“Responsibility is a unique concept,
it can only reside and inhere in a single individual.
You may share it with others, but your portion is not diminished.
You may delegate it, but it is still with you.
You may disclaim it, but you cannot divest yourself of it.
Even if you do not recognize it or admit is presence, you cannot escape it.
If responsibility is rightfully yours, no evasion, or ignorance,
or passing the blame cna shift the burden to someone else.
Unless you can point your finger at the man who is responsible when something goes wrong,
then you never had anyone really responsible.”
Shout out to TapRooT® instructor, Heidi Reed, for sending in these great course photos from Las Vegas.
You have just one more chance to take TapRooT® training in Vegas in 2016 at that is December 5.
I know it’s far out but time flies. Mark your calendar and make plans to end the year on a high note!
The CSB press release starts with:
“Washington, DC, April 13, 2016 – Offshore regulatory changes made thus far do not do enough to place the onus on industry to reduce risk, nor do they sufficiently empower the regulator to proactively oversee industry’s efforts to prevent another disaster like the Deepwater Horizon rig explosion and oil spill at the Macondo well in the Gulf of Mexico, an independent investigation by the U.S. Chemical Safety Board (CSB) warns.”
For the whole report, see:
COMPLETE SERIES – Admiral Rickover: Stopping the Normalization of Deviation with the Normalization of ExcellenceApril 14th, 2016 by Mark Paradies
You may have dropped in on this series of articles somewhere in the middle. Here are links to each article with a quick summary…
Point of this article is that deviation IS NORMAL. Management must do something SPECIAL to make deviation abnormal.
A brief history of how Admiral Rickover created the first high performance organization. The Nuclear navy has a history of over 50 years of operating hundreds of reactors with ZERO process safety (nuclear safety) accidents. He stopped the normalization of deviation with the NORMALIZATION OF EXCELLENCE. Excellence was the only standard that he would tolerate.
This article describes the first of Rickover’s three keys to process safety: TECHNICAL COMPETENCE. The big difference here is this isn’t just competence for operators or supervisors. Rickover required technical competence all the way to the CEO.
The second key to process safety excellence (the normalization of excellence) – RESPONSIBILITY.
Do you think you know what responsibility means? See what Rickover expected from himself, his staff, and everyone responsible for nuclear safety.
FACING THE FACTS is probably the most important of Rickover’s keys to achieving excellence.
Read examples from the Nuclear Navy and think about what your management does when their is a difficult decision to make.
Here is the other 18 elements that Rickover said were essential (as well as the first three keys).
That’s right, the keys are the start but you must do all of these 18 well.
Here is Rickover’s own writing on what makes the Nuclear Navy special. What to this day (over 35 years after Rickover was retired) keeps the reactor safety record spotless.
That’s it. The whole series. I’m thinking about writing about some recent process safety related accidents and showing how management failed to follow Rickover’s guidance and how this lead to poor process safety performance. Would you be interested in reading about bad examples?
The following is the summary of a report from the UK Rail Accident Investigation Branch.
Serious accident involving a passenger trapped in train doors and
dragged at Clapham South station, 12 March 2015
At around 08:00 hrs on Thursday 12 March 2015, a passenger fell beneath a train after being dragged along the northbound platform of Clapham South station, in south London. She was dragged because her coat had become trapped between the closing doors of a London Underground Northern line train.
The train had stopped and passengers had alighted and boarded normally, before the driver confirmed that the door closure sequence could begin. The train operator, in the driving cab, started the door closure sequence but, before the doors had fully closed, one set encountered an obstruction and the doors were reopened. A passenger who had just boarded, and found that the available standing space was uncomfortable, stepped back off the train and onto the platform, in order to catch the following train. The edge of this passenger’s coat was then trapped when the doors closed again and she was unable to free it.
The trapped coat was not large enough to be detected by the door control system and the train operator, who was unaware of the situation, started the train moving. While checking the platform camera views displayed in his cab, the train operator saw unusual movements on the platform and applied the train brakes. Before the train came to a stop, the trapped passenger fell to the ground and then, having become separated from her coat, fell into the gap between the platform and the train. The train stopped after travelling about 60 metres. The passenger suffered injuries to her arm, head and shoulder, and was taken to hospital.
As a result of this accident, RAIB has made one recommendation, addressed to London Underground, seeking further improvements in the processes used to manage risks at the platform-train interface.
RAIB has also identified one learning point for the railway industry, relating to the provision of under platform recesses as a measure to mitigate the consequences of accidents where passengers fall from the platform.
For the complete report, see:
Normalization of Excellence – The Rickover Legacy – 18 Other Elements of Rickover’s Approach to Process SafetyMarch 31st, 2016 by Mark Paradies
The previous three articles discusses Rickover’s “key elements” to achieving safety in the Navy’s nuclear program. They are:
In addition to these three keys that Rickover testified to Congress about, he had 18 other elements that he said were also indispensable. I won’t describe them in detail, but I will list them here:
- Conservatism of Design
- Robust Systems (design to avoid accidents and emergency system activation)
- Redundancy of Equipment (to avoid shutdowns and emergency actions)
- Inherently Stable Plant
- Full Testing of Plant (prior to operation)
- Detailed Prevent/Predictive Maintenance Schedules Strictly Adhered To
- Detailed Operating Procedures Developed by Operators, Improved with Experience, and Approved by Technical Experts
- Formal Design Documentation and Management of Change
- Strict Control of Vendor Provided Equipment (QA Inspections)
- Formal Reporting of Incidents and Sharing of Operational Experience
- Frequent Detailed Audits/Inspections by Independent, Highly Trained/Experienced Personnel that Report to Top Management
- Independent Safety Review by Government Authorities
- Personal Selection of Leaders (looking for exceptional technical knowledge and good judgment)
- One Year of Specialized Technical Training/Hands-On Experience Prior to 1st Assignment
- Advanced Training for Higher Leadership Positions
- Extensive Continuing Training and Requalification for All Personnel
- Strict Enforcement of Standards & Disqualification for Violations
- Frequent Internal Self-Assessments
Would like to review what Rickover had to say about them? See his testimony here:
Now after the description of the excellence of Rickover’s program, you might think there was nothing to be improved. However, I think the program had three key weaknesses. They are:
- Blame Orientation (Lack of Praise)
- Needed for Advanced Root Cause Analysis
Let me talk about each briefly.
The dark side of a high degree of responsibility was a tendency to blame the individual when something went wrong. Also, success wasn’t celebrated, it was expected. The result was burnout and attitude problems. This led to fairly high turnover rate among the junior leaders and enlisted sailors.
Want to work long hours? Join the Nuclear Navy! Eighteen hour days, seven days a week, were normal when at sea. In port, three section duty (a 24 hour day every third day) was normal. This meant that you NEVER got a full weekend. Many errors were made due to fatigue. I remember a sailor was almost killed performing electrical work because of actions that just didn’t make sense. He had no explanation for his errors (they were multiple) and he knew better because he was the person that trained everyone else. But he had been working over 45 days straight with a minimum of 12 hours per day. Was he fatigued? It never showed up in the incident investigation.
ADVANCED ROOT CAUSE ANALYSIS
Root Cause Analysis in the Nuclear Navy is basic. Assign smart people and they will find good “permanent fixes” to problems. And this works … sometimes. The problem? The Nuke Navy doesn’t train sailors and officers how to investigate human errors. That’s where advanced root cause analysis comes in. TapRooT® has an expert system that helps people find the root causes of human error and produce fixes that stop the problems. Whenever I hire a Navy Nuke to work at System Improvements, they always tell me they already know about root cause analysis because they did that “on the boat.” But when they take one of our courses, they realize that they really had so much to learn.
If you would like to learn more about advanced root cause analysis, see our course offerings:
And sign up for our weekly newsletter:
IOGP SAFETY ALERTDROPPED OBJECT: 1.3 POUND LINK PIN FELL 40 FEET
A drilling contractor was tripping pipe out of the hole and a link pin came loose from the hook, falling 40 feet (12.2 metres) to the deck below. The pin bounced and struck a glancing blow to the left jaw/neck area of a worker. The link pin is 1 inch by 5 inches (2.5cm x 12.7cm) and weighs 1.3 pounds (0.6 kg).
What Went Wrong?
The type of keeper pin used on the dropped object did not adequately secure the pin. The link pin is threaded and uses a cotter pin to prevent the pin body from backing out. The pin was secured with a coil “diaper pin” instead of a cotter pin.
Corrective Actions and Recommendations:
Safety pins that can be knocked out must not be used for lifting operations or securing equipment overhead.
Follow cotter pin installation guidelines:
- Both points on a cotter pin must be bent around the shaft.
- Cotter pins are a single-use instrument and should never be re-used.
safety alert number: 271
IOGP Safety Alerts http://safetyzone.iogp.org/
Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither the IOGP nor any of its members past present or future warrants its accuracy or will, regardless of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms.
This document may provide guidance supplemental to the requirements of local legislation. Nothing herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In the event of any conflict or contradiction between the provisions of this document and local legislation, applicable laws shall prevail.
In the past two weeks we’ve discussed two of the “essential” (Rickover’s word) elements for process safety excellence …
This week we will discuss the third, and perhaps most important, essential element – FACING THE FACTS.
What is facing the facts? Here are some excerpts of how Rickover described it:
“… To resist the human inclination to hope that things will work out,
despite evidence or suspicions to the contrary.“
“If conditions require it, you must face the facts and brutally make needed changes
despite significant costs and schedule delays. … The person in charge must
personally set the example in this area and require his subordinates to do likewise.“
Let me give two examples from Rickover’s days of leading the Navy Nuclear Power Program that illustrate what he meant (and how he lived out this essential element).
Many people reading this probably do not remember the Cold War or the Space Race with the USSR. But there was a heated competition with national importance in the area of technology during Cold War. This technology race extended to the development of nuclear power to power ships and submarines.
Rickover in 1947, Rickover proposed to the Chief of Naval Operations that he would develop nuclear power for submarine propulsion. The technical hurdles were impressive. Developing the first nuclear powered ship was probably more difficult than the moon shot that happened two decades later. Remember, there were no computers. Slide rules were used for calculations. New metals had to be created. And new physics and radiation protection had to be created. None the less, Rickover decided that before he built the first nuclear powered submarine, he would build a working prototype of the submarine exactly like the actual submarine that was proposed. It would be built inside a hull and surrounded by a water tank to absorb radiation from the reactor.
This first submarine reactor was built near Idaho Falls, Idaho, and went critical for the first time in March of 1953. Just imagine trying to do something like that today. From concept to critical operations in just 6 years!
The prototype was then operated to get experience with the new technology and to train the initial crew of the first submarine, the USS Nautilus. The construction of the ship started in 1952 before the prototype was completed. Therefore, much of the construction of the Nautilus was complete before appreciable experience could be gained with the prototype. Part of the reason for this was that the lessons learned from the construction of the prototype allowed the Nautilus construction to progress much faster than was possible for the prototype.
However, during the operation of the prototype it was found that some of the piping used for the non-reactor part of the steam plant was improper. It was eroding much faster than expected. This could eventually lead to a hazardous release of non-radioative steam into the engineering space – a serious personnel hazard.
This news was bad enough, but the problem also had an impact on the Nautilus. There was no non-destructive test that could be performed to determine if the right quality piping had been used in the construction of the submarine. Some said, go ahead with construction. We can change out the piping of the Nautilus after the first period underway and still beat the Russians to sea on nuclear power.
Rickover wouldn’t hear of it. He insisted that the right way to do it was to replace the piping even though it meant a significant schedule delay. Accepting the possibility of poor quality steel would be sending the wrong message … the message that taking shortcuts with safety was OK. Therefore, he insisted that all the steam piping be replaced with steel of known quality before the initial criticality of the reactor. He set the standard for facing the facts. (By the way, they still beat the Russians to sea and won the race.)
The second example is perhaps even more astounding. Since no civilian or Navy power plants existed, there were no standards for how much occupational exposure a nuclear technician could receive. In addition, submarines were made for war and some proposed that any civilian radiation allowance should be relaxed for military men because they were sailors who must take additional risks. (Remember, we were doing above ground nuclear weapons testing in the US and marching troops to ground zero after the blast during this period.)
Rickover’s staff argued that a standard slightly higher than the one being developed for civilian workers would be OK for sailors. This higher standard would save considerable shielding weight and would result in a faster, more capable submarine. Rickover would hear nothing of it. He insisted that the shielding be built so that the projected radiation dose received by any sailor from the reactor during operation be no higher than that experienced by the general public. (Everyone receives a certain amount of exposure from solar radiation, dental and medical X-rays, and background radiation from naturally occurring radionuclides.) That was the design standard he set.
Many years later, it was noticed that Russian submarine crews were given time off after their deployments to relax in Black Sea resorts. Some thought this was just a reward for the highly skilled sailors. However, it was later discovered that this time off was required to allow the sailors time for their bone marrow to regenerate after damage due to high levels of radiation. The Russians had not used extra shielding and hence their sailors got significant radiation doses. Perhaps that why Russian nuclear submarine duty got the nickname of “babyless duty.”
There was no similar problem for US Nuclear Power Program personnel. Rickover made sure that the facts were faced early in the design process and no adverse health effects were experienced by US submarine sailors.
Let’s compare Rickover’s facing the facts to industrial practices. What happens when a refinery experiences problems and faces a shutdown? Does management “face the facts” and accept the downtime to make sure that everything is safe? Or do they try to apply bandages while the process is kept running to avoid losing valuable production? What would be the right answer to “face the facts” and achieve process safety excellence? Have we seen major accidents caused by just this kind of failure to face the facts? You betcha!
That’s it, the first three (and most important) of Rickover’s essential elements for process safety excellence. But that isn’t all. In his testimony to Congress he outlined additional specific elements that completed his reactor safety management system. I’ll outline the remaining elements in next week’s article.
What’s worse than a fatal accident? A fatal accident followed by fatalities to first responders or rescuers.
Six rescuers were recently killed while trying to save 26 miners after a coal mine explosion in Russia. The rescuers were killed when the methane exploded again during their rescue attempt. See:
Can you learn something about your emergency response and rescue efforts from this example?
TapRooT® training is available around the globe! Check out our upcoming courses: Course schedule.
Monday Accident & Lessons Learned: Report by UK RAIB – Serious accident as a passenger left a train and became trapped in the train doors at West Wickham station last AprilMarch 14th, 2016 by Mark Paradies
At around 11:35 hrs on 10 April 2015, a passenger was dragged along the platform at West Wickham station, south London, when the 11:00 hrs Southeastern service from London Cannon Street to Hayes (Kent) departed while her backpack strap was trapped in the doors of the train.
As it moved off, she fell onto the platform and then through the gap between the platform and train, suffering life-changing injuries.
The backpack strap became trapped when the train doors closed unexpectedly and quickly while she was alighting.
Testing showed that this potentially unsafe situation could only occur when a passenger pressed a door-open button, illuminated to show it was available for use, within a period of less than one second beginning shortly after the train driver initiated the door closure sequence.
RAIB identified this door behaviour, which was not known to the owner or operator, and issued urgent safety advice. In response to this, the railway industry undertook a review which identified 21 other types of train that permit passenger doors to be opened for a short period after door closure is initiated by train crew. The industry is now seeking ways to deal with this risk.
The train was being driven by a trainee driver under the supervision of an instructor. The service was driver only operation, which meant that before leaving West Wickham station, and after all train doors were closed, drivers were required to check that it was safe to depart by viewing CCTV monitors located on the platform. Two of these monitor images showed that a passenger appeared to be trapped but, although visible from the driving cab, neither the trainee driver nor the instructor was aware of this. Although the RAIB has not been able to establish why the trapped passenger was not seen before the train departed, a number of possible explanations have been identified.
As a result of this accident, RAIB has made two recommendations. The first, addressed to operators and owners of trains with power operated doors, is intended to identify and correct all train door control systems exhibiting the unsafe characteristics found during this investigation. The second, addressed to RSSB, seeks changes to guidance documents so that, where practicable, staff dispatching trains watch the train doors while they are closing, in addition to checking the doors after they are closed.
RAIB has also identified five learning points relating to: releasing train doors long enough to allow passengers to get on and off trains safely; effective checking of train doors before trains depart (and not relying on the door interlock light); design of door controls; and use of train driving simulators to raise drivers’ awareness of circumstances when it is not safe to depart from a station.
For the entire report, see: