“People can forget to be afraid”

01 April 2007

The Baker Report into BP’s Safety Culture following the Texas City accident points the finger at the company’s own senior management, but other companies will be missing the point if they fail to assess whether their own operations and practices would stand up to similar scrutiny, writes Andrew Bond

Aerial shot of the Texas City refinery in the USA - “©BP p.l.c
Aerial shot of the Texas City refinery in the USA - “©BP p.l.c

Now that the dust has settled following the publication of the ‘Baker Report’, or, to give it its full name, ‘The Report of the BP Refineries Independent Safety Review Panel’, the spotlight of media attention has moved on to other issues, leaving space for the rest of us to take a closer look at what the report actually says about process control and instrumentation and to see if there are wider lessons to be learned.

The Review Panel was set up by BP under the chairmanship of former US Secretary of State James Baker following the accident at its Texas City refinery in March 2005. The accident killed 15 people and seriously injured more than 170 others, making it one of the worst industrial accidents in the US in the past 20 years. Texas City was, however, already a byword for industrial disaster long before 2005. In 1947 a ship loading ammonium nitrate fertilizer caught fire and exploded in the harbour causing America’s worst ever industrial accident with a death toll approaching 600 and total casualties of some 4000.

That may go some way to explaining why the 2005 accident made such an impact in the US and further afield. However, despite the coverage it has received, it’s also worth noting that it was not part of the ‘Baker’ Panel’s brief to investigate that specific incident or to apportion blame. Rather it was charged with conducting “a thorough review of the company’s corporate safety culture, safety management systems, and corporate safety oversight at its US refineries.”

Despite that, even the introduction to the Executive Summary leaves the reader in little doubt that the panel, while acknowledging BP’s excellent record on personal safety, believes that complacency about process safety was the root cause of the accident. “Preventing process accidents requires vigilance,” it says. “The passing of time without a process accident is not necessarily an indication that all is well and may contribute to a dangerous and growing sense of complacency. When people lose an appreciation of how their safety systems were intended to work, safety systems and controls can deteriorate, lessons can be forgotten, and hazards and deviations from safe operating procedures can be accepted. Workers and supervisors can increasingly rely on how things were done before, rather than rely on sound engineering principles, and other controls.” Most tellingly, it adds, “People can forget to be afraid.”

Baker puts the responsibility for BP’s deficiencies in process safety fairly and squarely on the company’s management, with the greatest blame accruing to the highest level. However that may make it all too easy for other plant operators to assume that the problems identified were and are specific to BP and to its senior management. That’s clearly a danger of which Baker is all too aware. “We are under no illusion that deficiencies in process safety culture, management, or corporate oversight are limited to BP,” the report says. “We urge … other companies to regularly and thoroughly evaluate their safety culture, the performance of their process safety management systems, and their corporate safety oversight for possible improvements.”

One of the most important lessons for operators, suppliers and regulators in the wider industry is to appreciate that, while the development of new standards and practices may make the plants of the future safer, they can do nothing for existing plants, which in Europe and North America will always be by far the majority, unless they are applied retrospectively.

Readers of magazines such as Control Engineering Europe could easily gain the impression, for example, that standards such as IEC 61508 and 61511, which have been in existence for some years and upon which any discussion of modern safety practice is based, have been universally adopted across the process industries. However, after reading Baker, and the consultants’ report which is attached to it as an appendix, a rather different picture emerges. Indeed a full 10 years after the publication of ISA 84.01, the US equivalent of IEC 61511 with which it is now effectively merged, Baker found that “… none of BP’s five US refineries had a comprehensive plan for conforming to ISA 84.01, and only Toledo and Cherry Point have implemented it for recent projects.”

It would be bad enough, if understandable, if the problem was simply one of a backlog of legacy plant to be brought up to current standards, but the report adds that “… one refinery (Whiting) did not implement ISA 84.01 for its newest process … unit scheduled for start-up in 2006” (our italics). Moreover, “discussion with BP refinery instrumentation subject matter experts indicated that it might be another 10 years before ISA 84.01 would be fully implemented in the BP US refineries.”

You can almost hear the Panel’s collective jaw drop as it comments that “The PSM (Process Safety Management) Review Team believes that it is feasible and reasonable for BP to expedite ISA 84.01 implementation and complete it at a much faster pace.”
Given the emphasis that both ISA 84.01 and IEC 61511 place on the management of the process safety life cycle including, for example, the need for regular proof testing in order to maintain SIL ratings, it is perhaps not surprising, to read later in the report that “BP did not properly bypass or test some important alarms and shutdown devices,” clear evidence, if further evidence were needed, that people at all levels in BP had indeed “forgotten to be afraid”. There can, surely, be no other explanation for a barrage of data which includes “226 critical alarms and ESDs … overdue for testing” at Carson, “Four instrumented shutdown systems … past due for testing” at Cherry Point, “a written procedure had been developed to support periodic testing for only one of seven critical alarms that were selected randomly” at Toledo and “Several critical alarms were improperly (permanently) bypassed” at Whiting. And this, remember, months after the accident at Texas City had already put the entire industry on the alert.

Even more extraordinary, where deficiencies which might compromise process safety were identified, they were by no means always rectified immediately. Thus “all five refineries over the past few years had (1) significant numbers of action items that were not completed within a reasonable period of time and (2) backlogs of overdue action items – some as long as many months or years overdue.” However, it does add that more recently “All five refineries had made reduction of action item backlog a priority” and that at Cherry Point “An intense focus in 2005 reduced the action item backlog to zero” which, you can again almost hear the panel saying, just goes to show that it can be done.

One result of Baker will certainly be increased investment in new generation control and safety systems as companies across the process industries move rapidly to bring their existing operations in line with IEC 61508 and 61511. Indeed, as we know, BP itself has already embarked on a comprehensive five year, $1bn programme of investment at its US refineries. However its most important legacy should be to remind everyone across the process industries as a whole that paying lip service to standards and good practice is not sufficient. We must all, as Baker reminds us, remember to be afraid.

Related Articles...

Print this page | E-mail this page