September 2007 Safety MeetingSeptember 2007 Safety Meeting

BP TEXAS CITY EXPLOSIONBP TEXAS CITY EXPLOSION

3-23-05 (video)3-23-05 (video)

ISOM UNITISOM UNIT

Closed

ClosedSight-glass dirty & unreadable – Level

transmitter not calibrated

Indicated 10 ft and falling

Inoperative

Inoperative

Redundant Alarm Inoperative

Event PreventionEvent Prevention

Significant Event

Management Defenses

Program Defenses

Job Specific Planned Defenses

Error Precursors

Latent OrganizationalWeaknesses:

Poorly written procedures,Processes and or

Ineffective Management

Active Errors:Tasks demands,

work environment,individual capabilities,

human nature.

Less than adequate identification of hazards for the job and/or lessthan adequate planned barriers

to mitigate hazards.

Perform Work

The CausesThe Causes Actions and errors by operations Actions and errors by operations

personnel were the immediate causes of personnel were the immediate causes of the accidentthe accident

Latent conditions and safety system Latent conditions and safety system deficiencies influenced personnel deficiencies influenced personnel actions and contributed to the accident - actions and contributed to the accident - and collectively influenced the decisions and collectively influenced the decisions and actions of operations personneland actions of operations personnel

Safety system deficiencies created a Safety system deficiencies created a workplace ripe for human errorworkplace ripe for human error

Personnel Actions & ErrorsPersonnel Actions & Errors

Required pre-start actions not completedRequired pre-start actions not completed– Pre-Startup Safety Review not performedPre-Startup Safety Review not performed– Key malfunctioning instrumentation not repairedKey malfunctioning instrumentation not repaired– Malfunctioning pressure control valve not repaired -- Malfunctioning pressure control valve not repaired --

supervisor signed off on startup procedure that supervisor signed off on startup procedure that control valves had tested satisfactorilycontrol valves had tested satisfactorily

– Functionality checks of alarms and instruments not Functionality checks of alarms and instruments not completedcompleted

– Review of startup procedures by operators and Review of startup procedures by operators and supervisors not completedsupervisors not completed

Night Lead Operator did not use startup Night Lead Operator did not use startup procedure or record completed steps when procedure or record completed steps when startup was partially completed on night shiftstartup was partially completed on night shift

Personnel Actions & Errors (Cont’d)Personnel Actions & Errors (Cont’d) Night Lead Operator left an hour before end of Night Lead Operator left an hour before end of

shiftshift ISOM-experienced Day Supervisor A arrived over ISOM-experienced Day Supervisor A arrived over

an hour late - did not conduct shift turnover with an hour late - did not conduct shift turnover with night shift personnelnight shift personnel

Day Supervisor B was told that startup could not Day Supervisor B was told that startup could not proceed because storage tanks were full - not proceed because storage tanks were full - not communicated to ISOM operations personnelcommunicated to ISOM operations personnel

Day Board Operator closed automatic tower level Day Board Operator closed automatic tower level control valve – although procedure required valve control valve – although procedure required valve to be placed in “automatic” and set at 50 percentto be placed in “automatic” and set at 50 percent

Day Supervisor left the plant due to family Day Supervisor left the plant due to family emergency as unit was being heatedemergency as unit was being heated

Latent Organizational WeaknessesLatent Organizational Weaknesses Work environment encouraged procedural Work environment encouraged procedural

noncompliancenoncompliance Ineffective communications for shift change and Ineffective communications for shift change and

hazardous operations (such as unit startup)hazardous operations (such as unit startup) Malfunctioning instrumentation and alarmsMalfunctioning instrumentation and alarms Poorly designed computerized control system Poorly designed computerized control system Ineffective supervisory oversight Ineffective supervisory oversight Insufficient staffingInsufficient staffing Lack of a human fatigue-prevention policyLack of a human fatigue-prevention policy Inadequate operator training for abnormal and Inadequate operator training for abnormal and

startup conditionsstartup conditions Failure to establish effective safe operating limitsFailure to establish effective safe operating limits

Latent Organizational Weaknesses (Cont’d)Latent Organizational Weaknesses (Cont’d)

Ineffective incident investigation management Ineffective incident investigation management system system

Ineffective lessons learned program Ineffective lessons learned program No coordinated line management self-No coordinated line management self-

assessment processassessment process No flare on blow down drum No flare on blow down drum No automatic safety shutdown systemNo automatic safety shutdown system Key operational indicators and alarms inoperativeKey operational indicators and alarms inoperative Ineffective response to serious safety problems Ineffective response to serious safety problems

and eventsand events Focus on injury and illness statistics, not process Focus on injury and illness statistics, not process

safetysafety

Poor implementation of Process Hazards Poor implementation of Process Hazards Analyses (PHA) and Management of Change Analyses (PHA) and Management of Change (MOC) processes (equivalent to USQ)(MOC) processes (equivalent to USQ)

Ineffective follow-up on audit reportsIneffective follow-up on audit reports Problem reporting not encouragedProblem reporting not encouraged Inadequate implementation of OSHA Process Inadequate implementation of OSHA Process

Safety Management regulationsSafety Management regulations Inadequate OSHA inspections and enforcementInadequate OSHA inspections and enforcement Gaps in applicable industry standardsGaps in applicable industry standards

Latent Organizational Weaknesses (Cont’d)Latent Organizational Weaknesses (Cont’d)

DOE Safety Advisory 2007-02DOE Safety Advisory 2007-02April 2007April 2007

““In order to achieve continuous In order to achieve continuous improvement in the operation of DOE improvement in the operation of DOE facilities, it is important to foster a safety facilities, it is important to foster a safety culture that sets and maintains high culture that sets and maintains high standards; identifies and resolves problems standards; identifies and resolves problems and deficiencies; is open to criticism and and deficiencies; is open to criticism and recommendations for improvement; and recommendations for improvement; and promotes effective communication between promotes effective communication between line managers and independent oversight.”line managers and independent oversight.”

Process Safety, Process Safety, DOEDOE & OSHA & OSHA

ISMSISMS DSADSA QAQA Procedures and Procedures and

TrainingTraining AssessmentAssessment Emergency Emergency

PreparednessPreparedness Incident Incident

InvestigationsInvestigations SWESWE HPIHPI

OSHA 1910.119 App C

Process Safety Management Guidelines

The major objective of process safety management is to prevent unwanted release of hazardous chemicals which could expose employees and the public to serious hazard.

Event Prevention HandbookEvent Prevention Handbook Provides Additional Tools to Enhance Safety Provides Additional Tools to Enhance Safety

PerformancePerformance Describes the Critical Task Concept Describes the Critical Task Concept Provides a listing of Error Precursors that can lead Provides a listing of Error Precursors that can lead

to Error Likely Situations to Error Likely Situations Provides guidance and a Framework for the Provides guidance and a Framework for the

Following ToolsFollowing Tools– SAFER DialogueSAFER Dialogue– Self-Checking Self-Checking – Peer CheckingPeer Checking– Effective CommunicationsEffective Communications– Procedure Use and AdherenceProcedure Use and Adherence– Stop in Face of UncertaintyStop in Face of Uncertainty– Questioning AttitudeQuestioning Attitude– Pre-Job BriefingsPre-Job Briefings– Work Site Hazard AnalysisWork Site Hazard Analysis

Event Prevention HandbookEvent Prevention HandbookCritical taskCritical task

Not all aspects of a job are equally important. Not all aspects of a job are equally important. Some actions/tasks are irrecoverable-- once the Some actions/tasks are irrecoverable-- once the

action is taken, it cannot be reversed and undone action is taken, it cannot be reversed and undone Some steps have more chances for error, and Some steps have more chances for error, and

questions should be asked before commencing: questions should be asked before commencing: – Is the outcome of the error intolerable from a personnel Is the outcome of the error intolerable from a personnel

safety or facility perspective?safety or facility perspective? The concept of the The concept of the critical taskcritical task focuses attention focuses attention

on potential consequences so that:on potential consequences so that:– Appropriate defenses and contingencies can be plannedAppropriate defenses and contingencies can be planned– Workers can look for error precursors that may Workers can look for error precursors that may

negatively impact the job negatively impact the job

Event Prevention HandbookEvent Prevention HandbookError Precursors Error Precursors

Error precursorsError precursors are unfavorable are unfavorable conditions at the job site that create conditions at the job site that create a mismatch between the task and the a mismatch between the task and the individual. individual.

Event Prevention HandbookEvent Prevention HandbookSAFERSAFER Questions Questions

SSummarize the critical steps.ummarize the critical steps. AAnticipate What Error Traps might exist (Error nticipate What Error Traps might exist (Error

Precursors). Precursors). FForesee what is the worst thing that could oresee what is the worst thing that could

happen to me, the facility, or the equipment. happen to me, the facility, or the equipment. (Consequences)(Consequences)

EEvaluate what kind of defenses the work valuate what kind of defenses the work team has.team has.

RReview others experiences.eview others experiences.

Event Prevention HandbookEvent Prevention HandbookSampleSample ToolsTools

STAR STAR Peer CheckingPeer CheckingEffective CommunicationsEffective CommunicationsProcedure AdherenceProcedure AdherenceStop in the Face of UncertaintyStop in the Face of UncertaintyQuestioning AttitudeQuestioning AttitudePre-job BriefingsPre-job BriefingsWork Site Hazard AnalysisWork Site Hazard Analysis

Event Prevention HandbookEvent Prevention HandbookTools (continued) Tools (continued)

STARSTAR is a common is a common self-checkingself-checking practice:practice:– SStop (pause; focus; eliminate distractions)top (pause; focus; eliminate distractions)– TThink (verify action is appropriate; understand hink (verify action is appropriate; understand

expected results; consider contingencies if expected results; consider contingencies if unexpected results occur)unexpected results occur)

– AAct (perform the correct action on the correct ct (perform the correct action on the correct component)component)

– RReview (verify results, perform contingencies if eview (verify results, perform contingencies if required; make notifications)required; make notifications)

Event Prevention HandbookEvent Prevention HandbookTools (continued)Tools (continued)

Peer-checking Peer-checking allows another individual to allows another individual to observe or check the work of a performer to observe or check the work of a performer to ensure correct performance of a specific set of ensure correct performance of a specific set of actions. actions.

EEffective communicationffective communication is mutual understanding is mutual understanding between two or more people, especially between two or more people, especially communication involving technical information communication involving technical information related to operations or personnel safety. related to operations or personnel safety.

Event Prevention HandbookEvent Prevention HandbookTools (continued)Tools (continued)

Procedure adherenceProcedure adherence means means understanding the procedure’s intent understanding the procedure’s intent and purpose, and following its direction. and purpose, and following its direction. – However, if the procedure cannot be used as However, if the procedure cannot be used as

written, the activity must stop, and the written, the activity must stop, and the procedure corrected before continuing.procedure corrected before continuing.

Event Prevention HandbookEvent Prevention Handbook Tools (continued)Tools (continued)

Stop in the Face of UncertaintyStop in the Face of Uncertainty – When confronted with confusion or When confronted with confusion or

uncertainty, the chances for error are uncertainty, the chances for error are particularly high (1-in-2 to 1-in-10). particularly high (1-in-2 to 1-in-10). When unsure, the best course of action When unsure, the best course of action is to stop and get help from other is to stop and get help from other people. Whenever a question arises and people. Whenever a question arises and what to do remains uncertain, what to do remains uncertain, STOPSTOP and and ASKASK!!

Event Prevention HandbookEvent Prevention Handbook Tools (continued)Tools (continued)

A A questioning attitudequestioning attitude fosters situational fosters situational awareness, encouraging thought about safety awareness, encouraging thought about safety before action is taken. before action is taken. – Being mindful of the work situation helps a person Being mindful of the work situation helps a person

maintain an accurate understanding of work maintain an accurate understanding of work conditions at any given time, avoiding blind spots. conditions at any given time, avoiding blind spots.

– This tool alerts people to imminent hazards, warning This tool alerts people to imminent hazards, warning signs, and uncertainties in the work environment or signs, and uncertainties in the work environment or with the work plan, and with the work plan, and

– Encourages the user to stop and resolve those Encourages the user to stop and resolve those hazards, warnings, or uncertainties before hazards, warnings, or uncertainties before proceeding with the job.proceeding with the job.

Event Prevention HandbookEvent Prevention Handbook Tools (continued)Tools (continued)

Pre-job briefingsPre-job briefings conducted before a conducted before a job allow workers and supervisors to job allow workers and supervisors to discuss the nature of the tasks to be discuss the nature of the tasks to be performed, and hazards, safety performed, and hazards, safety precautions, and controls;precautions, and controls;– Help individuals better understand what Help individuals better understand what

to accomplish and what to avoid; and to accomplish and what to avoid; and – Help participants avoid surprises in the Help participants avoid surprises in the

field and reinforce the idea that there are field and reinforce the idea that there are no “routine” activities.no “routine” activities.

Event Prevention HandbookEvent Prevention Handbook Tools (continued)Tools (continued)

The The work site hazard analysiswork site hazard analysis tool (Site tool (Site Form A-6004-101) is used by planners, Form A-6004-101) is used by planners, supervisors, and workers to identify supervisors, and workers to identify the hazards, controls, permits, and the hazards, controls, permits, and personal protective equipment (PPE) personal protective equipment (PPE) needed to safely perform a job at a needed to safely perform a job at a particular work site.particular work site.

Event Prevention FrameworkEvent Prevention Framework

Event Prevention HandbookEvent Prevention HandbookExpectations for UseExpectations for Use

Can be used in all company activities from Can be used in all company activities from the office to the field in particular whenthe office to the field in particular when planning & performing work planning & performing work

To identify error precursors that apply To identify error precursors that apply at the present time and workplaceat the present time and workplace

To conduct a pre-job safety meeting To conduct a pre-job safety meeting using the SAFER frameworkusing the SAFER framework

Event Prevention HandbookEvent Prevention HandbookSummarySummary

Regular use of the Event Prevention Regular use of the Event Prevention Handbook will increase:Handbook will increase:– Situational awarenessSituational awareness– Event Prevention efforts Event Prevention efforts – Increase job safety and effectivenessIncrease job safety and effectiveness