23 Apr For paper 3, you will analyze the ethical or unethical nature of a specific engineering issue by identifying problems in the situation and using an engineering co

,

British Petroleum Texas City Refinery Explosion Comment by Ed: GRADE: A This paper does a good job of focusing on what caused the event and how communication allowed it to happen. The discussion of ethics is good and detailed. There are some minor issues with language, and the history contains some irrelevant information.

Abstract

It is a requirement of all engineers to follow the Engineering Code of Ethics in order to protect the citizens they serve.  On March 23, 2005, the Texas City British Petroleum (BP) refinery malfunctioned resulting in the death of 15 individuals and the injury of another 180.  The failure to communicate between management and operators, to test and maintain equipment, and, most importantly, to put safety over production led to 15 deaths and the loss of over 1.5 billion dollars in production.  This report will characterize in detail the safety failures leading up to the explosion by reviewing two investigation reports, the US Chemical Safety Board Report and the Bonse Report, and by comparing the actions of all workers to the code of ethics.  After reviewing these investigation reports, it was concluded that if the Engineering Code of Ethics had been followed by the management and engineers, this devastating disaster could have been prevented. This would have saved billions of dollars and, most importantly, human life.    Comment by Ed: which one? Comment by Ed: malfunctioned, resulting… Comment by Ed: odd word choice

Introduction

The British Petroleum (BP) refinery located in Texas City, Texas, suffered a major explosion on March 23, 2005. It has been declared one of the worst industrial disasters in the history of the United States, leaving 15 people dead and an additional 180 people injured. The financial loss of the explosion totaled over $1.5 billion, as the damage from the explosion stretched over a three-quarter mile radius from where the explosion was initiated. The severity of this explosion led to the investigation of the BP refinery by the United States Chemical Safety and Hazard Investigation Board (CSB), the United States Environmental Protection Agency (EPA), the Occupational Safety and Health Administration (OSHA), and the Texas Commission of Environmental Quality (TCEQ). By studying company documents and conducting interviews, these organizations found that several different issues were at fault and contributed to the explosion. For example, the isomerization unit was in disrepair, the startup safety procedure was neglected, and the safety alarms were unreliable. In fact, the majority of the refinery equipment was outdated and unsafe. Besides the many technical issues that contributed to the explosion, there were also several organizational issues present within BP. OSHA discovered that the BP employees responsible for operating the isomerization unit were consistently overworked, that there was poor communication between operations staff, and that management was not adequately enforcing safety precautions. There had also been several accidental releases of hazardous material from the isomerization unit that went overlooked, as well as a 50% budget cut that left the infrastructure of the refinery in poor condition in the 6 years prior to the explosion. Due to the shortage of funds, the BP management had a “run to failure” mentality pertaining to the refinery equipment. According to company documentation, personnel within BP were not only aware of these problems, but were also aware that they could turn catastrophic, yet they did not take preventative action. Considering all the issues surrounding the BP refinery equipment and personnel, it is apparent that BP left itself vulnerable to disaster. In order to fully understand the BP refinery explosion and its causes, it is necessary to be familiar with the history of BP leading up to the explosion, the technical issues that BP was experiencing at the time of the explosion, and the ethical controversy that was present preceding the explosion. Comment by Ed: issues were at fault? Comment by Ed: omit comma

History

Anglo-Persian Oil Company (APOC) was an oil company that was founded in 1908 by a group of British geologists that discovered a large oil reservoir in Iran. When the company began, the British and the Persians had equal control, but in 1913 it came under a British majority. In 1915, APOC started another business called the British Tanker Company, which acquired the British Petroleum Company in 1916. After World War I, the British Petroleum Company started expanding rapidly, acquiring land fields all over the world. The expansion of the British Petroleum Company started with refineries in Scotland, Wales, and Britain. They later acquired refineries from France and built an additional refinery in Australia. In 1923, Britain obtained exclusive rights for APOC to control all oil fields inside of Persia, and in 1932, APOC and another company, by the name of Royal Dutch Shell, started a joint marketing company called Shell-Mex and BP. These two companies separated in 1998 to form the current day Texas City location of BP as shown in Figure 1 below (“History,” n.d.).   Comment by Ed: I don’t see how this is important enough to include. The second paragraph is much more relevant.

Figure 1. Timeline of the History of the Texas City Refinery

Out of all the operational refineries owned by BP in the world, the Texas City refinery is the largest.  Before the March 23, 2005 explosion, the refinery produced around 10 million gallons of gas every day along with other fuels such as jet and diesel fuels.  In addition, the Texas City refinery employed close to 1,800 workers and hundreds of contractors when at full capacity before the explosion.  The Texas City refinery was, therefore, a very large and important economic driver for Texas and the United States (“CSB,” 2007, p. 31).

Technical Description

On March 23, 2005, an explosion at BP’s Texas City refinery killed 15 people and injured more than 180 people.  The events that led up to the explosion consisted of both safety device and operator failure.  The major components of failure in the refinery were components of the splitter tower and the blowdown drum, which are shown below in Figure 2. Comment by Ed: Safety device is an event? Comment by Ed: omit

Figure 2. Splitter Tower and Blowdown Drum (“CSB,” 2005, p.34)

At 2:00 am, operators started up the isomerization (ISOM) unit of the refinery for the first time after being shut down a month for maintenance.  This process began by sending raffinate, a flammable hydrocarbon, into the splitter tower at the refinery, which separates the light and heavy components of the raffinate.  The splitter tower normally holds around six feet of hydrocarbon liquid, and a level indicator reads the total liquid present and sends it to the operating room for the workers to interpret.  The level indicator, however, was not designed to read levels over 10 feet.  At 3:30 am the liquid in the tower reached around 8 feet, and an alarm sounded in the operator room. A second alarm later did not sound due to the failure of the level indicator, and the liquid reached an estimated 13 feet by the US Chemical Safety Board (CSB) even though the level displayed around 9 feet to the operators (“CSB,” 2007, p. 43).  At 9:50 am, operators began sending more liquid into the splitter tower, but no liquid was leaving the tower because a valve usually opened by an operator was left closed (“BP Texas City,” 2007). Comment by Ed: for a month

Continuing the routine process of normal operations at 10:00 am, the furnace was started, which began sending heated hydrocarbon liquid into the splitter tower.  Unknown to the operators, the tower was quickly filling with liquid even though the level indicator showed less than 10 feet and dropping at 12:40 pm. It was later estimated by the CSB that the liquid raffinate reached a height of 138 feet (“CSB,” 2007, p. 43).

At 12:40 pm, a high pressure alarm sounded because of the pressure leaving the top of the splitter tower, and two burners were turned off to lower the temperature in the tower.  The valves controlling the pressure malfunctioned, so a manual valve was opened by an operator to redirect gas into the blowdown drum.  At 1:00 pm, a valve to send liquid from the bottom of the splitter tower to a storage tank was opened, which reduced the level of liquid in the tower initially.  The liquid at the bottom of the tower, however, was extremely hot, so when going through the heat exchanger, the liquid going into the tower was increased by an estimated 150 degrees (“BP Texas City,” 2005).  At 1:05 pm, the hydrocarbon liquid flowing into the splitter tower started to boil due to the increased temperature from the incoming rafinate, causing the liquid in the tower to quickly rise and begin overflowing into the pipe at the top of the tower (“CSB,” 2007, p. 43).

By 1:14 pm, the pressure-release valves at the bottom of the tower were opened, which directed the liquid into the blowdown drum.  A sensor at the bottom of the drum failed to sound an alarm to the operators that liquid was at the bottom of the drum.  The blowdown drum proceeded to completely fill with flammable liquid and began to spew liquid from the top of the drum for around one minute.  Once the liquid began falling, it changed phases into a flammable gas, which spread over a large majority of the refinery.  At 1:20 pm, the vapor cloud was ignited, setting off a sequence of explosions.  It was determined that the vapor cloud was most likely ignited by a diesel truck at the refinery (“CSB,” 2007, p. 43).  

Safety Issues

Before the explosion occurred, there was an abundance of safety issues that were present at the Texas City BP refinery. The main underlying issues were: a work environment that promoted the deviation from the safety procedure, a lack of effective communication, a malfunctioning instrumentation that did not alert the operators, a poorly designed control system, a lack of supervising and technical assistance, an understaffed refinery, a lack of concern for employee fatigue, a habitat of rushed operator training, and a failure to establish operating limits (“CSB,” 2007, p. 71-72).

The problems existing at the Texas City refinery arose because the management did not place enough importance on the safety regulations. They would allow the operators to skip certain safety measures in order to speed up the startup process. Also, the management did not keep the documentation of safety procedures up to date with evolving technological improvements.  In addition, one of the main issues with the startup procedure that went unaddressed was that operators noticed large changes in the tower liquid level, which had the potential to damage some of the components inside of the raffinate splitter. Another issue present was that management would allow operators to change the current start-up procedure at the last minute without going through a proper safety analysis of the new procedure. Because of the lack of documentation of the safety procedure and the fact that the operators were allowed to change the procedure whenever they chose, there was not a standardized procedure in place. This made it challenging for new operators to learn the process because every operator had his or her own start up procedure.  

The refinery had gone through 19 different startup procedures from the year 2000 until the explosion occurred. Management changed this procedure so often because in 18 prior operations, the liquid levels in the towers had risen above the recommended threshold of 50%. The BP official safety regulations stated that the valve responsible for sending the liquid raffinate to the storage tank must remain turned to the automatic position, which was not done in the majority of the procedures. Even though these occurrences of high liquid levels were well known within the company, none of the equipment was inspected for damage due to the increased levels, nor was there an improved standard procedure established for the operators to prevent the varying liquid levels. Furthermore, the tower pressure alarms would trigger often, but would be ignored. There was also nothing updated in the safety procedure about how the operators should handle this problem. The control board computer records showed that 14 of the startups that displayed heavy swaying triggered the high level pressure alarm sounding a total of 74 times. The other 4 start-ups that had heavy swaying only triggered the low level alarms, which were triggered a total of 9 times (“CSB,” 2007, p. 285).

The reason the safety procedure stated that the valve controlling the liquid raffinate must be set at automatic was because once the alarms would trigger, this valve would shut down production until the pressure levels fell below the threshold. Instead, the operators would leave the valve controls set to manual and attempt to control the sways themselves. Additional records from the control board computer showed that during the 18 prior start-ups, over 50 hours of production was completed while the high level pressure alarm sounded. The alarm, however, was only displayed on the control board computer; therefore, the operators were completely unaware of operating within the dangerous pressure levels. If the operators had kept the valve control on automatic, they would have been aware of the dangerously high pressure levels they were working under.

A safety expert by the name of Trevor Kletz once said, “To say accidents are due to human failing is like saying falls are due to gravity. It is true but it does not help us prevent them” (“CSB,” 2007, p. 71). By not following and updating the regular safety procedures, unsafe operating conditions were produced that led to the Texas City BP refinery explosion. Comment by Ed: Safety expert Trevor Kletz once said…

Organizational Issues

There were two major organizational issues that resulted in miscommunications between the employees at the BP Texas oil refinery prior to the explosion of 2005. The first issue with organization was that the management of the refinery did not provide the operators with set instructions on how to route the flammable raffinate through the splitter tower. The other frequent miscommunication that occurred was that the night shift operators would not convey to the day shift workers how much raffinate was already in the tower and vice versa. There was a logbook that the operators were supposed to use to record the state of the raffinate, but BP management did not enforce these actions. On the day of the explosion, the night shift operator had attempted to record the raffinate levels in the logbook, but due to lack of training and experience created by the nonexistent enforcement from management, it was unclear what procedures the night shift operators had completed. This led to confusion for the day shift operators as they did not know where to continue with the operation. As a result, the start-up procedure was relayed to the board control operator over the phone by the lead operator. The lead operator, however, was busy with other tasks and provided the control operator with no help on starting the raffinate splitter. Also, due to the fact that the lead operator was preoccupied, his communication was rushed and vague. The board operator was under the assumption that he should send all the liquid raffinate to the overflow tank because the main tanks were full. In contrast, the lead operator thought he had made it clear that the light raffinate tanks should not be sent to the normal tank and should be mixed with heavy raffinate since the light raffinate tanks were full. Controversially, it was noted in the logbook that the heavy raffinate tank was almost full. If BP had been more organized and consistent about their documentation, these miscommunications would not have occurred. Comment by Ed: wrong word

Ethical Communication

According to the reports from the investigation that took place after the Texas City refinery explosion, there were many incidents where the known dangers of the plant had been communicated. The problems with communication occurred between many levels, beginning with the plant operators and reaching as high as top of BP management in the U.S. There are two reports that discuss in great detail communication that occurred prior to the disaster. These reports are the Texas City Isomerization Explosion Final Report, or the “Bonse Report,” and the CSB, or the U.S. Chemical Safety and Hazard Investigation Board, final investigation report. There were also a number of personal communication documents provided by engineers working for BP. This section will focus on the ethics of their communication and use the code of ethics set by the National Society of Professional Engineers, which is shown below in Figure 3. Comment by Ed: the top of BP…

Figure 3. Engineering Code of Ethics. (“NSPE,” 2007)

The CSB final investigation report, a 341 page document, covers the incident (“CSB”, 2007). It includes some information on the level of communication that took place before the incident, but the communication was not the main focus of the document. After reviewing emails and documentation, the report concluded that there was little communication that occurred between operators and supervisors. It also concluded that crucial safety accidents had been left out of compiled reports. The report determined that there was a “lack of a BP policy or emphasis on effective communication for shift change and hazardous operations [such as unit startup].” In a 2004 risk assessment, it was recommended that improvements were needed in HSSE (health, safety, security, and environment), but it left out the multiple work related deaths that had occurred earlier that year (“CSB”, 2007, p.149).

These findings in the CSB report conflict with the Engineering Code of Ethics established by the National Society of Professional Engineers (“NSPE,” 2007). It was found that engineers at the plant were tasked with writing procedures for daily operations of equipment and monitoring the condition of equipment. By letting procedures lapse and by not establishing clear lines of communication, the engineers failed to act responsibly and ethically and did not honor their position. This situation also proves that they failed to hold the safety of the public paramount. Because the engineers left out some of the significant consequences of previous lapses in safety procedures, they failed to keep in line with the section of the Engineering Code of Ethics concerning the avoidance of deceptive acts, but this also violated their responsibility to act ethically and to hold public safety above all else. The CSB findings clearly indicated that the engineers working at the Texas City refinery at the time of the explosion violated the Engineering Code of Ethics.

The Bonse Report was a 176 page document produced by BP from an internal investigation (“Fatal Accident,” 2005). It was a continuation of an interim report that was written during the beginning of the investigation. This report, while finding that there were a number of procedural and communicational problems, concluded that no one deliberately took any action or made any decision that put others at risk (“Fatal Accident,” 2005, ii). Any such action or decision would directly violate the Engineering Code of Ethics. It also concluded that there was poor awareness and understanding of the safety procedures, and poor vertical communication within the company. This investigation showed that multiple hazard and operational studies had been done on the isomerization unit, dating back to 1993. These studies stated the equipment was unsafe, therefore, proving that this was a long term problem that was never taken care of at the Texas City refinery (“Fatal Accident,” 2005, p. 61). In addition, these studies reported multiple recommendations on improving the safety conditions at the facility. As an engineer, poor awareness and the inability to properly address safety concerns from audits directly violates the Engineering Code of Ethics. They failed to hold the safety and the welfare of the public paramount or conduct themselves responsibly. Also, the Bonse Report went on to say that the overall organization of the Texas City refinery had been changed so often that there was a lack of real visible leadership.

After BP took over the facility from the Amoco Corporation in 1998, there were many emails between the company engineers and supervisors that detailed mounting safety concerns at the facilities. The earliest sourced email exchange was from 2002, and it details the need to fix several hazards that were found during a recent assessment. The email originated from a corporate office in the UK and was met with resistance as the management from the plant wanted their engineers to stay focused on production projects rather than safety concerns (J. Hay, personal communication, August 19, 2002). This is a serious breach of the code of ethics as they should hold safety above all else. One year later, in 2003, BP was worried about the ethical choices being made at the refinery, so the company sent out emails to assess any breaches that were being made. They received a response from one of their engineers that they were in violation of OSHA 1910.119, which refers to the requirements of preventing catastrophic releases of explosive chemicals (D. Breedlove, September 29, 2003). He acted within the code of ethics by reporting the facility’s failure to achieve healthy and safety regulations, but the email also suggested that management was already aware that there were unethical actions taking place within the facility. In January 2005, an email was sent out requesting a meeting to detail what steps were necessary to improve safety concerns at the plant as there had been multiple deaths that occurred the previous year (T. Lambright, January 13, 2005). There were major concerns that since their recordable OSHA incident rate improved, that there was a belief that safety had improved at the refinery. This email was met with a reply that business meetings were more pertinent and there was not time for both. Again, this shows a complete lack of concern for safety and personal responsibility. These emails continued, as some recognized the danger and the lack of ethical behavior that was occurring and realized the need to improve to prevent loss of life and a potential disaster. Many of these emails were disregarded, though, directly breaking the Engineering Code of Ethics.

Conclusion

After reviewing the investigation reports, it is apparent that there were several safety concerns within the BP refinery that should have been corrected such as alarm reliability, procedure consistency, and worker knowledge and communication. Had these issues been corrected, the explosion and subsequent loss of life could have been prevented. Once aware of the dangers posed by these issues, the engineers that worked in the isomerization unit did communicate the issues to their supervisors, but they made no attempt to contact higher management, even after they realized no actions were being taken by their supervisors. It was found through the investigation conducted by the CSB that the management at the Texas City refinery was even informed of the safety issues from a BP corporate office in the UK, yet they still failed to make safety a priority. Since BP handles such dangerous materials, the safety regulations and their effectiveness should have been a top priority at all levels of management, thus declaring the inaction of the management to be unethical. The engineers at BP acted unethically by not doing all they could to stress the importance of the situation to higher management, and the management acted unethically by not taking action to secure the safety of the refinery. Comment by Ed: corrected, such as…

References:

BP Texas City Explosion. (2005). Retrieved April 18, 2015, from https://www.youtube.com/watch?v=VCcN4SQkb9A

CSB Final Investigation Report on the BP Texas City Refinery Explosion and Fire. (2007, March 20). Retrieved April 16, 2015, from http://www.propublica.org/documents/item/csb-final-investigation-report-on-the- bp-texas-city-refinery-explosion

Fatal Accident Investigation Report/Isomerization Unit Explosion Final Report. (2005). Bonse Report. Retrieved from https://people.uvawise.edu/pww8y/Supplement/-ConceptsSup/Work/WkAccidents/BPTxCityFinalReport.pdf

History of BP. (n.d.). Retrieved April 17, 2015, from http://www.bp.com/en/global/corporate/about-bp/our-history/history-of-bp.html

NSPE Code of Ethics for Engineers. (2007). Retrieved April 29, 2015, from http://www.nspe.org/resources/ethics/code-ethics

1908: APOC was founded

1915: British Tanker Company was established

1923: APOC took control of all oil fields in Persia

1932: Shell-Mex and BP joined together

1998: Shell-Mex and BP seperated

,

I chose the topic Manned trip to mars because even since I read the novel “The Martian” by Andy Weir, the idea of being able to survive on another planet seems to be very fascinating to me. Now that famous billionaires like Jeff Bezos and Elon Musk are on a race to build cities on Mars, this Science Fiction of living on another planet might come to reality. Therefore, I chose this topic and in this essay I plan to write about the three elements of engineering in that I plan to base my analysis of ethics on.

1. Safety: The safety of astronauts should be the top priority of the mission. Engineers must design and test all the aspect of the mission to ensure that the astronauts have enough resources and support they need to stay safe.

2. Contamination: Engineers should be careful so as not to contaminate the ecosystem we visit or our own planet after the mission.

3. Sustainability: engineers should make the design the spacecraft and other technologies in such a way that it minimizes polluting our planet and the planet they will go on.