BP Texas City Refinery Explosion | SafeGuard PSM Case Study

📋 Incident Summary

On March 23, 2005, a series of explosions ripped through the isomerization (isom) unit at BP's Texas City refinery, killing 15 workers and injuring 180 others — the deadliest U.S. industrial disaster in more than a decade. Workers were seated in temporary trailers positioned 121 feet from the isom blowdown drum, an area identified as high-risk but never evaluated for blast hazard.

During startup of the raffinate splitter, operators overfilled the distillation tower with flammable liquid. Level instruments provided false readings; operators believed the tower was nearly empty when it was actually overflowing. Liquid cascaded into the blowdown drum, overwhelmed it, and geysered out of the atmospheric vent stack as a massive flammable vapor cloud that found multiple ignition sources.

The CSB issued 26 recommendations to 9 entities and concluded that BP's corporate culture had systematically prioritized personal safety metrics — lost-time injuries — at the expense of process safety. The Baker Panel review commissioned after this incident led to sweeping changes in BP's global process safety governance.

🔎 Key Findings

Finding 1

Occupied Trailers in Blast Zone

Temporary trailers housing workers during a turnaround were positioned 121 feet from the blowdown drum. No facility siting analysis evaluated blast hazard distances for these occupied structures.

Finding 2

False Level Instrument Readings

The raffinate splitter level transmitter and sight glass gave inaccurate readings during startup. Operators could not determine actual liquid levels, allowing overflow to develop undetected.

Finding 3

Deficient Startup Procedures

Startup procedures were incomplete, outdated, and not effectively enforced. Critical steps for managing liquid levels during the isom unit startup were absent or unclear.

Finding 4

Corporate Safety Culture Failure

BP measured safety performance using personal injury metrics while process safety indicators went unmeasured, creating a false sense of safety across all management levels.

Finding 5

Blowdown Drum Design

The atmospheric blowdown drum vented liquid hydrocarbons directly to the environment — an outdated design. Modern systems direct overflow to a closed flare header.

Finding 6

Inadequate PHA for Startup

The PHA for the isom unit startup scenario was inadequate. The high-consequence combination of liquid overflow, blowdown drum overfill, and occupied trailers in the blast zone was never identified.

🔍 Root Causes

Corporate Culture Prioritizing Personal Safety Over Process Safety

BP management focused on lost-time injury rates as the primary safety indicator, making systemic process safety hazards invisible to leadership until catastrophe struck.

Deficient Process Safety Leadership

BP's Texas City refinery lacked adequate process safety accountability at all levels, from frontline supervision through executive management.

Mechanical and Instrumentation Failures

Level instruments provided false readings and the blowdown drum design was inadequate. Known deficiencies were not corrected before the fatal startup.

Inadequate Startup Supervision

Day shift supervisor did not effectively brief the night shift; startup proceeded without active oversight or adherence to procedures.

Facility Siting Failure

Temporary trailers were placed in the blast zone without a hazard assessment. OSHA PSM facility siting requirements at 29 CFR 1910.119(e) were not fulfilled.

☑ CSB Recommendations

→ BP / Baker Panel

Implement all Baker Panel recommendations across all U.S. refineries, including establishing a corporate-level process safety management system with measurable performance indicators.

→ OSHA

Develop a standard requiring facility siting analyses for temporary structures near high-hazard process units during turnarounds and other non-routine operations.

→ EPA / API

Update RMP and API guidance to differentiate process safety performance metrics from personal safety metrics and establish industry benchmarks.

→ BP Texas City

Immediately evaluate all temporary structures near process units for blast proximity and relocate or remove any within identified hazard zones.

→ Industry

Adopt closed flare systems or equivalent liquid containment for blowdown drums at all refineries handling volatile hydrocarbon streams.

💡 Lessons Learned

⚠ Process safety and personal safety are not the same metric. A facility can achieve years of zero lost-time injuries while catastrophic process hazards remain entirely unaddressed.

⚠ Facility siting analyses are required under OSHA PSM. Temporary structures and trailers positioned near high-hazard units must be evaluated for blast, fire, and toxic release consequences before occupation.

⚠ Level instruments are safety-critical devices. False readings during high-hazard startups can mask dangerous conditions until intervention is impossible — these instruments must be verified accurate before startup.

⚠ Startup procedures for high-hazard units must be complete, current, and actively supervised. Startup is a high-risk operation that demands the highest level of management attention.

⚠ Corporate process safety culture is established at the executive level. When leadership measures only personal injury rates, process safety gaps are invisible until they produce catastrophe.

PSM Elements: PSI · PHA · SOP · MI · MOC · EP

🔨 Safety Meeting Toolbox Talk

Topic: Process Safety vs. Personal Safety & Facility Siting

💬Does our facility have a process safety management program that goes beyond tracking personal injuries and near-misses with dedicated process safety metrics?

💬Have we conducted a facility siting analysis for all occupied buildings, trailers, and temporary structures near high-hazard process units?

💬Are our startup procedures complete, current, and actively supervised by qualified personnel for all high-hazard units?

💬Do we have level instruments and other safety-critical instruments on a formal calibration and testing program with verification before critical operations?

💬Who in our organization is specifically accountable for process safety performance — and how is that accountability measured and enforced?

💬Could any known instrument failures or equipment deficiencies create hazardous conditions during a startup, turnaround, or non-routine operation?

✎ Team Action Items

✓Review the location of any trailers, control rooms, or temporary structures relative to high-hazard process units and verify a facility siting analysis exists for each

✓Identify all safety-critical instruments in your unit and confirm they are on an active calibration and verification schedule with pre-startup checks

✓Pull the startup procedure for your highest-hazard unit and verify it includes liquid level management steps with defined alarm and shutdown limits

✓Ask your supervisor to identify the process safety performance indicators your facility tracks beyond personal injury rates

🔗 PSM Failures Behind This Incident

This incident traced to breakdowns across 6 PSM elements (PSI · PHA · SOP · MI · MOC · EP). Each represents a documented gap that process safety documentation and consulting can close before a similar event occurs at your facility.

Process Safety Information (PSI)

Accurate, complete Process Safety Information is the foundation every other PSM element depends on. When PSI is missing or wrong — chemistry data, equipment specs, P&IDs — the entire hazard analysis is built on a flawed base.

Supporting documents in our library →

Process Hazard Analysis (PHA)

A structured PHA or HAZOP study exists to identify exactly these scenarios before they occur. When PHA is absent, superficial, or overdue for revalidation, hazards operate unseen until they kill someone.

Supporting documents in our library →

Operating Procedures (SOPs)

Operators cannot reliably hold safe operating limits without clear, current, enforced procedures. Deviation from acceptable operating conditions — a root cause here — is a direct consequence of SOP failure.

Supporting documents in our library →

Mechanical Integrity (MI)

Equipment must be designed, inspected, and maintained to operate safely in its intended service. Mechanical integrity failures — degraded equipment, missed inspections, deferred repairs — contributed to loss of containment here.

Supporting documents in our library →

Management of Change (MOC)

Changes to equipment, chemistry, operating limits, or procedures that bypass formal review create new hazard pathways your PHA never evaluated. MOC failures open the door to incidents like this one.

Supporting documents in our library →

Employee Participation

OSHA PSM requires workers to be meaningfully involved in hazard analyses and procedure development — not just trained on the finished product. Active participation catches gaps that management alone misses.

Supporting documents in our library →

SafeGuard PSM

Process Safety Management Consulting & Document Library

📂

PSM Document Library

32 ready-to-deploy PSM documents covering all 14 OSHA elements — procedures, checklists, and audit templates built for facilities operating under 29 CFR 1910.119.

Browse the Library →

📊

Free PSM Health Score

Find out where your PSM program stands across all 14 OSHA elements. Our free health score surfaces your biggest gaps in under 10 minutes — no account required.

Check Your Score →

📞

Consulting Services

PHA facilitation, PSM program builds, compliance audits, and OSHA inspection support. Transparent flat-fee pricing — no retainer required to get started.

View Pricing →

📋 Explore the full incident library: All 132 CSB Case Studies →