🚨 When a small change turns into a big disaster

When a New Part Brings a Big Disaster: The Texas City Refinery Incident & MoC Lessons

Incident Brief — MoC Failure at Texas City Refinery

In 2005, at BP’s Texas City Refinery in Louisiana, a serious fire broke out in one of the process units. The cause? During a maintenance overhaul, contractors swapped a piping elbow made of carbon steel into a hydrogen-rich, high-temperature environment — replacing what should have been an alloy steel elbow resistant to hydrogen attack. Cobbled into a line previously designed for alloy steel, the carbon steel elbow failed catastrophically under service. 

The failure happened roughly three months after installation, when the elbow ruptured, releasing high-pressure hydrogen gas which ignited, leading to a large fireball. There were serious injuries and significant damage. 

How MoC Failed

• Incorrect Part with No Formal Review: The new/replacement part (carbon steel elbow) was visually similar to the correct material (alloy steel) and was selected without a proper check of material compatibility. There was no system in place to enforce materials verification or tag critical components clearly. 

• Absence of Adequate Risk Assessment / Change Control: The change — replacing an elbow — was significant because of the process conditions (hydrogen, high temperature, possibility of hydrogen attack). But this alteration was not evaluated using MoC or PHA (Process Hazard Analysis) before the change. 

• Poor Documentation & Communication: There was no awareness across the maintenance / operations teams that the part installed did not meet required specification. The documentation or specification of parts was not adequately enforced. 

• Design Vulnerability: The piping configuration allowed for critical components to be interchanged without obvious distinction; parts looked similar. This made human error likely. MoC procedures should have flagged and prevented this. (Wikipedia)

What is Management of Change (MoC)

Given incidents like this, MoC is the framework meant to prevent exactly the kind of failures above.

Management of Change is a formal, structured process that ensures all changes to processes, equipment, materials, personnel, procedures, or plant configuration are evaluated for hazards, reviewed, approved, implemented, and monitored. Key elements typically include:

1. Identification of change: Recognize what is changing — whether installing a new component, replacing a part, changing material, or even organizational changes.

2. Risk / hazard assessment: Analyze what hazards may be introduced by the change: compatibility, operating conditions, failure modes, impact on safety/environment.

3. Stakeholder review & authorization: Involve engineering, operations, maintenance, safety, materials / procurement, quality, etc., to review and approve the change.

4. Specification & verification: Ensuring correct material specs, supplier qualification, part marking, tagging, traceability.

5. Implementation plan: How and when the change is made; ensuring correct installation, proper testing, methods to mitigate risk during transition.

6. Communication & training: Ensuring that everyone affected (operators, maintenance personnel, management) knows about the change, understands implications.

7. Documentation: All steps, decisions, specifications, approvals, verification must be recorded.

8. Post-implementation monitoring & review: Checking that change has the desired effect and no unexpected consequences.

How Applying MoC Properly Could Have Prevented Texas City Type Incident

If a robust MoC process had been in place, aligned with best practices, the following would likely have prevented the failure:

Other Industrial Examples

Here are a couple of other industrial incidents where improper change / modifications without proper MoC led to failures:

• Flixborough Disaster (1974, UK): A temporary bypass pipe was installed to replace a removed reactor section; the bypass was designed poorly, causing a leak of hot cyclohexane that exploded. The modification was done without adequate engineering design review, risk assessment, or management oversight. (Wikipedia)

• Williams Olefins Plant Explosion (2013, USA): A standby heat exchanger, isolated after maintenance, was assumed safe but became filled with hydrocarbon fluid; when it was brought back into service, the fluid vaporized and led to explosion. Part of the issue was that the change (bringing the exchanger online) did not have a clear process hazard review or verification to ensure it was safe. (Wikipedia)

Lessons & Best Practices

From Texas City and other incidents:

• Treat all part replacements / modifications as MoC items, even if they seem minor or routine.

• Ensure material compatibility and specification enforcement. Use part tagging, material certificates, supplier quality.

• Prevent interchangeability of critical components unless they are designed for that service; avoid look-alike parts that can be misinstalled.

• Institute robust review & sign-off involving multiple disciplines (maintenance, design, safety, materials).

• Use design tools like PHA, HAZOP, what-if analysis to evaluate changes, even small ones.

• Make sure documentation, training, communication support the change.

• Monitor and audit: After change, verify performance and check for early warning signs.

Conclusion

Installing the wrong elbow, or replacing a part without verifying specifications, seems like a small error — but in high-hazard settings, that small change can turn fatal. The Texas City refinery incident is a stark reminder that Management of Change must not be treated as a box-ticking exercise. It must be a living system that stops unsafe changes before they happen.