Can the level indication be trusted during startup?: The BP Texas City refinery explosion
The 23 March 2005 explosion at BP Texas City, United States, killed 15 people and injured 180. It illustrates interacting weaknesses in instrumentation, startup control, release systems and occupied-building siting.
Incident sequence and circumstances
BP Texas City was restarting its isomerisation unit on 23 March 2005. The CSB examined overfilling of the raffinate splitter and problems with level indication and operating decisions during startup.
Hydrocarbons discharged through the atmospheric blowdown system, formed a vapour cloud and exploded. Fifteen people died and 180 were injured. Nearby temporary buildings made personnel location part of the consequence analysis, alongside release and ignition.
Original reporting and investigation records
The CSB final report examines startup, instrumentation and alarms, the blowdown system and occupied trailers. The original report includes the investigation diagrams and site material.
CSB: BP Texas City final investigation report · CSB: Final findings on the BP Texas City disaster
Check your workplace
- Do independent process indications agree?
- Are unresolved instrument or alarm defects blocking startup?
- Have occupied temporary buildings and non-essential personnel been assessed?
Startup is a distinct operating phase
The CSB final report describes tower overfilling during isomerization-unit startup, a hydrocarbon release and a vapor-cloud explosion. Startup needs its own controls rather than assumptions drawn from steady operation.
Cross-check the process state
The investigation examined instrumentation, alarms, procedures and handover. A plausible displayed value should not override inconsistent flow, pressure or temperature information.
Define hold points and stop conditions as well as operating steps. Establish how discrepancies between field observations and control-room indications are escalated, resolved and authorized for restart.
Temporary buildings create real exposure
CSB identified occupied trailers near the process as a major issue. Temporary status does not remove the need for siting assessment.
Consider release and explosion scenarios, structural vulnerability and actual occupancy, not a single generic separation distance. Plan control of non-essential personnel during startup.
Management evidence before release to operation
Connect checklist signatures to evidence: unresolved defects, protective-system tests, modifications and handover records.
Low personal-injury rates alone do not demonstrate control of major process hazards. Track degraded safeguards, repeat releases and overdue corrective actions to understand whether defenses remain effective.
Putting it into practice
Use the startup meeting to review unresolved defects and explicit hold points. Operations, maintenance and safety personnel should share the same equipment-state record.
Include temporary-building occupancy and access restrictions in the readiness decision.
Technical insight
Startup decisions require a consistent process picture
Flows and heating conditions change during startup, so a familiar indication alone may not describe the equipment inventory. The instrumentation and procedural problems examined in the BP investigation distinguish having a displayed value from verifying the process state.
Use procedural hold points when field observations, indications and material flows disagree. Readiness review also includes unresolved defects, handover and people in temporary buildings who could be exposed. One apparently normal reading cannot establish overall startup readiness.
Sources
- CSB: BP Texas City final investigation report미국 / United States
- CSB: Final findings on the BP Texas City disaster미국 / United States