Pipeline Spill in Alberta Threatens Drinking Water

by ThinkReliability Staff

A pipeline spill in Alberta, Canada of up to 480,000 litres was noticed on the evening of June 7, 2012.  Although pipelines are estimated to spill approximately 3.4 million litres a year, they are not frequently near populated areas or water sources.  However, due to the proximity of this spill to a drinking water source, there was the potential of impact to drinking water.  An issue of this magnitude, with this type of impact, is thoroughly investigated to reduce the risk of recurrence.  We can examine this issue in a visual root cause analysis performed as a Cause Map.

We begin with the impacts to the goals.  In this case, the safety goal is impacted because of the potential impact to drinking water.  The environmental goal is impacted because of the spill of sour crude oil.  The spill is impacting area residents in a variety of ways, which can be considered an impact to the customer service goal.  The production goal was impacted due to a 10-day shutdown of a portion of the pipeline.  The property goal is impacted by the damage to the pipeline, and the labor goal is impacted by the response and cleanup required.

Once we have developed the impacts to the goals, we can ask “Why” questions to develop the cause-and-effect relationships that resulted in those impacts.  The potential impact to drinking water resulted from the proximity of the spill to a drinking water source, because the spill was in a populated area, and the oil spill itself.  The oil spill resulted from damage to the pipeline and the time elapsed before the spill was stopped.  Because the longer a spill goes undetected, the more environmental impact it has, consideration of the adequacy of monitoring, inspection and testing must be considered to ensure that this risk is reduced.

Although the cause of the pipeline damage is still being investigated, causes that have resulted in prior pipeline damage include construction damage, internal corrosion, and external corrosion.  External corrosion can result from exposure to water, which in this case was impacted by recent flooding of the river and shallow burying of the pipe, as was typical with earlier installations.  The age of the pipe may have also impacted the internal corrosion, as the more time that pipe is exposed to hydrocarbons (which the pipe transmits) the more corrosion will occur.

Immediate solutions include isolating the damaged area with a valve.  Then repairs were made to the pipeline, and cleanup began.  Cleanup is expected to take most of the summer.  There have been calls for increased monitoring, testing, and inspection of the line, and with an incident of this type, that frequency should be examined to ensure it is appropriate to minimize these types of risk.

To view the Outline, Cause Map, and Solutions, please click “Download PDF” above.

Deadly Kansas City Walkway Collapse

By Kim Smiley

On July 17, 1981, the second and fourth floor suspended walkways collapsed at the newly opened Hyatt Regency of Kansas City, Missouri.  A dance contest had attracted a crowd and the atrium under the walkway was filled with people.  This accident killed 113 people and injured 186.

The hotel was newly constructed and the walkways were well maintained.  So how did this happen?

A root cause analysis of this accident shows that there were a number of causes that contributed to the walkways collapsing.  Investigation into the accident shows that the structural design of the walkway was inadequate.  A weld failed which allowed a support rod to pull through the box beam and the walkways fell.

Additionally, the weld had greater stress than normal on it at the time of the failure because a large crowd had gathered to watch a danced content.  About 20 people were on second floor walkway and about 40 were on the fourth floor walkway at the time of the accident.  The higher loading combined to the walkway collapse.

Identifying the failure mechanism is important during an investigation, but a thorough root cause analysis needs to take the analysis farther to really understand the causes.  The reason that an inadequate design was built needs to be determined.

In this case, it appears that the design was changed without approval of the structural engineer.  This resulted from a communication error between the fabricator and the structural engineer.  The structural engineer sent a sketch of a proposed walkway design to the fabricator, assuming that the fabricator would work the details of the design himself. The fabricator assumed the sketch was a finalized drawing.   The fabricator then picked standard parts to fit the sketch.  This resulted in a significant change from the original design and dramatically decreased the load bearing capacity of the walkways.

The original design called for continuous hanger rods (a non-standard part that would have needed to be manufactured) that passed through the fourth floor walkway beam box to the second floor walkway, resulting in the ceiling connecting supporting the weight of both walkways.  The fabricator changed the design to use two shorter rods (standard parts) which resulted in the fourth floor walkway supporting the weight of the second floor walkway, which it wasn’t designed to handle.

It’s important to investigate beyond the point of inadequate design to learn what failed in the design process to prevent future accidents from occurring.

Deadly Plane Crash in Lagos, Nigeria

by ThinkReliability Staff

A devastating air crash in Lagos, Nigeria killed all on board and at least 10 on the ground.  This was the first major commercial air disaster since 2006.  Safety efforts since that disaster resulted in the US Federal Aviation Administration ( FAA) granting Nigerian    airlines its top air-safety rating.  Now concerns about air safety in Nigeria have resurfaced.  As a result of the crash, according to Harold Demuren, head of Nigerian civil aviation body: “We have suspended the entire Dana fleet.  They will be grounded as long as it takes to carry out the necessary investigations into whether they are airworthy.”

We can examine this incident in a Cause Map, or a visual root cause analysis.  We begin with the goals that were impacted.  In this case, the safety goal was impacted due to the deaths of people on the plane and on the ground.  We begin by asking “Why” questions to put together a very simple cause-and-effect relationship.  In this case, after losing both engines, Dana Air flight 992 crashed into a residential building in a highly populated suburb of Lagos, Nigeria, killing all 153 people on board and at least 10 on the ground.

The investigation of the plane crash is still ongoing.  However, it is known that both engines of the plane lost power, causing the plane to rapidly lose altitude and crash into a highly populated area.  Some of the areas being investigated that may have contributed to the crash are:

1) a bird strike (bird remains were found in one engine),

2) poor maintenance (although the plane was regularly inspected, there were also reports of leaking hydraulics and a history of poor airline safety in Nigeria, which appeared to have been remedied in recent years as indicated by the US FAA’s granting of its top air-safety rating,

3) overworked planes, likely due to financial considerations (the plane that crashed was on its fourth trip of the day), and/or

4) the age of the airplane (at 22 years old, it was technically not permitted to fly in Nigeria, which bans the use of planes over 20 years old).

As more information is revealed during the investigation it can be added to the Cause Map.  As the investigation is concluded, there will likely be more changes to Nigerian requirements and oversight for air safety.

To view the Outline and Cause Map, please click “Download PDF” above.

Unticketed Man Bypasses Security, Boards Plane

by ThinkReliability Staff

On May 29, 2012 a man boarded a flight from the tarmac at San Diego International Airport.  The man did not have a ticket, and had not been through security.  The extra passenger was not noticed until a flight attendant’s head count was noted to be off.

We can examine this issue in a Cause Map, which is a root cause analysis that visually represents the cause-and-effect relationships that result in impacts to the organization’s goals.  We begin by defining what those impacts to the goals were.  In this instance, although no one was hurt, there was the potential for a safety issue.  The customer service goal was impacted due to the deplaning required for the passengers already onboard.  The schedule goal was impacted because the plane was delayed due to the rechecks required of passengers.  The personnel time required for these rechecks is an impact to the labor goal.

Once we’ve determined the impacts to the goals, we ask “why” questions to determine the causes resulting in the impacted goals.  In this case, the rechecks were required because the flight attendant’s head count was off.  The flight attendant’s count was off because a man without a ticket had boarded the plane.   Because the man was able to board the plane from the tarmac without showing a ticket, tickets were presumably not checked at the aircraft door.  Likely they were instead checked at the door leading to the tarmac.  Because the unticketed man was able to access the tarmac through an emergency exit, he was able to get on the plane without a ticket.  How was he able to access the tarmac?  He went through an emergency exit door in a public area.  Security did not realize that he had exited this way, either because there was no alarm associated with using the door, or the notification from the alarm was inadequate to ensure that security was notified.

According to San Diego Harbor Police Chief John Bolduc, “He completely bypassed TSA screening.  He was in a public area and went out an emergency fire door, which gave him access to the tarmac.”

The airport is carefully scrutinizing its security to ensure that this never happens again.  One solution would be to install emergency exit alarms so that security personnel are notified that security bypass procedures should be initiated.  A solution for the plane operators is to check tickets at the door of the plane, in addition to or instead of at the exit to the tarmac.

To view the Outline, Cause Map and potential solutions, please click “Download PDF” above.

The Collapse of Agricultural Buildings

By ThinkReliability Staff

Every winter there are pockets of agricultural building collapses in areas that have seen heavy snow and ice accumulation.    The causes for these collapses can be examined in a Cause Map, or visual root cause analysis.  First, we begin by capturing the basic information about the issue.  In this case, there  were three areas that suffered building collapses due to winter weather accumulation.  This included New  York State in 1999,  Wisconsin in 2010, and England in 2010 and 2011.  Important to note is that each of these areas experienced heavy snowfall during the periods of collapse and in each region, agricultural buildings were more likely than other types of buildings to have collapsed.  It is also important to note that in each of these areas, agricultural buildings were not regulated to the same level as other buildings.

To begin our root cause analysis, we begin with the impacts to the goals. The collapse of an agricultural building carries with it the risk of human injury or loss of life, as well as potential loss of livestock.  A building collapse results in property damage as well as time spent on cleanup, repairs, and anything else that needs to be done to get the facility up and running again.

To continue the analysis, we begin with the impacted goals and ask “why” questions.  These impacts to the goals are all related to the collapse of an agricultural building.  The collapse of a building results when the stress (in this case, the structural load) exceeds the strength.  The structural loads in the case of the collapsed buildings generally result from accumulation of ice and snow, which  may be unevenly distributed, increasing local load, due to drifting, and an improperly engineered building.  Agricultural buildings are more likely to collapse due to structural loads because they are exempt from codes in most of the US and unregulated in England.  If engineering is desired, a properly engineered building may be scaled up or altered, resulting in changing loads and strengths, meaning the engineering review may no longer be valid to protect the building.  Although engineering is frequently skipped due to cost measures, experts say that proper engineering can save money by ensuring that supports are put in only where they’re needed (and, of course, reducing the risk of a collapse.)

Generally the collapsed buildings are found to have inadequate bracing, which reduces the strength of the building to the point of collapse.  If the buildings are not properly engineered, bracing may be inadequate for the design of the building.  Another issue  frequently seen is that the trusses are engineered, but are not reviewed with respect to the overall building design, leading to an insufficient analysis that does not take into account all of the factors that impact building loads and strength.

Although states and countries could elect to consider agricultural buildings in their codes, farmers don’t need to wait.  If you are building an agricultural building (or any building that may be exempt from code), ensure it’s adequately structurally engineered.  It may save a life.

To view the Outline and Cause Map, please click “Download PDF” above.  Or read more:

1999 collapses in NY State

2010 collapses in Wisconsin

2010 & 2011 collapses in England