Can the level indication be trusted during startup?: The BP Texas City refinery explosion
How did the level indication and relief system reflect accumulating liquid during startup?
30-second summary
At about 13:20 on 23 March 2005, explosions during startup of the isomerization unit at BP’s Texas City refinery killed 15 people and injured 180. Liquid accumulated in a distillation tower and escaped to the atmosphere through its relief system.
The CSB investigated failed indication and alarms alongside startup preparation, staffing, training, temporary-building siting and corporate process safety. Startup review extends from valve sequence to instrument coverage, actual inventory, discharge destinations and people exposed there.
Work background and incident sequence
The raffinate splitter was returning from maintenance. Its level transmitter measured a limited range near the bottom of the approximately 52 m tower, not the whole vessel. An instrument appropriate to the normal bottom level was being relied on during an overfill scenario.
Some equipment needed attention before startup. The CSB identified problems with the level transmitter and sight glass and an inoperative pressure-control valve. The transmitter was not repaired within the turnaround schedule, and some alarm tests remained incomplete even though procedural sign-offs recorded completion.
BP had applied a pre-startup safety review, or PSSR, to turnaround startups. It covered safety systems, procedures, training and testing. The relevant process safety coordinator did not understand its applicability, and the review was not performed. It also required confirmation that nonessential people had left the unit and neighboring units.
Raffinate entered the equipment in the early hours of 23 March. One level alarm activated at 03:09, but a separate high-level alarm did not. The night crew then stopped the startup, leaving the tower’s liquid outlet control valve closed for the next shift.
The incoming crew received insufficient detail about what had been filled and which steps were complete. The procedure described a continuous startup rather than one stopped and resumed across shifts. Information about liquid already in the exchangers and connected piping was not adequately transferred.
Feed continued for over three hours without liquid removal. The indicated level fell while actual inventory rose. Liquid reached the overhead piping and imposed pressure on relief valves farther below. When those valves opened, they discharged into the blowdown drum.
The drum and open vent stack could not contain the liquid. Liquid erupted from the stack and evaporated as it fell, forming a flammable cloud. The CSB identified backfire from an idling diesel pickup as the most likely ignition source.
Equipment and work principles
Distillation separates components through differences in volatility. During startup, feed, withdrawal, heating and circulation change. A normal-operating level display alone cannot describe the entire tower inventory once liquid has risen beyond its measuring range.
The transmitter covered about 1.5 m near the bottom, compared with a tower height of about 52 m. A display near 100% refers to that measurement span, not a precise measurement of the whole vessel’s capacity. Instrument range must be read alongside equipment geometry.
A pressure-relief valve protects equipment by releasing fluid at high pressure. Protection also depends on a safe downstream destination. Here, flammable liquid entered an atmospheric system. Testing whether a valve opens is separate from evaluating whether the receiving drum can accommodate the discharge.
The CSB identified the antiquated system’s lack of connection to a flare system that could contain liquids and handle vapors. A high atmospheric vent does not eliminate liquid eruption or cloud formation. Relief-system evaluation must include liquid-overfill scenarios as well as vapor relief.
Feed and withdrawal totals provide another way to examine inventory change. Adding a flow indication does not automatically create an independent safeguard. The display must reveal imbalance, and operating arrangements must define who stops feed and whether another flow path can continue filling the equipment.
Startup authorization must connect instrument faults with inconsistent process conditions. If feed continues without withdrawal while indicated level falls, review the inventory balance before increasing feed. Check whether flow totals, valve positions and temperature changes support a consistent explanation. Each instrument has range and error limitations; one is not automatically the definitive check on another.
Listing support personnel is different from making them available. The CSB described experienced personnel assigned elsewhere and a board operator monitoring multiple units. A startup plan should specify who is released from other duties to make field checks, who watches abnormal trends and who takes over if the lead person leaves.
Published chronology and investigation findings
The CSB did not reduce procedural deviations to individual error. It examined startup support, supervision, shift turnover, abnormal-situation training and fatigue. Staffing and oversight under extended working hours and turnaround pressure did not adequately support this hazardous operating phase.
A low personal-injury rate did not demonstrate control of major release and explosion hazards. Better injury statistics can coexist with failed safety instruments, repeated releases and unfinished maintenance. The CSB called for corporate attention to process-safety resources and performance indicators.
Later that year, failed level indication and overfilling also preceded the Buncefield vapor-cloud explosion. Texas City involved a distillation tower and relief system during startup; Buncefield involved a storage tank and high-level shutdown during receipt. Both raise the question of what actually stops inflow when indication is wrong.
Recommendations to API addressed overfilling in relief-system design, drum and piping capacity for credible liquid discharges, and alternatives to atmospheric blowdown systems receiving flammable material. Changing only an alarm set point does not resolve the consequences after discharge. Design review must include where overflow can travel.
Process-safety indicators need to extend beyond fatalities and injuries after an event. Relevant warning signals here include overdue safety-instrument repairs, incomplete alarm tests, repeated releases and unmet startup conditions. Reporting must reach the management level able to change resources and schedules; attention demanded only from frontline individuals leaves recurring defects unresolved.
| When | Established account | Source |
|---|---|---|
| 2005-03-22 | Some instrument and alarm checks incomplete | CSB pp.48–49 |
| 2005-03-23 03:09 | Level alarm activated; separate high-level alarm did not | CSB p.50 |
| 2005-03-23 shift change | Interrupted startup; outlet valve remained closed | CSB pp.51–52 |
| 2005-03-23 startup | Continued feed without liquid withdrawal; overfill | CSB pp.21–23 |
| 2005-03-23 13:20 | Explosion; 15 killed, 180 injured | CSB p.17 |
| 2007-03-20 | CSB final report | CSB cover |
Consequences and emergency response
The 15 people killed were contractors in or around temporary trailers near the blowdown system. People who do not operate the process can still be exposed within its release and explosion footprint. Convenience and available space are not sufficient criteria for locating temporary offices or meeting areas.
Temporary buildings can be relocated more readily but may be more vulnerable to blast. The CSB recommended a separate siting approach for trailers. A site-layout review should include turnaround contractor populations and people remaining nearby during startup, not only normal occupancy.
Emergency planning extends beyond routes followed after an alarm. Removing unnecessary people before startup and controlling overlaps between discharge points, vehicles and ignition sources can reduce exposure. Locations allowed for engines and temporary equipment should be reviewed against credible release areas.
Questions for your site
| Question | How to check |
|---|---|
| At what point is startup stopped if indication conflicts with feed and withdrawal? | Compare instrument span, charged inventory and outlet paths in one record. Establish a hold point before further feed or heating when discrepancies cannot be explained. |
| Can startup be authorized while instrument repairs remain incomplete? | Link the repair list and functional-test results to authorization. Trace what was tested, what remains untested and who can authorize the next step. |
| What is rechecked when another shift resumes an interrupted startup? | Record the last completed step, closed valves, filled piping and exchangers, and alarm status. Review whether resumption requires a different procedure from continuous startup. |
| Can the relief destination handle a liquid-overfill discharge? | Review liquid quantity and disposal paths in the design scenario and assess exposure around atmospheric discharge. Do not substitute rapid operator response for inadequate capacity. |
| Who remains in nearby trailers and work areas during startup? | Check occupancy and building use, including contractors. Complete relocation and removal of nonessential people before startup authorization. |
Application at Korean sites
Comparable work in Korea is subject to the Rules on Occupational Safety and Health Standards, MOEL Ordinance No. 450, effective 2026-03-02. The following concerns present work; findings about the incident depend on its investigation and proceedings.
Article 277 specifies checks before use after repair or alteration and for changes of use, including feedstock. Connect corrosion review and maintenance records to return-to-service authorization.
Article 279 requires immediate work stoppage and evacuation where an imminent fire or explosion danger exists. It also requires restricted access and signs until the danger is confirmed absent.
How I would approach this incident at work
I check mechanical completion separately from readiness for safe operation.
My checks also cover instrument connections, restoration of alarms, trips and interlocks, and the necessary functional tests.