“There is almost no human action or decision that cannot be made to look flawed and less sensible in the misleading light of hindsight. It is essential that the critic should keep himself constantly aware of that fact.” — Lord Anthony Hidden
One of the insidious effects of hindsight bias is that it puts much too much emphasis on the impact of procedure violations when explaining an incident. When Sidney Dekker quoted Lord Hidden in his book, Just Culture, he was warning us about the dangers of hindsight bias in our incident investigations. As he notes, “hindsight bias is one of the most consistent and well-documented biases in psychology, but incident reporting systems…have essentially no protections against it.”
What’s Normal?
There is always—ALWAYS—a difference between what procedures say and what is normally done. One form of labor action that exploits this difference is called “working to the rule.” When a labor force cannot go on strike, it can still cause havoc by insisting on following every policy and procedure to the letter. This inevitably causes a significant slowdown. We don’t expect workers to “work to the rule,” under normal circumstances, but when an incident occurs, many investigators seize on a procedure violation as the cause, whether the violation is actually abnormal, or more importantly, whether the violation actually caused the incident.
The Williams Peak Shaving Plant explosion
A few years ago, there was a natural gas explosion at the Williams Peak Shaving Plant in Plymouth, Washington. There is general agreement that the explosion was the result of a natural gas/air mixture remaining in the system following maintenance that subsequently auto-ignited upon startup, when the flammable mixture entered the inlet of a heater. It seems apparent that the system had not been successfully purged of air before starting up.
The investigation report acknowledges this but goes on to make much of something it called an operator error: a triple pressure purge of cycling between 100 psig and 5 psig, rather than cycling between 100 psig and 0 to 1 psig.
Auto-Ignition
For a gas mixture to auto-ignite, two conditions have to be met: the mixture has to be flammable and it has to be above its auto-ignition temperature. Auto-ignition temperature decreases with increasing pressure and a study conducted after the incident showed that at the normal operating pressure of 700 psig, the auto-ignition temperature of natural gas can be as low as 680 F. The normal operating temperature for the process was 550 F, well below the auto-ignition temperature. However, if any point in the process was hotter than 680 F, auto-ignition was inevitable if there was a flammable mixture.
A flammable natural gas mixture must have enough fuel to burn and enough oxygen to burn in it. Safe operation depends on being below the lower explosive limit (LEL) of 4.4% natural gas (too lean to burn) or above the upper explosive limit (UEL) of 15% natural gas (too rich to burn), or on being below the limiting oxygen concentration (LOC) for natural gas of 12% oxygen, below which there is not enough oxygen, regardless of the natural gas concentration. A mixture of natural gas and air that is 43% natural gas and 57% air (which in turn is only 20.9% oxygen) cannot burn because it contains too much fuel (it is too rich to burn) and because it contains too little oxygen. Purging air from the natural gas system was key to handling the natural gas safely.
An Operator Error?
When the explosion at the Plymouth facility occurred, four workers sustained minor injuries and fifth worker was hospitalized with burns. The explosion caused $46 million in damages and lost product, including $71,000 in damages to public and other private property.
Obviously, there was a flammable mixture, or the explosion would not have occurred. It is reasonable to conclude that the procedures that were followed were insufficient to remove the flammable mixture. It is a mystery, though, how the investigator concluded that a triple purge cycle of 100 to 1 psig would have helped when a triple purge cycle of 100 to 5 psig was inadequate.
When a system is full of air at atmospheric pressure, a single purge cycle to 100 psig reduces the oxygen concentration from 20.9% to 2.3%. A second purge cycle further reduces the oxygen concentration: to 0.4% when from 1 psig to 100 psig, to 0.5% when from 5 psig to 100 psig. A third purge cycle reduces the oxygen concentration even more. The second and third purge cycles are insurance; the oxygen concentration should have been below the LOC after the first cycle.
Missing an Opportunity to Improve
Pinning the cause of the explosion at Plymouth on the purge cycle pressures is to miss the point and divert efforts away from the real cause. To seize on this deviation from “industry recognized” recommendations, as the press did, is to fall into the trap of hindsight bias. There was flammable gas mixture in the system when it started up, but it could not have been the of an operator error during the purge cycle.
No incident report is complete without recommendations to reduce the likelihood of a reoccurrence of the incident in the future. Any good recommendation addresses a cause of the incident, so correctly identifying causes is essential to improving safety. Defaulting to “procedure violations” as a cause when those violations have little or nothing to do with the incident is not helpful.
When you find yourself investigating an incident, be sure you are identifying the real causes so that your recommendations make a real difference in the future. Otherwise, safety is not advanced and blame, if it is necessary at all, is misplaced. It is not easy, but to do anything less is to miss out on an opportunity to improve.
This blog is based on an earlier version, “Operator Errors and Hindsight Bias”, posted on 03-Jun-2016 by Elsevier in Chemicals & Materials Now!
