Monthly Archives: June 2013

Root Cause Analysis - Incident Investigation

Train Derails After Collapse of Bridge in Calgary

By ThinkReliability Staff

Emergency crews in Calgary, already overworked from the heavy flooding in the area, have another potential emergency to mitigate.  In the very early morning of June 27, a rail bridge over the Bow River collapsed, just as the end of a long train went across.  The last six cars – five of which contained petroleum products, the last empty – derailed and are now precariously balanced on the collapsed bridge (but remain out of the river).

Emergency plans have been implemented to reduce the risk of the public in the area.  Capturing the cause-and-effect relationships that are resulting in the risk to the area can show how the emergency actions are acting on causes and potential causes to keep the public and the environment safe.  A visual representation of this type of root cause analysis is called a Cause Map.  The Cause Map has three steps.

First, we capture the what, when and where of the incident in a problem outline.  We also capture any differences such as the heavy recent flooding in the area.  Differences that we capture may or may not turn out to be causally related to the problem, but investigating the possibility is important.

The remainder of the outline is the impact to the goals.  Any “problem” is in fact an impact to one or more of an organization’s goals.  Framing the problem with respect to an organization’s goals ensures that solutions act to reduce these impacts and decrease disagreement about what the problem really is.  In this case, the safety goal is impacted due to the potential for injuries (though there have not been any associated with the derailment or response yet).  The potential leak of petroleum products is an impact to the environmental goal.  The area surrounding the train was evacuated, which can be considered an impact to the customer service goal.  (Frequently organizations will consider the surrounding communities as part of their customer base.)  The production/schedule goal is impacted because the bridge is unusable.  The damage to the bridge and potential damage to the cars (as yet unknown, because of their unstable position) are impacts to the property/materials goal. Lastly, the manpower being spent on emergency response and securing the train cars is an impact to the labor/time goal.

Once the impacts to the goals have been determined, the analysis begins with these impacted goals and is continued by asking “Why” questions.  For example, the risk of injury is caused by the potential leak of petroleum products.  The potential leak is due to the potential damage to the rail cars and the product contained within 5 of the cars.  Removing either of these causes reduces the risk of the effect.  In this case, plans are being made to remove the product from the trains to reduce the risk of both the safety and environmental impact.  The rail cars are being secured so that further bridge collapse will have less impact on the structural stability of the cars.

The evacuation – removing the people from the area – also serves to reduce the risk of injury.  To reduce the potential environmental impact, booms have been installed down-river in case of product leak.  Of course, these are emergency, short-term solutions designed to reduce the impact of collapse and derailment.  Solutions to the issue of the bridge collapse and its causes will be looked at in more detail once the cars have been safely removed.

While the investigation of the issue is still ongoing, the information that is currently known can be added to the Cause Map.  The structural failure that led to the bridge collapse appears to be caused by scouring of a support pier caused by the sudden influx of water related to the flooding in the area.  Concerns about how quickly the damage was discovered are a concern.  While investigations had been stepped up as a result of the flood, concerns from the city – which does not have jurisdiction for its own inspections – that the rail company’s inspections were insufficient will certainly be investigated.  It’s also been determined that the bridge – unlike others in the area – was not built into the bedrock, decreasing its strength, though how much of a role that played in the collapse  is yet to be determined.  When more information is known, it can be added to the Cause Map.

To view the Outline and Cause Map, please click “Download PDF” above.

Root Cause Analysis - Incident Investigation

Chemical Plant Explosion Kills 2 and Injures Dozens in LA

By Kim Smiley

On June 13, 2013, an explosion at a chemical plant in Louisiana killed two and injured more than seventy others.  The cause of the explosion is still unknown, but the federal Occupational Safety and Health Administration and the U.S. Chemical Safety Board are investigating the accident.

Even though the investigation is still ongoing, an initial Cause Map, or visual root cause analysis can be built for this issue.  The initial Cause Map can document what is known at this point and can easily be expanded to incorporate more details as they become available.  The first step in the Cause Mapping process is to fill in an Outline with the basic background information for the accident (such as the location, time and date) as well as document what overall goals were impacted by the incident.

In this case, the safety goal was obviously impacted because of the fatalities and injuries.  The damage to the plant is an impact to the material goal and the time the plant is shut down is an impact to the schedule goal.  Once the Outline is complete, including the impacts to the goal, the Cause Map is built by asking “why” questions.  For example, we would ask “why” people were killed and injured and would add that there was an explosion at the chemical plant to the Cause Map.

What caused the explosion isn’t known, but every explosion requires oxygen, a spark and fuel so these basic facts can be added to the Cause Map.  The plant housed a large amount of flammable material because it manufactures polymer grade propylene which is used to make plastics.  If investigators are able to determine what created the spark that information could be added as well as any other relevant information that comes to light.

The Outline also has space to document anything that is different or unusual at the time of the accident.  Anything unusual about the situation when the accident occurred is often a good starting point in an investigation because it may have played a role in the accident.  In this example, the plant was being expanded at the time of the accident and there were many contract workers on site.  If this is found to have played a role in the accident, this information would be incorporated onto the Cause Map as well as the Outline.

The final step of the Cause Mapping process is to use the Cause Map to develop solutions that can be implemented to help prevent a similar problem from occurring in the future.  Once a final Cause Map is built that incorporates all the findings from the investigation, it will be helpful in understanding any lessons to be learned and discussing potential solutions.

To view a high level Cause Map and an Outline for this accident, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

Failure of the Teton Dam in 1976

by ThinkReliability Staff

On June 5, 1976, workers were called to the Teton Dam on the Teton River in Idaho to attempt to repair a leak.  Workers in bulldozers narrowly avoided being sucked into the dam with their equipment, and watched helplessly as the dam was breached.  It would kill 14 people and cause nearly hundreds of millions of dollars in property and environmental damage.  To examine what went wrong, we can perform a visual root cause analysis, or Cause Map.

The Cause Mapping process begins by determining the impacts to an organization’s goals.  From the perspective of the government, specifically the Bureau of Reclamation, the safety goal is impacted because of the 14 deaths.  The environmental goal is impacted due to the severe impact the dam failure and subsequent flooding had on the ecosystem of the area.  The customer service goal was impacted due to the evacuation of three towns.  The production goal is impacted due to the abandonment of the dam – at a cost of approximately $50 million.  Additionally, property damage of at least $400 million (some estimates are much higher) is an impact to the property goal.  (There were also substantial claims related to the loss of property and livelihood from impacts to industries, particularly fishing.)

Once we have determined the impacts to the goals, we begin with an impacted goal, such as the safety goal, and ask “Why” questions to determine the cause-and-effect relationships that led to the impacted goals (also known as “problems”.)  In the case of the Teton Dam failure, people were killed due to a massive wave of water released from the dam (which was filled to capacity) when it failed.  The dam failure was also the cause of severe damage to the dam, which was never rebuilt, leading to the impacted production goal.

The failure of the dam was found to be caused by erosion and inadequate strength.  Due to the less than ideal geological conditions of the site (which was picked because there were no “good” sites available), unequal stress distribution and inadequate fill material (which was used from the site) led to reduced strength.  Susceptible materials and seepage from leaks in the embankment, caused by joints that were not resistant to water pressure due to inadequate testing, and inadequate protection from water due to an over-reliance on an ineffective curtain intended to stop flow, led to the erosion.

Many geologists had predicted problems with the dam before it was built.  Specifically, in his book “Normal Accidents”, Charles Perrow states “The Bureau ignored its own data that rocks in the area were full of fissures, and in addition they filled the dam too fast . . . All it takes to bring a dam down is one crack, if that crack wets the soil within the interior portions of the dam, turning it into a quagmire.”

Although tragic, and expensive, the failure of the Teton Dam did lead to many reforms in the Bureau of Reclamation, who is responsible for dam safety.  Detailed geological studies performed in order to determine the causes of the dam failure also provided additional insight to the strength provided by various types of earth, erosion and seepage.

Root Cause Analysis - Incident Investigation

Bridge Collapse In Washington Dumps Cars in River

By Kim Smiley

On May 23, 2013, a section of a four lane bridge over Skagit River near Mount Vernon, Washington unexpectedly collapsed, sending two cars into the river.  No one was killed, but the bridge failure is going to take months and an estimated $15 million to repair.  Additionally, the bridge was one of Washington’s main arteries to Canada with around 70,000 vehicles crossing it a day and detours during the repairs are significantly impacting the region.

So what caused the bridge to fail and how can a similar collapse be prevented in the future? This issue can be analyzed by building a Cause Map, a visual root cause analysis.  A Cause Map intuitively shows the causes that contributed to an issue and the cause-and-effect relationships between them. The collapse occurred after the top of an oversized truck hit a steel girder.  The bridge was a ‘fracture critical’ design, meaning that the design had little redundancy and fracture of one critical component, in this case the overhead steel girder, caused the whole bridge to collapse.  This type of design was common when the bridge was built in the 1950s because it was relatively quick and cheap to build.  Newer designs typically incorporate more redundancy to prevent a single failure from causing significantly damage, but the average bridge in the United States is 42 years old and there are thousands of fracture critical bridges across the nation.

So why did the truck impact the bridge?  This question is more complicated than it might appear on the surface.  The driver appears to have done his due diligence, but he had no warning that his truck was taller than the clearance.  The driver had a permit for hauling an oversized load on this stretch of highway.  The truck was also following a guide who gave no indication of potential clearance issues.  Additionally, there was no sign about low overhead clearance on the bridge because signage wasn’t required.  Signs are only required for overcrossing less than 14 feet and the lowest point on the bridge was higher than that.

The truck was traveling in the outside lane at the time it impacted the bridge.  The clearance over the outside lane of the bridge is lower than the inside lane because of the arch design of the bridge.  The truck’s load was 15 feet 9 inches high and the lowest clearance over the outside lane was 14 feet and 7 inches, but the inside lane has about a 17 feet clearance.  Bottom line, if the truck had simply moved into the inside lane it should have had the clearance to safely cross over the bridge.

This incident is certainly a warning about the need for redundancy in designs, but it also illustrates the need for clear communication.  If the driver had been aware that there was a potential issue, he could have changed lanes (which is a free and relatively easy solution) and the bridge collapse wouldn’t have happened.  Something needs to be changed to ensure that drivers are aware of any potential clearance issues.  In an ideal world, all bridges would be the safest, most up to date designs available, but the reality is that there are thousands of “fracture critical” bridges in use throughout the United States and we’re going to have to find ways to use them as safely as possible for quite some time.

Click here to see a Cause Map of another bridge failure, the 2007 I-35 Bridge Collapse and here to see a Cause Map of the failure of the Tacoma Narrows Bridge.