Safety Culture Lessons from CSB and Other Major Incident Investigations Bill Hoyle Senior Investigator; retired U.S. Chemical Safety Board Sao Paulo, Brazil August 2014
Presentation overview Expecting the unexpected New ways to think about safety culture Review of major CSB investigations including Deepwater Horizon, West Fertilizer and BP Texas City Discussion of Fukushima nuclear and San Bruno pipeline incidents
3
18 Things that have not happened before happen all the time.
7 What is the CSB? Independent U.S. government investigation agency began operation in 1998; modeled after the National Transportation Safety Board Makes recommendations for prevention Budget $11million; 18 investigators Conducts safety studies: combustible dust and reactive chemicals
San Bruno, California 2010
San Bruno fire 2010 30-inch-diameter natural gas ruptured and caught fire in California 8 people killed and many injured 38 homes destroyed and 70 more damaged Company took 95 minutes to stop the release Released 47 million standard cubic feet of gas Workers self-deployed to shut the manual valves Culture of grandfathering safety
West, Texas April 2013
Apartment building destroyed
Fertilizer company destruction
Nursing home and schools damaged
Fukushima nuclear incident
23 Was the earthquake unforeseen? March 11, 2011 major earthquake damages Fukushima nuclear plant A 6.8 earthquake in 2007 cost Tokyo Electric Power Company (TEPCO) nearly $6 billion A 7.8 quake in 1993 created a 30-foot high tsunami in Japan
24 Fukushima planning was inadequate Engineers planned for a maximum tsunami wave of less than 11 feet Fukushima was hit by a wave that was 30 to 45 feet high The powerful earthquake was calculated to occur once in 1,000 years, but it took place just 8 years after the analysis TEPCO s cost estimated to be $137 billion Culture of close relationship between company and regulator revealed
Blaming BP: a barrier to learning CSB investigation ongoing Transocean, Halliburton, Cameron involvement Oil industry role Government regulatory ineffectiveness Failure of risk management
Failure to recognize major risks Past success acted to downplay risk of a catastrophic spill Blowout preventer failure considered extremely unlikely Emergency response planning not taken seriously by industry or regulators
Failed emergency response Response plans copied from Alaska Response equipment not available Very little industry or government capacity to address a major leak It took nearly three months to stop the leak
Personal vs. major hazard safety BP and Transocean primarily measure safety performance using worker injury data BP executives on the rig to commemorate outstanding safety record Safety bonuses and awards largely based on injury data Transocean celebrated 2010 as the safest year in their history
Failure to learn from Texas City Safety management system improvements made in refining were not implemented in offshore operations Continued focus on personal safety rather than major hazard safety 30,000 wells drilled without a major blowout was seen as proof that risk was managed successfully
25 Risk assessments that rely on probability do not offer protection from incidents that rarely happen or have not happened before.
BP Texas City - 3/23/2005
28 BP Texas City oil refinery
BP Texas City days away from work
31 New ways to think about safety culture Safety culture usually examined at a single facility or within a single company CSB investigations reveal that safety culture should also be studied at the level of an entire industry as well as at the level of the safety regulators
Deepwater Horizon: looking beyond BP Regulators, industry and media all focused on BP in the Deepwater Horizon disaster Transocean, Halliburton and Cameron worked for all the major oil companies None of the companies was prepared to address a major blowout and neither were the regulators
BP: a renegade company? Almost exclusive focus (and blame) was placed on BP as renegade and outlier company in the Texas City and Deepwater Horizon disasters Assigning blame for major incidents to one person or one company is an act of extreme oversimplification; it detracts from learning and prevention The underlying causes of the Texas City and Deepwater Horizon incidents involved systemic technical and cultural failures at every level of the company, the energy industry and the government
Industry and regulators forgot to be afraid The energy industry had a can-do culture Did not recognize that success breeds complacency Did not understand that lack of serious incidents should not be seen as proof that systems are safe; especially when it involves the potential for low-frequency highconsequence events
Questions?