BP Texas City made process-safety cost discipline an accountability test

Summary

• On March 23, 2005, during restart of the isomerization unit at BP's Texas City refinery, the raffinate splitter tower was filled for more than three hours without liquid being removed. Faulty or misleading level instrumentation and alarms did not reveal the true inventory. Liquid entered the overhead line, opened relief valves, overwhelmed an atmospheric blowdown drum and stack, and formed a flammable vapor cloud that ignited. The U.S. Chemical Safety and Hazard Investigation Board, or CSB, records 15 deaths, 180 injuries, and financial losses exceeding $1.5 billion in its investigation page at https://www.csb.gov/bp-america-texas-city-refinery-explosion/ and final report at https://www.csb.gov/file.aspx?DocumentId=5596.
• The central accountability question is not whether frontline errors occurred. They did. It is who had practical control over the conditions that made those errors catastrophic: whether to start with malfunctioning instruments; whether procedures matched actual operation; whether another board operator and knowledgeable supervision were present; whether repeated abnormal startups were investigated; whether an obsolete atmospheric disposal system was replaced by a flare; whether occupied trailers were allowed inside the blast hazard; and whether maintenance, staffing, and training budgets reflected known risk.
• The strongest causal record is the CSB investigation. Its 2007 findings release at https://www.csb.gov/u-s-chemical-safety-board-concludes-organizational-and-safety-deficiencies-at-all-levels-of-the-bp-corporation-caused-march-2005-texas-city-disaster-that-killed-15-injured-180/ attributes the disaster to organizational and safety deficiencies across BP, not to a single act. The independently chaired Baker Panel report at https://www.csb.gov/assets/1/20/baker_panel_report1.pdf separately found material process-safety deficiencies across BP's five U.S. refineries and warned that improving personal-injury rates had created false confidence about catastrophic process risk.
• Enforcement produced unusually large numbers, but they must not be blurred together. OSHA's public record includes a 2005 settlement payment of $21,361,500, a later $50.61 million failure-to-abate settlement, and a 2012 agreement for $13,027,000 covering most of 439 additional citations. DOJ announced a Clean Air Act felony plea with a $50 million criminal fine and three years of probation. Other civil Clean Air Act claims at the same refinery produced a separate $15 million penalty. Proposed penalties, final settlements, remediation spending, private civil claims, and total economic loss are different measures and cannot be safely added as though they were one bill.
• Repair evidence is substantial but not absolute. OSHA records decommissioning of the ISOM unit, hundreds of abatement actions, independent audits, pressure-relief and layer-of-protection reviews, training changes, and dedicated funding. Industry standards changed for portable-building siting, process-safety indicators, fatigue, and atmospheric discharges. Yet the CSB's March 2025 digest at https://www.csb.gov/assets/1/6/CSB_BPTC_Investigation_Digest_v3_%28004%29.pdf said that one of 26 recommendations remained open: OSHA still had not explicitly required management-of-change review for organizational, staffing, and budget changes that can affect process safety. Durable accountability therefore requires more than closed action items. It requires evidence that cost decisions cannot silently remove safety margin again.

Why Texas City is a cost-discipline case

Calling Texas City a cost-discipline case does not mean that a single budget instruction mechanically caused an explosion. It means that money, staffing, schedule, maintenance, training, and design decisions determined which safeguards existed when the startup went wrong. The CSB documented a chain in which an old blowdown system remained open to the atmosphere, instrument defects persisted into startup, procedures did not reflect the way the unit was commonly operated, staffing and training had been reduced, and temporary trailers were positioned close to hazardous process equipment. Each condition had an owner and a resource consequence.

The phrase also guards against an easy but incomplete explanation: operator error. Operators closed or failed to open valves, continued filling, and did not recognize the true tower level. Those are confirmed elements of the sequence. But an accountability analysis asks why the system depended so heavily on perfect human action during a hazardous startup. OSHA's current Process Safety Management standard at https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.119 requires process hazard analysis to consider engineering and administrative controls, consequences of control failure, facility siting, and human factors. It also requires mechanical-integrity work, operating procedures, training, pre-startup review, incident investigation, management of change, and compliance audits. That architecture exists because no single operator should carry the full burden of containing a catastrophic inventory.

The cost-discipline question is therefore operational: when a site knows that instruments are unreliable, startup behavior routinely departs from the written procedure, maintenance work remains open, and a relief discharge can form a vapor cloud, who can authorize the next dollar and who can stop the next startup? Site managers can delay startup, repair instruments, add supervision, relocate people, and escalate capital needs. Business-unit leaders can set staffing and spending. Corporate leaders can reject across-the-board cuts that disregard site condition.

The board can require process-safety indicators rather than accept a low personal-injury rate as evidence that major-accident risk is controlled. Regulators can inspect and enforce. Standards bodies can define the accepted engineering baseline. The workers in nearby trailers controlled almost none of those decisions.

That unequal distribution of control is the core accountability fact. The people most exposed to the blast had the least power to inspect the splitter tower, redesign the relief system, set the turnaround schedule, or challenge the refinery's capital plan. A durable record must therefore follow control upstream from the ignition source.

An auditable timeline from warning to enforcement

1999-2000: merger integration and fixed-cost pressure. BP acquired the refinery through its merger with Amoco. The CSB final report records a corporate target to reduce business-unit cash costs for 2001 by at least 25 percent from 1998 levels. Its review of a 2002 refinery retrospective also found that maintenance spending had already fallen substantially during the 1990s and that reductions did not adequately reflect the refinery's specific maintenance needs. This is confirmed documentary history. It does not establish that every later defect resulted from one budget line, but it establishes that resource pressure preceded the disaster and reached maintenance, training, staffing, inspection, and turnaround work.

2002-2004: warnings accumulated. Internal reviews described mechanical-integrity, training, reliability, reporting, and cultural problems. Previous ISOM startups repeatedly showed abnormal levels and pressures, yet the deviations were not converted into an effective learning loop. A 2003 hazard review recommended a second board operator during startups, according to the CSB, but the recommendation was not implemented before March 2005. Two fatal incidents occurred at the refinery in 2004, and other serious events added warning signals. The accountability significance is not hindsight alone: management had evidence of deteriorating conditions before the fatal startup.

Late 2004 to early 2005: another budget challenge met a weak plant. The CSB reported that group refining leadership issued a further 25 percent capital-reduction challenge for 2005. Texas City management argued that the cut was too deep and recovered part, but not all, of the proposed reduction. A February 2005 presentation to senior refining leaders included concern about plant condition, production pressure, inadequate training, poor closure of process-safety action items, and weak mechanical availability. The same public record describes a refinery business plan warning that the site could kill someone within 12 to 18 months. Those facts make hazard escalation a governance issue: the risk was not wholly invisible.

March 10, 2005: a known instrument issue remained. The Baker Panel's reproduced CSB urgent recommendation states that a work order acknowledged a splitter level transmitter needed repair and that repair was deferred until after startup. Public evidence does not reveal every conversation or technical rationale around that deferral. It does show that startup authorization and maintenance completion were linked decisions under management control.

March 23, 2005: the unit restarted and the tower overfilled. During the morning startup, hydrocarbons entered the 170-foot raffinate splitter for more than three hours without liquid leaving through the bottom. Instrumentation gave operators a false picture. Three pressure-relief valves opened for roughly six minutes, sending liquid to an undersized or unsuitable atmospheric blowdown system. The drum filled and expelled a geyser-like release from its stack. A large vapor cloud formed and, according to the CSB, was most likely ignited by a nearby idling diesel pickup. At about 1:20 p.m., explosions and fires struck the unit and surrounding trailers. All 15 people killed were contractors working in or around temporary trailers positioned as close as 121 feet from the blowdown drum.

August and September 2005: urgent review and first settlement. On August 17, the CSB urgently recommended that BP's global board commission an independent review of corporate oversight and safety culture. In September, OSHA and BP entered a settlement following more than 300 cited deficiencies. OSHA's BP record hub at https://obis.osha.gov/dep/bp/bp.html preserves the sequence of inspections, citations, agreements, and later verification.

January and March 2007: two major investigations reached the public. The Baker Panel published its review in January. It was commissioned and funded by BP in response to the CSB recommendation, but its external chair and panel took responsibility for the conclusions. It examined U.S. refinery process-safety culture and oversight, not the detailed root cause of the March 2005 explosion. On March 20, the CSB approved its final accident report after reviewing more than 30,000 documents, conducting 370 interviews, testing equipment, and analyzing control-system data and previous startups.

October 2007 through 2009: criminal accountability and victim-rights litigation. DOJ announced that BP Products North America would plead guilty to a felony Clean Air Act violation and pay a $50 million criminal fine, with three years of probation, in https://www.justice.gov/archive/opa/pr/2007/October/07_ag_850.html. The Fifth Circuit later considered whether victims had been consulted before the plea agreement. Its opinion at https://www.ca5.uscourts.gov/opinions/pub/08/08-20125-CV0.wpd.pdf found a statutory violation of the Crime Victims' Rights Act because the victims should have had a meaningful opportunity to confer before the deal was struck, although the court denied the requested writ of mandamus. Accountability thus extended beyond equipment and money to the procedure by which harmed people were heard.

2009-2012: follow-up enforcement tested whether repair was real. OSHA's 2009 monitoring inspection produced 270 failure-to-abate notices and 439 additional alleged willful violations. The initial proposed total was $87.43 million, as recorded in the Department of Labor release at https://www.dol.gov/intelligence team/releases/osha/osha20091030. A clerical duplication later reduced the failure-to-abate component, and BP settled that portion for $50.61 million in 2010. In 2012, another agreement resolved 409 of the 439 additional citations for $13.027 million, while grouped pressure-relief issues remained contested. This sequence matters because it shows why an announcement of reform is weaker evidence than a regulator's follow-up inspection.

February 1, 2013: operational control changed hands. Marathon Petroleum's 2013 annual report at https://www.marathonpetroleum.com/content/documents/Investors/Annual_Report/MPC_Annual_Report_2013_with10-K.pdf records its acquisition of the refinery and related assets from BP. Historic responsibility for BP-era decisions did not transfer away, but current operating control did. Any present-tense claim about site conditions must therefore distinguish BP's historic accountability from the duties of the subsequent owner.

March 2025 to July 2026: most recommendations were closed, one structural gap remained. The CSB's twentieth-anniversary review reported 25 of 26 recommendations successfully closed. The remaining open recommendation called for OSHA's PSM rule to require management-of-change review for mergers, reorganizations, staffing changes, and budget cuts that may affect process safety. The CSB investigation page still displayed 25 closed and one open recommendation when checked on July 15, 2026. The unresolved item goes directly to the title of this case: whether cost and organizational decisions must pass a formal safety review before they reduce control capacity.

The physical sequence was technical, but not mysterious

The immediate sequence can be described without speculation. The raffinate splitter was being restarted after maintenance. Feed entered the tower while the route that should have moved liquid onward remained closed. The tower's level transmitter only measured a narrow span near the bottom of a vessel that was 170 feet tall. It was miscalibrated, and a separate high-level alarm did not provide the needed warning. Operators saw indications that did not reveal the rising inventory. By the time the true level approached the upper part of the tower, liquid entered overhead piping and increased pressure at the relief valves.

Relief valves did what pressure-relief valves are designed to do: they opened to protect equipment from pressure. But the destination of the discharge was unsafe for the event that occurred. The valves sent flammable material to a blowdown drum and atmospheric stack dating from the 1950s. The drum could not contain the liquid load. The stack then released thousands of gallons of volatile hydrocarbons into open air, where a vapor cloud formed near vehicles, process equipment, and occupied trailers. The chain converted an overfill into a mass-casualty explosion.

The distinction between a relief valve and a safe disposal system is essential. Opening a valve may prevent one vessel from rupturing while creating a different hazard if the discharged material is not contained, recovered, or safely burned. The CSB concluded that the atmospheric system was antiquated and unsafe and that opportunities to connect the splitter relief to a flare had been missed. The later 2025 digest records that API revised its pressure-relief guidance to address vessel overfill and to favor inherently safer alternatives where atmospheric discharge presents vapor-cloud explosion risk.

The trailer siting converted the blast into a human disaster. The trailers were convenient for turnaround work, but convenience placed nonessential personnel close to a hazardous unit. The CSB found that 13 trailers were destroyed and 27 more damaged; people in trailers were injured hundreds of feet from the blowdown drum. This was not a hidden chemical property. It was a siting decision. API's current RP 753 page at https://www.api.org/products-and-services/standards/important-standards-announcements/rp753 reflects the post-incident standard specifically devoted to portable buildings near process plants.

The sequence therefore had multiple opportunities for prevention or mitigation: stop filling, establish accurate level, alarm independently, shut down automatically, keep the drain path open, delay startup, add supervision, send relief to a flare, remove ignition sources, and keep people outside the blast zone. Catastrophe required several layers to be absent, degraded, bypassed, or ineffective at the same time.

Practical control sat at several levels

Frontline operators controlled immediate actions, but not the safety architecture. Operators manipulated valves, monitored screens, communicated across shifts, and responded to alarms. They could have interrupted the startup if they recognized the overfill. Yet their decisions were shaped by false instrument readings, incomplete or inaccurate procedures, inconsistent shift communication, fatigue, normalized deviations, and a control-room design that did not display an effective material balance. Treating their conduct as the whole explanation would assign responsibility to the people operating inside conditions they did not design or fund.

Shift and unit supervision controlled startup readiness. Supervisors and technically knowledgeable personnel could require a pre-startup review, verify that instruments and alarms worked, confirm tank capacity and flow paths, ensure that procedures reflected actual conditions, staff a second operator, and stop the startup when readiness was uncertain. The CSB recommendations specifically addressed knowledgeable supervision during hazardous phases and additional board staffing during startups. That shows that supervision was not ceremonial; it was a missing protective layer.

Refinery management controlled maintenance, procedures, staffing, siting, and local escalation. Site leadership could prioritize work orders, forbid startup with malfunctioning critical equipment, investigate previous abnormal startups, update procedures, move trailers, install independent level protection, and raise unresolved risk to corporate leadership. It also controlled how production goals and turnaround schedules were translated into daily choices. The site did not control every corporate budget target, but it controlled whether unresolved hazards were made explicit and whether operations continued.

North American refining and group leadership controlled resource envelopes. Corporate and business-unit leaders set budget challenges, capital priorities, staffing models, performance contracts, and the authority of safety functions. The CSB traced warnings and studies upward and concluded that budget cuts and production pressure impaired training, staffing, maintenance, and mechanical integrity. The Baker Panel likewise found that BP had not always provided the resources and process-safety leadership required across its U.S. refineries. This is why practical accountability does not stop at the refinery gate.

The board controlled oversight design. A board does not calibrate a level transmitter. It determines whether management must present leading and lagging process-safety indicators, whether major hazards receive the same disciplined scrutiny as financial controls, whether independent audit findings remain open, whether executives are accountable for closure, and whether resource decisions that weaken safeguards are visible. Before Texas City, personal-injury measures received more attention than process-safety performance. A low rate of slips, trips, and ordinary injuries could not show whether a tower might overfill or a relief system might create a vapor cloud.

Regulators controlled standards and enforcement, but not daily operation. OSHA could inspect, cite, settle, monitor, and demand abatement. EPA and DOJ could enforce the Clean Air Act's accidental-release duties. Regulators could not operate the unit on March 23, but the CSB found that comprehensive process-safety inspection capacity was limited before the disaster. The later refinery national-emphasis program and extensive Texas City follow-up strengthened external challenge. The current EPA text of 40 CFR Part 68 is available through https://www.epa.gov/rmp/general-rmp-guidance-appendix-40-cfr-68; it provides the Risk Management Program framework that complements worker-focused PSM requirements.

Industry bodies controlled the shared engineering baseline. API could revise guidance on portable buildings, pressure-relief disposal, fatigue, and process-safety metrics. Consensus standards do not replace a company's legal duties or site-specific hazard analysis, but they influence what counts as recognized and generally accepted good engineering practice. The post-Texas City revisions therefore matter as system-level repair.

Contractors, workers, families, and neighbors carried exposure without equivalent control. Contractors performed turnaround work and occupied trailers selected or approved by others. Families had no role in startup authorization. Nearby residents depended on the refinery's containment and emergency systems. The asymmetry is the moral and operational basis for assigning the strongest duties to those with the greatest preventive power.

Cost pressure mattered through the controls it weakened

The CSB did not merely note that budgets were tight. It linked spending and organizational choices to process-safety capacity. Its report described reductions in maintenance, training, engineering, inspection, supervision, and turnaround expenditure. It found that the refinery accepted reductions without a sufficiently structured analysis of site-specific maintenance needs and that spending pressure affected decisions not to replace the ISOM blowdown system. It also found that senior leaders received warnings about plant condition and process-safety weaknesses.

The proper inference is not that cost control is inherently unsafe. Refineries must manage cost, schedule, reliability, and production. The supported inference is that across-the-board cuts become unsafe when they are not tested against the condition and hazard profile of each facility. A 25 percent target applied to a relatively healthy asset and the same target applied to an aging, unreliable refinery do not remove the same safety margin. Cost discipline becomes process-safety discipline only when the organization can show which inspections, repairs, staffing levels, training exercises, and safeguards will remain adequate after the change.

That is why the still-open CSB recommendation on organizational management of change is so important. OSHA's rule expressly covers changes to process chemicals, technology, equipment, procedures, and facilities affecting a covered process. It does not expressly list a merger, a staffing reduction, a reorganization, or a budget cut. Yet those changes can alter the human and financial capacity that makes every physical safeguard reliable. The open recommendation would force organizations to ask whether a nontechnical decision changes technical risk.

Metrics were another form of cost control. The Baker Panel found that BP emphasized personal safety and interpreted improving injury rates as evidence of acceptable process safety. Personal safety matters, but it measures a different failure class. A refinery can reduce common injuries while accumulating corrosion, overdue tests, alarm defects, open hazard-study actions, relief-system weaknesses, and abnormal startups. API's RP 754 page at https://www.api.org/products-and-services/standards/important-standards-announcements/754 describes the later four-tier framework for leading and lagging process-safety indicators. The lesson is not to abandon injury metrics; it is to prevent an easy metric from masking catastrophic risk.

Fatigue makes the same point at workforce level. The CSB found that key operators had worked 12-hour shifts for 29 or more consecutive days, and its 2025 digest says some key personnel had worked up to 39 consecutive days. Fatigue was assessed as a likely contributor, not the sole cause. API RP 755, described at https://www.api.org/products-and-services/standards/important-standards-announcements/recommended-practice-755, emerged from the post-incident recommendation and provides a framework for fatigue risk management. Scheduling is a cost and capacity choice; treating it as merely an individual's sleep problem evades the employer's control over work hours.

Operator error is a finding, not a stopping point

The public record confirms deviations from the written startup procedure. The bottom flow remained closed. Feed continued. Operators did not detect the true level. Those facts matter for competence, training, and procedure. But stopping there would contradict the structure of the investigation.

First, abnormal startup practices had become normal. Previous startups showed high levels, pressure swings, and departures from procedure. When a workaround repeatedly succeeds without immediate catastrophe, an organization can mistake survival for validation. A mature process-safety system investigates the deviation, corrects the procedure or the operation, and verifies the safeguard. Texas City did not convert those prior warnings into control improvement.

Second, operators were given weak information. The level transmitter showed only a small portion of the tower's height and was miscalibrated. A redundant alarm malfunctioned. The display did not provide an effective mass balance showing that material entered without leaving. Shift communication did not reliably preserve critical instructions. Human performance cannot be separated from interface, instrumentation, staffing, and communication design.

Third, procedure was being used as the least reliable safeguard against overfill. A procedure can guide action, but it cannot physically stop feed when the true level becomes dangerous. An independent high-high level trip, diverse indication, automatic feed isolation, or equivalent engineered layer would not depend on one tired operator correctly reconciling misleading signals. The CSB's recommendations called for effective instrumentation, multiple level indicators, suitable automatic controls, and clear display of tower material balance.

Finally, even a complete failure to prevent overfill did not have to kill people. A closed flare system could have safely managed or greatly reduced the release hazard. Proper siting could have kept trailers and nonessential personnel outside the blast area. Ignition control could have reduced probability. Accountability is layered precisely so that one error does not become 15 deaths.

This does not absolve every frontline decision. It places those decisions in the same causal map as the choices that defined workload, information, equipment, and consequence. Responsibility should be proportional to practical control and evidence, not proximity to the last valve moved.

Harm and cost cannot be compressed into a fine

The primary harm was human. Fifteen workers did not return home. One hundred eighty people were injured according to the CSB's final count. Families lost relatives, income, care, and future time. Survivors faced physical and psychological consequences. Contractors and employees learned that the buildings provided for their work could increase their vulnerability. The wider Texas City community was alarmed by an industrial event that sent smoke, fire, emergency activity, and uncertainty beyond the unit.

The CSB estimated financial losses exceeding $1.5 billion. That figure captures an economic scale, not the value of life. It also should not be combined casually with later enforcement or corrective-action amounts because categories can overlap. Production loss, property damage, claims, legal expense, remediation, fines, and later investment answer different questions.

The 2005 OSHA agreement included a $21,361,500 payment, recorded in OSHA's final exhibits at https://www.osha.gov/enforcement/bp/final-exhibits-to-bp-agreement. The 2010 failure-to-abate settlement required $50.61 million and at least $500 million allocated to a refinery safety program; the Department of Labor announcement is at https://www.dol.gov/intelligence team/releases/osha/osha20100805-0, and OSHA's fact sheet is at https://obis.osha.gov/dep/bp/bpsettlementfactsheet.html. The 2012 settlement added $13,027,000 for most of the additional citations, documented at https://www.dol.gov/intelligence team/releases/osha/osha20120712. These are final or settled enforcement amounts, unlike the earlier proposed $87.43 million headline.

DOJ's criminal resolution added a $50 million fine and probation. A separate 2010 Clean Air Act civil settlement over other fires, a leak, and reporting violations at the refinery imposed $15 million; DOJ and EPA described it at https://www.justice.gov/archives/opa/pr/bp-products-pay-largest-single-facility-clean-air-act-penalty-releases-hazardous-pollutants. That announcement also said BP had performed about $1.4 billion in corrective actions and would spend an estimated additional $500 million under OSHA and criminal-resolution requirements. Those government statements document scale, but they do not prove that every dollar produced an effective safeguard.

Private civil redress is not fully auditable from the sources used here. Settlements may be confidential, differently classified, or tied to individual claims. The article therefore does not state a comprehensive victim-compensation total. That unknown should remain visible rather than be filled with an unsupported number.

Enforcement showed both accountability and delay

The legal record matters because it tested several distinct duties. OSHA addressed workplace process-safety requirements. DOJ and EPA addressed Clean Air Act release-prevention and environmental duties. Courts addressed the criminal plea and victims' statutory rights. None of these records replaces the technical investigation, and the technical report does not determine every legal question.

The criminal case established corporate legal accountability beyond an administrative citation. DOJ stated that BP admitted that, from 1999 through the morning of the explosion, several procedures required to ensure mechanical integrity and safe startup had not been established or were being ignored. The plea, criminal fine, and probation did not identify a single human culprit for every failure. They attached a felony consequence to the corporate entity's conduct under the Clean Air Act.

The victims' challenge exposed a second accountability issue: who participates in the resolution. In In re Dean, the Fifth Circuit held that the government and district court had failed to accord victims the full rights provided by the Crime Victims' Rights Act when plea negotiations proceeded without timely consultation. The court denied extraordinary relief because victims later had meaningful opportunities to speak and the district court still had to consider the agreement. Both parts matter. A rights violation was found; the plea was not automatically undone. A fair account should not report only one half.

OSHA's follow-up revealed why closure evidence is essential. The 2005 settlement required broad evaluation and abatement. Four years later, the agency alleged 270 failures to abate and 439 new willful violations. BP disputed parts of that record, and later settlements reclassified, grouped, withdrew, or left some citations contested. The 2012 OSHA fact sheet at https://obis.osha.gov/dep/bp/FactSheet-BP-2012-Agreement.html reconciles the sequence and states that verification inspections found the failure-to-abate items corrected under the 2010 agreement. It also preserves the fact that some relief-valve citations remained in separate litigation.

This is not evidence that nothing changed after 2005. It is evidence that initial reform was incomplete and that external verification forced more work. Enforcement delay also transferred risk to workers who remained at the refinery during the abatement period. A durable system should not require a catastrophic event, a record settlement, a follow-up finding of hundreds of deficiencies, and another record settlement before engineering basics become demonstrably current.

The wider regulatory record also produced learning. OSHA created a refinery national-emphasis program. API and labor developed standards. Yet the CSB's organizational-change recommendation remains open. Regulatory accountability is therefore mixed: strong inspection and enforcement after the disaster, meaningful standard development, and an unresolved rule gap at the point where corporate cost and staffing choices enter the hazard system.

What the repair record actually proves

The repair record has several levels of evidentiary strength. The strongest site-specific evidence comes from regulatory agreements, independent expert work, inspection, and CSB recommendation closure. Company annual reports add useful detail but remain self-reporting.

OSHA's 2010 final exhibits say BP completed approximately 660 abatement actions imposed by the 2005 agreement. The listed work included shutting down and decommissioning the ISOM unit; correcting more than 300 process-safety, electrical, and other cited deficiencies; expanding safety and health training; commissioning a comprehensive PSM audit; responding to 220 of 228 expert recommendations it accepted; and implementing 100 recommendations from a pressure-relief review of selected units.

The same exhibit preserved OSHA's allegations that four safety-instrumented-system recommendations had not been implemented and that relief review should have extended further. Evidence should include both completion and dispute.

The 2010 settlement required more: evaluation of pressure-relief devices and systems, correction of deviations from recognized engineering practice, robust layer-of-protection analyses, interim controls, schedules across all 28 process units, independent experts, quarterly progress, and a board-level liaison for OSHA concerns. The $500 million allocation mattered because abatement without resources is not a plan. The 2012 verification that failure-to-abate items were corrected is stronger than a promise, although it does not establish that every future operating decision remained safe.

BP's 2007 annual report filed with the SEC at https://www.sec.gov/Archives/edgar/data/313807/000115697308000263/u54999_20f.htm reported that it removed temporary buildings from high-risk zones, took 17 relevant refinery blowdown stacks out of service, completed 50 major-accident risk assessments, strengthened auditing, and hired about 640 people across U.S. refineries in engineering, inspection, and process-safety support. Those statements are evidence of what BP publicly claimed and committed to at the time. They should be read alongside, not instead of, OSHA follow-up findings.

CSB recommendation closure provides another layer. Recommendations to BP addressed board expertise, incident reporting, process-safety indicators, instrumentation, maintenance history, near-miss reporting with the union, abnormal-situation training, startup staffing, knowledgeable supervision, and current startup procedures. The investigation page lists those BP-directed items as closed through acceptable action or acceptable alternative action. Closure means the CSB judged the response to meet or acceptably address the recommendation's objective.

It is not a guarantee against recurrence and is not equivalent to continuous compliance at every facility.

Industry repair widened the impact. API RP 753 addressed portable-building siting. RP 754 created process-safety performance indicators. RP 755 addressed fatigue. API also revised RP 521 on pressure-relief and depressuring systems. These changes turn one company's disaster into a shared engineering baseline. Their real value depends on adoption, audit, field implementation, and whether regulators and operators use the standards to challenge convenient but weak arrangements.

Repair also needs a time boundary. BP sold the Texas City refinery to Marathon in 2013. BP remained accountable for its historic conduct and legal obligations, while Marathon assumed current operational control over the acquired asset. A claim that "BP fixed Texas City forever" would ignore the ownership change and the need for ongoing maintenance. A claim that later conditions at the site automatically prove BP's repair would be equally unsupported.

The defensible conclusion is narrower: public records show substantial technical, organizational, enforcement, and standards-based repair, followed by a transfer of operational control.

Confirmed facts, supported inferences, and unknowns

Confirmed facts. The ISOM startup overfilled the raffinate splitter. Critical indication and alarm functions failed to show operators the true condition. Relief valves discharged to an atmospheric blowdown system, a vapor cloud formed, and ignition produced explosions and fire. Fifteen workers were killed and 180 injured. Occupied trailers were inside the hazardous area. Previous startups had shown abnormal behavior. Staffing, fatigue, procedure, maintenance, siting, and corporate oversight problems were documented. The CSB attributed the disaster to organizational and safety deficiencies at multiple levels. OSHA issued extensive citations and later found failures to abate. BP entered criminal, administrative, and civil resolutions. Most CSB recommendations were later closed, while the organizational-management-of-change recommendation remained open as of the access date.

Supported inferences. Cost and production pressure reduced safety margin because documented spending and staffing decisions affected training, maintenance, turnaround work, supervision, and replacement of hazardous equipment. The event would likely have been prevented or materially mitigated if independent overfill protection, reliable indication, a closed flare system, disciplined startup readiness, or safe trailer siting had been in place. The reliance on personal-injury rates weakened executive visibility into major-accident risk. These inferences follow official findings and control logic; they do not require assigning a private motive to every manager.

Unknowns. The public record used here does not reveal every internal discussion, subjective motive, work-order decision, capital-ranking model, legal settlement term, insurance recovery, individual medical outcome, or post-sale operating condition. It does not permit a complete allocation of the $1.5 billion-plus loss among property, interruption, claims, remediation, and other categories. It does not prove that every BP refinery or every later owner implemented each lesson with equal quality. It also cannot isolate how much each failed layer contributed to blast severity in a numerical causal percentage.

The distinction protects both rigor and fairness. Confirmed facts can support strong institutional conclusions. Supported inference can explain why control design matters. Unknowns prevent the analysis from becoming a story about hidden intent. Accountability does not require omniscience; it requires an evidence-based match between responsibility and control.

Counterfactual comparison: controls that change consequence

A useful counterfactual asks which available control would have broken the chain, not whether a perfect organization could have avoided all error.

Startup hold. If management had required repair and proof testing of the level transmitter and alarms before restart, operators would have had a more reliable picture and the startup might not have proceeded at all. The uncertainty is whether those repairs alone would have prevented every later action. The stronger counterfactual combines accurate indication with a formal readiness gate.

Independent overfill protection. If a separate high-high level device or material-balance safeguard had automatically stopped feed, the tower could not have continued filling solely because the primary indication was wrong. This is stronger than asking the same operator to interpret another alarm generated by the same failure chain. It directly addresses common-cause and human-response risk.

Closed relief disposal. If the relief valves had discharged to a properly designed flare or other closed system, overpressure protection would not have ejected a large flammable inventory into the work area. The CSB stated that a flare would have prevented or greatly minimized the accident's severity. This counterfactual does not depend on predicting which vehicle ignited the cloud because it prevents the cloud from forming where people and ignition sources were present.

Safe siting. If temporary trailers and nonessential workers had been outside the modeled blast area, the event could still have damaged equipment, but the mass-casualty exposure would have been radically different. The official record of the 2018 Husky Superior refinery explosion at https://www.csb.gov/husky-energy-superior-refinery-explosion-and-fire/ provides an imperfect but instructive comparison. Thirty-six workers were injured and the event caused major damage, yet the CSB noted that many workers had moved into blast-resistant buildings or away from the unit during a break. Its Texas City anniversary digest also notes that the Superior refinery had relocated contractor trailers and later required blast-resistant units. This is not a controlled experiment and does not prove that siting alone explains the absence of deaths. It supports the narrower inference that separating people from process hazards changes exposure when prevention fails.

Staffing and abnormal-situation management. A second trained board operator, a knowledgeable supervisor, effective shift handover, and realistic simulator practice could have challenged fixation on the misleading level reading. Fatigue limits could have improved attention and judgment. These are administrative and human-performance controls, so they are less independent than an automatic trip, but they add diversity to the defense.

Organizational management of change. If budget, staffing, and reorganization decisions had required a documented process-safety review, decision-makers would have had to identify which safeguards, competencies, inspections, and action-item closures the cuts affected. The review might have rejected the change, funded compensating controls, or exposed the remaining risk to higher authority. It cannot be claimed with certainty that paperwork would have prevented the event. The counterfactual depends on a review with real authority, accurate data, and enforceable closure.

These comparisons show why the accident was preventable without pretending that one silver bullet existed. Multiple controls were available, and several would have prevented release or separated workers from its consequences. Durable accountability requires preserving that redundancy.

Later evidence tests whether learning traveled

The durability question extends beyond one repaired unit. In September 2022, a fatal naphtha release and fire occurred at the BP-operated Toledo refinery. The CSB's investigation page at https://www.csb.gov/bp---husky-oregon-chemical-release-and-fire-/ records two deaths, major property loss, an alarm flood, liquid overflow, weak abnormal-situation management, and missed learning from an earlier event. The CSB explicitly identified similarities between the Toledo and Texas City overflow scenarios.

That comparison must be bounded. Toledo involved different equipment, a different sequence, different people, and a refinery later acquired by another company. It does not prove that the Texas City settlement work was false or that the same managers made the same decisions. It does show that enterprise learning cannot be inferred solely from closing action items at one site. If a company claims a lesson is corporate, the test is whether hazard analysis, alarm management, overflow protection, stop-work authority, and incident learning travel across facilities and survive changes in leadership and ownership.

The Toledo record also reinforces the hierarchy of controls. Operators faced thousands of alarms and a cascading abnormal situation. When a process depends on improvised human response after safeguards fail, the same accountability pattern returns: who designed the alarm philosophy, who ensured independent overflow protection, who turned earlier findings into action, and who had authority to shut down? The comparison is relevant because the failure pattern, not the exact hardware, is what process-safety governance is supposed to learn.

Industry standards provide another travel mechanism. Portable-building rules, fatigue systems, process-safety metrics, and safer relief guidance can reach firms that were not part of the original incident. The CSB's 2025 digest treats those changes as positive industry outcomes. But a published standard is only potential control. Verification requires site hazard studies, engineering records, workforce participation, inspection, tests, drills, and evidence that findings are closed before operation.

The durable accountability test

Texas City passes a durable accountability test only if the evidence remains usable after the headlines, settlements, leadership changes, and sale of the refinery.

First, the technical file should prove startup safety. It should identify the credible overfill scenarios; show independent and correctly calibrated level indication; document alarm set points and proof tests; demonstrate automatic protective action or justified alternatives; show inlet and outlet material balance; validate procedures against actual operating practice; and require a pre-startup review that can stop work. A closed action item without test results is not enough.

Second, the consequence-control file should prove that a failed prevention layer does not become a mass-casualty event. Relief studies should cover liquid as well as vapor scenarios, disposal should avoid atmospheric flammable discharge where a vapor-cloud hazard exists, ignition control should be credible, and occupied buildings should be located or constructed for the modeled fire, toxic, projectile, and blast hazards. Temporary convenience must never outrank life safety.

Third, the human-performance file should show adequate staffing, supervision, shift handover, fatigue limits, competency assessment, abnormal-situation drills, usable control-room displays, and worker authority to stop a startup. It should distinguish blame from learning. An organization that disciplines the last operator but leaves misleading instruments and impossible workload unchanged has not repaired the system.

Fourth, the mechanical-integrity file should show that safety-critical defects are repaired before use or managed through documented, time-bounded controls that genuinely assure safe operation. Work-order age, overdue inspection, alarm impairment, safety-instrumented-system bypasses, relief-device condition, and repeated failures should reach leadership as leading indicators. Deferred work should identify who accepted the risk, for how long, on what evidence, and with what compensating protection.

Fifth, the cost and organizational file should subject budget cuts, staffing changes, mergers, reorganizations, outsourcing, and turnaround compression to formal safety review. The review should quantify affected safeguards and competencies, include worker and process-safety expertise, name accountable approvers, preserve dissent, and prevent production from resuming until required actions close. This is the unresolved regulatory lesson in the CSB record.

Sixth, the governance file should let executives and the board see catastrophic risk directly. Leading indicators should include overdue critical maintenance, open hazard-analysis actions, impaired protective layers, alarm floods, containment loss, repeat incidents, procedure deviations, fatigue exposure, and audit closure quality. Lagging personal-injury rates remain useful, but they cannot stand in for these measures. Compensation and advancement should not reward production or cost performance achieved by carrying hidden process risk.

Seventh, the regulatory and redress file should preserve citations, settlements, disputed items, verification results, victim participation, and community impact without collapsing them into a public-relations total. The Fifth Circuit record shows that affected people must be heard before a criminal resolution becomes effectively fixed. The OSHA record shows that follow-up inspection is necessary to distinguish promised abatement from completed abatement.

Finally, the learning file should travel. A lesson from Texas City should appear in every relevant BP-era facility, in successor-owner systems, in industry standards, and in regulator inspection practice. Later incidents should trigger comparison against the original findings, not be treated as isolated surprises. Ownership transfer should include the status and evidence for safety-critical commitments so that a sale does not reset institutional memory.

The record through July 15, 2026 supports a sober conclusion. BP and the industry made substantial repairs; regulators imposed significant consequences; standards changed; and the CSB closed most recommendations. The same record also shows delayed abatement, a victim-rights violation, later overflow parallels at another BP-operated refinery, and one still-open rulemaking recommendation at the junction of cost, staffing, and safety. That is why Texas City remains an accountability test rather than a closed historical episode.

Process safety is durable only when the authority to spend less is matched by a documented duty to prove that less spending has not purchased more risk.