Future Energy

Safety Culture!

Source: Wata-Malaysian Oil & Gas Engineer

In the course of a recent conversation with one of my clients' senior leaders, the discussion turned to ExxonMobil and that company's consistantly strong financial performance, due in large part to its rigorous approach to risk management.  ExxonMobil consistantly places number one on lists such as Platt's Top 250, which ranks energy companies on their financial performance, and the company has long been thought by many financial analysts to be the most "sustainable" oil and gas company.  While I may disagree (strongly) with ExxonMobil's past position and role on issues such as climate change its hard not to be impressed with the discipline the company appears to bring to its operations.

My discussion of ExxonMobil ended with reference to a statement given by Rex Tillerson, Chairman and CEO of ExxonMobil to the U.S. National Commission on the BP Deepwater Oil Spill and Offshore Drilling back on November 9th, 2010, in which Tillerson outlines ExxonMobil's approach to safety, operational integrity and risk management.  Specifically, Tillerson talks about the development of the company's Operational Integrity Management System (OIMS) and, perhaps more importantly, the development of ExxonMobil's safety culture.  Noteably, Tillerson makes the point that a successful approach to safety demands that a corporate commitmnent to safety should be a value, not a priority.  

Whats the difference you might ask?  In Tillerson's view, it appears to be that a value becomes part of the culture - it goes beyond the written rules, standards and procedures and influences the unwritten standards and norms that shape employees and leaders mindsets, attitudes and behaivours.  

Companies must develop a culture in which the value of safety is embedded in every level of the workforce, reinforced at every turn and upheld above all other considerations.

Interestingly, he attributes ExxonMobil's journey along the path to a sustainable safety culture to the Exxon Valdez oil spill disaster (and seems the reinforce the notion that sometimes it takes a disaster to build consensus for change).  ExxonMobil's safety objective is "Nobody Gets Hurt".  Commenting on the transformation of the company's culture to achieve that objective, he clearly defines the end game:

When an organization reaches the point where everyone owns the system and believes in it, only then at that point, the culture of safety and operational integrity has been established that can be sustained - when it enters the hearts and minds of the people of the organization and becomes a part of who we are.

The statement to the Commission provides an excellent overview of the framework that has been constructed within ExxonMobil to support a safety culture.  In particular, he outlines many of the elements of the company's OIMS.  Summing up, Tillerson outlines three key considerations with respect to safety culture:

1. A culture of safety is born within an organization.  You can't buy a culture - you have to make it yourself.
2. Creating a strong, sustainable safety culture is a long process.
3. Leadership by example and thoughtful, honest and objective self-assessment are essential.

While the safety literature is replete with lists of what is required to achieve a high performance safety culture, Tillerson's list is jargon free and as good as any.  Notably, his remarks also give strong weight to the role of OIMS - that is the system and tools that give substance to what might otherwise be empty rhetoric.  This is an improvement over some of the safety literature which seems to think leadership is enough (like much management literature these days), discounting the role of rigorous management systems.  In my view, both the systems and the leadership/culture are essential - one reinforcing the other.  A strong culture without workable tools to operationalize concern for safety won't produce a result.  And neither will tools without the culture demanding their use.

What got me interested in Tillerson's statement originally, was what it suggested for developing a "culture" around other performance imperitives - such as sustainability.  But thats a conversation for another post. 

 

Pragmatic Regulation: Sparrow and the Control of Harms

“Pick Important Problems and Solve Them”

Malcolm Sparrow, a Harvard professor in the Kennedy School of Government and ex-British cop, has spent a decade or more popularizing this phrase and the approach to regulation that it summarizes.  In his most recent book, The Character of Harms: Operational Challenges in Control, he looks closely at the difficulties of picking and solving regulatory harms or risks and has this to say:

“However simple that sounds, it turns out that organizing around carefully selected and important pieces of risk - rather than around traditional programmatic or functional tasks, or around core-high-volume operational processes – is extraordinarily difficult for agencies or institutions to do.”

Harms or risks, as defined by Sparrow can include international terrorism, hunger, war, child mortality, loss of environmental resources, crime of all kinds, etc., etc., etc.  In Sparrow’s words, “much of the unfinished business for the human race consists of harms, threats, or risks of one kind or another, insufficiently controlled”.

Solving harms is a different kind of work from the routines practiced by most regulators and others in the risk management business.  It even gets its own acronym, ROPE (Recognize, Organize, Perform, Explain) to distinguish it from the functional and process-based approaches normally practiced by regulators.  Introducing the characteristics of his approach to solving harms, Sparrow describes it as “spot the knots, study them and unpick them one-by-one”.  More prosaically, he describes the four important properties of the approach:

• Addresses specific, tightly defined concentrations of harm;
• Involves a prolonged period of analysis resulting the development of hypotheses about what the specific problem really is;
• Results in interventions that are qualitatively new, not merely a mix of existing functions and methods; and
• Projects involve multiple agencies and organizations working in collaboration because the problems frequently straddle jurisdictional and pragmatic boundaries.

Sparrow advocates a pragmatic, practical approach to regulation, urging regulators (and readers) to understand the problems facing them before worrying about which tools, tactics or times to intervene and to avoid ideological preferences.  He goes further, suggesting that practitioners ....

“respect the natural shape and size of the harm itself.  Fashion your response around its structure, rather than forcing the harm into your structure.  Use a control structure which mirrors the structure of the harm itself.”

And in his opinion the people chosen to carry out this type of work matter (they always matter, but it’s nice to read an author that understands that).   

“The analysis and planning stages favour creative, analytic-types; not champions of particular functions with entrenched views; not necessarily senior staff or authority figures; rather those who work well in lateral teams, far away from their normal supervisor, the only one-of-their-kind in a diverse group; people not wed to any one particular set of tactics but willing to engage in brain-storming, working and re-working strange new ideas until they eventually morph into something feasible, legal, publicly acceptable and (hopefully) brilliantly effective.”

In short, pragmatic, practical people.

It would take a book to adequately describe his approach and that is what Sparrow very ably provides.  And it's divided into two sections: the first half provides the how-to, with sections such as “A different type of work”, “Defining the problems: setting the scale”, and “Puzzles of measurement”.

The second half of the book tackles special categories of risk such as invisible harms, catastrophic harms and conscious opponents.  In each case providing insight into what’s different and how responses must be tempered to address the specifics of the particular type of harm.

Perhaps most importantly, is that the approach is not just for regulators.  It can be applied equally well to the management of risk by other organizations, corporations, NGO's ..... wherever individuals are struggling to manage risks associated with the potential harms of our day.

It’s a very good read if you are interested in effective regulation and the art of risk management.

Enjoy.

Too Many Oil Spills

Source: solveclimate.com

In April (through July), it was BP's Macondo well in the Gulf of Mexico.  Last week, Enbridge's pipeline failed releasing one million gallons of crude into the Kalamazoo River in Michigan.  And in his blog at Solveclimate.com, David Sassoon provides a photolog of the Chinese oil spill at the Yellow Sea port-city of Dalian (see Bare Hands Clean-Up of a Horrible Oil Spill, July 29^th).

These are certainly spills that have captured the horror of press and public across much of the world.  However, a recent report by the Wildlife Federation of America makes the case that as devastating as this small number of spills might be, they are only the tip of the ice-berg.  Bradford Plumer writing in the Vine Blog (The New Republic) (see Oil Spills Everywhere, July 29^th) identified the report - Assault on America: A Decade of Petroleum Company Disaster, Pollution and Profit in which the National Wildlife Federation takes a strong stand.  In fact stronger than I would have expected from this type of NGO.

Major oil spills are really only a small part of the real story. From 2000 to 2010, the oil and gas industry accounted for hundreds of deaths, explosions, fires, seeps, and spills as well as habitat and wildlife destruction in the United States. These disasters demonstrate a pattern of feeding the addiction to oil leaving in their wake sacrifice zones that affect communities, local economies, and our landscapes.

The report provides a Map detailing thousands of petroleum company accidents, spills and other incidents (explosions, fires, etc.) in the U.S. between 2000 and 2010.  The report also highlights five or six of the more significant incidents each year. 

Finally, NWF provides a list of recommendations for ending the industry's history of spills, including:

• eliminate the cap on liability for damages caused by oil and gas disasters
• remove exemptions from the Clean Water and Safe Drinking Water Acts for oil and gas development
• implement new monitoring measures
• reform royalty structures for oil and gas leases on federal land
• pass comprehensive climate legislation in the U.S.

(In all NWF provides 13 recommendations.)

Working in the oil and gas industry obviously leaves me somewhat conflicted when I look at a report like this.  On the one hand there is no question that the incidents are unacceptable - in this regard, NWF does a good job of bringing them all together in a way that helps the industry to begin looking at the systemic causes.

On the other hand, an industry as all encompassing as the oil and gas sector and working as it does in some of the most inhospitable environments on earth will have incidents.  We and our economy are dependent on petroleum products; these incidents are the price of such dependency.  (To be fair to the NWF, many of their recommendations relate to decreasing the addiction.)

No doubt the long term answer is to reduce use of petroleum.

However, in the the short term there are several answers:

• Effective regulation that recognizes and acts on the key risks facing the industry.
• Better identification of the risks by the companies developing petroleum.
• Much better design and implementation of risk management systems to ensure that qualified people work safely to develop a volatile resource.
• Real senior management oversight of how their companies are managing the social, safety and environmental risks associated with their activities.

My understanding of NWF is that it is a relative moderate among the NGO's calling for the oil and gas sector to change.  And if they are concerned enough to use the language that appears in this report, its well worth paying attention to what they are saying and what they are trying to say.  So to close, over to NWF:

The total cost of the status quo —– in lives lost and health risks as well as social and environmental degradation —– is far too high. The sooner we move in the direction of meeting our energy needs through cleaner, safer sources.

The negative consequences for our health, our land, our climate and our children’s future are too great to continue to depend on oil to power our economy. Now is the time to put enact laws that favor and encourage safe and clean energy development and remove federal subsidies and tax advantages for oil and gas development. Now is the time to increase mitigation fees. Now is the time to create an oil and gas disaster fund paid for by industry. Now is the time to draw lines around environmentally sensitive areas that are made permanently off limits to oil and gas development.

And now is the time to cap global warming pollution from all oil and gas production —– including every aspect of the uncontrolled extraction and refining processes where methane, carbon dioxide, and other global warming gases are released into the air every day.

The BP Deepwater Horizon spill is truly a tragedy of our time. It should be used to take a closer and more comprehensive look at the full and continuing costs that the oil and gas industry continues to impose on society with its pollution, environmental degradation, habitat destruction, wildlife loss, worker and community endangerment, health effects consequences, and loss of life.

Controlling Risk with Malcolm Sparrow

Last week while trying to get some information on a recent book by Malcolm Sparrow, I came across an interview with the man himself.  I was trying to make up my mind about ordering his book, The Character of Harms, and had hoped to find enough information to make a decision.  However, the interview was interesting in its own right and seemed worthy of a quick post.

I first came across Sparrow, a researcher at Harvard and ex-British cop, in an earlier book entitled The Regulatory Craft.  As a consultant that focuses on regulatory management, I am always looking for good writing on the subject and Sparrow's book was one of the best I've come across in recent years.  (Very quickly, his thesis in The Regulatory Craft was that regulators should "pick important problems and solve them" as part of a focus of focusing on the delivery of obligations.  It strikes a counterpoint to the many prescriptions for regulatory reform that focus, in his view wrongly, on customer service, process improvement, etc.)

In his interview, (and I suspect in his most recent book) Sparrow again focuses on the careful identification and solving of regulatory and other risk related problems, extending the direction advocated in The Regulatory Craft.  In discussing this approach, he hits on three key themes, including:

• Catastrophic risks, much in the news these days, lack the frequent, low-level events that would normally provide a basis for training, practice and prevention.  Put another way, there are too few events to support a a feedback loop.  To successfully manage catastrophic risks then, regulators and others must shift their focus to near-misses and precursor events.

• Regulators should focus on spotting emerging problems and suppressing them quickly before they can do much harm - "that doesn't mean waiting for three years for new legislation, but using available tools and enlisting relevant partners and getting into it quickly, devising a solution ..."

• This approach is not just for regulators, it applies equally well to corporate risk management and in fact any forum in which managers are struggling to manage risks relating to potential harms.

I am a strong advocate of designing and building proactive management systems to address the risks that affect companies and regulators.  However, I do believe that the practical, evidence-based approach advocated by Sparrow makes sense for addressing those problems that inevitably squeeze through even the best management systems.  So I recommend reading the interview for yourself - its short and won't take you long.  I recommend Sparrow's books even more.

Incidentally, I did buy The Character of Harms and with 30 minutes invested in reading thus far, it looks like it will be good.

More lessons in risk management from the Deepwater Horizon

Source: Treehugger

The NY Times has put together a detailed look at the issues and failures behind the Deepwater Horizon disaster (see In Gulf, It Was Unclear Who Was in Charge of Rig).  In Saturday's NY Times, Ian Urbina catalogues two kinds of failures: system failures for which BP and its partners were responsible and failures on the part of the regulatory framework that governs (or not) offshore oil and gas development in the Gulf of Mexico.  I want to focus on the risk management failures he identifies in this article.

Several weeks ago, I looked at the news reports to that time and argued that the Deepwater Horizon disaster provided some valuable lessons for managing the risks inherent in complex undertakings like drilling for deep water oil and gas deposits.  As noted in that post, I think Thomas Homer-Dixon's Ingenuity Gap provides an excellent basis for understanding how the problems we face, such as this blowout, can outrun our ability to deal with them.  Echoing these arguments, the article quotes Tad Patzek of the University of Texas, Austin, who concludes that:

"It's a very complex operation in which the human element has not been aligned with the complexity of the system."

And Mr. Urbina goes on to identify four ways in which BP and its partners failed to adequately manage the system's complexity:

• Who was in charge?

Federal investigators heard conflicting answers as to who was in charge of the rig and its activities in the days and hours leading up to the explosion.  There was an inherent conflict in the relationship between BP and the drill rig owner, Transocean (and likely Haliburton as well), with BP responsible for paying a daily leasing fee for the rig.  Time was a cost for BP and a source of revenue for the contractors. 

In Mr. Urbina's words:  "Amid this tangle of overlapping authority and competing interests, no one was solely responsible for ensuring the rig's safety, and communication was a constant challenge."

A related issue was the apparent confusion over delegation of responsibilities once something went wrong.  The rig captain was upset that one employee pressed a distress button without authorization and another failing to contact shore for help.

• Failure to Plan for Identified Risks.

BP asked for and received permission to exempt the project from the regulatory requirement for a rigorous environmental review.  Even once risk assessments had identified a "worst case" blowout as one that might produce 250,000 barrels of oil per day (The blowout is currently spewing out 12,000 to 19,000 barrels per day - or possibly more.  It is hard to imagine the devastation the worst case would have led to.)  there was no response plan to address that level of risk nor did the company have on hand the equipment that it had indicated would be used to respond to a blowout.

NY Times notes that the rig's spill response plan included a web link for a contractor that directed users to an Asian shopping website, suggesting that it was out of date and/or had not been adequately checked.

• Ignoring own risk management policies and designs.

BP engineers had to get company permission to use equipment, including casings, that deviated from it's own design and safety policies.  BP elected to proceed with well casings that had a greater risk of collapsing and used cement in a way that did not meet Halliburton's "best practices". 

The Minerals Management Service (federal regulator) had "highly encouraged" (but did not require) companies to have backup systems to trigger blowout preventers in case of emergency - BP did not have them.

• Not responding to failures and indicators that something was wrong.

Well before the blowout and explosion April 20th, the rig was experiencing "kicks" (kicks, or pulses of gas or pressured liquids into the well bore, if not controlled become blowouts), the blowout preventer was found to be leaking fluids at least three times, despite noticing cementing problems in the well bore, BP skipped a quality test of the casing, tests before the blowout indicated abnormal buildup in pressure, .... A picture of persistence in the face of any and all indicators that something was wrong.

                              

Complexity demands rigorous management systems if it is going to be managed successfully.

In the introduction to its 2009 Sustainability Report (Safety section), BP indicates that it follows a "systematic approach":

"BP constantly seeks to improve its safety performance through the procedures, processes and training programs that we implement in pursuit of our goal of ‘no accidents, no harm to people and no damage to the environment’  ......We are carrying forward our efforts on process safety, which is an integral part of our operating management system (OMS) and ingrained within our capability programs."

The evidence presented by Mr. Urbina suggests that while the systems exist on paper, BP is having difficulty implementing them in its U.S. operations.  

So to reiterate what I wrote several weeks ago, the lessons (for risk management) coming out of the Deepwater Horizon disaster seem to be:

• have adequate systems in place ( but this isn't enough);

To be fair, its hard to find a major company in the oil and gas business that hasn't gone to the effort of developing risk management systems for safety, process safety, environment, and other key risks inherent in their businesses.  Similarly they all have crisis management, emergency response, pandemic and other disaster response plans on the books.

• make sure they are up to date;

However, its the implementation where many management systems start to come unglued.  Its not enough put the binders on the shelf or the plans on an intranet site.  If systems and plans are up to date, they don't have links to Asian shopping sites.

• make sure they are understood and used by everyone involved; and

Its hard work to communicate and train employees regularly to ensure they understand and can use the systems and plans in their everyday activities.  Its even harder to make sure that they continue to be used when time or cost concerns intervene - everybody loves a good shortcut.

• make sure the performance and process data that is used in decision making is the right data and that it is not ignored in response to the pressures of the moment.

Its important to take the time before a project begins to understand what indicators/ measures might help us understand the process we are managing.  And then its even more important to pay attention to those indicators once they arise.  What's the point of constructing systems and plans to manage complexity if we ignore the indicators that tell us something about the complex environment we are trying to manage? 

Perhaps a more succinct way of putting all of this is to follow the old Boy Scout motto: Be Prepared.

 

BP's Deepwater Horizon: Lessons for Risk Management

Reading the stories emerging from BP's Deepwater Horizon disaster in the Gulf of Mexico over the past several weeks reminds me of arguments made by Thomas Homer-Dixon in his book The Ingenuity Gap. One of my key take-aways from this book was that the emergence of increasingly complex problems facing society today demand new ways of approaching and solving them.

Certainly the quest for offshore oil and gas has to be considered very complex and getting more so every day as the oil companies push into ever deeper water and ever deeper reserves.

Fortunately, the past two decades have seen the development and adoption of a variety of risk management systems and risk assessment tools that are intended to help us manage the complexity that is inherent in industries such as energy and oil and gas.  Systems such as the ISO 14001 environmental management system, the OHSAS 18001 occupational health and safety management system and the ISO 9001 quality management system all exist to help managers understand the risks they face, develop solutions to address them and monitor performance to ensure they have actually dealt with the risks as intended.  An even broader array of tools exist to identify and assess risks - two I am familiar with are the Hazard and Operability (HAZOP) process and the Bow-Tie diagram.

Unfortunately, early evidence surfacing from the U.S. congressional investigations and news reports suggests that on the Deepwater Horizon, BP and its partners may not have made adequate use of the management systems and tools available to them.

A report in Reuters today (see On Doomed Rig, Lapses Sparked Catastrophe, May 14) highlights three failures on the platform:

• Timing of removal of drilling mud from the drill bore despite data that suggests it was unwise to do so.

BP and Transocean made a decision late on April 20 to begin removing mud from within the drill pipe despite pressure tests from within the well that a BP official described as "not satisfactory" and "inconclusive," Waxman said on Wednesday.

Drilling mud is a mixture of synthetic ingredients that is pumped into the well to exert downward hydrostatic pressure and prevent a column of oil and gas from rushing up the pipe.

Earlier in the day, well pressure tests showed an imbalance between the drill pipe and kill and choke lines running from the drill deck to the blowout preventer. The pressure in the drill pipe was 1,400 pounds per square inch (PSI), while the choke and kill lines read zero PSI, Waxman said.

"They knew there was something wrong because the pressure in the kill and choke lines was not correct," Nagarajaiah said. "That should have alerted them."

But according to Waxman, workers performed additional tests and at 8 p.m. CDT (0100 GMT) "company officials determined that the additional results justified ending the test and proceeding with well operations."

"I'm a little shocked that they proceeded at that point," said Philip Johnson, a petroleum engineering professor at the University of Alabama.

"It sounds like they never got an adequate low pressure test and someone decided to go ahead and displace the mud," Johnson said. "That sounds like a pretty serious mistake."

• Failure of emergency power supplies to blow-out preventers.

Once the well exploded in a green flash, rig workers tried to activate the blowout preventer on the ocean floor, designed as a fail-safe to choke off the well.

But officials from Cameron International Corp, which manufactured the device, told committee staff that a key hydraulic system meant to supply emergency power was disabled.

• Having the wrong equipment in place to cut of well flow.

And another key device component designed to clamp down around the drill pipe and seal any leak -- known as a variable bore ram -- had been replaced by a useless test ram, according to Representative Bart Stupak, chairman of the Energy and Commerce Committee's investigations subcommittee.

With oil gushing into the sea, BP sent remote robots to the ocean floor to attempt to activate the ram. "An entire day's worth of precious time had been spent engaging rams that closed the wrong way," Stupak said.

In an analysis posted at Environment 360 earlier this week (see The Gulf Oil Spill, An Accident Waiting to Happen, May 10), John McQuaid outlines two systemic failures:

• An industry aversion to examining "worst-case scenarios", i.e. to fully understanding the risks they were facing.

Energy companies have aggressively lobbied to avoid formally analyzing worst-case scenarios since the Carter administration first required them in instances where there was uncertainty about the risk of disaster.

“They thought it would lead to irrational public resistance to projects,” Doremus said. “But to me this Deepwater Horizon thing is an example where a worst-case analysis would have been useful. If they had done a worst case analysis they’d have to consider, well, ‘What if our blowout preventer didn’t work? And what if it happened during a bout of bad weather when the spill might reach the shore?’” Instead, BP officials admitted they were stunned by the disaster, and they and the government have largely improvised their response.

• Industry unwillingness to put in place backup devices for triggering blowout preventers, despite a regulatory "suggestion" to do so.

Based on experience with malfunctioning blowout preventers, for instance, the MMS did suggest that energy companies install backup devices for triggering them. But it was only a suggestion, not a requirement, and U.S. drilling operators have declined to do so.

Mr. McQuaid goes on to draw links between the Deepwater Horizon disaster and BP's Texas City Refinery explosion and fire, which killed 15 and injured 170 in March 2005.  BP commissioned former Secretary of State James Baker to lead an investigation panel into the Texas City disaster, the results of which were published in what is widely known as the Baker Report.  Among the findings were suggestions that the company had failed to adequately manage the safety of its process because its focus was too narrow - measuring worker safety incidents rather than looking closely at the industrial processes in the refinery.

"BP primarily used injury rates to measure process safety performance at its U.S. refineries ... BP's reliance on injury rates significantly hindered its perception of process risk."

Essentially saying the company failed to monitor the safety of its refining processes. Sounds a bit like comments made in the Reuters article on Deepwater Horizon.

Complex operating environments like those that are present in the oil and gas sector demand well though-out risk management systems that are kept up to date and are used by everyone present.  While its still too early to say what contributed to the Deepwater Horizon disaster, some of the evidence certainly suggests that operators didn't make full use of the data being provided by risk control equipment - and thus not fully using the safety and environmental management systems that were undoubtedly in place.

So if there are lessons to be drawn from the disaster at this early stage I would suggest that they are:

• have adequate systems in place ( but this isn't enough);
• make sure they are up to date;
• make sure they are understood and used by everyone involved; and
• make sure the performance and process data that is used in decision making is the right data and that it is not ignored in response to the pressures of the moment.

Note: Previously posted at Eos Consulting blog