BP pled guilty and settled for $50million and a probation period of three years
Litigation
Approximately 4,000 claims
Costs
Approximately $2.5billion of liabilities for BP
On March 23, 2005, ahydrocarbon vapor cloud ignited and violently exploded at theisomerization process unit of theBP-ownedoil refinery inTexas City, Texas. It resulted in the killing of 15 workers, 180 injuries and severe damage to the refinery. All the fatalities were contractors working out of temporary buildings located close to the unit to supportturnaround activities. Property loss was $200million ($322million in 2024). When including settlements ($2.1 billion), costs of repairs, deferred production, and fines, the explosion is the world's costliest refinery accident.
The explosive vapor cloud came fromraffinate liquids overflowing from the top of ablowdown stack. The source of ignition was probably a running vehicle engine. The release of liquid followed the automatic opening of a set ofrelief valves on a raffinate splitter column caused by overfilling.
Subsequent investigation reports by BP, theU.S. Chemical Safety Board (CSB), and an independentblue-ribbon panel led byJames Baker identified numerous technical and organizational failings at the refinery and within corporate BP.
The disaster had widespread consequences on both the company and the industry as a whole. The explosion was the first in a series of accidents (which culminated in theDeepwater Horizon oil spill) that seriously tarnished BP's reputation, especially in the U.S. The refinery was eventually sold as a result, together with other North American assets. In the meantime, the industry took action both through the issuance of new or updated standards and more radical regulatory oversight of refinery activities.
The refinery was established in 1933 byPan American Refining Corporation.[1] Pan American merged with Standard Oil of Indiana in 1954 to formAmoco.[2]BP acquired the refinery as part of its merger with Amoco in 1999.[3] As of January 2005, it was the second largest oil refinery out of 23 in Texas (behindBaytown Refinery), and the fourth overall out of 142 in the United States in terms of operating capacity, which was 475,000 barrels (75,500 m3)per stream day.[4][a] At the time of the accident it was one of three refineries in Texas City, the other two belonging toMarathon Petroleum andValero Energy.[1][4] The refinery was also one of five BP refineries in the U.S. and BP’s largest worldwide. It could produce around 10 million gallons (38 million L) ofgasoline per day, or about 2.5% of the entire volume sold in the United States. It also producedjet fuels,diesel fuels, as well as chemical feed stocks. Its 1,200-acre (490 ha) site was covered by 29 oil refining units and four chemical units. It employed around 1,800 BP workers. At the time of the accident, about 800 contractors were onsite to supportturnaround works.[6]
At the time of the 1999 merger, the plant was losing money,[7] but BP was extremely successful in turning the tide. In fact, the complex had performed at an all-time record profitability in 2004, with over $1 billion in profit, "more than any other refinery in the BP system" in the words of business unit leader and complex manager Don Parus.[8] By early 2005 the refinery was making profits of around $100 million on a monthly basis.[9]
Since 1974, there had been 23 fatalities in 20 separate accidents at the refinery. Three of these occurred in 2004, the year prior to the explosion. Almost half of these fatalities were due to fires or explosions ensuing process fluid releases.[10] A very serious explosion affected the complex in July 1979, when hydrocarbons at 265 psi (1,830 kPa) were released from a failed 12 inches (30 cm) elbow in the depropanizer overhead condensing system of thesulfuric acidalkylation unit. More than 4,000 US gallons (15 m3) of liquids were discharged. A large vapor cloud formed and traveled downwind about 640 feet (200 m) to thefluid catalytic cracking (FCC) unit, where ignition occurred. A control building, the alkylation unit, the FCC unit, and the carbon monoxide boiler sustained heavy damage. Windows were broken up to 1.5 miles (2.4 km) away. Although no fatalities occurred, property loss was very significant ($24million, or $104million in 2024).[11][12] Another large explosion took place in March 2004. Although no one was injured, BP temporarily evacuated the refinery. The police closed the access roads and asked residents not to leave their houses.[13]
The plant had been poorly maintained for several years.[14] Starting in the early 1990s, Amoco and later BP made substantial budget cuts, especially affecting maintenance expenditure. Immediately after the merger, in fact, BP ordered a 25% cut in operating costs, which was achieved in part with lower spending in maintenance and training and cutting back on safety staff.[15][16]
In 2002, BP contracted consulting firmA.T. Kearney to understand "the historical facts which have led to the deterioration of the Texas City refinery performance." The report[17] connected the significant reductions in spending with the deterioration in the refinery's integrity and reliability.[18] An internal BP audit conducted in 2003 found that a "checkbook mentality", blame, and status culture erodedHSE as well as general performance; the condition of assets and infrastructure was poor; management had not created meaningful action plans; and that there were insufficient resources.[19] A similar audit in 2004 found fault across all elements ofprocess safety management (PSM).[20] Another external audit report was produced by consulting firm Telos in January 2005.[21][22] It identified numerous safety issues including "broken alarms, thinned pipe, chunks of concrete falling, bolts dropping, cigarettes falling 60 feet (18 m) and staff being overcome with fumes." The report's co-author stated, "We have never seen a site where the notion 'I could die today' was so real."[23] The report also stated, "Most interviewees say that production and budget compliance gets recognized and rewarded before anything else",[24] "Most interviewees at the production level say that the pressure for production, time pressure, and understaffing are the major causes of accidents at Texas City"[25] and that
There is an exceptional degree of fear of catastrophic incidents at Texas City. People talked or wrote at length about serious hazards are in the operating units fromCUI, abandonedasbestos, piping integrity issues, inadequate spare pumps and parts, and other equipment and operating hazards. Of these, piping integrity was repeated again and again. Even where there have been recent investments in piping integrity, people reported that they often could not shut the unit down to in fact replace the pipe they had fabricated. The tolerance of these kinds of risk "distracted" people from routine safe practices at the task level, or made them feel skeptical about the commitment to safety at the plant.[26]
Some key reports on the preoccupying conditions of the refinery made their way to company board level.[27] In early March 2005, mere weeks before the explosion, an internal e-mail warned, "I truly believe that we are on the verge of something bigger happening and that we must make some critical decisions [...] over getting the workforce's attention around safety."[28] Management turnover had been high in the years leading to the explosion, with the complex having had five managers in the six years since the merger,[29] with the result that employees were under the impression that any new initiative would not last and that efforts were focused on short-term profit rather than long-term sustainability.[30] The complex was still largely using Amoco safety management processes pre-dating the merger.[31]
Theisomerization plant (ISOM) at the site was designed for the conversion of low-octane hydrocarbons, through various chemical processes, into hydrocarbons with higheroctane ratings that could then be blended into unleadedgasoline. This is achieved by converting straight-chain hydrocarbon molecules into branched ones.[32] The main feed to the unit was a mix ofn-pentane andn-hexane, withisopentane andisohexane being the main product.[33] The plant consisted of adesulfurization system, aPenex isomerization reactor, a vapor recovery and liquid recycle unit, and araffinate splitter.[34]
The 170-foot (50 m) tall tower-shaped splitter, adistillation column, was used to separate lighter hydrocarbon components from the top of the tower (mainly pentane and hexane), which condensed and were then pumped to a light raffinate storage tank, while the heavier components (mainlyC7 andC8) were recovered lower down in the splitter, then pumped to a heavy raffinate storage tank. The unit had an operational capacity of 45,000 barrels (7,200 m3) per day.[31]
Excess hydrocarbon vapors and liquids from vent andrelief were sent to vessel F-20, ablowdown stack. This was designed to disperse vapors from the top and convey any liquids through agooseneck into the plant closed sewer network.[b] It was a 10-foot (3.0 m) diameter vertical drum with a 113-foot (34 m) vertical flue pipe. F-20 was put in commission in the 1950s and had gone through several modifications over the years.[31]
Remedial work had been started on the raffinate splitter from February 21, 2005. Twoturnaround activities were also taking place at the adjacentultracracker unit (UCU) and at the aromatics recovery unit (ARU) at the same time.Portable buildings andtrailers were often installed for use as offices during construction and maintenance.[36] In 2004, 122 trailers were in the refinery with an estimated occupancy of 800. BP allowed trailers to be placed near process units based on the results of a screening process.[37]
In 1995 a site-wide temporary siting analysis report[38] had been created at the facility that established an acceptable layout of trailers and other temporary structures with respect to nearby hazardous process facilities. The report was revalidated in 2002, still based on Amoco's standards although more than three years had passed since the BP–Amoco merger. In turn, Amoco'sFacility Siting Screening Workbook was based on theAmerican Petroleum Institute's Recommended Practice 752.[39][40][c] The next siting analysis was due to take place in 2007 and, therefore, any siting changes before then would have to be under themanagement of change (MOC) process. Plans were made late in 2004 to accommodate contractors due to work on the UCU in 2005 in nine single trailers and one double-wide trailer immediately west of the ISOM process unit. The team carrying out the MOC assessment for the placement of the double-wide trailer identified that the structure would be less than 350 feet (110 m) from the ISOM plant, a distance below which a dedicated risk analysis had to be carried out under Amoco'sWorkbook provisions. This team, however, lacked the expertise to complete the risk assessment. The introduction of the nine single trailers in the picture was not assessed in an MOC. Further, contrary to procedure, recommendations issued in the analysis of the change involving the placement of the double-wide trailer were still open when the trailers were occupied in November 2004.[43]
The start-up process commenced with thenight-shift lead operator on March 23 carrying out the initial filling of the splitter tower. Because plant start-ups are especially prone to unexpected situations, operational practice requires the application of a controlled and approvedpre-start-up safety review (PSSR) procedure. BP had one, but it was not adopted in this case.[44] The process control level transmitter was designed to indicate the raffinate level within a 5-foot (1.5 m) span from the bottom of the splitter tower to a 9-foot (2.7 m) level. A high-level alarm dependent on this transmitter sounded as intended at 3:09 am, when a level of 7.6 feet (2.3 m) from the bottom was reached. However, during start-up it was common to ignore this alarm and fill up to a level of 99% (as indicated by the transmitter) to prevent damage to thefurnace heating the splitter bottom. Unbeknown to the operators, the process control level transmitter, which was used to monitor the level in the splitter during the whole start-up operation, was not calibrated and its readings were not reliable. An independent level alarm triggered by a high-level switch should also have sounded at 7.9 feet (2.4 m) but failed to. At 5:00 am, the lead operator in the ISOM satellitecontrol room briefed the central control room and went home early. At 6:00 am, theday-shift board operator (central control room operator) arrived and started his thirtieth consecutive day on a 12-hour shift duty. By this time, the level was still believed to be below the 9-foot mark, but it was already at 13 feet (4.0 m).[45][46][47]
At 7:15 am, more than one hour late on the commencement of his shift (6:00 am), one of the two day-shift supervisors ("A") arrived at the central control room. Because of his lateness, he could not go through the required handover with the night shift. During the morning meeting on March 23, it was discussed that the heavy raffinate storage tanks were nearly full and, therefore, a second day-shift supervisor ("B") was told that the start-up procedure should not continue, but this information was not passed on. Therefore, the start-up procedure resumed just before 9:30 am under instructions from the day-shift supervisor A. The splitter level control valve into the heavy storage tank was placed in manual mode (rather than having its opening regulated by the level transmitter) and set at 4,300 bpd. However, theflow transmitter on this line was in error and the valve had actually been closed shut. This, coupled with the malfunctioning of all the splitter tower instruments, allowed the level of liquid in the tower to increase without anyone noticing and caused the operators to lose allsituational awareness.[16] The circulation process was restarted just before 10 am and raffinate was once again fed into the tower, even though the level was already too high. Since the level-control valve was shut and, therefore, there was no circulation out of the tower (i.e. no heavy raffinate being transferred to the storage tank), the splitter tower inevitably began to fill up. The defective level transmitter continued to show the level at less than 100%, and since the externalsight glass was opaque, a visual check to verify the level in the splitter tower was not possible. Day-shift supervisor A, the more experienced of the two, left at 10:50 am due to a family emergency. Contrary to the operating rules, no supervisor was left in the central control room. A single, unsupervised, and very tired board operator was now left to supervise the ISOM and two other units during a critical start-up procedure.[45][48][49][d]
Two burners in the furnace had been turned on at 9:55 am to pre-heat raffinate going into the tower and to heat the raffinate in the tower bottom. Two more were lit at 11:16 am. The required temperature for the tower reboiler return flow was 135 °C (275 °F) with a rate increase of 10 °C (18 °F) per hour, but this procedure was not followed: during start-up, the return flow temperature reached 153 °C (307 °F) at a rate of 23 °C (41 °F) per hour. The defective level transmitter still erroneously indicated an ongoing safe level condition in the tower. However, there was still no flow of heavy raffinate from the splitter tower to the storage tank as the level control valve remained closed; instead of the hydrocarbon liquid level being at 8.65 feet (2.64 m), i.e. 93% of the instrument range, as indicated, it had actually reached 67 feet (20 m). Just before midday, with heat increasing in the tower, the actual fluid level had risen to 98 feet (30 m). Pressure started to build up in the system as the hydrocarbon vapors and thenitrogen remaining in the tower and associated pipework from when it had been put back in service became compressed with the increasing volume of raffinate. The operations crew thought that the pressure rise was a result of overheating in the tower bottoms as this was a known start-up issue, so the pressure was released.[51][52]
By 12:42 pm, the furnaces had been turned down and the level control valve was finally opened, draining heavy raffinate from the splitter tower. The gas fueling the furnace was shut off, but the raffinate feed into the splitter tower was not. The operators believed the level transmitter reading which was now down to 78% (7.9 feet [2.4 m]) but the fluid level in the 170-foot (52 m) tall splitter tower had now reached 158 feet (48 m).[53]
The release of liquid from the blowdown stack via the open pressure relief valves
While the opening of the heavy raffinate flow should have diminished the level in the column, the fact that this hot flow was used to pre-heat the feed meant that the temperature inside the splitter increased dramatically, which led to significant increase in vaporization and the lifting of a slug of liquid over the top of the column into the overheads line.[54] At 1:13 pm, thehydrostatic head of this liquid had built to over 42 psi (290 kPa).[55] This was sufficient to open therelief valves.[54] With the relief valves fully open, over 51,900 US gallons (196 m3) of heated raffinate passed directly into the collection header over a 6-minute period before the valves closed, as pressure within the splitter overheads pipe dropped below their minimum closing set point (37.2 psi (256 kPa) above atmospheric pressure).[56] Hot raffinate flowed into the blowdown drum and stack, and as it filled, some of the fluid started to flow into the ISOM unit sewer system via a 6-inch (15 cm) pipeline at the base of the blowdown drum. As the blowdown drum and stack filled up, hot raffinate shot out of the top of the stack and into the air, forming a 20-foot (6 m) "geyser".[57] The equivalent of a nearly full tanker truck of raffinate rained down on the ground, ran down the side of the blowdown drum and stack, and pooled at the base of the unit.[58] A radio call was received in the control room that hot hydrocarbons were overflowing from the stack.[57] The plant evacuation alarm was not sounded, a fact that prevented people in the vicinities to evacuate before ignition took place.[59][60]
Charred remains of the diesel pick-up truck that ignited the flammable vapors
A diesel pick-up truck, with its engine left idling, had been parked about 25 feet (8 m) from theblowdown stack. The vapor cloud reached the vehicle, and hydrocarbon fumes were drawn into the engine's air intake, causing theengine to race. Nearby workers frantically tried to shut down the engine, without success. The expanding vapor cloud forced the workers who were trying to shut down the overspeeding truck engine to retreat. The cloud continued to spread across the ISOM plant, across the pipe-rack to the west and into the trailer area unimpeded. No emergency alarm sounded, and at approximately 1:20 pm, the vapor cloud was ignited by a backfire, as observed (by nearby witnesses) to be originating from the overheating truck engine.[61]
Destroyed trailers with the blowdown stack in the background
Equipment and piping congestion contributed to accelerate the flame front. This triggered a massivevapor cloud explosion that was heard for miles.[62] The blast pressure wave struck the cluster of contractor trailers located as close as 121 feet (37 m) from the blowdown stack, completely destroying them. The explosion sent debris flying, instantly killing 15 people in the closest trailers and injuring 180 others.[e] Workers in trailers received injuries as far as 480 feet (150 m) from the blowdown drum, with heavy damage reaching some trailers as far as 600 feet (180 m) away. Over 40 trailers were damaged.[41][64] All the fatalities and many of those injured in the accident were contractors.[65] Fifty storage tanks sustained structural damage, although the largest portion of the tank farm was more than 250 feet (76 m) from the explosion.[66] Over 2,750 pounds (1,250 kg) ofbenzene escaped from one of the damaged tanks.[67][68]
An area estimated at 200,000 square feet (19,000 m2) of the refinery was badly burned by the fire that followed the violent explosion, damaging refinery equipment worth millions of dollars.[69] The pressure wave was so powerful it blew out windows offsite up to three-quarters of a mile (1.2 km) away.[67]
The site emergency response team intervened immediately, mounting asearch and rescue operation.[70] An order was issued for theshelter-in-place of 43,000 people.[33]Mutual aid provided by IMAS (Texas City Industrial Mutual Aid System) andMemorial Hermann Life Flight resources were mobilized by 1:45 pm.[67][70][71] The feed to the raffinate splitter was not shut down, but it stopped at 2:45 pm when electrical power went down. Fires were brought under control by 150–200firefighters after two hours. Ambulances and Life Flight stood down by 4:44 pm. The final body was found under a heap of debris at about 11:00 pm.[70][72]
BP's in-house experts as well as various authorities and committees investigated the explosion in relation to technical, organizational, andsafety culture aspects. BP internal investigations included a panel (the Mogford investigation, from the name of the lead investigator) tasked with reconstructing the accident causation chain and conducting a detailedroot-cause analysis,[73] and two other teams (the Bonse and Stanley investigations) who remained focused on underlying procedural and cultural factors as well as managerial accountabilities.[74][75] An independent, high-profile panel (theBaker panel) was commissioned by BP on an urgent recommendation by theU.S. Chemical Safety Board (CSB), to look into management and safety culture issues. The CSB conducted their own detailed and extensive investigation, focused both on technical and procedural aspects.[76][77]
The different panels and investigations found organizational failings including corporate cost-cutting, a failure to invest in the plant infrastructure, a lack of corporate oversight on both safety culture and major accident prevention programs, a focus onoccupational safety as opposed toprocess safety, a defectivemanagement of change process (which allowed the siting of contractor trailers too close to the ISOM process unit), the inadequate training of operators, a lack of competent supervision for start-up operations, poor communication between individuals and departments and the use of outdated and ineffective work procedures which were often not followed. Technical failings included the use of a blowdown drum that was both insufficiently sized and outdated, a lack of preventive maintenance onsafety-critical systems, and inoperative alarms and level sensors in the ISOM process unit.[78]
A team of experts led by John Mogford, the senior BP Group vice president for safety and operations, examined the technical aspects of the explosion and suggested corrective actions. An interim report was issued on May 12, 2005.[79] Reacting to the report, Scott Berger, director of the Center for Chemical Process Safety (CCPS) of theAmerican Institute of Chemical Engineers (AIChE), expressed surprise at the emphasis the report put on individual responsibility by plant operators and supervisors.[80]
On December 9, 2005, BP published the final revision of the Mogford report.[73] It identified four critical factors without which the explosion would not have happened or would have had a lesser impact: "loss of containment; raffinate splitter start-up procedures and application of knowledge and skills; control of work and trailer siting; and design and engineering of the blowdown stack."[81] Furthermore, five critical underlying cultural issues were identified:[82]
"Business context", including a working environment that resisted change and was dominated by lack of motivation, trust and sense of purpose. This was coupled with unclear expectations about management and supervision.
"Safety as a priority", in that management did not give process safety the necessary importance within the business.
"Organizational complexity and capability", in the sense of a lack of clarity in accountabilities and poor communication.
"Inability to see risk", or a tendency to accept high levels of risk due to poor hazard awareness.
"Lack of early warning", or the inability to recognize and action signals revealing plant and procedures deterioration.
The Mogford final report did not, however, find evidence that anyone intentionally made decisions or took actions that put others at risk.[82]
The company also put together a team of BP and external experts for conducting a process and operationalaudit review of the refinery. James W. Stanley, former deputy director of theOccupational Safety and Health Administration (OSHA), was the team leader. The audit focused on processes and operations; incident management, control of work, risk assessment, and compliance assessment; employee andcontractor management; and maintenance, reliability, and integrity. The Stanley report was issued internally on June 15, 2005. It concluded that significant performance and behavior change on the part of senior and extended management would be needed, in spite of well-designed and documented procedures and processes being available and the workforce being generally capable of good performance.[83] Among the issues "preventing the successful execution of some key work processes", the team singled out: leadership factors, including failure to hold people accountable for safety andsilo mentality, among other issues; risk awareness, indicated by complacency and repeated failure to heed recommendations arising from previous accidents; measures for control of work, which was found to be both insufficient and unadhered to; negative workplace conditions, as shown by poorhousekeeping and insufficient plant maintenance; and a contractor management philosophy lacking diversity and inclusion values.[84]
Another internal team was led byWilhelm Bonse-Geuking [de], who was BP Group vice president of Europe. The Bonse team investigated the level of compliance by plant managers with BP's management framework and corporate code of conduct. The final report – which was only released to the public after a court ordered it on May 3, 2007 – identified numerous management failures.[74][85][86] It further noted that management responsibilities within BP Group were unclear, and that the poor state of the plant equipment and the insufficiency of spending on maintenance were contributing factors to the accident.
In sum, the Texas City Refinery had a culture of risk taking coupled with a failure to understand the process safety implications of prior incidents [...], a long tradition of failure to comply with simple procedures, the desire to avoid conflict within its organization, and a penchant for placing persons in key roles who lacked adequate professional training.[87]
The report identified four executives for dismissal: Pat Gower, regional vice president for U.S. refining; Mike Hoffman, group vice president for North American refining and marketing; Texas City complex manager Don Parus; and Willie Willis, Texas City West plant supervisor.[86] As of the date of publication of the report none had actually been sacked.[9][f]
After the March explosion, two more seriousprocess safety incidents occurred at the plant:
On July 28, 2005, ahydrogen gas heat exchanger pipe on theresid hydrotreater unit ruptured, causing a release of hydrogen that erupted into a largejet fire. Fires lasted for about two hours. One person received minor injuries and property damaged amounted to $30 million. The Chemical Safety Board found that a contractor had accidentally swapped alow-alloy steel elbow for acarbon steel pipe elbow during maintenance, causing a failure mode known ashigh-temperature hydrogen attack (HTHA). The CSB found that BP should have required positive materials verification using anX-ray fluorescence test device and maintained or required the contractor to maintain materials identification usingtagging to prevent misplacement of components when reassembling the equipment.[91][92][93]
Both accidents required communityshelter-in-place alerts.[97] Following these events, on August 17, 2005, theU.S. Chemical Safety and Hazard Investigation Board (CSB) issued an urgent recommendation that BP commission an independent panel to investigate the safety culture and management systems at BP North America.[98] Ablue-ribbon panel was assembled, led by former U.S. Secretary of StateJames A. Baker III.[76][99] A figure of this stature and curriculum was specifically selected by BP to publicly show to U.S. opinion-makers that the company was eager to learn the lesson and make strides to change.[100]
The Baker Panel differed from BP's and the CSB's investigations in that it was not charged to conduct a root cause investigation. Its scope was broader, focused on BP's corporate safety oversight, corporate safety culture, and itsprocess safety management systems and included all five BP refineries in the United States.[101]
The Baker Panel report was released on January 16, 2007.[76][102][103] It cited weak safety culture driven by poor process safety leadership and low employee empowerment as underlying causes of the accidents plaguing the refinery. It also highlighted that despite BP's comprehensivesafety management system, this was not sufficiently enforced in their refineries. It also showed that BP's focus in measuring its safety performance relied overwhelmingly on occupational safety indicators to the detriment of process safety performance monitoring.[104][105] It further stressed that worker fatigue and a system that encouragedovertime had detrimental effects on safe plant operation,[106] and that the company had failed to deal with deficiencies arising from known incidents, risk assessments and audits.[107] Implementation ofgood engineering practices was also found lacking.[108]
Additionally, the panel interviewed a number of employees, managers and contractors at all five of BP's U.S. refineries.[109] They also created and administered to the refineries a process safety culture survey.[110] They concluded that theToledo andTexas City plants had the worst process safety culture, while theCherry Point refinery, located inBirch Bay, Washington, had the best process safety culture. The survey results also showed that managers andwhite-collar workers generally had a more positive view of the process safety culture at their plants when compared with the viewpoint ofblue-collar operators and maintenance technicians.[111]
The report made 10 recommendations on various aspects of process safety (leadership; management system; competence; culture; expectations and accountability; leading and laggingperformance indicators; and auditing), as well as on support forline management and industry stewardship.[112]
Given the extent of the disaster the Chemical Safety Board examined both the safety management in the Texas City refinery and the role of the BP Group as well as the role of OSHA as a regulatory body. The CSB investigation team was on site 48 hours after the accident. Some 13 CSB investigators remained onsite for three months. For its investigation, the CSB used a budget of $2.5 million and reviewed more than 30,000 documents, interviewed 370 witnesses, and performed computer modeling and testing. The results of the investigation of the agency were published on March 20, 2007 in a 341-page long report,[77] the most extensive conducted up to that point by the then nine-year-old agency. The report findings were presented on the same day at a public meeting in Texas City.[113][114][115]
Diagram of the blowdown stack of the ISOM plant at BP's Texas City refineryA flare stack, aninherently safer solution to dispose of excess flammable gas
One of the key findings of the CSB was that the blowdown system used at the ISOM unit was antiquated and totally inadequate, being located as it was amid the plant and liable to spew unignited heavy vapors down into normally occupied areas.[116] The CSB found that BP had failed to heed or implement multiple warnings and safety recommendations made before the blast regarding the ISOM blowdown system. Among them were:[117]
In 1991, the Amoco refining planning department proposed eliminating blowdown systems that vented to the atmosphere, but funding for this plan was not included in the budget.
In 1992, OSHA issued a citation to Amoco for unsafe design of a similar blowdown system elsewhere in the refinery. However, Amoco successfully persuaded OSHA to drop this citation by relying on the less-stringent requirements inAPI Recommended Practice 521.[118]
In 1993, the "Amoco Regulatory Cluster Project" proposed eliminating atmospheric blowdown systems, but again, funding was not approved.
Despite Amoco's "Process Safety Standard No. 6", which prohibited new atmospheric blowdown systems and called for the phasing out of existing ones, in 1997, Amoco replaced the 1950s-era blowdown drum/vent stack that served the raffinate splitter tower with an identical system, instead of upgrading to recommended alternatives that were safer.
In 2002, an opportunity to tie the ISOM relief system into the new naphtha desulfurization unitflare system was not taken, due to a US$150,000 incremental cost.
Also in 2002, BP's "Clean Streams Project" proposed converting the blowdown drum to a flare knock-out tank, and routing discharges to a flare. When it was found that a needed relief study of the ISOM system had not been completed due to budget constraints, the Clean Streams decided not to pursue the option.
Between 1994 and 2004, at least eight similar cases occurred in which flammable vapors were emitted by the ISOM blowdown drum/vent stack, of which two resulted in a fire. Yet no corrective action was taken.[119] Furthermore, the blowdown drum was not designed to deal with a vessel overfill. This was not necessarily attributable to Amoco or BP, but rather to a lack of guidance in the API Recommended Practice 521.[118][120][g]
Other design issues included:
The range of the remotelevel instruments at the splitter was too narrow and inadequate for start-up operations.[126]
Additionally, redundant means to assess liquid level for the safe start-up of a distillation column, such as e.g., a bottompressure transmitter, were missing altogether.[127]
Instrumented systems relied decisively on manual operator intervention instead of automatic action. As a consequence, there was no automaticprocess shutdown upon the liquid level in the splitter reaching an assigned high level.[128]
Thehuman–machine interface used in the control rooms was poorly designed, in that it did not show the splitter incoming and outgoing flows on the same screen, nor did it calculate the total liquid in the tower.[129][h]
Several items, most of which safety-critical, were not operational and contributed to the chain of events. In particular, none of the four available level readings and alarms on the splitter worked. The affected instruments were the process control system displacer-type level transmitter, the two independent high- and low-level switches (although the low-level one did not play a role in the accident), and the levelsight glass at the bottom of the splitter tower,[130] as well as theflow transmitter reading the flowrate of heavy raffinate.[131]
The splitter tower mechanical conditions were seen as degraded, so in 2004 the set point of the pressure relief valves was decreased from 70 psi (480 kPa) to approximately 40 psi (280 kPa). If this change had not been implemented, the valves would not have opened on the day of the accident and the explosion would not have occurred, because the static head above them would not have reached the valve set point.[132][133]
The CSB found that organizational and safety deficiencies at all organizational levels of BP contributed to the refinery explosion, such as cost cuts and spending cuts in the safety area, although a large part of the refinery infrastructure and process equipment were in poor condition. In addition, the committee said that BP had cut the budget for training and reduced staff.
Carolyn W. Merritt, chairman and chief executive officer of the CSB, stated that findings about BP's safety culture were similar to those by the Baker Panel,[58] and that "[t]he combination of cost-cutting, production pressures, and failure to invest caused a progressive deterioration of safety at the refinery." She pointed out that, beginning in 2002, BP commissioned several studies through which it became aware of serious safety problems, including insufficient maintenance and training. Merritt highlighted that the studies were shared with key executives in London, but BP's response was inadequate, with the little investment made not addressing the real issues in Texas City. In fact, BP executives challenged their refineries to cut another 25% from their budgets for 2005. In addition, safety improvements between 2002 and 2005 were "largely focused on personal safety—such as slips, trips, falls, and vehicle accidents, rather than on improving safety performance," according to supervisory investigator Don Holmstrom.[103][i]
The CSB also issued a recommendation for theAmerican Petroleum Institute (API) and theUnited Steelworkers (USW, the trade union representing refinery workers) to work together to develop a guideline for understanding, recognizing and dealing with fatigue during shift work, as well as to create performance indicators specific to process safety in the refining and petrochemical industries,[135] since measuring safety purely based on eminently occupational indicators such as lost-time incidents was seen as insufficient in the context of preventing major process accidents.[136] Other recommendations addressed to API were to update Recommended Practice 752 to include guidelines on the safe placement of trailers and temporary buildings in process plants;[137] and to update Recommended Practice 521Guide for Pressure-Relieving and Depressuring Systems[138] to identify overfilling vessels as a potential hazard for evaluation, to mandate sizing disposal drums for credible worst-case liquid relief scenarios, to warn against the use of atmospheric blowdown drums and stacks attached to piping systems receiving flammable discharges from multiple relief valves, and to urge the use of appropriateinherently safer alternatives such as a flare system.[139]
The CSB judged that the Amoco–BP merger had negatively impacted the ability of the organization to deal with process hazards, because organizational changes occurred without getting assessed in terms of their consequences on safety. Therefore, the Board recommended to OSHA that theirProcess Safety Management of Highly Hazardous Chemicals regulation,[140] promulgated in 1992 and usually referred to as Process Safety Management (PSM),[141] should include a requirement for management of organizational changes, in addition to the existing rules on equipment and procedural changes.[142] A complementary recommendation was addressed to the Center for Chemical Process Safety, to the effect of developing guidelines on how to perform organizational management of change reviews.[143]
In the United States, the PSM regulation[140] is the key piece of legislation supporting the safe operation of a process facility handling hazardous materials, like the Texas City refinery (and indeed any refinery or sizeable chemical plant). OSHA is the enforcing agency for the regulation. However, the CSB found that OSHA had as supervising authority failed to carry out planned inspections of the refinery and did not enforce safety rules, although there were many warning signs. The CSB also found that only a limited number of OSHA inspectors received the specialized training and experience necessary for complex investigations in refineries.[144] The report further negatively compared OSHA's available resources with those of other agencies, like the BritishHealth and Safety Executive or theContra Costa County, California hazardous materials programs, that were much more prepared in spite of their smaller scope of oversight.[145]
The refinery also fell under the statutes of theEnvironmental Protection Agency (EPA)'sRisk Management Program (RMP) rule, a process safety management scheme similar to OSHA's. The CSB found that the EPA had not conducted any audits or inspections on RMP compliance since the rule had been promulgated.[146] However, the CSB did not issue recommendations to the EPA. Merritt stated in a Senate hearing that they were unable to do so because the EPA did not share critical information, without which meaningful recommendations could not be formulated.[147]
Property damage from the explosion amounted to $200 million ($322 million in 2024).[148] The explosion caused the shutdown of several units at the refinery. In anticipation ofHurricane Rita later in 2005, the entire refinery was shut down. BP then focused on repairing the damage caused by the explosion as well as the hurricane. Process units restart commenced in March 2006.[149] Costs of repairs and deferred production amounted to over $1 billion.[150] BP pled guilty to federalenvironmental crimes, for which it paid $50 million.[151] The company also paid at least around $2.1 billion in civil settlements.[150] Additionally, BP paid $84.6 million and $27 million in fines to the federal government on OSHA's and theEPA's request, respectively,[152][153][154] and a $50 million fine to the government of Texas for environmental violations.[155] The disaster is the world's costliest refinery accident.[156]
BP initiated a crisis management plan only six hours after the explosion. The following day, a website[157] was set up to publish updates on the accident.[158]Chief Executive LordJohn Browne visited the plant on the day after the explosion.[159] In the months after the accident BP tended to put the blame on its operators and supervisors. Victims and union leaders considered this amounted to simplescapegoating.[160] At this point, the company consistently chose not to publicly apologize for the accident.[161] This changed on May 17, 2005, when Ross Pillari, president of BP Products North America, made a public apology, saying "We regret that our mistakes have caused so much suffering. We apologize to those who were harmed and to the Texas City community” and promising "financial support and compensation" to the injured and the families of the dead.[162]
On December 9, BP said they would put in place a budget of $1 billion to be spent over five years to improve safety at their Texas City refinery.[159][163] BP also said that it would eliminate all blowdown drums/vent stack systems in flammable service, of which there were 11 at Texas City, and install new flares in line with their new policy prohibiting atmospheric venting of-heavier-than-air light hydrocarbons.[9][164][165] They also relocated trailers away from areas where explosions are possible[164][166] and started a trial of an electronicintegrated safe system of work (ISSOW).[164] Group-wide initiatives were also taken.[164]
Not long after the explosion and the other accidents at Texas City in 2005, however, BP's image in the U.S. was further tarnished by the near-sinking of thesemi-submersible oil platformThunder Horse PDQ in July of the same year[167] and, more crucially, in March 2006 whenan oil pipeline spill was discovered inPrudhoe Bay, Alaska, while multiple investigations into the Texas City explosion were still ongoing.[168] CSB chairman Carolyn Merritt said there were striking similarities between the accidents of Texas City and Prudhoe Bay, including "long delays in implementation, administrative documentation of close-out even though remedial actions were not actually taken, or simple non-compliance" as well as "flawed communication oflessons learned, excessive decentralization of safety functions, and high management turnover."[169] A further serious accident occurred at BP Texas City in 2007, when 143 workers at the refinery claimed that they were injured when they inhaled toxic vapors released at the plant.[170] CEO John Browne resigned in 2007 over unrelated issues,[171] although he did not escape criticism for the lax safety culture and the budget cuts at BP's U.S. refineries.[28][172]Tony Hayward took over at the helm of the company. Hayward shifted emphasis from Lord Browne's focus onalternative energy, announcing that safety would be the company's "number one priority".[173] By this time, BP had already taken a markedly apologetic stance over recent accidents, especially Texas City, with their executives and technical experts giving presentations about what went wrong and how they were working to prevent that from happening again.[174] However, only three years later, the 2010Deepwater Horizonexplosion andoil spill occurred, causing a very serious impact on the company on a global scale, again stemming from BP's operations in the U.S. As a result, Hayward resigned, and his role was taken over by American-bornBob Dudley.[175] Under Dudley, BP announced in 2011 that it was selling its Texas City refinery as part of its divestment plan to pay for ongoing compensation claims and remedial activities following theDeepwater Horizon disaster. The sale of the refinery was successfully completed at the start of 2013 toMarathon Petroleum Corporation for US$2.5 billion.[3][176] Marathon already owned the adjoiningGalveston Bay Refinery and in 2018 merged the two sites into one refining complex.[177]
Twocongressional hearings were held specifically on the Texas City disaster. Among those heard were API, Baker Panel, CCPS, CSB, EPA, and USW representatives, as well as victim relatives.[141][178] In other congressional hearings dedicated to subsequent BP accidents in the U.S., the Texas City case history was consistently presented within the pattern of degraded safety culture at BP.[179][180][181][182]
BP was named in lawsuits from the victims' families and the wounded.[183] The case of Eva Rowe, a young woman who lost her parents in the explosion, attracted nationwide attention. Rowe said that she would not accept a settlement from BP and would drag the group to justice.Ed Bradley, a well-known American journalist, made her story known in the television magazine60 Minutes.[184] On November 9, 2006, BP settled the case with Rowe as the last applicant after her lawyers had tried to inviteJohn Browne, BP's chief executive officer at the time of the accident, as witness. The amount of compensation for Eva Rowe remained unknown. BP also paid $32 million to hospitals and education and research institutions nominated by Rowe, including the Mary Kay O'Connor Process Safety Center atTexas A&M University ($12.5 million), theUniversity of Texas Medical Branch in Galveston and its Truman G. Blocker Adult Burn Unit ($12.5 million), theCollege of the Mainland in Texas City ($5 million),St. Jude Children's Research Hospital inMemphis, Tennessee ($1 million), and theHornbeck, Louisiana school system ($1 million).[185][j] Furthermore, BP was forced to publish about seven million pages of internal documents, including the Telos and Bonse reports.[187][188][k] Rowe would later participate in one of the congressional hearings held over the accident.[191]
As of September 2007, BP had settled at least 1,350 of around 3,000 lawsuits related to the accident.[88] By February 2008, about 4,000 claims were filed, of which half had settled, for a total exceeding $1.6 billion.[192] BP also said that they had set aside a further $525 million for other claims.[150] By August 2008 only one of the approximately 4,000 claims remained open.[193]
On February 4, 2008, U.S. district judgeLee Rosenthal heard arguments regarding BP's offer to plead guilty to a federalenvironmental crime for two violations of theClean Air Act (CAA)[194] with a $50 million fine. At the hearing, blast victims and their relatives objected to the plea, calling the proposed fine "trivial".[195] However, the plea was eventually agreed, together with a three-year probation period for BP.[151] This was the first and, for several years, remained the only federalconviction for an accidental chemical release under the CAA.[196]
In September 2005, the Occupational Safety and Health Administration, which in the CSB report would be found lacking in oversight and competency,[l] gave BP a record $21 million fine for committing 301 violations of the Process Safety Management rule.[29][198][199] In October 2009, OSHA imposed a fine of $87 million, which shattered its 2005 record, after claiming that BP had failed to implement safety improvements following the disaster and noting that four further fatal accidents occurred in the refinery since the previous fine. In its new report, OSHA cited 709 safety violations.[200][201] BP announced that it would challenge the fine.[202] On August 12, 2010, BP announced that it had agreed to pay $50.6 million of the 2009 fine, while continuing to contest the remaining $30.7 million (the fine had been reduced by $6.1 million between when it was levied and when BP paid the first part).[203] In July 2012 OSHA and BP agreed that the outstanding $30.7 million would be reduced to $13 million, which BP paid.[152]
Following the explosion, theU.S. Environmental Protection Agency inspected the refinery for compliance with the Clean Air Act (CAA) and found BP in violation of the CAA as well as itsRisk Management Program (RMP) rule.[204] Most of the violations were not directly related to the explosion but rather to other events, like the two later accidents in 2005. A first fine of $12 million was imposed on BP by the EPA in February 2009. This settlement also included BP's agreement to spend nearly $170 million to improve its environmental performance, with over $150 million dedicated to management ofbenzene emissions and the remainder addressingchlorofluorocarbons andasbestos.[154] In September 2010, the EPA and BP agreed on a settlement of $15 million on additional counts of violation.[94] This was both the largest civil penalty recovered for CAA violations at an individual facility and the largest ever for civil violations of the RMP.[153][205]
At the request of theTexas Commission on Environmental Quality (TCEQ), theTexas Attorney General opened proceedings against BP for violations of theTexas Health and Safety Code[206] andTexas Water Code,[207] including the release of hydrocarbons through the blowdown stack on March 23, 2005, the prolonged release of benzene from a tank damaged in the explosion, which lasted more than 25 days, and tens of other events.[68] In a 2011 settlement, BP agreed to pay a $50 million fine covering 72 other emissions in excess of BP's operating permits. This included legal costs of $500,000. In return, the Justice Department agreed not to allow additional criminal charges against BP in connection with the refinery explosion.[155][208]
The disaster had a notable impact in the domain ofprocess safety. Texas City has become a classic case history used to explain failings in both management and technical barriers in process plants.[99][209][210][211][212]
The Baker Panel report became well known among process safety engineers, who felt its findings were relevant to other plants and it was important for strengthening process safety awareness in the chemical process industry.[213] This fulfilled the Panel's wish as stated in the report:
Although we necessarily direct our report to BP, we intend it for a broader audience. We are under no illusion that deficiencies in process safety culture, management, or corporate oversight are limited to BP. Other companies and their stakeholders can benefit from our work. We urge these companies to regularly and thoroughly evaluate their safety culture, the performance of their process safety management systems, and their corporate safety oversight for possible improvements. We also urge the same companies to review carefully our findings and recommendations for application to their situations.[214]
Analysis of weak implementation of process safety management
The accident has been extensively analyzed in the specialized literature, which highlighted how several elements of process safety management (PSM) were implemented weakly and poorly managed. Observations made on PSM elements as defined in OSHA's rule[140] include:
Employee participation: The refinery suffered from workers' fear of punishment from reporting incidents or hazards.[215]
Operating procedures: Deviations from key procedures like the start-up of the ISOM plant had become routine. Additionally, the same start-up procedure lacked sufficient instructions.[50][216][217]
Training: Training for key plant operators was largely insufficient, especially regarding abnormal situation management and verification of operator knowledge and qualifications.[50]
Contractors:Management of contractors disregarded important safety aspects. As an example, those occupying trailers in proximity to the ISOM plant were not told of the start-up.[217][218] All the fatalities and many of those injured in the accident were contractors.[65]
Mechanical integrity: Multiple instruments and valves were not operational, because they had not been tested or maintained.[50][216]
Management of change: This failed in multiple respects, namely the changes to the unit start-up procedure that required the operators to work the splitter above a safe level,[50] the lacking or incomplete MOCs for the placement of trailers in the vicinity of a highly hazardous unit,[216][217] and the lack of a formal change process assessing the elimination of critical operator positions to manage the ISOM plant.[219]
Incident investigation: Learning from past incidents and near misses was impaired by the near absence of internal investigations and the consequent spreading of usefullessons learned.[216]
Emergency planning and response: The evacuation alarm was not sounded, and this may have contributed to the number of fatalities, since the contractors in the trailers did not have a chance to leave the area.[217]
Complianceaudits: Audits were conducted but, by BP's own admission, "[audit] action items did not appear to be tracked and effectively closed."[220]
Additional elements of process safety are defined in the Center for Chemical Process Safety's (CCPS) PSM scheme,[221] and the refinery was also lacking in some of these:
Measurement and metrics: Metrics for safety performance management were focused only on occupational accidents. This contributed to give a distorted picture of the health of safety management, since no performance indicators were used to assess the impact of past and the possibility of future process accidents in connection with critical losses of containment of hazardous materials.[216]
Other essential safety practices that failed included:
Control of ignition sources also failed, as demonstrated by the laxness in managing vehicle access in close proximity to live hydrocarbon process equipment.[41][216][217]
API actioned the recommendations from the CSB's report, thus creating new standards and guidelines for the industry:
Standard 521: API issued a new revision of its document onPressure-relieving and Depressuring Systems and upgraded its status from Recommended Practice to Standard. The new standard had more stringent requirements on the atmospheric venting of process gas and an instruction to include overfilling from upstream equipment among the design cases of blowdown systems.[226][227]
Recommended Practice 753: API issued new guidance on the location of trailers and portable buildings within hazardous process sites. The scope of Recommended Practice 752 was reduced to permanent buildings only starting with the third edition.[228][229][230]
Recommended Practice 754: API addressed the need for process safety performance indicators in this new Recommended Practice onProcess Safety Performance Indicators for the Refining and Petrochemical Industries.[231][232] In general, in the wake of Texas City, awareness of the difference between occupational and process safety became more widespread in light of the investigations' findings.[233][m]
Recommended Practice 755: This new guideline was directed to refineries and petrochemical plants and detailed how to put in place a fatigue risk management system (FRMS). This document includes recommendations for work on rotating shifts, for the maximum acceptable number of overtime hours and the number of days to be worked on without interruption.[236][237][238]
The CCPS published an extensive guideline on organizational management of change to address another related recommendation from the CSB report.[239][240]
After being singled out for lack of initiative and competency in assessing and inspecting large hazardous process plants, and refineries in particular, OSHA took action, initiating a refinery Process Safety Management National Emphasis Program (NEP) and enforcing a dedicated inspection audit program between 2007 and 2011. This was the most significant PSM enforcement action since the regulation[140] was issued in 1992.[241]
OSHA also issued an internal memorandum[242] to address the CSB's recommendation on updating the PSM regulation to include requirements for hazardous process facilities to extend their management-of-change procedures to capture organizational changes. However, the CSB did not deem this initiative sufficient to close the recommendation, which, as of January 2024[ref], was still open.[240][243]
^Although it did not prove of relevance on the occasion of the accident, discharging flammable liquids into a sewer system was an unsafe practice.[35]
^The CSB later found that API 752 was not adequate for the assessment of temporary building and trailers.[37][41][42]
^The need for two operators, especially for dealing with potential plant upsets, had been highlighted in several reports since before the Amoco–BP merger.[50]
^Ironically, the contractors working in the trailers closest to the explosion had just returned from a lunch organized to celebrate one month without lost-time injury[63]
^Parus was put on "indefinite" leave by BP in May 2005 and remained on their payroll as of September 2007.[88] It transpired that, prior to the March 2005 explosion, he had tried to highlight the poor safety conditions of the plant to his higher management and asked to stop budget cuts. He even showedJohn Manzoni, BP head of refining and marketing, a presentation titled "Texas City Is Not a Safe Place to Work"[89] with photographs of workers that lost their life on the job at the refinery. Parus was the manager that commissioned the Telos Report.[21][90]
^Flare systems are both more inherently safe and environmentally sound than blowdown stacks: Safer because they significantly reduce the risk of having heavier-than-air flammable gas clouds migrating into the plant[121] and they eliminate toxic gases likehydrogen sulfide and other noxious substances likevolatile organic compounds;[122][123] more environmentally sound because they convertmethane tocarbon dioxide, which is a comparatively milder (albeit still potent)greenhouse gas.[124][125] It is true, however, that in the specific scenario occurred at Texas City, unless the flare knock-out drum (a pressure vessel separating and disposing of excess liquid) were to be designed to cope with liquid overfills from upstream equipment, the mere use of a flare would not have prevented an accident from happening, as CSB investigator Don Holmstrom stated.[78] Nevertheless, the consequences would have most likely been more limited. A liquid slug large enough to overcome an undersized knock-out drum and climb to the flare tip would likely get ignited on exiting the stack, which would result in liquid fires raining down from the flare stack and pooling around it. A flare stack has to be placed away from manned areas due to the highthermal radiation from the flame the flare generates in case of plant upset scenarios (although not specifically for upsets where liquids are ingested by the flare); this arrangement would have caused anypool fire to occur in a safe area, empty of people and hazardous equipment.[7]
^An additional design flaw pointed out elsewhere was that the pressure relief valves should not have been placed so far below the top of the tower. This made them liable to be opened by the static head of liquid in case of column overfilling or liquid carry-over, a scenario that in fact materialized and resulted in overwhelming the blowdown drum, which was not designed to receive such a huge inflow of liquids. This scenario had never been considered in ahazard and operability study (HAZOP).[54]
^Rowe's parents were from this town in Louisiana.[186]
^Some of the documents caused a certain embarrassment to BP. For example, some saw an e-mail written on the day of the accident by BP America public relations chief Patricia Wright as very cynical. The e-mail stated that "follow up coverage [...] will essentially go away – due to the holiday weekend. This is a very big story in the U.S. right now – but theTerry Schiavo story is huge as well."[189][190]
^AdmiralFrank Bowman, a member of the Baker Panel, stated in a congressional hearing, "If [OSHA] can find 300 serious violations after the explosion, it would seem to me that preemptively finding those violations may have prevented this tragedy, and I think that that is one of the main root causes of why we are here today."[197]
^As a further example, the Texas City explosion was among the factors that led the British regulator to issue guidance on process safety metrics and setting a goal that by the end of 2015 process plants liable to major accidents will have to gauge their safety performance using key lagging and leading performance indicators.[234][235]
^Pradhan, Samir Ranjan (2008).India, GCC, and the Global Energy Regime: Exploring Interdependence and Outlook for Collaboration. New Delhi, India:Academic Foundation. p. 375.ISBN978-81-7188-633-3.
^Fahim, Mohamed A.; Alsahhaf, Taher A.; Elkilani, Amal (2010).Fundamentals of Petroleum Refining. Kidlington, England and Amsterdam, The Netherlands:Elsevier. p. 4.ISBN978-0-444-52785-1.
^API (May 1995).Management of Hazards Associated with Location of Process Plant Buildings. API Recommended Practice 752 (1st ed.). Washington, D.C.:American Petroleum Institute.
^abcHolmstrom, Don; Altamirano, Francisco; Banks, Johnnie; Joseph, Giby; Kaszniak, Mark; Mackenzie, Cheryl; Shroff, Reepa; Cohen, Hillary; Wallace, Stephen (September 8, 2006). "CSB Investigation of the Explosions and Fire at the BP Texas City Refinery on March 23, 2005".Process Safety Progress.25 (4):345–349.doi:10.1002/prs.10158.eISSN1547-5913.ISSN1066-8527.
^abState of Texas v. BP Products North America Inc. (District Court of Travis County, Texas – 201st Judicial District June 23, 2009),Text,archived from the original.
^abSanders, Roy E. (2015).Chemical Process Safety: Learning from Case Histories (4th ed.). Kidlington, England and Waltham, Mass.:Butterworth-Heinemann. pp. 99–112.ISBN978-0-12-801425-7.
^abAPI (November 1990).Guide for Pressure-Relieving and Depressuring Systems. API Recommended Practice 521 (3rd ed.). Washington, D.C.:American Petroleum Institute.
^API (March 1997).Guide for Pressure-Relieving and Depressuring Systems. API Recommended Practice 521 (4th ed.). Washington, D.C.:American Petroleum Institute.
^abState of Texas v. BP Products North America Inc. (District Court of Travis County, Texas – 201st Judicial District March 11, 2011),Text, archived fromthe original.
^Kidwell, Hugh (February 28, 2006)."Thunder Horse Back on Course".Offshore Technology.Archived from the original on January 23, 2024. RetrievedJanuary 23, 2024.
^Water Code(PDF) (Code).Texas Legislature. 2023."Archived copy"(PDF). Archived from the original on January 24, 2024. RetrievedJanuary 24, 2024.{{cite web}}: CS1 maint: archived copy as title (link) CS1 maint: bot: original URL status unknown (link)
^Pike, Howard (April 6, 2017). "Learning from the Experience". In Khan, Faisal (ed.).Methods in Chemical Process Safety. Vol. 1. Cambridge, Mass.; San Diego, Cal.; Kidlington, England; and London, England:Academic Press. pp. 57–73.ISBN978-0-12-811547-3.
^API (June 2007).Management of Hazards Associated with Location of Process Plant Portable Buildings. API Recommended Practice 753 (1st ed.). Washington, D.C.:American Petroleum Institute.
^API (December 2009).Management of Hazards Associated with Location of Process Plant Permanent Buildings. API Recommended Practice 752 (3rd ed.). Washington, D.C.:American Petroleum Institute.
^Talbot, Paul (2009). "Facility Siting and Portable Buildings".Loss Control Newsletter. No. 2.Marsh. pp. 21–24.
^API (April 2010).Process Safety Performance Indicators for the Refining and Petrochemical Industries. ANSI/API Recommended Practice 754 (1st ed.). Washington, D.C.:American Petroleum Institute.
^Khan, Faisal; Hashemi, Seyed J. (April 6, 2017). "Introduction". In Khan, Faisal (ed.).Methods in Chemical Process Safety. Vol. 1. Cambridge, Mass.; San Diego, Cal.; Kidlington, England; and London, England:Academic Press. pp. 1–36.ISBN978-0-12-811547-3.
^API (April 2010).Fatigue Risk Management Systems for Personnel in the Refining and Petrochemical Industries. ANSI/API Recommended Practice 755 (1st ed.). Washington, D.C.:American Petroleum Institute.
^Pasman, Hans (2015).Risk Analysis and Control for Industrial Processes – Gas, Oil and Chemicals. Kidlington, England and Waltham, Mass.:Butterworth-Heinemann. p. 246.ISBN978-0-12-800057-1.
Maresh, Michelle; Williams, David E. (2010). "Oil Industry Crisis Communication". In Coombs, W. Timothy; Holladay, Sherry J. (eds.).The Handbook of Crisis Communication. Hoboken, N.J.:Wiley-Blackwell. pp. 285–300.ISBN978-1-4051-9441-9.
Thomson, J.R. (2015).High Integrity Systems and Safety Management in Hazardous Industries. Kidlington, England and Waltham, Mass.:Butterworth-Heinemann.ISBN978-0-12-801996-2.
Abílio Ramos, Marilia; López Droguett, Enrique; Mosleh, Ali; das Chagas Moura, Márcio; Ramos Martins, Marcelo (August 18, 2017). "Revisiting Past Refinery Accidents from a Human Reliability Analysis Perspective: The BP Texas City and the Chevron Richmond Accidents".The Canadian Journal of Chemical Engineering.95 (12):2293–2305.doi:10.1002/cjce.22996.eISSN1939-019X.ISSN0008-4034.
Remember the 15 (archived on March 12, 2008) – Memorial site for those lost in the explosion
Texas City Explosion – Webpage managed by Brent Coon & Associates, lead counsel in the litigation following the blast. Hosts a wealth of evidence used in the case.