 The training will cover the 14 elements of PSM using the 2005 explosion at BP's Texas City Refinery as a model. Look for it soon at csb.gov. March 23rd, 2005, the BP Refinery in Texas City, Texas. Several units at the refinery had been shut down for lengthy maintenance projects which required nearly a thousand contractors to be on site along with BP employees. BP had positioned a number of portable trailers close to process units for the use of contractors and other maintenance workers. Over a period of months, BP had located 10 trailers for workers servicing the ultra-cracker unit including a double-wide wood-framed trailer that contained 11 offices and was regularly used for meetings. Though these trailers were located near the isomerization unit, the occupants were not warned the ISOM unit was about to start up, a potentially hazardous operation. At 2.15 a.m. on March 23rd, overnight operators began introducing flammable liquid hydrocarbons known as raffinate into a 170-foot-tall raffinate splitter tower used to distill and separate gasoline components. Near the base of the tower, there was a single instrument that measured how much liquid was inside. It transmitted this information to both a satellite control room and a central control room located away from the ISOM unit. But this level indicator was not designed to measure liquid above the 9-foot mark. During normal operation, the tower was only supposed to contain about 6.5 feet of liquid. But during start-ups, operators routinely deviated from written procedures and filled the tower above the 9-foot mark concerned that if the liquid level fluctuated too low it would cause costly damage to the furnace. At 3.09 a.m. as the liquid neared the 8-foot mark a high-level alarm activated and sounded in the control rooms. But a second high-level alarm, slightly further up the tower, failed to go off. By 3.30 a.m. the level indicator showed that liquid had filled the bottom 9 feet of the tower and the feed was stopped. The CSB later estimated that the liquid was in fact at a height of 13 feet and the operators could not know the actual level because the indicator only measured up to 9 feet. The lead operator had been overseeing the start-up from a satellite control room within the ISOM unit. At 5 a.m. he briefly updated the night board operator in the central control room about the start-up activities. The lead operator then left the refinery early, an hour before the end of the shift. A new board operator arrived in the control room around 6 a.m. to start his 30th day in a row working the 12-hour shift. He spoke briefly with the departing night shift operator and then read the logbook to prepare for the start-up. But the logbook did not clearly indicate how much liquid was already in the tower and equipment and it left no instructions on routing of the liquid feed and products when the start-up resumed. Instead, the control board operator only found a one-line logbook entry that said ISOM brought in some raft to unit to pack raft with. At 7.15 a.m. the day shift supervisor arrived. Because he was more than an hour late, he received no formal briefing from personnel on the night shift about conditions in the ISOM unit. At 9.51 a.m. operators resumed the start-up. They began recirculating the liquid feed and adding more liquid to the already overfilled tower. As new feed was added, start-up procedures called for regulating the liquid level in the tower using the automatic level control valve. But the board operator and others had received conflicting instructions on routing the product. As a result, this critical valve was left closed for several hours, blocking the flow of liquid from the tower. A few minutes later, operators lit burners on the furnace to begin heating up the feed, part of the normal start-up process. While the start-up was underway, the day supervisor left the refinery on short notice just before 11 a.m. to attend to a family medical emergency. Contrary to BP's own procedures, no experienced supervisor was assigned to replace him. This left a single control board operator, now without a qualified supervisor, to run three refinery units, including the ISOM unit, which needed close attention. The refinery had eliminated a second board operator position following corporate budget cuts in 1999 after BP acquired Amaco. As the start-up continued, the tower steadily filled with liquid, reaching a height of 98 feet, shortly before noon, more than 15 times the normal level. But the improperly calibrated level indicator told operators in the control room that the liquid was at 8.4 feet and gradually falling. Furthermore, the control panel was not configured to clearly warn operators of the growing danger. It did not display flows into and out of the tower on the same screen, nor did it calculate the total liquid in the tower. Meanwhile, the maintenance contractors, who were not involved in the operation of the ISOM unit, left their work trailers to attend a company lunch, celebrating a month without a lost time injury. At 12.41 p.m., an alarm activated as the rising liquid compressed the gases remaining in the top of the tower. Unable to understand the source of the high pressure, operators opened a manual chain valve to vent gases to the unit's emergency relief system, a 1950s-era blowdown drum that vented vapor directly into the atmosphere. Operators also turned off two burners in the furnace to lower the temperature inside the tower, believing this would reduce the pressure. Nobody knew the tower was dangerously full. The operators did become concerned about the lack of flow out of the tower and began opening the valve to send liquid from the bottom of the tower to storage tanks. But this liquid was very hot. As it flowed through the heat exchanger, it suddenly raised the temperature of the liquid entering high up the tower by 141 degrees Fahrenheit. It was now about 1 p.m. Contract workers, unaware of the startup and the looming danger, returned from lunch and began a meeting in the double-wide trailer, in the corner room, closest to the blowdown drum. Over the next few minutes, the hot feed entering the tower caused the liquid inside to start to boil and swell. Liquid filled the tower completely and began spilling into the overhead vapor line, exerting great pressure on the emergency relief valves 150 feet below. At 1.14 p.m., the three emergency valves opened, sending nearly 52,000 gallons of flammable liquid to the blowdown drum at the other end of the ISOM unit. Liquid rose inside the blowdown drum and overflowed into a process sewer, setting off alarms in the control room. But the high-level alarm on the blowdown drum failed to go on. None of the operators knew of the catastrophe unfolding in the ISOM unit. As flammable hydrocarbons overfilled the blowdown drum, operators nearby saw a geyser of liquid and vapor erupt from the top of the stack. The equivalent of nearly a tanker truck full of hot gasoline fell to the ground and began forming a huge flammable vapor cloud. The vapor cloud expanded in just 90 seconds, engulfing the unit and the nearby trailers full of workers. About 25 feet from the base of the blowdown drum, two workers were parked in a pickup truck with the engine idling. As flammable vapor entered the air intake, the diesel engine began to race. The two workers fled, unable to shut off the engine. Moments later, witnesses saw the truck backfire and ignite the vapor cloud. Powerful explosions swept through the area. The blast pressure wave accelerated through the ISOM unit, causing heavy destruction and igniting fires. The workers inside the trailers were right in the path of the explosions. The fires continued to burn for hours. 12 of the 20 occupants of the double-wide trailer were killed, along with three workers in a trailer nearby. 180 workers were injured, many with serious burns, fractures, or other traumatic injuries. The wood and metal frame trailers were blown apart by the blasts. Firefighters struggled to rescue the injured and recover the victims. Fifty large chemical storage tanks were damaged and the ISOM unit remained shut down for more than two years. The disaster at BP Texas City was the most serious refinery accident ever investigated by the CSB.