Eleven workers died at a Longview, Washington, paper mill after a tank that had failed three thickness inspections stayed in service. In this In Case You Missed It episode, Traci Purdum walks through David Strobhar's column on why human error isn't confined to the control room, and how an industry ombudsman and a few practical habits can give dissenting voices a place to be heard.

Transcript

Welcome to Process Safety with Trish and Traci. I'm Traci Purdum with Chemical Processing. Trish is off this week, so I'm bringing you one of our In Case You Missed It episodes.

Today I want to walk you through a column we published on October 9th by David Strobhar. It's called "Operator Training: When 'Safe' Is a Judgment Call." Dave founded Beville Operator Performance Specialists back in 1984. He helped start the Center for Operator Performance, and he's spent his career studying human factors in process plants.

His column asks the question: With all the money we spend on safety systems and studies, how do 11 people die from a hazard we already knew about?

On this show, Trish and I spend a lot of time talking about incidents. What happened, who was hurt, what went wrong. But the point has never been to just tell sad stories. The point is to help you keep the next one from happening. So I'll share the highlights from Dave’s column, and then I'll pull in some lessons Trish and I have covered over the past couple of years.

Let's start with the incident that prompted the column. According to the U.S. Chemical Safety Board, the tank that ruptured in Longview held white liquor --  hot, highly caustic process liquor used in pulping.

Three separate inspections, starting more than 10 months before the incident, showed that the tank wall had thinned below its minimum safe thickness. Three times, the data said this tank was no longer fit to hold what it was holding.

And the tank stayed in service. Then a minor plant upset raised the liquid level. More liquid meant more pressure on that thinned wall, and the tank failed.

Why the tank stayed in service is still under investigation, and we'll learn more as the CSB does its work. But Dave’s point doesn't depend on who said what in which meeting. His point is about what kind of error this was.

When most of us hear "human error," we picture the control room. An operator misses an alarm. Somebody turns the wrong valve or adjusts the wrong controller. And our industry has invested a lot to catch those errors. Safety instrumented systems. HAZOPs. Layers of protection analysis. Alarm management.

Dave argues we're much less likely to think about human error in managerial decision-making. Yet sizing up the current situation is at the heart of every decision, whether you're on the board or the board operator. And that's especially true when the question on the table is, "Is this safe?"

So Dave goes back to basics. To be safe is to be free from risk. And risk is the probability of running into a hazard. Which means, at its heart, safety is a game of probability.

Some probabilities are easy. Flip a coin, you know the odds. Others are much harder, like the odds and the consequences of a catastrophic failure. And for those complex situations, Dave says, reasonable people can look at the same facts and land in different places.

That's the key idea of this whole column. Disagreeing about risk doesn't make someone careless or difficult. It's built into the problem.

David shares a few stories from his own career and has been on different sides of these debates.

The first one is from when he was writing an emergency response plan for a chlorine manufacturer. The two operations representatives on the project scoffed at the idea that a major release could ever happen. Too unlikely to bother planning for. Years later, those same two men were building a fix for a major leak that had forced an areawide evacuation.

The second story is from a refinery, where he was helping set safe operating limits. A debate broke out over a heat exchanger. Is going over its maximum allowable working pressure just as unsafe as going over its maximum allowable working temperature? One group said yes, equally unsafe, period. Dave's group said no, because the way each failure would happen, and what it would lead to, were different.

The third story goes back to his first job out of college, at a nuclear utility, reviewing control room changes for human factors. The project team wanted to add a new set of valves to prevent a repeat of a valve misalignment caused by operator error. Their fix basically made the task more complicated. Dave believed that would make an error more likely, not less. He was in the minority.

So what could he do? His only real option was to go to the Nuclear Regulatory Commission. While he was wrestling with that decision, the team changed the design. It wasn't perfect, but he considered it acceptable. He never had to make that call. But he says just knowing he had an independent place to go was reassuring.

And that brings us to Dave's recommendation. Organizations need a way to challenge a safety decision when the people closest to the hazard believe the organization has the risk wrong.

He is not asking for another government agency. What he proposes is an ombudsman. An independent third party that someone can bring into the discussion anonymously.

Some companies already have this. Dave mentions Koch Industries as one example. But not every company can or will build one. So he suggests the industry could create the function within one of our existing groups. He names the American Petroleum Institute, the American Institute of Chemical Engineers, the Center for Chemical Process Safety, and American Fuel and Petrochemical Manufacturers as possible homes.

The ombudsman wouldn't take accountability away from management. The goal is to make the decision, and the reasoning behind it, more transparent and harder to ignore.

Dave’s bottom line? Bad decision-making isn't limited to the control room or the front line. And an ombudsman could give people with real safety concerns a neutral place to ask whether the risk is truly understood and managed.

If this story sounds familiar, it should. Trish and I talk about incidents like this all the time. In our Challenger episode, the engineers couldn't prove the launch was dangerous, so managers launched anyway. The burden of proof got flipped. In our Columbia episode, we talked about how NASA normalized foam strikes until they felt routine. And in our refinery fires episode, Trish called asset integrity the thing standing between operators and disaster.

A thinning tank wall, flagged three times, is exactly that kind of signal. So, here's how you can help mitigate it at your site.

First, decide ahead of time what a bad inspection result triggers. If a vessel reads below minimum thickness, the next step shouldn't be a debate in the moment. It should be a written response: a fitness-for-service review, a reduced operating limit, or removal from service, with a deadline and an owner.

Second, put the burden of proof in the right place. Don't ask people to prove something is unsafe. Ask the decision-maker to show why it's safe to keep running, and write down that reasoning.

Third, talk about risk in the same terms. David's heat exchanger story shows how two smart groups can talk past each other. Spell out the likelihood and the consequence, so the disagreement is out in the open instead of buried.

Fourth, track your weak signals. In our Buncefield episode, we saw how small warnings piled up across a tank farm. Repeat findings, extended deferrals, and open inspection items belong on a list leadership sees regularly.

Fifth, bring in cold eyes. In our episode on auditing your own program, Trish talked about self-checks and cold-eyes reviews. Someone with no stake in the schedule will ask the questions the team has stopped asking.

And sixth, give people somewhere to go. If your company has an ombudsman or an anonymous reporting line, make sure people know it exists and that it's taken seriously. If you don't have one, start the conversation. And if you're active in American Petroleum Institute, the American Institute of Chemical Engineers, the Center for Chemical Process Safety, and American Fuel and Petrochemical Manufacturers, maybe ask whether an industry ombudsman is something your group could take on.

Dave closes with a challenge for all of us. With all our focus on safety, how could 11 people die from a known hazard? His answer is that bad decisions aren't limited to the control room or the front line.

So my challenge to you is this. Think about the last time someone on your site said, "I don't think this is safe," and the answer was, "It's fine." Was that disagreement written down? Was it ever looked at again? Did the person have anywhere else to go?

If the answer is no, you know where to start.