DOI: 10.3303/CET23104028 Paper Received: 16 May 2023; Revised: 13 July 2023; Accepted: 25 August 2023 Please cite this article as: Barozzi M., Melchiore A., Derudi M., Copelli S., 2023, Integrating Recursive Operability Analysis with Different Risk Assessment Methods: Analysis of the Historical Bp American Refinery Explosion, Chemical Engineering Transactions, 104, 163-168 DOI:10.3303/CET23104028 CHEMICAL ENGINEERING TRANSACTIONS VOL. 104, 2023 A publication of The Italian Association of Chemical Engineering Online at www.cetjournal.it Guest Editors: Sabrina Copelli, Ernesto Salzano Copyright © 2023, AIDIC Servizi S.r.l. ISBN 979-12-81206-06-9; ISSN 2283-9216 Integrating Recursive Operability Analysis with Different Risk Assessment Methods: Analysis of the Historical BP American Refinery Explosion Marco Barozzia, Alessandra Melchiore a, Marco Derudi b, Sabrina Copelli a,* a University of Insubria, Department of Science and High Technology, via Valleggio 9, 22100, Como, Italy b Politecnico of Milan, Department of Chemistry Materials and Chemical Engineering, Via Luigi Mancinelli 7, 20131,Milan, Italy sabrina.copelli@uninsubria.it The British Petroleum (BP) American Refinery accident, back in 2005, was one of the most severe explosions recorded in any industrial accident database. According to both the reconstruction and the interviews with the company, it was found that the causes of the accident where both technical, with the failure of a level controller, which was also badly designed for the isomerization unit, and human, with a very stressed and undersized personnel. In this work, a Quantitative Risk Assessment (QRA) based on the Recursive Operability Analysis (ROA), as hazards and accidental scenarios identification tool, was performed on the unit (BP isomerization unit) involved in the accident. The analysis was carried out exploiting many different techniques, to provide a proper assessment. The quantification of all node-deviation-variables (necessary to establish the real behaviour of the system) was performed by implementing the BP plant in CoCo simulator. Basic events were identified using a simplified Failure Mode and Effects Analysis (FMEA). Then, the magnitude of fire and explosion was estimated basing on the simulation results provided by the ALOHA software. Finally, a Fault Tree Analysis for the BP isomerization unit was performed, quantifying the probability of occurrence of all the most credible scenarios. Probabilities, magnitudes, and risk indexes (function of the distance with respect to the source point) were also estimated. From the analysis, the importance of redundant measurements of the most crucial variables, such as liquid level, and the impact of human errors was highlighted. 1. Introduction In the framework of process industry, the Oil & Gas sector is the greatest in terms of both production volumes and raw materials. Since most of the substances involved in this field are flammable and toxic (hydrocarbons, solvents, etc…), Oil & Gas has to deal with significantly higher risks when compared to other chemical industries. In a recent study (Arun et al., 2022), a Past Accident Analysis was performed using the eMars database over the period 2010-2021, a total number of 495 accidents were identified in the Eurozone, with more than 90 in the Oil & Gas sector only. Large accidents can disrupt either the local or regional oil market, also causing health concerns for thousands of nearby residents, and bringing direct and indirect job losses (Mkrtchyan et al., 2022). For instance, consumers in California paid an estimated 2.4 billion$ more for gasoline after the ExxonMobil Torrance Refinery accident in 2015 (Gonzales et al., 2016). The Chevron Richmond Refinery, affected by an accident in 2012, was required to pay 10 million$ as a compensation for the affected community members. After one of the biggest refinery accidents in Texas City in 2005, which killed 15 contract employees and injured more than 180, British Petroleum (BP) had to pay around 50 million$ for environmental fines (“The Environmental Case,” 2023). Oil and Gas plants are particularly big, and they involve a very high number of workers, causing the human factor to be one of the most important aspects to be handled for a proper process safety management. In this study, a risk assessment was carried out on the raffinate splitter tower of the British Petroleum (BP) in Texas City (US), that witnessed one of the most severe explosions recorded in the history. 163 In 2005, during the start-up of the raffinate splitter section of the ISOM unit, the tower was completely filled with liquid. Flammable liquid was released, vaporized, and ignited, resulting in a huge explosion and fire. This accident was investigated by many associations and scholars (CSB, 2007; Khan and Amyotte, 2007; Manca and Brambilla, 2012), due to the severity of the explosion itself. However, most of the works are focused on both the detection of the root causes that lead to the event and the modelling of the overfill and release from the blowdown system. The scope of this work is to find whether the dynamics of the accident would have been foreseeable within a risk assessment framework. It was also investigated whether the BP plant was, at least in theory, designed correctly in terms of equipped protective devices. The analysis was carried out with the Recursive Operability Analysis (ROA), a HazOp like method, with the support of additional tools, namely Failure Mode and Effect Analysis and Fault Tree Analysis. Variable deviations were furtherly investigated with the support of a freeware process simulator and the magnitude of the event were found with a simple simulation performed with the well-known free software ALOHA. 2. Case study and methods Plant P&ID and procedures were recovered by combining several sources, including the well-known Mogford reconstruction (Mogford, 2005), the reconstruction carried out by the Chemical Safety Board (CSB, 2007), and different accident simulations (Khan and Amyotte, 2007; Manca and Brambilla, 2012). Based on the information retrieved on these references, a P&ID was reconstructed from the plant, including the loading of Aromatic Recovery Units, the raffinate splitter column E-1101, the bottom and top distillates to storage, and the blowdown drum, used for emergency releases. The analysis was carried out for the regular distillation procedure. Figure 1 reports the P&ID reconstructed: the process was composed of storage tanks (feed, light and heavy fractions), the raffinate splitter column E-1101, the reboiler furnace (B-1101), heat exchangers (C-1104/6/7), drums (F- 1102/2), condenser CA-1101, pumps (J-1101/2/3), temperature transmitters and indicators (identified with TT and TI), flow transmitters and controllers, valves (identified with LCV,PCV, LCV, RV and HV, depending on their functioning), low and high level alarms (LAL, LALL, LAH and LAHH), level indicators (identified as LI), and the blowdown drum F-20. Figure 1: Reconstructed P&ID for the BP plant 164 2.1 FMEA analysis The identification of components failure was performed by executing a Failure Mode and Effect Analysis, a tool to describe failure modes and effects of each component (controllers, valves, sensors…). Failure rates for the determination of each plant component unavailability were found by using literature data (Mannan, 2005; Smith, 2011). Human errors were also identified with the support of a literature database (Bello and Colombari, 1980). 2.2 ROA Analysis The Recursive Operability Analysis is a tool that can be used to identify both hazards and accidental scenarios also arranging a probability analysis (Barozzi et al., 2020). The main advantage consists in the possibility of generating Fault Trees in an automatic way (Barozzi et al., 2021). Usually, when performing such an analysis, the combination between variable deviations and consequences is led to the analyst’s knowledge and experience. In this study, due to the complexity of a multi-component distillation column, it is proposed to analyze process deviations with the support of a simulator. ROA was carried out with the support of a CAPE-OPEN simulator (CoCo simulator, https://www.cocosimulator.org/). The column was represented as a simple distillation column. Peng Robinson was chosen as Equation of State, since it generally finds good application for hydrocarbons. The column has 73 plates, where the first is the condenser and the last is the reboiler. Feed occurs on tray number 32 (Mogford, 2005). The composition of the feed is shown in Table 1. Table 1: Composition of the feed (CSB, 2007) Component Mass fraction Component Mass fraction Component Mass fraction n-pentane 0.0383 2-methyl pentane 0.2950 n-nonane 0.0409 2-methyl butane 0.0263 n-heptane 0.3072 n-decane 0.0104 m-hexane 0.1519 n-octane 0.1300 Given the working conditions found in the literature, it was not possible to directly close the equations system. To achieve this goal, it was necessary to combine information reported and make assumptions. According to Mogford report, the working pressure of the column was 238000 N/m2, and it was kept constant. The reboiler temperature was fixed at 408 K, as indicated in the Mogford report. To close the equation system, a reflux ratio equal to 2 was hypothesized. 2.3 FTA Analysis The fault trees found were analyzed with the freeware software OpenFTA 1.0 (Formal Software Construction Ltd., Cardiff, UK), from which Minimal Cut Sets (MCS) and probability analysis are performed. 2.4 Accident simulation From the Top Events, one of the most critical scenarios found was a flammable hydrocarbon release from the column. The magnitude of dispersion was assessed with the help of the freeware software ALOHA. 3. Results The plant was divided into 4 nodes. Node 1 describes the feed line, and it includes: F-1101, LI-5007, LT-5007, LAH-5007, PIC-5013, 5001A/B, FCV-5001, FVC-5003, FCV-5000, J-1101, FT-5001, FIC-5001, FT-1001, FIC- 1001, FT-5000, FIC-5000. To characterize the different lines, the following sub-nodes were defined. 1A, south feed line, 1B, north feed line, 1C, drum and line to reboiler. Node 2 contains the furnace, and it includes: B- 1101, C-1104, FT-1014, FI-1014, FT-1009, FIC-1009, TIC-5025, TT-5025, PI-5002A-PT-5002A, FIC-5008, FT- 5008, FCV-5008, FCV-5005. Sub-nodes: 2A, heat exchanger line, 2B, reboiler line. Node 3 was the splitter column with its blowdown, it involves the following components: E-1101, LI-5102, LI-5100, LT-5102, TT- 5001/2/4/7/6, TE-5001/2/4/7/6, LAL-5102, LAH-5102, LAHH-5102, J-1103, RV-1001 A/B/C, F-1102, CA-1101, PI-5002, PT-5002, RV-1002G, RV-1109 G, LI-5008, LT-5008, LT-5004, LALL-5010, J-1102, LT-5020, LI-5020, LAH-5020, HV-5020, HV-5021, J-14A. Sub-nodes: 3A, splitter column, 3B, condenser line, 3C, blowdown line. Node 4 was the heavy raffinate line, it includes: J-1103, C-1104, C-1106, LCV-5100, FIC-5015, FT-5015, TI- 5512, TT-5512, T-538. The variables investigated were the following: liquid level (L), temperature (T), flow (F), and pressure (P). The analysis was applied to the regular continuous distillation. From CoCo simulations, under regular steady-state conditions, the mass fraction of the top was found equal to 47%, with almost all of hydrocarbons above C6 on the top. These results are comparable with the information found in the literature (Mogford, 2005). The duty to condenser is equal to 23.2 MW. 165 3.1 ROA The Recursive Operability Analysis for regular distillation is shown in Table 2. Table 2: ROA analysis for distillation procedure Rec NDV Causes Cons. Plant state with protections working Protections Notes TE Manual Automatic safety means Alarm Operator actions 1.0 2BlT (Inlet: 300K) B-1101 OR C-1104 OR FCV-5008 OR FIC-5008 OR Human error 3AhL System is restored Operator can check temperature in control room and adjust furnace input Reboiler duty increases up to 25% Possible liquid level rise if reboiler does not provide sufficient heat 1.1 2BhT (Inlet: 400K) B-1101 OR FCV-5008 OR FIC-5008 OR Human error Partial feed vaporization Partial feed vaporization 1.2 3AhL 2BlT OR J-1103 3AhhL System restored automatically LAH-5102 LCV-5100 1.3 3AhhL 3AhL Column flooding AND 3AhP AND 3BhP Plant shutdown LAHH- 5102 Operators call for assistant There not any device for check the actual level above TE1 1.4 3AhP 3AhhL OR CA-1101 OR J-1102 OR FCV-5106 3AhhP Pressure increases inside F-20 The operator open PCV- 5002 1.5 3AhhP 3AhP Release from cracks generated by overpressure Release from F-20 RV-1001 A/B/C TE2 1.6 3AlT FIC-1009 OR B-1101 OR J-1103 OR Human error) 3AhL Plant Shutdown 1.7 3AhT FIC-1009 OR 3AlT OR B-1101 OR Human error 4AhF AND 4BlF 4AhF AND 4BlF Higher temperature implicates more flow rate to the top 166 1.8 3BhP 3AhhL OR CA-1101 OR J-1102 OR FCV-5106 closed 3BhhP Release from F-20 Operator opens PCV- 5003 1.9 3BhhP 3BhP Release from cracks generated by overpressure Release from F-20 RC-1002G TE3 1.10 4AhF 3AhT Heavy fraction on top Heavy fraction on top 1.11 4BlF 3AhT Light fraction in bottom Light fraction in bottom From the analysis, three Top Events were identified. TE1 is the column flooding, caused by a very high level of liquid. The level may rise due to failure of pumps, flow control valves, temperature control or human error (operators can change operating conditions). This deviation was protected by both manual intervention (double level alarm LAH-5102 and LAHH-5102), and automatic valves (LCV-5100). TE2 and TE3 are events related to overpressures generated in the column and in the condenser, respectively. Even in this case, several pressure control valves connected with the blowdown system F-20 are present. PCV-5002/3 are manually operated valves, while RV-1001 A/B/C and RC-1002G are automatic relief valves. When protections work, the lighter fraction is vented to the atmosphere through F-20, while the heavy fraction is sent to both sewer and pumped by J-14A. 3.2 FTA For what concerns the Fault Trees developed, it is worth noticing that multiple barriers are always present, highlighting, in theory, a well-designed setup. From Table 2, Fault Trees were generated and solved with OpenFTA 1.0. Basic events probabilities were found with a Poisson distribution (Crowl and Louvar, 2011) with a mission time of 1 year. Failure rates of single components were recovered from the aforementioned literature database. Table 3 resumes the results found. Every Top Event had a probability of occurrence in the range 10- 5-10-6. While this is close to the negligible range, such values should still rise a level of concern, especially when protections are highly human dependent. Table 3: Probabilities of Top Events identified TE1 TE2 TE3 P [-] 2.39∙10-5 3.7∙10-5 3.36∙10-5 # of MCS 17 28 29 3.3 Accidental scenario Among the accidents identified, the one closest to what happened to the ISOM unit is the TE2, that was the pressurization of the column. This event is expected to occur with a probability of 3.7∙10-5 on a year base. a b Figure 2: Results of the simulation for TE2. a) Simulation of the release flowrate of methyl-pentane. b) Threat zones (yellow, concentrations lower than 10% of LEL, red zones are above the LEL) 167 Under these conditions, the raffinate is sent to the blowdown drum, where the heavy fraction is drained to sewer and with pump J-14A, and the light one is vented in atmosphere. TE2 was simulated through ALOHA. The leakage was represented as an emptying of a vertical tank with the same dimensions of the column, filled with iso-hexane. Iso-hexane was chosen as main component in accordance with the results of the simulations: within deviations associated with high pressures in the column, 2-methylpentane is the most present in the light fraction, with a molar fraction greater than 0.6. A 2 cm hole on the column was hypothesized. Figure 2 reports the flowrates from the column and the threat zones drawn in MARPLOT. Under these conditions, the potentially flammable zones were between 11 and 10 meters, depending on atmospheric stability (concentrations above the LEL of iso-hexane, that is 12000 ppm), and threat zones with a Level of Concern equal to 10% of the LEL extend up to 33 meters, depending on stability conditions. According to the ALOHA simulation, the threat zones are relatively narrow, and completely confined within the ISOM unit. 4. Conclusions In the current work, a risk assessment on the BP plant was performed. According to the analysis, the most common events are releases of flammable hydrocarbons into the environment, mostly related to high pressures in the plant. If protections work correctly, the release is handled by the blowdown drum F-20. If protections do not intervene, cracks can develop in the column, causing a leakage from there. However, a total overfill of the column was not found as a critical accident. Such an event should be so rare that is hardly predictable even in a standard risk assessment, especially when protective means are present. According to the probabilities found, values should rise concern, but they are close to the negligible range (usually acknowledged as 10-6), and this is due to the presence of both human and automatic protections, according to regular plant procedures. The fact that multiple alarms failed, along with an improper personnel management, caused the loss of protective means. This led to new, unforeseen accidents, caused by intentional deviations from regular procedures. In conclusion, the infamous BP accident reminds how critical human factor and protections are for a safer industry. References Arun, P.A., Tauseef, S.M., Uniyal, U., 2022. Comparison of Accident Databases and Analysis of Past Industrial Accidents in the Chemical Process Industry. Engineering, Technology & Applied Science Research 12, 8922–8927. https://doi.org/10.48084/etasr.5079 Barozzi, M., Contini, S., Raboni, M., Torretta, V., Casson Moreno, V., Copelli, S., 2021. Integration of Recursive Operability Analysis, FMECA and FTA for the Quantitative Risk Assessment in biogas plants: Role of procedural errors and components failures. Journal of Loss Prevention in the Process Industries 71, 104468. https://doi.org/10.1016/j.jlp.2021.104468 Barozzi, M., Copelli, S., Scotton, M.S., Torretta, V., 2020. Application of an Enhanced Version of Recursive Operability Analysis for Combustible Dusts Risk Assessment. International Journal of Environmental Research and Public Health 17. https://doi.org/10.3390/ijerph17093078 Bello, G.C., Colombari, V., 1980. The human factors in risk analyses of process plants: The control room operator model ‘TESEO.’ Reliability Engineering 1, 3–14. https://doi.org/10.1016/0143-8174(80)90010-4 Crowl, D.A., Louvar, J.F., 2011. Chemical Process Safety: Fundamentals with Applications. Pearson Education International. CSB, 2007. BP America (Texas City) Refinery Explosion. Gonzales, D., Gulden, T.R., Strong, A., Hoyle, W., 2016. Cost–Benefit Analysis of Proposed California Oil and Gas Refinery Regulations. RAND Corporation. Khan, F.I., Amyotte, P.R., 2007. Modeling of BP Texas City refinery incident. Journal of Loss Prevention in the Process Industries, Selected Papers Presented at the Sixth International Symposium on Hazards, Prevention and Mitigation of Industrial Explosions 20, 387–395. https://doi.org/10.1016/j.jlp.2007.04.037 Manca, D., Brambilla, S., 2012. Dynamic simulation of the BP Texas City refinery accident. Journal of Loss Prevention in the Process Industries 25, 950–957. https://doi.org/10.1016/j.jlp.2012.05.008 Mannan, S., 2005. Lees’ Loss Prevention in the Process Industry, 3rd ed. Butterworth-Heinemann. Mkrtchyan, L., Straub, U., Giachino, M., Kocher, T., Sansavini, G., 2022. Insurability risk assessment of oil refineries using Bayesian Belief Networks. Journal of Loss Prevention in the Process Industries 74, 104673. https://doi.org/10.1016/j.jlp.2021.104673 Mogford, J., 2005. Fatal accident investigation report. Smith, D., 2011. Reliability, Maintainability and Risk - 8th Edition. Butterworth-Heinemann. The Environmental Case [WWW Document], 2023. Sage Publications Inc. URL https://us.sagepub.com/en- us/nam/the-environmental-case/book258485 (accessed 5.3.23). 168 32barozzi.pdf Integrating Recursive Operability Analysis with Different Risk Assessment Methods: Analysis of the Historical BP American Refinery Explosion