been 23 fatalities in 20 separate accidents at the refinery. Three of these occurred in 2004, the year prior to the explosion. Almost half of these fatalities were due to fires or explosions ensuing process fluid releases.^[10] A very serious explosion affected the complex in July 1979, when hydrocarbons at 265 psi (1,830 kPa) were released from a failed 12 inches (30 cm) elbow in the depropanizer overhead condensing system of the sulfuric acid alkylation unit. More than 4,000 US gallons (15 m³) of liquids were discharged. A large vapor cloud formed and traveled downwind about 640 feet (200 m) to the fluid catalytic cracking (FCC) unit, where ignition occurred. A control building, the alkylation unit, the FCC unit, and the carbon monoxide boiler sustained heavy damage. Windows were broken up to 1.5 miles (2.4 km) away. Although no fatalities occurred, property loss was very significant ($24 million, or $101 million in 2023).^[11][12] Another large explosion took place in March 2004. Although no one was injured, BP temporarily evacuated the refinery. The police closed the access roads and asked residents not to leave their houses.^[13]

The plant had been poorly maintained for several years.^[14] Starting in the early 1990s, Amoco and later BP made substantial budget cuts, especially affecting maintenance expenditure. Immediately after the merger, in fact, BP ordered a 25% cut in operating costs, which was achieved in part with lower spending in maintenance and training and cutting back on safety staff.^[15][16]

In 2002, BP contracted consulting firm A.T. Kearney to understand "the historical facts which have led to the deterioration of the Texas City refinery performance." The report^[17] connected the significant reductions in spending with the deterioration in the refinery's integrity and reliability.^[18] An internal BP audit conducted in 2003 found that a "checkbook mentality", blame, and status culture eroded HSE as well as general performance; the condition of assets and infrastructure was poor; management had not created meaningful action plans; and that there were insufficient resources.^[19] A similar audit in 2004 found fault across all elements of process safety management.^[20] Another external audit report was produced by consulting firm Telos in January 2005.^[21][22] It identified numerous safety issues including "broken alarms, thinned pipe, chunks of concrete falling, bolts dropping, cigarettes falling 60 feet (18 m) and staff being overcome with fumes." The report's co-author stated, "We have never seen a site where the notion 'I could die today' was so real."^[23] The report also stated, "Most interviewees say that production and budget compliance gets recognized and rewarded before anything else",^[24] "Most interviewees at the production level say that the pressure for production, time pressure, and understaffing are the major causes of accidents at Texas City"^[25] and that

There is an exceptional degree of fear of catastrophic incidents at Texas City. People talked or wrote at length about serious hazards are in the operating units from CUI, abandoned asbestos, piping integrity issues, inadequate spare pumps and parts, and other equipment and operating hazards. Of these, piping integrity was repeated again and again. Even where there have been recent investments in piping integrity, people reported that they often could not shut the unit down to in fact replace the pipe they had fabricated. The tolerance of these kinds of risk "distracted" people from routine safe practices at the task level, or made them feel skeptical about the commitment to safety at the plant.^[26]

Some key reports on the preoccupying conditions of the refinery made their way to company board level.^[27] In early March 2005, mere weeks before the explosion, an internal e-mail warned, "I truly believe that we are on the verge of something bigger happening and that we must make some critical decisions [...] over getting the workforce's attention around safety."^[28] Management turnover had been high in the years leading to the explosion, with the complex having had five managers in the six years since the merger,^[29] with the result that employees were under the impression that any new initiative would not last and that efforts were focused on short-term profit rather than long-term sustainability.^[30] The complex was still largely using Amoco safety management processes pre-dating the merger.^[31]

The ISOM plant

The isomerization plant (ISOM) at the site was designed for the conversion of low-octane hydrocarbons, through various chemical processes, into hydrocarbons with higher octane ratings that could then be blended into unleaded gasoline. This is achieved by converting straight-chain hydrocarbon molecules into branched ones.^[32] The main feed to the unit was a mix of n-pentane and n-hexane, with isopentane and isohexane being the main product.^[33] The plant consisted of a desulfurization system, a Penex isomerization reactor, a vapor recovery and liquid recycle unit, and a raffinate splitter.^[34]

The 170-foot (50 m) tall tower-shaped splitter, a distillation column, was used to separate lighter hydrocarbon components from the top of the tower (mainly pentane and hexane), which condensed and were then pumped to a light raffinate storage tank, while the heavier components (mainly C7 and C8) were recovered lower down in the splitter, then pumped to a heavy raffinate storage tank. The unit had an operational capacity of 45,000 barrels (7,200 m³) per day.^[31]

Excess hydrocarbon vapors and liquids from vent and relief were sent to vessel F-20, a blowdown stack. This was designed to disperse vapors from the top and convey any liquids through a gooseneck into the plant closed sewer network.^[b] It was a 10-foot (3.0 m) diameter vertical drum with a 113-foot (34 m) vertical flue pipe. F-20 was put in commission in the 1950s and had gone through several modifications over the years.^[31]

Unit turnarounds and use of portable buildings

Remedial work had been started on the raffinate splitter from February 21, 2005. Two turnaround activities were also taking place at the adjacent ultracracker unit (UCU) and at the aromatics recovery unit (ARU) at the same time. Portable buildings and trailers were often installed for use as offices during construction and maintenance.^[36] In 2004, 122 trailers were in the refinery with an estimated occupancy of 800. BP allowed trailers to be placed near process units based on the results of a screening process.^[37]

In 1995 a site-wide temporary siting analysis report^[38] had been created at the facility that established an acceptable layout of trailers and other temporary structures with respect to nearby hazardous process facilities. The report was revalidated in 2002, still based on Amoco's standards although more than three years had passed since the BP–Amoco merger. In turn, Amoco's Facility Siting Screening Workbook was based on the American Petroleum Institute's Recommended Practice 752.^[39][40][c] The next siting analysis was due to take place in 2007 and, therefore, any siting changes before then would have to be under the management of change (MOC) process. Plans were made late in 2004 to accommodate contractors due to work on the UCU in 2005 in nine single trailers and one double-wide trailer immediately west of the ISOM process unit. The team carrying out the MOC assessment for the placement of the double-wide trailer identified that the structure would be less than 350 feet (110 m) from the ISOM plant, a distance below which a dedicated risk analysis had to be carried out under Amoco's Workbook provisions. This team, however, lacked the expertise to complete the risk assessment. The introduction of the nine single trailers in the picture was not assessed in an MOC. Further, contrary to procedure, recommendations issued in the analysis of the change involving the placement of the double-wide trailer were still open when the trailers were occupied in November 2004.^[43]

Early morning

The start-up process commenced with the night-shift lead operator on March 23 carrying out the initial filling of the splitter tower. Because plant start-ups are especially prone to unexpected situations, operational practice requires the application of a controlled and approved pre-start-up safety review (PSSR) procedure. BP had one, but it was not adopted in this case.^[44] The process control level transmitter was designed to indicate the raffinate level within a 5-foot (1.5 m) span from the bottom of the splitter tower to a 9-foot (2.7 m) level. A high-level alarm dependent on this transmitter sounded as intended at 3:09 am, when a level of 7.6 feet (2.3 m) from the bottom was reached. However, during start-up it was common to ignore this alarm and fill up to a level of 99% (as indicated by the transmitter) to prevent damage to the furnace heating the splitter bottom. Unbeknown to the operators, the process control level transmitter, which was used to monitor the level in the splitter during the whole start-up operation, was not calibrated and its readings were not reliable. An independent level alarm triggered by a high-level switch should also have sounded at 7.9 feet (2.4 m) but failed to. At 5:00 am, the lead operator in the ISOM satellite control room briefed the central control room and went home early. At 6:00 am, the day-shift board operator (central control room operator) arrived and started his thirtieth consecutive day on a 12-hour shift duty. By this time, the level was still believed to be below the 9-foot mark, but it was already at 13 feet (4.0 m).^[45][46][47]

At 7:15 am, more than one hour late on the commencement of his shift (6:00 am), one of the two day-shift supervisors ("A") arrived at the central control room. Because of his lateness, he could not go through the required handover with the night shift. During the morning meeting on March 23, it was discussed that the heavy raffinate storage tanks were nearly full and, therefore, a second day-shift supervisor ("B") was told that the start-up procedure should not continue, but this information was not passed on. Therefore, the start-up procedure resumed just before 9:30 am under instructions from the day-shift supervisor A. The splitter level control valve into the heavy storage tank was placed in manual mode (rather than having its opening regulated by the level transmitter) and set at 4,300 bpd. However, the flow transmitter on this line was in error and the valve had actually been closed shut. This, coupled with the malfunctioning of all the splitter tower instruments, allowed the level of liquid in the tower to increase without anyone noticing and caused the operators to lose all situational awareness.^[16] The circulation process was restarted just before 10 am and raffinate was once again fed into the tower, even though the level was already too high. Since the level-control valve was shut and, therefore, there was no circulation out of the tower (i.e. no heavy raffinate being transferred to the storage tank), the splitter tower inevitably began to fill up. The defective level transmitter continued to show the level at less than 100%, and since the external sight glass was opaque, a visual check to verify the level in the splitter tower was not possible. Day-shift supervisor A, the more experienced of the two, left at 10:50 am due to a family emergency. Contrary to the operating rules, no supervisor was left in the central control room. A single, unsupervised, and very tired board operator was now left to supervise the ISOM and two other units during a critical start-up procedure.^{[45][48][49][d]}

Late morning

Two burners in the furnace had been turned on at 9:55 am to pre-heat raffinate going into the tower and to heat the raffinate in the tower bottom. Two more were lit at 11:16 am. The required temperature for the tower reboiler return flow was 135 °C (275 °F) with a rate increase of 10 °C (18 °F) per hour, but this procedure was not followed: during start-up, the return flow temperature reached 153 °C (307 °F) at a rate of 23 °C (41 °F) per hour. The defective level transmitter still erroneously indicated an ongoing safe level condition in the tower. However, there was still no flow of heavy raffinate from the splitter tower to the storage tank as the level control valve remained closed; instead of the hydrocarbon liquid level being at 8.65 feet (2.64 m), i.e. 93% of the instrument range, as indicated, it had actually reached 67 feet (20 m). Just before midday, with heat increasing in the tower, the actual fluid level had risen to 98 feet (30 m). Pressure started to build up in the system as the hydrocarbon vapors and the nitrogen remaining in the tower and associated pipework from when it had been put back in service became compressed with the increasing volume of raffinate. The operations crew thought that the pressure rise was a result of overheating in the tower bottoms as this was a known start-up issue, so the pressure was released.^[51][52]

Explosion

By 12:42 pm, the furnaces had been turned down and the level control valve was finally opened, draining heavy raffinate from the splitter tower. The gas fueling the furnace was shut off, but the raffinate feed into the splitter tower was not. The operators believed the level transmitter reading which was now down to 78% (7.9 feet [2.4 m]) but the fluid level in the 170-foot (52 m) tall splitter tower had now reached 158 feet (48 m).^[53]

While the opening of the heavy raffinate flow should have diminished the level in the column, the fact that this hot flow was used to pre-heat the feed meant that the temperature inside the splitter increased dramatically, which led to significant increase in vaporization and the lifting of a slug of liquid over the top of the column into the overheads line.^[54] At 1:13 pm, the hydrostatic head of this liquid had built to over 42 psi (290 kPa).^[55] This was sufficient to open the relief valves.^[54] With the relief valves fully open, over 51,900 US gallons (196 m³) of heated raffinate passed directly into the collection header over a 6-minute period before the valves closed, as pressure within the splitter overheads pipe dropped below their minimum closing set point (37.2 psi (256 kPa) above atmospheric pressure).^[56] Hot raffinate flowed into the blowdown drum and stack, and as it filled, some of the fluid started to flow into the ISOM unit sewer system via a 6-inch (15 cm) pipeline at the base of the blowdown drum. As the blowdown drum and stack filled up, hot raffinate shot out of the top of the stack and into the air, forming a 20-foot (6 m) "geyser".^[57] The equivalent of a nearly full tanker truck of raffinate rained down on the ground, ran down the side of the blowdown drum and stack, and pooled at the base of the unit.^[58] A radio call was received in the control room that hot hydrocarbons were overflowing from the stack.^[57] The plant evacuation alarm was not sounded, a fact that prevented people in the vicinities to evacuate before ignition took place.^[59][60]

A diesel pick-up truck, with its engine left idling, had been parked about 25 feet (8 m) from the blowdown stack. The vapor cloud reached the vehicle, and hydrocarbon fumes were drawn into the engine's air intake, causing the engine to race. Nearby workers frantically tried to shut down the engine, without success. The expanding vapor cloud forced the workers who were trying to shut down the overspeeding truck engine to retreat. The cloud continued to spread across the ISOM plant, across the pipe-rack to the west and into the trailer area unimpeded. No emergency alarm sounded, and at approximately 1:20 pm, the vapor cloud was ignited by a backfire, as observed (by nearby witnesses) to be originating from the overheating truck engine.^[61]

Equipment and piping congestion contributed to accelerate the flame front. This triggered a massive vapor cloud explosion that was heard for miles.^[62] The blast pressure wave struck the cluster of contractor trailers located as close as 121 feet (37 m) from the blowdown stack, completely destroying them. The explosion sent debris flying, instantly killing 15 people manning the closest trailers and injuring 180 others.^[e] Workers in trailers received injuries as far as 480 feet (150 m) from the blowdown drum, with heavy damage reaching some trailers as far as 600 feet (180 m) away. Over 40 trailers were damaged.^[41][64] All the fatalities and many of those injured in the accident were contractors.^[65] Fifty storage tanks sustained structural damage, although the largest portion of the tank farm was more than 250 feet (76 m) from the explosion.^[66] Over 2,750 pounds (1,250 kg) of benzene escaped from one of the damaged tanks.^[67][68]

An area estimated at 200,000 square feet (19,000 m²) of the refinery was badly burned by the fire that followed the violent explosion, damaging refinery equipment worth millions of dollars.^[69] The pressure wave was so powerful it blew out windows offsite up to three-quarters of a mile (1.2 km) away.^[67]

Emergency response

The site emergency response team intervened immediately, mounting a search and rescue operation.^[70] An order was issued for the shelter-in-place of 43,000 people.^[33] Mutual aid provided by IMAS (Texas City Industrial Mutual Aid System) and Memorial Hermann Life Flight resources were mobilized by 1:45 pm.^[67][70][71] The feed to the raffinate splitter was not shut down, but it stopped at 2:45 pm when electrical power went down. Fires were brought under control by 150–200 firefighters after two hours. Ambulances and Life Flight stood down by 4:44 pm. The final body was found under a heap of debris at about 11:00 pm.^[70][72]

BP internal investigations

Baker Panel report

After the March explosion, two more serious process safety incidents occurred at the plant:

• On July 28, 2005, a hydrogen gas heat exchanger pipe on the resid hydrotreater unit ruptured, causing a release of hydrogen that erupted into a large jet fire. Fires lasted for about two hours. One person received minor injuries and property damaged amounted to $30 million. The Chemical Safety Board found that a contractor had accidentally swapped a low-alloy steel elbow for a carbon steel pipe elbow during maintenance, causing a failure mode known as high-temperature hydrogen attack (HTHA). The CSB found that BP should have required positive materials verification using an X-ray fluorescence test device and maintained or required the contractor to maintain materials identification using tagging to prevent misplacement of components when reassembling the equipment.^[91][92][93]

• On August 10, 2005, a gasoil hydrotreater developed a leak caused by corrosion and high-temperature sulfidation which resulted in the release of toxic gases including carbon monoxide (CO), hydrogen sulfide (H₂S), and sulfur dioxide (SO₂), as well as flammable hydrocarbon vapors.^[94][95] Property damage was around $2 million.^[96]

Both accidents required community shelter-in-place alerts.^[97] Following these events, on August 17, 2005, the U.S. Chemical Safety and Hazard Investigation Board (CSB) issued an urgent recommendation that BP commission an independent panel to investigate the safety culture and management systems at BP North America.^[98] A blue-ribbon panel was assembled, led by former U.S. Secretary of State James A. Baker III.^[76][99] A figure of this stature and curriculum was specifically selected by BP to publicly show to U.S. opinion-makers that the company was eager to learn the lesson and make strides to change.^[100]

The Baker Panel differed from BP's and the CSB's investigations in that it was not charged to conduct a root cause investigation. Its scope was broader, focused on BP's corporate safety oversight, corporate safety culture, and its process safety management systems and included all five BP refineries in the United States.^[101]

The Baker Panel report was released on January 16, 2007.^{[76][102][103]} It cited weak safety culture driven by poor process safety leadership and low employee empowerment as underlying causes of the accidents plaguing the refinery. It also highlighted that despite BP's comprehensive safety management system, this was not sufficiently enforced in their refineries. It also showed that BP's focus in measuring its safety performance relied overwhelmingly on occupational safety indicators to the detriment of process safety performance monitoring.^[104][105] It further stressed that worker fatigue and a system that encouraged overtime had detrimental effects on safe plant operation,^[106] and that the company had failed to deal with deficiencies arising from known incidents, risk assessments and audits.^[107] Implementation of good engineering practices was also found lacking.^[108]

Additionally, the panel interviewed a number of employees, managers and contractors at all five of BP's U.S. refineries.^[109] They also created and administered to the refineries a process safety culture survey.^[110] They concluded that the Toledo and Texas City plants had the worst process safety culture, while the Cherry Point refinery, located in Birch Bay, Washington, had the best process safety culture. The survey results also showed that managers and white-collar workers generally had a more positive view of the process safety culture at their plants when compared with the viewpoint of blue-collar operators and maintenance technicians.^[111]

The report made 10 recommendations on various aspects of process safety (leadership; management system; competence; culture; expectations and accountability; leading and lagging performance indicators; and auditing), as well as on support for line management and industry stewardship.^[112]

CSB report

Given the extent of the disaster the Chemical Safety Board examined both the safety management in the Texas City refinery and the role of the BP Group as well as the role of OSHA as a regulatory body. The CSB investigation team was on site 48 hours after the accident. Some 13 CSB investigators remained onsite for three months. For its investigation, the CSB used a budget of $2.5 million and reviewed more than 30,000 documents, interviewed 370 witnesses, and performed computer modeling and testing. The results of the investigation of the agency were published on March 20, 2007 in a 341-page long report,^[77] the most extensive conducted up to that point by the then nine-year-old agency. The report findings were presented on the same day at a public meeting in Texas City.^{[113][114][115]}

Design deficiencies

One of the key findings of the CSB was that the blowdown system used at the ISOM unit was antiquated and totally inadequate, being located as it was amid the plant and liable to spew unignited heavy vapors down into normally manned areas.^[116] The CSB found that BP had failed to heed or implement multiple warnings and safety recommendations made before the blast regarding the ISOM blowdown system. Among them were:^[117]

• In 1991, the Amoco refining planning department proposed eliminating blowdown systems that vented to the atmosphere, but funding for this plan was not included in the budget.
• In 1992, OSHA issued a citation to Amoco for unsafe design of a similar blowdown system elsewhere in the refinery. However, Amoco successfully persuaded OSHA to drop this citation by relying on the less-stringent requirements in API Recommended Practice 521.^[118]
• In 1993, the "Amoco Regulatory Cluster Project" proposed eliminating atmospheric blowdown systems, but again, funding was not approved.
• Despite Amoco's "Process Safety Standard No. 6", which prohibited new atmospheric blowdown systems and called for the phasing out of existing ones, in 1997, Amoco replaced the 1950s-era blowdown drum/vent stack that served the raffinate splitter tower with an identical system, instead of upgrading to recommended alternatives that were safer.
• In 2002, an opportunity to tie the ISOM relief system into the new naphtha desulfurization unit flare system was not taken, due to a US$150,000 incremental cost.
• Also in 2002, BP's "Clean Streams Project" proposed converting the blowdown drum to a flare knock-out tank, and routing discharges to a flare. When it was found that a needed relief study of the ISOM system had not been completed due to budget constraints, the Clean Streams decided not to pursue the option.

Between 1994 and 2004, at least eight similar cases occurred in which flammable vapors were emitted by the ISOM blowdown drum/vent stack, of which two resulted in a fire. Yet no corrective action was taken.^[119] Furthermore, the blowdown drum was not designed to deal with a vessel overfill. This was not necessarily attributable to Amoco or BP, but rather to a lack of guidance in the API Recommended Practice 521.^{[118][120][g]}

Other design issues included:

• The range of the remote level instruments at the splitter was too narrow and inadequate for start-up operations.^[126]
• Additionally, redundant means to assess liquid level for the safe start-up of a distillation column, such as e.g., a bottom pressure transmitter, were missing altogether.^[127]
• Instrumented systems relied decisively on manual operator intervention instead of automatic action. As a consequence, there was no automatic process shutdown upon the liquid level in the splitter reaching an assigned high level.^[128]
• The human–machine interface used in the control rooms was poorly designed, in that it did not show the splitter incoming and outgoing flows on the same screen, nor did it calculate the total liquid in the tower.^[129][h]

BP's response and fate of the refinery

BP initiated a crisis management plan only six hours after the explosion. The following day, a website^[157] was set up to publish updates on the accident.^[158] Chief Executive Lord John Browne visited the plant on the day after the explosion.^[159] In the months after the accident BP tended to put the blame on its operators and supervisors. Victims and union leaders considered this amounted to simple scapegoating.^[160] At this point, the company consistently chose not to publicly apologize for the accident.^[161] This changed on May 17, 2005, when Ross Pillari, president of BP Products North America, made a public apology, saying "We regret that our mistakes have caused so much suffering. We apologize to those who were harmed and to the Texas City community” and promising "financial support and compensation" to the injured and the families of the dead.^[162]

On December 9, BP said they would put in place a budget of $1 billion to be spent over five years to improve safety at their Texas City refinery.^[159][163] BP also said that it would eliminate all blowdown drums/vent stack systems in flammable service, of which there were 11 at Texas City, and install new flares in line with their new policy prohibiting atmospheric venting of-heavier-than-air light hydrocarbons.^{[9][164][165]} They also relocated trailers away from areas where explosions are possible^[164][166] and started a trial of an electronic integrated safe system of work (ISSOW).^[164] Group-wide initiatives were also taken.^[164]

Not long after the explosion and the other accidents at Texas City in 2005, however, BP's image in the U.S. was further tarnished by the near-sinking of the semi-submersible oil platform Thunder Horse PDQ in July of the same year^[167] and, more crucially, in March 2006 when an oil pipeline spill was discovered in Prudhoe Bay, Alaska, while multiple investigations into the Texas City explosion were still ongoing.^[168] CSB chairman Carolyn Merritt said there were striking similarities between the accidents of Texas City and Prudhoe Bay, including "long delays in implementation, administrative documentation of close-out even though remedial actions were not actually taken, or simple non-compliance" as well as "flawed communication of lessons learned, excessive decentralization of safety functions, and high management turnover."^[169] A further serious accident occurred at BP Texas City in 2007, when 143 workers at the refinery claimed that they were injured when they inhaled toxic vapors released at the plant.^[170] CEO John Browne resigned in 2007 over unrelated issues,^[171] although he did not escape criticism for the lax safety culture and the budget cuts at BP's U.S. refineries.^[28][172] Tony Hayward took over at the helm of the company. Hayward shifted emphasis from Lord Browne's focus on alternative energy, announcing that safety would be the company's "number one priority".^[173] By this time, BP had already taken a markedly apologetic stance over recent accidents, especially Texas City, with their executives and technical experts giving presentations about what went wrong and how they were working to prevent that from happening again.^[174] However, only three years later, the 2010 Deepwater Horizon explosion and oil spill occurred, causing a very serious impact on the company on a global scale, again stemming from BP's operations in the U.S. As a result, Hayward resigned, and his role was taken over by American-born Bob Dudley.^[175] Under Dudley, BP announced in 2011 that it was selling its Texas City refinery as part of its divestment plan to pay for ongoing compensation claims and remedial activities following the Deepwater Horizon disaster. The sale of the refinery was successfully completed at the start of 2013 to Marathon Petroleum Corporation for US$2.5 billion.^[3][176] Marathon already owned the adjoining Galveston Bay Refinery and in 2018 merged the two sites into one refining complex.^[177]

Two congressional hearings were held specifically on the Texas City disaster. Among those heard were API, Baker Panel, CCPS, CSB, EPA, and USW representatives, as well as victim relatives.^[141][178] In other congressional hearings dedicated to subsequent BP accidents in the U.S., the Texas City case history was consistently presented within the pattern of degraded safety culture at BP.^{[179][180][181][182]}

Settlements with victims

BP was named in lawsuits from the victims' families and the wounded.^[183] The case of Eva Rowe, a young woman who lost her parents in the explosion, attracted nationwide attention. Rowe said that she would not accept a settlement from BP and would drag the group to justice. Ed Bradley, a well-known American journalist, made her story known in the television magazine 60 Minutes.^[184] On November 9, 2006, BP settled the case with Rowe as the last applicant after her lawyers had tried to invite John Browne, BP's chief executive officer at the time of the accident, as witness. The amount of compensation for Eva Rowe remained unknown. BP also paid $32 million to hospitals and education and research institutions nominated by Rowe, including the Mary Kay O'Connor Process Safety Center at Texas A&M University ($12.5 million), the University of Texas Medical Branch in Galveston and its Truman G. Blocker Adult Burn Unit ($12.5 million), the College of the Mainland in Texas City ($5 million), St. Jude Children's Research Hospital in Memphis, Tennessee ($1 million), and the Hornbeck, Louisiana school system ($1 million).^[185][j] Furthermore, BP was forced to publish about seven million pages of internal documents, including the Telos and Bonse reports.^{[187][188][k]} Rowe would later participate in one of the congressional hearings held over the accident.^[191]

As of September 2007, BP had settled at least 1,350 of around 3,000 lawsuits related to the accident.^[88] By February 2008, about 4,000 claims were filed, of which half had settled, for a total exceeding $1.6 billion.^[192] BP also said that they had set aside a further $525 million for other claims.^[150] By August 2008 only one of the approximately 4,000 claims remained open.^[193]

Criminal prosecution

On February 4, 2008, U.S. district judge Lee Rosenthal heard arguments regarding BP's offer to plead guilty to a federal environmental crime for two violations of the Clean Air Act (CAA)^[194] with a $50 million fine. At the hearing, blast victims and their relatives objected to the plea, calling the proposed fine "trivial".^[195] However, the plea was eventually agreed, together with a three-year probation period for BP.^[151] This was the first and, for several years, remained the only federal conviction for an accidental chemical release under the CAA.^[196]

Fines

In September 2005, the Occupational Safety and Health Administration, which in the CSB report would be found lacking in oversight and competency,^[l] gave BP a record $21 million fine for committing 301 violations of the Process Safety Management rule.^{[29][198][199]} In October 2009, OSHA imposed a fine of $87 million, which shattered its 2005 record, after claiming that BP had failed to implement safety improvements following the disaster and noting that four further fatal accidents occurred in the refinery since the previous fine. In its new report, OSHA cited 709 safety violations.^[200][201] BP announced that it would challenge the fine.^[202] On August 12, 2010, BP announced that it had agreed to pay $50.6 million of the 2009 fine, while continuing to contest the remaining $30.7 million (the fine had been reduced by $6.1 million between when it was levied and when BP paid the first part).^[203] In July 2012 OSHA and BP agreed that the outstanding $30.7 million would be reduced to $13 million, which BP paid.^[152]

Following the explosion, the U.S. Environmental Protection Agency inspected the refinery for compliance with the Clean Air Act (CAA) and found BP in violation of the CAA as well as its Risk Management Program (RMP) rule.^[204] Most of the violations were not directly related to the explosion but rather to other events, like the two later accidents in 2005. A first fine of $12 million was imposed on BP by the EPA in February 2009. This settlement also included BP's agreement to spend nearly $170 million to improve its environmental performance, with over $150 million dedicated to management of benzene emissions and the remainder addressing chlorofluorocarbons and asbestos.^[154] In September 2010, the EPA and BP agreed on a settlement of $15 million on additional counts of violation.^[94] This was both the largest civil penalty recovered for CAA violations at an individual facility and the largest ever for civil violations of the RMP.^[153][205]

At the request of the Texas Commission on Environmental Quality (TCEQ), the Texas Attorney General opened proceedings against BP for violations of the Texas Health and Safety Code^[206] and Texas Water Code,^[207] including the release of hydrocarbons through the blowdown stack on March 23, 2005, the prolonged release of benzene from a tank damaged in the explosion, which lasted more than 25 days, and tens of other events.^[68] In a 2011 settlement, BP agreed to pay a $50 million fine covering 72 other emissions in excess of BP's operating permits. This included legal costs of $500,000. In return, the Justice Department agreed not to allow additional criminal charges against BP in connection with the refinery explosion.^[155][208]

Analysis of weak implementation of process safety management

The accident has been extensively analyzed in the specialized literature, which highlighted how several elements of process safety management (PSM) were implemented weakly and poorly managed. Observations made on PSM elements as defined in OSHA's rule^[140] include:

• Employee participation: The refinery suffered from workers' fear of punishment from reporting incidents or hazards.^[215]
• Process hazard analysis: the plant hazard and operability analysis (HAZOP) failed to identify the column overfilling scenario^[54] and the risk assessment for the placement of temporary buildings was not complete and, for the most part, erroneous.^[43][216]
• Operating procedures: Deviations from key procedures like the start-up of the ISOM plant had become routine. Additionally, the same start-up procedure lacked sufficient instructions.^{[50][216][217]}
• Training: Training for key plant operators was largely insufficient, especially regarding abnormal situation management and verification of operator knowledge and qualifications.^[50]
• Contractors: Management of contractors disregarded important safety aspects. As an example, those occupying trailers in proximity to the ISOM plant were not told of the start-up.^[217][218] All the fatalities and many of those injured in the accident were contractors.^[65]
• Pre-start-up safety review: This key review in preparation to a particularly hazardous operation was not conducted.^[216]
• Mechanical integrity: Multiple instruments and valves were not operational, because they had not been tested or maintained.^[50][216]
• Management of change: This failed in multiple respects, namely the changes to the unit start-up procedure that required the operators to work the splitter above a safe level,^[50] the lacking or incomplete MOCs for the placement of trailers in the vicinity of a highly hazardous unit,^[216][217] and the lack of a formal change process assessing the elimination of critical operator positions to manage the ISOM plant.^[219]
• Incident investigation: Learning from past incidents and near misses was impaired by the near absence of internal investigations and the consequent spreading of useful lessons learned.^[216]
• Emergency planning and response: The evacuation alarm was not sounded, and this may have contributed to the number of fatalities, since the contractors in the trailers did not have a chance to leave the area.^[217]
• Compliance audits: Audits were conducted but, by BP's own admission, "[audit] action items did not appear to be tracked and effectively closed."^[220]

Additional elements of process safety are defined in the Center for Chemical Process Safety's (CCPS) PSM scheme,^[221] and the refinery was also lacking in some of these:

• Process safety culture: This failed at all levels, as mentioned in all investigation reports.^{[74][76][77][222]}
• Measurement and metrics: Metrics for safety performance management were focused only on occupational accidents. This contributed to give a distorted picture of the health of safety management, since no performance indicators were used to assess the impact of past and the possibility of future process accidents in connection with critical losses of containment of hazardous materials.^[216]

Other essential safety practices that failed included:

• Shift handover and communication between operators was also very poor,^[50] a problem that contributed to several other disasters such as Piper Alpha, the Esso Longford gas plant fire and the Buncefield fire.^{[223][224][225]}
• Control of ignition sources also failed, as demonstrated by the laxness in managing vehicle access in close proximity to live hydrocarbon process equipment.^{[41][216][217]}

New industry guidelines and initiatives

API actioned the recommendations from the CSB's report, thus creating new standards and guidelines for the industry:

• Standard 521: API issued a new revision of its document on Pressure-relieving and Depressuring Systems and upgraded its status from Recommended Practice to Standard. The new standard had more stringent requirements on the atmospheric venting of process gas and an instruction to include overfilling from upstream equipment among the design cases of blowdown systems.^[226][227]
• Recommended Practice 753: API issued new guidance on the location of trailers and portable buildings within hazardous process sites. The scope of Recommended Practice 752 was reduced to permanent buildings only starting with the third edition.^{[228][229][230]}
• Recommended Practice 754: API addressed the need for process safety performance indicators in this new Recommended Practice on Process Safety Performance Indicators for the Refining and Petrochemical Industries.^[231][232] In general, in the wake of Texas City, awareness of the difference between occupational and process safety became more widespread in light of the investigations' findings.^[233][m]
• Recommended Practice 755: This new guideline was directed to refineries and petrochemical plants and detailed how to put in place a fatigue risk management system (FRMS). This document includes recommendations for work on rotating shifts, for the maximum acceptable number of overtime hours and the number of days to be worked on without interruption.^{[236][237][238]}

The CCPS published an extensive guideline on organizational management of change to address another related recommendation from the CSB report.^[239][240]

After being singled out for lack of initiative and competency in assessing and inspecting large hazardous process plants, and refineries in particular, OSHA took action, initiating a refinery Process Safety Management National Emphasis Program (NEP) and enforcing a dedicated inspection audit program between 2007 and 2011. This was the most significant PSM enforcement action since the regulation^[140] was issued in 1992.^[241]

OSHA also issued an internal memorandum^[242] to address the CSB's recommendation on updating the PSM regulation to include requirements for hazardous process facilities to extend their management-of-change procedures to capture organizational changes. However, the CSB did not deem this initiative sufficient to close the recommendation, which, as of January 2024^[ref], was still open.^[240][243]