3,700 Alarms!
Stephen Maddox
I help engineers improve situation awareness in the control room so operators perform at the highest level when all hell breaks loose.
The CSB reports the fatal naphtha release and fire on Sept 20th (2022) at the “BP Toledo Refinery” in Ohio was a result of several abnormal situaitons which resulted in the death of two BP employees, who were brothers.
During an emergency situation at the refinery, liquid naphtha was released from a pressurized vessel, which resulted in a vapor cloud that subsequently ignited, causing a flash fire, which fatally injured the two BP employees and cost the company $597 million in property damage.
Thousands of pounds of naphtha was released during the incident.?This is the largest fatal incident at a BP-operated petroleum refinery in the United States since the fatal explosions and fires at the BP refinery in Texas City, Texas, in 2005, that resulted in the deaths of 15 workers and injured 180 other people. The CSB’s report details a series of cascading events that contributed to the release and fire.
There was an “alarm flood”, with more than 3,700 alarms going off in the 12-hour period prior to the fatal incident, which overwhelmed and distracted BP’s board operators, causing delays and errors in responding to critical alarms. The CSB also found that the refinery failed to implement a shutdown in time to prevent the fatal incident.
A process upset in the naphtha hydrotreater unit led to liquid naphtha flowing to – and filling up -- a pressurized vessel, which normally contained only vapor. The vessel then overflowed into vapor piping, intended for downstream furnaces and boilers. Due to the abnormal state, several BP employees were directed to drain the liquid. Shortly thereafter, two of the employees released the liquid to the ground by opening the vessel, which subsequently created the vapor cloud that ignited, resulting in the fire that fatally injured the two employees.
The CSB’s report concluded that the two employees who opened the vessel may have believed that the liquid was an amine-water solution, not naphtha. CSB Chairperson Steve Owens said, “Nearly everything that could go wrong did go wrong during this incident. The tragic loss of life resulting from this fire underscores the importance of putting in place the tools that employees need to perform tasks safely, such as stop work authority, and having adequate policies, procedures, and safeguards in place to effectively manage highly stressful abnormal situations, including alarm floods.”
The CSB’s final report identifies several critical safety issues that contributed to the catastrophic outcome:
Liquid Overflow Prevention: The refinery's process hazard analyses (PHAs) identified potential risks, including overflow events. However, the safeguards in place, such as safety instrumented systems and emergency pressure-relief valves, did not prevent liquid overflow into the fuel gas system. The high level in the vessel led to the subsequent release of naphtha, vapor cloud formation, and fire.
领英推荐
Abnormal Situation Management: The BP Toledo Refinery experienced several abnormal situations across several units, escalating to overfilling multiple vessels. This prompted two BP employees to release the vessel’s contents to the ground, ultimately cascading to the vapor cloud, fire, and fatal injuries.
Alarm Flood: Board operators were dealing with an alarm flood for nearly 12 hours before the incident occurred, with 3,712 alarms going off during this period. Excessive alarms contributed to delays and errors in response and mitigation of the overflow of naphtha into the fuel gas system.
Warning Signs: The CSB found that a previous incident at the BP Toledo Refinery had occurred and the BP Toledo Refinery investigation team identified catastrophic incident warning signs during the investigation but did not develop action items to prevent naphtha from filling the vessel, resulting in a missed opportunity to improve safety and prevent another incident.
The CSB is issuing a total of seven safety recommendations to address an existing safety gap.
The CSB did not make any recommendations to BP, since BP no longer operates the Toledo Refinery.
We are hosting a conference in September to help educate industrial companies on the best practices required to manage abnormal sitations. Email me [email protected] or visit: www.mycontrolroom.com
Written procedures are often to complex, long, spreaded out in various documents leading to be finally ignored or at least not used by those who should use them. Management often does not understand that procedures needs to be short, handy at any time for anybody and understandable. Therefore existing documents must be shrinked not further inflated. It is the typical situation, that everybody would sign up for this (like politicians when they say they want to lower bureaucracy), but at the end Management doesn′t put the resources and time to simply do it.... Maybe they think with tons of documents they are "covered" legally for every case/accident and maybe this is the case. Unfortuneatly it can be the contrary in reality....
LDAR
4 个月This was in my backyard and I went to go with Ben and his brother my heart breaks seeing this article
Refinery Technician at Ampol Australia
5 个月The constant unnecessary alarm sound just leads to increased stress from excess stimuli, more difficult radio communications all while trying to process what needs immediate attention and focus. Add to that during a start up there is always a big push from people not in the room to hurry up or question why something is behind a desired timeline. It takes as long as it takes to do it safely and to the level and capability of the staff rostered on that day. Reading this I also wonder if the outside ops that drained the vessel were wearing gas badges? I can’t imagaine they would have been or they would have closed the drain valve off.
Global Process Optimisation Business Leader
5 个月Often people forget the 7+-2 rule, in which a person can only remember about 7 pieces of information at a time. I have actually tested this in various user centred workshops, and it is true. Also the more you push someone beyond 7 they actually start remembering less!!!! So bringing it back to alarms, for each alarm think about what the steps are to clarify and then reduce resolve each... Often due to ignorance about the challenge facing an operator alarms are an afterthought, and then huge number of graphics and other steps to validate and resolve can often be even worse that 3,700. We end up giving our operators an impossible job... Except for those rare few who have worked at the asset for decades and know it back the front, but you cannot rely on that!
Oil & Gas Professional
5 个月Excellent share and comments. I made an observation coming from an old pneumatic operating system and transitioning into DCS and ACS control: - in the pneumatic era, operators relied on trending data and “gut” logic - sounds, sights & feel. This created proactive operators that took action as trends deviated and alarm response was a lot less and a lot less critical. - with the introduction of advanced control systems (DCS, ACS, SCADA), operators began to rely on alarms’ notifications. This then shifted operators from being proactive to becoming reactive. As an anology: prior to mobile phones advancements, we remembered numerous phone numbers. Now, if we know a handful, we know a lot. This doesn’t offer a solution as much as an insight into another possibility to explore.