Wednesday, June 29, 2005

Lessons From Texas City

It seems to be getting harder every day for BP to convince the world that workers were to blame for the March 23 explosion that killed 15 and injured 170, especially when information uncovered by the Chemical Safety Board (CSB) reveals that alarms and warning indicators weren't working, and when BP itself admits that it had failed for years to replace a dangerous antiquated process. The full text of yesterday's CSB press conference explaining the problems at BP can be found here.

The United Steelworkers, who represent workers at the plant, certainly aren't buying BP's blame-the-worker story, although BP says that's their story and they're sticking with it:
Gary Beevers, Region 6 director of the United Steelworkers, said after the briefing that the board's revelations amounted to "vindication" of the operators and others who were fired and disciplined by the company.

In releasing its interim investigation report, BP Products North American President Ross Pillari had said that the accident was caused by "surprising and deeply disturbing" mistakes by workers.

Beevers said the union's own investigation will continue to uncover evidence that the workers may not be as responsible for the accident as BP has said. "We think there are more things going on here," he said, adding that the workers should get back their jobs.

BP spokesman Hugh Depland said the company stands by its interim report, released May 17, and the personnel decisions it made in the wake of it.

"BP continues to have no doubt about the provisional critical factors published in our interim report, or the subsequent personnel decisions taken by the company," Depland said. "If personnel responsible for safe startup of the isomerization unit had followed procedures, the fire and explosion would not have occurred."
Although the Chemical Safety Board warns that the root causes of the accident will not be confirmed until the Board actually votes on the BP report, it is clear that all the facts will eventually come out.

Not so, however, in the every-day American workplace. BP's blaming the workers for the incident is not an exception, but the general rule in American workplaces. And, unfortunately, unless there is a good union trained in workplace safety principles that has some idea of how to do a root cause analysis of an incident, management usually gets away with blaming the workers, and meting out "appropriate" punishments.

The problem with this method, aside from being unfair, is that it will do nothing to prevent future similar incidents. You can fire all the workers you want at BP, but if you continue to run an antiquated system, if the indicators don't work and the alarms don't go off, you're going to have more incidents.

BP claims that if the workers had just followed the correct procedures, the explosion wouldn't have happened. In other words, if things hadn't gotten out of hand, it wouldn't have mattered that the alarms and indicators didn't work. In theory, this is true. In real life, however, it's faulty -- and dangerous -- thinking. In real life, shit happens, things break, procedures don't work. That's why large complicated process (such as those that exist in refineries) must be accompanied by something called "Layers of Protection".

In this case, when a distillation unit called the raffinate splitter overpressurized, it dumped hydrocarbons into a tower called the blowdown drum. This was normal, but also the first problem. The blowdown drum was an antiquated system dating from the 1950's, replaced years ago in most refineries by a flare system that harmlessly burned off the hydrocarbons. In fact, as far back as 1992, OSHA warned the plant to replace the blowdown drum.

The problem with the blowdown drum is that you can't let it overflow. A first layer of protection would be indicators showing how full the blowdown drum tower was getting. In case this didn't work or someone didn't notice it, a second layer of protection might be an audible alarm to warn operators that something was wrong. A third level might be some kind of automatic shutdown mechanism. In Texas City, neither of these first two basic layers of protection were functioning. The blowdown drum was only supposed to be filled to the 10 foot mark before the alarms went off, but while the indicators were showing normal levels and the alarms were silent, the actual level reached 120 feet.

The lesson here for workers and investigators is that major alarm bells should go off any time you read that the cause of an accident was "worker error." Keep asking why the worker made the alleged mistake, and with every answer, ask why again until you reach a point where nothing can be done to correct the problem.

Otherwise, the real cause of the incidents will never be revealed, and to paraphrase George Santayana, "Those who do not learn the real causes of accidents are condemned to repeat them."