First Out

Incident lessons

Lessons from Texas City (2005): instruments out of service at start-up

A distillation tower overfilled during start-up with a misleading level indicator and a failed high level alarm; what it teaches about instrument checks and independent protection.

2 min read · First Out AI knowledge library

What happened

On 23 March 2005, during the start-up of the isomerisation unit's raffinate splitter tower at the BP Texas City refinery, the tower was filled for about three hours without the level control valve being opened as the procedure required. According to the U.S. Chemical Safety Board's preliminary findings, the level reached about fifteen times its normal value. The level indicator misled operators, a separate high level alarm did not activate, and a control valve was malfunctioning; the investigators said the unit should not have been started up in that condition.

Relief valves sent the overflow to a blowdown drum with an atmospheric vent stack that had never been connected to a flare. Flammable liquid was released from the top of the stack and formed a vapour cloud, which ignited. Fifteen workers were killed and about 170 injured.

The CSB also reported that instrument checks required before start-up were signed off as done when they were not, and that many earlier start-ups had involved abnormally high levels or pressures that were not investigated.

Lessons for SIS and instrumentation

  • Start-up is a hazardous mode. Hazard studies and SIFs must cover start-up and other transient operations, not only normal operation.
  • Protection must not depend on the same failed instrument. An indicator and an alarm that are both wrong at once suggest a shared cause; an independent high-high level trip with its own sensor would have been a separate layer.
  • Instrument checks before start-up must be real. Proof that protection is in service is part of the start-up procedure; signing without testing defeats the safety lifecycle.
  • Relief to a safe location is part of the protection design; an atmospheric vent for flammable liquid is a consequence multiplier.
  • Near misses are data. Repeated high-level start-ups were warnings.

Related First Out AI articles

"HAZOP deviation library: heat exchangers and distillation columns", "What qualifies as an independent protection layer", "Writing a proof test procedure that achieves its coverage".

Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.