All posts by Angela Griffith

I lead comprehensive investigations by collecting and organizing all related information into a coherent record of the issue. Let me solve a problem for you!

Plane Dive Caused by Personal Camera Results in Court-Martial

By Angela Griffith

On February 9, 2014, a Royal Air Force Voyager was transporting 189 passengers and a crew of 9 towards Afghanistan when the plane suddenly entered a steep dive. Many passengers were unrestrained and were injured by striking the ceiling or other objects. Other passengers were injured by flying objects or spills of hot liquid. More than 30 passengers and crew members reported injuries, all considered minor. The Military Aviation Authority’s final report contains details of the impacts from the dive, the causes of the dive, and recommendations that would reduce the possibility of a similar issue in the future.

These impacts, the cause-and-effect relationships that led to them, and the recommended solutions can be captured within a Cause Map. The Cause Map process begins with filling in a Problem Outline, which captures the what, when and where of an incident, followed by the impacts to the goals. The problem covered by the report is the aircraft dive and resulting injuries which occurred on February 9, 2014 at about 1549 (3:49 PM) on an Airbus A330-243 Voyager tanker air transport flight. Things that were different, unusual or unique at the time of the incident are also captured. In this case, the plane had experienced prior turbulence, and the co-pilot was not in his seat at the time of the dive.

The next step is to capture the impacts to the goals on the Outline. In this case, the safety goal is impacted because of a significant potential for fatalities, as well as the more than 30 actual injuries. Customer service is impacted due to the steep dive of the plane, and the regulatory goal is impacted due to the court-martial of the pilot, as well as 10 lawsuits against the Ministry of Defense. Production was impacted because the plane was grounded for 12 days, the property goal is impacted because of the potential for the loss of the whole plane, and the labor goal is impacted by the investigation.

Beginning with an impact to the goal, all the cause-and-effect relationships that led to that goal are captured on the Cause Map. In this case, the potential for fatalities resulted from the potential loss of the plane. According to Air Marshal Richard Garwood, previous director general of the UK’s Military Aviation Authority (MAA), “On this occasion, the A330 automatic self-protection systems likely prevented a disaster of significant scale. The loss of the aircraft was not an unrealistic possibility.” The potential for the loss of the plane resulted from the steep dive. The reason the plane was NOT lost (and this becomes a significant near miss) is the plane was recovered to level flight by the flight envelop protection system, which functioned as designed. (Although this is a positive, not a negative, it’s a cause all the same and should be included in the Cause Map.)

The steep dive resulted from the controller being forced forward without being counteracted. These are two separate causes that resulted in the effect, and are listed vertically and joined with an “AND” on the Cause Map. More detail should be provided about both causes. The command could not be counteracted because the co-pilot was not on the flight deck. He had been taking a break for several minutes before the incident. The investigation found that the controller was forced forward by a camera that was pushed against the controller. The camera had been placed between the seat and the controller, and then the seat was pushed towards (as is normal to occur during flight).

The investigation found that, despite concerns for about a year prior to this incident, loose personal articles were not prohibited on the flight deck. While there was a requirement to stow loose articles, it was not referenced in the operational manual and instead became one of thousands of paragraphs provided as background, resulting in a lack of awareness of controller interference from loose articles. The pilot was found to be using the camera while on the flight deck, likely due to boredom on the highly automated plane. (Analysis of the camera and flight recordings provided evidence.) The pilot was court-martialed for “negligently performing a duty, perjury and making a false record”, presumably at least partially due to the use of a personal camera while solo on the flight deck.

The report provided many recommendations as a result of the investigation, including increasing seat belt use by passengers and crew during rest periods, which would have reduced some of the injuries caused by unrestrained personnel striking the ceiling of the aircraft. Recommendations also included ensuring manufacturer’s safety advice is included in operational documents, promoting awareness of the danger of loose articles, and maximizing use of storage for loose articles, all of which aim to reduce the risk of loose articles contacting control equipment. An additional recommendation is to manage low in-flight pilot workload in an attempt to combat the boredom that can be experienced on long flights.

To view the Problem Outline, Cause Map, and recommendations, please click “Download PDF” above. Or click here to read the Military Aviation Authority’s report.

Train Derails on Track Just Inspected

By Angela Griffith

A train derailment in the Columbia River Gorge near Mosier, Oregon resulted in a fire that burned for 14 hours. The Federal Railroad Administration (FRA) preliminary investigation says the June 3rd derailment was caused by a broken lag bolt which allowed the track to spread, resulting in the 16-car derailment. Although there is only one other known instance of a broken lag bolt causing a train derailment, the FRA determined that the bolt had been damaged for some time, and had been inspected within days of the incident, raising questions about the effectiveness of these inspections.

Determining all the causes of a complex issue such as a train derailment can be difficult, but doing so will provide the widest selection of possible solutions. A Cause Map, or visual root cause analysis, addresses all aspects of the issue by developing cause-and-effect relationships for all the causes based on the impacts to an organization’s goals. We can create a Cause Map based on the preliminary investigation. Additional causes and evidence can be added to the map as more detail is known.

The first step in the Cause Mapping process is to determine the impacts to the organization’s goals. While there were no injuries in this case, the massive fire resulting from the derailment posed a significant risk to responders and nearby citizens, an impact to the safety goal. The release of 42,000 gallons of oil (although much of it was burned off in the fire) is an impact to the environmental goal. The customer service goal is impacted by the evacuation of at least 50 homes and the regulatory goal is impacted by the potential for penalties, although the National Transportation Safety Board (NTSB) has said it will not investigate the incident. The state of Oregon has requested a halt on oil traffic, which would be an impact to the schedule goal. The property goal is impacted by the damage to the train cars, and the labor/ time goal is impacted by the response and investigation.

The analysis, which is the second step in the Cause Mapping process, begins with one of the impacted goals and develops cause-and-effect relationships by asking ‘Why’ questions. In this case, the safety goal is impacted by the high potential for injuries. This is caused by the massive fire, which burned for 14 hours. There may be more than one cause resulting in an effect, such as a fire, which is caused by heat, fuel, and oxygen. The oxygen in this case is from the atmosphere. The heat source is unknown but could have been a spark caused by the train derailment. The fire was fueled by the 42,000 gallons of crude released due to damage to train cars, which were transporting crude from the Bakken oil fields, caused by the derailment.

The derailment of 16 cars of the train was caused by the broken lag bolt. Any mechanical failure, such as a break, results from the stress on that object exceeding the strength of the object. In this case, the stress was caused by the weight of the 94-car train. The length of a train carrying crude oil is not limited by federal regulations. The strength of the bolts was reduced due to previous damage, which was not identified prior to the failure. While the track strength is evaluated every 18 months by the Gauge Restraint Measurement System (GRMS), it did not identify the damage. It’s unclear the last time it was performed.

Additionally, although the track is visually inspected twice a week by the railroad, it is done by vehicle, which would have made the damage harder to spot. The FRA does not require walking inspections. Nor does the FRA inspect or review the railroad’s inspections very often – there are less than 100 inspectors for the 140,000 miles of track across the country. There are only 3 in Oregon.

As a result of the derailment, the railroad has committed to replacing the existing bolts with heavy-duty ones, performing GRMS four times a year, enhanced hyrail inspections and visual track inspections three times a week, and performing walking inspections on lag curves monthly.

The FRA is still evaluating actions against the railroad and is again calling for the installation of advanced electronic brakes, or positive train control (PTC). It has also recommended PTC after other incidents, such as the deaths of two railroad workers on April 3 (see our previous blog) and the derailment in Philadelphia last year that killed 8 (see our previous blog).

To view a one-page PDF of the Cause Mapping investigation, click on “Download PDF” above. Or, click here to read the FRA’s preliminary investigation.

Marauding Monkeys Lead to Electrical Outage in Kenya

By Angela Griffith

One monkey managed to cause an electrical outage for all of Kenya – 4.7 million households and businesses – for 15 minutes to more than 3 hours. In order to determine solutions to prevent this from happening again, a thorough analysis of the problem is necessary. We will look at this issue within a Cause Map, a visual form of root cause analysis.

The first step of any problem-solving method is to define the problem. In the Cause Mapping method, the problem is defined with respect to the organization’s goals. In this case, there were several goals that were impacted. If the organization has a goal of ensuring safety of animals, that goal is impacted due to the risk of a fatality or severe injury to the monkey. (In this case, the monkey was unharmed and was turned over to the wildlife service.) The loss of power to 4.7 million businesses and households is an impact to the customer service goal. The nationwide power outage, which lasted from 15 minutes to over 3 hours, is an impact to the production/ schedule goal. Damage to the transformer is an impact to the property goal, and the time required for response and repair is an impact to the labor/ time goal.

The second step of problem-solving is the analysis. Using the Cause Mapping method, cause-and-effect relationships are developed. One of the impacted goals is used as the first effect. Asking “Why” questions is one way to determine cause-and-effect relationships. However, there may be more than one cause required to produce an effect. In this example, the power outage resulted from a cascading effect on the country’s generators. This cascading effect was caused by the loss of a hydroelectric facility, which provides 20% of the country’s electricity, and the unreliability of the power grid, due to aging infrastructure. All of these causes were required for this scenario: had the country had a more reliable power grid or more facilities so that the country was not so dependent on one, the loss of the hydroelectric site would not have resulted in nationwide outage.

Continuing the analysis, the loss of the hydroelectric facility was caused by an overload when a key transformer at the site was tripped. According to the power company, the trip was caused by a monkey falling onto the transformer. (There is also photographic evidence showing a monkey in the area of the transformer.) In order for the monkey to fall onto the transformer, it had to be able to access the transformer. The monkey in this case is believed to have fallen off the roof. How this occurred is still unclear, because the facility is secured by an electric fence designed specifically for protection against “marauding wild animals”.

The last step of problem-solving is to determine solutions, based on the analysis of this problem. The utility says it is “looking at ways of further enhancing security” at all their power plants. Unfortunately, total protection against outages caused by animals is impossible. In the United States, animal-caused outages are believed to cause at least $18 billion in lost economy every year. Just this May, raccoons caused outages to 40,000 in Seattle and 5,600 in Colorado Springs. This year also saw outages caused by squirrels, snakes, starlings and geese. Other unusual outages include work on a transformer causing an outage with economic loss of $118 million in Arizona (see our blog on this subject) and a woman with a shovel who cut internet service to nearly all of Armenia (see our blog on this subject).

Because power outages due to animals and other issues can’t be completely eliminated, ensuring a robust power grid is important to minimize the impact from and duration of outages. Calls for improvements to the aging infrastructure in Kenya have resulted from this incident, but these kinds of solutions require not only the cooperation of the utilities, but the country as a whole.

To view the problem outline and Cause Map for this incident, please click on “Download PDF” above

Kansas City Interstate Overpass Closed Due to 20′ Crack

By Angela Griffith

A bridge engineer watching a crack (previously described as “tight”) under the Grand Boulevard bridge noticed it had extended to 20′ on May 6, 2016. He immediately ordered the bridge closed, requiring the rerouting of the more than 9,000 vehicles that use the bridge every day. Replacing the bridge is estimated to cost $5 million.

Luckily, due to the quick action of the engineer, there were no injuries or fatalities as could have occurred due to either the bridge catastrophically collapsing while in use, or for motorists on the Interstate below being struck by large chunks of concrete falling from the overpass.

The overpass failure can be addressed in a Cause Map, or visual root cause analysis. The process begins by capturing the what, when and where of the incident (a bridge failure May 6 in Kansas City) and the impacts to the goals. Because there was the potential for injuries, the safety goal is impacted. The re-routing of over 9,000 vehicles a day is an impact to the customer service goal. The closing of the bridge’s overpass/ sidewalks is an impact to the production goal, and the cost of replacing the bridge is an impact to the property/ labor goal.

By beginning with an impacted goal and asking ‘Why’ questions, cause-and-effect relationships that lay out the causes of an incident can be developed. In this case, the impacted goals are caused by the significant damage to the bridge, due to a rapidly spreading crack.

The failure of any material or object, including all or part of a bridge, results from the stress on that object from all sources overcoming the strength of the object. In this case the stress on the bridge was greater than the strength of the bridge. Stress on the bridge results from each pass of a vehicle over the life of the bridge. In this case, 9,300 vehicles a day transit the bridge, which has been in service since 1963.

Stress also results from large trucks traveling over the bridge. The engineers suspect this is what happened, possibly due to an apartment construction project near the bridge. Says Brian Kidwell, an assistant engineer for the Missouri Department of Transportation, “My hunch is a very heavy load went over it. It could have been a totally legal load.” A “hunch” by an experienced professional is included in the Cause Map as a potential cause. This is indicated with a “?” and requires more evidence.

Legal loads on bridges are based on the allowable stress for a bridge’s strength. However, the strength of the bridge can change over the years. It is likely that happened in this case. Previous damage has been noted on the bridge, which also required bracing last month to fix a sagging section. However, the bridge was deemed “adequate” in an inspection eight months ago. Any needed repairs may not have occurred – there’s never enough money for needed infrastructure improvements. It’s also possible that water entered the empty cylinders that make up the part of the span of the bridge (this is called a “sonovoid” design) and they could have filled with water and later frozen, causing damage that can’t be easily seen externally.

For now, more information will be required to determine what led to the bridge failure. At that point, bridges of similar design may face additional inspections, or be replaced on the long waiting list for repairs. For Kansas City, some are taking a broader – and bolder – view and are recommending the older section of the Interstate “loop” be removed altogether.

To view the Cause Map of the bridge failure, click on “Download PDF” above. Or, click here to learn.

Airplane Emergency Instructions: How do you make a work process clear?

By Angela Griffith

What’s wrong with the process above?

This process provides instructions on how to remove the over-wing exit door on an airplane during an emergency.  However, imagine performing this process in an actual emergency.  During the time you spend opening the door, there will probably be people crowded behind you, frantic to get off the plane.  Step 4 indicates that after the door is detached from the plane wall, you should turn around and set the door (which is about 4’ by 2’ and can weigh more than 50 pounds) on the seats behind you.  In most cases, this will be impossible.  This is why emergency exit doors open towards the outside; in an emergency, a crush against the door will make opening the door IN impossible.

Even if it would be possible to place the door on the seat in the emergency exit row, it would likely reduce the safety of passengers attempting to exit.  As discussed, the exit door is fairly large and heavy.  It is likely to be displaced while passengers are exiting the airplane and may end up falling on a passenger, or blocking the exit path.

However, when this process was tested in training, it probably worked fine.  Why? Because it wasn’t an actual emergency, and there probably weren’t a plane full of passengers that really wanted to get out.  This is just another reason that procedures need to be tested in as close to actual situations as possible.  At the very least, any scenario under which the process is to be performed should be replicated as nearly as possible.

Now take a look at this procedure:

It’s slightly better, not telling us to put the removed door on the seat behind us, but instead it doesn’t tell us what to do with the door. Keep in mind that the person performing this procedure’s “training” likely consisted of a 30-second conversation with a flight attendant and that in all probability, the first time he or she will perform the task is during an emergency situation. When testing a procedure, it’s also helpful to have someone perform the procedure who is not familiar with it, with instructions to do only what the procedure says. In this case, that person would end up removing the door . . . and then potentially attempting to climb out of the exit with the door in their hands. This is also not a safe or efficient method of emergency escape.
This procedure provides a much better description of what should be done with the door. The picture clearly indicates that the door should be thrown out of the plane, where it is far less likely to block the exit or cause passenger injury.

The first two procedures were presumably clear to the person who created them.  But had they been tested by people with a variety of experience levels (particularly important in this case, because people of various experience levels may be required to open the doors in an emergency), the steps that really weren’t so clear may have been brought to light.

Reviewing procedures with a fresh eye (or asking someone to perform the procedure under safe conditions based only upon the written procedure) may help to identify steps that aren’t clear to everyone, even if they were to the writer.  This can improve both the safety, and the effectiveness, of any procedure used in your organization.

8 Injured by Arresting Cable Failure on Aircraft Carrier

By Angela Griffith

An aircraft carrier is a pretty amazing thing. Essentially, it can launch planes from anywhere. But even though aircraft carriers are huge, they aren’t big enough for planes to take off or land in a normal method. The USS Dwight D. Eisenhower (CVN 69) has about 500′ for landing planes. In order for planes to be able to successfully land in that distance, it is equipped with an arresting wire system, which can stop a 54,000 lb. aircraft travelling 150 miles per hour in only two seconds and a 315′ landing area. This system consists of 4 arresting cables, which are made of wire rope coiled around hemp. These ropes are very thick and heavy and cause a significant risk to personnel safety if they are parted or detached.

This is what happened on March 18, 2016 while attempting to land an E-2C Hawkeye. An arresting cable came unhooked from the port side of the ship and struck a group of sailors on deck. At least 8 were injured, several of whom had to be airlifted off the ship for treatment. We will examine the details of this incident within a Cause Map, a visual form of root cause analysis.

The first step in any problem investigation is to define the problem. We capture the what, when, and where within a problem outline. Additionally, we capture the impacts to the goals. The injuries as well as the potential for death or even more serious injuries are impacts to the safety goal. Flight operations were shut down for two days, impacting both the mission and production/ schedule goal. The potential of the loss of or (serious damage to) the plane is an impact to the property goal. (In a testament to the skill of Navy pilots, the plane returned to Naval Station Norfolk without any crew injuries to the flight crew or significant damage to the plane.) The response and investigation are an impact to the labor goal. It’s also useful to capture the frequency of these types of incidents.   The Virginian-Pilot reports that there have been three arresting-gear related deaths and 12 major injuries since 1980.

The next step in the problem-solving process is to determine the cause-and-effect relationships that led to the impacted goals. Beginning with the safety goal, the injuries to the sailors resulted from being struck by an arresting cable. When a workplace injury results, it’s also important to capture the personal protective equipment (PPE) that may have impacted the magnitude of the injuries. In this case, all affected sailors were wearing appropriate PPE, including heavy-duty helmets, eye and ear protection. This is a cause of the injuries because had they NOT been wearing PPE, the injuries would have certainly been much more severe, or resulted in death.

The arresting cable struck the sailors because it came unhooked from the port side of the ship. The causes for the detachment of the cable have not been conclusively determined; however, a material failure results from a force on the material that is greater than the strength of the material. In this case the force on the arresting cable is from the landing plane. In this case, the pilot reported the plane “hit the cable all at once”, which could have provided more force than is typical. The strength of the cable and connection may have been impacted by age or use. However, arresting cables are designed to “catch” and slow planes at full power and are only used for a specific number of landings before being replaced.

Other impacted goals can be added to the Cause Map where appropriate (additional relationships may result). In this case, the potential damage to the plane resulted from the landing failure, which was caused by the detachment of the arresting cable AND because the arresting cable is needed to safely land a plane on an aircraft carrier.

The last step of the Cause Mapping process is to determine solutions to reduce the risk of the incident recurring. More investigation is needed to ensure that the cable and connection were correctly installed and maintained. If it is determined that there were issues with the connection and cable, the processes that lead to the errors will be improved. However, it is determined that the cable and connection met design criteria and the detachment resulted from the plane landing at an unusual angle, there may be no changes as a result of this investigation.

It seems unusual that an investigation that resulted in 8 injuries would result in no action items. However, solutions are based on achieving an appropriate level of risk. The acceptable level of risk in the military is necessarily higher than it is in most civilian workplaces in order to achieve desired missions. Returning to the frequency from the outline, these types of incidents are extremely rare. The US Navy currently has ten operational aircraft carrier (and an eleventh is on the way). These carriers launch thousands of planes each year yet over the last 36 years, there have been only 3 deaths and twelve major injuries associated with landing gear failures, performing a dangerous task in a dangerous environment. Additionally, in this case, PPE was successful in ensuring that all sailors survived and limiting injury to them.

To view the outline and Cause Map of this event, click on “Download PDF” above.

 

Track Workers Killed by Train

By Angela Griffith

A derailment and the fatalities of two railroad workers on April 3, 2016 has led to an investigation by the National Transportation Safety Board (NTSB). In this investigation, the NTSB will address the impacts of the accident, determine what caused the accident and will provide recommendations to prevent similar accidents from recurring. While the investigation is still underway, a wealth of information related to the accident is already available to begin the analysis. We will look at what is currently known regarding the accident in a Cause Map, a visual form of root cause analysis.

The first step of the analysis is to define the problem. This includes the what, when, and where of the incident, as well as the impacts to the organizational goals. Capturing the impacts to the goals is particularly important because the recommendations that will result from the analysis aim to reduce these impacts. If we define the problem as simply a “derailment”, recommendations may be limited to those that prevent future derailments. Not only are we looking for recommendations to prevent future derailments, we are looking for recommendations to prevent all the impacted goals. In this case, that includes worker safety: 2 workers died, public safety: 37 passengers were injured, customer service: the train derailed, property: the train and some construction equipment was damaged, and labor: response and investigation are required.

The analysis is performed by beginning with the impacted goals and developing the cause-and-effect relationships that led to those impacts. Asking “why” questions can help to identify some of the cause-and-effect relationships, but there may be more than one cause that results in an effect. In this case, the worker fatalities occurred because the train struck heavy equipment and the workers were in/on/near the equipment. Both of these causes had to occur for the effect to result. The workers were on the equipment performing routine maintenance. In addition, their watch was ineffective. When capturing causes, it’s important to also include evidence, which validates the cause.

We know the watch was ineffective, because federal regulation requires a watch for incoming trains that gives at least a fifteen second warning. Fifteen seconds should have been sufficient time for the workers to exit the equipment. Because this did not happen, it follows that the watch was ineffective.

The train struck the heavy equipment because the equipment was on track 3, the train was on track 3, and the train was unable to brake in time. It’s unclear why the heavy equipment was on the track; rail safety experts say heavy equipment should never be directly on the track. The train was on track 3 because it was allowed on the track. Work crews are permitted to shut off the current to preclude passage of trains into the work zone, but they did not in this case, for reasons that are still being investigated. Additionally, the dispatcher allowed the train onto the track. Per federal regulations, when workers are on the track, train dispatchers may not allow trains on track until roadway worker gives permission. It appears that in this case the workers either failed to secure permission to work on the track (thus notifying the dispatcher of their presence) or the work notification was improperly cancelled, allowing trains to return to the track, possibly due to a miscommunication between the night and day crews. This is also still under investigation.

While inspection of the cars and maintenance records found no anomalies, the braking system is under investigation to determine whether or not it affected the train’s ability to brake. Also under investigation is the Positive Train Control (PTC), which should have emitted warnings and slowed the train automatically. However, the supplemental shunting device, which alerts the signaling system that the track is occupied, and is required by Amtrak rules, was not in place. Whether this was sufficient to prevent the PTC from stopping the train in time is also under investigation. The conductor placed the train in emergency mode 5 seconds before the collision. As the train was traveling at 106 mph (the speed limit was 110 mph in the area), this did not give adequate time to brake. There should have been a flagman to notify the train that a crew was on the track, but was not. The flagman also carries an air horn, which provides another notification to the track crew that a train is coming.

Says Ashley Halsey III, reporting in The Washington Post, “Basic rules of railroading and federal regulations should have prevented the Amtrak derailment near Philadelphia on Sunday that killed two maintenance workers.” It appears that multiple procedural requirements were not followed, but more thorough investigation is required to determine why and what can be done in the future to improve safety by preventing derailments and worker fatalities.

To view the available information in a Cause Map, please click “Download PDF” above.

Don’t Just Google It . . . Maps Error Leads to Wrong House Being Demolished

By Angela Griffith

Imagine coming “home” and finding an empty lot. That’s what happened in Rowlett, Texas on March 22, 2016. A tornado had previously damaged many of the homes in the area; some were slated for repairs, and some for demolition. The demolition company had plans to level the duplex at 7601 Cousteau Drive, but instead demolished the duplex at 7601 Calypso Drive.

An error on Google Maps has been blamed for the mistake but, as is typical with these types of incidents, there’s more to it than that. To ensure that all the causes leading to an incident are identified and addressed, it’s important to methodically analyze the issue. Creating a Cause Map, a form of root cause analysis that creates a map of cause-and-effect relationships is one way a problem can be analyzed.

The first step in the Cause Mapping process is to capture the what, when and where of an incident. Along with the geographic (where the incident occurred) and process location (what was being done at the time), it can be helpful to capture any differences about the situation surrounding the incident. In this case, “differences” would be anything out of the ordinary during the demolishing of the house at 7601 Cousteau/Calypso. The error on Google Maps (which pointed to the house which was mistakenly demolished) is one difference. Another difference is that the name of the street was not checked during the location confirmation. Other potential differences between this demolish job and other demolish jobs were that the same house number was present on both streets, in close proximity, and both houses experienced tornado damage. These differences may or may not be causally related – at this point, potential differences are just captured.

The next step is to capture the impacts to the organization’s goals as a result of the incident. These impacts to the goals become the first effects in the cause-and-effect relationships. In this case, there’s a potential for injuries (an impact to the safety goal) as a result of an unexpected demolition. The demolition of a house planned to be repaired is an impact to the environmental, customer service, and property goals. The demolition of the wrong house is an impact to the production/ schedule and labor/time goals.

The analysis begins with one of the impacted goals. Asking “why” questions develops cause-and-effect relationships. For example, the demolition of the wrong house was caused by the duplex at 7601 Calypso Drive being demolished while the duplex at 7601 Cousteau was planned for demolition. Because both of these facts (which can be verified with evidence) resulted in the wrong house being demolished, they are both connected to the cause of ‘demolition of wrong house” and joined with an “AND”.

Each cause on the map is also an effect. More detail can be added to the Cause Map by continuing to ask “why” questions. However, one cause may not be sufficient to result in an effect, so questions such as “what else was required?” are also necessary to ensure all causes are present on the map. In this case, the crew went to the wrong house because of an error on Google Maps, which was used to find the house. Per a Google spokeswoman, 7601 Cousteau was shown at the location of 7601 Calypso. This error has been identified as “the cause” of the incident. However, there were other opportunities to catch the error. Opportunities that were missed are also causes in the cause-and-effect relationship. While there was a site confirmation prior to demolition, only the street number (7601), lot location (corner lot), and tornado damage were confirmed. All three of these data points used to confirm the location were the same for 7601 Cousteau and 7601 Calypso.

What hasn’t been mentioned in the news but is apparent from looking at a (corrected) Google Map is that the house-numbering scheme of the neighborhood was set up for failure. 7601 Calypso is on the corner of Calypso Drive and Cousteau Drive, meaning a person could easily believe it was 7601 Cousteau. 7601 Cousteau is just a block away, on the corner of Cousteau Drive and an apparently unnamed alley. I can’t imagine it is the first time that someone has confused the two.

While it’s too late for 7601 Calypso Drive, Google Maps has fixed the error. Likely in the future this demolition company will use another identifier (or will mark the house while talking to the homeowners prior to the demolition) to ensure that the wrong house is not destroyed.

To view the Cause Map, as well as the updated Google Map, click on “download PDF” above.

Crane Collapse In High Winds Kills One in NYC

By Angela Griffith

A crane collapsed in New York City on February 5, 2016 killing one, injuring three, and damaging two city blocks. While an investigation is underway and the causes of the crane collapse have not yet been determined, the city has already implemented new rules to make crane operations safer. We can examine the potential cause-and-effect relationships that led to the issue in a Cause Map, or visual root cause analysis.

We begin by capturing the what, when and where of the incident within a problem outline. The crane collapse occurred February 5 at about 8:30 a.m. Anything that is different or unusual at the time of an incident should also be noted on the outline and an important difference on February 5 was the accelerating winds. The crane that collapsed was a crawler crane, and at the time of the collapse, workers were in the process of securing the crane because of the high winds. This was as expected. Says New York City Mayor Bill de Blasio, “The workers on Friday morning did not begin work on the site, but immediately seeing the winds, made the move to secure the crane, so their timing was appropriate. Upon arrival, they immediately determined the need to secure the crane.”

The impact to the goals as a result of the incident are also captured in the problem outline. In this case, the safety goal was impacted due to the death, as well as injuries. The environmental goal was impacted by water leaks resulting from damage. Customer service (looking at the citizens of New York City as customers) is impacted due to closures. Production is impacted because 418 additional cranes were secured as a result of the incident. Property impacts includes damage to the crane, as well as two city blocks. The labor goal was impacted because of the time required for the response and removal of the damaged crane. It’s also important to capture the frequency of similar events. OSHA reports it has investigated 13 fatal crane accidents in the last 5 years. (There was a crane collapse in New York City in 2008 that resulted in 4 deaths. Click here to see our previous blog on this topic.)

Once the impacts to the goals have been captured, the analysis begins with one of these goals, which is an effect. Asking “why” questions allows the development of cause-and-effect relationships. In this case, the fatality and injuries resulted from the collapse of a crane. It also resulted from people being in the area of the crane collapse. Both of these causes are required (the fatality and injuries would not have occurred if the crane had not collapsed, or if people had not been in the area) so they are listed vertically and joined with “AND”.

People were in the area where the crane collapsed because the area was inadequately secured. This is likely because construction workers were responsible for securing the area, as well as securing the crane. The reasons for the crane collapse are unknown. However, the investigation will look at human error, structural and equipment problems, and impacts from high winds. While the cause has not been determined, it is considered likely that the wind played a role. The crane was not yet secured, as the workers were in the process of attempting to secure it. It was not required to be secured because city regulations limit operation of cranes when wind is above 30 miles per hour(mph), or if there are gusts greater than 40 mph. The crane operators were working under a limit of 25 mph, as sometimes manufacturers use stricter limits. The forecast did not indicate that winds would be greater than 25 mph that day.

As a result of the incident, Mayor de Blasio put into place immediate and temporary rules regarding crane operation. These rules will be in place until a task force provides updated recommendations within 90 days. Uniformed personnel will assist with enforcing closures associated with crane use. Crane operations are limited to wind speeds less than 30 mph (or gusts up to 40 mph). A city sweep and increased fines were also put into place to ensure the updated regulations are followed.

To view a one-page overview of the Outline, Cause Map and interim solutions, click on “Download PDF”.

Flammable Siding Fuels High Rise Hotel Fire

By Angela Griffith

A fire on New Year’s in Dubai has raised concern with similar building materials across the world. Around 9:30 pm on December 31, 2015, a fire started at a 63-story hotel. The fire quickly spread along the outside of the building. There were no reported fatalities but at least 14 were injured.

Performing a thorough root cause analysis for one specific incident can develop solutions for similar incidents around the world. These types of fires are becoming increasingly common – there have been 8 in the last two decades in Dubai alone. Similar fires have occurred in China, Azerbaijan, and Australia over recent years. We can investigate the causes the led to the New Year’s fire in Dubai by using the Cause Mapping method, a visual form of root cause analysis.

Our analysis begins by capturing the what, when and where of an incident as well as the impacts to the organization’s goals. In this case, the safety goal is impacted due to the injuries. The environmental goal is impacted due to the significant amount of smoke released, and the customer service goal is impacted because of the evacuation. Additional goals impacted include the property damage to the hotel and the labor/time associated with response and repairs.

Beginning with the impact to the safety goal, we can ask “why” questions to capture the cause-and-effect relationships that led to the injuries. In this case, the injuries resulted from an extensive fire that spread up the side of the hotel. An extensive fire requires both initiation and spread. Both the initiation and spread result from heat, fuel and oxygen. The oxygen in both cases was provided by the atmosphere. The heat source for the initiation is believed to be either from exposed wiring (per the local police chief and shown in photographs from before the incident), or a short circuit in a lamp (reported by some news sources). Because it has not been definitively determined, we put a “?” after each cause, and join them with “OR”. The fuel source for the initiation has been reported as curtains. Flammable liquid was also a potential cause but has been ruled out by the police chief.

A burning fire provides heat, so it will continue to burn as long as oxygen and fuel are present. The fuel that allowed the rapid spread of the fire is flammable cladding used as siding. This siding is made of two thin pieces of aluminum surrounding a foam core. Foam cores made primarily of polyethylene are highly flammable. This type of cladding is used because it is considered to provide a modern look, allows dust to be rinsed off during rains, and is relatively simple and cheap to install. While the foam core can be made of flame-resistant materials, this was not required for this building. After a similar fire in Dubai in 2012, new regulations banned the use of flammable material as cladding, but existing buildings (including this hotel) were not required to be retrofitted. The cladding was installed continuously, which allowed the fire to rapidly climb up the side of the building.

While electrical faults that can act as heat sources should be repaired as quickly as possible, the flammability of the materials used on high-rise buildings with multiple potential heat and fuel sources (and a nearly unlimited supply of oxygen) have raised significant concern, not only about this hotel or Dubai, but about buildings with similar cladding around the world. Says Peter Rau, the chief officer of Melbourne, Australia’s Metropolitan Fire Brigade (where a similar fire broke out in November 2014), “You know you’ve only got to step back a little bit further and say: ‘What does it mean for Australia and what does it mean (when) you’re talking to me from Dubai? This is a significant issue worldwide, I would suggest . . . There is no question this is a game changer.”