Safety Culture at Chevron’s Richmond, CA Refinery

The U.S. Chemical Safety and Hazard Investigation Board (CSB) released its final report* on the August 2012 fire at the Chevron refinery in Richmond, CA caused by a leaking pipe.  In the discussion around the CSB’s interim incident report (see our April 16, 2013 post) the agency’s chairman said Chevron’s safety culture (SC) appeared to be a factor in the incident.  This post focuses on the final report findings related to the refinery’s SC.

During their investigation, the CSB learned that some personnel were uncomfortable working around the leaking pipe because of potential exposure to the flammable fluid.  “Some individuals even recommended that the Crude Unit be shut down, but they left the final decision to the management personnel present.  No one formally invoked their Stop Work Authority.  In addition, Chevron safety culture surveys indicate that between 2008 and 2010, personnel had become less willing to use their Stop Work Authority. . . . there are a number of reasons why such a program may fail related to the ‘human factors’ issue of decision-making; these reasons include belief that the Stop Work decision should be made by someone else higher in the organizational hierarchy, reluctance to speak up and delay work progress, and fear of reprisal for stopping the job.” (pp. 12-13) 

The report also mentioned decision making that favored continued production over safety. (p. 13)  In the report’s details, the CSB described the refinery organization’s decisions to keep operating under questionable safety conditions as “normalization of deviance,” a term popularized by Diane Vaughn and familiar to Safetymatters readers. (p. 105) 

The report included a detailed comparison of the refinery’s 2008 and 2010 SC surveys.  In addition to the decrease in employees’ willingness to use their Stop Work Authority, surveyed operators and mechanics reported an increased belief that using such authority could get them into trouble (p. 108) and that equipment was not properly cared for. (p. 109) 

Our Perspective

We like the CSB.  They’re straight shooters and don’t mince words.  While we are not big fans of SC surveys, the CSB’s analysis of Chevron’s SC surveys appears to show a deteriorating SC between 2008 and 2010. 

Chevron says they agree with some CSB findings however Chevron believes “the CSB has presented an inaccurate depiction of the Richmond Refinery’s current process safety culture.”  Chevron says “In a third-party survey commissioned by Contra Costa County, when asked whether they feel free to use Stop Work Authority during any work activity, 93 percent of Chevron refinery workers responded favorably.  The overall results for the process safety survey exceeded the survey taker’s benchmark for North American refineries.”**  Who owns the truth here?  The CSB?  Chevron?  Both?    

In 2013, the city of Richmond adopted an Industrial Safety Ordinance (RISO) that requires Chevron to conduct SC assessments, preserve records and develop corrective actions.  The CSB recommendations including beefing up the RISO to evaluate the quality of Chevron’s action items and their actual impact on SC. (p. 116)

Chevron continues to receive blowback from the incident.  The refinery is the largest employer and taxpayer in Richmond.  It’s not a company town but Chevron has historically had a lot of political sway in the city.  That’s changed, at least for now.  In the recent city council election, none of the candidates backed by Chevron was elected.***

As an aside, the CSB report referenced a 2010 study**** that found a sample of oil and gas workers directly intervened in only about 2 out of 5 of the unsafe acts they observed on the job.  How diligent are you and your colleagues about calling out safety problems?

*  CSB, “Final Investigation Report Chevron Richmond Refinery Pipe Rupture and Fire,” Report No. 2012-03-I-CA (Jan. 2015).

**  M. Aldax, “Survey finds Richmond Refinery safety culture strong,” Richmond Standard (Jan. 29, 2015).  Retrieved Jan. 29, 2015.  The Richmond Standard is a website published by Chevron Richmond.

***  C. Jones, “Chevron’s $3 million backfires in Richmond election,” SFGate (Nov. 5, 2014).  Retrieved Jan. 29, 2015.

****  R.D. Ragain, P. Ragain, Mike Allen and Michael Allen, “Study: Employees intervene in only 2 of 5 observed unsafe acts,” Drilling Contractor (Jan./Feb. 2011).  Retrieved Jan. 29, 2015.

Defense in Depth and Safety Culture from an IAEA Conference

A 2013 IAEA conference focused on the concept of Defense in Depth (DID) and its implementation at nuclear facilities.  It was a large-scale event with almost 50 presentations and papers.  The published proceedings* run over 350 pages.  This post focuses on the treatment of safety culture (SC) by the authors and presenters.  The proceedings started off well: SC was explicitly mentioned as a cross-cutting issue in the implementation of DID. (p. 1)  In addition, the conference itself was predicated on Fukushima lessons learned which, as everyone now knows, included SC shortcomings in both licensee and government organizations.

But on the whole the treatment of SC was something of a disappointment.  The presentations from Argentina, Pakistan and Vietnam mentioned SC in passing.  The presentation from Egypt discussed the regulator’s role in SC oversight at length. (pp. 302-304)  Only the following three presentations gave SC a featured role.

SC in WANO

The World Association of Nuclear Operators (WANO) presenter said this about SC: “Safety supposes that no operator feels isolated, or refuses openness and permanent self-questioning; it requests as well for WANO to ensure that cultural and sometimes political barriers do not hinder safety culture . . . . In WANO, we believe that management system and practices are at the centre of safety culture, and a full involvement of top management (CEOs) of our members is absolutely requested.”**

SC in Indonesia

Two papers discussed SC at different nuclear facilities in Indonesia.  Desirable SC characteristics at both facilities were based on INSAG-4.

The Experimental Fuel Element Installation (EFEI)

The abstract of this paper*** highlighted SC’s role at this facility.  “The application of safety culture in a nuclear facility is one way of DID implementation.  Safety culture aims at the performance of safe works, the prevention of deviation, and the accomplishment of quality operation.  It is in accordance with the first level of DID concept which is the prevention of abnormal operation and failures that is done through conservative design and high quality in construction and operation. . . The objective of safety culture implementation in the EFEI is to encourage workers to have a stronger sense of responsibility on safety and to contribute actively for its development”  The paper presented a laundry list of strategies used to strengthen SC including briefings, workshops, training, senior management visits, integration of safety into work processes, self-assessments, open reporting on safety incidents, open and timely reporting to the regulator, evaluation of safety performance indicators and an annual SC questionnaire.

The authors displayed a bit of realism when they said “Leaders cannot completely control safety culture, but they may influence it.” (p. 179)  They also said their questionnaire results indicated that EFEI SC is at Stage 2 (from IAEA-TECDOC-1329) where “Safety becomes an organizational goal.”  They want SC to evolve to Stage 3 where the organization believes “Safety can always be improved.” (pp. 187-188)

Kartini Research Reactor

This paper**** reported the findings of a SC self-assessment.  The method consisted of questionnaire responses reviewed by experts.  The assessment identified several good current practices in maintaining the safety status of Kartini reactor.  As supporting evidence, the authors noted the number of inspection/audit findings from the regulator went down while reactor utilization and operating hours increased over the past several years.  One opportunity for improvement was the need for more frequent dialogues between employees and managers.

Our Perspective

There is not much SC substance here.  The recitations on SC repeated familiar stuff you’ve seen in lots of places.  In other words, zero new information or insight.  The single page WANO presentation indicates their lowest common denominator audience is even lower than IAEA’s.  Perhaps there were technical issues discussed at the conference that are of interest to you.  Otherwise, don’t invest your coffee break in going through this lengthy document.

*  IAEA, International Conference on TopicalIssues in Nuclear Installation Safety: Defence in Depth — Advances andChallenges for Nuclear Installation Safety, Oct. 21-24, 2013 ConferenceProceedings, IAEA-TECDOC-CD-1749 (Vienna, 2014).  We are grateful to Madalina Tronea for publicizing this material.  Dr. Tronea is the founder and moderator of the LinkedIn Nuclear Safety Culture forum.

**  J. Regaldo, “WANO Actions to Reinforce the Operators’ Safety Culture Worldwide,” p. 147.

***  H. Hardiyanti, B. Herutomo and G. K. Suryaman, “Safety Culture as a Pillar of Defense-in-Depth Implementation at the Experimental Fuel Element Installation, Batan, Indonesia,” pp. 173-188.

****  S. Syarip, “Safety Management and Safety Culture Self Assessment of Kartini Research Reactor,” pp. 321-326.

Back to the Past at Millstone?

Millstone

A recent article* in the Hartford Courant newspaper reported on a turbine-driven auxiliary feedwater (TDAFW) pump problem at Millstone 3 that took so long to resolve that the NRC issued a White finding to plant owner Dominion Resources.

The article included a quote from the Connecticut Nuclear Energy Advisory Council (NEAC) describing their unease over the pump problem.  We dug a little deeper on the NEAC, a state government entity that works with public agencies and plant operators to ensure public health and safety.  Their 2014 annual report** highlights the TDAFW pump problem and another significant event at Millstone, a loss of site power that caused a dual reactor trip.  NRC inspections following these two events resulted in one Severity Level III finding, the White finding previously mentioned and two Green findings.  The events and NRC findings led the NEAC to express “great concern regarding the downward performance trend” to Dominion and request a formal response from Millstone management on any root cause that linked the performance problems.

In his response to the NEAC, the Millstone site VP said there was no root cause linking events.  He also said two safety culture (SC) improvement areas had been identified, viz., problem identification and evaluation and establishing clarity around decision making, and that the site has implemented improvement actions to address those areas.  In the Courant article, a plant spokesman is quoted as saying "If it's not immediately obvious why it's not working, we put a team to work on it."

The article also referred to related behind-the-scenes NRC staff emails*** in which the time it took for Dominion to identify and address the TDAFW pump issue raised eyebrows at the NRC.

So what does the TDAFW pump event tell us about SC at Millstone?

Our Perspective

Is Millstone on the road to the bad old days, when SC was AWOL from the site?  We hope not.  And there is some evidence that suggests the TDAFW pump issue was an isolated problem exacerbated by a bit of bad luck (a vendor supplying the wrong part with the same part number as the correct part).

Positive data includes the following: Millstone 2 and 3 both had all green performance indicators on the 3QTR2014 NRC ROP and, more importantly, a mid-2014 baseline inspection of the Millstone CAP “concluded that Dominion was generally effective in identifying, evaluating, and resolving problems.”****  In addition, plant “staff expressed a willingness to use the corrective action program to identify plant issues and deficiencies and stated that they were willing to raise safety issues.” (p. 10)

Currently, M2 is subject to baseline inspection and M3 to baseline and a supplemental inspection because of the White finding.

To us, this doesn’t look like a plant on the road to SC hell although we agree with the NRC that the TDAFW pump problem took too long to evaluate and resolve.

We hope the Millstone organization learned more from the TDAFW pump problem than they displayed in their reply to the NRC.*****  In dealing with the regulator, Millstone naturally tried to bound the problem and their response: they pointed at the vendor for sending them the wrong part, implemented a TDAFW pump troubleshooting guide, revised a troubleshooting procedure, and produced and presented two case studies to applicable plant personnel. 

The site VP’s letter to NEAC suggests a broader application of the lessons learned.  We suggest the “trust but verify” principle for dealing with vendors be strengthened and that someone be assigned to read Constance Perin’s Shouldering Risk (see our Sept. 12, 2011 review) and report back on the ways factors such as accepted logics, organizational power relations and production pressure can prevent organizations from correctly perceiving problems that are right in front of them.

*  S. Singer, “Emails Show NRC's Concern Over How Millstone Nuclear Plant Reacted To Malfunction,” Hartford Courant (Jan. 12, 2015).

**  2014 Nuclear Energy Advisory Council (NEAC) Report (Dec. 11, 2014).  The Nov. 10, 2014 letter from Millstone site VP S.E. Scace to J.W. Sheehan (NEAC) is appended to NEAC’s 2014 annual report.

***  The Associated Press obtained the emails under a Freedom of Information Act request.  Most of the content relates to the evolution of technical issues but, as cited in the Courant article, there are mentions of Millstone’s slowness in dealing with the pump issue.  The emails are available at ADAMS ML14358A318 and ML14358A320.

****  “Millstone Power Station – NRC Problem Identification and Resolution Inspection Report 05000336/2014009 and 05000423/2014009” (Sept. 12, 2014), cover letter.  ADAMS ML14255A229.

*****  Dominion Nuclear Connecticut, Inc. Millstone Power Station Unit 3, Reply to a Notice of Violation (Nov. 19, 2014).  ADAMS ML14325A060.

Human Performance at a Nuclear Power Plant

2015 is off to a slow start in the safety culture (SC) space but we recently saw two mid-2014 articles worth a few words: “Putting People in the Mix” Parts I and II by Ken Ellis, both originally published in Nuclear Engineering International.*  The basic premise is that an incident investigation finding of human error is only “the tip of the iceberg” in understanding human performance issues.

Part I

Part I describes how people add a probabilistic aspect to nuclear plant performance.  Ellis begins by reviewing the nuclear industry’s defense-in-depth: physical barriers, safety systems and contingency plans.  If an incident occurs, then linear root cause analysis starts with the outcome and works back to identify what happened.  Lessons learned are used to update the defense-in-depth system.

But people don’t always behave according to the laws of physics.  People “can circumvent both equipment and process, either unwittingly or wittingly” because of their personal history, perceptions, stress and other factors.  Adding people makes a complicated system (a nuclear plant) a complex one.  One consequence is that a complete and accurate reconstruction of the events preceding an incident may not be possible.  Incident analysis should include investigating the dynamic context in which any relevant human behavior occurred. 

Part II

Part II describes risk management.  It begins with a list of factors that can increase risks at nuclear plants, including lack of leadership, time pressures, complacency and normalization of deviance.  The organization’s primary goal in risk space “is to narrow the band of what constitutes acceptable risk.” The strategy should be to control human behavior by making the boundaries of the work space “explicit and known, and giving workers opportunities to develop coping skills at boundaries.”

Ellis on goes to list  practices that can help improve safety including communication protocols, conservative decision-making and a questioning attitude.  He concludes with some suggestions for managing human performance risk including explicit discussion of complexity and risk boundaries, seeking divergent opinions and understanding how workers interpret messages from corporate. 

Our Perspective 

There is really nothing wrong with these articles.  Ellis covers the ground fairly well in 2400 words intended for a general nuclear industry audience.  But there is nothing new here.  More importantly, this is a brisk treatment of some important concepts about human behavior, the nature of human and system errors, competing mental models of nuclear operations, and desirable management attributes.  The author’s lack of references means a curious reader is left to his own devices.  One really needs direction to key sources, e.g., Dekker, Hollnagel, Reason, Taleb, Vaughan, Woods and the HRO people to gain a meaningful understanding of such concepts.  If you’ve been following Safetymatters for awhile, you know we’ve covered these folks and their ideas at length.

*  K. Ellis, “Putting People in the Mix: Part I,” Nuclear Engineering International (July 18, 2014) and “Putting People in the Mix:Part II,” Nuclear Engineering International (July 21, 2014).  Mr. Ellis is the Managing Director of the World Association of Nuclear Operators (WANO).  Thanks to Dr. W.R. Corcoran for publicizing Part I in the LinkedIn Nuclear Safety Culture group.