In early 2005, BP's own safety business plan for the Texas City refinery listed a specific risk by name: that the site could kill someone within the next 12 to 18 months.
The same plan, and the years of effort behind it, could point to real progress. Slips, trips, falls and vehicle incidents, the things most safety programmes are built to count, had been falling. Texas City was, on the numbers most sites report, getting safer.
On 23 March 2005, a distillation tower on the site's isomerisation unit overfilled, vented flammable liquid through a blowdown stack with no flare, and the vapour cloud found an ignition source. Fifteen people died. A hundred and eighty were injured. The blast destroyed 13 contractor trailers and damaged 27 more; people were hurt inside trailers 479 feet from the unit.
Two kinds of safety, one scoreboard
The US Chemical Safety Board's investigation found that BP's improvement work between 2002 and 2005 was "largely focused on personal safety, such as slips, trips, falls, and vehicle accidents," in the words of CSB supervisory investigator Don Holmstrom, rather than on process safety performance, which the CSB said continued to deteriorate over the same period. A 2004 internal BP audit had already found widespread tolerance of non-compliance with basic health, safety and environment rules across 35 business units. An internal survey that year, the Telos report, recorded staff saying plainly that production and budget compliance got rewarded before anything else.
This is the gap a Zero Harm or Target Zero slogan tends to paper over. Personal safety covers the things that hurt one person at a time: a fall, a strain, a vehicle reversing into someone. It is visible, countable, and genuinely worth reducing. Process safety covers the things that can kill many people at once: a vessel overpressuring, a relief system that can't cope, a flammable cloud finding an ignition source. The two don't move together. A site can drive its personal injury rate to zero while a catastrophic hazard sits completely unmanaged, because the metric on the wall was never built to see it.
Texas City had both problems at once. Staffing in the isomerisation unit's control room had been cut from two operators to one, a staffing decision Nobody Fell Asleep at Texas City looks at in more depth. A relief valve adequacy study was 13 years overdue. The unit's blowdown stack vented straight to atmosphere instead of to a flare, a design the site had lived with for years. None of that shows up in a lost-time injury rate. All of it showed up in the explosion.
A reduction in personal injuries does not necessarily mean a reduction in the risk of a catastrophic accident. The two scores can move in completely opposite directions, and usually nobody notices, because only one of them is on the wall.
When the scoreboard becomes the objective
People manage what an organisation measures. If management meetings run almost entirely on lost-time injuries, recordable rates, days without an accident, and the number of toolbox talks completed, those become the things people prioritise. Not necessarily because anyone is deliberately ignoring process safety, but because the incentive structure rewards visible performance over proven risk control, the same drift Familiarity Is Not Control traces through the same site's leadership culture in the years before the explosion.
A safety performance indicator is supposed to help an organisation understand its exposure to risk. When the indicator becomes the objective in its own right, that purpose gets lost. A falling injury rate may look encouraging. A growing list of overdue safety-critical inspections, sitting one floor down from the same report, can tell a very different story, and neither number means much read in isolation, particularly once either one starts influencing bonuses or how competent a site is assumed to be.
What Zero Harm should mean, and rarely does
None of this argues against chasing zero injuries. A falling injury rate genuinely reflects fewer people getting hurt, and that's worth having on its own terms. What doesn't hold up is treating that one number as proof the organisation is safe, the same documentation-equals-safety assumption The Illusion of Safety traces through the Nimrod Safety Case. Zero Harm as an aspiration is admirable; Zero Harm as a measurement of whether a site is safe is a different claim, and it's the one that fails, because the number it's built from was never designed to see a catastrophic hazard coming.
The fix the CSB and the later Baker Panel review pushed for wasn't abandoning personal safety metrics. It was adding a second set that tracks the thing personal safety metrics can't see: process safety performance indicators, built around leading measures like overdue inspections, bypassed safety instrumented systems, and time-expired relief valve studies, alongside lagging measures of loss of containment. HSE's HSG254, Developing Process Safety Indicators, sets out the same logic for UK high-hazard sites: track the status of your barriers, not just the absence of recent injuries. The American Petroleum Institute's RP 754, developed in direct response to Texas City, does the equivalent for the US refining and petrochemical sector.
| Leading indicators | Lagging indicators |
|---|---|
| Overdue safety-critical inspections | Loss of primary containment |
| Overdue proof testing | Fires and explosions |
| Safety instrumented system bypasses | Significant chemical releases |
| Overdue mechanical integrity actions | Process safety incidents |
| Outstanding HAZOP recommendations | Unplanned emergency shutdowns |
| Critical equipment impairment | Major accident events |
These should be risk-weighted, not simply counted. Ten overdue low-risk actions are not necessarily more concerning than one overdue action on a single critical protection layer, and a leading indicator is only useful if it measures the health of a barrier, not just whether a form was signed on time.
A site running both sets honestly will sometimes report a falling injury rate next to a rising count of overdue process safety actions. That's not a contradiction. It's two different questions getting two different, honest answers, which is the entire point of measuring more than one thing.
Five things to check tomorrow
Find out what your main safety KPI actually measures. If it's injury rate, recordables or days since a lost-time incident, ask what it tells you about the condition of your process safety barriers, and what it leaves out.
Pull the overdue list. Overdue inspections, overdue proof testing, bypassed safety instrumented systems, outstanding HAZOP or LOPA recommendations, expired permits on safety-critical equipment.
Compare the two trends directly. Is your injury rate falling while overdue maintenance, equipment impairments or loss-of-containment events are rising? If nobody's ever put the two charts side by side, that's the gap this article is about.
Find out what happens when a critical safeguard is unavailable. Is there a clear impairment procedure: compensating measures, escalation, and a defined point at which operations get restricted or stopped?
Ask what "Zero Harm" means on your site, specifically. Does it cover occupational injuries, process safety, environmental releases and major accident hazards, or has it quietly become shorthand for a good injury statistic?
The question worth asking
BP's own 2005 plan named the risk correctly. Texas City could kill someone within 12 to 18 months. The organisation wrote that down, and kept reporting a safety record built almost entirely from a different kind of number.
Zero Harm isn't a dangerous idea. A target with no stated scope, standing in for the whole of safety when it only ever measured part of it, is the dangerous part.
A site can have zero reported injuries and still be one process failure away from catastrophe.
What would your site's safety scoreboard have to include before "zero" meant what everyone assumes it means?
Sources
- U.S. Chemical Safety Board: Organizational and safety deficiencies at all levels of the BP Corporation caused March 2005 Texas City disaster — CSB
- CSB Investigation Digest: BP Texas City — U.S. Chemical Safety Board
- HSG254: Developing process safety indicators — Health and Safety Executive
- API Recommended Practice 754: Process Safety Performance Indicators — American Petroleum Institute