On November 19, 1984, a series of explosions caused one of the deadliest industrial accidents in the history of the world. The explosions occurred at a storage and distribution facility for liquified petroleum gas belonging to Petroleos Mexicanos. It is believed that the explosion started with a gas leak which caused a plume that grew large enough to be transported by the wind and reach a flare pit where it ignited.
The explosions and fires demolished most of the town of San Juan Ixhuatepec, and it is estimated that up to 600 people died and 5,000 – 7,000 people suffered severe injuries. The fire created such an inferno that most corpses were reduced to ashes, making it hard to determine who perished.
Learn more about the disaster.
When something catastrophic happens, companies often discover a series of errors and process flaws that were present all along. Advanced root cause analysis skills can help you uncover these error and flaws. Visit our training page to find a course near you:
Here’s the summary of the report:
At about 20:15 hrs on 15 October 2013, a freight train operated by Direct Rail Services, which was carrying containers, derailed about 4 miles (6.4 km) south west of Gloucester station on the railway line from Newport via Lydney. It was travelling at 69 mph (111 km/h) when the rear wheelset of the last wagon in the train derailed on track with regularly spaced dips in both rails, a phenomenon known as cyclic top. The train continued to Gloucester station where it was stopped by the signaller, who had become aware of a possible problem with the train through damage to the signalling system. By the time the train stopped, the rear wagon was severely damaged, the empty container it was carrying had fallen off, and there was damage to four miles of track, signalling cables, four level crossings and two bridges.
The immediate cause of the accident was a cyclic top track defect which caused a wagon that was susceptible to this type of track defect to derail. The dips in the track had formed due to water flowing underneath the track and although the local Network Rail track maintenance team had identified the cyclic top track defect, the repairs it carried out were ineffective. The severity of the dips required immediate action by Network Rail, including the imposition of a speed restriction for the trains passing over it, but no such restriction had been put in place. Speed restrictions had repeatedly been imposed since December 2011 but were removed each time repair work was completed; on each occasion, such work subsequently proved to be ineffective.
The type of wagon that derailed was found to be susceptible to wheel unloading when responding to these dips in the track, especially when loaded with the type of empty container it was carrying. This susceptibility was not identified when the wagon was tested or approved for use on Network Rail’s infrastructure.
The RAIB also observes: the local Network Rail track maintenance team had a shortfall in its manpower resources; and design guidance for the distance between the wheelsets on two-axle wagons could also be applied to the distance between the centres of the bogies on bogie wagons.
The RAIB has made seven recommendations. Four are directed to Network Rail and cover reviewing the drainage in the area where the train derailed, revising processes for managing emergency speed restrictions for cyclic top track defects, providing track maintenance staff with a way of measuring cyclic top after completing repairs, and investigating how cyclic top on steel sleeper track can be effectively repaired. Two are directed to RSSB and cover reviewing how a vehicle’s response to cyclic top is assessed and amending guidance on the design of freight wagons. One is directed to Direct Rail Services and covers mitigating the susceptibility of this type of wagon to cyclic top.
For the complete report, see:
Once again, human error in the news …
A tragedy nearly occurred when a giant drill bit almost penetrated a subway full of people in New York.
Airplane loses power during take off at a Kansas Airport and plane strikes building. Pilot of the King Air Aircraft that crashed and 3 people working in a flight simulator inside that building are dead. Read more here at KAKE News in Wichita, KS.
I post this because of the debates and blame that are going to ensue. Was it just one thing, the plane crashing, that caused this issue to occur? Was it the location of all the flight buildings in the vicinity of an airport. Was this just a “freak accident”. So much more to learn… I hope they get it right so it does not happen again.
The suborbital commercial flights give passengers a small taste of space travel by piloting international flights 62 miles above the Earth’s atmosphere for about $250,000 per seat.
So far, more than 700 prospective passengers have paid for tickets.
And interesting article in the Washing Post suggests that using a B-1B for night time close air support and insufficient training led to the death of 7 Americans and 3 allies in a friendly fire accident.
See the story at THIS LINK and see what you think.
The media debate about Ebola is subtly shifting from how to stop the spread of this horrific disease to finger pointing. How do we stop the blame game?
A recent analysis & opinion column (Reuters.com), “Why Finger Pointing about Ebola Makes Americans Less Safe,” suggests:
With Ebola, root cause analysis is going to be key to avoid mistakes in the future, but this will require a culture where it is safe to admit to errors.
Read the opinion here:
And let us know what you think by commenting below. How can the healthcare community create a culture where workers are not afraid to self-report mistakes? Do you think root cause analysis is key to stopping Ebola?
Monday Accident & Lessons Learned: UK RAIB Accident Report on a Passenger Becoming Trapped in a Train Door and Dragged a Short Distance at Newcastle Central StationOctober 27th, 2014 by Mark Paradies
Here is a summary of the report:
At 17:02 hrs on Wednesday 5 June 2013, a passenger was dragged by a train departing from platform 10 at Newcastle Central station. Her wrist was trapped by an external door of the train and she was forced to move beside it to avoid being pulled off her feet. The train reached a maximum speed of around 5 mph (8 km/h) and travelled around 20 metres before coming to a stop. The train’s brakes were applied either by automatic application following a passenger operating the emergency door release handle, or by the driver responding to an emergency signal from the conductor. The conductor, who was in the rear cab, reported that he responded to someone on the platform shouting at him to stop the train. The passenger suffered severe bruising to her wrist.
This accident occurred because the conductor did not carry out a safety check before signalling to the driver that the train could depart. Platform 10 at Newcastle Central is a curved platform and safe dispatch is particularly reliant upon following the correct dispatch procedure including undertaking the pre-dispatch safety checks.
The investigation found that although the doors complied with the applicable train door standard, they were, in certain circumstances, able to trap a wrist and lock without the door obstruction sensing system detecting it. Once the doors were detected as locked, the train was able to move.
In 2004, although the parties involved in the train’s design and its approval for service were aware of this hazard, the risk associated with it was not formally documented or assessed. The train operator undertook a risk assessment in 2010 following reports of passengers becoming trapped. Although they rated the risk as tolerable, the hazard was not recorded in such a way that it could be monitored and reassessed, either on their own fleet or by operators of similar trains.
As a consequence of this incident, RAIB has made six recommendations. One of these is for operators of trains with this door design to assess the risk of injuries and fatalities due to trapping and dragging incidents and take the appropriate action to mitigate the risk.
Two recommendations have been made to the train’s manufacturer. One of these is to reduce the risk of trapping on future door designs, and the other to review its design processes with respect to hazard identification and recording.
One recommendation has been made to the operator of the train involved in this particular accident. This is related to the management of hazards associated with the design of its trains and assessment of the risks of its train dispatch operations.
Two recommendations have been made to RSSB. One is to add guidance to the standard on passenger train doors to raise awareness that it may be possible to overcome door obstruction detection even though doors satisfy the tests specified within the standard. The other recommendation is the consideration of additional data which should be recorded within its national safety management information system to provide more complete data relating to the risk of trapping and dragging incidents.
See the complete report here:
What do you have planned to keep walkways clear this winter?
Here are some tips for snow and ice removal from WeatherChannel.com: (Read tips.)
Monday Accident & Lessons Learned: OPG Safety Alert #260 – Planning & Preparation … Key Elements for Prevention of MPD Well Control AccidentsOctober 6th, 2014 by Mark Paradies
OPG Safety Alert #260
PLANNING AND PREPARATION – KEY ELEMENTS FOR PREVENTION OF MPD WELL CONTROL INCIDENTS
During drilling the 6″ reservoir section in an unconventional well, a kick-loss situation occurred. After opening the circulation port in a drillstring sub-assembly, LCM was pumped to combat losses. When LCM subsequently returned to surface it plugged the choke. Circulation was stopped, the upper auto-Internal BOP (IBOP) was activated, and the choke manifold was lined up for flushing using a mud pump. During the course of this operation mud backflow was observed at the Shaker Box. The Stand Pipe Manifold and mud pumps were isolated to investigate. After a period of monitoring the stand pipe pressure, the upper IBOP, located at the top of the drillpipe, was opened to attempt to bullhead mud into the drillstring. Upon opening, a pressure, above 6500psi and exceeding the surface system safe working pressure, was observed. The upper IBOP was closed immediately and the surface system bled down. An attempt to close the lower manual IBOP as a second barrier was not successful. Due to the presence of high pressure, the Stand Pipe Manifold could not be used as the second barrier, nor could it be used for circulation. Well control experts were mobilised to perform hot tapping and freeze operations which were successfully executed and allowed a high-pressure drillpipe tree to be installed in order to re-instate 2 barriers on the drillpipe.
What Went Wrong?
- With the down-hole circulation sub-assembly open in the drillstring, the upper IBOP was either leaking or remained open due to activation malfunction (this could not be substantiated), and a flow path developed up the drill pipe.
- The line up for flushing the Choke Manifold with the mud pumps did not allow for adequate well monitoring. The set up as used resulted in unexpected flow up the drillstring to go undetected.
- It was incorrectly assumed that monitored volume gains were due only to mud transfer.
- Assessment of flow, volume and pressure risks did not consider in sufficient detail the concurrent operations involving pumping mud off line and a pressurized drill string.
- Operational focus was on choke manifold flushing whereas supervision should have maintained oversight of the broader situation including well monitoring.
Corrective Actions and Recommendations
- Develop a barrier plan for all operational steps; always update the plan as a result of operational changes prior to continuing (ie. ensure a robust Management of Change process).
- Take the time required to verify that intended barriers are in place as per the Barrier Plan and, when activated, have operated properly (eg. IBOP’s).
- Install a landing nipple above the down hole circulation sub-assembly to allow a sealing drop dart to be run if required.
- Always close-in, or line-up, in such a way that allows for monitoring of all the closed-in pressures at all times.
- “Walk the lines” prior to commencing (concurrent) operations involving pressure and flow.
- Develop procedures in advance for flushing of the Well Control system, especially for recognisable potential cases of concurrent operations.
- Develop clear procedures covering all aspects of unconventional operations, including reasonably expected scenarios, and ensure effective communication of these to all relevant staff.
Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither the OGP nor any of its members past present or future warrants its accuracy or will, regardless of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms.
This document may provide guidance supplemental to the requirements of local legislation. Nothing herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In the event of any conflict or contradiction between the provisions of this document and local legislation, applicable laws shall prevail.
On October 4, 2010, toxic sludge leaked from a metal refinery in Hungary. Over 100 people were injured, many suffering burns, and at least ten deaths were attributed to the disaster. The company was fined $647 million for environmental damage (Read article and view dramatic photos on The Guardian).
Learn how TapRooT® Root Cause Analysis can help you avoid injuries, deaths and costly fines. (Click here to learn more.)
This week accident information is from the US Chemical Safety Board …
CSB Chairperson Moure-Eraso Warns About Danger of Hot Work
on Tanks Containing Biological or Organic Material
Earlier this month a team of CSB investigators deployed to the Omega Protein facility in Moss Point, Mississippi, where a tank explosion on July 28, 2014, killed a contract worker and severely injured another. Our team, working alongside federal OSHA inspectors, found that the incident occurred during hot work on or near a tank containing eight inches of a slurry of water and fish matter known as “stickwater.”
The explosion blew the lid off the 30-foot-high tank, fatally injuring a contract worker who was on top of the tank. A second contract worker on the tank was severely injured. CSB investigators commissioned laboratory testing of the stickwater and found telltale signs of microbial activity in the samples, such as the presence of volatile fatty acids in the liquid samples and offgassing of flammable methane and hydrogen sulfide.
The stickwater inside of the storage tank had been thought to be nonhazardous. No combustible gas testing was done on the contents of the tank before the hot work commenced.
This tragedy underscores the extreme importance of careful hot work planning, hazard evaluation, and procedures for all storage tanks, whether or not flammable material is expected to be present. Hot work dangers are not limited to the oil, gas, and chemical sectors where flammability hazards are commonplace.
The CSB has now examined three serious hot work incidents—all with fatalities—involving hot work on tanks of biological or organic matter. At the Packaging Corporation of America (PCA), three workers were killed on July 29, 2008, as they were performing hot work on a catwalk above an 80-foot-tall tank of “white water,” a slurry of pulp fiber waste and water. CSB laboratory testing identified anaerobic, hydrogen-producing bacteria in the tank. The hydrogen gas ignited, ripping open the tank lid and sending workers tumbling to their deaths.
On February 16, 2009, a welding contractor was killed while repairing a water clarifier tank at the ConAgra Foods facility in Boardman, Oregon. The tank held water and waste from potato washing; the CSB investigation found that water and organic material had built up beneath the base of the tank and decayed through microbial action, producing flammable gas that exploded.
Mixtures of water with fish, potatoes, or cardboard waste could understandably be assumed to be benign and pose little safety risk to workers. It is vital that companies, contract firms, and maintenance personnel recognize that in the confines of a storage tank, seemingly non-hazardous organic substances can release flammable gases at levels that cause the vapor space to exceed the lower flammability limit. Under those conditions, a simple spark or even conducted heat from hot work can prove disastrous.
I urge all companies to follow the positive example set by the DuPont Corporation, after a fatal hot work tragedy occurred at a DuPont chemical site near Buffalo, New York. Following CSB recommendations from 2012, DuPont instituted a series of reforms to hot work safety practices on a global basis, including requirements for combustible gas monitoring when planning for welding or other hot work on or near storage tanks or adjacent spaces.
Combustible gas testing is simple, safe, and affordable. It is a recommended practice of the National Fire Protection Association, The American Petroleum Institute, FM Global, and other safety organizations that produce hot work guidance. Combustible gas testing is important on tanks that hold or have held flammables, but it is equally important—if not more so—for tanks where flammables are not understood to be present. It will save lives.
Why is the CSB Investigation of the Deepwater Horizon Accident Taking So Long? A 2010 Subpoena Ruled Valid By Federal Appeals Court…September 25th, 2014 by Mark Paradies
The Louisiana Record published the following article: “Fifth Circuit allows federal safety board review of Deepwater Horizon incident”.
Perhaps they can complete their investigation now…
Monday Accident & Lesson Learned: Fatal accident at Barratt’s Lane No.2 footpath crossing, Attenborough, Nottingham, 26 October 2013September 22nd, 2014 by Mark Paradies
The UK Rail Accident Investigation Branch issued a report about the fatal accident of a train striking a pedestrian at a footpath crossing near Nottingham, UK. See the entire report and the one lesson learned at:
Note: We have decided to republish articles from the Root Cause Network™ Newsletter that we find particularly interesting and still applicable today. These are used with the permission of the original publisher. In some cases, we have updated some parts of the text to keep them “current” but we have tried to present them in their original form as much as possible. If you enjoy these reprints, let us know. You should expect about two per month.
BEAT ‘EM OR LEAD ‘EM
A TALE OF TWO PLANTS
You’re the VP of a 1000 MW nuclear power plant. A senior reactor operator in the control room actuates the wrong valve.
The turbine trips.
The plant trips.
If the plant had just 30 more days of uninterrupted operation, your utility would have been eligible for a better rate structure based on the Public Service Commission’s (PUC) policy that rewards availability. Now you can kiss that hefty bonus check (that is tied to plant performance goals) good-bye.
To make matters worse, during the recovery, a technician takes a “shortcut” while performing a procedure and disables several redundant safety circuits. An inspector catches the mistake and now the Nuclear Regulatory Commission (the plant’s nuclear safety regulator – the NRC) is sending a special inspection team to look at the plant’s culture. That could mean days, weeks or even months of down time due to regulatory startup delays.
What do you do???
PLANT 1 – RAPID ACTION
He who hesitates is lost!
Corporate expects heads to roll!
You don’t want to be the first, so you:
- Give the operator a couple of days off without pay. Tell him to think about his mistake. He should have used STAR! If he isn’t more careful next time, he had better start looking for another job.
- Fire the technician. Make him an example. There is NO excuse for taking a shortcut and not following procedures. Put out another memo telling everyone that following procedure is a “condition of employment.”
- Expedite the root cause analysis. Get it done BEFORE the NRC shows up. There is no time for detailed analysis. Besides, everyone knows what’s wrong – the operator and technician just goofed up! (Human error is the cause.) Get the witch-hunt over fast to help morale.
- Write a quick report. Rapid action will look good to the regulator. We have a culture that does not accept deviation from strict rules and firing the technician proves that. Tell them that we are emphasizing the human performance technology of STAR. Maybe they won’t bother us any more.
- Get the startup preparation done. We want to be ready to go back on-line as soon as we can to get the NRC off our backs and a quick start-up will keep the PUC happy.
PLANT 2 – ALTERNATIVE ACTION
No one likes these types of situations, but you are prepared, so you:
- Start a detailed root cause analysis. You have highly trained operations and maintenance personnel, system and safety engineers, and human factors professionals to find correctable root causes. And your folks don’t just fly by the seat of their pants. They are trained in a formal investigation process that has been proven to work throughout a variety of industries – TapRooT®! It helps them be efficient in their root cause analysis efforts. And they have experts to help them if they have problems getting to the root causes of any causal factors they identify.
- Keep the NRC Regional Office updated on what your team is finding. You have nothing to hide. Your past efforts sharing your root cause analyses means that they have confidence that you will do a thorough investigation.
- “Keep the hounds at bay.” Finding the real root causes of problems takes time to perform a trough investigation. Resist the urge (based on real or perceived pressure) to give in to knee-jerk reactions. You don’t automatically punish those involved. Yoiu believe your people consistently try to do their best. You have avoided the negative progression that starts with a senseless witch-hunt, progresses to fault finding, and results in future lies and cover-ups.
- Check to see that the pre-staged corrective maintenance has started. Plant down time – even unscheduled forced outages – is too valuable to waste. You use every chance to fix small problems to avoid the big ones.
- Keep up to date on the root cause analysis team’s progress. Make sure you do everything in your power to remove any roadblocks that they face.
- Get ready to reward those involved in the investigation and in developing and implementing effective corrective actions. This is a rare opportunity to show off your team’s capabilities while in the heat of battle. Reward them while the sweat is still on their brow.
- Be critical of the investigation that is presented to you. Check that all possible root causes were looked into. Publicly ask: “What could I have done to prevent this incident?” Because of your past efforts, the team will be ready for good questions and will have answers.
Which culture is more common in your industry?
Which plant would you rather manage?
Where would you rather work?
What makes Plant 1 and Plant 2 so different? It is really quite simple…
- Management Attitude: A belief in your people means that you know they are trying to do their best. There is no higher management purpose that to help then succeed by giving them the tools they need to get the job done right.
- Trust: Everyone trusts everyone on this team. This starts with good face to face communications. It includes a fair application of praise and punishment after a thorough root cause analysis.
- Systematic Approach and Preparation: Preparation is the key to success and the cause of serendipity. Preparation requires planning and training. A systematic approach allows outstanding performance to be taught and repeated. That’s why a prepared plant uses TapRooT®.
Which plant exhibited these characteristics?
HOW TO CHANGE
Can you change from Plant 1 to Plant 2? YES! But how???
The first step has to be made by senior managers. The right attitude must be adopted before trust can be developed and a systematic approach can succeed.
Part of exhibiting the belief in your people is making sure that they have the tools they need. This includes:
- Choosing an advanced, systematic root cause analysis tool (TapRooT®).
- Adopting a written accident/incident investigation policy that shows managements commitment to thorough investigations and detailed root cause analysis.
- Creating a database to trend incident causes and track corrective actions to completion.
- Training people to use the root cause analysis tool and the databases that go with them.
- Making sure that people have time to do proper root cause analysis, help if things get difficult, and the budget to implement effective corrective actions.
- Providing a staff to assist with and review important incidents, to trend investigation results, and to track the implementation of corrective actions and report back to management on how the performance improvement system is performing.
Once the proper root cause analysis methods (that look for correctable root causes rather than placing blame) are implement and experienced by folks in the field, trust in management will become a forgone conclusion.
YOU CAN CHANGE
Have faith that your plant can change. If you are senior management, take the first step: Trust your people.
Next, implement TapRooT® to get to the real, fixable causes of accidents, incidents, and near-misses. See Chapter 6 of the © 2008 TapRooT® Book to get great ideas that will make your TapRooT® implementation world class.
_ _ _
Copyright 2014 by System Improvements, Inc. Adapted from an article in the March 1992 Root Cause Network™ Newsletter (© 1992 by System Improvements – used by permission) that was based on a talk given by Mark Paradies at the 1990 Winter American Nuclear Society Meeting.
The UK Rail Accident Investigation Branch has published a report about two accidents where things (a wheelchair and a baby stroller) rolled onto the tracks.
To see the report and the one lesson learned, CLICK HERE.
Monday Accident & Lessons Learned: NTSB Investigation – Grounding and Sinking of Towing Vessel Stephen L. Colby”September 8th, 2014 by Mark Paradies
Below is the NTSB investigation PDF. Read it and see what you think of the “probable cause” of the accident … “The National Transportation Safety Board determines that the probable cause of the grounding and sinking of the Stephen L. Colby was the failure of the master and mate to ensure sufficient underkeel clearance for the intended transit through the accident area.“
See the whole report here: