Dates for your Diary
1 February 2019. ICPEM 10th anniversary event
2 April 2019. ICPEM AGM
19 June 2019. ICPEM Conference
Further details to be announced nearer the dates
Dates for your Diary
1 February 2019. ICPEM 10th anniversary event
2 April 2019. ICPEM AGM
19 June 2019. ICPEM Conference
Further details to be announced nearer the dates
Originally published in Loss Prevention Bulletin 257 - October 2017
In 2013, Judith Hackitt, then IChemE President and Chair of the Health and Safety Executive, congratulated an audience at the Institution of Civil Engineers on the “excellent progress” that had been made in changing “safety culture”, but at the same time, warned that they had done “very little to address issues of process safety” as a result of which such disasters as Buncefield, Texas City, Macondo and “many more” had occurred.1
In the context of this paper, the management of personal safety includes such things as ensuring that personnel wear appropriate protective equipment and making efforts to avoid slips and trips on site. There seems to be general agreement that progress has been made on personal safety and it has become “embedded in the chemical and oil and gas sectors.”2 Process safety, on the other hand, focuses on preventing fires, explosions and accidental releases at facilities handling hazardous material, and responding to them should they occur. In its final report on the Macondo accident, published in April 2016, the US Chemical Safety and Hazard Investigation Board (CSB) reported that analysis has repeatedly shown that “imbalanced indicator programs focusing mostly on personal safety without an equal focus on process safety will not adequately inform a company of its emerging major accident risk, yet companies, industry groups, and even regulators continue to rely on such practice.”3
Reporting specifically on the two companies mostly heavily involved, the report said that whilst both British Petroleum (BP) and Transocean “collected, measured, and rewarded personal safety” issues, they failed to give “process safety the same attention”.4
Indeed, BP were accused of making decisions “that increased risk” and of displaying “a lack of oversight and operational discipline” in that what happened in the Macondo accident “were failures in process safety” designed to save “the company time and money”.5
Preparation consists of those measures to be taken to enable organisations to rapidly respond to an impending or actual serious accident, and prevent it from causing further damage. There are four key components to being ready for such an incident:
For the four components to be meaningful, chief executive and board support is essential. Top management must be committed in ensuring that all four are, from a practical point of view, part of company policy and not just words written on a piece of paper. Being ready is a continuous process, not just a chore to be forgotten when done once. Strong leadership is vital in ensuring that an organisation devotes sufficient time and effort to prepare for and be ready for such an event. The actions necessary to ensure this is so may be delegated, but responsibility and accountability will always remain with corporate management, so it is essential that they promote an environment in which process safety and production are seen as equally important.6
This does not appear to have been how BP looked at it in 2010 because the company was totally unprepared for the Macondo blowout in the Gulf of Mexico, in which 11 people were killed, and it took 87 days to stem the resultant oil leak. Consequently, in what was the largest accidental oil spill in history, there was extensive environmental damage. The lack of preparedness was later confirmed by Chief Executive Officer (CEO) Tony Hayward who admitted that BP “was not prepared”, that its “contingency plans were inadequate”, and the company was “making it up day to day” in the early stages.7
CEOs and other senior managers must broadly understand the vulnerabilities and risks involved and take responsibility for emergency planning for the range of consequences that could arise from a process safety incident, including the consideration of worse-case scenarios. Experience shows that the events for which a plan has been designed never go exactly as expected. Indeed, the military have a saying, “no plan survives first contact with the enemy”. It is the same with a major accident. No matter how carefully an organisation has planned, something will always occur that has not been considered. Therefore, at some point the plan will need to be modified. Sometimes there are options but there are serious time constraints. So there is likely to be a need for quick decisions. Inaction or inappropriate decisions can produce undesirable consequences and may have far-reaching implications. It takes a particular kind of person to make the right decisions under such circumstances.
In deciding the skills that are necessary to manage an event following a serious accident, there are two schools of thought. The first sees the skills merely as an extension of those used by managers in ensuring that the product is produced, stored or transported. Others see the skills necessary to manage the events following a major accident as distinct from those required in everyday operations.8
As long ago as 1990, Lord Cullen, in his inquiry into the 1988 Piper Alpha disaster, in which 167 people died, claimed that the role of the Offshore Installation Manager (OIM) demanded “a level of command ability which [was] not a feature of normal management.” He then devoted a whole chapter to “training for emergencies” in which he stressed the need for regular and realistic training.9
It is important to recognise that not everyone has the ability to manage emergency situations. Those who have a talent for successfully managing an organisation that is running on an even keel do not necessarily have the skills to manage an incident that involves uncertainty. As Lagadec has pointed out, “a great manager, who excels in periods of calm, will often be completely at sea when his universe topples into what, for him, is something quite unimaginable.” He added that what was needed on such occasions are “people who are prepared to expose themselves,” but unfortunately “such people are not legion”.11
Response relates to those measures that can be taken immediately prior to an accident or emergency, if there is some kind of warning of the impending event, and those measures to be taken during and following the impact. Effectively responding to a serious accident will be the most challenging part of any senior manager’s job, from the Chief Executive Officer down. The ability of an organisation “to respond will be reflected in the effectiveness of their internal communication systems, the preparedness of their staff, and hence the quality of their pre-hazard training, their ability to communicate with potential hazard victims and advise them on appropriate actions, and their ability to mobilise resources for hazard response activities.”12
Taking these four abilities in turn, firstly, an absence of effective internal communications was a factor which led ConocoPhillips (UK) Limited being fined £3 million and ordered to pay costs of almost £160,000 after it admitted at Lincoln Crown Court in February 2016 that it had put workers” lives at risk during gas leaks on a gas platform. The incident happened on the Lincolnshire Offshore Gas Gathering System (LOGGS) between 30 November and 1 December 2012. Gas was released into the atmosphere whilst work was being undertaken to replace a gas pressure control valve. The lives of the 66 workers on board were put in danger of death or serious injury from two sources, particularly if an ignition had resulted in an explosion. A breakdown in communications across the five platforms of LOGGS meant that some workers incorrectly believed the platform was free of gas. In addition, a loss of electrical power made management of the emergency more difficult, the company having failed to consider this as a possibility.13
Secondly, mention has already been made about the preparedness of staff and the quality of pre-hazard training in relation to the Piper Alpha and Texas City disasters. Thirdly, the ability of BP to communicate with potential hazard victims was seriously defective. When an organisation “is grappling” with the results of a serious accident, “it is vital to get your side of the story out” and “you need the news media to transmit information to the public.”14 But, as the company spokesman, CEO Tony Hayward “made a series of mistakes” and he eventually admitted the company had “not [been] prepared” to deal with “the intensity of the media scrutiny.”15 At the outset, BP was accused of being slow to acknowledge there was an initial problem and of not responding quickly enough. The company took four days to realise that the well was leaking; it was slow to express concern, compassion and full apology to victims who were most affected by the spill; and it intentionally underestimated the extent of the spill, stating that only 1,000 barrels (159,000 litres) were actually spewing into the Gulf daily, but quickly revised it upward to 5,000 barrels (795,000 litres) as other sources queried the first figure. To compound these errors, instead of expressing “compassion” towards the victims, Hayward initially took it “lightly”, minimised its impact on the environment by suggesting it was “relatively tiny” in comparison with the big size of the ocean.”16 Finally, given that it took BP nearly three months to stem the leak in the Gulf of Mexico, it was apparent that the company were unable to mobilise the necessary resources to respond to the blowout.
The failure of corporate management to plan for and respond to emergencies is not confined to the process industries. For instance, following the capsizing of the Herald of Free Enterprise in 1987 when 187 people lost their lives after it sailed with the bow doors open, it was revealed that senior managers in Townsend Car Ferries failed to heed the suggestions of the ferry masters over a period of two years prior to the accident that there should be a warning light on the bridge to warn them when the bow doors were still open.17 Consequently, no plans were in place to enable a master and crew to respond to this type of emergency. Whilst it was clear that the initial cause of the accident was the failure of a member of the crew to close the bow doors, the inquiry chairman, Mr Justice Sheen, stressed that “the underlying or cardinal faults lay higher up in the company” adding “from top to bottom the body corporate was infected with the disease of sloppiness”.18 On a slightly different tact, whilst there were plans in place at Stoke Mandeville Hospital to respond to outbreaks of Clostridium difficile between 2003 and 2006, the Healthcare Commission found a “significant failing” by senior managers in that they persistently overrode the advice of the infection control team, i.e. those responsible for implementing the plan to control infection, in their desire to achieve government targets.19 This is similar to organisations that emphasise production over process safety as was apparent in the Pike River mining accident in New Zealand in November 2010, when 29 people lost their lives. The Royal Commission appointed to investigate the tragedy found that “the board’s focus on meeting production targets set the tone for executive managers and their subordinates” and failed to ensure that the workers “were being protected”. The Commission found that the general attitude of the Board Chairman, John Dow, “was that things were under control, unless [he was] told otherwise” but, said the Commission, “this attitude …. exposed the workers at Pike River to health and safety risks.”20
Seven months earlier, in April 2010, a coal dust explosion in the Upper Big Branch Mine in Raleigh County, West Virginia, killed twenty-nine of the thirty-one miners who were at the site at the time. The resultant investigation by the Mine Safety and Health Administration (MSHA) found that there had been flagrant safety violations. The company running the operation, Massey, had deliberately broken the law thus “endangering the lives of their miners”. Alleging that Massey’s corporate culture was the root cause of the tragedy, it found that the company “promoted and enforced a workplace culture that valued production over safety.” The company was issued with 369 citations and orders, including 21 flagrant violations, and the MSHA imposed the largest fine in its history, nearly $11 million.21 But a more serious warning notice came to corporate management in April 2016 when the Chairman and CEO of Massey’s, Donald Blankenship, was sentenced to a year in prison for conspiring to violate federal mining standards. He was also ordered to serve a year of supervised release and pay a fine of $250,000.22
The Royal Commission into the River Pike mining disaster pointed out that protecting the health and safety of workers was “part and parcel of an organisation’s functions and should be embedded in an organisation’s strategies, policies and operations.”23 It briefly outlined what the board should have done. It needed: “to have a company-wide risk framework and keep its eye firmly on health and safety risks. It should have ensured that good risk assessment processes were operating throughout the company. An alert board would have ensured that these things had been done properly. It should have familiarised itself with good health and safety management systems. It would have regularly commissioned independent audit and advice. It would have held management strictly and continuously to account.”24
It follows that the responsibility for ensuring that plans are in place to provide an effective response to major accidents and emergencies rests with the Chief Executive Officer and the Board of the parent company. It is their responsibility to ensure that there are competent management, engineering, and operational personnel at all levels.25 It is their responsibility “to engage with the workforce”, ensuring, amongst other things, that emergency response plans are developed and maintained at all sites within the company and at an organisation-wide level, with appropriate levels of competent resources, both human and technical, available to execute the plans26. But, on too many occasions, senior management have ignored the warning signs of the possibility of a serious accident, sometimes for years, and have allowed organisational and safety deficiencies to exist which has meant that when such an incident did occur the response was less than effective.
Just over twenty-five years ago, Lord Cullen found “the quality of safety management by operators is fundamental to offshore safety”, but he added, “no amount of detailed regulations for safety improvements could make up for the deficiencies in the way that safety is managed by operators.”27 Although Cullen was referring to offshore safety, his comments are equally applicable to any organisation involved in the manufacture, storage or transportation of hazardous materials. Safety, particularly process safety, is an attitude of mind. Over twenty years ago, Patrick Lagadec claimed that, amongst senior management, there was “often a considerable reluctance to learn” about the possibility of serious accidents. Pointing out that such events happen rarely, managers decided “their time [was] best spent on other important issues.”28 But, as Donald Blankenship recently discovered, corporate management has a legal, as well as a moral responsibility to ensure that process safety is at the top of the company agenda.
Tony Moore is a former Associate Director of the Resilience Centre at Cranfield University. He was successively Chairman and Vice-President of the Institute of Civil Protection and Emergency Management. He was the co-editor of three issues of Tolley’s Handbook of Disaster and Emergency Management and is the author of the British Standards Institution’s publication on Disaster and Emergency Systems. He is a regular contributor to Crisis Response Journal.
The latest issue of Alert, is now available for download here.
Originally published in Crisis Response Journal, 12:4, August 2017
In the light of the catastrophic fire at Grenfell Tower in West London, Tony Moore looks back at recent high-rise building fires in Britain.
Two incidents within a month in 1999 should have alerted the authorities to the dangers of fires in high-rise residential blocks. On June 11, fire swept through Garnock Court, a 14-storey block of flats in Irvine, North Ayrshire, in Scotland, killing one person and injuring five others. The fire, which started in a corner apartment on the fifth floor, swept upwards on the outside of the building after a ribbon of cladding on the external walls caught alight. Within ten minutes the fire had reached the 12th floor. On July 3, 2009, a fire at Lakanal House, a 14-storey block in Southwark, London, killed six people. The blaze broke out as a result of an electrical fault in a TV in a ninth- floor flat, and spread through the block: “With a ferocity that baffled firefighters and terrifed residents.” Subsequently it was revealed that Lakanal House had been due for demolition in 1999 but, instead, in 2006-2007, landlord Southwark Council opted for refurbishment, including the fitting of cladding panels offering less fire resistance than those they replaced. In February 2017, Southwark Council pleaded guilty to four breaches of fire regulations, including failing to carry out an appropriate fire risk assessment.
London Fire Brigade’s Assistant Commissioner for Fire Safety said: “All landlords, including large housing providers, such as councils and housing associations, have a clear responsibility under the law, that their premises meet all fire safety requirements and are effectively maintained to provide protection in the event of a fire, and keep their residents safe.”
Since then, there have been other warning signs. On April 7, 2010, two firefighters died tackling a fire at the 15-storey Shirley Tower in Southampton. At the inquest, the Coroner called for the retrofitting of sprinklers to be considered in all high-rise blocks. On February 4, 2011, two women died in a fire that had been deliberately started on the 16th floor of Marine Tower, a 17-storey block in Deptford, South London. A woman was subsequently convicted of manslaughter. The owner – Lewisham Homes – was fined and ordered to pay prosecution costs, after admitting failing to maintain fire doors, which had allowed the fire to spread, and failing to review an existing fire risk assessment. After passing sentence, Judge Christopher Heir said it should be a “wake-up call” to all housing providers to ensure fire safety features in buildings are properly maintained.
There were three further warnings within a four-month period in 2016, although none involved fatalities. On June 11, fire spread upwards from a ground floor flat in a 16-storey premises at Canterbury Crescent in Brixton, South London. Approximately 50 people were evacuated; three people were hospitalised. On August 19, a faulty tumble-dryer caused a fire in a flat on the seventh floor of Shepherds Court, West London. the flames spread up to the 11th floor, via the outside of the building, before they were brought under control. On September 29, fire broke out in an unoccupied apartment on the 13th floor of Handsworth House, a 17-storey residential block in Portsmouth. The top five floors were quickly evacuated as firefighters fought the blaze. Three firefighters were treated for heat exhaustion and 30 residents suffered from smoke inhalation.
In the aftermath of the Grenfell Tower fire, Ronnie King, honorary secretary of the All-Parliamentary Fire and Rescue Group, and a former chief fire officer, claimed that it seemed governments needed to: “Have a disaster to change regulations, rather than evidence and experience. It was the same with the King’s Cross fire and the Bradford City football stadium fire. They always seem to need a significant loss of life before things are changed.”
In November 1936, as the Second World War loomed, Winston Churchill said: “The era of procrastination, of half-measures, of soothing and baffling expedients, of delays, is coming to its close. In its place, we are entering a period of consequences.” Successive governments have procrastinated and delayed legislation that would, at least, have prevented the Grenfell Tower fire from being so catastrophic. At the same time, owners and managing agents of high-rise blocks have procrastinated and delayed the implementation of lessons identified following the fires at Lakanal House, Shirley Tower and Marine Tower. Now they must all face the consequences.
The response to disasters regularly dominates the news but the complex long-term process of recovery – providing shelter, rebuilding homes, restoring livelihoods and shattered lives - frequently fails attract the attention of the media and, indeed, the aid agencies themselves.