How hindsight bias distorts history An iconoclastic analysis of the Buncefield explosion – short version Richard Booth Professor Emeritus, Aston University, Birmingham, England Director, Health and Safety Technology and Management Ltd (Hastam) Saturday 10 December 2011 Contents 1 Introduction 2 2 Buncefield: the immediate events 3 3 The prosecution of Total UK Ltd 4 4 Hindsight bias in incident investigations generally 8 5 Concluding comments 9 Acknowledgements 10 References 10 Note: This is a version of a paper due to be presented at the 2012 IOSH Annual Conference, Manchester, on 7 March. Page 1 of 10 1 Introduction Hindsight bias is a malign influence on the objectivity of incident investigations and was a significant factor in the Buncefield investigation. The massive explosion took place at the Buncefield depot of Hertfordshire Oil Storage Ltd (HOSL) on Sunday 11 December 2005. HOSL was a joint venture partnership (JVP) - 60% owned by Total UK Ltd and 40% by the Chevron Corporation. Total were responsible for safety though they were equal partners in operational decisions. People who believe, in good faith, that they have ‘factored out’ the bias are mistaken (including of course me1). Reason (2008) explains the concept: “There is a universal tendency to perceive past events as somehow more foreseeable and more avoidable than they actually were. Our knowledge of the outcome unconsciously colours our ideas of how and why it occurred. To the retrospective observer all the lines of causality home in on the bad event; but those on the spot, possessed only of foresight, do not see this convergence.” Fischoff (1985; reprinted 2003) carried out the seminal research on hindsight bias. His findings carry unquestioned authority. He states: “The hindsight bias is a projection of new knowledge into the past accompanied by a denial that the outcome information has influenced judgment. Thus, subjects who learn of an outcome in a hindsight experiment typically claim that they ‘would have known it all along.’” “… it appears that what passes for the wisdom of hindsight often contains heady doses of sophistry that the perceived inevitability of reported outcomes is imposed upon, rather than legitimately inferred from, the available evidence.” “Consider a decision maker [here for example a Total employee] who has been caught unprepared by some turn of events and who tries to see where he went wrong ... If, in retrospect, the event appears to have seemed relatively likely, he can do little more than berate himself for not taking the action which his knowledge seems to have dictated … When second guessed by a hindsightful observer [eg, a prosecutor], his misfortune appears to have been incompetence, folly, or worse.” *My emphases and additions in square brackets in both quotations] The diversity of adverse circumstances where hindsight bias may have played a part in investigations (and media reports) includes diagnostic errors by physicians; supervision of children at domestic risk, and ‘friendly fire’ incidents. It is a commonplace that individuals and agencies are often made scapegoats following such events2. 1 I was an ‘expert’ engaged to assist the court by Total UK Ltd who were prosecuted following the incident. This is a further source of bias to which readers should be alert, and there are doubtless others. The opinions expressed here are entirely my responsibility and not necessarily the views of any other party in the case. I believe that almost everything stated here (apart from my own interpretation of events) is in the public domain (albeit exceptionally difficult to access in many cases). I apologise if this belief is mistaken and leads to delicacies. 2 Scapegoating individuals, albeit unfair, can sometimes change the course of history. In 1757 Admiral Byng was shot for cowardice (strictly, for failing to ‘do his utmost’) in the face of the enemy. This followed a flawed and biased court Page 2 of 10 My interest in hindsight bias only began in 2009, despite my interest in modern history (reflected in an indulgent footnote above) and despite having lectured for 20 years on the associated work of the seminal researchers. My belated perception was, as an expert witness, that prosecutions, supported by their experts, unwittingly overstated their cases – not in my experience to secure convictions, but rather to facilitate sharper criticisms of defendants. Equally, defences may be constrained unduly by their belief that their clients were more culpable than the objective reality. There seems only one certain way to justify that one’s opinions are not biased, post event, namely to provide incontestable evidence showing that the same opinions, or at least compatible opinions, were held beforehand. 2 Buncefield: the immediate events The Buncefield explosion followed an uncontrolled release of 250,000 litres (37 road tanker loads) of petrol from a HOSL storage tank. The ignition source was a spark from a fire pump motor that started up when the emergency shutdown systems were belatedly activated. By extraordinary good fortune, nobody was fatally injured. However the Buncefield site was effectively destroyed and surrounding property was severely damaged. There was a significant adverse environmental impact. The overflow was a result of a failure of an endemically unreliable automatic tank gauge (ATG) level indicator/alarm together with the non-operation of an apparently functioning independent high level (supply cut-off) switch (IHLS) but which had, as it emerged, a crippling latent defect. Both devices were supplied and maintained by Motherwell Control Systems (MCS). An experienced HOSL night-shift pipeline supervisor misunderstood which tank was being filled and from which pipeline. He thought the tank being filled was from a low-flow-rate pipeline (as was recorded in the day-shift log). This was a result of a misunderstanding by the day-shift supervisor, and a cursory shift handover. The night supervisor with multiple other commitments and concerns did not realize the ATG alarm had failed to operate, or later that the tank was overflowing. Earlier he did not monitor the level in the tank - the critical active human ‘failure’ with the benefit of hindsight. This would have revealed that the ATG had seized up. A nuance of hindsight bias is the presumption that personnel should have spent their time exclusively addressing the issues that subsequently emerge as critical. martial. Voltaire said that the execution was ‘pour encourager les autres’. Indeed it did. The execution led to a seachange in the fighting spirit of naval officers and was a key factor in victories such as Trafalgar in 1805. Admiral Jellicoe’s caution at Jutland in 1916 was and continues to be condemned. Though ‘Jellicoe was the only man on either side who could lose the war in an afternoon’ (Churchill, 1927) – and he didn’t. Jellicoe did not ‘do his upmost’, but for compelling reasons. Incidentally the battle was a narrow tactical defeat as a result of dire communications between ships and violations of explosion-prevention procedures in Beatty’s Battle Cruiser fleet. These bear an uncanny resemblance to those encountered in recent major industrial accidents. In any event the court martial of an admiral pre-dates by 250 years the modern view that senior managers and directors should be called to account when things go wrong on ‘their watch’. Page 3 of 10 The endemic ATG unreliability was poorly communicated within HOSL. Managers were not, or only obliquely, informed. They took no pro-active steps (eg, by examining shift logs where failures were generally recorded) to discover that there was an ATG reliability crisis3. Anyway, no action was taken beyond those of the control room supervisors. They ‘called out’ MCS staff to rectify ATG faults when these occurred. But MCS failed to grapple effectively with the problem. HOSL supervisors appear to have been reasonably meticulous in defect reporting to MCS – a cause for isolated congratulation. Prosecution evidence lacked grace in this regard. HOSL supervisors were criticised for crying wolf too often and that the real issues for MCS were hidden by the noise of their unnecessary call outs. The so-called ‘unnecessary’ call outs properly reflected the belief of supervisors that all faults, whatever happened later, merited reporting. Of course the IHLS failure to cut off the supply to the tank was the crucial immediate cause of the overflow. The pipeline supervisor could not have known about the IHLS latent inoperability as noone knew about it. He has been scapegoated for his inactions, I think unfairly. He was doing his best in demanding conditions, and his behaviour seems consistent with the prevailing culture of the HOSL control room. Primary responsibility for the faulty IHLS (and ATG) lay with MCS. Even if HOSL had been the most ‘intelligent customer’ they would have needed extraordinary insight to counter the, now obviously bizarre, belief of MCS engineers that padlocks supplied with the IHLSs, in fact essential as a balancing weight, were merely an optional security provision. After installation MCS engineers simply deposited the padlocks in the HOSL control room. The IHLSs were sold without the manufacturer TAV routinely providing instructions. The IHLS latent defect could only have been detected by an in-situ fully-realistic test. But such a test was opposed by all parties, including HSE, after a thorough review of the issue. A test involving the removal of IHLSs from tanks was considered sufficient. With hindsight bias of course this decision appears a culpable error. Chevron’s argument that fully realistic tests would unduly impede throughput now looks inappropriate, perhaps unreasonably noting the substantial outages involved. 3 The prosecution of Total UK Ltd The evidence presented by the crown in the prosecution of Total UK Ltd (who had as stated overall responsibility for safety at HOSL) was replete with hindsight bias. An aggravating factor underpinning the prosecution’s case was that Total should have foreseen a major explosion as a consequence of an overflow, and introduced commensurate preventive measures. In fact they came 3 HOSL managers were under a lot of pressure. Paradoxically some were completing the COMAH Safety Report. But pressure was exacerbated by managers (who were Total employees) being sent to ‘troubleshoot’ at Total’s OSD at Colnebrook. This was an unfortunate decision and belies Total’s initial argument that while 16 (of 17) HOSL staff were Total employees; they were on permanent secondment to the JVP. However a decision was made to postpone the introduction of the environmental management standard (ISO14001) as a result of these work pressures. Nonetheless two senior HOSL staff were manifestly at the end of their tether in the weeks preceding the explosion. Page 4 of 10 close, but the implementation was eroded by shortcomings in HOSL operational practices and by the dire reliability of MCS-supplied ATGs and IHLSs. There were also unfortunate misinterpretations of the daunting quantity of evidence gathered for the prosecution. The prosecution’s primary expert witness’s authoritative report taught me a great deal. But in important areas I believe he was mistaken. My impression is that his report was not subject sufficiently to peer review. This will become more important with the changes in the law proposed by the Law Commission relating to the reliability of expert reports. Total pleaded guilty to sections 2(1) & 3(1) of the 1974 Act. While it is my opinion that Total had principled reasons for pleading not guilty, they were unlikely to find favour with the court. Juries are not immune to hindsight bias, and anyway Total were not ‘bullet proof’. A 95% rebuttal of a prosecution’s case is no rebuttal at all. Moreover mitigation based on arguments that appear to constitute a defence is likely to irritate a judge. For impenetrable reasons the legal advisers to HOSL (as a JVP involving Chevron) pleaded not guilty, in the end unsuccessfully. Their defence was essentially that Total were wholly responsible for everything that HOSL did, including ‘ownership’ of the HOSL COMAH Safety Report. MCS (for technical reasons) and TAV also pleaded not guilty, without success. At the risk of hyperbole, Total, a French company, were the ‘fall guys’. All the opprobrium fell on them. While their guilty plea was based on a realistic appraisal, they thereby lost the opportunity to challenge the evidence of other defendants, notably HOSL, at the trial. Moreover, while it would have been wholly inappropriate to have prosecuted Chevron, Shell and others, their ‘failings’ were also laid at Total’s door. In the counter-factual situation where the Competent Authority (CA) – the major hazards regulator comprising of the HSE and the Environment Agency - was not immune from prosecution and if there was an independent prosecutor, the latter would, I presume, have examined the CA’s possibly culpable role in the causal chain. It is my opinion that the CA did not comply with the key COMAH regulations that applied to them. The CA’s quasi-statutory regulatory regime was honoured in the breach largely because of staff shortages. Moreover HSE guidance, with hindsight, was badly flawed. For example HSE (1998) only recommends the fitment of an ATG alarm, and states that a high, high-level trip may also be fitted. All the parties in a court case should disclose their pre-event opinions, including the regulator. Eventually the Competent Authority’s (CA’s)4 prior role relating to Buncefield was disclosed to other parties, but too late to be of much assistance. I sought to complete a jig-saw puzzle of the events and causes via an Events and Causal Factors Analysis (ECFA) - to create a ‘map’ of the incident to assist the court, but vital pieces – key decisions of the CA - were missing. 4 The CA acts as regulator, investigator and prosecutor. This is not an ideal arrangement. For example rail and air accidents are investigated by independent bodies. Page 5 of 10 Tozer (2011)5 has drawn attention of the continuing failure of the MIIB to publish their promised final report on the prior roles of the CA6. It is now a year since the end of all legal proceedings. Perhaps the report will be published only when HSE is able to demonstrate that it has remedied the deficiencies identified in the report. The Major Incident Inquiry Board (MIIB, 2008) stated that an explosion (and certainly not one of the most violent explosions in peace-time Europe for a century) was not considered ‘realistically credible’. Recommendation 1 of MIIB (ibid) reads: “Operators of Buncefield-type sites should review their emergency arrangements to ensure they provide for all reasonably foreseeable emergency scenarios arising out of credible major hazard incidents, including vapour cloud explosions and severe multi-tank fires that, before Buncefield, were not considered realistically credible.” *My emphasis+ Before the event the conventional wisdom of the oil ‘majors’, accepted by the regulator, was that the worst tank overflow scenario was a fire contained within a bund (so not a major accident hazard (MAH) in terms of the COMAH Regulations)7. But afterwards it seems like a catastrophe waiting to happen which Total should ‘uniquely’ have anticipated and prevented. Total were, in my opinion, taking appropriate steps to promote, secure and monitor safety at their joint venture subsidiary, HOSL. However these good, and in some respects, best practice arrangements, supported by DNV audits, failed to identify and correct substantial shortcomings both at HOSL (including the unsafe practices of staff working under great pressure), and by Motherwell Control Systems (MCS). But in the after light the fact that good, or in parts, best, practice failed to detect the shortcomings in overflow prevention at plant level seems self-evident ‘proof’ that the systems were actually inappropriate and casually implemented. This was the decided opinion of the prosecution. As stated above, overflow from tanks was not judged by all the participants to be a MAH under the site’s COMAH regime, despite HSE (1999). This was perhaps an important root cause of the events on 11 December 2005. For example a quantitative risk assessment was not completed as it was not required by HSE for the COMAH Safety Report. Overflow prevention was not included in (otherwise very appropriate) COMAH training. The safety challenges for control room staff associated with substantially increased throughput and reduced storage capacity were barely considered. ‘Turf wars’ with other oil storage depots (OSDs) on the site continued unabated. Two overflows at another OSD were reported to HSE without significant follow-up. There was no compelling impetus 5 “Buncefield - An alternative review of the official story and why not to rely on a regulator”. 6 MIIB (unpublished) “The Report of the Buncefield [MIIB] into the policy and procedures of the *HSE’s+ and the *EA’s+ role in regulating the activities on the Buncefield site under the COMAH Regulations”. 7 What is curious is that according to HSE’s COMAH Guidance (HSE, 1999/2006) a tank overfill would qualify as a MAH even if a bund fire was the worst foreseeable consequence. In any event MAH tank overfill risk assessments were not required by HSE. HSE (1998) requirements paraphrased above fall well short of good practice. HOSL had installed all the ‘optional’ overflow-prevention hardware so had adopted best practice in terms of HSE (1998). Page 6 of 10 to deal effectively with the shortcomings in the ATGs referred to above. Crucially the need to test the IHLSs in situ, though fully considered by all parties, led to the mistaken conclusion that the test was not necessary. Of course overflows of flammable liquids are highly undesirable on any terms but the preventive challenge went ‘below the radar’ largely because of the focus only on COMAH MAHs. A paradox is that the petrol that overflowed belonged to Chevron, supplied by ‘their’ pipeline8 over which HOSL had no direct control. In contrast HOSL supervisors could manage pro-actively deliveries from the Total-owned pipeline. But in the aftermath, Total’s best practice systems were the foundation for criticisms of ‘Chevron’s’ arrangements. Incredibly, Total were blamed for the alleged shortcomings of ‘Chevron’s’ acceptable (though much less satisfactory) systems. All this might form the plot for a ‘Kafkaesque’ novel. Total were wholly responsible for safety at HOSL but Chevron were at least an equal partner in production scheduling. Chevron’s throughput increased by 55% between 2001 and 2005. This was a significant causal factor in the challenges facing the control room operators. (Total’s throughput increased by at most 8% over the same period.) The reason for the increase was that Shell closed their OSD at Buncefield and three vital storage tanks were dismantled. They transferred their operations to HOSL via a contract with Chevron. Shell’s place in the causal chain seems to have got lost. As usual it is necessary to explain that my criticisms of Chevron and Shell (and HSE) are magnified by hindsight bias. Being part of the causal chain is not the same as being culpable. And this applies to Total as well. The failure of Total’s ‘high level’ systems to detect and address the incompetence of MCS9, and inadequate control room procedures, now leads to a range of hindsight biases. The prosecution argued mistakenly that the audits by DNV were critical of HOSL’s safety systems. Moreover Total/HOSL were censured for not taking the DNV audits, which were actually very positive, seriously. In fact the audits were thoroughly reviewed and acted upon. But the DNV industry best practice audits commissioned by Total did not engage, as it emerged, sufficiently on day-to-day operational issues. Thus a key learning point was masked in the investigation. The DNV audit reports were models of their kind. Prosecution criticisms, based on the expert report, of the audit protocol (in terms of its selection by Total) were largely founded on the remarkably mistaken belief that a US process industry protocol should have been used, despite that standard’s clear preliminary statement that it did not apply to storage at ambient temperatures and pressures. It should be noted that the DNV audits did engage on safety procedures at the grass roots. By 8 Chevron’s products were delivered by two pipelines owned by BPA – a Shell & BP JVP. BPA’s inadequate delivery scheduling at weekends led to three amendments in transmission times on the night of the explosion. Dealing with such issues required the supervisors’ attention, at the expense of engagement on other matters that at the time seemed to be a low priority. 9 While HOSL’s management of the ATG failure epidemic was deficient, they had no reason to suspect the IHLS. Relying on MCS was however the basis of a ‘common mode’ failure, namely that a then well-regarded company appears to have been in operational and technical disarray at that time. Page 7 of 10 mischance a DNV audit was due just after the explosion. The previous audit pre-dated the ATG imbroglio. However HOSL’s highly-relevant ISO9000 quality management system had recently been re-certificated. An important lesson from Buncefield is that good/best practice in the safety oversight of subsidiary companies may be deficient generally. The historical learning point is that Total had every reason to believe that their systems were sufficiently robust to ensure safety at HOSL. But the ‘reach’ of their systems was deficient. An example is that HOSL’s /Total’s rigorous procedure for vetting contractors only focussed on the safety of their work methods, not on the rigour of their quality control. This is a disquieting reflection that challenges the conventional wisdoms in major hazard industries. Total would have had to ‘micromanage’ HOSL’s safety and operational systems to uncover and address their well-disguised long-standing but unacceptable local working practices. But micromanagement of subsidiaries is rightly anathema in the business community. Auditors should consider afresh the scope of their audits of subsidiaries to uncover such problems, even at the risk of promoting micromanagement, albeit temporarily. Some of the causal factors at Buncefield have a long ancestry. Inadequate shift logs and handovers have been significant causal factors in many major incidents10. The fact that these shortcomings are repeated reflects a failure to learn anything from experience – perhaps equally as bad as learning the wrong lessons. This is a criticism of the chemical process industry of which Total are a part. Shortcomings in shift record keeping are underlying causes. The root causes may be associated with subsets of organisational culture some of which come down to the custom and practice of individual work groups. The effectiveness of initiatives to improve for example record keeping may depend on the efforts made to change deeply entrenched beliefs (and behaviours) at shift level, i.e., in this example, the root causes. 4 Hindsight bias in incident investigations generally The effects of hindsight bias are uniformly adverse in assigning blame and guilt in retrospect in accident cases. But hindsight (aiding understanding of the ‘correct’ lessons from what has happened) can better inform incident investigators about the future control of risks. If bias is minimised the simplifications of hindsight explained by Reason (ibid): “To the retrospective observer all the lines of causality home in on the bad event” is actually an advantage. The sequence of events and conditions leading up to the bad outcome are still the important issues even if people are blamed unduly for their part. A targeted investigation approach, if it explores underlying and root causes, provides a coherent, comprehensible but simple (but not simplistic) explanation that can be used to devise appropriate precautions to minimise repetitions. But there are considerable 10 Shortcomings in shift record keeping and shift handovers were key causal factors in the explosion on Piper-Alpha (1987), and at Longford (1998), Port Talbot (2001) and Texas City (2005). Page 8 of 10 challenges which stand in the way of this ideal outcome. These include heightened perceptions of risk in the immediate aftermath, where disproportionate precautions may be introduced; the presumption that people in the causal chain have behaved inexplicably; and hindsight bias is selective depending on the a priori beliefs of investigators. There are investigation techniques, for example ECFA, that promote objective analyses. Moreover investigators should ask the question: why did participants believe at the time that their actions were rational? Incident investigation training including an analysis of hindsight bias together with the use of investigation models may lead to more effective investigations. 5 Concluding comments Hindsight bias is uniformly a harmful influence in the evaluation of bad events. This has been demonstrated here, inter-alia by the extensive quotations, and by the Buncefield experience. The key issues are that participants in adverse events are unfairly blamed and that inappropriate lessons may be learnt from investigations. Moreover investigators who sincerely believe that they have ‘factored out’ hindsight bias are mistaken. In my opinion, a key root cause of the Buncefield explosion, namely the limited ‘reach’ of good/best practice safety systems, has been masked by the desire, promoted by hindsight bias, to rubbish in legal proceedings the efforts of Total, the JV partner responsible for safety at HOSL. An equally important conclusion is that while hindsight bias cannot be eliminated, hindsight is the essential means for learning from experience. Hindsight-rich bias-aware studies of the past where the facts are structured ‘simplified’ and made comprehensible, is the foundation for coherent efforts to prevent repetitions of adverse events. Incident investigation training courses embracing an analysis of hindsight bias together with the practical use of structured investigation models may improve the utility of investigations. The most important message of this paper, though not discussed in detail, is that it provides yet further evidence that some key lessons of major adverse events are simply not being appreciated and certainly not applied in practice. The underlying causal factors of major incidents are repeated time and time again. The repetitions almost defy belief. It is however the root causes, mainly associated with organisational and group culture and conventional wisdoms that need to be addressed. The ‘analysis of the past’ by investigators has so far failed to take sufficient account of the need to combat deeply-rooted causal factors. Prevention depends on explicit programmes to address the ultimate root causes. This is what we have yet to learn fully from history. Page 9 of 10 Acknowledgements I wish to thank the following Hastam colleagues who were involved in work on Buncefield: Dr Tony Boyle, Diana Gauton, Professor Andrew Hale, Sue Hanson, Dr Chris Hartley and the late Mike Thomas. I am also grateful to Steve Highly, Liz Shuttleworth, and Mike Vyvyan, as well as Andrew & Tony, for commenting on drafts of this report. Responsibility for the views expressed here is mine alone. References Churchill, WS (1927) “The World Crisis 1916-1918 Part 1”. Thornton Butterworth, London, page 112. Fischoff, B (2003) “Hindsight foresight: the effect of outcome knowledge on judgment under uncertainty”. Qual Saf Health Care 2003; 12: pp 304–312. Reprint of a paper in Journal of Experimental Psychology: Human Perception and Performance 1975, Volume 1, pages 288–299. HSE (1998) “The storage of flammable liquids in tanks”. HSG176, HSE Books. HSE (1999; second edition 2006) “A guide to the Control of Major Accident Hazards Regulations 1999 (as amended). Guidance on Regulations”. L111, HSE Books. HSE (2011) “Buncefield: Why did it happen? The underlying causes of the explosion and fire at the Buncefield oil storage depot, Hemel Hempstead, Hertfordshire on 11 December 2005”. http://www.hse.gov.uk/comah/buncefield/buncefield-report.pdf MIIB (2008) “The Buncefield Incident 11 December 2005. The final report of the Major Incident Investigation Board” *in three parts+. Reason, JT (2008) “The human contribution: unsafe acts, accidents and heroic recoveries”. Ashgate, Farnham, England. Tozer, R (2011) “Buncefield – An alternative review of the official story and why not to rely on a regulator”. RoSPA Conference http://www.shponline.co.uk/newscontent/full/she11-undisclosedbuncefield-report-should-be-made-public-says-lawyer (last accessed: 12 October 2011).
© Copyright 2019 ExploreDoc