38 | Winter 2005 | PPRROOCCEESSSSWest
IIt is human nature to let our guard downwhen during the course of a job or task itbecomes repetitive or when we lose sight
of the consequences of certain actions.For example, driving a car for hours down
a long straight piece of blacktop, like theroads in southern Saskatchewan, can reduceour alertness to the point where we becomeso drowsy we begin to catnap. If we don'trecognize what is happening or remind our-selves of the severe consequences (death), weunknowingly increase our risk exposure andthe risk exposure to others. Anear-miss event occurred in myfamily this summer when boththe driver and passenger on a six-hour drive to Saskatchewan fellasleep. Fortunately, they wokeup in the ditch while driving athighway speed and immediatelyresponded with the correct recov-ery procedure. They committedto each other to always take reg-ular breaks on long trips to avoidthis from happening again. Thepoint is, taking breaks is not new.But in today's fast paced world,marathon-driving sessions, with-out breaks, brought on by jampacked schedules seem to havebecome the norm.
My family's driving anecdoteshowcases the impact of humannature in our personal lives. Wecontinuously need to be remind-ed and to remind ourselves thatsometimes the consequences of our actionscan be extremely bad, both for others and us.If we don't have a system of re-highlightingthe consequences of our mistakes or omis-sions, we often do not think of the potentialunpleasant consequences. When such anincident occurs, we can be lucky or unlucky.If we are lucky, we normally take it as awarning sign. Hopefully, we learn from ittoo. We pay more attention. We pull off theroad and find a safe place for a nap. If we arevery unlucky, we may not get a secondchance. Should the worst happen, hopefullyothers learn from our mistake.
The March 23, 2005 incident at the BPTexas City, Texas refinery illustrates theseverity of consequences in our industrialworld.
According to a number of sources, includ-ing the Houston Chronicle and BP manage-ment, apparently trouble began early in themorning when isomerization unit workerswho had begun the start-up of the raffinatesplitter during the night shift failed to fullybrief day-shift workers and the supervisor.(The splitter is used to produce chemicals
used to boost the octane of gasoline.) As thestart-up continued early that morning, high-ly flammable hydrocarbons flowed into thesplitter much more quickly and were heatedmuch faster than normal. As the level of thefluids rose from seven feet to a staggering140 feet, three pressure-relief valves activat-ed, allowing the materials to begin flowinginto a blow down drum nearby.
After the blow down drum filled, thematerials then made their way up a ventstack and overflowed. Liquids and vaporsthen flowed onto the plant grounds, whereunsuspecting workers were driving vehicles,
operating generators and doing other refin-ery work. A yet-to-be-identified ignitionsource then caused the massive blast.Apparently six minutes passed between thetimes the pressure relief valves opened andthe explosion occurred, but none of the oper-ators sounded the evacuation alarm. T h econsequences were extremely severe. Fifteenpeople were killed and more than 170 wereinjured in the explosion. BP set aside US$700 million to compensate victims of theexplosion and resolve claims arising from the
incident.
HHooww ccaann tthhiiss hhaappppeenn aatt aammooddeerrnn NNoorrtthh AAmmeerriiccaannffaacciilliittyy??
As we can see in thegraphic accompanying thisarticle, taken from the interna-tional standard IEC 61511Functional safety - Safety instru-mented systems for the processindustry sector, there are manyrisk reduction methods used byprocess plants like Texas City.
The results of a prelimi-nary investigation by the U.S.Chemical Safety and HazardInvestigation Board releasedon August 17, 2005 found thatsome of the safeguards in place,which may have prevented thisevent from occurring, failed.In particular:
•Key alarms and a leveltransmitter failed to operate properly and towarn operators of unsafe and abnormal con-ditions within the tower and blow downdrum;
•The startup of the raffinate splitter wasauthorized on March 23 despite knownproblems with the tower level transmitterand the high level alarms on both the towerand the blow down drum;
•The majority of 17 startups of the raffi-nate splitter tower from April 2000 toMarch 2005 exhibited abnormally highinternal pressures and liquid levels - includ-ing several occasions where pressure relief
PPRROOCCEESSSSSAFETYKen Bingham
...a human nature issue?TThhee BBPP TTeexxaass CCiittyy IInncciiddeenntt
Typical risk reduction methods found in process plants.
PPRROOCCEESSSSWest | Winter 2005 | 39
valves likely opened, but theabnormal startups were notinvestigated as near-misses andthe adequacy of the towersdesign, instrumentation andprocess controls were not re-eval-uated;
•Written startup proceduresfor the raffinate splitter wereincomplete and directed opera-tors to use the so-called 3-lb ventsystem to control tower pressure,even though the pressure-controlvalve did not function in pre-startup equipment checks andalso failed to operate effectivelyin post-accident testing.
It appears that the driver hadfallen asleep and the brakes werenot going to be able to help ifcalled upon. That the driver hadexperienced some minor inci-dents that should have served aswarning signs makes it muchmore regrettable.
BP, government and regulato-ry bodies are now exhaustivelyconsidering what went wrongand how to minimize a reoccur-rence. The process industry willbenefit from the lessons learnedand know what to do better nexttime. Ironically, one of thepotential safeguards now beingconsidered more seriously is theuse of relief valves being tied into
a closed flare system. This safe-guard had been evaluated before,but considered unnecessary.Now related systems in this facil-ity and others may be revampedto a closed flare system.
Unfortunately, the Texas Cityincident signifies one of theongoing challenges decisionmakers in industry face. Unlessthe severest consequences areconsidered and steps taken tomitigate their probability, it ishuman nature to focus on theimmediate - financial perform-ance, the bottom line.Consequently, unacceptable riskscan be taken. They becomeacceptable in certain circum-stances. The trouble is that ifthese special circumstancesbecome normal circumstances,organizations expose themselvesto extraordinary and unaccept-able risk.
By being aware of the realisticprobabilities of all types of conse-quences, both individuals andorganizations can help reducehazardous events and reducetheir risk. For the process indus-try, one suggestion is to involveplant personnel in risk assess-ments. This helps identify theprobability of hazardous events,severity of consequences androbustness of safeguards in high-risk areas of a plant. It personal-izes the seriousness of operatingprocedures and maintaining safe-guards and safety systems.
The participation of plant andcorporate personnel in regularHAZID, HAZOP and SILAssessments is a good start toguard against the human natureproblem of making unacceptablerisks acceptable on any givenday.
Let's drive safely, practice gooddriving habits, and appreciatewhat staying out of the ditchmeans. PPWW
Readers can contact the author, KenBingham of ACM Facility Safety adivision of ACM Automation Inc.for more information by email:[email protected] and byphone 403-264-9637
If we don’t have a systemof re-highlight-ing the conse-quences of our
mistakes oromissions, weoften do notthink of the
potentialunpleasant
consequences.
