Thank you very much to the organisers for the invitation to join you today. I very much value opportunities to address international audiences especially on the topic I've been asked to speak to you about this afternoon.
My belief is that strong leadership is crucial in the major hazard industries and because many organisations in this sector operate globally with a reach that gives them widespread influence it is vital that this concept and the things that underpin it are understood internationally.
So in my remarks I'd like to cover three broad areas to explain how effective leadership is a key element in the drive towards excellence in all aspects of health and safety, but especially process safety:
As I stated in my opening comments, the issues associated with major hazard industries are international. In the last few years, we have all received very stark reminders that in hazardous industries the consequences of plant process failures are not just serious but can be truly catastrophic. In the US in 2005 the major incident which occurred at the Texas City Oil refinery resulted in 15 fatalities. In the UK, in the same year, the biggest ever peacetime explosion occurred at an oil storage depot in Buncefield. Whilst this incident did not result in any loss of life there were numerous injuries, widespread damage to offices and homes nearby, as well as having a substantial impact on the local environment. The simple reason for there being no fatalities was that the incident happened at 6am on a Sunday morning – on any weekday during the normal working hours the results of the same incident would have been truly catastrophic. And, only last year, the events in the Gulf of Mexico on Deepwater Horizon show the enormous scale of human, economic and environmental devastation which occur when fundamental principles of process safety and asset integrity are overlooked.
Everywhere I go there seems to be a growing level of interest and stated commitment to process safety, but sadly this does not always translate into consistent measurable improvement in performance. For example, in Great Britain where we require major hazards industries to report loss of containment to HSE, in the last year alone there have been over 100 loss of containment incidents, more than half of which were considered to be precursor events for a potential major accident. That equates to an average of two loss of containment incidents every week, one of which had the clear potential to develop into a major catastrophe. I use these statistics to illustrate the magnitude of the problem which we all face, I am not suggesting that there is a greater problem in Great Britain than elsewhere but it does highlight why we should all be concerned. Sooner or later one of those "potential" catastrophes will become a real one, somewhere. Our luck is going to run out.
But If we are going to address the issue there are several factors which we need to consider.
First of all let us consider what we can learn from the past. Some of the more recent tragic events which we have seen in the major process industries remind many of us of other events which have happened before.
For instance Flixborough, which I've included because I regard it as my own personal "wake up call" - a long time ago.
The Flixborough accident happened on 1st June 1974. On that Saturday afternoon, there was a large explosion at the Nypro site in the North East of England. 28 workers were killed in the explosion and a further 36 suffered injuries. The numbers of casualties would have been many more if this incident had occurred on a weekday rather than a Saturday. There were a further 53 reported injuries to members of the public in the neighbourhood and there was considerable damage to offsite property.
Three months before the explosion it had been discovered that there was a vertical crack in the fifth of a series of reactors in the process and the crack was leaking cyclohexane. After shutting down to investigate the problem the decision had been taken to remove the leaking reactor and to install a bypass connecting reactors 4 and 6.
On the 1st of June that bypass system ruptured resulting in a large leak of cyclohexane which formed a vapour cloud and exploded. All 18 people in the control room were killed when windows shattered and the roof collapsed. Fires burned onsite for over 10 days. So let's consider the causes of this tragic accident:
The incident happened during a start up when people were stretched and under pressure.
I was a student at Imperial College in London studying to be a chemical engineer when the explosion at Flixborough happened. Of course all of my fellow students knew from our chemistry lessons in school that reactions could run away, some of us had even had it happen to us during practicals. We had all been taught about the importance of process safety in design as part of our university course. But there is something very different about seeing for real the scale of human life lost and the physical devastation caused by a major incident that creates a very different feeling towards the subject of process safety, as opposed to learning about it from books or in theoretical terms.
When I graduated and took up my first job in the chemical industry with Exxon a year after Flixborough it was clear that the explosion and the extent of the tragedy had had an enormous impact throughout industry. It was standard practice for young engineers in many companies to be trained in Hazop and Hazan. Multi-disciplinary teams would pore over any change proposed to the process. It was standard practice to assume that every piece of hardware might fail and to discuss and explore what would happen if it did.
But then in 1988 the UK saw a major disaster occur in its offshore oil and gas industry in the North Sea on Piper Alpha – 165 people were killed in the explosion and fireball that engulfed the installation located 190 kilometres north east of Aberdeen.
The subsequent inquiry carried out by Lord Cullen concluded that the initial cause of the explosion had been a condensate leak which was the result of maintenance work being carried out simultaneously on a pump and related safety valve. The maintenance and safety procedures were found to be inadequate as were arrangements for refuge and evacuation.
One of the reasons for highlighting both Flixborough and Piper Alpha in this presentation is to remind us that at the heart of both of these incidents lay a very similar problem.
At Flixborough the design of the process was compromised when an unengineered bypass was put in place in order to continue to run the process when a reactor was taken out of service. In the case of Piper Alpha the design integrity of that installation was also compromised long before the tragic accident happened in 1988 – it occurred at the point when the platform, which was originally designed for oil production, was converted for use as a gas platform and the fire and blast protection measures were inadequate to deal with the contingencies of a gas production platform.
Buncefield, which I have already mentioned and, which I'll return to some of the lessons which have emerged from the 2005 explosion later in my presentation.
So if the lessons from the past are there to be learned, and in the immediate aftermath of incidents the commitment to implement the learning was demonstrated what has happened? What in HSE's view, are the major factors that have lead to the 'decay' which occurs in learning processes and continues to contribute to nearly all of the major accidents we've seen in the distant past and more recently? Well our evidence shows that those factors cant be marked out as follows:
Automation and process control has brought many benefits but has also increased the remoteness of the process itself and the hardware from the vast majority of people. Process operators now monitor and control processes via computer screens and increasingly complex process control systems which run the process much more steadily and reliably also can create a false sense that the computer wouldn't let things go wrong.
So what has HSE done about these concerns in the UK? Can we offer any lessons or suggestions to others on how to address these issues? Well back in 2008, HSE organised a major conference for GB-based major hazards industries called "Leading from the top". Unusually perhaps, our target audience was not engineers and technical specialists within the major hazards industries but the people at the top of the organisation – the most senior managers and directors. Our message to them was that there was a real need for everyone to take note of what had happened at both Texas City and at Buncefield. Remember that when we held this meeting the Gulf of Mexico incident had not happened otherwise that would also have been on our list. It was a very deliberate decision to bring all sectors together for the discussion because, I had seen first hand whilst I was still part of the industry the ease with which people rationalised away - "this is a different sector to mine so there's nothing for me to take note of here".
And I'll pause briefly at this stage and introduce something that's happened recently that emphasise this point – the Fukushima nuclear power station incident in Japan. Earlier this month, the Chief Inspector of the Office of Nuclear Regulation in the UK, Mike Weightman, published his interim report into the incident and review of the robustness of the UK's nuclear regulatory regime in its aftermath. The report draws a number of conclusions and makes several recommendations which are predominantly for the UK Nuclear Industry to act upon. But what this incident has shown and what all major hazard industries should take note of is the global impact events of this nature can have especially on the public's confidence and trust of an entire sector. Whether it be Longford, Bhopal, Deepwater Horizon or Buncefield – we must realise that it's often difficult for people to differentiate between a site, organisation or industry. That's why it's so important that we all not only strive to be the best in our own organisations but that we work together to share knowledge and lessons so that we can all seek to build public confidence. We cannot hope to reassure and build public confidence simply by talking about our commitment to safety. It has always been the case that we will all be judged by our performance not our words, and in major hazards industries which are truly global the impact of an incident anywhere in the world impacts upon and has consequences for us all. When industries become much better at doing the right things and sharing that knowledge, it will become easier to (re)gain public trust and confidence. Industry and regulators will be better able to explain clearly, using language that is comprehensible to all, what the real risks are and how they are being managed.
There was also a line in the Executive summery of the Fukushima report that, although directed at the nuclear industry, everyone in the major hazard sector should give consideration to:
"No matter how high the standards of nuclear design and subsequent operation are, the quest for improvement should never stop. Seeking to learn from events, new knowledge and experience, both nationally and internationally, must be a fundamental feature of the safety culture of the UK nuclear industry"
Of course as I've said you can swap "nuclear industry" for any major hazard sector.
So by bringing leaders of all the major hazards industries together at the same conference as we did 3 years ago, our message was loud and clear: "You are not as different as you think you are and you have all got lessons to learn from one another".
We used the conference as a platform to highlight the importance of measuring and reporting the right things. In particular we made clear that the right things will only be measured and reported if the senior managers in the organisation are asking the right questions and responding appropriately to the information when it is reported.
Measurement of leading indicators of performance, which is a fundamental element of process safety, means that by definition you are measuring the signs that things are not going as well as they should and that disaster has not yet happened. If the: "not broke, don't need to fix it" mentality still prevails at the most senior levels no-one is going to take any notice of those leading indicators in a timely manner.
To do this senior managers need to have a better understanding of the processes they run and respect the nature of those processes that generate their business' profits – to understand what can go wrong – no matter how unlikely and to appreciate what the human and business consequences of those things going wrong might be.
Requests for money to de-scale and paint equipment, to test critical safety equipment are not expenditures with no added value or no return or purely for cosmetic purposes, they are normally a crucial element of assuring continued returns into the future through preserving the integrity of the all important assets. Unless the most senior levels of an organisation's management understand and factor this into their wider considerations, they can not satisfy themselves that they are leading the organisation in the right direction for the long term. What's more, they will not develop assurance and management systems which report the right things and they will not create an organisational culture which fosters the right human behaviours.
Real leadership is characterised by skills and competences which go beyond technical expertise. Exceptional people skills, the ability to influence and motivate and above all to communicate in language that is meaningful to people is also crucial.
And I believe it is important that directors and managers adopt an approach that is personal as well as process-driven. It is vital to get out and about – to visit workstations and talk to staff. Leaders have a responsibility to engage with the workforce so that they understand what the risks are and can see what their role is in managing them. It is important to have employees who are competent and confident in dealing with the things that really matter and who feel they are engaged constructively in managing all aspects of health and safety.
This requires specific, tangible interventions that empower individuals. Key for me is winning hearts and minds by motivating and coaching everyone to play their part, rather than for a small group of people charged with health and safety to take sole responsibility.
Our message to senior managers at the conference back in 2008 and reinforced by all of our activities with major hazards industries since then has been about the importance of leadership of setting an example and setting the right tone. We re-stated this point when we launched our new strategy for health and safety in Great Britain in 2009. The strategy clearly states that leadership is not just important - it is fundamental. Because without that leadership from the very top of the organisation, none of the rest of the elements of a strong health and safety system will happen.
There are many books on the subject of leadership. But much of what is written focuses on personal leadership styles and how to have the most impact. Less attention has been paid to the role of the leader in ensuring continued success of the organisation long after he or she has moved on. Leaders need to ensure that the most important knowledge and learning is passed on. It is absolutely vital that in times of change leaders pass on to their successors – whether they are part of the same company or not – the important lessons of the past that have been learned both locally and more broadly from other similar industries. No matter how long the run of good "incident free" operation, no-one must ever become a leader in the major hazards industry without understanding and believing the realities of the processes they are dependent upon for their wealth creation and the importance of listening to those who are closest to those processes when they warn of what might go wrong.
Whilst the consequences may be different in some respects, the parallels here with the financial sectors over the same period of time are worthy of reflection. Perhaps there is something fundamental we need to teach to all future managers and leaders about believing that things can go wrong and that assumptions of continued, uninterrupted growth and ignoring of risks are dangerous management philosophies in any sector of the economy. The ability to think about the worst that can happen is not a popular idea in any field but I believe it is crucial. Unless leaders are able to think about and to envisage the consequences of things going wrong not just in financial or business terms but even to the extent of thinking about how they will feel if lives are lost - they will not take action to address and mitigate the risks of these events taking place.
I promised earlier that I would return to Buncefield as one of my case studies. The process of investigating the Buncefield explosion and fire was groundbreaking in the way that the early publication of a series of reports on the findings shared lessons early as the Major Incident Investigation Board generated them. Earlier this year the prosecutions associated with this case reached their conclusion and HSE and its competent authority partners completed a final report which was published in February. This final report highlights the major failings that caused the incident and identifies the key learning points which all industries can and should take note of and action. I wish I could tell you that there is something completely new in this report that we have not learned before but that isn't the case. The report highlights many of the points I have already made to you that we could and should have learned from past events.
The case emphasises again the failure to understand major risks, a failure to provide adequate focus, resources or expertise to maintain safety critical barriers and a failure to respond to warning signs.
The significance of safety critical equipment was not recognised by the supplier, the installer, the maintainer or the user; repeated failures of equipment were not acted upon, increasing pressures from above onto operators and management made compliance with safety procedures difficult if not impossible.
Behind the physical failures of which we are all aware lay much broader management/leadership failures at a site fed by pipelines which operators were not in direct control of in terms of flows or nature of product. For example, levels of throughput had been increased reducing the ability of site management and staff to monitor the status of receipt and storage of fuel. Those pressures were increased by a lack of engineering support from Head Office. Keeping the process running was the focus and the priority and process safety did not get the attention it needed. The warning signs were there but no-one asked the right questions and there was no effective assurance system to pick up the underlying problems.
I now want to turn to an example of good practice to show what can be achieved when leadership really happens. This is the case of an energy company – Scottish Power – which has learned lessons on process safety from the traditional process and major hazards industries. They have shown leadership in their willingness to learn from others outside their industry sector and in doing so have probably become the best in class.
Scottish Power adopted the principles of process safety management as part of their Operational Transformation Process. The programme was aimed at applying processes and procedures to the understanding of and control of dangers associated with Scottish Power's assets.
In the UK, Scottish Power, part of the Iberdrola group worldwide, is one of the big 6 energy suppliers with over 5 million customers and some 6GW of generating capacity. The energy generation business has some important features which differentiate it from other major hazards industries perhaps – not least the immediacy of their processes. Energy generators must react very rapidly to changes in demand and stay online to meet contracted commitments.
In adopting a new approach, Scottish Power has changed its operating philosophy from one that hoped that nothing unexpected or unplanned would happen that would prevent them from meeting their commitment to one based on building confidence throughout the organisation in their ability to deliver these commitments.
They admit that their own wake-up call came as a result of a major plant failure - a major mechanical failure that totally disabled one of their generating sites in Scotland for several weeks. As well as reengineering the mechanical system, they used this incident as a turning point to introduce a company wide system of real time KPI measurement against all critical components in their process safety management system. What's so different is that the system is visible to everyone in the organisation at all locations: operators, managers and board members. The system can be used not only to monitor but to compare performance between sites by anyone because they took the time to bring people together to agree a common set of parameters to measure so that meaningful comparison is possible.
I have seen the system in action, the way it is used at all levels and the way in which it has changed the culture. What is clear is the crucial role that Board level leadership has played in bringing this change about. They embarked upon a change of approach which did not deliver instant fixes but took time to embed, they established a fully transparent system where the actions and decisions taken at every level are visible to the entire organisation. The level of capital investment in hardware to effect the change was minimal but the investment of management time in leading the process to make it a reality was - and is - considerable. But they have already seen the business benefits – a dramatic increase in plant availability, huge savings in maintenance costs from fixing problems before they lead to failure, enhanced business reliability and reputation with their customers and they have reduced the likelihood of a major incident.
If we look to the future, it is clear that we need to (re)generate a better understanding of risk and a greater commitment to building inherent safety into plant design, operation, control and management. Many of the plants and equipment which have already operated for many years will continue to be hugely important processes for the future. We need many more leaders to adopt the Scottish Power approach to risks which they are already managing – a willingness to look again at familiar problems and processes with a fresh pair of eyes. And to consider new and innovative ways of making process safety in integral part of everyone's role.
I understand that re-learning lessons which should have been learned before is particularly hard because it requires acknowledging that there has been a failure of leadership and management in the past. But this is an aspect of human factors and behaviour which need our focus and our attention. Because, just as I have said that leadership is fundamental to building the right culture, it follows that the human factors which influence leaders and managers are fundamental to understanding the human factors and behaviours which occur at lower levels in the organisation.
One common factor across all the industries represented here under the major hazard industries umbrella, is the fundamental need to ensure the primary containment of potentially hazardous products on site. All industries recognise the danger of any kind of release and in the downstream oil and gas sector the major one is associated with hydrocarbons. Understanding that, I now want you to take a look at this CCTV footage and to consider the human factors in relation to it.
I know it prompts all kinds of responses but the key ones for me and the questions I think you need to ask yourselves and ensure the leaders in your organisation understand the importance of are: