PTQ Q4 2026 Issue

execution. Flare systems are not new technology, hydro- treater procedures are not experimental, and the governing standards have existed in mature form for decades. So when the same categories of failure keep recurring, the honest answer is rarely ‘we didn’t know the risk’. It is that signals were missed, response was delayed, or disci- pline slipped under pressure and under cost or schedule pressure; people rationalise, defer hard calls, and avoid confronting what is inconvenient to see. That is not a flaw unique to one operator or one coun - try. It is a predictable feature of how humans behave under pressure, and it is precisely why process safety manage- ment exists: to catch what individual judgement, under stress, reliably misses. Where major losses actually begin There is a name for what connects the human failure mode to the engineering one, and it deserves a place in the indus- try’s standard vocabulary: execution drift. Major losses in oil and gas do not begin with the incident. They begin with execution drift. That is, the slow, largely unlogged diver- gence between how a system was designed to run and how it actually runs on a given shift. Drift takes familiar forms: • Maintenance drift: the inspection interval that stretches under a heavy turnaround schedule, the corrective work order that ages quietly in a backlog while the equipment it covers keeps operating. • Manpower drift: the experienced console operator replaced by a contractor three weeks into the role, the procedural knowledge that leaves with a retirement and is never written down. Each deviation is small, defensible, and usually invisible in the metrics leadership reviews. Compounded across hundreds of decisions a week, they are how a facility with complete documentation and current certifications arrives on the night when the flare becomes the ignition source. Reread the three previous incidents with ‘drift’ in mind. Oily water overflowing a perimeter after heavy rain is a drainage system where maintained condition drifted from its design intent. A flare that escalates a process upset is a relief path where loading, or where readiness, drifted from the assumptions in the original relief study. High-pressure piping that ruptures in hydrogen service is a mechanical-integrity programme in which the inspec- tion reality drifted from its inspection plan. None of these failures began on the night of the fire. The incident is only the final frame of a film that had been running for months. That reframing changes what operators should instru- ment. If losses begin with drift, then the leading indicators worth measuring are drift indicators. Deferred work orders on safety-critical equipment, procedure deviations per crew, staffing turnover in safety-critical roles, the age of the last HAZOP revalidation, and the objective of any tech- nology investment is to eliminate execution drift before it compounds, not to document it afterwards. Drift, unlike failure, is measurable while there is still time to act on it. It appears in the data weeks or months before it appears in an incident report, which is precisely what makes

drainage system. One event would be a case study. Three events in six weeks, each following a recognisable shape, is a pattern. Patterns are not resolved by post-incident root- cause reports alone. They are resolved by changing the system that keeps producing them. Recurring failures Two things are true at once when examining why the same failures keep recurring, and both deserve more attention than they typically get. The first is engineering. Certain equipment is structurally underestimated. Fired heaters and the hydrotreaters they serve sit at the inter- section of high temperature, high pressure, and hydrogen service conditions where tube rupture, flame impingement, and refractory failure carry consequences out of proportion to how routinely the equipment is treated. Figure 2 Fire and smoke over the hydrotreater complex at Valero’s Port Arthur Refinery, Texas, following the 23 March explosion. Source: Oilprice.com Flare systems suffer the opposite problem. Since they are the safety device, it is easy to assume they cannot them- selves become the point of failure. Both assumptions are wrong often enough that they should no longer be assump- tions. This is exactly where HAZOPs, dust hazard analyses, and layers-of-protection studies earn their value or quietly stop earning it. A hazard and operability study (HAZOP) is only as good as its last update, not its last audit date; a study performed at commissioning and never revisited as feedstock, con- ditions, or equipment age changes becomes a historical document rather than a live risk control. Control room sit- ing deserves the same scrutiny: an independent protection layer that can be destroyed alongside the hazard it moni- tors was never truly independent. The second truth is human, and it is the harder one to engineer around. Systems do not fail on paper; they fail in Patterns are not resolved by post-incident root-cause reports alone. They are resolved by changing the system that keeps producing them

PTQ Q4 2026