Texas City 2005: How a Restart Decision Became a Governance Failure

F5 narrative case study for EHS leaders, operations directors, and incident investigators

The BP Texas City refinery explosion on March 23, 2005, was not only a process-safety event. It was a governance failure that became visible during a startup, when leaders had to decide whether production could resume while critical warning signals, equipment conditions, and operating assumptions remained unresolved.

The U.S. Chemical Safety Board reported 15 fatalities and 180 injuries. Those numbers describe the human cost, but they do not explain why the event was possible. The more useful question for an incident investigator is how several ordinary decisions accumulated until a restart became more important than proving that the operating envelope was safe.

This case matters because many organizations still treat a restart as a technical milestone. A unit is repaired, a checklist is signed, and production is expected to return. The Texas City record shows why the restart decision belongs to governance, not only to the shift team, because authority, evidence, and unresolved risk must meet before the first feed enters the process.

Initial scenario: a startup carried unresolved exposure

The incident occurred during the startup of the isomerization unit at BP's Texas City refinery. Startup work already carries a different risk profile from stable operation because inventories change, alarms are tested, procedures are followed at speed, and abnormal conditions can develop before operators have a reliable process picture.

According to the U.S. Chemical Safety Board's investigation report, the raffinate splitter tower was overfilled during the startup. Hydrocarbon vapors were released from the blowdown stack, where they formed a flammable cloud that ignited. The event was not a single mistake detached from the system. It emerged from a sequence in which equipment design, operating practice, alarms, procedures, supervision, and siting conditions failed to provide a dependable barrier.

The distinction is important. An investigation that stops at the operator's final action explains who touched the process last, but not why the organization allowed a startup arrangement to rely on weak signals and limited protection. James Reason's analysis of latent failures is useful here because the visible action happened at the console while the conditions that made the action dangerous had been distributed across the organization.

The decision: production continuity displaced restart proof

A credible restart decision should answer three questions before work begins. What has changed since the last stable operating state? Which barriers must be available before the change is introduced? Who has the authority to delay the restart when the evidence is incomplete?

The Texas City case shows what happens when those questions are treated as paperwork rather than as decision gates. The CSB identified weaknesses in process safety management, operating procedures, training, alarm practices, and management oversight. The resulting system gave personnel a difficult task while leaving leadership with an incomplete picture of the exposure.

For an operations director, the lesson is not to add another signature. The lesson is to define the evidence that makes a restart acceptable. A signed pre-startup review is weak when it confirms that documents exist but does not demonstrate that critical alarms work, relief paths are appropriate, occupied buildings are protected, operators understand the abnormal sequence, and unresolved actions have an accountable owner.

That is the governance test. A restart is not ready because the schedule says it is ready. It is ready when the organization can show that the barriers which matter for the first unstable minutes are available, understood, and owned.

Execution: ordinary weaknesses combined under abnormal conditions

The CSB investigation did not describe a problem that could be corrected by one refresher course. It described a collection of weaknesses that interacted during startup. Procedures did not adequately control the sequence. Operators lacked reliable indication of the tower condition. The blowdown arrangement discharged flammable material near occupied temporary trailers. Management systems did not convert known hazards into timely redesign.

Each weakness could look manageable when reviewed alone. A procedure can be revised later. An alarm can be investigated after the shift. A temporary building can remain in place until the next project phase. A training gap can be added to a corrective-action list. The danger grows when these decisions share the same operating window, because the system has less capacity to absorb an unexpected deviation.

Incident investigators should therefore build a barrier timeline rather than a blame timeline. The barrier timeline asks when the process left its expected range, which signal should have appeared, who could interpret it, what action was available, and why the next layer did not stop the escalation. That approach produces findings that can change design and authority instead of merely repeating that operators must follow the procedure.

Measured result: the event exposed a governance gap

The immediate result was catastrophic. Fifteen people died and 180 were injured, according to the CSB report. The wider result was a loss of confidence in the organization's ability to manage major-hazard risk, because the event revealed that written systems and leadership expectations had not created reliable protection during startup.

The table matters because it separates outcomes from controls. A fatality count tells the board that the event was severe. It does not tell the board which decision rights, design choices, and verification practices failed before the release. Those are the findings that determine whether the next restart will be safer.

Generalizable lessons for incident investigators

First, treat startup as a distinct risk state. Stable-operation controls cannot be assumed to work during commissioning, maintenance return, process change, or restart after an upset. The investigation should identify the barriers required for that state and test each one against evidence from the day of the event.

Second, distinguish a warning from a decision. An alarm, procedure step, inspection result, or worker concern has value only when someone has the authority and time to act on it. A system full of signals can still be unsafe if leaders have not defined what pauses the job.

Third, investigate the location of people, not only the location of equipment. The temporary trailers near the Texas City process unit became part of the consequence pathway. A technically acceptable process can become an unacceptable operation when people are placed where a foreseeable release can reach them.

Fourth, convert repeated deferrals into governance data. When an organization knows that a design, alarm, procedure, or training weakness remains open across several review cycles, the repetition is itself evidence that the risk owner lacks either authority or incentive to close it.

What to apply in a high-hazard operation

Before the next startup, an EHS leader and operations director should run a focused restart review that is short enough to use and strong enough to change the schedule. Ask the team to identify the first unstable conditions, the barrier that should detect each condition, the person who interprets the signal, and the decision that follows. Then require evidence that the barrier is available in the field, not merely present in a procedure.

Use a red-line rule for unresolved major-hazard exposure. If the team cannot show that a critical alarm works, that the relief and discharge path is acceptable, that occupied areas are protected, or that the operating procedure matches the actual equipment, the restart owner should have an explicit duty to pause the work and escalate the issue.

After the restart, review the first operating period separately from routine performance. Capture alarm floods, unexplained level changes, workarounds, delayed interventions, and questions that required supervisor interpretation. These signals reveal whether the organization transferred the design intent into daily operation.

Why retraining alone would miss the case

Retraining is attractive after a serious event because it is visible, fast to assign, and easy to count. It is also insufficient when the event depended on design, siting, alarm, procedure, and governance weaknesses that training cannot remove.

The Texas City record is a warning against closing a complex investigation with a human-performance slogan. People need competence, but competence cannot compensate for a process that gives poor information, a release path that exposes occupied buildings, or a leadership system that treats unresolved risk as an inconvenience to production.

A stronger corrective-action plan places retraining in its proper position. It may support the change, but the primary actions must address the barrier that failed, the authority that was missing, and the evidence that was not required before restart.

The governance question that remains

The central lesson from Texas City is not that startups are dangerous. It is that organizations become vulnerable when they define readiness through completion rather than through demonstrated control.

For the next restart, the accountable leader should be able to answer one plain question: what evidence would make us delay production today? If the answer is unclear, the organization has not finished the safety decision. It has only finished the paperwork around it.

The BP Texas City explosion remains a useful case because it connects incident investigation with leadership accountability. The event was made possible by technical and organizational weaknesses, but the prevention opportunity sits in the decision architecture that determines whether those weaknesses are accepted, escalated, redesigned, or allowed to persist.

If your operation is preparing for a restart, use the case as a governance test. Identify the unstable conditions, verify the barriers that matter first, protect people from credible consequence zones, and give the risk owner authority to delay production when proof is incomplete. That is how an investigation becomes a control decision rather than a historical summary.

For more practical analysis on major-hazard leadership and incident learning, continue with the Headline Podcast blog.