Monday Accident & Lessons Learned: Aviation Safety Reporting System CALLBACK Notice About Ramp SafetyOctober 17th, 2016 by Mark Paradies
Here’s the start of the report …
This month CALLBACK features reports taken from a crosssection of ramp experiences. These excerpts illustrate avariety of ramp hazards that can be present. They describethe incidents that resulted and applaud the “saves” made bythe Flight Crews and Ground Personnel involved.
For the complete report, see:
Summary from the UK Rail Accident Investigation Branch …
At 18:12 hrs on Thursday 16 June 2016, a two-car diesel multiple unit train, operated by Great Western Railway (GWR), was driven through open trap points immediately outside Paddington station and derailed. It struck an overhead line equipment (OLE) mast, damaging it severely and causing part of the structure supported by the mast to drop to a position where it was blocking the lines. There were no passengers on the train, and the driver was unhurt. All the the lines at Paddington were closed for the rest of that evening, with some services affected until Sunday 19 June.
For causes and lessons learned, see: https://www.gov.uk/government/publications/paddington-safety-digest/derailment-at-paddington-16-june-2016
Monda Accident & Lessons Learned: US CSB Report on 2014 Freedom Industries Contamination of Charleston, West Virginia Drinking WaterOctober 3rd, 2016 by Mark Paradies
Here is the press release from the US Chemical Safety Board …
CSB Releases Final Report into 2014 Freedom Industries Mass Contamination of Charleston, West Virginia Drinking Water; Final Report notes Shortcomings in Communicating Risks to Public, and Lack of Chemical Tank Maintenance Requirements Report Includes Lessons Learned and Safety Recommendations to Prevent a Similar Incident from Occurring
September 28, 2016, Charleston, WV, — The CSB’s final report into the massive release of chemicals into this valley’s primary source of drinking water in 2014 concludes Freedom Industries failed to inspect or repair corroding tanks, and that as hazardous chemicals flowed into the Elk River, the water company and local authorities were unable to effectively communicate the looming risks to hundreds of thousands of affected residents, who were left without clean water for drinking, cooking and bathing.
On the morning of January 9, 2014, an estimated 10,000 gallons of Crude Methylcyclohexanemethanol (MCHM) mixed with propylene glycol phenyl ethers (PPH Stripped) were released into the Elk River when a 46,000-gallon storage tank located at the Freedom Industries site in Charleston, WV, failed. As the chemical entered the river it flowed towards West Virginia American Water’s intake, which was located approximately 1.5 miles downstream from the Freedom site.
The CSB’s investigation found that Freedom’s inability to immediately provide information about the chemical characteristics and quantity of spilled chemicals resulted in significant delays in the issuance of the “Do Not Use Order” and informing the public about the drinking water contamination. For example, Freedom’s initially reported release quantity was 1,000 gallons of Crude MCHM. Over the following days and weeks, the release quantity increased to 10,000 gallons. Also, the presence of PPH in the released chemical was not made public until 13 days after the initial leak was discovered.
The CSB’s investigation found that no comprehensive aboveground storage tank law existed in West Virginia at the time of the release, and while there were regulations covering industrial facilities that required Freedom to have secondary containment, Freedom ultimately failed to maintain adequate pollution controls and secondary containment as required.
CSB Chairperson Vanessa Allen Sutherland said, “Future incidents can be prevented with proper communication and coordination. Business owners, state regulators and other government officials and public utilities must work together in order to ensure the safety of their residents. The CSB’s investigation found fundamental flaws in the maintenance of the tanks involved, and deficiencies in how the nearby population was told about the risks associated with the chemical release.”
An extensive technical analysis conducted by the CSB found that the MCHM tanks were not internally inspected for at least 10 years before the January 2014 incident. However, the CSB report notes, since the incident there have been a number of reforms including passage of the state’s Aboveground Storage Tank Act. Among other requirements, the new regulations would have required the tanks at freedom to be surrounded by an adequate secondary containment structure, and require proper maintenance and corrosion prevention, including internal inspections and a certification process.
The CSB’s investigation determined that nationwide water providers have likely not developed programs to determine the location of potential chemical contamination sources, nor plans to respond to incidents such as the one in Charleston, WV.
Supervisory Investigator Johnnie Banks said, “The public deserves and must demand clean, safe drinking water. We want water systems throughout the country to study the valuable lessons learned from our report and act accordingly. We make specific recommendations to a national association to communicate these findings and lessons.”
While performing a lift using a tower crane, a failure of the gearbox cause about 1.000 lbs of hook and rigging gear to fall to the ground, narrowly missing workers in the area. Here is the report.
The investigation revealed several issues, most relating to proper inspections of the gearboxes to identify defective gears. While again this appears to be a straight equipment failure, we would also want to know:
- How did the deficient gear end up in the gearbox (it was the wrong material)?
- Are we looking for repeat failures (this had happened before)?
- How close were the workers in the vicinity?
- What was the preventative maintenance plan for this gearbox? Was it required be the vendor?
Lots of other directions a good investigation will lead you.
Here is a link (click of picture below) to a Callback publication about accidents and Fatigue …
Here is a quote:
“The NTSB 2016 “Most Wanted List” of Transportation Safety Recommendations leads with, ‘Reduce Fatigue-Related Accidents.” It states, “Human fatigue is a serious issue affecting the safety of the traveling public in all modes of transportation.’”
This incident notice is from the UK Rail Investigation Branch about an overspeed incident at Fletton Junction, Peterborough on 11 September 2015.
At around 17:11 hrs on 11 September 2015, the 14:25 hrs Virgin Trains East Coast passenger train service from Newcastle to London King’s Cross passed through Fletton Junction, near Peterborough at 51 mph (82 km/h) around twice the permitted speed of 25 mph (40 km/h). This caused the carriages to lurch sideways resulting in minor injuries to three members of staff and one passenger.
It is likely that the train driver had forgotten about the presence of the speed restriction because he was distracted and fatigued due to issues related to his family. Lineside signs and in-cab warnings may have contributed to him not responding appropriately as he approached the speed restriction and engineering controls did not prevent the overspeeding. Neither Virgin Trains East Coast, nor the driver, had realised that family-related distraction and fatigue were likely to be affecting the safety of his driving. Virgin Trains East Coast route risk assessment had not recognised the overspeeding risks particular to Fletton Junction and Network Rail had not identified that a speed limit sign at the start of the speed restriction was smaller than required by its standards.
The incident could have had more serious consequences if the train had derailed or overturned. The risk of this was present because the track layout was designed for a maximum speed of 27 mph (43 km/h).
As a consequence of this investigation, RAIB has made five recommendations. Two addressed to Virgin Trains East Coast relate to enhancing the management of safety critical staff with problems related to their home life, and considering such issues during the investigation of unsafe events.
A recommendation addressed to Virgin Trains East Coast and an associated recommendation addressed to Network Rail relate to assessing and mitigating risks at speed restrictions.
A further recommendation to Network Rail relates to replacement of operational signage when this is non-compliant with relevant standards.
RAIB report also includes learning points relating to managing personal problems that could affect the safety performance of drivers. A further learning point, arising because of a delay in reporting the incident, stresses the importance of drivers promptly reporting incidents which could have caused track damage. A final learning point encourages a full understanding of the effectiveness of safety mitigation provided by infrastructure and signalling equipment.
For more information see:
Here’s a link to the story: http://www.abc.net.au/news/2016-07-25/baby-dies-at-bankstown-lidcombe-hospital-after-oxygen-mix-up/7659552
An Oxygen line had been improperly installed in 2015. It fed nitrous oxide to a neonatal resuscitation unit rather than oxygen.
The Ministry of Health representative said that all lines in all hospitals in New South Wales installed since the Liberal government took over in 2011 will be checked for correct function.
What can you learn from this?
Think about your installation and testing of new systems. How many Safeguards are in place to protect the targets?
Last month, Delta Airlines experienced an equipment failure that caused their reservation system to shut down, Media reports indicate close to 2,000 flights were canceled. This is only a few weeks after Southwest Airlines experienced a similar computer failure, causing numerous flight delays and cancellations.
Reports continue to indicate that this was an equipment failure, due to a small fire in a power supply in there server room. Here is their description:
“Monday morning (August 8) an uninterrupted power source switch experienced a small fire which resulted in a massive failure at Delta’s Technology Command Center. This caused the power control module to malfunction, sending a surge to a transformer outside of Delta, resulting in the loss of power. The power was stabilized and power was restored quickly. But when this happened, critical systems and network equipment didn’t switch over to backups. Around 300 of about 7,000 data center components were discovered to not have been configured appropriately to avail backup power. In addition to restoring Delta’s systems to normal operations, Delta teams this week have been working to ensure reliable redundancies of electrical power as well as network connectivity and applications are in place.”
Keep in mind that the “uninterrupted power supply switch” is actually known as an “uninterruptible” power supply (UPS). This normally swaps you over to another power source if your primary source fails. You may have a simple UPS on your computer systems at the office, providing battery backup while power is restored. In Delta’s case, their UPS system attempted to switch over, but configuration issues prevented a significant number of their devices from actually shifting over.
Additionally, other reports indicate that the reservation system is an extremely antiquated system, linked into other airlines’ (also extremely antiquated) systems. They have all patched together and upgraded their individuals systems to the point that it is almost impossible to upgrade; it really requires a complete replacement, which would be EXTREMELY difficult and expensive to replace while still being used for current reservations.
So while this is discussed by the airlines as an equipment failure, I think there are more than likely multiple causal factors, of which only one (the initiating problem) was a burned up component. Without knowing the details, we can see several Causal Factors:
- A UPS caught fire
- This small fire caused a large surge and widespread power loss
- Other equipment was not properly configured to shift to backup power
- There is no backup in the event of a loss of the primary reservation system
- The reservation computer system has not been upgraded to modern standards
I always question when a failure is classed as “equipment failure.” Unless the equipment failure is an allowed event (Tolerable Failure), it is much more likely that humans were much more involved in the failure, with the broken equipment as only a result.
From the UK Rail Accident Investigation Branch…
On 1 August 2015 at about 11:11 hrs, a freight train travelling within a work site collided with the rear of a stationary freight train at 28 mph (45 km/h).
Engineering staff had authorised the driver of the moving freight train to enter the work site at New Cumnock station, travel about 3 miles (4.8 km) to the start of a track renewal site, and bring the train to a stand behind the stationary train.
There were no injuries but the locomotive and seven wagons from the moving train and eleven wagons from the stationary train were derailed; the locomotive and derailed wagons were damaged. One wagon came to rest across a minor road. There was also substantial damage to the track on both railway lines.
The immediate cause was that the moving train was travelling too fast to stop short of the rear of the stationary train when its driver first sighted the train ahead. This was due to a combination of the train movement in the work site not taking place at the default speed of 5 mph (8 km/h) or at caution, as required by railway rules, and the driver of the moving train believing that the stationary train was further away than it actually was.
An underlying cause was that drivers often do not comply with the rules that require movements within a work site to be made at a speed of no greater than 5 mph (8 km/h) or at caution.
As a consequence of this investigation, RAIB has made four recommendations addressed to freight operating companies.
One relates to the monitoring of drivers when they are driving trains within possessions and work sites.
Two recommendations relate to implementing a method of formally recording information briefed to drivers about making train movements in possessions and work sites.
A further recommendation relates to investigating the practicalities of driving freight trains in possessions and work sites for long distances at a speed of 5 mph (8 km/h) or at other slow speeds, and taking action to address any identified issues.
RAIB has also identified three learning points including:
the importance of providing drivers with all of the information they need to carry out movements in possessions and work sites safelya reminder to provide drivers (before they start a driving duty) with information about how and when they will be relievedthe importance of engineering staff giving instructions to drivers through a face to face conversation when it is safe and practicable to do so.
From the Rail Accident Investigation Branch …
At around 13:10 hrs on 25 July 2015, a passenger was dragged along the platform at Hayes & Harlington station, London, when the 11:37 hrs First Great Western service from Oxford to London Paddington departed while her hand was trapped in a door. The passenger, who had arrived on the platform as the doors were about to close, had placed her hand between the closing door leaves.
The train driver did not identify that the passenger was trapped and the train moved off, dragging the passenger along the platform. After being dragged for about 19 metres, the passenger lost her footing and fell onto the platform. The passenger suffered head, hand and back injuries.
RAIB’s investigation found that the passenger had deliberately placed her hand in the closing door in the expectation that it would re-open as a consequence. RAIB has concluded that after closing the doors of the train, the driver either did not make a final check that it was safe to depart, or that the check was insufficiently detailed to allow him to identify the trapped passenger. The driver may have been misled into thinking that it was safe to depart because a door interlock light in his cab had illuminated, indicating that the doors were closed and locked and he was able to take power.
Our investigation identified that the train driver and other railway staff held the same misunderstanding: if someone had a hand trapped in a door it would not be possible for the door interlock light to illuminate and a driver to take power. This is not the case, and the door was found to be compliant with all applicable standards after the accident.
As a consequence of this investigation, RAIB has made two recommendations.
The first, addressed to RSSB to review, and if necessary extend, its research into the passenger/train interface to understand passenger behaviour and identify means for deterring members of the public from obstructing train doors.
The second recommendation is addressed to operators and owners of trains similar to the one involved in the accident at Hayes & Harlington, is intended to continue and expand upon a current review into the practicability of fitting sensitive door edge technology to this type of train.
RAIB has also identified three learning points. The first concerns improving awareness among train drivers of the limitations of train door interlocking technology and the importance of the final safety check when dispatching a train.
The second concerns the potential for drivers to be distracted by the use of mobile communication devices while driving.
The third is aimed at train operators to have the necessary processes in place to identify drivers who are showing signs of sub-standard performance or not engaging positively with measures agreed as part of a Competence Development Plan and the provision of briefing and guidance material for driver managers to enable them to identify behaviours and attitudes which are inconsistent with those expected of train drivers.
For the complete report, see:
The following is a IOPG Safety Alert from the International Association of Oil & Gas Producers…
IOGP SAFETY ALERT
CORROSION COUPON PLUG EJECTED FROM PRESSURISED PIPELINE
Personnel accountable or responsible for pipelines and piping fitted with corrosion coupons.
A routine corrosion coupon retrieval operation was being conducted on a 28” crude oil pipeline. Two retrieval technicians were located in a below ground access pit, to perform the operation. The operation involved removal of the corrosion coupon carrier ‘plug’ from its threaded 2” access fitting on the pipeline. The plug was ejected at high velocity from the access fitting (pipeline pressure 103 bar), during the operation to ease the plug using a ring spanner to a maximum of ¼ turn (as per procedure) and before the service valve and retrieval tool were installed. A high volume of crude oil spilled from the pipeline via the access fitting. Fortunately, the two technicians escaped the access pit without injury from the plug projectile or crude oil release.
What Went Wrong?
The Venture is still in the process of conducting the incident investigation. Based on their findings to date, the most probable cause is that the threads of the access fitting were worn down to such an extent, that they were unable to restrain the plug upon minor disturbance (the ¼ turn of the plug).
- The access fitting was installed during pipeline construction in 1987. It is estimated to have been subject to over 140 coupon retrieval and installation cycles.
- Bottom-of-pipeline debris can cause galling of threads on stainless steel plugs, which in turn can damage the threads of carbon steel access fittings.
- The repair (chasing) of worn threads on access fittings is performed using an original equipment manufacturer supplied thread tap assembly service tool.
- In the presence of bottom-of-pipeline debris and thread damage, the repetitive removal of internal thread material, can lead to ever smaller contact surfaces, increasing contact stress, increasing wear rates and/or galling.
- Smaller thread contact surfaces reduce the ability of the access fittings to restrain plugs.
- In this incident, the original equipment manufacturer supplied thread tap assembly service tool had been used routinely for every plug coupon retrieval and installation cycle without the use of flushing oil to remove debris from the threads.
Corrective Actions and Recommendations:
Lessons Learned –
- As yet, there is no standard method to determine internal thread condition of on-line corrosion probe/coupon original equipment manufacturer access fittings. Thread condition is not easily inspected.
- The risk posed by long term use of thread tap assembly service tools on access fittings, has not been previously identified.
Action taken in originating company –
Temporarily suspend all corrosion coupon retrieval operations on pressurised lines furnished with threaded access fittings in the 6 o’clock position (bottom of pipeline). This provides time to complete the investigation and complete work with the original equipment manufacturer to develop clear guidance on the maximum number of retrieval cycles.
- A subsequent notification will be issued based on the completed investigation and original equipment manufacturer tests*. In this alert any changes to guidance or maintenance routines (i.e. how and when these type operations can be recommenced) will be advised.
- The temporary suspension does not cover retrieval operations on lines which are depressurised.
* the use of ‘no go’ gauges for checking access fittings after every use of a thread tap assembly service tool or access fitting body seat reamer, is being explored.
Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither the IOGP nor any of its members past present or future warrants its accuracy or will, regardless of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms.This document may provide guidance supplemental to the requirements of local legislation. Nothing herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In the event of any conflict or contradiction between the provisions of this document and local legislation, applicable laws shall prevail.
Safety Alert Number: 273
IOGP Safety Alerts http://safetyzone.iogp.org
The errors reported in this Aviation Safety Reporting System “Call Back” article are simple but serious. If you load a plane wrong, it could crash on takeoff. Click on the picture of the article below to read the whole report.
These simple errors seem like they are just an aviation problem. But are there simple errors that your people could make that could cause serious safety, quality, or production issues? maybe a Safeguard Analysis is in order to see if the only Safeguard you are relying on could fail due to a simple human error.
Monday Accident & Lessons Learned: Is the Information Collected as Part of an Accident Investigation “Privileged” – Canadian Court RulesAugust 1st, 2016 by Mark Paradies
The Occupational Health and Safety Act (“OHS Act”) in Canada requires an employer to conduct and investigation and prepare a report following an accident in the workplace. But an Aberta Queens Bench ruled that the obligation does not “foreclose or preclude” the employer’s ability to claim privilege over information collected during an internal investigation into the incident.
Want to learn more? See the article about the Alberta v Suncor Energy case at:
Last week’s collapse of the 235 foot boom on a crane building the new Tappan Zee bridge is still under investigation. There are apparently 3 separate investigations in progress, and as expected, not much information has been released.
The boom came down across all lanes of traffic on the old (still active) portion of the bridge. Amazingly enough, there were only 4 minor injuries, and it cause direct damage to a single vehicle. If you’ve ever driven across that bridge (I was on it just 30 days before the incident), you understand how lucky we were not to have any fatalities.
What we know so far:
– There was almost no wind, and this has been eliminated as a cause.
– The crane was being used to drive piles into the river bottom using a 60 ton vibratory hammer.
– There is a “black box” on the crane which will supply data on the boom angle, weight, etc.
– The operator says he knows what caused it (it wasn’t him).
– This is a new model crane with several safety features designed to eliminate human error.
– This is the only crane of this model being used on the project.
– The crane operator is licensed, with over 30 years of experience.
This seems to be a good start to an investigation. And as expected, there are a lot of questions (and “expert” opinions) about what happened. Some of the questions that might be asked:
- Was the crane properly inspected and certified?
- What was the condition of the vibratory hammer?
- Was there any sense of urgency that may have caused someone to make a mistake? The contract specified $120,000 per day fine of the project finished late.
- Was there an adequate review and approval of the safe zone around the crane operation?
It’s important not to just ask the hard questions, but also to give the hard answers. For example, one option that could have been in place (20/20 hindsight) would be to close the operating section of the bridge during construction. While this would definitely have been 100% safer, does it actually make sense to do this? Were there adequate safeguards in place to allow continued use of the old span? The answers here might be yes, and it was perfectly appropriate to operate the old bridge during contruction. I’ve seen hundreds of construction projects that have cranes in near proximity to the public. In fact, almost every downtown construction project has the potential to cause injury to the public if a crane collapses. Some of the criticism I’ve seen written about this accident (“Why wasn’t the old span closed during this constructiuon project?”) is too simplistic for the real world. The real question should be, “Were there adequate safeguards put in place for the level of risk imposed by this projct?” We don’t know the answers yet, but just asking these questions in an unbiased investigation can provide useful information.
It appears that there is plenty of information available to the investigators. I’m very interested to see the results after the investigations are complete.
This Accident shares a “Call Back” Report from the Aviation Safety Reporting System that is applicable far beyond aviation.
In this case, the pilot was fatigued and just wanted to “get home.” He had a “finish the mission” focus that could have cost him his life. Here’s an excerpt:
I saw nothing of the runway environment…. I had made no mental accommodation to do a missed approach as I just knew that my skills would allow me to land as they had so many times in past years. The only conscious control input that I can recall is leveling at the MDA [Rather than continuing to the DA? –Ed.] while continuing to focus outside the cockpit for the runway environment. It just had to be there! I do not consciously remember looking at the flight instruments as I began…an uncontrolled, unconscious 90-degree turn to the left, still looking for the runway environment.
To read about this near-miss and the lessons learned, see:
Derailment of freight train near Angerstein Junction, south east London, 3 June 2015
At about 12:10 hrs on 3 June 2015, one wagon of an empty freight train derailed on the approach to Angerstein Junction, near Charlton in south east London. The train continued over the junction, derailing two further wagons, before it stopped on the Blackheath to Charlton line. The three derailed wagons were partly obstructing the line used by trains travelling in the opposite direction. No other trains were involved in the accident and no-one was injured, but there was significant damage to the railway infrastructure.
The wagons derailed because the leading right-hand wheel on one of them was carrying insufficient load to prevent the wheel climbing up the outer rail on a curved section of track. The insufficient load was due to a combination of the suspension on that wheel being locked in one position, a twisted bogie frame and an intended twist in the track.
As a consequence of this investigation, RAIB has made three recommendations.
The first, addressed to VTG (the wagon owner), seeks improvements to its wagon maintenance processes.
The second, also addressed to VTG, seeks liaison with industry to improve understanding of how wagon suspension wear characteristics relate to maintenance processes.
The third, addressed to Network Rail, seeks a review of infrastructure arrangements at the accident location.
The report also includes a learning point reinforcing a previous recommendation intended to encourage use of currently available wheel load data to enable identification of wagons with defects or uneven loads that are running on Network Rail’s infrastructure.
To see the complete report, go to:
The above information and report are from the UK Rail Accident Investigation Branck. See their web site at:
Contact a power line and no one is hurt. What do you do next?
You’ve seen it hundreds of times. Something goes wrong and management starts the witch hunt. WHO is to BLAME?
Is this the best approach to preventing future problems? NO! Not by a long shot.
We’ve written about the knee-jerk reaction to discipline someone after an accident many times. Here are a few links to some of the better articles:
- Wacky Willie
- Will Discipline Fix the CTA’s Problems?
- USS Hartford / USS New Orleans Collision & Subsequent Discipline
- Should You Discipline BEFORE an Investigation is Complete?
- What Should Managers Know About Root Cause Analysis?
- Root Cause Analysis – Do it before even thinking about discipline!
Let me sum up what we know …
Always do a complete root cause analysis BEFORE you discipline someone for an incident. You will find that most accidents are NOT a result of bad people who lack discipline. Thus, disciplining innocent victims of the systems just leads to uncooperative employees and moral issues.
In the very few cases where discipline is called for after a root cause analysis, you will have the facts to justify the discipline.
For those who need to learn about effective advanced root cause analysis techniques that help you find the real causes of problems, attend out 5-Day TapRooT® Root Cause Analysis Training. See: http://www.taproot.com/courses