Lessons Learned from the US Chemical Safety

and Hazard Investigations Board

presented at

The IAEA International Conference on Human

and Organizational Aspects of Assuring

Nuclear Safety – Exploring 30 Years of Safety

Culture

Presented by Mark Griffon

Mark Griffon Consulting LLC

February 24, 2016

WHAT IS THE CSB? An independent U.S. federal agency

investigating chemical accidents promoting prevention – public knowledge

Authorized by Congress in 1990 Five Board Members; approximately 45 staff Modeled after NTSB

Intent of CSB investigations are to get to root

cause(s) and make recommendations toward prevention

Not regulatory; no enforcement authority

CSB Investigation Approach

Formal analysis to identify underlying technical, human

factor, management system, organizational and

regulatory causes of the incident.

Beyond immediate technical events and individual actions

Focus is on improving safety NOT assigning blame

Addressing the immediate cause ONLY prevents that

exact accident from occurring again.

CSB, Chevron Report, 2012

19 potential worker fatalities, 6 injuries,

15,000 people sought medical treatment

Oxygen

source

Ignition

source

People

present

“Hot Zone” not

of sufficient size

to protect

personnel

Released

process fluid

autoignitedLeak in

4-Sidecut line

4-Sidecut piping component was extremely thin

No formal method to communicate,

implement, oversee and track to

completion ETC findings and

recommendations

Line constructed of variable

corrosion rate-prone carbon

steel

Turnaround

team relied

on

inspection

data

Flammable

material

released

PHYS

ICAL E

VENT

S AND

CON

DITIO

NSOU

TCOM

ECH

EVRO

NIND

USTR

Y COD

ES

AND S

TAND

ARDS

Increased sulfidation

corrosion rates in low-

silicon carbon steel

Decision to remove insulation to identify

leak location rather than

shut down unit

Essential process safety analyses

not required by regulator

No requirement for ALARP

No Damage

Mechanism

Hazard Review

performed

Thorough

safeguard

evaluation not

conducted in PHA

Refer to Chevron Regulatory Report

Refer to Chevron Interim Investigation Report

Refer to Chevron Final Investigation Report

LEGEND

Chevron reliability

programs not effective

to implement ETC

Sulfidation Failure

Prevention Initiative

No guiding emergency leak

response protocol in place

100% component inspection not in

Richmond Inspection Plan

Consequences of potential

damage mechanisms

were not evaluated

Unit

metallurgists

were not

consulted

Minimal industry

emergency leak response

protocol requirements

Inconsistent API

standards

API does not

require 100%

component

inspection

Regulatory regime

reactive and activity-based

rather than goal-based

Regulators had little input

into safety precautions in

the refinery.

Assumption that

non-inspected

components were

of sufficient

thicknessImportant safety projects not

brought to management rather

than IMPACT team for

approval if outside framing

document requirements

Requests for

replacement or

100% inspection

outside of framing

document

requirements

Low-silicon component

not inspected

Inspection data did

not indicate pipe

was thin

Risk of catastrophic

failure not perceived by

decision makers

Trust in

management

Stop Work

uncommon

for shutting

down plant

“Stop Work”

not called

Past practice is to

keep running with

a small leakRecommendations to

replace or 100% inpect

4-Sidecut line not

implementedT-Min lowered so 4-sidecut

could stay in operation

Chevron

did not

use API

574

default

values

Chevron

allowed

inspector

to lower

alert

thickness

No MOC

performed

to

evaluate

risk of new

T-Min

Thorough inherently safer

systems analysis not

conducted in PHA

Regulator does not require or

oversee safety culture

assessment follow-up action

items

BP Texas City

• March 23, 2005

• 15 deaths and 180 injuries

• During startup, tower and blowdown drum overfilled

• Liquid hydrocarbon released, vapor cloud formed and ignited

• Explosion and fire

CSB Investigation • Most extensive investigation in CSB history

• Conducted 370 interviews

• Reviewed over 30,000 documents

• Assessment of 5-years of electronic data from the

computerized control board system

• Based on human factors framework (Reason, 1997)

and methodologies used in investigations of other

catastrophic incidents, such as Bhopal and Chernobyl

Baker panel findings

BP had not provided effective process safety leadership

BP had not established an open trusting relationship between management and the workplace

Lack of a unifying process safety culture

Personal Safety emphasis; not process safety

Reliance on low LTIR gave misleading risk indicator

Cost cutting pressures seriously degraded infrastructure

Mgmt failed to assess impact of cost and staff reductions on safety

Safety Culture Attributes the degree to which the workforce feels “empowered” as to process

safety

the extent to which the workforce feels free to report safety-related incidents

the process safety awareness, knowledge, and competency of the workforce;

relationships and trust between different workforce / management and contractors

whether deviations from policies and procedures are tolerated;

the extent of information flow at all levels

whether the workforce has a shared belief that safety comes first, regardless of financial, scheduling, or cost objectives; and

the extent to which the workforce is vigilant about process safety risks, continuously tries to reduce them, and seeks to learn from incidents and near misses.

5+ Years Later …..

Lessons Learned??

Macondo

April 20th, 2010

11 deaths

> 60 injured

~5 million barrels of oil

spilled in Gulf over 80+ days

Tremendous Economic

Impact

CSB Investigation

Examine specifics of organizational factors Staffing and organizational structure (changes)

Safety Metrics

Awards and Bonuses

Cost and Performance Pressures (cost and production goals)

Human factors analysis of how mistakes occurred Reliance on human intervention

Evidence / Explanations for “inexplicable” decisions leading up to the incident

Control / display panels

Decision making process

Macondo Safety Culture

“Government oversight must be accompanied by

sweeping reforms that accomplish no less

than a fundamental transformation of its safety

culture” (POSC)

“The lack of a strong safety culture resulting from

deficient overall systems approach is evident in

the multiple flawed decisions that led to the

blowout.” (NAE)

Chevron

Refinery,

Richmond, CA

August 6, 2012

Flammable Vapor

release and Fire

6 Injured

~ 15,000 sought

medical treatment

California PSM Reform

Employee Participation

Process Safety Culture Assessment

Human Factors

Management of Organizational Change

10+ years after BP Texas City ……

How are things going?

Maintaining Safe Production Cut exploration

Reduce manning

Reduce training

Reduce maintenance

Focus on today, not

tomorrow?

UK HSE, S. Mackenzie, 2015

<$50

Safety Performance

Personal

Process

UK HSE, 2015

Cautions / Challenges “the popularity of the concept has been

counterproductive and there is a danger of it becoming meaningless” (M. Fleming, ‘Regulator’s Guide to Safety Culture and Leadership’)

Overemphasis on the sharp end (front line worker) rather than the blunt end (organizational / management)

Risk Tolerance

How is it defined and who defines it

Safety culture study / change must consider inequalities of power and authority

Cautions / Challenges

Unified safety culture vs. understanding different sub-

cultures within an organization and optimizing how they

work together

Focus on Organizational Culture(s) influence on safety

rather then Safety Culture

Trusting and Reporting culture

Look at the real effect of resource limitations on safety

Will Off-Shore Drilling and Refinery Safety

be transformed like the Nuclear Industry?

Nuclear Industry, post TMI, developed a real belief that “if one of us fails, we all fail”

Nuclear Industry agreed to collect and share accident, near miss and indicator data (thru INPO)

Unclear whether same climate exists in Oil and Gas Industry Deepwater was ‘just a rogue operator’

Sharing of ‘lessons learned’, accident data, and near miss data is limited

Reaction to the price of oil

Public Reaction

Thank You