HOUSTON -- An overemphasis on individual worker safety over entire systems safety may be what led to the 2010 Gulf of Mexico oil spill, a federal investigative board announced yesterday.

The U.S. Chemical Safety and Hazard Investigation Board (CSB) reached the same conclusion in 2007 in its investigation of a fire at a BP PLC refining center in Texas City, Texas, that killed 15 workers. But the recommendations to enhance process safety mechanisms that the board made in 2007 were not adequately accepted, leading to the explosion at the Deepwater Horizon drilling rig and deaths of 11 offshore workers, board members said in a public hearing held here yesterday.

Issuing its initial findings on the 2010 Macondo well blowout, which spilled more than 5 million barrels of oil into the Gulf, the CSB concluded that, despite the example of the Texas City incident, offshore drillers continued to focus too heavily on one aspect of safety management.

Namely, the board said that although the refining industry has evolved its practices, the offshore oil and gas industry still placed too much weight on avoiding individual injuries that would require a report to the Occupational Safety and Health Administration. Systems aimed at further reducing the chances of a loss of control at a drilling site were lacking.

"Personal safety does not wait for process safety," said Cheryl MacKenzie, investigations team leader at CSB. "Special emphasis on process safety must be placed on all levels of an organization."

While rules for avoiding slips, falls and other hazards that can cause injury or death were common, at the time of the spill, BP and Transocean Ltd. -- the lease holder at the Macondo well site and the rig owner and operator, respectively -- had inadequate process safety controls in place.

One example: Neither the well operator nor the rig owner had any written procedures for conducting negative pressure tests before the blowout, CSB said. Thus, the crew on the Deepwater Horizon had no formal means for determining at what point test results showed that work could be safely continued, creating confusion when they analyzed the data from multiple tests conducted in different ways.

"This was also an industry issue," CSB investigator Kelly Wilson said.

Wilson also pointed out that BP and Transocean changed their temporary abandonment plans -- the process of temporarily plugging a successful find for later production -- five times before the disaster. And the plans provided by BP for the CSB investigation were simply one-page documents that included no formal risk assessment, she said.

At the time of the incident, Deepwater Horizon was in the middle of temporary abandonment.

On April 20, 2010, the crew cementing the well received false negative pressure test readings indicating that the production zone had been successfully plugged, when it had not. Oil and gas escaped the production zone and shot up the well, forcing drilling mud and crude oil onto the drilling rig platform. The leaking oil and gas quickly ignited, engulfing the rig in flames.

In theory, the rig and crew could have been saved by using a process safety evaluation that would have looked at the diverter lines on the rig, which tie into the riser and are used to collect and divert drilling fluid for cleaning and reuse. Special valves on the diverter lines that could have been used to redirect flammable hydrocarbons away from the rig deck were designed to be opened manually and not automatically, a design flaw that could have saved lives had it been noticed in a more complete process safety evaluation, Wilson said.

"Risks were not properly managed by Transocean or BP," she said. "Hazard assessment management systems were inadequate."

MacKenzie pointed to further indicators her team found where too much reliance on guarding against worker safety hazards had blinded the companies to the larger picture. She said that at the time of the Macondo accident, BP's accident risk evaluation system looked only at BP equipment, excluding the Deepwater Horizon rig, owned and operated by Transocean. That has changed since the spill, she added.

She also faulted Transocean for overemphasizing smaller personal safety issues rather than adapting a process for noticing larger operational risks, through means such as internal rewards systems for minimizing workplace injuries. The flaws in this approach were seen, she said, when Transocean awarded safety management bonuses to senior personnel after the Deepwater Horizon went up in flames and sank to the bottom of the Gulf.

Industrywide issues

CSB faulted the industry at large for failing to heed the warnings from the 2005 Texas City refinery explosion, noting that at the time of the 2010 spill the International Association of Drilling Contractors also prioritized individual worker safety over process safety.

Some people invited to testify at the CSB public hearing voiced open skepticism of internal rewards systems as a means to encourage better workplace safety.

Roy Erling Furre, an official with Norway's offshore SAFE program, said the lost time injury reporting was the most common way for the industry to police platform safety, and in his opinion the most useless. He likened bonus pay for minimizing reported injuries to extra pay for police officers who reduce the number of parking tickets they issue.

Such systems lead to manipulation of data, risking an entire operation, he said.

"We need to demand honesty and transparency around payments to anyone" where safety matters are concerned, Furre said.

Lois Epstein, principal engineer at the Wilderness Society, criticized federal government regulators for being as myopic as the industry is sometimes accused of.

Epstein noted that when her advice was sought by officials at the Bureau of Safety and Environmental Enforcement (BSEE), she advised that they look overseas for examples of offshore process safety management that they could emulate. She was told that BSEE couldn't do that.

"What's needed is a data collection overhaul by BSEE," Epstein said.