Deepwater horizon revisited investigative insights

WELCOME

Organisational Issues From Investigation PerspectivesPresented by Cheryl MacKenzie, Investigator at United States Chemical Safety and Hazard Investigation Board (CSB)

Cheryl MacKenzie, U.S. CSB Investigations Team [email protected] www.csb.gov

February 20 – 27, 2017

Deepwater Horizon RevisitedCSB Investigative Insights

University of Sydney Chemical and Biomolecular Engineering Foundation & SIA

• Purpose – Popular View vs. Reality• Who is the U.S. Chemical Safety Board?• What is Human & Organizational Factors?• Investigation HOF Findings and Conclusions

• Broad Takeaways

Outline

Popular View vs. Reality

• Single “bad guy” and single bad actor among industry

• Individuals on the rig made inexplicable, bad decisions

• Profits and greed solely to blame• Incident could have been prevented had it

not been for a few incompetent people

Popular View – Movie and Elsewhere

• Complex incident involving multiple parties making numerous (often unrecognizably) interdependent decisions

• Individuals on the rig made decisions and took actions that made sense to them at time

• Identifying gaps between policy and practice give useful safety insights

• More proactive approaches for hazard management exist

Reality

Presenter

Presentation Notes

Complex incident involving multiple parties making numerous (often unrecognizably) interdependent decisions Individuals on the rig made decisions and took actions that made sense to them at time Identifying gaps between Work-as-Imagined and Work-as-Done give insights into potential safety issues, and to a larger extent, the organization’s culture There are steps we can take to be more proactive in major hazard management Through a series of examples drawn from the investigation we will explain some of the key issues – why they happened and then suggest some ideas which might help us to prevent them happening in other organizations RIGHT NOW I HAVEN’T COVERED ALL OF THESE.

US Chemical Safety BoardDrive chemical safety change through independent

investigations to protect people and the environment

• Independent non-regulatory federal agency

• Investigate catastrophic chemical accidents in the US

• Determine causes and identify lessons learned

• Make recommendations for safety improvements

US Chemical Safety Board (CSB)

Presenter

Presentation Notes

Congress requested the CSB investigate the Macondo event because of the work we did investigating the 15-person fatality explosion at the BP Texas City refinery explosion in 2005.

Human and Organizational Factors

• Modifying individual behavior• Finding fault in order to blame• Weeding out the bad apples

‘Human & Organizational Factors’ is NOT about

Presenter

Presentation Notes

The key message of a presentation given in the months prior to Macondo in the US stated “To further improve safety performance, you have to modify worker behavior.”

• Understanding the interactions between people and other elements of a complex system

• Defining what we expect of those interactions• Determining if those expectations are

reasonable• Putting in place systems and processes that

ensure those expectations can be achieved• Monitoring the gaps between expectations and

practice

Human & Organizational Factors is about

• Crew exhibited natural human tendencies to rationalize situation

• Undefined and unrealistic expectations placed on the well operations crew

• Major gaps in Work-as-Imagined versus Work-as-Done

• Organizational practices influenced human performance

CSB found:

Presenter

Presentation Notes

There are multiple examples that support each of these findings, but I’m going to give some representative ones now, recognizing that – like the movie simplifies the event in order to condense the story into a short format – I too am restricted by the time and can only give a quick review of some of these examples right now.

Adverse outcomes are not the result of unusual actions in usual conditions, but the result of usualactions in unusual conditions.

Erik Hollnagel, “Is Justice Really Important for Safety?,” 2013

Presenter

Presentation Notes

Complex incident involving multiple parties making numerous (often unrecognized) interdependent decisions – a cornucopia of human cognitive biases Evidence of industry-wide gaps Production/profit is an ever-present condition, but not the only aspect influencing culture Individuals on the rig made decisions and took actions that made sense to them at time Steps we can take to be more proactive in risk awareness and hazard management Through a series of examples drawn from the investigation we will explain some of the key issues – why they happened and then suggest some ideas which might help us to prevent them happening in other organizations RIGHT NOW I HAVEN’T COVERED ALL OF THESE.

http://www.offshore-technology.com/projects/macondoprospect/macondoprospect1.html

Presenter

Presentation Notes

Here’s the incident recap: April 20, 2010 Gulf of Mexico A well blowout that found ignition source; the rig sank about 36 hours after the initial explosions Well released hydrocarbons for 87 days until it was finally stopped on July 15, 2010.

Andrew Kelly Reuters

Presenter

Presentation Notes

11 men died on the rig that day, 17 others with life-lifted, and many others had minor physical injuries and mental/emotional anguish that most of here could never imagine.

Associated Press

Presenter

Presentation Notes

Worst oil spill in U.S. history

Riser

BOP

Well

Rig

Temporary Abandonment

Temporary Abandonment

• Install cement surface plug

• Intentionally unbalance the well to test for integrity

• Monitor well conditions

• Remove mud fully

“Free gas in the riser represents one of the most dangerous situations on a rig from a standpoint of personnel safety… It is not out of the realm of possibilities that this slow migration of gas in the riser could go unnoticed as the other activities are taking place, and the gas will begin to unload before anyone notices it.”

BP Well Control Manual

Partially remove the mud barrier

Negative (pressure/flow) test(s)

Crew accepts negative (pressure/flow) test results

Negative Test

Presenter

Presentation Notes

A positive pressure test to test for leaks from inside the well to the outside was successful—while this does not verify the bottom hole cement job, it is a “successful” step in the temporary abandonment process. bleeding and observing pressure and flow Negative test – place well in a controlled underbalanced condition and watch for flow or pressure increases Conducted on drillpipe, then on kill line Procedure called for kill line test Pressure on drillpipe, but no flow on kill line for 30 minutes

Challenges• Downhole conditions inferred and

calculated

• Delayed real-time feedback

• Various groups provide critical information – no one person or entity can feasibly have it all

• The interconnectedness of decisions not fully understood

Unusual Spacer• Spacer is used to displace the mud in

preparation to test for well integrity • Atypical type and amount used• No operational reason for decision; chosen

to ease disposal. • This material likely plugged the kill line that

later was used to conduct the negative test that was deemed a success. But that was not known to the crew

Presenter

Presentation Notes

There was no operational reason to use it. They used it so that they could dispose of it. At the end of the displacement (step 6), the drillpipe had 2,300 psi of trapped fluid pressure (see call-out box on page 53). If all of the spacer had been placed above the BOP as intended, the crew should have observed only ~1,600 psi of trapped pressure. The high pressure reading could have warned the crew of the under-displacement, but the crew would have needed to be predisposed to look for this data and use it to deduce the conditions of the well, yet they weren’t given that information and had no a priori reason for suspecting a problem. Analysis of real time data post incident indicates the was the incorrect pump efficiency. 0.126 bbls per pump stroke = ~ 96% efficiency, but in reality it was closer to 89-91% efficient. This contributed to an underdispaced spacer, placing it across the kill line, likely plugging it and interfering with the crew’s ability to interpret the results.

• Riser level was not full• The level could have dropped before BOP was

closed or after ─ After = leak past annular─ Before = well integrity lost

• Crew assumed it was after the BOP was closed; this option made more sense to them

Rationalized Well Conditions Based on Experience

Presenter

Presentation Notes

.

Post-Incident Well Data AnalysisReal-time Deepwater Horizon data indicates the drillpipepressure began to drop just after the crew closed an annular preventer, implying a loss of well integrity NOT leaking annular.Why did that assumption seem more plausible?• Challenges of well up to now successfully overcome,

reinforcing mentality that success was inevitable- Multiple loss-of-well control events- Changes to drilling plans to accommodate challenges

• Various personnel deemed the cement job successful • Positive pressure test was successful (e.g., no leaks

from inside the well to the outside)• It is “not uncommon” to see an annular leak.

Presenter

Presentation Notes

The fact that these small seemingly insignificant decisions and actions by the crew management and workforce actually contributed collectively to the eventual loss of well integrity and gas-in the-riser situation suggest the need for greater aattention to these “smaller” decisions, as well as the need for effective risk assessment and planning of what appear to be small decisions. Various personnel deemed the cement job successful – this was the primary physical barrier set in the well to maintain integrity and the major operational task of the abandonment process. So they carried on with the temporary abandonment process, stage 3, the negative test.

No negativetest indicated

Presenter

Presentation Notes

‘Upcoming’ Critical Operations The practice on the Deepwater Horizon was for BP to provide the OIM and well operations crew a “Forward Plan” that described upcoming critical operations. On April 16, 2010, BP sent a Forward Plan describing the temporary abandonment activities, but it was missing any reference to the negative test.

No negativetest indicated

Presenter

Presentation Notes

The OIM bridged what was possibly a simple documentation oversight, potential gap in WAI versus WAD at Macondo, which he described post-incident: “I told [the BP Well Site Leader] it was my policy to do a negative test before displacing with seawater.” Worth noting is that the OIM indicated it was “his” policy and did not refer back to a corporate Transocean policy. It is unknown if a different OIM would have had the same “personal” policy—bridging appears to have occurred.

Gap Between Policies and PracticesBP did not send a corrected “Forward Plan”

Transocean had policy to co-develop Standing Instructions to the Driller (SID) with its customer (BP)

‒ Described as a key communication tool that should be discussed with drillers at the beginning of a shift

A Transocean advisory issued weeks before noted that a SID should “raise awareness and […] highlight” underbalanced conditions in a well when a single barrier is present

‒ No evidence SIDs were used on the Deepwater Horizon

Procedure Assumes Successful Test

“Close [BOP] and conduct negative test. After successful negative test open [BOP]”

Procedure Assumes Successful Test

Close [BOP] and conduct negative test. After successful negative test open [BOP]

The night shift WSL recalled participating in approximately 50 previous negative tests; to his knowledge, never had one failed.

Presenter

Presentation Notes

The night shift WSL recalled participating in approximately 50 previous negative tests; to his knowledge, never had one failed.

Negative Test Procedure & Approach• At least 6 different procedures used by the

DWH from August 2007 through April 2010• The procedure at Macondo was different

from any of these• Transocean required written procedures for

safety critical tasks—including negative tests

• Generic DWH procedures identified personal safety and minor spills of mud

Communication Pathways

Presenter

Presentation Notes

Pathways of communication on the rig are complex and dynamic. This slide simplistically depicts at least 5 different companies interacting, all providing their sliver of information into the collective pot, but no one person retains all the minuate, all the details. They all make a valiant effort, they all want to do their share right, but in these sorts of work environments, one’s success is very much interwoven with another. when you have levels of communication and interaction and interdependency like this, the lines of clear-cut accountability can easily blur. People made choices that day that made sense to them based upon the limited slice of information they had. No one person had all the information. Humans are not robots. They will not say and act the same in every situation. Nor do we want them to. That variability is what saves the days when abnormalities or unique situations present themselves. But we want them to be able to effectively function in the dynamic and complex work environment we place them in – and we need to better understand and prepare for that. The individual most often sited as the one to suggest the bladder effect theory? [CLICK] ADD POP-UP BOX WITH EXPERIENCE AND PERFORMANCE REVIEW INFO This gentleman didn’t survive, and so we cannot get his account of what happened. But there were others in the drill shack. Their testimony was limited, they took the 5th (right to not self-incriminate) and thus the context surrounding the event is further clouded. But they did give some testimony. The CSB looked at this information, and while representing only that person’s viewpoint of the conversation, is still revealing about some of the realities of human nature.

Conversation between Well Site Leader and Onshore Drilling Engineer

• Conversation about the next steps - negative test came up

• WSL tells ODE test was “squirrelly” but “no problems”

• Toolpusher/drill crew was “annular compression” that “happens all the time”

• “If there had been a kick in the well, we would have seen it”

Presenter

Presentation Notes

April 27, 2010 interview summarized Purpose of the call was to discuss the surface plug. “Squirrelly test” did NOT equal problem. It was part of the process but they resolved it and are moving on. This is further supported by the crew “It does this all the time”. Issue noted but not explored fully by either party. Explanation provided by others was accepted. Information shared between the two implies the possibility of a kick not absent from their mindsets, but further discussion on this point is absent. Kicks were not out of mind, but it is clear from the dialogue described that the point of the call was not to verify that a kick was an issue. “If there had been a kick, we would have seen it.” Note that the WSL conducted over 50 negative tests before, never experienced one failing.

Conversation between Well Site Leader and Onshore Drilling Engineer

• Lacking contextual information

• Influence of org hierarchy and structure

• Relationship will impact tone and purpose

• Purpose of call is to discuss next steps

Presenter

Presentation Notes

ODE had access to well site data, but didn’t have contextual information about what was occurring on the rigs to fully understand the data Organizational hierarchy – the ODE did not have direct line management accountability over the WSLHe was there as a consult, and neither identified the need to obtain that consult. Relative strangers or long-time acquaintances? Impacts tone and purpose of how they would communicate and the expectations they would have for each other. Purpose was to discuss next steps; negative test conversation was incidental

Communication Pathways #2

Conversation between Mudlogger and Other Well Operations Crewmembers

• Mudlogger provides a second set of eyes on the well data from the control board and video feed of fluid flow on the rig

• Perceived as independent layer of protection

• Yet not privy to all pertinent information to fulfill his protective role

Presenter

Presentation Notes

Caveats – one-sided. December 7, 2010. meant to assist the driller in well operations the challenges of not being co-located.

Conversation between Mudlogger and Other Well Operations Crewmembers

• Multiple fluid movements and transfers between pits and off the rig between 9:10 and 9:35 pm– These activities impacted his understanding of the

data he was meant to monitor• When sought information, didn’t get sufficient

feedback• Org structure discouraged assertiveness• Not co-located – lacking same visual and

contextual information as well operations crew

Presenter

Presentation Notes

Caveats – one-sided. December 7, 2010. When he noticed that the mud pumps were being brought online in a “staggering” manner during the final displacement and called an assistant driller to find out why, the assistant driller said, “That’s the way we’re going to do it this time.” He also spoke with the mud engineer when he noticed a gain in one of the active pits, although he could not recall the time. The mud engineer informed him that “they were moving mud out of some sand traps.” No other communications with the well operations crew during his shift were ident Not privy to all pertinent info to play protective role: Multiple fluid movements and transfers between pits and off the rig between 9:10 and 9:35 pm These activities impacted his understanding of the data he was meant to monitor When sought information, didn’t get sufficient feedback Org structure such that he was a client of the operator (well service provider), not in a position to be assertive to the driller/assistant drillers (primary well operations crew) Not co-located, thus did not have same visual & contextual information ified.

Other Organizational Factors• Development and use of relevant safety

performance indicators and metrics─ LTI award recognition from BP to

Transocean ─ LTI ≠ control over major accident

hazards

Presenter

Presentation Notes

To various degrees, BP and Transocean exhibited the following organizational behaviors that were detrimental to process safety: • Poor adherence to their own corporate major hazard management policies, which contained more stringent risk reduction responsibilities than regulations stipulated (Chapters 1.0 and 4.0); • Inadequate consideration for human and organizational factors in work planning, risk assessment, and incident investigations (Chapters 1.0 and 2.0); • Inadequate individual performance contracts and bonus structures with limited inclusion of process safety goals (Chapter 3.0); • Inadequate development and usage of relevant process safety performance indicators (Chapter 3.0); • Failed efforts aimed toward bridging major risks (Chapter 4.0); and • Boards of Directors not sufficiently engaged in process safety (Chapter 5.0).

www.csb.gov42

Major Hazard

RiskEvent

Severity

Frequency / probability

Major hazard accidents are

here

..but most of the management systems, (e.g. performance measures, audits, behavior-based safety programs, etc.) are aimed here

Event Severity

Frequency/Probability

© HSE

Presenter

Presentation Notes

This is why. The explosion on March 23 was a major hazard accident. [CLICK] And major hazard accidents are infrequent events with severe consequences. [CLICK] But most of the management systems put in place to make facilities safer are aimed at the high-frequency events, that tend to be low on the severity scale. Some of you may recognize this graph. It was developed by HSE in their investigation of several events that occurred at BP’s Grangemouth refinery in 2000. Despite BP’s public embrace of the findings of HSE’s Grangemouth report, the CSB found that the lessons were not learned at the Texas City site. The Baker Panel report also noted striking similarities between the lessons of Grangemouth and the Texas City explosion, including a poor understanding of and a lack of focus on process safety. While BP was improving its personal safety (that is, decreasing its slips, trips, and fall incidents) – and thereby reducing it’s statistics like lost-time incidents and days away from work – its process safety was not improving at an equal rate. In fact, the safety of the facility from high hazard incidents was getting worse between the same time period of the graph I just showed. How did the CSB determine that the Texas City refinery’s safety culture was not were it should be?

Other Organizational Factors• Development and use of relevant safety

performance indicators and metrics─ LTI award recognition from BP to

Transocean ─ LTI ≠ control over major accident

hazards─ Influence of safety observation

programs

Presenter

Presentation Notes


Influence of Safety Observation Program

Policy: Employees shall observe and report unsafe situations/activities

• Transocean crews required to submit daily START card • Crewmembers believed the focus on the quantity not

quality of observation. • “people [tried] not to rat people out so to speak, you

know like you wanted to be helpful, […] whereas some of the higher-ups in the office, they kind of wanted to weed out problems …”

• “I’ve seen guys get fired for someone [writing] a bad START card about them”

(pg 143-144, Vol 3 CSB Macondo Report)

Presenter

Presentation Notes

The TO perceptions came from a safety culture survey the company commissioned as well as CSB interviews. RESULT: TO was getting reports from their workforce; every person was submitted their observations and lots of data was being collected. But what does that reveal about the organizational culture and its focus on safety? The numbers suggest progress and attention on safety. HOWEVER, when we dug deeper, what did we find?

Well Control Events – Precursor Data

2008 – 2009:• 6 riser unloading events2009: • 121 well control events• 32 different operators• Various geographic

locations

Source: Transocean Well Control Events & Statistics report, 2005 - 2009

Indicators:• Kick volume• Kick intensity• Riser unloading

events

Presenter

Presentation Notes

Let’s talk a little bit more about using indicators to understand an organization’s culture for safety. How do you assess whether you have a culture for safety? Is it by the lack of incidents or other indicators? Tier 1 and 2 are visible and required to be reported to the regulator, making them easy to measure. They are on the surface. But they are infrequent. No major incidents today is not a good indicator for no major incidents tomorrow. So much of why we have tier 3 and tier 4 events is not explored. The context surrounding those events is rarely measured, much less understood. A Tier 3 event is one where there are challenges to a safety system. Why is the company having those challenges?

Other Organizational Factors• Insights of Organizational Culture found

in the WAI-WAD Gap ─ Not necessarily about operational

discipline ─ The gap is there for a reason, and it is

usually not due to complacency─ The gap reveals discrepancies

between espoused values and actual culture

Presenter

Presentation Notes


• Complex incident involving multiple parties making numerous (often unrecognizably) interdependent decisions

• Individuals on the rig made decisions and took actions that made sense to them at time

• The power of metrics• Safety opportunity resides within the gaps

between policies and practice

Broad Takeaways

Presenter

Presentation Notes

Complex incident involving multiple parties making numerous (often unrecognizably) interdependent decisions Individuals on the rig made decisions and took actions that made sense to them at time Identifying gaps between Work-as-Imagined and Work-as-Done give insights into potential safety issues, and to a larger extent, the organization’s culture There are steps we can take to be more proactive in major hazard management Through a series of examples drawn from the investigation we will explain some of the key issues – why they happened and then suggest some ideas which might help us to prevent them happening in other organizations RIGHT NOW I HAVEN’T COVERED ALL OF THESE.

Beyond Today’s PresentationVolume 1Incident Background Offshore Drilling Primer

Volume 2Blowout PreventerSafety Critical Barrier Management

Volume 3Human & Organizational FactorsSafety Performance IndicatorsRisk ManagementCorporate GovernanceSafety Culture

Volume 4US Offshore Safety Regulations During & Post-MacondoAttributes of An Effective Regulator & Regulatory System

This presentation for the SIA and the University of Sydney Chemical and Biomolecular Engineering Foundation by Cheryl MacKenzie, Investigator for the U.S. Chemical Safety and Hazard Investigation Board, on February 20 – 27, 2017, is for general informational purposes only. The presentation is the view of Ms. MacKenzie. References, conclusions or other statements about CSB investigations may not represent a formal, adopted product or position of the entire Board. For information on completed investigations, please refer to the final written products on the CSB website at: www.csb.gov.

Disclaimer

http://www.csb.gov/

Cheryl MacKenzie, U.S. CSB Investigations Team [email protected] www.csb.gov

Questions?

Operationalising Organisational FactorsPresented by Peter Wilkinson, General Manager, Risk Noetic Group

HUMAN AND ORGANISATIONAL FACTORS Are there practical solutions?

Peter WilkinsonGM – Risk, Noetic GroupCanberra and Washington DC

Piper Alpha 1988 – 167 killed

53

What will I cover?

Definition of Human and Organisational Factors (HOF)

The special problem of very low probability but very high consequence events

What are the main HOF issues and what can we do about them?

A checklist for improvement – not limited to oil and gas

But first – what do we mean by Human and Organisational Factors?

54

What are Human and Organisational Factors?

Definitions of Human Factors:

Human Factors are “the study of the interactions between human and machine” –Gordon 1998

Human Factors “…include a focus on environmental, organisational and job factors which influence work behaviour in a way that can affect health and safety” – UK HSE

Human Factors “…[cover] …management functions, decision making, learning and communication, training, resource allocation and organisational culture”

As the focus has widened the term Human and Organisational Factors is increasingly used.

HOF is multi-disciplinary: Psychology, Management Science, Sociology, Anthropology…

55

Intellectual roots of HOF

Aviation

Oil and Gas

Chemical

Mining

Rail

Healthcare

Public Service

Maritime

56

ManagementScience

Psychology

Engineering

Sociology

Academic Disciplines Sectors

Incident causation?

Key Question – what is the mental model of incident causation in your organisation?What are the causes of incidents?80% caused by human error? – So, who caused the remaining 20%?Is there ever one root cause?

More modern view:Humans involved in all incidents, but not just at front line Managers, supervisors, designers, manufacturers, suppliers at all levels and not just

“hands on” front line workers

Incidents typically involve failures or defects in:Systems, Processes and proceduresEquipment, hardware and softwareOrganisational culture or “climate”

57

Terminology – We have a problemSector/region specific termsProcess Safety - PSM USAMajor Accident Events - MAEs offshore oil and gas e.g. UK/AustraliaMajor Accident Hazards – onshore major hazard industryTechnical Safety – old BP termCatastrophic Events – some mining companiesMaterial Unwanted Events - ICMM (international mining peak body)

These are all low probability/high consequence events. They can have devastating impacts on people, the environment and businesses.

They are material risks to an organisation and they (and their precursor events) warrant serious attention.

They share a similar set of underpinning ideas and concepts.

58

Terminology – Process vs Personal Safety

59

Leak in oil pipeline can result in:

BUT – it is down to chance which, if any of these consequences eventuate

Gas Release

Oil SpillLoss of Supply

Financial Loss

Reputation Damage

Fire

Explosion

Environment Damage

Low probability but high consequence events –Are these especially difficult to deal with and if so, why? Feedback Low probability but high consequence = less feedback?High probability but low consequence = more feedback

Cognitive biasesOptimism bias – “she’ll be right…!”Availability heuristic and risk matricesConfirmation biasHindsight bias

Decision MakingDecision making – validity of rational actor model?Making sense of decision making in practice LeadershipAvoiding dissonance “…tell me why this can’t happen to us”And finally how well does bad news travel upwards in an organisation? But you cannot manage

what you do not know about60

Many high hazard organisations will have oneor more of these characteristicsStrong focus on personal safety including fatality riskGenuine shock and surprise when a serious event occurs – they might even call

it a Black Swan event!They have a large number of systems, procedures, policies, practices.

Quality sometimes good BUT ease of use varies due to:Volume of material ComplexityClarityThey assume that work is done in accordance with the written procedures –

work as imagined vs work as doneReporting on “health” of risk controls – doesn’t get high enough in organisationAnd even where it does - it is often unduly optimistic

61

Signs, symptoms and treatments (1)Strong focus on personal safety especially fatality risk

LEADERSHIPSenior leaders can articulate the difference between process safety (or

MAEs/Catastrophic Hazards etc.) and personal safetyMetrics for both types of hazards are reported to the topSenior leaders are incentivised to improve control over process safetyThe annual report talks about this aspect of the company’s activities

62

Signs, symptoms and treatments (2)Large volume of paperwork – is it clear what really matters?Risk assessment and bowtiesVolume, complexity and length of proceduresIs their purpose clear Training Checklist to be rigidly followedGeneral guidanceIs what is really important clear?Why are the first 3 pages about document control?

63

Signs, symptoms and treatments (2)

64

65

Large no. of controls Processes &

procedures (Shelfware)?

Complex bowties

“shelf-ware”

But what really matters?

BowtieCritical control summary sheet

Signs, symptoms and treatments (3)Monitoring of the implementation of controls –“work as imagined” vs “work as done”Is there a clear model of the purpose and scope of monitoring?Who is accountable for monitoring control implementation”?How is this to be done?What is the frequency of monitoring?Do supervisors at all levels have the skills for this?Are the results available in a useful format – after all these are “material risks”

66

Simplified model of monitoring

67

ManagersEnsure supervisors have systems for monitoring critical controls and carry out some monitoring themselves

SupervisorsMonitor implementation of critical controls by operators

Front line workersDo the work! Carry out their own monitoring – including each other

Audit

Signs, symptoms and treatments (4)Reporting and governance over Risk

Process Safety risks are usually Material Risks – ASX Principle 7As a result should appear in the Enterprise Risk Management SystemAre conclusions on these sorts of risk based on field data? Or are they

unsupported assertions?Bad news doesn’t travel upwards well – but cannot manage what you do not

know aboutReward bad news – but expect people to bring you solutions too!

68

Signs, symptoms and treatments (5)CultureCulture: “…remains a confusing and ambiguous concept…little evidence of a relationship between safety culture and safety performance…”Values + Practices = Culture (John Coleman, Harvard Business Review); Andrew Hopkins and Edgar Schein say much the same.Values can be faked – Practices are visible. In good cultures; Values and Practices must be in syncTo improve culture as applied to safety – a focus on practices is likely to be more successful. Practices repeated are “How we do things round here.”

Putting Safety Critical Controls at the heart of the prevention (and mitigation) strategy for MAEs is good for the culture!

69

HOFs – Examples of what we can do (1)

Deepwater Horizon HOF Issues

7 years LTI free award Leadership Focus Personal injury data not related to major accident prevention

Diverter: over-reliance on front line personnel

Human Factors Engineering Engineering design important in preventing human error

Focus on risk on environmental “spills”

Decision on cement plug integrity

Group think and confirmation bias

WAI vs WAD

Senior and respected “black hat” as part of team to challenge

Assumption re drillers instructions

WAI vs WAD Active monitoring of critical controls

70

HOFs – Examples of what we can do (2)

Deepwater Horizon HOF Issues

BOP – technical issues Maintenance induced error? Design, active monitoring of maintenance procedures

Previous incidents did not result in effective action to communicate and take action

Lessons Learnt processes ineffective

Many organisations identify “Lessons to be learnt” – lesson only learnt when tools, techniques, practices are changed and implemented

Important issues left to front line personnel

Availability Heuristic How well can we tell stories about low probability but high consequence events

Risk Matriceslegal blameworthy approaches especially front line workers

Fundamental Attribution Error

Hindsight Bias

Normative thinking and language prevalent

71

ConclusionWe know there are a variety of factors involved in major accidents But we are better at dealing with the engineering compared with the human and organisational Todays thesis is that naming and explaining some of these HOFs helps people to talk about them, research them and apply them in practice Some HOFs are easier to deal with than others eg reduce over focus on LTIs compared with managing group think – but techniques are readily available to address most HOFs

72

Q&A

Summary

Thank you

Date post:	19-Mar-2017
Category:	Presentations & Public Speaking
Upload:	safety-institute-of-australia
View:	624 times
Download:	0 times

Deepwater horizon revisited investigative insights

Presentations & Public Speaking