'Raising the bar' for safety
16 May 2007
The official reports into the accidents at Buncefield and Texas City put responsibility for improving safety culture on all stakeholders in every industry sector
Despite their different starting points, the official reports into BP Texas City -- by the US Chemical Safety Board (CSB) - and Buncefield - by the UK's Major Incident Investigation Board (MIIB) - have arrived at strikingly similar conclusions and recommendations in response to both accidents.
Both reports will also have similarly wide-ranging impact on the safety performance of the process industry, covering everything from containment of hazardous substances and automatic safety systems right up to the safety culture in business organisations and, indeed, entire industry sectors.
The MIIB report on the Design & Operation of Sites "raises the bar in many areas of design and operation that have not been on people's radar screens up to now," said Taf Powell, manager of the Health & Safety Executive's investigation into Buncefield. This, he said, is "certainly so in terms of a common approach to safety integrity in building high reliability organisations and developing leadership and a strong safety culture in this sector,"
Perhaps the most fundamental conclusion in the MIIB report, which was issued on 29 March, is that primary containment is the most important element of major hazard risk control — a common sense notion that seems to have eluded many sectors of industry, or been overshadowed by occupational safety measures.
"Primary containment is invariably the most important element," explained Powell, in a 13 April interview at the HSE's Rose Court HQ in London. "Hydrocarbon releases from petrochemical and offshore facilties, keeping chlorine in vessels, ionisation from nuclear plants, trains leaving the track - it's the common thread of all major hazard risk control systems."
Citing other incidents, such as Texas City and Milford Haven, Powell said: "It can almost seem like a triumph of occupational safety measures or culture over major hazard risk control. Protective equipment, hygiene, slips, trips and falls protection and measures like lost time accidents are not major accident precursor measures."
Likewise, the CSB said that BP's efforts to make safety improvements were largely focused on personal safety - such as slips, trips, falls, and vehicle accidents - rather than on improving process safety performance.
Both the UK and US facilities commonly employed hazard control systems that relied on interventions by operators — something that the health and safety regulators now want to eliminate.
At Buncefield, a tank level gauging system failed and operators were not alerted that fuel was overflowing from a massive storage tank. At Texas City, a high-level alarm malfunctioned and a transmitter indicated that the liquid level was below nine feet and falling when in fact it was rising rapidly, reaching 158 feet just before the explosion.
"BP relied on operators taking correct and timely actions and following procedures to prevent excessive liquid levels in the tower, said the CSB. The agency wants companies to introduce automatic safety controls that shut down liquid flow to a tower and so prevent dangerous overfilling.
In the UK, the MIIB has already issued a mandatory requirement that overfill must be prevented by independent and automatic methods. Operators can no longer rely on human intervention, for example, in terms of responding to an alarm and then taking executive action.
"This is a point on which we are absolutely rigid," stressed Powell. "Some industry commentators think we have taken a step too far. But the whole new regime we are calling for needs a fixed point, otherwise it is going to lack solidity and give too much leeway to risk assessment to justify not having independent automatic overfill protection systems."
MIIB's recommendations also encompass human and organisational factors, including defining the role and responsibilities of control room operators and their interfaces with various process systems. They also cover ensuring robust communications management within and between sites and contractors and with operators of distribution systems.
"To keep focus on controlling the major hazard potential of your industry you have got to develop the right safety culture and the right organisation," said Powell. Operators must become "high reliability organisations" that take proper account of human factors.
The CSB found that a "dysfunctional safety culture existed at all levels of BP Group executives". Texas City managers, it noted, were aware of serious process safety problems at the refinery in the three years to March 2005.
"Many of the safety issues that led to the March 2005 accident were recurring safety problems that had been previously identified in internal audits, reports, and investigations," according to supervisory investigator Don Holmstrom.
Corporate management
Indeed, the Baker Panel Report — formed and funded by BP in response to an urgent CSB safety recommendation — stated that BP's corporate safety management system "does not effectively measure and monitor process safety performance" for its US refineries.
The Baker recommendations to BP included providing effective process safety leadership, developing process safety knowledge and expertise, and ensuring management accountability.
The CSB also recommended that companies be required to perform a management-of-change safety review on organisational changes, including mergers, acquisitions, reorganisations and budget cuts.
The Buncefield Board's recommendations are mainly for companies running sites with large-scale fuel storage facilities, but could also apply to the chemical industry and indeed the entire major hazards industrial network in the UK.
"Sectors like the chemical sector will want to take account of everything the Board says, as will the regulators, to see if there are applications where relevant lessons need to be learned," said Powell. Process industry sectors, he concluded, "need to build an attitude and a culture that holds its members to account, that encourages high integrity operations and encourages continuous improvement as new knowledge and invention comes through the system."
Recipe for disaster
1998
BP merges with Amoco and takes control of Texas City refinery, where 23 people had previously been killed in industrial accidents
1999
BP Group management directs Texas City to cut costs 25%
2001
Presentation to BP management predicts an employee death in the next 3-4 years
2002
Study concludes that Texas City has serious deficiencies with mechanical integrity, inspections and instrumentation, as well as a high probability of a major incident
2003
Audit determines that the Texas City refinery infrastructure and assets are in poor condition, and that both training and incident investigation activities are insufficient
2004
The Texas City plant manager gives a presentation entitled "Safety Reality" to 100 supervisory personnel regarding deaths in the plant in the previous 30 years
Presentation to plant managers identifies serious problems with process safety performance
Two employees are killed and another seriously injured when burned with hot water and steam during the opening of a pipe flange
Presentation in late 2004 declares that Texas City refinery is not a safe place to work
BP Group refining leadership gives the Texas City refinery business unit leader a 25% budget cut "challenge" for 2005
Feb 2005
BP Group VP and the North American VP for Refining presented with findings on the
deteriorating conditions of the refinery and the 2004 fatality incidents
Business plan warns that the refinery is likely to "kill someone in the next 12-18 months"
23 March 2005
Explosion and accompanying fire at the Texas City refinery results in 15 fatalities and over 180 injuries
Both reports will also have similarly wide-ranging impact on the safety performance of the process industry, covering everything from containment of hazardous substances and automatic safety systems right up to the safety culture in business organisations and, indeed, entire industry sectors.
The MIIB report on the Design & Operation of Sites "raises the bar in many areas of design and operation that have not been on people's radar screens up to now," said Taf Powell, manager of the Health & Safety Executive's investigation into Buncefield. This, he said, is "certainly so in terms of a common approach to safety integrity in building high reliability organisations and developing leadership and a strong safety culture in this sector,"
Perhaps the most fundamental conclusion in the MIIB report, which was issued on 29 March, is that primary containment is the most important element of major hazard risk control — a common sense notion that seems to have eluded many sectors of industry, or been overshadowed by occupational safety measures.
"Primary containment is invariably the most important element," explained Powell, in a 13 April interview at the HSE's Rose Court HQ in London. "Hydrocarbon releases from petrochemical and offshore facilties, keeping chlorine in vessels, ionisation from nuclear plants, trains leaving the track - it's the common thread of all major hazard risk control systems."
Citing other incidents, such as Texas City and Milford Haven, Powell said: "It can almost seem like a triumph of occupational safety measures or culture over major hazard risk control. Protective equipment, hygiene, slips, trips and falls protection and measures like lost time accidents are not major accident precursor measures."
Likewise, the CSB said that BP's efforts to make safety improvements were largely focused on personal safety - such as slips, trips, falls, and vehicle accidents - rather than on improving process safety performance.
Both the UK and US facilities commonly employed hazard control systems that relied on interventions by operators — something that the health and safety regulators now want to eliminate.
At Buncefield, a tank level gauging system failed and operators were not alerted that fuel was overflowing from a massive storage tank. At Texas City, a high-level alarm malfunctioned and a transmitter indicated that the liquid level was below nine feet and falling when in fact it was rising rapidly, reaching 158 feet just before the explosion.
"BP relied on operators taking correct and timely actions and following procedures to prevent excessive liquid levels in the tower, said the CSB. The agency wants companies to introduce automatic safety controls that shut down liquid flow to a tower and so prevent dangerous overfilling.
In the UK, the MIIB has already issued a mandatory requirement that overfill must be prevented by independent and automatic methods. Operators can no longer rely on human intervention, for example, in terms of responding to an alarm and then taking executive action.
"This is a point on which we are absolutely rigid," stressed Powell. "Some industry commentators think we have taken a step too far. But the whole new regime we are calling for needs a fixed point, otherwise it is going to lack solidity and give too much leeway to risk assessment to justify not having independent automatic overfill protection systems."
MIIB's recommendations also encompass human and organisational factors, including defining the role and responsibilities of control room operators and their interfaces with various process systems. They also cover ensuring robust communications management within and between sites and contractors and with operators of distribution systems.
"To keep focus on controlling the major hazard potential of your industry you have got to develop the right safety culture and the right organisation," said Powell. Operators must become "high reliability organisations" that take proper account of human factors.
The CSB found that a "dysfunctional safety culture existed at all levels of BP Group executives". Texas City managers, it noted, were aware of serious process safety problems at the refinery in the three years to March 2005.
"Many of the safety issues that led to the March 2005 accident were recurring safety problems that had been previously identified in internal audits, reports, and investigations," according to supervisory investigator Don Holmstrom.
Corporate management
Indeed, the Baker Panel Report — formed and funded by BP in response to an urgent CSB safety recommendation — stated that BP's corporate safety management system "does not effectively measure and monitor process safety performance" for its US refineries.
The Baker recommendations to BP included providing effective process safety leadership, developing process safety knowledge and expertise, and ensuring management accountability.
The CSB also recommended that companies be required to perform a management-of-change safety review on organisational changes, including mergers, acquisitions, reorganisations and budget cuts.
The Buncefield Board's recommendations are mainly for companies running sites with large-scale fuel storage facilities, but could also apply to the chemical industry and indeed the entire major hazards industrial network in the UK.
"Sectors like the chemical sector will want to take account of everything the Board says, as will the regulators, to see if there are applications where relevant lessons need to be learned," said Powell. Process industry sectors, he concluded, "need to build an attitude and a culture that holds its members to account, that encourages high integrity operations and encourages continuous improvement as new knowledge and invention comes through the system."
Recipe for disaster
1998
BP merges with Amoco and takes control of Texas City refinery, where 23 people had previously been killed in industrial accidents
1999
BP Group management directs Texas City to cut costs 25%
2001
Presentation to BP management predicts an employee death in the next 3-4 years
2002
Study concludes that Texas City has serious deficiencies with mechanical integrity, inspections and instrumentation, as well as a high probability of a major incident
2003
Audit determines that the Texas City refinery infrastructure and assets are in poor condition, and that both training and incident investigation activities are insufficient
2004
The Texas City plant manager gives a presentation entitled "Safety Reality" to 100 supervisory personnel regarding deaths in the plant in the previous 30 years
Presentation to plant managers identifies serious problems with process safety performance
Two employees are killed and another seriously injured when burned with hot water and steam during the opening of a pipe flange
Presentation in late 2004 declares that Texas City refinery is not a safe place to work
BP Group refining leadership gives the Texas City refinery business unit leader a 25% budget cut "challenge" for 2005
Feb 2005
BP Group VP and the North American VP for Refining presented with findings on the
deteriorating conditions of the refinery and the 2004 fatality incidents
Business plan warns that the refinery is likely to "kill someone in the next 12-18 months"
23 March 2005
Explosion and accompanying fire at the Texas City refinery results in 15 fatalities and over 180 injuries
