BP德州事故调查报告 BP texas accident investigation report

LessonsfromTexasCityMikeBroadribb,DistinguishedAdvisor-ProcessSafetyWorkforceInvolvementDay,Edinburgh8thMay2008TexasCityRefinery−TexasCityrefineryislocated40milesfromHoustoninTexas,USA−1600peopleworkattherefinerypluscontractors−ItisoneofthelargestrefineriesintheUSA,processing460,000barrelsofcrudeoil/day,around3%ofgasolineUSsuppliesTheaccident−Anexplosionandfireoccurredattherefinery’sisomerizationunit−Theexplosionhappenedat13:20(Houstontime)onMarch23,2005−15peoplediedandmanymorewereinjured−Note:Theisomerizationunitbooststheoctaneofgasolineblendstocks.SimplifiedblockdiagramofRaffinateSplitterVentReliefsystemBottomProductFeedHeatExchangerCondensateFeedRaffinateSplitterBlowdownstackFurnaceRaffinateSplitterandBlowdownDrumStackRaffinateSplitterTowerBlowdownDrumStackAerialPhotographofIsomerizationUnitWhathappened?•PriortoFeb.15•Feb.21•March22•March23−Temporarytrailersplaced150feetfromtheIsomerizationunit.Theywerebeingusedbypersonnelpreparingforaturnaroundatanotherpartoftherefinery−ShutdownpartoftheIsomerizationunittorefreshthecatalystinthefeedunit−Onthenightshift,theraffinatesplitterwasbeingrestartedaftertheshutdown.TheraffinatesplitterispartoftheIsomerizationunitthatdistilschemicalsfortheIsomerizationprocess−Splitterwasover-filledandover-heated−Whenliquidsubsequentlyfilledtheoverheadlinethereliefvalvesopened−Thiscausedexcessiveliquidandvapourtoflowtoblowdowndrumandventattopofthestack−Anexplosionoccurredwhichkilled15peopleandinjuredmanyothersTexasCityRefineryMarch23,200515PeopleKilledManymoreinjuredAcommunitydevastatedTexasCityRefineryMarch23,200515PeopleKilledManymoreinjuredAcommunitydevastatedIsomerizationUnitIsomerizationUnitSatelliteControlRoomInsideSatelliteControlRoomTrailerDouble-WideTrailerKeyIssues−OperatorInattention−FollowingProcedures−SupervisorAbsence−Communication–shifthandover−TrailersTooClosetoHazards−SomeInstrumentationDidNotWork−AbnormalStart-ups−InvestigationofPreviousIncidents−BlowdownDrumVentedHydrocarbonstoAtmosphere−OpportunitiestoReplaceBlowdownDrumBPincidentinvestigationteamreportsCRITICALFACTORS:•Start-upproceduresandmanagementoversight•Lossofcontainment•Designandengineeringofblowdownunit•ControlofworkandtrailersitingUNDERLYINGCULTURE:•Insufficientbusinesscontext•Safetyasapriority•Organizationalcomplexity•Inabilitytoseerisk•LackofearlywarningindicatorsTheInterimReportidentified4criticalfactors;theFinalReportconfirmedthecriticalfactorsandidentifiedunderlyingculturalissues:UnderlyingCulturalIssues•BusinessContext−Motivation−Morale•(Process)SafetyasaPriority−EmphasisonEnvironmentandOccupationalSafety•OrganizationalComplexity&Capability−InvestmentinPeople−LayersandSpanofControl−Communication•InabilitytoSeeRisk−HazardIdentificationSkills−UnderstandingofProcessSafety−FacilitySiting−Vehicles•LackofEarlyWarning−DepthofAudit−KPI’sforProcessSafety−SharingofLearning/IdeasReminderofthe‘SwissCheeseModel’HazardAccidentProtective‘Barriers’WeaknessesOr‘Holes’•Hazardsarecontainedbymultipleprotectivebarriers•Barriersmayhaveweaknessesor‘holes’•Whenholesalignhazardenergyisreleased,resultinginthepotentialforharm•Barriersmaybephysicalengineeredcontainmentorbehavioralcontrolsdependentonpeople•Holescanbelatent/incipient,oractivelyopenedbypeopleTexasCityExplosion–HazardManagementDiagramHierarchyofcontrol–Biastowardshardware/inherentsafety&reducingthescopeforhumanerror–multibarrierdefenceInherentDesignPlantLayoutControl,Alarm&Shutdownsystem•Operateoutsideenvelop•Nofail-safeshutdown•Nomassbalanceorattentiontootherdata•Lostprocesscontrol•FaultyhighlevelalarmnotreportedMaintenance&InspectionLearningfromthePast•Previousincidents&upsetsnotreported•Admin.ratherthanISDsolutions•HierarchyofcontrolnotappliedOperationsProceduresEffectiveSupervision/LeadershipTraining&CompetencyƒInadequateHAZIDskillsƒLackofunderpinningknowledgeƒFailuretofollowproceduresWorkControl•Failuretorecognizehazardtotrailersfromstart-up•Peoplenotnotifiedofstart-up•MultiplesourcesofignitioninadjacentareasSupporttoNextofKin&InjuredReliefandBlowdownSystem•Nouptodatereliefstudy-designbasisunclear•CapacityofblowdowndrumexceededAudit&SelfRegulation•Pre-start-upreviewnotperformed•Proceduralcompliancenotchecked•Supervisoroffsite•Nointerventions•InadequateKPI’sforprocesssafety•No/incompleteMOC’sfortrailersiting•BlowdowndrummodifiedwithoutrigorousMOCManagementofChangeActive&PassiveFireProtectionEscape/AccessRescue&RecoveryHAZARDNormalHydrocarbonInventoryinRaffinateSplitterInvestigation&LessonsLearned•Active&passivefireprotection•Access&escaperoutediversity•Accesstoscene•Emergencyresponsebysiteandexternalauthorities•HospitalizationHAZARDREALIZATIONLossofcontainmentIgnitionExplosionMultiplefatalitiesandinjuries•Inventoryincreased•Proximityofnon-essentialpersonneltohazard•FlarenotusedCommunication•Confusionoverwhowasincharge•Noverificationonproceduresinuse•Absentfromunitatcriticaltimes•Proceduresnotfollowed•Stepsnotsignedoff•Useof‘localpractices’•Noeffectivehandoverbetweenshifts•UnitalarmnotsoundedStrategicConceptsInordertoreducethepotentialforfuturemajorincidents